@oxyhq/core 5.5.0 → 7.0.0

package/src/utils/__tests__/authWebUrl.test.ts

@@ -1,50 +1,15 @@
 /**
- * `resolveCentralAuthUrl` / `CENTRAL_AUTH_URL` — central IdP resolution.
+ * Central IdP apex constant.
  *
- * Pure helper: an explicit non-empty value always wins; otherwise the central
- * `auth.oxy.so` origin is returned. No DOM, no side effects.
+ * `resolveCentralAuthUrl` + `CENTRAL_AUTH_URL` were removed in the device-first /
+ * legacy-final cutovers. `CENTRAL_IDP_APEX` survives because live server-side
+ * callers (the `@oxyhq/core/server` CORS helper + the IdP worker) import it.
  */
 
-import { CENTRAL_AUTH_URL, CENTRAL_IDP_APEX, resolveCentralAuthUrl } from '../authWebUrl';
+import { CENTRAL_IDP_APEX } from '../authWebUrl';
 
 describe('CENTRAL_IDP_APEX', () => {
   it('is the central IdP registrable apex', () => {
     expect(CENTRAL_IDP_APEX).toBe('oxy.so');
   });
 });
-
-describe('CENTRAL_AUTH_URL', () => {
-  it('is the central IdP origin with no trailing slash', () => {
-    expect(CENTRAL_AUTH_URL).toBe('https://auth.oxy.so');
-    expect(CENTRAL_AUTH_URL.endsWith('/')).toBe(false);
-  });
-
-  it('is derived from CENTRAL_IDP_APEX (apex and origin never drift)', () => {
-    expect(CENTRAL_AUTH_URL).toBe(`https://auth.${CENTRAL_IDP_APEX}`);
-  });
-});
-
-describe('resolveCentralAuthUrl', () => {
-  it('returns the central default when no explicit value is given', () => {
-    expect(resolveCentralAuthUrl()).toBe(CENTRAL_AUTH_URL);
-    expect(resolveCentralAuthUrl(undefined)).toBe('https://auth.oxy.so');
-  });
-
-  it('returns the explicit value when provided (explicit wins)', () => {
-    expect(resolveCentralAuthUrl('https://auth.mention.earth')).toBe(
-      'https://auth.mention.earth',
-    );
-  });
-
-  it('does not read any ambient DOM/window state', () => {
-    // Even with a window installed, the result is purely a function of the arg.
-    (globalThis as unknown as { window: unknown }).window = {
-      location: { hostname: 'mention.earth', protocol: 'https:' },
-    };
-    try {
-      expect(resolveCentralAuthUrl()).toBe('https://auth.oxy.so');
-    } finally {
-      delete (globalThis as Record<string, unknown>).window;
-    }
-  });
-});

package/src/utils/__tests__/registrableApex.test.ts

@@ -0,0 +1,62 @@
+/**
+ * `registrableApex` — the eTLD+1 host kernel (Public Suffix List aware).
+ *
+ * The client `autoDetectAuthWebUrl` helper was removed in the device-first
+ * cutover; only the registrable-apex kernel survives (used by the api SSO
+ * surface + the IdP). These cases lock its Public-Suffix-List behaviour.
+ */
+
+import { registrableApex } from '../registrableApex';
+
+describe('registrableApex', () => {
+  it('returns the eTLD+1 for a normal two-label host', () => {
+    expect(registrableApex('mention.earth')).toBe('mention.earth');
+  });
+
+  it('strips subdomains down to the trailing two labels', () => {
+    expect(registrableApex('www.mention.earth')).toBe('mention.earth');
+    expect(registrableApex('deep.app.homiio.com')).toBe('homiio.com');
+  });
+
+  it('lower-cases the input', () => {
+    expect(registrableApex('WWW.Mention.EARTH')).toBe('mention.earth');
+  });
+
+  it('returns the eTLD+1 for hosts under multi-part public suffixes', () => {
+    expect(registrableApex('foo.co.uk')).toBe('foo.co.uk');
+    expect(registrableApex('www.foo.co.uk')).toBe('foo.co.uk');
+    expect(registrableApex('shop.victim.com.tr')).toBe('victim.com.tr');
+  });
+
+  it('returns the eTLD+1 for hosts under private hosted suffixes', () => {
+    expect(registrableApex('honest.github.io')).toBe('honest.github.io');
+    expect(registrableApex('app.victim.pages.dev')).toBe('victim.pages.dev');
+    expect(registrableApex('site.victim.netlify.app')).toBe('victim.netlify.app');
+  });
+
+  it('returns null for bare public and private suffixes', () => {
+    expect(registrableApex('co.uk')).toBeNull();
+    expect(registrableApex('github.io')).toBeNull();
+    expect(registrableApex('pages.dev')).toBeNull();
+    expect(registrableApex('netlify.app')).toBeNull();
+  });
+
+  it('returns null for IPv4 literals', () => {
+    expect(registrableApex('192.168.1.10')).toBeNull();
+    expect(registrableApex('10.0.0.1')).toBeNull();
+  });
+
+  it('returns null for IPv6 literals and hosts carrying a port', () => {
+    expect(registrableApex('[::1]')).toBeNull();
+    expect(registrableApex('mention.earth:3000')).toBeNull();
+  });
+
+  it('returns null for single-label hosts', () => {
+    expect(registrableApex('intranet')).toBeNull();
+    expect(registrableApex('localhost')).toBeNull();
+  });
+
+  it('returns null for empty input', () => {
+    expect(registrableApex('')).toBeNull();
+  });
+});

