@oxyhq/core 7.1.0 → 8.0.0

package/src/mixins/OxyServices.connectedApps.ts

@@ -41,6 +41,10 @@ export interface PublicApplication {
   icon?: string;
   /** Optional public website/homepage URL for the application. */
   websiteUrl?: string;
+  /** Optional public privacy-policy URL, rendered as a legal link on the consent screen. */
+  privacyPolicyUrl?: string;
+  /** Optional public terms-of-service URL, rendered as a legal link on the consent screen. */
+  termsUrl?: string;
   /** Application classification (set by Oxy platform staff). */
   type: ApplicationType;
   /** Whether the application is an officially endorsed Oxy application. */

package/src/mixins/OxyServices.devices.ts

@@ -2,6 +2,7 @@
  * Device Methods Mixin
  */
 import type { OxyServicesBase } from '../OxyServices.base';
+import type { DeviceLinkedSession, DeviceLinkedSessionLogoutResponse } from '../models/interfaces';
 
 export function OxyServicesDevicesMixin<T extends typeof OxyServicesBase>(Base: T) {
   return class extends Base {
@@ -54,11 +55,11 @@ export function OxyServicesDevicesMixin<T extends typeof OxyServicesBase>(Base:
      * @param sessionId - The session ID
      * @returns Array of device sessions
      */
-    async getDeviceSessions(sessionId: string): Promise<any[]> {
+    async getDeviceSessions(sessionId: string): Promise<DeviceLinkedSession[]> {
       try {
         // Use makeRequest for consistent error handling and optional caching
         // Cache disabled by default to ensure fresh session data
-        return await this.makeRequest<any[]>('GET', `/session/device/sessions/${sessionId}`, undefined, {
+        return await this.makeRequest<DeviceLinkedSession[]>('GET', `/session/device/sessions/${sessionId}`, undefined, {
           cache: false, // Don't cache sessions - always get fresh data
           deduplicate: true, // Deduplicate concurrent requests for same sessionId
         });
@@ -74,12 +75,12 @@ export function OxyServicesDevicesMixin<T extends typeof OxyServicesBase>(Base:
      * @param excludeCurrent - Whether to exclude the current session
      * @returns Logout result
      */
-    async logoutAllDeviceSessions(sessionId: string, deviceId?: string, excludeCurrent?: boolean): Promise<any> {
+    async logoutAllDeviceSessions(sessionId: string, deviceId?: string, excludeCurrent?: boolean): Promise<DeviceLinkedSessionLogoutResponse> {
       try {
-        const urlParams: any = {};
+        const urlParams: Record<string, string> = {};
         if (deviceId) urlParams.deviceId = deviceId;
         if (excludeCurrent) urlParams.excludeCurrent = 'true';
-        return await this.makeRequest('POST', `/session/device/logout-all/${sessionId}`, urlParams, { cache: false });
+        return await this.makeRequest<DeviceLinkedSessionLogoutResponse>('POST', `/session/device/logout-all/${sessionId}`, urlParams, { cache: false });
       } catch (error) {
         throw this.handleError(error);
       }

package/src/mixins/__tests__/accounts.test.ts

@@ -83,7 +83,7 @@ const appFixture: Application = {
   isOfficial: true,
   isInternal: false,
   capabilities: [],
-  redirectUris: ['https://mention.earth/__oxy/sso-callback'],
+  redirectUris: ['https://mention.earth/oauth/callback'],
   scopes: ['profile'],
   createdByUserId: 'u1',
   ownerAccountId: 'acc1',

package/src/models/interfaces.ts

@@ -645,8 +645,10 @@ export interface AssetUploadProgress {
   error?: string;
 }
 
-// Device Session interfaces
-export interface DeviceSession {
+// Device-linked session interfaces — the sessions that share one physical
+// device (GET /session/device/sessions/:sessionId). Distinct from the
+// server-authority `DeviceSession` Mongoose model / `DeviceSessionState`.
+export interface DeviceLinkedSession {
   sessionId: string;
   deviceId: string;
   deviceName: string;
@@ -658,12 +660,12 @@ export interface DeviceSession {
   createdAt?: string;
 }
 
-export interface DeviceSessionsResponse {
+export interface DeviceLinkedSessionsResponse {
   deviceId: string;
-  sessions: DeviceSession[];
+  sessions: DeviceLinkedSession[];
 }
 
