@oxyhq/core 7.1.0 → 7.1.1

package/dist/esm/session/accountDialogController.js

@@ -56,6 +56,9 @@ export class AccountDialogController {
         this.pollTimer = null;
         // --- Store plumbing ---
         this.unsubscribeSession = null;
+        this.unsubscribeTokens = null;
+        /** Last-observed SDK auth readiness (a planted bearer). Drives the fetch edge. */
+        this.authed = false;
         this.started = false;
         this.refreshSeq = 0;
         this.oxyServices = options.oxyServices;
@@ -95,13 +98,28 @@ export class AccountDialogController {
         if (this.started)
             return;
         this.started = true;
+        this.authed = this.isAuthenticated();
         this.unsubscribeSession = this.sessionClient.subscribe(() => {
             // A device-state change (switch / sign-out / sibling sign-in) can add or
-            // remove accounts — re-project immediately, and refetch profiles when new
-            // account ids appeared.
+            // remove accounts — re-project immediately, refetch profiles when new
+            // account ids appeared, and reconcile the auth-readiness edge.
             this.emit();
             void this.ensureProfiles();
+            this.reconcileAuth();
         });
+        // The access token is planted AFTER `SessionClient.applyState` fires its
+        // subscription (`applySync` calls `setTokens` only once `applyState`/notify
+        // has returned; `ensureActiveToken` plants it async later), so the
+        // device-state subscription alone cannot observe the signed-out → signed-in
+        // edge. Observe the SDK-canonical readiness signal directly — a change to
+        // `oxyServices.getAccessToken()`, the `hasAccessToken` term of
+        // `OxyContext.canUsePrivateApi`.
+        this.unsubscribeTokens = this.oxyServices.onTokensChanged(() => {
+            this.reconcileAuth();
+        });
+        // Initial projection is device-only. `refresh()` fetches the graph IFF a
+        // bearer is already planted (warm start); when signed out (cold boot before
+        // restore) it re-projects from device state and makes NO private call.
         void this.refresh();
     }
     /**
@@ -114,10 +132,58 @@ export class AccountDialogController {
             this.unsubscribeSession();
             this.unsubscribeSession = null;
         }
+        if (this.unsubscribeTokens) {
+            this.unsubscribeTokens();
+            this.unsubscribeTokens = null;
+        }
         this.clearPollTimer();
         this.listeners.clear();
     }
     // =========================================================================
+    // Auth readiness (SDK-canonical — mirrors OxyContext.canUsePrivateApi)
+    // =========================================================================
+    /**
+     * Whether a PRIVATE endpoint may be called right now. Mirrors the
+     * `hasAccessToken` term of `OxyContext.canUsePrivateApi`
+     * (`authResolved && isAuthenticated && tokenReady && hasAccessToken`, where
+     * `hasAccessToken = Boolean(oxyServices.getAccessToken())`): a planted bearer
+     * is the only term that decides whether a request carries auth — the other
+     * three are provider render-lifecycle gates with no headless equivalent.
+     *
+     * `listAccounts()` (`GET /accounts`) and `getUsersByIds()`
+     * (`POST /users/by-ids`) are private; calling either before cold-boot restore
+     * plants the token 401s → `HttpService` clears the bearer + emits
+     * `onTokensChanged(null)` → the app signs out. Every graph/profile fetch gates
+     * on this.
+     */
+    isAuthenticated() {
+        return Boolean(this.oxyServices.getAccessToken());
+    }
+    /**
+     * Reconcile the account graph against the current auth-readiness edge. On the
+     * signed-out → signed-in edge fetch the graph ONCE; on signed-in → signed-out
+     * drop it and re-project device-only. A no-op when readiness is unchanged, so
+     * a burst of token events / device pushes cannot restart the fetch — and a
+     * failed `listAccounts()` never flips the edge, so it cannot re-trigger itself
+     * (no retry storm).
+     */
+    reconcileAuth() {
+        const authed = this.isAuthenticated();
+        if (authed === this.authed)
+            return;
+        this.authed = authed;
+        if (authed) {
+            void this.refresh();
+            return;
+        }
+        // Signed out: the graph is no longer fetchable/switchable — drop it and
+        // re-project from the device session set alone.
+        this.graph = [];
+        this.error = null;
+        this.loading = false;
+        this.emit();
+    }
+    // =========================================================================
     // View actions
     // =========================================================================
     /** Set the dialog view directly. */
@@ -146,6 +212,17 @@ export class AccountDialogController {
      */
     async refresh() {
         const seq = ++this.refreshSeq;
+        // Never hit the private `listAccounts()` while signed out: at cold boot the
+        // bearer is not planted yet, so the call 401s → `HttpService` clears the
+        // token and signs the user out. Re-project from the device session set alone
+        // (`projectSwitchableAccounts` works from `SessionClient` state) and stop.
+        if (!this.isAuthenticated()) {
+            this.graph = [];
+            this.loading = false;
+            this.error = null;
+            this.emit();
+            return;
+        }
         const hadAccounts = this.snapshot.accounts.length > 0;
         this.loading = !hadAccounts;
         this.error = null;
@@ -175,6 +252,9 @@ export class AccountDialogController {
      * subscription so a newly-added device account gets a name/avatar.
      */
     async ensureProfiles() {
+        // `getUsersByIds` is private — skip the whole path while signed out.
+        if (!this.isAuthenticated())
+            return;
         const ids = switchableAccountIds(this.sessionClient.getState(), this.graph);
         if (ids.every((id) => this.profilesById.has(id)))
             return;
@@ -182,6 +262,11 @@ export class AccountDialogController {
         this.emit();
     }
     async loadProfiles(seq) {
+        // `getUsersByIds` (`POST /users/by-ids`) is a private call — never issue it
+        // while signed out (the 401 → sign-out cascade). Callers already gate; this
+        // guards the network chokepoint too (e.g. the token was cleared mid-refresh).
+        if (!this.isAuthenticated())
+            return;
         const ids = switchableAccountIds(this.sessionClient.getState(), this.graph);
         if (ids.length === 0)
             return;