@oxyhq/core 5.5.0 → 6.0.0

package/src/utils/__tests__/authWebUrl.test.ts

@@ -1,11 +1,12 @@
 /**
- * `resolveCentralAuthUrl` / `CENTRAL_AUTH_URL` — central IdP resolution.
+ * Central IdP apex/origin constants.
  *
- * Pure helper: an explicit non-empty value always wins; otherwise the central
- * `auth.oxy.so` origin is returned. No DOM, no side effects.
+ * `resolveCentralAuthUrl` was removed in the device-first cutover (the SDK no
+ * longer resolves an IdP host). The `CENTRAL_IDP_APEX` / `CENTRAL_AUTH_URL`
+ * constants survive because the IdP worker imports them to brand assertions.
  */
 
-import { CENTRAL_AUTH_URL, CENTRAL_IDP_APEX, resolveCentralAuthUrl } from '../authWebUrl';
+import { CENTRAL_AUTH_URL, CENTRAL_IDP_APEX } from '../authWebUrl';
 
 describe('CENTRAL_IDP_APEX', () => {
   it('is the central IdP registrable apex', () => {
@@ -23,28 +24,3 @@ describe('CENTRAL_AUTH_URL', () => {
     expect(CENTRAL_AUTH_URL).toBe(`https://auth.${CENTRAL_IDP_APEX}`);
   });
 });
-
-describe('resolveCentralAuthUrl', () => {
-  it('returns the central default when no explicit value is given', () => {
-    expect(resolveCentralAuthUrl()).toBe(CENTRAL_AUTH_URL);
-    expect(resolveCentralAuthUrl(undefined)).toBe('https://auth.oxy.so');
-  });
-
-  it('returns the explicit value when provided (explicit wins)', () => {
-    expect(resolveCentralAuthUrl('https://auth.mention.earth')).toBe(
-      'https://auth.mention.earth',
-    );
-  });
-
-  it('does not read any ambient DOM/window state', () => {
-    // Even with a window installed, the result is purely a function of the arg.
-    (globalThis as unknown as { window: unknown }).window = {
-      location: { hostname: 'mention.earth', protocol: 'https:' },
-    };
-    try {
-      expect(resolveCentralAuthUrl()).toBe('https://auth.oxy.so');
-    } finally {
-      delete (globalThis as Record<string, unknown>).window;
-    }
-  });
-});

package/src/utils/__tests__/fapiAutoDetect.test.ts

@@ -1,133 +1,12 @@
 /**
- * Auto-detect of `auth.<rp-apex>` from `window.location` for the Clerk-style
- * multi-domain FAPI setup. The IdP backend independently derives `iss` and
- * the FedCM manifest from the request host, so the only contract the SDK
- * needs to honour is: build URLs against the same host the page is on,
- * one subdomain over.
+ * `registrableApex` — the eTLD+1 host kernel (Public Suffix List aware).
  *
- * Ported verbatim from packages/auth-sdk/__tests__/utils/fapiAutoDetect.test.ts
- * plus Public Suffix List regression cases that are unique to the core
- * implementation's registrable-apex guard.
+ * The client `autoDetectAuthWebUrl` helper was removed in the device-first
+ * cutover; only the registrable-apex kernel survives (used by the api SSO
+ * surface + the IdP). These cases lock its Public-Suffix-List behaviour.
  */
 
