@oxyhq/core 7.1.0 → 7.1.1

package/dist/types/session/accountDialogController.d.ts

@@ -131,6 +131,9 @@ export declare class AccountDialogController {
     private signInToken;
     private pollTimer;
     private unsubscribeSession;
+    private unsubscribeTokens;
+    /** Last-observed SDK auth readiness (a planted bearer). Drives the fetch edge. */
+    private authed;
     private started;
     private refreshSeq;
     private snapshot;
@@ -150,6 +153,30 @@ export declare class AccountDialogController {
      * active sign-in flow (timers). Idempotent.
      */
     destroy(): void;
+    /**
+     * Whether a PRIVATE endpoint may be called right now. Mirrors the
+     * `hasAccessToken` term of `OxyContext.canUsePrivateApi`
+     * (`authResolved && isAuthenticated && tokenReady && hasAccessToken`, where
+     * `hasAccessToken = Boolean(oxyServices.getAccessToken())`): a planted bearer
+     * is the only term that decides whether a request carries auth — the other
+     * three are provider render-lifecycle gates with no headless equivalent.
+     *
+     * `listAccounts()` (`GET /accounts`) and `getUsersByIds()`
+     * (`POST /users/by-ids`) are private; calling either before cold-boot restore
+     * plants the token 401s → `HttpService` clears the bearer + emits
+     * `onTokensChanged(null)` → the app signs out. Every graph/profile fetch gates
+     * on this.
+     */
+    private isAuthenticated;
+    /**
+     * Reconcile the account graph against the current auth-readiness edge. On the
+     * signed-out → signed-in edge fetch the graph ONCE; on signed-in → signed-out
+     * drop it and re-project device-only. A no-op when readiness is unchanged, so
+     * a burst of token events / device pushes cannot restart the fetch — and a
+     * failed `listAccounts()` never flips the edge, so it cannot re-trigger itself
+     * (no retry storm).
+     */
+    private reconcileAuth;
     /** Set the dialog view directly. */
     setView(view: AccountDialogView): void;
     /** Return to the account list and cancel any in-flight sign-in flow. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/core",
-  "version": "7.1.0",
+  "version": "7.1.1",
   "description": "OxyHQ SDK Foundation — API client, authentication, cryptographic identity, and shared utilities",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/src/session/__tests__/accountDialogController.test.ts

@@ -65,6 +65,8 @@ function graphNode(id: string, over: Partial<AccountNode> = {}): AccountNode {
 }
 
 interface OxyMock {
+  getAccessToken: jest.Mock;
+  onTokensChanged: jest.Mock;
   listAccounts: jest.Mock;
   getUsersByIds: jest.Mock;
   getFileDownloadUrl: jest.Mock;
@@ -73,10 +75,24 @@ interface OxyMock {
   pollCommonsSignIn: jest.Mock;
   claimSessionByToken: jest.Mock;
   signInWithSharedIdentity: jest.Mock;
+  /**
+   * Test helper: set the current access token and fire every registered
+   * `onTokensChanged` listener (mirrors `OxyServices.setTokens`/`clearTokens`).
+   * With no listener yet registered (before `start()`), it just sets the token.
+   */
+  emitTokenChange: (token: string | null) => void;
 }
 
 function makeOxy(): OxyMock {
+  const tokenListeners = new Set<(token: string | null) => void>();
+  // Authenticated by default (mirrors a warm start with a planted bearer).
+  let currentToken: string | null = 'access-token';
   return {
+    getAccessToken: jest.fn(() => currentToken),
+    onTokensChanged: jest.fn((listener: (token: string | null) => void) => {
+      tokenListeners.add(listener);
+      return () => tokenListeners.delete(listener);
+    }),
     listAccounts: jest.fn().mockResolvedValue([]),
     getUsersByIds: jest.fn().mockResolvedValue([]),
     getFileDownloadUrl: jest.fn((id: string) => `https://cdn/${id}`),
@@ -85,9 +101,18 @@ function makeOxy(): OxyMock {
     pollCommonsSignIn: jest.fn(),
     claimSessionByToken: jest.fn(),
     signInWithSharedIdentity: jest.fn().mockResolvedValue(null),
+    emitTokenChange: (token: string | null) => {
+      currentToken = token;
+      for (const listener of tokenListeners) {
+        listener(token);
+      }
+    },
   };
 }
 