package/src/utils/__tests__/validationUtils.test.ts

@@ -7,6 +7,7 @@ import {
   isValidEmail,
   isValidUsername,
   isValidPassword,
+  isValidDisplayName,
   isValidUUID,
   isValidDate,
   isValidFileSize,
@@ -139,6 +140,35 @@ describe('Validation Utils', () => {
     });
   });
 
+  describe('isValidDisplayName', () => {
+    it('should return true for clean names (letters, spaces, apostrophe)', () => {
+      expect(isValidDisplayName("Renée O'Brien")).toBe(true);
+      expect(isValidDisplayName('Ada Lovelace')).toBe(true);
+      expect(isValidDisplayName('山田太郎')).toBe(true);
+      expect(isValidDisplayName('')).toBe(true); // empty is valid; non-empty enforced elsewhere
+    });
+
+    it('should return false for emoji, symbols, digits, and punctuation', () => {
+      expect(isValidDisplayName('nixCraft \u{1f427}')).toBe(false); // penguin emoji
+      expect(isValidDisplayName('Agent007')).toBe(false);
+      expect(isValidDisplayName('Jean-Luc')).toBe(false);
+      expect(isValidDisplayName('J.R.')).toBe(false);
+    });
+
+    it('should return false for control whitespace (tab/newline/CR)', () => {
+      // \p{Zs} (space separators only) rejects layout-breaking / multi-line
+      // spoofing whitespace that \s would have admitted.
+      expect(isValidDisplayName('Ada\tLovelace')).toBe(false);
+      expect(isValidDisplayName('Ada\nLovelace')).toBe(false);
+      expect(isValidDisplayName('Ada\rLovelace')).toBe(false);
+    });
+
+    it('should return true for Unicode space separators', () => {
+      expect(isValidDisplayName('Ada Lovelace')).toBe(true); // NBSP
+      expect(isValidDisplayName('山田　太郎')).toBe(true); // ideographic space
+    });
+  });
+
   describe('isValidUUID', () => {
     it('should return true for valid UUIDs', () => {
       expect(isValidUUID('123e4567-e89b-12d3-a456-426614174000')).toBe(true);

package/src/utils/accountUtils.ts

@@ -4,7 +4,6 @@
  */
 
 import { translate } from '../i18n';
-import type { RefreshAllAccount } from '../models/interfaces';
 
 export interface QuickAccount {
     sessionId: string;
@@ -15,9 +14,8 @@ export interface QuickAccount {
     avatarUrl?: string;
     /**
      * Device-local account slot index, 0..N-1 (Google-style multi-account).
-     * Mirrors the server's `oxy_rt_${authuser}` cookie slot. Optional so that
-     * pre-multi-account QuickAccounts (sessionId-only, non-cookie auth on RN)
-     * remain valid; web flows always populate it after `refreshAllSessions`.
+     * Optional so that pre-multi-account QuickAccounts (sessionId-only) remain
+     * valid; the device session set populates it where available.
      */
     authuser?: number;
     /**
@@ -178,67 +176,6 @@ export const createQuickAccount = (
     };
 };
 
