@oxyhq/core 6.0.0 → 7.1.0

package/src/session/accountProjection.ts

@@ -0,0 +1,263 @@
+/**
+ * Unified account-list projection — THE single source of truth.
+ *
+ * Produces the flat `SwitchableAccount[]` every account chooser renders, by
+ * merging the device's server-authoritative session set (`DeviceSessionState`
+ * from {@link SessionClient}) with the caller's account graph (`AccountNode[]`
+ * from `oxyServices.listAccounts()`), deduped by `accountId`. This lives in
+ * `@oxyhq/core` so `@oxyhq/services` (RN) and `@oxyhq/auth` (web) — and
+ * `auth.oxy.so` — all render the SAME list from the SAME logic and cannot
+ * diverge.
+ *
+ * Pure and I/O-free: the caller resolves per-account profiles via
+ * `oxyServices.getUsersByIds(...)` and passes them in as `profilesById`, and
+ * binds `resolveAvatarUrl` to `oxyServices.getFileDownloadUrl`. This is the same
+ * split the former `@oxyhq/services` `buildSwitchableAccounts` used — hoisted
+ * into core, keyed directly on `DeviceSessionState` (whose `activeAccountId` is
+ * atomic, so no cross-call current-row reconciliation is needed).
+ */
+
+import type { DeviceSessionState } from '@oxyhq/contracts';
+import type { User } from '../models/interfaces';
+import type {
+  AccountNode,
+  AccountRelationship,
+  AccountKind,
+  AccountMember,
+} from '../mixins/OxyServices.accounts';
+import { getAccountDisplayName, getAccountFallbackHandle } from '../utils/accountUtils';
+
+/**
+ * The per-account user shape carried by a {@link SwitchableAccount}. The SDK's
+ * canonical {@link User} document — either a profile resolved via
+ * `oxyServices.getUsersByIds()` (device rows), the caller-supplied
+ * `activeUser` override (the freshest copy of the active row), or the `account`
+ * document embedded in an account-graph node (graph-only rows).
+ */
+export type SwitchableAccountUser = User;
+
+/**
+ * One account the signed-in user can switch INTO, in the uniform switch model.
+ *
+ * A switchable account is either a device sign-in, an account-graph node (owned
+ * org / shared-with-you), or BOTH (an account that has been switched into
+ * becomes a device session while still being a graph node — the two are deduped
+ * into a single row). Every row carries a canonical `accountId` (the uniform
+ * switch key); `sessionId` is present IFF the account is currently signed in on
+ * THIS device.
+ */
+export interface SwitchableAccount {
+  /**
+   * Canonical account id (the underlying `User._id`). The single key EVERY
+   * switch uses — `controller.switchTo(accountId)`. Always present.
+   */
+  accountId: string;
+  /**
+   * Device session id, present IFF this account is signed in on THIS device.
+   * Absent for a graph account not yet switched into. Used only for
+   * device-scoped actions (per-account sign-out); switching ALWAYS goes through
+   * `switchTo(accountId)`.
+   */
+  sessionId?: string;
+  /**
+   * Device-local account slot index (0..N-1) carried on the underlying
+   * `SessionAccount`. Absent for graph-only rows.
+   */
+  authuser?: number;
+  /** Whether this account is the currently-active one (`accountId === activeAccountId`). */
+  isCurrent: boolean;
+  /** Whether this account is signed in on THIS device (has a `sessionId`). */
+  onDevice: boolean;
+  /**
+   * The caller's relationship to this account when it appears in the account
+   * graph: `self` (the caller's own personal account), `owner` (an org/project/
+   * bot the caller owns), or `member` (shared with the caller). Absent for an
+   * independent device sign-in that is NOT in the active account's graph.
+   */
+  relationship?: AccountRelationship;
+  /** Account classification (personal/organization/…). Cosmetic badge only. */
+  kind?: AccountKind;
+  /** Parent account id for 2-level tree grouping, or `null` for a root. */
+  parentAccountId?: string | null;
+  /**
+   * The caller's effective membership (role + permissions) in this account when
+   * it appears in the graph, or `null`/absent otherwise. Use `permissions` to
+   * gate per-account settings UI.
+   */
+  callerMembership?: AccountMember | null;
+  /** Friendly display name (never blank — falls back to a handle/sentinel). */
+  displayName: string;
+  /**
+   * Real account email, or `null` when the account genuinely has none. NEVER a
+   * synthesized `username@oxy.so` — a missing email falls back to the `@handle`
+   * secondary line.
