@oxyhq/core 5.2.1 → 5.4.0

package/dist/cjs/utils/ssoBounce.js

@@ -142,18 +142,18 @@ function ssoPriorSessionKey(origin) {
  * per-tab `sessionStorage` the loop-breaker keys use — it must survive a reload.
  *
  * It exists purely to suppress AUTOMATIC silent restore after a deliberate
- * sign-out: a still-live IdP session (the central `fedcm_session` / the FedCM
- * credential association) would otherwise let `fedcm-silent` / the per-apex
- * `/auth/silent` iframe re-mint a session on the very next cold boot, so a user
- * who pressed "Sign out" gets silently signed back in on reload. With this flag
- * set, those silent cold-boot steps are skipped while the Gmail-style
- * returning-account fast-path is otherwise preserved.
+ * sign-out: a still-live IdP session (the central `fedcm_session`) would
+ * otherwise let the per-apex `/auth/silent` iframe re-mint a session on the
+ * very next cold boot, so a user who pressed "Sign out" gets silently signed
+ * back in on reload. With this flag set, that silent cold-boot step is
+ * skipped while the Gmail-style returning-account fast-path is otherwise
+ * preserved.
  *
  * Lifecycle (mirrors the existing gate machinery — set on a definitive event,
  * cleared on its inverse):
  *   - SET on EXPLICIT full sign-out (alongside clearing the prior-session hint
  *     and the SSO bounce state).
- *   - CLEARED on ANY deliberate sign-in (password, FedCM, account switch, device
+ *   - CLEARED on ANY deliberate sign-in (password, account switch, device
  *     claim) so a real sign-in fully re-enables silent restore — there is no
  *     "stuck signed out" state.
  *
@@ -297,8 +297,8 @@ function guardActive(storage, origin, now = Date.now()) {
  * Whether AUTOMATIC silent restore is SUPPRESSED for this origin because the
  * user deliberately signed out (the durable {@link ssoSignedOutKey} flag).
  *
- * When `true`, the silent cold-boot steps that can re-mint a session from a
- * still-live IdP session WITHOUT user intent — `fedcm-silent` and the per-apex
+ * When `true`, the silent cold-boot step that can re-mint a session from a
+ * still-live IdP session WITHOUT user intent — the per-apex
  * `/auth/silent` iframe — MUST be skipped, so a user who pressed "Sign out" is
  * not silently signed back in on the next reload. Interactive sign-in clears the
  * flag, so this never blocks a deliberate re-sign-in.

