@oxyhq/core 7.1.1 → 8.1.0

package/dist/cjs/session/refresh.js

@@ -92,6 +92,15 @@ async function refreshPersistedSession(deps) {
             if (persisted.deviceToken) {
                 next.deviceToken = persisted.deviceToken;
             }
+            // The refresh response carries no device credentials — carry the persisted
+            // deviceId/deviceSecret (phase 2c) forward so a rotation never drops the
+            // zero-cookie mint lane (mirrors the deviceToken preservation above).
+            if (persisted.deviceId) {
+                next.deviceId = persisted.deviceId;
+            }
+            if (persisted.deviceSecret) {
+                next.deviceSecret = persisted.deviceSecret;
+            }
             await store.save(next);
             return rotated.accessToken;
         }

package/dist/cjs/session/sessionClientHost.js

@@ -7,8 +7,7 @@ exports.createSessionClientHost = createSessionClientHost;
  * `SessionClient` is host-agnostic: it only needs a REST + token surface.
  * `OxyServices` already exposes all of that except `getCurrentAccountId`,
  * which has no direct equivalent — the adapter holds a mutable ref set by
- * the caller (`OxyContext` in `@oxyhq/services`, `WebOxyProvider` in
- * `@oxyhq/auth`) via `setCurrentAccountId`.
+ * the caller (`OxyContext` in `@oxyhq/services`) via `setCurrentAccountId`.
  *
  * Shared here (rather than duplicated per consumer) because it is entirely
  * platform-agnostic: every method it calls exists identically on

package/dist/cjs/utils/accountUtils.js

@@ -1,7 +1,7 @@
 "use strict";
 /**
  * Shared account types and pure helper functions.
- * Used by both @oxyhq/services (React Native) and @oxyhq/auth (Web) account stores.
+ * Used by the @oxyhq/services account stores (Expo/RN and RN-Web).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getAccountColor = exports.createQuickAccount = exports.buildAccountsArray = exports.getAccountFallbackHandle = exports.getAccountDisplayName = exports.formatPublicKeyHandle = void 0;

