@oxyhq/core 5.5.0 → 6.0.0

package/src/utils/__tests__/ssoBounce.test.ts

@@ -1,219 +0,0 @@
-/**
- * Central SSO bounce helpers — per-origin key builders, the bounce URL builder,
- * the central-IdP predicate, and the self-healing guard.
- *
- * These are a wire/storage contract shared with the IdP and every consumer, so
- * the exact key strings, the 30s TTL, and the same-origin / parse-failure
- * behaviour are all asserted explicitly.
- */
-
-import {
-  SSO_CALLBACK_PATH,
-  SSO_GUARD_TTL_MS,
-  ssoStateKey,
-  ssoGuardKey,
-  ssoDestKey,
-  ssoNoSessionKey,
-  ssoAttemptedKey,
-  ssoPriorSessionKey,
-  ssoSignedOutKey,
-  buildSsoBounceUrl,
-  isCentralIdPOrigin,
-  guardActive,
-  silentRestoreSuppressed,
-  allowSsoBounce,
-} from '../ssoBounce';
-import { CENTRAL_AUTH_URL } from '../authWebUrl';
-
-describe('SSO bounce constants', () => {
-  it('pins the callback path and guard TTL (wire/storage contract)', () => {
-    expect(SSO_CALLBACK_PATH).toBe('/__oxy/sso-callback');
-    expect(SSO_GUARD_TTL_MS).toBe(30_000);
-  });
-});
-
-describe('per-origin key builders', () => {
-  const origin = 'https://mention.earth';
-
-  it('builds the exact contracted key strings', () => {
-    expect(ssoStateKey(origin)).toBe('oxy_sso_state:https://mention.earth');
-    expect(ssoGuardKey(origin)).toBe('oxy_sso_guard:https://mention.earth');
-    expect(ssoDestKey(origin)).toBe('oxy_sso_dest:https://mention.earth');
-    expect(ssoNoSessionKey(origin)).toBe('oxy_sso_no_session:https://mention.earth');
-    expect(ssoAttemptedKey(origin)).toBe('oxy_sso_attempted:https://mention.earth');
-    expect(ssoPriorSessionKey(origin)).toBe('oxy_sso_prior_session:https://mention.earth');
-    expect(ssoSignedOutKey(origin)).toBe('oxy_signed_out:https://mention.earth');
-  });
-
-  it('namespaces keys per origin so two RPs never collide', () => {
-    expect(ssoStateKey('https://a.test')).not.toBe(ssoStateKey('https://b.test'));
-    expect(ssoPriorSessionKey('https://a.test')).not.toBe(ssoPriorSessionKey('https://b.test'));
-    expect(ssoSignedOutKey('https://a.test')).not.toBe(ssoSignedOutKey('https://b.test'));
-  });
-});
-
-describe('silentRestoreSuppressed (deliberately-signed-out gate)', () => {
-  const origin = 'https://accounts.oxy.so';
-
-  function storageWith(value: string | null): Pick<Storage, 'getItem'> {
-    return { getItem: (key: string) => (key === ssoSignedOutKey(origin) ? value : null) };
-  }
-
-  it('is SUPPRESSED when the signed-out flag is set to "1" for this origin', () => {
-    expect(silentRestoreSuppressed(storageWith('1'), origin)).toBe(true);
-  });
-
-  it('is NOT suppressed when the flag is absent (normal restore)', () => {
-    expect(silentRestoreSuppressed(storageWith(null), origin)).toBe(false);
-  });
-
-  it('is NOT suppressed for any non-"1" value (only the exact set value gates)', () => {
-    expect(silentRestoreSuppressed(storageWith('0'), origin)).toBe(false);
-    expect(silentRestoreSuppressed(storageWith(''), origin)).toBe(false);
-  });
-
-  it('is per-origin: another origin\'s flag does not suppress this one', () => {
-    const otherOriginFlag: Pick<Storage, 'getItem'> = {
-      getItem: (key: string) => (key === ssoSignedOutKey('https://other.test') ? '1' : null),
-    };
-    expect(silentRestoreSuppressed(otherOriginFlag, origin)).toBe(false);
-  });
-
-  it('fails safe (NOT suppressed, never throws) when getItem throws', () => {
-    const throwing: Pick<Storage, 'getItem'> = {
-      getItem: () => {
-        throw new Error('storage locked');
-      },
-    };
-    expect(silentRestoreSuppressed(throwing, origin)).toBe(false);
-  });
-});
-
-describe('allowSsoBounce (smart returning-visitor gate)', () => {
-  it('ALLOWS a returning visitor (prior-session hint) with no local session', () => {
-    // The core of fix B: a returning user whose local session has expired still
-    // gets ONE establish bounce so a central-only cross-domain session recovers.