-export interface DeviceSessionLogoutResponse {
+export interface DeviceLinkedSessionLogoutResponse {
   message: string;
   deviceId: string;
   sessionsTerminated: number;

package/src/server/index.ts

@@ -69,9 +69,3 @@ export { verifySecret } from './verifySecret';
 // Pure host handling (no browser deps), so it is safe on the server subpath and
 // lets `@oxyhq/api` derive `auth.<apex>` without duplicating PSL logic.
 export { registrableApex } from '../utils/registrableApex';
-
-// The single RP callback path the IdP redirects back to. A pure wire-contract
-// constant (no browser deps at module top level), re-used server-side so the
-// `/sso/establish-token` `return_to` cannot drift from what `/sso/establish`
-// validates.
-export { SSO_CALLBACK_PATH } from '../utils/ssoBounce';

package/src/session/__tests__/accountDialogController.test.ts

@@ -65,6 +65,8 @@ function graphNode(id: string, over: Partial<AccountNode> = {}): AccountNode {
 }
 
 interface OxyMock {
+  getAccessToken: jest.Mock;
+  onTokensChanged: jest.Mock;
   listAccounts: jest.Mock;
   getUsersByIds: jest.Mock;
   getFileDownloadUrl: jest.Mock;
@@ -73,10 +75,24 @@ interface OxyMock {
   pollCommonsSignIn: jest.Mock;
   claimSessionByToken: jest.Mock;
   signInWithSharedIdentity: jest.Mock;
+  /**
+   * Test helper: set the current access token and fire every registered
+   * `onTokensChanged` listener (mirrors `OxyServices.setTokens`/`clearTokens`).
+   * With no listener yet registered (before `start()`), it just sets the token.
+   */
+  emitTokenChange: (token: string | null) => void;
 }
 
 function makeOxy(): OxyMock {
+  const tokenListeners = new Set<(token: string | null) => void>();
+  // Authenticated by default (mirrors a warm start with a planted bearer).
+  let currentToken: string | null = 'access-token';
   return {
+    getAccessToken: jest.fn(() => currentToken),
+    onTokensChanged: jest.fn((listener: (token: string | null) => void) => {
+      tokenListeners.add(listener);
+      return () => tokenListeners.delete(listener);
+    }),
     listAccounts: jest.fn().mockResolvedValue([]),
     getUsersByIds: jest.fn().mockResolvedValue([]),
     getFileDownloadUrl: jest.fn((id: string) => `https://cdn/${id}`),
@@ -85,9 +101,18 @@ function makeOxy(): OxyMock {
     pollCommonsSignIn: jest.fn(),
     claimSessionByToken: jest.fn(),
     signInWithSharedIdentity: jest.fn().mockResolvedValue(null),
+    emitTokenChange: (token: string | null) => {
+      currentToken = token;
+      for (const listener of tokenListeners) {
+        listener(token);
+      }
+    },
   };
 }
 
+/** Flush pending microtasks (a `start()`-triggered `refresh()` cannot be awaited directly). */
+const flush = (): Promise<void> => new Promise((resolve) => setTimeout(resolve, 0));
+
 interface Harness {
   controller: AccountDialogController;
   oxy: OxyMock;
@@ -193,6 +218,104 @@ describe('AccountDialogController — account list', () => {
   });
 });
 
