@oxyhq/core 5.2.0 → 5.3.0

package/dist/cjs/session/createSessionClient.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSessionClient = createSessionClient;
+const SessionClient_1 = require("./SessionClient");
+const sessionClientHost_1 = require("./sessionClientHost");
+/**
+ * Wires a `SessionClient` over the given `OxyServices` instance: builds the
+ * `SessionClientHost` adapter and passes it through together with a
+ * caller-supplied `TokenTransport`.
+ *
+ * The transport is a required parameter (not constructed here) because it is
+ * the one piece of this integration that is NOT platform-agnostic: `services`
+ * branches native (shared-keychain sign-in) vs. web (silent sign-in), while
+ * `auth-sdk` is web-only. Each consumer builds its own transport and passes
+ * it in; this factory only wires the platform-agnostic parts (host + client)
+ * so neither consumer re-implements them.
+ *
+ * The host is returned alongside the client (not just the client) so the
+ * caller can call `host.setCurrentAccountId(...)` as the active account
+ * changes.
+ */
+function createSessionClient(oxyServices, transport) {
+    const host = (0, sessionClientHost_1.createSessionClientHost)(oxyServices);
+    const client = new SessionClient_1.SessionClient(host, { transport });
+    return { client, host };
+}

package/dist/cjs/session/projectSessionState.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deviceStateToClientSessions = deviceStateToClientSessions;
+exports.activeSessionIdOf = activeSessionIdOf;
+exports.activeUserOf = activeUserOf;
+exports.accountIdsOf = accountIdsOf;
+/**
+ * Pure projection helpers: `DeviceSessionState` (the device-scoped
+ * multi-account session-sync state produced by `SessionClient`) -> the
+ * shapes consumers (`@oxyhq/services`, `@oxyhq/auth`) render today
+ * (`ClientSession[]`, an active session id, an active `User`).
+ *
+ * No I/O. The caller fetches profiles via
+ * `oxyServices.getUsersByIds(accountIdsOf(state))` and builds `usersById`
+ * from the result before calling `deviceStateToClientSessions` /
+ * `activeUserOf`.
+ */
+/**
+ * Maps every `SessionAccount` in `state.accounts` to a `ClientSession`.
+ *
+ * `DeviceSessionState` carries no per-account `expiresAt` / `lastActive` —
+ * both are set to `state.updatedAt` (converted to an ISO-8601 string; the
+ * wire value is an epoch-ms number) as a provisional value.
+ *
+ * `usersById` is accepted for signature symmetry with `activeUserOf` even
+ * though `ClientSession` only stores `userId` — a session is still
+ * projected for an account whose id is absent from `usersById` (no
+ * placeholder user is fabricated).
+ */
+function deviceStateToClientSessions(state, usersById) {
+    const provisionalTimestamp = new Date(state.updatedAt).toISOString();
+    return state.accounts.map((account) => ({
+        sessionId: account.sessionId,
+        deviceId: state.deviceId,
+        // provisional: expiresAt/lastActive are not carried on DeviceSessionState
+        expiresAt: provisionalTimestamp,
+        lastActive: provisionalTimestamp,
+        userId: account.accountId,
+        isCurrent: account.accountId === state.activeAccountId,
+        authuser: account.authuser,
+    }));
+}
+/**
+ * The active account's `sessionId`, or `null` when there is no state or no
+ * active account is set.
+ */
+function activeSessionIdOf(state) {
+    if (state === null || state.activeAccountId === null) {
+        return null;
+    }
+    const activeAccountId = state.activeAccountId;
+    const activeAccount = state.accounts.find((account) => account.accountId === activeAccountId);
+    return activeAccount?.sessionId ?? null;
+}
+/**
+ * The active account's `User`, resolved from `usersById`. `null` when there
+ * is no state, no active account is set, or the active account id is absent
+ * from `usersById`.
+ */
+function activeUserOf(state, usersById) {
+    if (state === null || state.activeAccountId === null) {
+        return null;
+    }
+    return usersById.get(state.activeAccountId) ?? null;
+}
+/**
+ * All account ids in `state`, suitable for an `oxyServices.getUsersByIds(...)`
+ * fetch. `[]` for `null` state.
+ */
+function accountIdsOf(state) {
+    if (state === null) {
+        return [];
+    }
+    return state.accounts.map((account) => account.accountId);
+}