-    expect(
-      allowSsoBounce({ hasPriorSession: true, hasLocalSession: false }),
-    ).toBe(true);
-  });
-
-  it('SUPPRESSES a truly first-time anonymous visitor (no hint, no local session)', () => {
-    // The smart default (the ONLY behaviour): a first-time visitor browses
-    // anonymously instead of being force-redirected to the central IdP.
-    expect(
-      allowSsoBounce({ hasPriorSession: false, hasLocalSession: false }),
-    ).toBe(false);
-  });
-
-  it('ALLOWS when a local session was recovered this boot (spec fidelity)', () => {
-    expect(
-      allowSsoBounce({ hasPriorSession: false, hasLocalSession: true }),
-    ).toBe(true);
-  });
-});
-
-describe('buildSsoBounceUrl', () => {
-  const origin = 'https://mention.earth';
-
-  it('targets the central IdP /sso with all required params (default base)', () => {
-    const url = new URL(buildSsoBounceUrl(origin, 'state-123'));
-
-    expect(url.origin).toBe('https://auth.oxy.so');
-    expect(url.pathname).toBe('/sso');
-    expect(url.searchParams.get('prompt')).toBe('none');
-    expect(url.searchParams.get('client_id')).toBe(origin);
-    expect(url.searchParams.get('return_to')).toBe(origin + SSO_CALLBACK_PATH);
-    expect(url.searchParams.get('state')).toBe('state-123');
-  });
-
-  it('honours an explicit authWebUrl override (staging IdP)', () => {
-    const url = new URL(
-      buildSsoBounceUrl(origin, 'state-xyz', 'https://auth.mention.earth'),
-    );
-
-    expect(url.origin).toBe('https://auth.mention.earth');
-    expect(url.pathname).toBe('/sso');
-    expect(url.searchParams.get('client_id')).toBe(origin);
-    expect(url.searchParams.get('state')).toBe('state-xyz');
-  });
-
-  it('falls back to the central default for an empty override', () => {
-    const url = new URL(buildSsoBounceUrl(origin, 's', undefined));
-    expect(url.origin).toBe('https://auth.oxy.so');
-  });
-});
-
-describe('isCentralIdPOrigin', () => {
-  it('matches the central IdP origin', () => {
-    expect(isCentralIdPOrigin('https://auth.oxy.so')).toBe(true);
-    expect(isCentralIdPOrigin(CENTRAL_AUTH_URL)).toBe(true);
-  });
-
-  it('normalises a trailing-slash / path candidate via URL origin', () => {
-    expect(isCentralIdPOrigin('https://auth.oxy.so/')).toBe(true);
-    expect(isCentralIdPOrigin('https://auth.oxy.so/sso')).toBe(true);
-  });
-
-  it('rejects a non-central origin', () => {
-    expect(isCentralIdPOrigin('https://mention.earth')).toBe(false);
-    expect(isCentralIdPOrigin('https://auth.mention.earth')).toBe(false);
-  });
-
-  it('returns false for an unparseable candidate', () => {
-    expect(isCentralIdPOrigin('not a url')).toBe(false);
-    expect(isCentralIdPOrigin('')).toBe(false);
-  });
-});
-
-describe('guardActive', () => {
-  const origin = 'https://mention.earth';
-
-  function storageWith(value: string | null): Pick<Storage, 'getItem'> {
-    return { getItem: (key: string) => (key === ssoGuardKey(origin) ? value : null) };
-  }
-
-  it('is active for a present, fresh guard', () => {
-    const now = 1_000_000;
-    const storage = storageWith(String(now - 1_000)); // 1s old, well under TTL
-    expect(guardActive(storage, origin, now)).toBe(true);
-  });
-
-  it('is inactive for a present but stale guard (older than TTL)', () => {
-    const now = 1_000_000;
-    const storage = storageWith(String(now - SSO_GUARD_TTL_MS - 1));
-    expect(guardActive(storage, origin, now)).toBe(false);
-  });
-
-  it('is inactive for a guard exactly at the TTL boundary (strict <)', () => {
-    const now = 1_000_000;
-    const storage = storageWith(String(now - SSO_GUARD_TTL_MS));
-    expect(guardActive(storage, origin, now)).toBe(false);
-  });
-
-  it('is inactive when the guard is missing', () => {
-    expect(guardActive(storageWith(null), origin, 1_000_000)).toBe(false);
-  });
-
-  it('is inactive for an empty-string guard value', () => {