+describe('AccountDialogController — auth-gated graph fetch (prod sign-out fix)', () => {
+  it('start() while signed out does NOT call the private listAccounts / getUsersByIds and does not error', async () => {
+    const { controller, oxy, sc } = makeHarness();
+    oxy.emitTokenChange(null); // cold boot: no bearer planted yet (no listeners registered pre-start)
+    sc.set(state([{ accountId: 'a1', sessionId: 's1' }], 'a1'));
+
+    controller.start();
+    await flush();
+
+    expect(oxy.listAccounts).not.toHaveBeenCalled();
+    expect(oxy.getUsersByIds).not.toHaveBeenCalled();
+    const snap = controller.getSnapshot();
+    expect(snap.error).toBeNull();
+    expect(snap.loading).toBe(false);
+    controller.destroy();
+  });
+
+  it('refresh() while signed out re-projects device-only and skips the network call', async () => {
+    const { controller, oxy } = makeHarness();
+    oxy.emitTokenChange(null);
+
+    await controller.refresh();
+
+    expect(oxy.listAccounts).not.toHaveBeenCalled();
+    const snap = controller.getSnapshot();
+    expect(snap.loading).toBe(false);
+    expect(snap.error).toBeNull();
+  });
+
+  it('start() while authenticated fetches the graph exactly once', async () => {
+    const { controller, oxy, sc } = makeHarness();
+    sc.set(state([{ accountId: 'a1', sessionId: 's1' }], 'a1'));
+    oxy.listAccounts.mockResolvedValue([graphNode('org1')]);
+    oxy.getUsersByIds.mockResolvedValue([user('a1'), user('org1')]);
+
+    controller.start();
+    await flush();
+
+    expect(oxy.listAccounts).toHaveBeenCalledTimes(1);
+    expect(controller.getSnapshot().accounts.map((r) => r.accountId)).toEqual(['a1', 'org1']);
+    controller.destroy();
+  });
+
+  it('fetches the graph once when the bearer is planted after a signed-out start', async () => {
+    const { controller, oxy } = makeHarness();
+    oxy.emitTokenChange(null);
+    controller.start();
+    await flush();
+    expect(oxy.listAccounts).not.toHaveBeenCalled();
+
+    // Cold-boot restore plants the token → onTokensChanged → single graph fetch.
+    oxy.emitTokenChange('access-token');
+    await flush();
+    expect(oxy.listAccounts).toHaveBeenCalledTimes(1);
+    controller.destroy();
+  });
+
+  it('drops the graph and re-projects device-only (no fetch) when the token is cleared', async () => {
+    const { controller, oxy, sc } = makeHarness();
+    sc.set(state([{ accountId: 'a1', sessionId: 's1' }], 'a1'));
+    oxy.listAccounts.mockResolvedValue([graphNode('org1')]);
+    oxy.getUsersByIds.mockResolvedValue([user('a1'), user('org1')]);
+    controller.start();
+    await flush();
+    expect(controller.getSnapshot().accounts.map((r) => r.accountId)).toEqual(['a1', 'org1']);
+
+    oxy.listAccounts.mockClear();
+    oxy.emitTokenChange(null); // a 401 cleared the bearer
+    await flush();
+
+    expect(oxy.listAccounts).not.toHaveBeenCalled();
+    // Graph-only org1 is gone; the device row survives.
+    expect(controller.getSnapshot().accounts.map((r) => r.accountId)).toEqual(['a1']);
+    controller.destroy();
+  });
+
+  it('does not loop when listAccounts rejects — at most one call per refresh, no re-trigger on device changes', async () => {
+    const { controller, oxy, sc } = makeHarness();
+    sc.set(state([{ accountId: 'a1', sessionId: 's1' }], 'a1'));
+    oxy.getUsersByIds.mockResolvedValue([user('a1')]);
+    oxy.listAccounts.mockRejectedValue(new Error('graph boom'));
+
+    controller.start();
+    await flush();
+    expect(oxy.listAccounts).toHaveBeenCalledTimes(1);
+    expect(controller.getSnapshot().error).toBe('graph boom');
+
+    // A subsequent device-state push must NOT re-trigger the graph fetch (auth
+    // edge unchanged → reconcileAuth is a no-op → no storm).
+    sc.set(state([{ accountId: 'a1', sessionId: 's1' }], 'a1', 2));
+    await flush();
+    expect(oxy.listAccounts).toHaveBeenCalledTimes(1);
+    // Device row still rendered despite the graph failure.
+    expect(controller.getSnapshot().accounts.map((r) => r.accountId)).toEqual(['a1']);
+    controller.destroy();
+  });
+});
+
 describe('AccountDialogController — switchTo (uniform switch)', () => {
   it('uses SessionClient.switchAccount for an account already on the device', async () => {
     const { controller, oxy, sc } = makeHarness();

package/src/session/accountDialogController.ts

@@ -3,7 +3,7 @@
  *
  * A framework-agnostic state machine + subscribe/getSnapshot store (the same
  * pattern {@link SessionClient} uses — no React, no RN) that both
- * `@oxyhq/services` (RN `OxyProvider`) and `@oxyhq/auth` (web `WebOxyProvider`)
+ * every `OxyProvider` platform variant (Expo/RN and RN-Web)
  * bind to via `useSyncExternalStore`, so the account chooser is ONE
  * implementation across the ecosystem instead of the five drifting copies it
  * replaces.
@@ -166,6 +166,9 @@ export class AccountDialogController {
 