-/**
- * Merge a fresh `/auth/refresh-all` snapshot into an existing QuickAccount
- * list, preserving any cached fields (`avatarUrl`) for slots that didn't
- * change. The fresh response is canonical: the resulting list contains EXACTLY
- * the slots present in `fresh`, sorted by `authuser` ascending. Stale stored
- * accounts that no longer appear in `fresh` are dropped (the server already
- * authoritatively cleared the corresponding cookie).
- *
- * @param stored Previously persisted QuickAccount list (any order).
- * @param fresh Server's authoritative refresh-all response.
- * @returns Canonical merged list, sorted by `authuser` asc.
- */
-export const mergeAccountsFromRefreshAll = (
-    stored: QuickAccount[] | undefined,
-    fresh: RefreshAllAccount[],
-): QuickAccount[] => {
-    const storedByAuthuser = new Map<number, QuickAccount>();
-    if (stored) {
-        for (const account of stored) {
-            if (typeof account.authuser === 'number') {
-                storedByAuthuser.set(account.authuser, account);
-            }
-        }
-    }
-
-    const merged: QuickAccount[] = fresh.map((entry) => {
-        const previous = storedByAuthuser.get(entry.authuser);
-        // Preserve any previously cached identity for a slot that arrives
-        // without a user shape rather than overwriting it with blanks, and let
-        // AuthManager's getCurrentUser() hydration refresh it on the next
-        // snapshot.
-        const wireUser = entry.user;
-        const username = wireUser?.username ?? previous?.username ?? '';
-        const displayName = getAccountDisplayName({
-            name: wireUser?.name,
-            username,
-        });
-        const avatar = wireUser?.avatar ?? previous?.avatar ?? undefined;
-        const avatarUrl =
-            previous && previous.avatar === avatar ? previous.avatarUrl : undefined;
-        return {
-            sessionId: entry.sessionId,
-            userId: wireUser?.id ?? previous?.userId,
-            username,
-            displayName,
-            avatar,
-            avatarUrl,
-            authuser: entry.authuser,
-            color: wireUser?.color ?? previous?.color ?? null,
-        };
-    });
-
-    merged.sort((a, b) => {
-        const aIdx = a.authuser ?? Number.POSITIVE_INFINITY;
-        const bIdx = b.authuser ?? Number.POSITIVE_INFINITY;
-        return aIdx - bIdx;
-    });
-
-    return merged;
-};
-
 /**
  * Return the account's preferred Bloom color preset, or `null` if it has no
  * preference. Centralises the `color ?? null` normalisation so consumers can

package/src/utils/authWebUrl.ts

@@ -1,47 +1,17 @@
 /**
- * Central IdP (auth web) URL resolution for cross-domain SSO.
+ * Central IdP apex constant.
  *
- * The Oxy ecosystem runs a single, central Identity Provider at
- * `auth.oxy.so`. For TRUE central cross-domain SSO (Google/Meta/Clerk style),
- * FedCM and the opaque-code SSO bounce always target this one origin — it owns
- * the host-only `fedcm_session` cookie and the central session store reachable
- * via `api.oxy.so`. Relying Parties (mention.earth, homiio.com, alia.onl, …)
- * delegate to it rather than standing up a per-apex IdP.
- *
- * This module is intentionally pure: it performs no DOM access, reads no
- * `window`/`location`, and has no side effects. It is the single source of
- * truth for the central IdP origin so call sites never hardcode the literal.
- *
- * Note: this is distinct from `autoDetectAuthWebUrl` (per-apex `auth.<rp-apex>`
- * derivation). The central-SSO path deliberately does NOT auto-detect per-apex
- * IdPs — it is central only. An explicitly-configured `authWebUrl` still wins.
+ * The client SSO/FedCM resolvers (`resolveCentralAuthUrl`, `CENTRAL_AUTH_URL`)
+ * were removed in the device-first / legacy-final cutovers. The lone survivor is
+ * `CENTRAL_IDP_APEX`, kept because it has a LIVE consumer —
+ * `@oxyhq/core/server`'s CORS helper (`server/cors.ts`'s `createOxyCors`)
+ * auto-allows `*.oxy.so` from it. That CORS use is permanent, so this stays
+ * past the SSO/FedCM teardown.
  */
 