-    expect(guardActive(storageWith(''), origin, 1_000_000)).toBe(false);
-  });
-
-  it('is inactive for a malformed (non-numeric) guard value', () => {
-    expect(guardActive(storageWith('not-a-number'), origin, 1_000_000)).toBe(false);
-  });
-
-  it('is inactive (never throws) when getItem itself throws', () => {
-    const throwing: Pick<Storage, 'getItem'> = {
-      getItem: () => {
-        throw new Error('storage locked');
-      },
-    };
-    expect(guardActive(throwing, origin, 1_000_000)).toBe(false);
-  });
-
-  it('defaults now to Date.now() when omitted', () => {
-    const storage = storageWith(String(Date.now() - 500));
-    expect(guardActive(storage, origin)).toBe(true);
-  });
-});

package/src/utils/__tests__/ssoEstablish.test.ts

@@ -1,204 +0,0 @@
-/**
- * `establishIdpSessionAfterClaim` — the post-claim durable-session hop.
- *
- * After a WEB device-flow ("Sign in with Oxy" QR) claim commits, the app holds
- * only in-memory tokens: no `fedcm_session` cookie was ever planted at the IdP,
- * so a reload cannot re-mint a token. This primitive performs ONE top-level
- * establish hop (via the RP-minted establish-URL) so the per-apex IdP cookie is
- * planted and a reload restores via the existing `sso-return` / silent-iframe
- * paths.
- *
- * Invariants pinned here:
- *  - web only (no-op off-web / native);
- *  - never fires while sitting on the central IdP origin (would loop);
- *  - persists the SAME bounce state (`ssoStateKey`/`ssoGuardKey`/`ssoDestKey`)
- *    the `buildSsoBounceUrl` machinery primes, so the post-bounce `sso-return`
- *    step validates the state, exchanges the code, and restores the dest;
- *  - persists ONLY after the establish-URL request succeeds (no stale state on
- *    failure);
- *  - navigates exactly once, to the server-returned establish URL;
- *  - total: an establish-request failure leaves the committed in-memory session
- *    untouched, does NOT navigate, and returns `false` (user no worse off).
- */
-
-import { establishIdpSessionAfterClaim } from '../ssoEstablish';
-import {
-  ssoStateKey,
-  ssoGuardKey,
-  ssoDestKey,
-} from '../ssoBounce';
-import { CENTRAL_AUTH_URL } from '../authWebUrl';
-
-const RP_ORIGIN = 'https://accounts.oxy.so';
-const RP_HREF = 'https://accounts.oxy.so/settings';
-const ESTABLISH_URL =
-  'https://auth.oxy.so/sso/establish?et=jwt.abc.def&return_to=https%3A%2F%2Faccounts.oxy.so%2F__oxy%2Fsso-callback&state=state-xyz';
-
-function makeStorage(): {
-  storage: Pick<Storage, 'getItem' | 'setItem'>;
-  map: Map<string, string>;
-} {
-  const map = new Map<string, string>();
-  return {
-    map,
-    storage: {
-      getItem: (k: string) => (map.has(k) ? (map.get(k) as string) : null),
-      setItem: (k: string, v: string) => {
-        map.set(k, v);
-      },
-    },
-  };
-}
-
-describe('establishIdpSessionAfterClaim', () => {
-  it('requests the establish URL with the RP origin + generated state and navigates once (web)', async () => {
-    const { storage, map } = makeStorage();
-    const navigated: string[] = [];
-    const requestSsoEstablishUrl = jest.fn(async (origin: string, state: string) => {
-      expect(origin).toBe(RP_ORIGIN);
-      expect(state).toBe('state-xyz');
-      return { establishUrl: ESTABLISH_URL };
-    });
-
-    const result = await establishIdpSessionAfterClaim(
-      { requestSsoEstablishUrl },
-      {
-        isWeb: () => true,
-        storage,
-        location: { origin: RP_ORIGIN, href: RP_HREF },
-        navigate: (url) => navigated.push(url),
-        generateState: () => 'state-xyz',
-        now: () => 1_700_000_000_000,
-      },
-    );
-
-    expect(result).toBe(true);
-    expect(requestSsoEstablishUrl).toHaveBeenCalledTimes(1);
-    expect(navigated).toEqual([ESTABLISH_URL]);
-
-    // Bounce state persisted so the post-bounce `sso-return` step validates it.
