@oxyhq/core 8.0.0 → 8.1.0

package/src/session/__tests__/authStateStore.test.ts

@@ -65,6 +65,33 @@ describe('createWebAuthStateStore', () => {
     expect(await store.load()).toEqual(SAMPLE);
   });
 
+  it('round-trips the optional phase-2c deviceId + deviceSecret', async () => {
+    installLocalStorage(makeFakeStorage());
+    const store = createWebAuthStateStore();
+    const withCreds: PersistedAuthState = { ...SAMPLE, deviceId: 'dev-abc', deviceSecret: 'ds-secret-xyz' };
+
+    await store.save(withCreds);
+    const loaded = await store.load();
+    expect(loaded?.deviceId).toBe('dev-abc');
+    expect(loaded?.deviceSecret).toBe('ds-secret-xyz');
+    expect(loaded).toEqual(withCreds);
+  });
+
+  it('deserializes a legacy blob with no device credentials (additive — fields absent)', async () => {
+    const storage = makeFakeStorage();
+    installLocalStorage(storage);
+    const store = createWebAuthStateStore();
+
+    storage.setItem(
+      AUTH_STATE_STORAGE_KEY,
+      JSON.stringify({ sessionId: 's-1', refreshToken: 'r-abcdefghijklmnop', userId: 'u-1' }),
+    );
+    const loaded = await store.load();
+    expect(loaded).not.toBeNull();
+    expect(loaded && 'deviceId' in loaded).toBe(false);
+    expect(loaded && 'deviceSecret' in loaded).toBe(false);
+  });
+
   it('clear() wipes the session but the deviceToken survives', async () => {
     installLocalStorage(makeFakeStorage());
     const store = createWebAuthStateStore();

package/src/session/__tests__/refresh.test.ts

@@ -53,6 +53,20 @@ describe('refreshPersistedSession — arm 1 (refresh-token rotation)', () => {
     });
   });
 
+  it('carries the persisted deviceId + deviceSecret (phase 2c) forward across a rotation', async () => {
+    const store = createMemoryAuthStateStore();
+    await store.save({ ...STORED, deviceId: 'dev-mint', deviceSecret: 'ds-secret-orig' });
+    const { oxy } = makeOxy();
+
+    await refreshPersistedSession({ oxy, store, allowSharedKeyFallback: false });
+
+    const persisted = await store.load();
+    expect(persisted?.deviceId).toBe('dev-mint');
+    expect(persisted?.deviceSecret).toBe('ds-secret-orig');
+    // The refresh family head still rotated.
+    expect(persisted?.refreshToken).toBe('refresh-new-abcdefghij');
+  });
+
   it('clears the store on a family-revoked (401) error', async () => {
     const store = createMemoryAuthStateStore();
     await store.save(STORED);

package/src/session/authStateStore.ts

@@ -39,6 +39,26 @@ export interface PersistedAuthState {
   refreshToken: string;
   userId: string;
   deviceToken?: string;
+  /**
+   * The stable device identifier this session is bound to (phase 2c —
+   * zero-cookie transport). Persisted alongside {@link deviceSecret} because the
+   * `POST /session/device/token` mint presents BOTH — the secret is the proof,
+   * the deviceId selects the device doc. Sourced from the lanes that carry it
+   * (password login / 2FA / QR claim / challenge verify); the cookie-bootstrap
+   * lanes (`AuthTokenBundle`) omit it and preserve any prior value. Additive: a
+   * blob without it simply never takes the mint lane and falls back to the
+   * refresh family.
+   */
+  deviceId?: string;
+  /**
+   * The rotating device secret (phase 2c — zero-cookie transport). Possession of
+   * it mints a short access token for the device's active account via
+   * `POST /session/device/token`, replacing the cookie lane. Rotated in-use: the
+   * mint returns `nextDeviceSecret`, which the cold boot persists BEFORE planting
+   * the minted access token (multi-tab anti-loss). Additive and optional — same
+   * XSS risk profile as the already-persisted `refreshToken`.
+   */
+  deviceSecret?: string;
   /** Optional warm-boot access token (short-lived; see interface docs). */
   accessToken?: string;
   /** Optional warm-boot access-token expiry, ISO-8601. */
@@ -130,6 +150,12 @@ function deserialize(raw: string | null): PersistedAuthState | null {
   if (typeof candidate.deviceToken === 'string' && candidate.deviceToken.length > 0) {
     state.deviceToken = candidate.deviceToken;
   }
+  if (typeof candidate.deviceId === 'string' && candidate.deviceId.length > 0) {
+    state.deviceId = candidate.deviceId;
+  }
+  if (typeof candidate.deviceSecret === 'string' && candidate.deviceSecret.length > 0) {
+    state.deviceSecret = candidate.deviceSecret;
+  }
   if (typeof candidate.accessToken === 'string' && candidate.accessToken.length > 0) {
     state.accessToken = candidate.accessToken;
   }

package/src/session/refresh.ts

@@ -134,6 +134,15 @@ export async function refreshPersistedSession(deps: RefreshDeps): Promise<string
       if (persisted.deviceToken) {
         next.deviceToken = persisted.deviceToken;
       }
+      // The refresh response carries no device credentials — carry the persisted
+      // deviceId/deviceSecret (phase 2c) forward so a rotation never drops the
+      // zero-cookie mint lane (mirrors the deviceToken preservation above).
+      if (persisted.deviceId) {
+        next.deviceId = persisted.deviceId;
+      }
+      if (persisted.deviceSecret) {
+        next.deviceSecret = persisted.deviceSecret;
+      }
       await store.save(next);
       return rotated.accessToken;
     } catch (error) {