package/dist/cjs/session/sessionClientHost.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSessionClientHost = createSessionClientHost;
+/**
+ * Thin `SessionClientHost` adapter over an `OxyServices` instance.
+ *
+ * `SessionClient` is host-agnostic: it only needs a REST + token surface.
+ * `OxyServices` already exposes all of that except `getCurrentAccountId`,
+ * which has no direct equivalent — the adapter holds a mutable ref set by
+ * the caller (`OxyContext` in `@oxyhq/services`, `WebOxyProvider` in
+ * `@oxyhq/auth`) via `setCurrentAccountId`.
+ *
+ * Shared here (rather than duplicated per consumer) because it is entirely
+ * platform-agnostic: every method it calls exists identically on
+ * `OxyServices` regardless of host (web, Expo/RN, Node).
+ */
+function createSessionClientHost(oxyServices) {
+    let currentAccountId = null;
+    return {
+        makeRequest: (method, url, data, options) => oxyServices.makeRequest(method, url, data, options),
+        getBaseURL: () => oxyServices.getBaseURL(),
+        getAccessToken: () => oxyServices.getAccessToken(),
+        onTokensChanged: (listener) => oxyServices.onTokensChanged(listener),
+        setTokens: (accessToken) => oxyServices.setTokens(accessToken),
+        getCurrentAccountId: () => currentAccountId,
+        setCurrentAccountId: (id) => {
+            currentAccountId = id;
+        },
+    };
+}

package/dist/cjs/session/socketLoader.js

@@ -0,0 +1,55 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getSocketIO = getSocketIO;
+const loggerUtils_1 = require("../utils/loggerUtils");
+let cachedFactory = null;
+let loadAttempted = false;
+async function getSocketIO() {
+    if (cachedFactory)
+        return cachedFactory;
+    if (loadAttempted)
+        return null;
+    loadAttempted = true;
+    try {
+        const mod = (await Promise.resolve().then(() => __importStar(require('socket.io-client'))));
+        cachedFactory = mod.io ?? mod.default ?? null;
+        return cachedFactory;
+    }
+    catch (error) {
+        loggerUtils_1.logger.warn('[SessionClient] socket.io-client import failed; realtime session sync disabled', { component: 'SessionClient' }, error);
+        return null;
+    }
+}

package/dist/cjs/utils/cache.js

@@ -206,6 +206,8 @@ function registerCacheForCleanup(cache) {
                 cache.cleanup();
             }
         }, 60000); // Every minute
+        // Never block process/worker exit on a housekeeping timer.
+        cleanupInterval.unref?.();
     }
 }
 /**

package/dist/cjs/utils/ssoBounce.js

@@ -142,18 +142,18 @@ function ssoPriorSessionKey(origin) {
  * per-tab `sessionStorage` the loop-breaker keys use — it must survive a reload.
  *
  * It exists purely to suppress AUTOMATIC silent restore after a deliberate
- * sign-out: a still-live IdP session (the central `fedcm_session` / the FedCM
- * credential association) would otherwise let `fedcm-silent` / the per-apex
- * `/auth/silent` iframe re-mint a session on the very next cold boot, so a user
- * who pressed "Sign out" gets silently signed back in on reload. With this flag
- * set, those silent cold-boot steps are skipped while the Gmail-style
- * returning-account fast-path is otherwise preserved.
+ * sign-out: a still-live IdP session (the central `fedcm_session`) would
+ * otherwise let the per-apex `/auth/silent` iframe re-mint a session on the
+ * very next cold boot, so a user who pressed "Sign out" gets silently signed
+ * back in on reload. With this flag set, that silent cold-boot step is
+ * skipped while the Gmail-style returning-account fast-path is otherwise
+ * preserved.
  *
  * Lifecycle (mirrors the existing gate machinery — set on a definitive event,
  * cleared on its inverse):
  *   - SET on EXPLICIT full sign-out (alongside clearing the prior-session hint
  *     and the SSO bounce state).
- *   - CLEARED on ANY deliberate sign-in (password, FedCM, account switch, device
+ *   - CLEARED on ANY deliberate sign-in (password, account switch, device
  *     claim) so a real sign-in fully re-enables silent restore — there is no
  *     "stuck signed out" state.
  *
@@ -297,8 +297,8 @@ function guardActive(storage, origin, now = Date.now()) {
  * Whether AUTOMATIC silent restore is SUPPRESSED for this origin because the
  * user deliberately signed out (the durable {@link ssoSignedOutKey} flag).
  *
- * When `true`, the silent cold-boot steps that can re-mint a session from a
- * still-live IdP session WITHOUT user intent — `fedcm-silent` and the per-apex
+ * When `true`, the silent cold-boot step that can re-mint a session from a
+ * still-live IdP session WITHOUT user intent — the per-apex
  * `/auth/silent` iframe — MUST be skipped, so a user who pressed "Sign out" is
  * not silently signed back in on the next reload. Interactive sign-in clears the
  * flag, so this never blocks a deliberate re-sign-in.