 /**
  * The registrable apex (eTLD+1) of the Oxy ecosystem's central Identity
- * Provider. The central IdP is reachable at `auth.${CENTRAL_IDP_APEX}` and the
- * ID-token assertion issuer is always `https://auth.${CENTRAL_IDP_APEX}`
- * regardless of which per-apex `auth.<rp>` host served a given request.
- *
- * Kept as a standalone constant so the IdP worker and the SDK derive the same
- * literal from one source of truth (the worker imports it to brand assertions).
+ * Provider, reachable at `auth.${CENTRAL_IDP_APEX}`. Single source of truth so
+ * the CORS helper (and anything else that needs the central apex) never drifts.
  */
 export const CENTRAL_IDP_APEX = 'oxy.so';
-
-/**
- * The canonical central Identity Provider origin for the Oxy ecosystem.
- * No trailing slash. Derived from {@link CENTRAL_IDP_APEX} so the apex and the
- * full origin never drift apart.
- */
-export const CENTRAL_AUTH_URL = `https://auth.${CENTRAL_IDP_APEX}`;
-
-/**
- * Resolve the central IdP origin, honouring an explicit override.
- *
- * @param explicit - A caller-supplied auth web URL, or `undefined`/empty to use
- *   the central default. An explicit non-empty value always wins.
- * @returns The explicit value when provided, otherwise {@link CENTRAL_AUTH_URL}.
- */
-export function resolveCentralAuthUrl(explicit?: string): string {
-  return explicit ?? CENTRAL_AUTH_URL;
-}

package/src/utils/coldBoot.ts

@@ -3,19 +3,21 @@
  * authentication resolution.
  *
  * On a fresh page load / app launch the SDK may have several ways to recover an
- * existing session (silent FedCM, a persisted refresh token, a cross-domain
- * claim, a redirect SSO return, ...). They must be attempted in a deterministic
- * order*, and the FIRST one that yields a session wins — every later step is
- * skipped. This module encodes exactly that contract and nothing else.
+ * existing session (a persisted refresh-token family, a shared-keychain
+ * identity, a cross-domain boot-fragment return, ...). They must be attempted
+ * in a deterministic order, and the FIRST one that yields a session wins —
+ * every later step is skipped. This module encodes exactly that contract and
+ * nothing else.
  *
  * Design constraints (all enforced):
  *   - PURE: no DOM, no `navigator`, no `window`, no React, no platform globals.
  *   - NO module-level mutable state. Every call to {@link runColdBoot} is fully
  *     self-contained, so it is safe under bundler re-evaluation (e.g. the Metro
- *     web bundle, which is precisely why the FedCM silent-SSO guard had to live
- *     in consumers rather than a core singleton).
- *   - Architecture-agnostic: both candidate cross-domain SSO designs consume
- *     this same primitive; it knows nothing about HOW a step resolves a session.
+ *     web bundle — the reason any run-once guard for a step must live in the
+ *     calling consumer, never in a core module-level singleton).
+ *   - Architecture-agnostic: it knows nothing about HOW a step resolves a
+ *     session; `runSessionColdBoot` (`boot/coldBootV2.ts`) is the current
+ *     device-first consumer.
  *
  * A step is skipped (without running) when its `enabled` predicate returns
  * false. Any thrown error — from either `enabled` or `run` — is reported via
@@ -104,15 +106,16 @@ export interface RunColdBootOptions<S> {
    * fails to settle before the deadline, the runner abandons the await for that
    * step (reporting it via `onStepDeadline`) and CONTINUES to the next step,
    * each now racing against an already-expired deadline. This is deliberate:
-   * the runner keeps iterating so the TERMINAL step (e.g. the `/sso` bounce,
-   * whose `run()` performs its side effect synchronously before its first
-   * `await`) still gets to fire. A step that has nothing to contribute after
-   * the deadline simply doesn't settle and is skipped in turn.
+   * the runner keeps iterating so the TERMINAL step (e.g. `coldBootV2`'s
+   * `bootstrap-hop`, whose `run()` performs its navigation side effect
+   * synchronously before its first `await`) still gets to fire. A step that
+   * has nothing to contribute after the deadline simply doesn't settle and is
+   * skipped in turn.
    *
    * Per-step timeouts inside `run()` remain the first line of defense and
    * should keep every step well under this budget on a healthy load; this only
-   * trips when one of them regresses (the production FedCM-silent hang). When
-   * omitted there is no overall deadline.
+   * trips when one of them regresses (a step hanging past its own timeout).
+   * When omitted there is no overall deadline.
    */
   readonly overallDeadlineMs?: number;
   /**