   // --- Store plumbing ---
   private unsubscribeSession: (() => void) | null = null;
+  private unsubscribeTokens: (() => void) | null = null;
+  /** Last-observed SDK auth readiness (a planted bearer). Drives the fetch edge. */
+  private authed = false;
   private started = false;
   private refreshSeq = 0;
   private snapshot: AccountDialogSnapshot;
@@ -212,13 +215,28 @@ export class AccountDialogController {
   start(): void {
     if (this.started) return;
     this.started = true;
+    this.authed = this.isAuthenticated();
     this.unsubscribeSession = this.sessionClient.subscribe(() => {
       // A device-state change (switch / sign-out / sibling sign-in) can add or
-      // remove accounts — re-project immediately, and refetch profiles when new
-      // account ids appeared.
+      // remove accounts — re-project immediately, refetch profiles when new
+      // account ids appeared, and reconcile the auth-readiness edge.
       this.emit();
       void this.ensureProfiles();
+      this.reconcileAuth();
     });
+    // The access token is planted AFTER `SessionClient.applyState` fires its
+    // subscription (`applySync` calls `setTokens` only once `applyState`/notify
+    // has returned; `ensureActiveToken` plants it async later), so the
+    // device-state subscription alone cannot observe the signed-out → signed-in
+    // edge. Observe the SDK-canonical readiness signal directly — a change to
+    // `oxyServices.getAccessToken()`, the `hasAccessToken` term of
+    // `OxyContext.canUsePrivateApi`.
+    this.unsubscribeTokens = this.oxyServices.onTokensChanged(() => {
+      this.reconcileAuth();
+    });
+    // Initial projection is device-only. `refresh()` fetches the graph IFF a
+    // bearer is already planted (warm start); when signed out (cold boot before
+    // restore) it re-projects from device state and makes NO private call.
     void this.refresh();
   }
 
@@ -232,10 +250,60 @@ export class AccountDialogController {
       this.unsubscribeSession();
       this.unsubscribeSession = null;
     }
+    if (this.unsubscribeTokens) {
+      this.unsubscribeTokens();
+      this.unsubscribeTokens = null;
+    }
     this.clearPollTimer();
     this.listeners.clear();
   }
 
+  // =========================================================================
+  // Auth readiness (SDK-canonical — mirrors OxyContext.canUsePrivateApi)
+  // =========================================================================
+
+  /**
+   * Whether a PRIVATE endpoint may be called right now. Mirrors the
+   * `hasAccessToken` term of `OxyContext.canUsePrivateApi`
+   * (`authResolved && isAuthenticated && tokenReady && hasAccessToken`, where
+   * `hasAccessToken = Boolean(oxyServices.getAccessToken())`): a planted bearer
+   * is the only term that decides whether a request carries auth — the other
+   * three are provider render-lifecycle gates with no headless equivalent.
+   *
+   * `listAccounts()` (`GET /accounts`) and `getUsersByIds()`
+   * (`POST /users/by-ids`) are private; calling either before cold-boot restore
+   * plants the token 401s → `HttpService` clears the bearer + emits
+   * `onTokensChanged(null)` → the app signs out. Every graph/profile fetch gates
+   * on this.
+   */
+  private isAuthenticated(): boolean {
+    return Boolean(this.oxyServices.getAccessToken());
+  }
+
+  /**
+   * Reconcile the account graph against the current auth-readiness edge. On the
+   * signed-out → signed-in edge fetch the graph ONCE; on signed-in → signed-out
+   * drop it and re-project device-only. A no-op when readiness is unchanged, so
+   * a burst of token events / device pushes cannot restart the fetch — and a
+   * failed `listAccounts()` never flips the edge, so it cannot re-trigger itself
+   * (no retry storm).
+   */
+  private reconcileAuth(): void {
+    const authed = this.isAuthenticated();
+    if (authed === this.authed) return;
+    this.authed = authed;
+    if (authed) {
+      void this.refresh();
+      return;
+    }
+    // Signed out: the graph is no longer fetchable/switchable — drop it and
+    // re-project from the device session set alone.
+    this.graph = [];
+    this.error = null;
+    this.loading = false;
+    this.emit();
+  }
+
   // =========================================================================
   // View actions
   // =========================================================================
@@ -269,6 +337,19 @@ export class AccountDialogController {
    */
   async refresh(): Promise<void> {
     const seq = ++this.refreshSeq;
+
+    // Never hit the private `listAccounts()` while signed out: at cold boot the
+    // bearer is not planted yet, so the call 401s → `HttpService` clears the
+    // token and signs the user out. Re-project from the device session set alone
+    // (`projectSwitchableAccounts` works from `SessionClient` state) and stop.
+    if (!this.isAuthenticated()) {
+      this.graph = [];
+      this.loading = false;
+      this.error = null;
+      this.emit();
+      return;
+    }
+
     const hadAccounts = this.snapshot.accounts.length > 0;
     this.loading = !hadAccounts;
     this.error = null;
@@ -299,6 +380,8 @@ export class AccountDialogController {
    * subscription so a newly-added device account gets a name/avatar.
    */
   private async ensureProfiles(): Promise<void> {
+    // `getUsersByIds` is private — skip the whole path while signed out.
+    if (!this.isAuthenticated()) return;
     const ids = switchableAccountIds(this.sessionClient.getState(), this.graph);
     if (ids.every((id) => this.profilesById.has(id))) return;
     await this.loadProfiles(this.refreshSeq);
@@ -306,6 +389,10 @@ export class AccountDialogController {
   }
 