+   */
+  email: string | null;
+  /** Resolved avatar thumbnail URL, or `undefined` when the account has no avatar. */
+  avatarUrl?: string;
+  /** Account's preferred Bloom color preset, or `null` when unset. */
+  color: string | null;
+  /** The underlying per-account user payload. */
+  user: SwitchableAccountUser;
+}
+
+/** Input to {@link projectSwitchableAccounts}. */
+export interface ProjectSwitchableAccountsInput {
+  /**
+   * The device-scoped session state from `SessionClient.getState()`. `null`
+   * (or an empty account set) contributes no device rows.
+   */
+  state: DeviceSessionState | null;
+  /** The caller's account graph (`oxyServices.listAccounts()`). `[]` when none. */
+  graph: AccountNode[];
+  /**
+   * Per-account profiles resolved via `oxyServices.getUsersByIds()`, keyed by
+   * account id (`User.id`). Device accounts whose profile is absent here are
+   * omitted until a subsequent fetch resolves them (unless they are the active
+   * account and `activeUser` is supplied).
+   */
+  profilesById: Map<string, User>;
+  /**
+   * The freshest copy of the ACTIVE account's user (e.g. `useOxy().user`),
+   * preferred over `profilesById` for the active row so a just-committed profile
+   * edit is reflected immediately. Optional — the controller relies on
+   * `profilesById` alone when omitted.
+   */
+  activeUser?: User | null;
+  /** Locale for display-name resolution (passed to `getAccountDisplayName`). */
+  locale?: string;
+  /**
+   * Resolves an avatar file id to a thumbnail URL — bind to
+   * `(id) => id ? oxyServices.getFileDownloadUrl(id, 'thumb') : undefined`.
+   */
+  resolveAvatarUrl: (avatar: string | null | undefined) => string | undefined;
+}
+
+/**
+ * Pure union of device sign-ins and account-graph nodes into the flat
+ * {@link SwitchableAccount}[] every switcher renders.
+ *
+ * Order: device rows first (in `state.accounts` order, active flagged), then
+ * graph-only rows (in graph order). An account present as BOTH a device session
+ * and a graph node is deduped into ONE device row enriched with the graph
+ * metadata (relationship / kind / parent / membership).
+ */
+export function projectSwitchableAccounts(input: ProjectSwitchableAccountsInput): SwitchableAccount[] {
+  const { state, graph, profilesById, activeUser, locale, resolveAvatarUrl } = input;
+  const activeAccountId = state?.activeAccountId ?? null;
+
+  const toRow = (
+    accountUser: User,
+    opts: {
+      sessionId?: string;
+      authuser?: number;
+      relationship?: AccountRelationship;
+      kind?: AccountKind;
+      parentAccountId?: string | null;
+      callerMembership?: AccountMember | null;
+    },
+  ): SwitchableAccount => {
+    const accountId = accountUser.id?.toString() ?? '';
+    const handle = getAccountFallbackHandle(accountUser);
+    const secondaryHandle = handle ? `@${handle}` : null;
+    return {
+      accountId,
+      sessionId: opts.sessionId,
+      authuser: opts.authuser,
+      isCurrent: Boolean(accountId) && accountId === activeAccountId,
+      onDevice: Boolean(opts.sessionId),
+      relationship: opts.relationship,
+      kind: opts.kind,
+      parentAccountId: opts.parentAccountId,
+      callerMembership: opts.callerMembership,
+      displayName: getAccountDisplayName(accountUser, locale),
+      // Real email, or the `@handle` fallback (NEVER synthesized).
+      email: accountUser.email ?? secondaryHandle,
+      avatarUrl: resolveAvatarUrl(accountUser.avatar),
+      color: accountUser.color ?? null,
+      user: accountUser,
+    };
+  };
+
+  // --- Device rows (from the server-authoritative session set) ---
+  const deviceRows = (state?.accounts ?? []).flatMap((account): SwitchableAccount[] => {
+    const isActive = account.accountId === activeAccountId;
+    // The active row prefers the freshest `activeUser` (when supplied), then the
+    // batch-resolved profile; every other row uses the batch-resolved profile.