-    expect(map.get(ssoStateKey(RP_ORIGIN))).toBe('state-xyz');
-    expect(map.get(ssoGuardKey(RP_ORIGIN))).toBe(String(1_700_000_000_000));
-    expect(map.get(ssoDestKey(RP_ORIGIN))).toBe(RP_HREF);
-  });
-
-  it('is a no-op off-web (native): no request, no navigation, no state', async () => {
-    const { storage, map } = makeStorage();
-    const navigated: string[] = [];
-    const requestSsoEstablishUrl = jest.fn(async () => ({ establishUrl: ESTABLISH_URL }));
-
-    const result = await establishIdpSessionAfterClaim(
-      { requestSsoEstablishUrl },
-      {
-        isWeb: () => false,
-        storage,
-        location: { origin: RP_ORIGIN, href: RP_HREF },
-        navigate: (url) => navigated.push(url),
-      },
-    );
-
-    expect(result).toBe(false);
-    expect(requestSsoEstablishUrl).not.toHaveBeenCalled();
-    expect(navigated).toEqual([]);
-    expect(map.size).toBe(0);
-  });
-
-  it('never fires while sitting on the central IdP origin (loop guard)', async () => {
-    const { storage, map } = makeStorage();
-    const navigated: string[] = [];
-    const requestSsoEstablishUrl = jest.fn(async () => ({ establishUrl: ESTABLISH_URL }));
-
-    const result = await establishIdpSessionAfterClaim(
-      { requestSsoEstablishUrl },
-      {
-        isWeb: () => true,
-        storage,
-        location: { origin: new URL(CENTRAL_AUTH_URL).origin, href: `${CENTRAL_AUTH_URL}/` },
-        navigate: (url) => navigated.push(url),
-      },
-    );
-
-    expect(result).toBe(false);
-    expect(requestSsoEstablishUrl).not.toHaveBeenCalled();
-    expect(navigated).toEqual([]);
-    expect(map.size).toBe(0);
-  });
-
-  it('on an establish-request failure: no navigation, no persisted state, returns false (single attempt)', async () => {
-    const { storage, map } = makeStorage();
-    const navigated: string[] = [];
-    const onError = jest.fn();
-    const requestSsoEstablishUrl = jest.fn(async () => {
-      throw new Error('403 unapproved origin');
-    });
-
-    const result = await establishIdpSessionAfterClaim(
-      { requestSsoEstablishUrl },
-      {
-        isWeb: () => true,
-        storage,
-        location: { origin: RP_ORIGIN, href: RP_HREF },
-        navigate: (url) => navigated.push(url),
-        generateState: () => 'state-xyz',
-        onError,
-      },
-    );
-
-    expect(result).toBe(false);
-    expect(requestSsoEstablishUrl).toHaveBeenCalledTimes(1);
-    expect(navigated).toEqual([]);
-    // No stale bounce state left behind on failure.