-import { autoDetectAuthWebUrl, registrableApex } from '../fapiAutoDetect';
-
-function loc(hostname: string, protocol = 'https:'): Pick<Location, 'hostname' | 'protocol'> {
-  return { hostname, protocol };
-}
-
-describe('autoDetectAuthWebUrl', () => {
-  describe('returns auth.<apex> for public hostnames', () => {
-    it('derives from the apex itself', () => {
-      expect(autoDetectAuthWebUrl(loc('mention.earth'))).toBe('https://auth.mention.earth');
-    });
-
-    it('strips one leading subdomain', () => {
-      expect(autoDetectAuthWebUrl(loc('www.mention.earth'))).toBe('https://auth.mention.earth');
-      expect(autoDetectAuthWebUrl(loc('app.alia.onl'))).toBe('https://auth.alia.onl');
-    });
-
-    it('strips multiple leading subdomains down to the last two labels', () => {
-      // The heuristic is "last two labels" — fine for our use case because
-      // the IdP itself validates the request host. Deeply-nested hostnames
-      // resolve to the trailing two-label apex.
-      expect(autoDetectAuthWebUrl(loc('deep.app.homiio.com'))).toBe('https://auth.homiio.com');
-    });
-
-    it('honours the request protocol so dev http stays http', () => {
-      expect(autoDetectAuthWebUrl(loc('staging.example.test', 'http:'))).toBe(
-        'http://auth.example.test'
-      );
-    });
-  });
-
-  describe('returns current origin when already on the IdP', () => {
-    it('keeps everything same-origin instead of hopping to a sibling IdP', () => {
-      expect(autoDetectAuthWebUrl(loc('auth.mention.earth'))).toBe('https://auth.mention.earth');
-      expect(autoDetectAuthWebUrl(loc('auth.oxy.so'))).toBe('https://auth.oxy.so');
-    });
-  });
-
-  describe('returns undefined where auto-detect would be wrong', () => {
-    it('skips localhost and 127.0.0.1 (dev)', () => {
-      expect(autoDetectAuthWebUrl(loc('localhost', 'http:'))).toBeUndefined();
-      expect(autoDetectAuthWebUrl(loc('127.0.0.1', 'http:'))).toBeUndefined();
-    });
-
-    it('skips IPv4 literals', () => {
-      expect(autoDetectAuthWebUrl(loc('192.168.1.10'))).toBeUndefined();
-      expect(autoDetectAuthWebUrl(loc('10.0.0.1'))).toBeUndefined();
-    });
-
-    it('skips IPv6 literals (bracketed)', () => {
-      expect(autoDetectAuthWebUrl(loc('[::1]'))).toBeUndefined();
-    });
-
-    it('skips single-label hostnames', () => {
-      expect(autoDetectAuthWebUrl(loc('intranet'))).toBeUndefined();
-    });
-
-    it('skips unknown protocols', () => {
-      expect(autoDetectAuthWebUrl({ hostname: 'mention.earth', protocol: 'file:' })).toBeUndefined();
-      expect(autoDetectAuthWebUrl({ hostname: 'mention.earth', protocol: 'ftp:' })).toBeUndefined();
-    });
-
-    it('skips empty/missing hostnames', () => {
-      expect(autoDetectAuthWebUrl(loc(''))).toBeUndefined();
-    });
-
-    it('returns undefined when no location is available (SSR / non-browser)', () => {
-      expect(autoDetectAuthWebUrl(undefined)).toBeUndefined();
-    });
-  });
-
-  describe('uses the Public Suffix List for registrable apex detection', () => {
-    it('derives from the registrable domain under multi-part public suffixes', () => {
-      expect(autoDetectAuthWebUrl(loc('foo.co.uk'))).toBe('https://auth.foo.co.uk');
-      expect(autoDetectAuthWebUrl(loc('shop.com.au'))).toBe('https://auth.shop.com.au');
-      expect(autoDetectAuthWebUrl(loc('shop.victim.com.tr'))).toBe('https://auth.victim.com.tr');
-    });
-
-    it('derives from the registrable domain under private hosted suffixes', () => {
-      expect(autoDetectAuthWebUrl(loc('honest.github.io'))).toBe('https://auth.honest.github.io');
-      expect(autoDetectAuthWebUrl(loc('app.victim.pages.dev'))).toBe(
-        'https://auth.victim.pages.dev'
-      );
-      expect(autoDetectAuthWebUrl(loc('site.victim.netlify.app'))).toBe(
-        'https://auth.victim.netlify.app'
-      );
-    });
-
-    it('returns undefined for bare public and private suffixes', () => {
-      expect(autoDetectAuthWebUrl(loc('co.uk'))).toBeUndefined();
-      expect(autoDetectAuthWebUrl(loc('github.io'))).toBeUndefined();
-      expect(autoDetectAuthWebUrl(loc('pages.dev'))).toBeUndefined();
-      expect(autoDetectAuthWebUrl(loc('netlify.app'))).toBeUndefined();
-    });
-  });
-
-  // Regression guard: the refactor to delegate host handling to `registrableApex`
-  // must not change any of the pre-existing return values.
-  describe('regression — unchanged values after registrableApex extraction', () => {
-    const cases: Array<[string, string | undefined]> = [
-      ['mention.earth', 'https://auth.mention.earth'],
-      ['www.mention.earth', 'https://auth.mention.earth'],
-      ['deep.app.homiio.com', 'https://auth.homiio.com'],
-      ['auth.oxy.so', 'https://auth.oxy.so'],
-      ['auth.mention.earth', 'https://auth.mention.earth'],
-      ['localhost', undefined],
-      ['192.168.1.10', undefined],
-      ['[::1]', undefined],
-      ['intranet', undefined],
-      ['', undefined],
-      ['foo.co.uk', 'https://auth.foo.co.uk'],
-    ];
-    it.each(cases)('autoDetectAuthWebUrl(%s) === %s', (hostname, expected) => {
-      const protocol = hostname === 'localhost' || hostname === '[::1]' ? 'http:' : 'https:';
-      expect(autoDetectAuthWebUrl(loc(hostname, protocol))).toBe(expected);
-    });
-  });
-});
+import { registrableApex } from '../fapiAutoDetect';
 