+    const accountUser: User | undefined = isActive && activeUser
+      ? activeUser
+      : profilesById.get(account.accountId);
+    if (!accountUser) {
+      return [];
+    }
+    return [toRow(accountUser, { sessionId: account.sessionId, authuser: account.authuser })];
+  });
+
+  // --- Merge graph nodes, deduping by account id ---
+  const byAccountId = new Map<string, SwitchableAccount>();
+  const order: string[] = [];
+  const remember = (row: SwitchableAccount): void => {
+    if (!row.accountId || byAccountId.has(row.accountId)) {
+      return;
+    }
+    byAccountId.set(row.accountId, row);
+    order.push(row.accountId);
+  };
+
+  for (const row of deviceRows) {
+    remember(row);
+  }
+
+  for (const node of graph) {
+    const existing = byAccountId.get(node.accountId);
+    if (existing) {
+      // On-device account that is ALSO in the graph: enrich the device row with
+      // graph metadata; keep its (freshest) profile + sessionId + active flag.
+      byAccountId.set(node.accountId, {
+        ...existing,
+        relationship: node.relationship,
+        kind: node.kind,
+        parentAccountId: node.parentAccountId,
+        callerMembership: node.callerMembership,
+      });
+      continue;
+    }
+    // Graph-only account (owned org / shared, not yet a device session).
+    remember(toRow(node.account, {
+      relationship: node.relationship,
+      kind: node.kind,
+      parentAccountId: node.parentAccountId,
+      callerMembership: node.callerMembership,
+    }));
+  }
+
+  return order.flatMap((id) => {
+    const row = byAccountId.get(id);
+    return row ? [row] : [];
+  });
+}
+
+/**
+ * Every distinct account id referenced by a device session set AND an account
+ * graph, sorted for a stable profile-fetch key. Feed to
+ * `oxyServices.getUsersByIds(...)`; graph nodes already embed their `account`
+ * document, but including their ids lets the caller pass one id set and lets the
+ * projection prefer freshly-fetched profiles uniformly.
+ */
+export function switchableAccountIds(
+  state: DeviceSessionState | null,
+  graph: AccountNode[],
+): string[] {
+  const ids = new Set<string>();
+  for (const account of state?.accounts ?? []) {
+    if (account.accountId) {
+      ids.add(account.accountId);
+    }
+  }
+  for (const node of graph) {
+    if (node.accountId) {
+      ids.add(node.accountId);
+    }
+  }
+  return Array.from(ids).sort();
+}

package/src/session/createSessionClient.ts

@@ -1,5 +1,5 @@
 import type { OxyServices } from '../OxyServices';
-import { SessionClient, type TokenTransport } from './SessionClient';
+import { SessionClient, type SessionClientOptions, type TokenTransport } from './SessionClient';
 import type { SocketIOFactory } from './socketLoader';
 import { createSessionClientHost } from './sessionClientHost';
 
@@ -29,11 +29,18 @@ export function createSessionClient(
   oxyServices: OxyServices,
   transport: TokenTransport,
   socketFactory?: SocketIOFactory,
+  /**
+   * Optional signed-out realtime wiring: `signedOutSocketAuth` (open the socket
+   * while signed out so an idle tab receives its device pushes) and
+   * `onSessionAppeared` (self-acquire when a sibling signs in). See
+   * {@link SessionClientOptions}.
+   */
+  extra?: Pick<SessionClientOptions, 'signedOutSocketAuth' | 'onSessionAppeared'>,
 ): {
   client: SessionClient;
   host: ReturnType<typeof createSessionClientHost>;
 } {
   const host = createSessionClientHost(oxyServices);
-  const client = new SessionClient(host, { transport, socketFactory });
+  const client = new SessionClient(host, { transport, socketFactory, ...extra });
   return { client, host };
 }

package/src/shared/utils/debugUtils.ts

@@ -24,7 +24,7 @@ export const isDev = (): boolean => {
 
 /**
  * Log a debug message (only in development)
- * @param prefix - Log prefix (e.g., '[FedCM]')
+ * @param prefix - Log prefix (e.g., '[ColdBoot]')
  * @param args - Arguments to log
  */
 export const debugLog = (prefix: string, ...args: unknown[]): void => {
@@ -57,12 +57,12 @@ export const debugError = (prefix: string, ...args: unknown[]): void => {
 
 /**
  * Create a namespaced debug logger
- * @param namespace - Logger namespace (e.g., 'FedCM', 'SilentAuth')
+ * @param namespace - Logger namespace (e.g., 'ColdBoot', 'DeviceAuth')
  * @returns Object with log, warn, error methods
  *
  * @example
  * ```ts
- * const debug = createDebugLogger('FedCM');
+ * const debug = createDebugLogger('ColdBoot');
  * debug.log('Starting authentication');
  * debug.warn('Token expires soon');
  * debug.error('Authentication failed', error);

package/src/utils/__tests__/authWebUrl.test.ts

@@ -1,26 +1,15 @@
 /**
- * Central IdP apex/origin constants.