package/dist/cjs/utils/oauthPkce.js

@@ -0,0 +1,142 @@
+"use strict";
+/**
+ * OAuth 2.0 Authorization Code + PKCE helpers for "Sign in with Oxy" third-party
+ * sign-in.
+ *
+ * Third-party Relying Parties (SPAs, static sites, and native apps that are NOT
+ * Oxy first-party) authenticate through the standard OAuth flow against
+ * `auth.oxy.so/authorize` — never FedCM, SSO bounces, or Oxy session cookies.
+ * Public clients (no secret) prove possession of the authorization code with
+ * PKCE (RFC 7636, S256): the RP generates a random `code_verifier`, sends its
+ * `code_challenge = BASE64URL(SHA-256(code_verifier))` on the authorize
+ * redirect, and later replays the raw verifier on the token exchange.
+ *
+ * All cross-platform crypto (random bytes, SHA-256) is delegated to the shared
+ * `@oxyhq/protocol` platform loaders — the exact primitives the rest of core's
+ * crypto already uses — so these helpers run identically on web, Node, and
+ * React Native. No `require()`, so the ESM build stays bundler-clean.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_OAUTH_SCOPE = exports.OXY_AUTHORIZE_URL = void 0;
+exports.computeCodeChallenge = computeCodeChallenge;
+exports.generatePkcePair = generatePkcePair;
+exports.generateOAuthState = generateOAuthState;
+exports.buildOAuthAuthorizeUrl = buildOAuthAuthorizeUrl;
+const protocol_1 = require("@oxyhq/protocol");
+const loggerUtils_1 = require("./loggerUtils");
+/** The central Oxy IdP authorization endpoint used by default. */
+exports.OXY_AUTHORIZE_URL = 'https://auth.oxy.so/authorize';
+/** Default OAuth scope requested for a "Sign in with Oxy" third-party flow. */
+exports.DEFAULT_OAUTH_SCOPE = 'openid profile';
+/**
+ * Number of random bytes behind a PKCE `code_verifier`. 64 bytes → 86 base64url
+ * characters, comfortably inside RFC 7636 §4.1's required 43–128 range.
+ */
+const PKCE_VERIFIER_BYTES = 64;
+/** Number of random bytes behind an OAuth `state` (CSRF) token. */
+const OAUTH_STATE_BYTES = 32;
+/** RFC 4648 §5 base64url alphabet (URL- and filename-safe, no padding). */
+const BASE64URL_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+/**
+ * Cryptographically-secure random bytes, cross-platform.
+ *
+ * Mirrors the platform gating the rest of core's crypto already uses:
+ * `expo-crypto` on React Native, Node's built-in `crypto` on the server, and
+ * the Web Crypto API in the browser (also the fallback if Node's `crypto`
+ * fails to load in an unusual bundled-Node environment).
+ */
+async function getSecureRandomBytes(byteLength) {
+    if ((0, protocol_1.isReactNative)()) {
+        const crypto = await (0, protocol_1.loadExpoCrypto)();
+        return Uint8Array.from(await crypto.getRandomBytesAsync(byteLength));
+    }
+    if ((0, protocol_1.isNodeJS)()) {
+        try {
+            const nodeCrypto = await (0, protocol_1.loadNodeCrypto)();
+            return Uint8Array.from(nodeCrypto.randomBytes(byteLength));
+        }
+        catch (error) {
+            loggerUtils_1.logger.warn('[oxy.oauth] Node crypto unavailable for PKCE random bytes, falling back to Web Crypto', { component: 'oauthPkce' }, error);
+        }
+    }
+    const bytes = new Uint8Array(byteLength);
+    globalThis.crypto.getRandomValues(bytes);
+    return bytes;
+}
+/** Encode raw bytes as unpadded base64url (RFC 4648 §5). */
+function bytesToBase64Url(bytes) {
+    let output = '';
+    for (let i = 0; i < bytes.length; i += 3) {
+        const byte0 = bytes[i];
+        const hasByte1 = i + 1 < bytes.length;
+        const hasByte2 = i + 2 < bytes.length;
+        const byte1 = hasByte1 ? bytes[i + 1] : 0;
+        const byte2 = hasByte2 ? bytes[i + 2] : 0;
+        output += BASE64URL_ALPHABET[byte0 >> 2];
+        output += BASE64URL_ALPHABET[((byte0 & 0x03) << 4) | (byte1 >> 4)];
+        if (hasByte1) {
+            output += BASE64URL_ALPHABET[((byte1 & 0x0f) << 2) | (byte2 >> 6)];
+        }
+        if (hasByte2) {
+            output += BASE64URL_ALPHABET[byte2 & 0x3f];
+        }
+    }
+    return output;
+}
+/** Decode a lowercase-hex string into its raw bytes. */
+function hexToBytes(hex) {
+    const bytes = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < bytes.length; i += 1) {
+        bytes[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+    }
+    return bytes;
+}
+/**
+ * Compute the PKCE S256 `code_challenge` for a given verifier:
+ * `BASE64URL(SHA-256(ASCII(codeVerifier)))` (RFC 7636 §4.2). The verifier is
+ * base64url (ASCII), so its UTF-8 and ASCII byte encodings are identical.
+ *
+ * Reuses `@oxyhq/protocol`'s cross-platform {@link sha256} (which returns
+ * lowercase hex); the digest bytes are recovered and re-encoded as base64url.
+ */
+async function computeCodeChallenge(codeVerifier) {
+    const digestHex = await (0, protocol_1.sha256)(codeVerifier);
+    return bytesToBase64Url(hexToBytes(digestHex));
+}
+/**
+ * Generate a fresh PKCE verifier/challenge pair for an OAuth authorization-code
+ * flow. The verifier is 64 random bytes as base64url (86 chars, within RFC 7636
+ * §4.1's 43–128 range and drawn only from the unreserved set); the challenge is
+ * its S256 transform.
+ */
+async function generatePkcePair() {
+    const codeVerifier = bytesToBase64Url(await getSecureRandomBytes(PKCE_VERIFIER_BYTES));
+    const codeChallenge = await computeCodeChallenge(codeVerifier);
+    return { codeVerifier, codeChallenge, method: 'S256' };
+}
+/**
+ * Generate an opaque, single-use OAuth `state` token (32 random bytes as
+ * base64url) for CSRF protection across the authorize redirect.
+ */
+async function generateOAuthState() {
+    return bytesToBase64Url(await getSecureRandomBytes(OAUTH_STATE_BYTES));
+}
+/**
+ * Build the `auth.oxy.so/authorize` redirect URL for an OAuth authorization-code
+ * + PKCE (S256) flow. Built via the WHATWG `URL` API so a custom
+ * `authorizeBaseUrl` that already carries a query string keeps its existing
+ * params (the OAuth params are merged in, not clobbered by a naive `?` concat).
+ * All values are percent-encoded by `URL.searchParams`.
+ */
+function buildOAuthAuthorizeUrl(params) {
+    const { authorizeBaseUrl = exports.OXY_AUTHORIZE_URL, clientId, redirectUri, scope = exports.DEFAULT_OAUTH_SCOPE, state, codeChallenge, } = params;
+    const url = new URL(authorizeBaseUrl);
+    url.searchParams.set('client_id', clientId);
+    url.searchParams.set('redirect_uri', redirectUri);
+    url.searchParams.set('response_type', 'code');
+    url.searchParams.set('state', state);
+    url.searchParams.set('scope', scope);
+    url.searchParams.set('code_challenge', codeChallenge);
+    url.searchParams.set('code_challenge_method', 'S256');
+    return url.toString();
+}

package/dist/cjs/utils/platform.js

@@ -98,7 +98,7 @@ function setPlatformOS(os) {
  *
  * Native defines a global `window` but no `document`, so the DOM probe — not a
  * bare `window` check — is the reliable discriminator. This is the single
- * source of truth consumed by `@oxyhq/services` and `@oxyhq/auth` (both dropped
+ * source of truth consumed by `@oxyhq/services` (which dropped
  * their local copies), so every consumer shares the exact same predicate.
  *
  * NOTE: this is a live runtime probe (not the cached `getPlatformOS()` verdict)