-    expect(map.size).toBe(0);
-    expect(onError).toHaveBeenCalledTimes(1);
-  });
-
-  it('does not navigate when the server returns no establish URL', async () => {
-    const { storage, map } = makeStorage();
-    const navigated: string[] = [];
-    const requestSsoEstablishUrl = jest.fn(async () => ({ establishUrl: '' }));
-
-    const result = await establishIdpSessionAfterClaim(
-      { requestSsoEstablishUrl },
-      {
-        isWeb: () => true,
-        storage,
-        location: { origin: RP_ORIGIN, href: RP_HREF },
-        navigate: (url) => navigated.push(url),
-        generateState: () => 'state-xyz',
-      },
-    );
-
-    expect(result).toBe(false);
-    expect(navigated).toEqual([]);
-    expect(map.size).toBe(0);
-  });
-
-  it.each([
-    ['unparseable', 'not a url'],
-    ['non-https (http)', 'http://auth.oxy.so/sso/establish?et=x&state=s'],
-    ['wrong path', 'https://auth.oxy.so/evil?et=x&state=s'],
-    ['non-auth host', 'https://evil.oxy.so/sso/establish?et=x&state=s'],
-  ])(
-    'aborts silently (no navigation, no state) for a %s establish URL',
-    async (_label, badUrl) => {
-      const { storage, map } = makeStorage();
-      const navigated: string[] = [];
-      const requestSsoEstablishUrl = jest.fn(async () => ({ establishUrl: badUrl }));
-
-      const result = await establishIdpSessionAfterClaim(
-        { requestSsoEstablishUrl },
-        {
-          isWeb: () => true,
-          storage,
-          location: { origin: RP_ORIGIN, href: RP_HREF },
-          navigate: (url) => navigated.push(url),
-          generateState: () => 'state-xyz',
-        },
-      );
-
-      expect(result).toBe(false);
-      expect(navigated).toEqual([]);
-      expect(map.size).toBe(0);
-    },
-  );
-});

package/src/utils/__tests__/ssoReturn.test.ts

@@ -1,276 +0,0 @@
-/**
- * `parseSsoReturnFragment` — SSO return fragment parsing.
- *
- * The central IdP returns the RP via a top-level redirect with the bounce
- * result in the URL fragment. The parser must be pure, total (never throws),
- * and report `kind` strictly as one of `'ok' | 'none' | 'error'`, returning
- * `null` for anything that is not an oxy_sso fragment.
- */
-
-import type { SessionLoginResponse } from '../../models/session';
-import { consumeSsoReturn, parseSsoReturnFragment } from '../ssoReturn';
-import {
-  getSsoCallbackBootstrapScript,
-  ssoAttemptedKey,
-  ssoCallbackBootstrapKey,
-  ssoDestKey,
-  ssoNoSessionKey,
-  ssoStateKey,
-} from '../ssoBounce';
-
-class MemorySsoStorage implements Pick<Storage, 'getItem' | 'setItem' | 'removeItem'> {
-  private readonly values = new Map<string, string>();
-
-  getItem(key: string): string | null {
-    return this.values.get(key) ?? null;
-  }
-
-  setItem(key: string, value: string): void {
-    this.values.set(key, value);
-  }
-
-  removeItem(key: string): void {
-    this.values.delete(key);
-  }
-}
-
-const ORIGIN = 'https://app.mention.earth';
-
-const exchangedSession: SessionLoginResponse = {
-  sessionId: 'sess_sso',
-  deviceId: 'device_sso',
-  accessToken: 'access_sso',
-  expiresAt: '2030-01-01T00:00:00.000Z',
-  user: { id: 'user_sso', username: 'sso-user' },
-};
-
-describe('parseSsoReturnFragment', () => {
-  describe('ok', () => {
-    it('parses a success fragment with code and state', () => {
-      const result = parseSsoReturnFragment('#oxy_sso=ok&code=abc123&state=xyz');
-
-      expect(result).toEqual({ kind: 'ok', code: 'abc123', state: 'xyz' });
-    });
-
-    it('parses a success fragment without a leading #', () => {
-      const result = parseSsoReturnFragment('oxy_sso=ok&code=abc123&state=xyz');
-
-      expect(result).toEqual({ kind: 'ok', code: 'abc123', state: 'xyz' });
-    });
-
-    it('omits code when ok carries no code', () => {
-      const result = parseSsoReturnFragment('#oxy_sso=ok&state=xyz');