package/dist/cjs/utils/ssoEstablish.js

@@ -0,0 +1,110 @@
+"use strict";
+/**
+ * Post-claim durable-session establish hop (web device-flow / "Sign in with
+ * Oxy" QR).
+ *
+ * A WEB device-flow claim (`claimSessionByToken`) plants only IN-MEMORY tokens:
+ * unlike a redirect/FedCM/silent sign-in, it never causes the IdP to plant a
+ * `fedcm_session` cookie. So a reload has nothing to restore from — the
+ * silent-iframe and `/sso` paths find no IdP session and the session is lost.
+ *
+ * This primitive closes that gap. AFTER the claim has committed and the session
+ * has been durably persisted, it performs ONE top-level establish hop through
+ * the RP's own per-apex IdP host (`auth.<rp-apex>`), reusing the EXISTING
+ * `/sso/establish` endpoint: the server mints a short-lived, host+audience-bound
+ * establish-token and returns a fully-formed establish URL; navigating to it
+ * plants the durable first-party `fedcm_session` cookie and bounces back to the
+ * RP callback with an opaque code the standard `sso-return` cold-boot step
+ * exchanges.
+ *
+ * It reuses the SAME per-origin `sessionStorage` bounce contract
+ * (`ssoStateKey` / `ssoGuardKey` / `ssoDestKey`) that {@link buildSsoBounceUrl}
+ * primes for the terminal `/sso` bounce, so the post-bounce `sso-return` step
+ * (`consumeSsoReturn`) validates the CSRF `state`, exchanges the code, and
+ * restores the user's real destination with no extra wiring.
+ *
+ * Contract:
+ *  - WEB only — off-web / native it is a no-op returning `false`.
+ *  - NEVER fires while sitting on the central IdP origin (that would loop the
+ *    IdP against itself).
+ *  - Bounce state is persisted ONLY after the establish-URL request succeeds, so
+ *    a failed request leaves no stale state behind.
+ *  - SINGLE attempt: the caller invokes this exactly once per successful claim.
+ *    On ANY failure it does NOT navigate and returns `false`, leaving the
+ *    committed in-memory session exactly as-is (the user is no worse off than
+ *    before this hop existed).
+ *  - Total: never throws. Failures are reported via {@link deps.onError} only.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.establishIdpSessionAfterClaim = establishIdpSessionAfterClaim;
+const ssoBounce_1 = require("./ssoBounce");
+const OxyServices_sso_1 = require("../mixins/OxyServices.sso");
+/**
+ * Perform the post-claim establish hop. Returns `true` when a navigation to the
+ * establish URL was initiated (the document is being torn down and replaced by
+ * the IdP), `false` on every no-op / failure path.
+ *
+ * @param client - The exchange surface (`oxyServices.requestSsoEstablishUrl`).
+ * @param deps - Injectable web seams; see {@link EstablishAfterClaimDeps}.
+ */
+async function establishIdpSessionAfterClaim(client, deps = {}) {
+    const isWeb = deps.isWeb ??
+        (() => typeof window !== 'undefined' &&
+            typeof window.sessionStorage !== 'undefined');
+    if (!isWeb()) {
+        return false;
+    }
+    const storage = deps.storage ?? window.sessionStorage;
+    const location = deps.location ?? window.location;
+    const navigate = deps.navigate ?? ssoBounce_1.ssoNavigate;
+    const generateState = deps.generateState ?? OxyServices_sso_1.generateSsoState;
+    const now = deps.now ?? (() => Date.now());
+    const origin = location.origin;
+    // Never establish while sitting on the central IdP itself — that would bounce
+    // the IdP against itself. (The device-flow claim can only happen on an RP.)
+    if ((0, ssoBounce_1.isCentralIdPOrigin)(origin)) {
+        return false;
+    }
+    const state = generateState();
+    let establishUrl;
+    try {
+        const result = await client.requestSsoEstablishUrl(origin, state);
+        if (!result ||
+            typeof result.establishUrl !== 'string' ||
+            result.establishUrl.length === 0) {
+            return false;
+        }
+        establishUrl = result.establishUrl;
+        // Defense-in-depth before a TOP-LEVEL navigation: the establish URL is
+        // server-formed, but never follow anything that is not a well-formed https
+        // `/sso/establish` on an `auth.` host. A malformed or unexpected URL aborts
+        // silently (no navigation, no state persisted) — same total/no-throw
+        // contract — rather than navigating the document somewhere unintended.
+        let parsedEstablishUrl;
+        try {
+            parsedEstablishUrl = new URL(establishUrl);
+        }
+        catch {
+            return false;
+        }
+        if (parsedEstablishUrl.protocol !== 'https:' ||
+            parsedEstablishUrl.pathname !== '/sso/establish' ||
+            !parsedEstablishUrl.hostname.toLowerCase().startsWith('auth.')) {
+            return false;
+        }
+        // Persist the bounce state ONLY now that the request has succeeded and the
+        // URL is validated — so a failed/rejected request never leaves stale state
+        // behind. This is the exact contract the terminal `/sso` bounce primes via
+        // `buildSsoBounceUrl`, so the post-bounce `sso-return` step (`consumeSsoReturn`)
+        // validates `state`, exchanges the returned code, and restores the dest.
+        storage.setItem((0, ssoBounce_1.ssoStateKey)(origin), state);
+        storage.setItem((0, ssoBounce_1.ssoGuardKey)(origin), String(now()));
+        storage.setItem((0, ssoBounce_1.ssoDestKey)(origin), location.href);
+    }
+    catch (error) {
+        deps.onError?.(error);
+        return false;
+    }
+    navigate(establishUrl);
+    return true;
+}