+ * Central IdP apex constant.
  *
- * `resolveCentralAuthUrl` was removed in the device-first cutover (the SDK no
- * longer resolves an IdP host). The `CENTRAL_IDP_APEX` / `CENTRAL_AUTH_URL`
- * constants survive because the IdP worker imports them to brand assertions.
+ * `resolveCentralAuthUrl` + `CENTRAL_AUTH_URL` were removed in the device-first /
+ * legacy-final cutovers. `CENTRAL_IDP_APEX` survives because live server-side
+ * callers (the `@oxyhq/core/server` CORS helper + the IdP worker) import it.
  */
 
-import { CENTRAL_AUTH_URL, CENTRAL_IDP_APEX } from '../authWebUrl';
+import { CENTRAL_IDP_APEX } from '../authWebUrl';
 
 describe('CENTRAL_IDP_APEX', () => {
   it('is the central IdP registrable apex', () => {
     expect(CENTRAL_IDP_APEX).toBe('oxy.so');
   });
 });
-
-describe('CENTRAL_AUTH_URL', () => {
-  it('is the central IdP origin with no trailing slash', () => {
-    expect(CENTRAL_AUTH_URL).toBe('https://auth.oxy.so');
-    expect(CENTRAL_AUTH_URL.endsWith('/')).toBe(false);
-  });
-
-  it('is derived from CENTRAL_IDP_APEX (apex and origin never drift)', () => {
-    expect(CENTRAL_AUTH_URL).toBe(`https://auth.${CENTRAL_IDP_APEX}`);
-  });
-});

package/src/utils/__tests__/{fapiAutoDetect.test.ts → registrableApex.test.ts}

@@ -6,7 +6,7 @@
  * surface + the IdP). These cases lock its Public-Suffix-List behaviour.
  */
 
-import { registrableApex } from '../fapiAutoDetect';
+import { registrableApex } from '../registrableApex';
 
 describe('registrableApex', () => {
   it('returns the eTLD+1 for a normal two-label host', () => {

package/src/utils/accountUtils.ts

@@ -14,9 +14,8 @@ export interface QuickAccount {
     avatarUrl?: string;
     /**
      * Device-local account slot index, 0..N-1 (Google-style multi-account).
-     * Mirrors the server's `oxy_rt_${authuser}` cookie slot. Optional so that
-     * pre-multi-account QuickAccounts (sessionId-only, non-cookie auth on RN)
-     * remain valid; web flows always populate it after `refreshAllSessions`.
+     * Optional so that pre-multi-account QuickAccounts (sessionId-only) remain
+     * valid; the device session set populates it where available.
      */
     authuser?: number;
     /**

package/src/utils/authWebUrl.ts

@@ -1,38 +1,17 @@
 /**
- * Central IdP (auth web) URL resolution for cross-domain SSO.
+ * Central IdP apex constant.
  *
- * The Oxy ecosystem runs a single, central Identity Provider at
- * `auth.oxy.so`. For TRUE central cross-domain SSO (Google/Meta/Clerk style),
- * FedCM and the opaque-code SSO bounce always target this one origin — it owns
- * the host-only `fedcm_session` cookie and the central session store reachable
- * via `api.oxy.so`. Relying Parties (mention.earth, homiio.com, alia.onl, …)
- * delegate to it rather than standing up a per-apex IdP.
- *
- * This module is intentionally pure: it performs no DOM access, reads no
- * `window`/`location`, and has no side effects. It is the single source of
- * truth for the central IdP origin so call sites never hardcode the literal.
- *
- * LEGACY(old-sdk): the client resolver (`resolveCentralAuthUrl`) was removed in
- * the device-first cutover; `CENTRAL_IDP_APEX` / `CENTRAL_AUTH_URL` survive ONLY
- * because the lista-B IdP worker imports them to brand assertions. Deletable
- * once Homiio/Allo/Alia/Syra are bumped off the old SDK AND CloudWatch
- * `/oxy/ecs` shows the `/sso*` + `/fedcm/*` routes quiet — F-final sweep.