-
-      expect(result).toEqual({ kind: 'ok', state: 'xyz' });
-      expect(result?.code).toBeUndefined();
-    });
-
-    it('URL-decodes percent-encoded values', () => {
-      const result = parseSsoReturnFragment('#oxy_sso=ok&code=a%2Bb%2Fc&state=s%20t');
-
-      expect(result).toEqual({ kind: 'ok', code: 'a+b/c', state: 's t' });
-    });
-
-    it('ignores a stray reason on an ok outcome', () => {
-      const result = parseSsoReturnFragment('#oxy_sso=ok&code=abc123&state=xyz&reason=no_cookie');
-
-      expect(result).toEqual({ kind: 'ok', code: 'abc123', state: 'xyz' });
-      expect(result?.reason).toBeUndefined();
-    });
-  });
-
-  describe('none', () => {
-    it('parses a none fragment and carries state but never a code', () => {
-      const result = parseSsoReturnFragment('#oxy_sso=none&state=xyz');
-
-      expect(result).toEqual({ kind: 'none', state: 'xyz' });
-    });
-
-    it('ignores a stray code on a none outcome', () => {
-      const result = parseSsoReturnFragment('#oxy_sso=none&code=leaked&state=xyz');
-
-      expect(result).toEqual({ kind: 'none', state: 'xyz' });
-      expect(result?.code).toBeUndefined();
-    });
-
-    it('carries a machine-readable reason on a none outcome', () => {
-      const result = parseSsoReturnFragment('#oxy_sso=none&reason=no_cookie&state=xyz');
-
-      expect(result).toEqual({ kind: 'none', state: 'xyz', reason: 'no_cookie' });
-    });
-
-    it('omits reason when the none outcome carries none', () => {
-      const result = parseSsoReturnFragment('#oxy_sso=none&state=xyz');
-
-      expect(result?.reason).toBeUndefined();
-    });
-  });
-
-  describe('error', () => {
-    it('parses an error fragment', () => {
-      const result = parseSsoReturnFragment('#oxy_sso=error&state=xyz');
-
-      expect(result).toEqual({ kind: 'error', state: 'xyz' });
-    });
-
-    it('ignores a stray code on an error outcome', () => {
-      const result = parseSsoReturnFragment('#oxy_sso=error&code=leaked');
-
-      expect(result).toEqual({ kind: 'error' });
-      expect(result?.code).toBeUndefined();
-    });
-
-    it('carries a machine-readable reason on an error outcome', () => {
-      const result = parseSsoReturnFragment('#oxy_sso=error&reason=no_grant_establish');
-
-      expect(result).toEqual({ kind: 'error', reason: 'no_grant_establish' });
-    });
-  });
-
-  describe('null (not an oxy_sso fragment)', () => {
-    it('returns null for an empty string', () => {
-      expect(parseSsoReturnFragment('')).toBeNull();
-    });
-
-    it('returns null for a bare #', () => {
-      expect(parseSsoReturnFragment('#')).toBeNull();
-    });
-
-    it('returns null for undefined', () => {
-      expect(parseSsoReturnFragment(undefined)).toBeNull();
-    });
-
-    it('returns null for null', () => {
-      expect(parseSsoReturnFragment(null)).toBeNull();
-    });
-
-    it('returns null for a fragment without oxy_sso', () => {
-      expect(parseSsoReturnFragment('#access_token=foo&state=bar')).toBeNull();
-    });
-
-    it('returns null for an unrecognised oxy_sso value', () => {
-      expect(parseSsoReturnFragment('#oxy_sso=bogus&code=x')).toBeNull();
-    });
-
-    it('returns null for an empty oxy_sso value', () => {
-      expect(parseSsoReturnFragment('#oxy_sso=&code=x')).toBeNull();
-    });
-  });
-
-  describe('malformed / defensive', () => {
-    it('never throws and returns a valid kind for junk after the marker', () => {
-      const result = parseSsoReturnFragment('#oxy_sso=ok&=&&&code=c&&');
-
-      expect(result?.kind).toBe('ok');
-      expect(result?.code).toBe('c');
-    });
-
-    it('always reports a kind in the strict union', () => {
-      for (const input of [
-        '#oxy_sso=ok',
-        '#oxy_sso=none',
-        '#oxy_sso=error',
-      ]) {
-        const result = parseSsoReturnFragment(input);