package/dist/cjs/utils/ssoEstablish.js

@@ -0,0 +1,110 @@
+"use strict";
+/**
+ * Post-claim durable-session establish hop (web device-flow / "Sign in with
+ * Oxy" QR).
+ *
+ * A WEB device-flow claim (`claimSessionByToken`) plants only IN-MEMORY tokens:
+ * unlike a redirect/FedCM/silent sign-in, it never causes the IdP to plant a
+ * `fedcm_session` cookie. So a reload has nothing to restore from — the
+ * silent-iframe and `/sso` paths find no IdP session and the session is lost.
+ *
+ * This primitive closes that gap. AFTER the claim has committed and the session
+ * has been durably persisted, it performs ONE top-level establish hop through
+ * the RP's own per-apex IdP host (`auth.<rp-apex>`), reusing the EXISTING
+ * `/sso/establish` endpoint: the server mints a short-lived, host+audience-bound
+ * establish-token and returns a fully-formed establish URL; navigating to it
+ * plants the durable first-party `fedcm_session` cookie and bounces back to the
+ * RP callback with an opaque code the standard `sso-return` cold-boot step
+ * exchanges.
+ *
+ * It reuses the SAME per-origin `sessionStorage` bounce contract
+ * (`ssoStateKey` / `ssoGuardKey` / `ssoDestKey`) that {@link buildSsoBounceUrl}
+ * primes for the terminal `/sso` bounce, so the post-bounce `sso-return` step
+ * (`consumeSsoReturn`) validates the CSRF `state`, exchanges the code, and
+ * restores the user's real destination with no extra wiring.
+ *
+ * Contract:
+ *  - WEB only — off-web / native it is a no-op returning `false`.
+ *  - NEVER fires while sitting on the central IdP origin (that would loop the
+ *    IdP against itself).
+ *  - Bounce state is persisted ONLY after the establish-URL request succeeds, so
+ *    a failed request leaves no stale state behind.
+ *  - SINGLE attempt: the caller invokes this exactly once per successful claim.
+ *    On ANY failure it does NOT navigate and returns `false`, leaving the
+ *    committed in-memory session exactly as-is (the user is no worse off than
+ *    before this hop existed).
+ *  - Total: never throws. Failures are reported via {@link deps.onError} only.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.establishIdpSessionAfterClaim = establishIdpSessionAfterClaim;
+const ssoBounce_1 = require("./ssoBounce");
+const OxyServices_sso_1 = require("../mixins/OxyServices.sso");
+/**
+ * Perform the post-claim establish hop. Returns `true` when a navigation to the
+ * establish URL was initiated (the document is being torn down and replaced by
+ * the IdP), `false` on every no-op / failure path.
+ *
+ * @param client - The exchange surface (`oxyServices.requestSsoEstablishUrl`).
+ * @param deps - Injectable web seams; see {@link EstablishAfterClaimDeps}.
+ */
+async function establishIdpSessionAfterClaim(client, deps = {}) {
+    const isWeb = deps.isWeb ??
+        (() => typeof window !== 'undefined' &&
+            typeof window.sessionStorage !== 'undefined');
+    if (!isWeb()) {
+        return false;
+    }
+    const storage = deps.storage ?? window.sessionStorage;
+    const location = deps.location ?? window.location;
+    const navigate = deps.navigate ?? ssoBounce_1.ssoNavigate;
+    const generateState = deps.generateState ?? OxyServices_sso_1.generateSsoState;
+    const now = deps.now ?? (() => Date.now());
+    const origin = location.origin;
+    // Never establish while sitting on the central IdP itself — that would bounce
+    // the IdP against itself. (The device-flow claim can only happen on an RP.)
+    if ((0, ssoBounce_1.isCentralIdPOrigin)(origin)) {
+        return false;
+    }
+    const state = generateState();
+    let establishUrl;
+    try {
+        const result = await client.requestSsoEstablishUrl(origin, state);
+        if (!result ||
+            typeof result.establishUrl !== 'string' ||
+            result.establishUrl.length === 0) {
+            return false;
+        }
+        establishUrl = result.establishUrl;
+        // Defense-in-depth before a TOP-LEVEL navigation: the establish URL is
+        // server-formed, but never follow anything that is not a well-formed https
+        // `/sso/establish` on an `auth.` host. A malformed or unexpected URL aborts
+        // silently (no navigation, no state persisted) — same total/no-throw
+        // contract — rather than navigating the document somewhere unintended.
+        let parsedEstablishUrl;
+        try {
+            parsedEstablishUrl = new URL(establishUrl);
+        }
+        catch {
+            return false;
+        }
+        if (parsedEstablishUrl.protocol !== 'https:' ||
+            parsedEstablishUrl.pathname !== '/sso/establish' ||
+            !parsedEstablishUrl.hostname.toLowerCase().startsWith('auth.')) {
+            return false;
+        }
+        // Persist the bounce state ONLY now that the request has succeeded and the
+        // URL is validated — so a failed/rejected request never leaves stale state
+        // behind. This is the exact contract the terminal `/sso` bounce primes via
+        // `buildSsoBounceUrl`, so the post-bounce `sso-return` step (`consumeSsoReturn`)
+        // validates `state`, exchanges the returned code, and restores the dest.
+        storage.setItem((0, ssoBounce_1.ssoStateKey)(origin), state);
+        storage.setItem((0, ssoBounce_1.ssoGuardKey)(origin), String(now()));
+        storage.setItem((0, ssoBounce_1.ssoDestKey)(origin), location.href);
+    }
+    catch (error) {
+        deps.onError?.(error);
+        return false;
+    }
+    navigate(establishUrl);
+    return true;
+}