+/** Flush pending microtasks (a `start()`-triggered `refresh()` cannot be awaited directly). */
+const flush = (): Promise<void> => new Promise((resolve) => setTimeout(resolve, 0));
+
 interface Harness {
   controller: AccountDialogController;
   oxy: OxyMock;
@@ -193,6 +218,104 @@ describe('AccountDialogController — account list', () => {
   });
 });
 
+describe('AccountDialogController — auth-gated graph fetch (prod sign-out fix)', () => {
+  it('start() while signed out does NOT call the private listAccounts / getUsersByIds and does not error', async () => {
+    const { controller, oxy, sc } = makeHarness();
+    oxy.emitTokenChange(null); // cold boot: no bearer planted yet (no listeners registered pre-start)
+    sc.set(state([{ accountId: 'a1', sessionId: 's1' }], 'a1'));
+
+    controller.start();
+    await flush();
+
+    expect(oxy.listAccounts).not.toHaveBeenCalled();
+    expect(oxy.getUsersByIds).not.toHaveBeenCalled();
+    const snap = controller.getSnapshot();
+    expect(snap.error).toBeNull();
+    expect(snap.loading).toBe(false);
+    controller.destroy();
+  });
+
+  it('refresh() while signed out re-projects device-only and skips the network call', async () => {
+    const { controller, oxy } = makeHarness();
+    oxy.emitTokenChange(null);
+
+    await controller.refresh();
+
+    expect(oxy.listAccounts).not.toHaveBeenCalled();
+    const snap = controller.getSnapshot();
+    expect(snap.loading).toBe(false);
+    expect(snap.error).toBeNull();
+  });
+
+  it('start() while authenticated fetches the graph exactly once', async () => {
+    const { controller, oxy, sc } = makeHarness();
+    sc.set(state([{ accountId: 'a1', sessionId: 's1' }], 'a1'));
+    oxy.listAccounts.mockResolvedValue([graphNode('org1')]);
+    oxy.getUsersByIds.mockResolvedValue([user('a1'), user('org1')]);
+
+    controller.start();
+    await flush();
+
+    expect(oxy.listAccounts).toHaveBeenCalledTimes(1);
+    expect(controller.getSnapshot().accounts.map((r) => r.accountId)).toEqual(['a1', 'org1']);
+    controller.destroy();
+  });
+
+  it('fetches the graph once when the bearer is planted after a signed-out start', async () => {
+    const { controller, oxy } = makeHarness();
+    oxy.emitTokenChange(null);
+    controller.start();
+    await flush();
+    expect(oxy.listAccounts).not.toHaveBeenCalled();
+
+    // Cold-boot restore plants the token → onTokensChanged → single graph fetch.
+    oxy.emitTokenChange('access-token');
+    await flush();
+    expect(oxy.listAccounts).toHaveBeenCalledTimes(1);
+    controller.destroy();
+  });
+
+  it('drops the graph and re-projects device-only (no fetch) when the token is cleared', async () => {
+    const { controller, oxy, sc } = makeHarness();
+    sc.set(state([{ accountId: 'a1', sessionId: 's1' }], 'a1'));
+    oxy.listAccounts.mockResolvedValue([graphNode('org1')]);
+    oxy.getUsersByIds.mockResolvedValue([user('a1'), user('org1')]);
+    controller.start();
+    await flush();
+    expect(controller.getSnapshot().accounts.map((r) => r.accountId)).toEqual(['a1', 'org1']);
+
+    oxy.listAccounts.mockClear();
+    oxy.emitTokenChange(null); // a 401 cleared the bearer
+    await flush();
+
+    expect(oxy.listAccounts).not.toHaveBeenCalled();
+    // Graph-only org1 is gone; the device row survives.
+    expect(controller.getSnapshot().accounts.map((r) => r.accountId)).toEqual(['a1']);
+    controller.destroy();
+  });
+
+  it('does not loop when listAccounts rejects — at most one call per refresh, no re-trigger on device changes', async () => {
+    const { controller, oxy, sc } = makeHarness();
+    sc.set(state([{ accountId: 'a1', sessionId: 's1' }], 'a1'));
+    oxy.getUsersByIds.mockResolvedValue([user('a1')]);
+    oxy.listAccounts.mockRejectedValue(new Error('graph boom'));
+
+    controller.start();
+    await flush();
+    expect(oxy.listAccounts).toHaveBeenCalledTimes(1);
+    expect(controller.getSnapshot().error).toBe('graph boom');
+
+    // A subsequent device-state push must NOT re-trigger the graph fetch (auth
+    // edge unchanged → reconcileAuth is a no-op → no storm).
+    sc.set(state([{ accountId: 'a1', sessionId: 's1' }], 'a1', 2));
+    await flush();
+    expect(oxy.listAccounts).toHaveBeenCalledTimes(1);
+    // Device row still rendered despite the graph failure.
+    expect(controller.getSnapshot().accounts.map((r) => r.accountId)).toEqual(['a1']);
+    controller.destroy();
+  });
+});
+
 describe('AccountDialogController — switchTo (uniform switch)', () => {
   it('uses SessionClient.switchAccount for an account already on the device', async () => {
     const { controller, oxy, sc } = makeHarness();