-        expect(result).not.toBeNull();
-        expect(['ok', 'none', 'error']).toContain(result?.kind);
-      }
-    });
-  });
-});
-
-describe('consumeSsoReturn pre-hydration callback bootstrap', () => {
-  it('continues an ok callback after the HTML bootstrap moved the URL to a hydratable route', async () => {
-    const storage = new MemorySsoStorage();
-    const replaceStateCalls: string[] = [];
-    const dispatchPopState = jest.fn();
-    const hardRedirect = jest.fn();
-    const exchangeSsoCode = jest.fn(async (): Promise<SessionLoginResponse> => exchangedSession);
-
-    storage.setItem(ssoStateKey(ORIGIN), 'state-ok');
-    storage.setItem(ssoDestKey(ORIGIN), `${ORIGIN}/explore?tab=home#top`);
-    storage.setItem(ssoCallbackBootstrapKey(ORIGIN), '1');
-
-    const session = await consumeSsoReturn(
-      { exchangeSsoCode },
-      {
-        isWeb: () => true,
-        storage,
-        location: {
-          hash: '#oxy_sso=ok&code=opaque-code&state=state-ok',
-          origin: ORIGIN,
-          pathname: '/',
-          search: '',
-        },
-        history: {
-          replaceState: (_data: unknown, _unused: string, url?: string | URL | null): void => {
-            replaceStateCalls.push(String(url ?? ''));
-          },
-        },
-        dispatchPopState,
-        hardRedirect,
-      },
-    );
-
-    expect(session).toBe(exchangedSession);
-    expect(exchangeSsoCode).toHaveBeenCalledWith('opaque-code', 'state-ok');
-    expect(replaceStateCalls).toEqual(['/', '/explore?tab=home#top']);
-    expect(dispatchPopState).toHaveBeenCalledTimes(1);
-    expect(hardRedirect).not.toHaveBeenCalled();
-    expect(storage.getItem(ssoCallbackBootstrapKey(ORIGIN))).toBeNull();
-    expect(storage.getItem(ssoDestKey(ORIGIN))).toBeNull();
-    expect(storage.getItem(ssoNoSessionKey(ORIGIN))).toBeNull();
-  });
-
-  it('leaves a bootstrapped none callback with loop breakers set and no exchange', async () => {
-    const storage = new MemorySsoStorage();
-    const replaceStateCalls: string[] = [];
-    const dispatchPopState = jest.fn();
-    const hardRedirect = jest.fn();
-    const exchangeSsoCode = jest.fn(async (): Promise<SessionLoginResponse> => exchangedSession);
-
-    storage.setItem(ssoStateKey(ORIGIN), 'state-none');
-    storage.setItem(ssoDestKey(ORIGIN), `${ORIGIN}/library`);
-    storage.setItem(ssoCallbackBootstrapKey(ORIGIN), '1');
-
-    const session = await consumeSsoReturn(
-      { exchangeSsoCode },
-      {
-        isWeb: () => true,
-        storage,
-        location: {
-          hash: '#oxy_sso=none&state=state-none',
-          origin: ORIGIN,
-          pathname: '/',
-          search: '',
-        },
-        history: {
-          replaceState: (_data: unknown, _unused: string, url?: string | URL | null): void => {
-            replaceStateCalls.push(String(url ?? ''));
-          },
-        },
-        dispatchPopState,
-        hardRedirect,
-      },
-    );
-
-    expect(session).toBeNull();
-    expect(exchangeSsoCode).not.toHaveBeenCalled();
-    expect(replaceStateCalls).toEqual(['/']);
-    expect(dispatchPopState).not.toHaveBeenCalled();
-    expect(hardRedirect).toHaveBeenCalledWith(`${ORIGIN}/library`);
-    expect(storage.getItem(ssoCallbackBootstrapKey(ORIGIN))).toBeNull();
-    expect(storage.getItem(ssoDestKey(ORIGIN))).toBeNull();
-    expect(storage.getItem(ssoNoSessionKey(ORIGIN))).toBe('1');
-    expect(storage.getItem(ssoAttemptedKey(ORIGIN))).toBe('1');
-  });
-
-  it('exposes a pre-hydration script that preserves the SSO fragment', () => {
-    const script = getSsoCallbackBootstrapScript();
-
-    expect(script).toContain('/__oxy/sso-callback');
-    expect(script).toContain('oxy_sso=');
-    expect(script).toContain('window.history.replaceState');
-    expect(script).toContain('window.location.hash');
-  });
-});