   private async loadProfiles(seq: number): Promise<void> {
+    // `getUsersByIds` (`POST /users/by-ids`) is a private call — never issue it
+    // while signed out (the 401 → sign-out cascade). Callers already gate; this
+    // guards the network chokepoint too (e.g. the token was cleared mid-refresh).
+    if (!this.isAuthenticated()) return;
     const ids = switchableAccountIds(this.sessionClient.getState(), this.graph);
     if (ids.length === 0) return;
     let profiles: User[] = [];

package/src/session/accountProjection.ts

@@ -5,7 +5,7 @@
  * merging the device's server-authoritative session set (`DeviceSessionState`
  * from {@link SessionClient}) with the caller's account graph (`AccountNode[]`
  * from `oxyServices.listAccounts()`), deduped by `accountId`. This lives in
- * `@oxyhq/core` so `@oxyhq/services` (RN) and `@oxyhq/auth` (web) — and
+ * `@oxyhq/core` so every `@oxyhq/services` platform variant — and
  * `auth.oxy.so` — all render the SAME list from the SAME logic and cannot
  * diverge.
  *

package/src/session/projectSessionState.ts

@@ -5,7 +5,7 @@ import type { User } from '../models/interfaces';
 /**
  * Pure projection helpers: `DeviceSessionState` (the device-scoped
  * multi-account session-sync state produced by `SessionClient`) -> the
- * shapes consumers (`@oxyhq/services`, `@oxyhq/auth`) render today
+ * shapes `@oxyhq/services` consumers render today
  * (`ClientSession[]`, an active session id, an active `User`).
  *
  * No I/O. The caller fetches profiles via

package/src/session/refresh.ts

@@ -1,11 +1,8 @@
 /**
  * Unified token refresh — THE single refresh implementation for web + native.
  *
- * Before device-first, refresh was duplicated: `@oxyhq/auth`'s
- * `session/tokenRefresh.ts` (per-apex `/auth/silent` iframe) and
- * `@oxyhq/services`'s `inSessionTokenRefresh.ts` (native shared-key). This
- * module replaces both with ONE persisted-refresh-token rotation shared by
- * every consumer:
+ * ONE persisted-refresh-token rotation shared by every consumer (it replaced
+ * the pre-device-first per-platform duplicates):
  *
  *  - `refreshPersistedSession` — arm 1 rotates the stored refresh-token family
  *    (`POST /auth/refresh-token`), planting + persisting the rotated pair; arm 2
@@ -16,9 +13,8 @@
  *  - `createAuthRefreshHandler` / `installAuthRefreshHandler` wire arm 1+2 into
  *    `HttpService.setAuthRefreshHandler`, keeping that layer's single-flight
  *    dedup + cooldown (this module does NOT reimplement them).
- *  - `startTokenRefreshScheduler` — a proactive scheduler (lifted from the
- *    better of the two prior duplicates, `@oxyhq/auth`'s `tokenRefresh.ts`),
- *    decoupled from any React / auth-sdk type: refreshes ~60s before `exp`,
+ *  - `startTokenRefreshScheduler` — a proactive scheduler decoupled from any
+ *    React type: refreshes ~60s before `exp`,
  *    re-arms on token change + web tab-focus, `.unref?.()`s its timer in Node.
  *
  * Framework-free; no module-level mutable state.

package/src/session/sessionClientHost.ts

@@ -7,8 +7,7 @@ import type { SessionClientHost } from './SessionClient';
  * `SessionClient` is host-agnostic: it only needs a REST + token surface.
  * `OxyServices` already exposes all of that except `getCurrentAccountId`,
  * which has no direct equivalent — the adapter holds a mutable ref set by
- * the caller (`OxyContext` in `@oxyhq/services`, `WebOxyProvider` in
- * `@oxyhq/auth`) via `setCurrentAccountId`.
+ * the caller (`OxyContext` in `@oxyhq/services`) via `setCurrentAccountId`.
  *
  * Shared here (rather than duplicated per consumer) because it is entirely
  * platform-agnostic: every method it calls exists identically on