package/src/session/accountDialogController.ts

@@ -166,6 +166,9 @@ export class AccountDialogController {
 
   // --- Store plumbing ---
   private unsubscribeSession: (() => void) | null = null;
+  private unsubscribeTokens: (() => void) | null = null;
+  /** Last-observed SDK auth readiness (a planted bearer). Drives the fetch edge. */
+  private authed = false;
   private started = false;
   private refreshSeq = 0;
   private snapshot: AccountDialogSnapshot;
@@ -212,13 +215,28 @@ export class AccountDialogController {
   start(): void {
     if (this.started) return;
     this.started = true;
+    this.authed = this.isAuthenticated();
     this.unsubscribeSession = this.sessionClient.subscribe(() => {
       // A device-state change (switch / sign-out / sibling sign-in) can add or
-      // remove accounts — re-project immediately, and refetch profiles when new
-      // account ids appeared.
+      // remove accounts — re-project immediately, refetch profiles when new
+      // account ids appeared, and reconcile the auth-readiness edge.
       this.emit();
       void this.ensureProfiles();
+      this.reconcileAuth();
     });
+    // The access token is planted AFTER `SessionClient.applyState` fires its
+    // subscription (`applySync` calls `setTokens` only once `applyState`/notify
+    // has returned; `ensureActiveToken` plants it async later), so the
+    // device-state subscription alone cannot observe the signed-out → signed-in
+    // edge. Observe the SDK-canonical readiness signal directly — a change to
+    // `oxyServices.getAccessToken()`, the `hasAccessToken` term of
+    // `OxyContext.canUsePrivateApi`.
+    this.unsubscribeTokens = this.oxyServices.onTokensChanged(() => {
+      this.reconcileAuth();
+    });
+    // Initial projection is device-only. `refresh()` fetches the graph IFF a
+    // bearer is already planted (warm start); when signed out (cold boot before
+    // restore) it re-projects from device state and makes NO private call.
     void this.refresh();
   }
 
@@ -232,10 +250,60 @@ export class AccountDialogController {
       this.unsubscribeSession();
       this.unsubscribeSession = null;
     }
+    if (this.unsubscribeTokens) {
+      this.unsubscribeTokens();
+      this.unsubscribeTokens = null;
+    }
     this.clearPollTimer();
     this.listeners.clear();
   }
 