+ * The client SSO/FedCM resolvers (`resolveCentralAuthUrl`, `CENTRAL_AUTH_URL`)
+ * were removed in the device-first / legacy-final cutovers. The lone survivor is
+ * `CENTRAL_IDP_APEX`, kept because it has a LIVE consumer —
+ * `@oxyhq/core/server`'s CORS helper (`server/cors.ts`'s `createOxyCors`)
+ * auto-allows `*.oxy.so` from it. That CORS use is permanent, so this stays
+ * past the SSO/FedCM teardown.
  */
 
 /**
  * The registrable apex (eTLD+1) of the Oxy ecosystem's central Identity
- * Provider. The central IdP is reachable at `auth.${CENTRAL_IDP_APEX}` and the
- * ID-token assertion issuer is always `https://auth.${CENTRAL_IDP_APEX}`
- * regardless of which per-apex `auth.<rp>` host served a given request.
- *
- * Kept as a standalone constant so the IdP worker and the SDK derive the same
- * literal from one source of truth (the worker imports it to brand assertions).
+ * Provider, reachable at `auth.${CENTRAL_IDP_APEX}`. Single source of truth so
+ * the CORS helper (and anything else that needs the central apex) never drifts.
  */
 export const CENTRAL_IDP_APEX = 'oxy.so';
-
-/**
- * The canonical central Identity Provider origin for the Oxy ecosystem.
- * No trailing slash. Derived from {@link CENTRAL_IDP_APEX} so the apex and the
- * full origin never drift apart. The IdP worker imports it to brand assertions.
- */
-export const CENTRAL_AUTH_URL = `https://auth.${CENTRAL_IDP_APEX}`;

package/src/utils/coldBoot.ts

@@ -3,19 +3,21 @@
  * authentication resolution.
  *
  * On a fresh page load / app launch the SDK may have several ways to recover an
- * existing session (silent FedCM, a persisted refresh token, a cross-domain
- * claim, a redirect SSO return, ...). They must be attempted in a deterministic
- * order*, and the FIRST one that yields a session wins — every later step is
- * skipped. This module encodes exactly that contract and nothing else.
+ * existing session (a persisted refresh-token family, a shared-keychain
+ * identity, a cross-domain boot-fragment return, ...). They must be attempted
+ * in a deterministic order, and the FIRST one that yields a session wins —
+ * every later step is skipped. This module encodes exactly that contract and
+ * nothing else.
  *
  * Design constraints (all enforced):
  *   - PURE: no DOM, no `navigator`, no `window`, no React, no platform globals.
  *   - NO module-level mutable state. Every call to {@link runColdBoot} is fully
  *     self-contained, so it is safe under bundler re-evaluation (e.g. the Metro
- *     web bundle, which is precisely why the FedCM silent-SSO guard had to live
- *     in consumers rather than a core singleton).
- *   - Architecture-agnostic: both candidate cross-domain SSO designs consume
- *     this same primitive; it knows nothing about HOW a step resolves a session.
+ *     web bundle — the reason any run-once guard for a step must live in the
+ *     calling consumer, never in a core module-level singleton).
+ *   - Architecture-agnostic: it knows nothing about HOW a step resolves a
+ *     session; `runSessionColdBoot` (`boot/coldBootV2.ts`) is the current
+ *     device-first consumer.
  *
  * A step is skipped (without running) when its `enabled` predicate returns
  * false. Any thrown error — from either `enabled` or `run` — is reported via
@@ -104,15 +106,16 @@ export interface RunColdBootOptions<S> {
    * fails to settle before the deadline, the runner abandons the await for that
    * step (reporting it via `onStepDeadline`) and CONTINUES to the next step,
    * each now racing against an already-expired deadline. This is deliberate:
-   * the runner keeps iterating so the TERMINAL step (e.g. the `/sso` bounce,
-   * whose `run()` performs its side effect synchronously before its first
-   * `await`) still gets to fire. A step that has nothing to contribute after
-   * the deadline simply doesn't settle and is skipped in turn.
+   * the runner keeps iterating so the TERMINAL step (e.g. `coldBootV2`'s
+   * `bootstrap-hop`, whose `run()` performs its navigation side effect
+   * synchronously before its first `await`) still gets to fire. A step that
+   * has nothing to contribute after the deadline simply doesn't settle and is
+   * skipped in turn.
    *
    * Per-step timeouts inside `run()` remain the first line of defense and
    * should keep every step well under this budget on a healthy load; this only
-   * trips when one of them regresses (the production FedCM-silent hang). When
-   * omitted there is no overall deadline.
+   * trips when one of them regresses (a step hanging past its own timeout).