package/src/utils/platform.ts

@@ -98,3 +98,24 @@ export function setPlatformOS(os: PlatformOS): void {
   (globalThis as any).__REACT_NATIVE_PLATFORM__ = os;
 }
 
+/**
+ * True only in a real web browser (a DOM is present), false on React Native
+ * and Node/SSR.
+ *
+ * Native defines a global `window` but no `document`, so the DOM probe — not a
+ * bare `window` check — is the reliable discriminator. This is the single
+ * source of truth consumed by `@oxyhq/services` and `@oxyhq/auth` (both dropped
+ * their local copies), so every consumer shares the exact same predicate.
+ *
+ * NOTE: this is a live runtime probe (not the cached `getPlatformOS()` verdict)
+ * because it must reflect the actual DOM availability at call time in the
+ * consumer's bundle.
+ */
+export function isWebBrowser(): boolean {
+  return (
+    typeof window !== 'undefined' &&
+    typeof document !== 'undefined' &&
+    typeof document.documentElement !== 'undefined'
+  );
+}
+

package/src/utils/registrableApex.ts

@@ -0,0 +1,45 @@
+/**
+ * Registrable-apex (eTLD+1) host kernel.
+ *
+ * The client FAPI auto-detection helper was removed in the device-first cutover
+ * (which is why this file is now named for what it actually is, not the old
+ * `fapiAutoDetect`). What survives is the pure registrable-domain kernel, still
+ * used server-side by the api's device-first same-apex trust checks
+ * (`deviceAuth.ts`'s `POST /auth/device/web-session`, via `sameSite.ts`'s
+ * `isSameSiteTrustedRequest`) and the `@oxyhq/core/server` CORS/re-export layer.
+ *
+ * `registrableApex` is NOT legacy — the device-first same-apex check is a live
+ * consumer, so this kernel stays regardless of the SSO/FedCM removal.
+ */
+
+import { getDomain } from 'tldts';
+
+/**
+ * Compute the bare registrable apex (eTLD+1) of a hostname using the Public
+ * Suffix List, including private hosted suffixes.
+ *
+ * Performs NO protocol handling and builds NO URL — it only answers "what is
+ * the registrable domain of this host, or is that undefinable?".
+ *
+ * Returns `null` (apex undefinable) for:
+ *   - empty input;
+ *   - IPv4 literals (`192.168.1.10`);
+ *   - IPv6 literals or any host carrying a port (`[::1]`, anything with `:`);
+ *   - single-label hosts (`intranet`, `localhost`);
+ *   - public suffixes without a registrable label (e.g. `co.uk`, `github.io`).
+ *
+ * @param hostname - A bare hostname (no scheme), e.g. `www.mention.earth`.
+ * @returns The eTLD+1 (`mention.earth`), or `null` when undefinable.
+ */
+export function registrableApex(hostname: string): string | null {
+  if (!hostname) return null;
+  const host = hostname.toLowerCase();
+  if (/^\d+\.\d+\.\d+\.\d+$/.test(host)) return null;
+  // IPv6 literals are bracketed; any remaining ':' implies a port — neither
+  // yields a registrable apex.
+  if (host.startsWith('[') || host.includes(':')) return null;
+  // The Public Suffix List (private suffixes included) is the source of truth
+  // for what an attacker can register. A multi-part public suffix like `co.uk`
+  // or a hosted suffix like `github.io` returns no registrable domain.
+  return getDomain(host, { allowPrivateDomains: true });
+}