 describe('registrableApex', () => {
   it('returns the eTLD+1 for a normal two-label host', () => {

package/src/utils/__tests__/validationUtils.test.ts

@@ -7,6 +7,7 @@ import {
   isValidEmail,
   isValidUsername,
   isValidPassword,
+  isValidDisplayName,
   isValidUUID,
   isValidDate,
   isValidFileSize,
@@ -139,6 +140,35 @@ describe('Validation Utils', () => {
     });
   });
 
+  describe('isValidDisplayName', () => {
+    it('should return true for clean names (letters, spaces, apostrophe)', () => {
+      expect(isValidDisplayName("Renée O'Brien")).toBe(true);
+      expect(isValidDisplayName('Ada Lovelace')).toBe(true);
+      expect(isValidDisplayName('山田太郎')).toBe(true);
+      expect(isValidDisplayName('')).toBe(true); // empty is valid; non-empty enforced elsewhere
+    });
+
+    it('should return false for emoji, symbols, digits, and punctuation', () => {
+      expect(isValidDisplayName('nixCraft \u{1f427}')).toBe(false); // penguin emoji
+      expect(isValidDisplayName('Agent007')).toBe(false);
+      expect(isValidDisplayName('Jean-Luc')).toBe(false);
+      expect(isValidDisplayName('J.R.')).toBe(false);
+    });
+
+    it('should return false for control whitespace (tab/newline/CR)', () => {
+      // \p{Zs} (space separators only) rejects layout-breaking / multi-line
+      // spoofing whitespace that \s would have admitted.
+      expect(isValidDisplayName('Ada\tLovelace')).toBe(false);
+      expect(isValidDisplayName('Ada\nLovelace')).toBe(false);
+      expect(isValidDisplayName('Ada\rLovelace')).toBe(false);
+    });
+
+    it('should return true for Unicode space separators', () => {
+      expect(isValidDisplayName('Ada Lovelace')).toBe(true); // NBSP
+      expect(isValidDisplayName('山田　太郎')).toBe(true); // ideographic space
+    });
+  });
+
   describe('isValidUUID', () => {
     it('should return true for valid UUIDs', () => {
       expect(isValidUUID('123e4567-e89b-12d3-a456-426614174000')).toBe(true);

package/src/utils/accountUtils.ts

@@ -4,7 +4,6 @@
  */
 
 import { translate } from '../i18n';
-import type { RefreshAllAccount } from '../models/interfaces';
 
 export interface QuickAccount {
     sessionId: string;
@@ -178,67 +177,6 @@ export const createQuickAccount = (
     };
 };
 
-/**
- * Merge a fresh `/auth/refresh-all` snapshot into an existing QuickAccount
- * list, preserving any cached fields (`avatarUrl`) for slots that didn't
- * change. The fresh response is canonical: the resulting list contains EXACTLY
- * the slots present in `fresh`, sorted by `authuser` ascending. Stale stored
- * accounts that no longer appear in `fresh` are dropped (the server already
- * authoritatively cleared the corresponding cookie).
- *
- * @param stored Previously persisted QuickAccount list (any order).
- * @param fresh Server's authoritative refresh-all response.
- * @returns Canonical merged list, sorted by `authuser` asc.
- */
-export const mergeAccountsFromRefreshAll = (
-    stored: QuickAccount[] | undefined,
-    fresh: RefreshAllAccount[],
-): QuickAccount[] => {
-    const storedByAuthuser = new Map<number, QuickAccount>();
-    if (stored) {
-        for (const account of stored) {
-            if (typeof account.authuser === 'number') {
-                storedByAuthuser.set(account.authuser, account);
-            }
-        }
-    }
-
-    const merged: QuickAccount[] = fresh.map((entry) => {
-        const previous = storedByAuthuser.get(entry.authuser);
-        // Preserve any previously cached identity for a slot that arrives
-        // without a user shape rather than overwriting it with blanks, and let
-        // AuthManager's getCurrentUser() hydration refresh it on the next
-        // snapshot.
-        const wireUser = entry.user;
-        const username = wireUser?.username ?? previous?.username ?? '';
-        const displayName = getAccountDisplayName({
-            name: wireUser?.name,
-            username,
-        });
-        const avatar = wireUser?.avatar ?? previous?.avatar ?? undefined;
-        const avatarUrl =
-            previous && previous.avatar === avatar ? previous.avatarUrl : undefined;
-        return {
-            sessionId: entry.sessionId,
-            userId: wireUser?.id ?? previous?.userId,
-            username,
-            displayName,
-            avatar,
-            avatarUrl,
-            authuser: entry.authuser,
-            color: wireUser?.color ?? previous?.color ?? null,
-        };
-    });
-
-    merged.sort((a, b) => {
-        const aIdx = a.authuser ?? Number.POSITIVE_INFINITY;
-        const bIdx = b.authuser ?? Number.POSITIVE_INFINITY;
-        return aIdx - bIdx;
-    });
-
-    return merged;
-};
-
 /**
  * Return the account's preferred Bloom color preset, or `null` if it has no
  * preference. Centralises the `color ?? null` normalisation so consumers can