+   * When omitted there is no overall deadline.
    */
   readonly overallDeadlineMs?: number;
   /**

package/src/utils/{fapiAutoDetect.ts → registrableApex.ts}

@@ -1,17 +1,15 @@
 /**
  * Registrable-apex (eTLD+1) host kernel.
  *
- * The client FAPI auto-detection helper (`autoDetectAuthWebUrl`) was removed in
- * the device-first cutover — the SDK no longer derives a per-apex `auth.<rp>`
- * IdP host. What survives is the pure registrable-domain kernel, still used by
- * the api SSO surface, `fedcm.service`, `deviceAuth` (same-apex trust checks),
- * and the IdP worker (all lista B / server-side). `@oxyhq/core/server`
- * re-exports it for the api.
+ * The client FAPI auto-detection helper was removed in the device-first cutover
+ * (which is why this file is now named for what it actually is, not the old
+ * `fapiAutoDetect`). What survives is the pure registrable-domain kernel, still
+ * used server-side by the api's device-first same-apex trust checks
+ * (`deviceAuth.ts`'s `POST /auth/device/web-session`, via `sameSite.ts`'s
+ * `isSameSiteTrustedRequest`) and the `@oxyhq/core/server` CORS/re-export layer.
  *
- * LEGACY(old-sdk): `registrableApex` survives ONLY for the lista-B server/IdP
- * SSO surface. Deletable once Homiio/Allo/Alia/Syra are bumped off the old SDK
- * AND CloudWatch `/oxy/ecs` shows the `/sso*` + `/fedcm/*` routes quiet — the
- * F-final sweep should remove this file then.
+ * `registrableApex` is NOT legacy — the device-first same-apex check is a live
+ * consumer, so this kernel stays regardless of the SSO/FedCM removal.
  */
 
 import { getDomain } from 'tldts';

package/dist/cjs/mixins/OxyServices.authorizedApps.js

@@ -1,38 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.OxyServicesAuthorizedAppsMixin = OxyServicesAuthorizedAppsMixin;
-function OxyServicesAuthorizedAppsMixin(Base) {
-    return class extends Base {
-        /**
-         * List the authenticated user's authorized RP apps — the intersection of the
-         * user's FedCM grants and the currently-approved RP catalog. Powers the
-         * "Connected apps" management UI. Requires a real user session.
-         */
-        async listAuthorizedApps() {
-            try {
-                const response = await this.makeRequest('GET', '/fedcm/me/authorized-apps', undefined, {
-                    cache: true,
-                    cacheTTL: 30 * 1000, // 30 second cache — short, this drives a manageable UI
-                });
-                return response?.apps ?? [];
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Revoke the authenticated user's authorization for a specific RP origin.
-         * The corresponding cache entry is invalidated so a subsequent
-         * `listAuthorizedApps()` sees fresh data.
-         */
-        async revokeAuthorizedApp(origin) {
-            try {
-                await this.makeRequest('DELETE', `/fedcm/me/authorized-apps/${encodeURIComponent(origin)}`, undefined, { cache: false });
-                this.clearCacheEntry('GET:/fedcm/me/authorized-apps');
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-    };
-}

package/dist/esm/mixins/OxyServices.authorizedApps.js

@@ -1,35 +0,0 @@
-export function OxyServicesAuthorizedAppsMixin(Base) {
-    return class extends Base {
-        /**
-         * List the authenticated user's authorized RP apps — the intersection of the
-         * user's FedCM grants and the currently-approved RP catalog. Powers the
-         * "Connected apps" management UI. Requires a real user session.
-         */
-        async listAuthorizedApps() {
-            try {
-                const response = await this.makeRequest('GET', '/fedcm/me/authorized-apps', undefined, {
-                    cache: true,
-                    cacheTTL: 30 * 1000, // 30 second cache — short, this drives a manageable UI
-                });
-                return response?.apps ?? [];
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-        /**
-         * Revoke the authenticated user's authorization for a specific RP origin.
-         * The corresponding cache entry is invalidated so a subsequent
-         * `listAuthorizedApps()` sees fresh data.
-         */
-        async revokeAuthorizedApp(origin) {
-            try {
-                await this.makeRequest('DELETE', `/fedcm/me/authorized-apps/${encodeURIComponent(origin)}`, undefined, { cache: false });
-                this.clearCacheEntry('GET:/fedcm/me/authorized-apps');
-            }
-            catch (error) {
-                throw this.handleError(error);
-            }
-        }
-    };
-}