+  // =========================================================================
+  // Auth readiness (SDK-canonical — mirrors OxyContext.canUsePrivateApi)
+  // =========================================================================
+
+  /**
+   * Whether a PRIVATE endpoint may be called right now. Mirrors the
+   * `hasAccessToken` term of `OxyContext.canUsePrivateApi`
+   * (`authResolved && isAuthenticated && tokenReady && hasAccessToken`, where
+   * `hasAccessToken = Boolean(oxyServices.getAccessToken())`): a planted bearer
+   * is the only term that decides whether a request carries auth — the other
+   * three are provider render-lifecycle gates with no headless equivalent.
+   *
+   * `listAccounts()` (`GET /accounts`) and `getUsersByIds()`
+   * (`POST /users/by-ids`) are private; calling either before cold-boot restore
+   * plants the token 401s → `HttpService` clears the bearer + emits
+   * `onTokensChanged(null)` → the app signs out. Every graph/profile fetch gates
+   * on this.
+   */
+  private isAuthenticated(): boolean {
+    return Boolean(this.oxyServices.getAccessToken());
+  }
+
+  /**
+   * Reconcile the account graph against the current auth-readiness edge. On the
+   * signed-out → signed-in edge fetch the graph ONCE; on signed-in → signed-out
+   * drop it and re-project device-only. A no-op when readiness is unchanged, so
+   * a burst of token events / device pushes cannot restart the fetch — and a
+   * failed `listAccounts()` never flips the edge, so it cannot re-trigger itself
+   * (no retry storm).
+   */
+  private reconcileAuth(): void {
+    const authed = this.isAuthenticated();
+    if (authed === this.authed) return;
+    this.authed = authed;
+    if (authed) {
+      void this.refresh();
+      return;
+    }
+    // Signed out: the graph is no longer fetchable/switchable — drop it and
+    // re-project from the device session set alone.
+    this.graph = [];
+    this.error = null;
+    this.loading = false;
+    this.emit();
+  }
+
   // =========================================================================
   // View actions
   // =========================================================================
@@ -269,6 +337,19 @@ export class AccountDialogController {
    */
   async refresh(): Promise<void> {
     const seq = ++this.refreshSeq;
+
+    // Never hit the private `listAccounts()` while signed out: at cold boot the
+    // bearer is not planted yet, so the call 401s → `HttpService` clears the
+    // token and signs the user out. Re-project from the device session set alone
+    // (`projectSwitchableAccounts` works from `SessionClient` state) and stop.
+    if (!this.isAuthenticated()) {
+      this.graph = [];
+      this.loading = false;
+      this.error = null;
+      this.emit();
+      return;
+    }
+
     const hadAccounts = this.snapshot.accounts.length > 0;
     this.loading = !hadAccounts;
     this.error = null;
@@ -299,6 +380,8 @@ export class AccountDialogController {
    * subscription so a newly-added device account gets a name/avatar.
    */
   private async ensureProfiles(): Promise<void> {
+    // `getUsersByIds` is private — skip the whole path while signed out.
+    if (!this.isAuthenticated()) return;
     const ids = switchableAccountIds(this.sessionClient.getState(), this.graph);
     if (ids.every((id) => this.profilesById.has(id))) return;
     await this.loadProfiles(this.refreshSeq);
@@ -306,6 +389,10 @@ export class AccountDialogController {
   }
 
   private async loadProfiles(seq: number): Promise<void> {
+    // `getUsersByIds` (`POST /users/by-ids`) is a private call — never issue it
+    // while signed out (the 401 → sign-out cascade). Callers already gate; this
+    // guards the network chokepoint too (e.g. the token was cleared mid-refresh).
+    if (!this.isAuthenticated()) return;
     const ids = switchableAccountIds(this.sessionClient.getState(), this.graph);
     if (ids.length === 0) return;
     let profiles: User[] = [];