package/src/utils/authWebUrl.ts

@@ -12,9 +12,11 @@
  * `window`/`location`, and has no side effects. It is the single source of
  * truth for the central IdP origin so call sites never hardcode the literal.
  *
- * Note: this is distinct from `autoDetectAuthWebUrl` (per-apex `auth.<rp-apex>`
- * derivation). The central-SSO path deliberately does NOT auto-detect per-apex
- * IdPs — it is central only. An explicitly-configured `authWebUrl` still wins.
+ * LEGACY(old-sdk): the client resolver (`resolveCentralAuthUrl`) was removed in
+ * the device-first cutover; `CENTRAL_IDP_APEX` / `CENTRAL_AUTH_URL` survive ONLY
+ * because the lista-B IdP worker imports them to brand assertions. Deletable
+ * once Homiio/Allo/Alia/Syra are bumped off the old SDK AND CloudWatch
+ * `/oxy/ecs` shows the `/sso*` + `/fedcm/*` routes quiet — F-final sweep.
  */
 
 /**
@@ -31,17 +33,6 @@ export const CENTRAL_IDP_APEX = 'oxy.so';
 /**
  * The canonical central Identity Provider origin for the Oxy ecosystem.
  * No trailing slash. Derived from {@link CENTRAL_IDP_APEX} so the apex and the
- * full origin never drift apart.
+ * full origin never drift apart. The IdP worker imports it to brand assertions.
  */
 export const CENTRAL_AUTH_URL = `https://auth.${CENTRAL_IDP_APEX}`;
-
-/**
- * Resolve the central IdP origin, honouring an explicit override.
- *
- * @param explicit - A caller-supplied auth web URL, or `undefined`/empty to use
- *   the central default. An explicit non-empty value always wins.
- * @returns The explicit value when provided, otherwise {@link CENTRAL_AUTH_URL}.
- */
-export function resolveCentralAuthUrl(explicit?: string): string {
-  return explicit ?? CENTRAL_AUTH_URL;
-}

package/src/utils/fapiAutoDetect.ts

@@ -1,37 +1,17 @@
 /**
- * Auto-detect the FAPI (IdP) URL from the current browser hostname.
- *
- * This is the canonical cross-domain IdP-resolution primitive for the Oxy
- * ecosystem. Both candidate cross-domain SSO designs derive `auth.<rp-apex>`
- * through this helper; do not fork it.
- *
- * Clerk-style multi-domain SSO depends on the IdP being reachable on a
- * subdomain of the RP's own apex (e.g. `auth.mention.earth` CNAMEd to the
- * central Oxy IdP). That way every FedCM endpoint, the session cookie,
- * and any redirect target are same-site with the RP — the only way
- * to get first-party cookies in Safari ITP and Firefox Total Cookie
- * Protection.
- *
- * This helper computes `https://auth.<rp-apex>` from
- * `window.location.hostname` so a consuming app doesn't have to pass
- * `authWebUrl` explicitly. Returns `undefined` for environments where
- * auto-detection would be wrong:
- *
- *   - SSR / non-browser (no `window`).
- *   - `localhost`, `127.0.0.1`, IPv4/IPv6 literals.
- *   - Hostnames with fewer than two labels.
- *   - Hostnames where a registrable domain cannot be determined from the
- *     Public Suffix List, including private hosted suffixes such as
- *     `github.io`, `pages.dev`, and `netlify.app`.
- *
- * When the page is already loaded ON the IdP itself (`auth.<anything>`),
- * the helper returns the current origin so the SDK keeps everything
- * same-origin instead of hopping to a different IdP host.
- *
- * The IdP backend independently derives `iss`, `provider_urls`, and the
- * `fedcm.json` icon URLs from the request host
- * (`packages/auth/server/index.ts`), so an honest CNAME pair is all that
- * is required for end-to-end FedCM correctness — no per-RP config.
+ * Registrable-apex (eTLD+1) host kernel.
+ *
+ * The client FAPI auto-detection helper (`autoDetectAuthWebUrl`) was removed in
+ * the device-first cutover — the SDK no longer derives a per-apex `auth.<rp>`
+ * IdP host. What survives is the pure registrable-domain kernel, still used by
+ * the api SSO surface, `fedcm.service`, `deviceAuth` (same-apex trust checks),
+ * and the IdP worker (all lista B / server-side). `@oxyhq/core/server`
+ * re-exports it for the api.
+ *
+ * LEGACY(old-sdk): `registrableApex` survives ONLY for the lista-B server/IdP
+ * SSO surface. Deletable once Homiio/Allo/Alia/Syra are bumped off the old SDK
+ * AND CloudWatch `/oxy/ecs` shows the `/sso*` + `/fedcm/*` routes quiet — the
+ * F-final sweep should remove this file then.
  */
 
 import { getDomain } from 'tldts';
@@ -40,10 +20,8 @@ import { getDomain } from 'tldts';
  * Compute the bare registrable apex (eTLD+1) of a hostname using the Public
  * Suffix List, including private hosted suffixes.
  *
- * This is the pure host-handling kernel shared by {@link autoDetectAuthWebUrl}
- * and the IdP worker — it performs NO protocol handling, NO `auth.` prefixing,
- * and builds NO URL. It only answers "what is the registrable domain of this
- * host, or is that undefinable?".
+ * Performs NO protocol handling and builds NO URL — it only answers "what is
+ * the registrable domain of this host, or is that undefinable?".
  *
  * Returns `null` (apex undefinable) for:
  *   - empty input;
@@ -64,28 +42,6 @@ export function registrableApex(hostname: string): string | null {
   if (host.startsWith('[') || host.includes(':')) return null;
   // The Public Suffix List (private suffixes included) is the source of truth
   // for what an attacker can register. A multi-part public suffix like `co.uk`
-  // or a hosted suffix like `github.io` returns no registrable domain, so
-  // deriving `auth.<apex>` against it is impossible — `getDomain` returns null.
+  // or a hosted suffix like `github.io` returns no registrable domain.
   return getDomain(host, { allowPrivateDomains: true });
 }
-
-export function autoDetectAuthWebUrl(
-  location: Pick<Location, 'hostname' | 'protocol'> | undefined =
-    typeof window !== 'undefined' ? window.location : undefined
-): string | undefined {
-  if (!location) return undefined;
-  const { hostname, protocol } = location;
-  if (!hostname) return undefined;
-  if (protocol !== 'https:' && protocol !== 'http:') return undefined;
-  if (hostname === 'localhost' || hostname === '127.0.0.1') return undefined;
-  if (/^\d+\.\d+\.\d+\.\d+$/.test(hostname)) return undefined;
-  if (hostname.startsWith('[')) return undefined;
-  // Already ON the IdP — keep everything same-origin instead of hopping to a
-  // sibling host.
-  if (hostname.startsWith('auth.')) {
-    return `${protocol}//${hostname}`;
-  }
-  const apex = registrableApex(hostname);
-  if (apex === null) return undefined;
-  return `${protocol}//auth.${apex}`;
-}

package/src/utils/platform.ts

@@ -98,3 +98,24 @@ export function setPlatformOS(os: PlatformOS): void {
   (globalThis as any).__REACT_NATIVE_PLATFORM__ = os;
 }
 
+/**
+ * True only in a real web browser (a DOM is present), false on React Native
+ * and Node/SSR.
+ *
+ * Native defines a global `window` but no `document`, so the DOM probe — not a
+ * bare `window` check — is the reliable discriminator. This is the single
+ * source of truth consumed by `@oxyhq/services` and `@oxyhq/auth` (both dropped
+ * their local copies), so every consumer shares the exact same predicate.
+ *
+ * NOTE: this is a live runtime probe (not the cached `getPlatformOS()` verdict)
+ * because it must reflect the actual DOM availability at call time in the
+ * consumer's bundle.
+ */
+export function isWebBrowser(): boolean {
+  return (
+    typeof window !== 'undefined' &&
+    typeof document !== 'undefined' &&
+    typeof document.documentElement !== 'undefined'
+  );
+}
+