@oxyhq/core 9.0.0 → 9.2.0

package/src/utils/oauthPkce.ts

@@ -61,6 +61,11 @@ export interface BuildOAuthAuthorizeUrlParams {
   state: string;
   /** The PKCE `codeChallenge` from {@link generatePkcePair}. */
   codeChallenge: string;
+  /**
+   * OAuth `prompt` parameter. Use `none` for silent cross-origin session restore
+   * (no UI when the IdP hub already has a session + grant).
+   */
+  prompt?: 'none' | 'login' | 'consent';
 }
 
 /**
@@ -184,6 +189,72 @@ export function buildOAuthAuthorizeUrl(params: BuildOAuthAuthorizeUrlParams): st
   url.searchParams.set('scope', scope);
   url.searchParams.set('code_challenge', codeChallenge);
   url.searchParams.set('code_challenge_method', 'S256');
+  if (params.prompt) {
+    url.searchParams.set('prompt', params.prompt);
+  }
 
   return url.toString();
 }
+
+/** `sessionStorage` key for the OAuth CSRF `state` across an authorize redirect. */
+export const OXY_OAUTH_STATE_STORAGE_KEY = 'oxy_oauth_state';
+
+/** `sessionStorage` key for the PKCE `code_verifier` across an authorize redirect. */
+export const OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = 'oxy_oauth_code_verifier';
+
+/** `sessionStorage` key — at most one silent OAuth attempt per navigation. */
+export const OXY_SILENT_OAUTH_ATTEMPTED_KEY = 'oxy.silent_oauth_attempted';
+
+/** `sessionStorage` key — blocks further cross-origin auto-restore in this tab. */
+export const OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY = 'oxy.cross_origin_restore_attempted';
+
+/**
+ * Normalize a redirect URI to its origin. Official Oxy apps register apex
+ * origins (`https://inbox.oxy.so`) — never path-qualified URLs.
+ */
+export function normalizeOAuthRedirectUri(input: string): string {
+  try {
+    return new URL(input).origin;
+  } catch {
+    return input;
+  }
+}
+
+/** Persist the OAuth handshake for a full-page redirect return (web only). */
+export function persistOAuthHandshake(state: string, codeVerifier: string): boolean {
+  const store = (globalThis as { sessionStorage?: Storage }).sessionStorage;
+  try {
+    if (!store) throw new Error('sessionStorage is unavailable');
+    store.setItem(OXY_OAUTH_STATE_STORAGE_KEY, state);
+    store.setItem(OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY, codeVerifier);
+    return true;
+  } catch (error) {
+    logger.warn(
+      'Could not persist OAuth handshake to sessionStorage',
+      { component: 'oauthPkce' },
+      error,
+    );
+    return false;
+  }
+}
+
+/** Read the persisted OAuth handshake, or `null` when absent. */
+export function readOAuthHandshake(): { state: string; codeVerifier: string } | null {
+  const store = (globalThis as { sessionStorage?: Storage }).sessionStorage;
+  if (!store) return null;
+  const state = store.getItem(OXY_OAUTH_STATE_STORAGE_KEY);
+  const codeVerifier = store.getItem(OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY);
+  if (!state || !codeVerifier) return null;
+  return { state, codeVerifier };
+}
+
+/** Drop persisted OAuth handshake keys after a successful or aborted return. */
+export function clearOAuthHandshake(): void {
+  const store = (globalThis as { sessionStorage?: Storage }).sessionStorage;
+  try {
+    store?.removeItem(OXY_OAUTH_STATE_STORAGE_KEY);
+    store?.removeItem(OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY);
+  } catch {
+    // Best-effort cleanup only.
+  }
+}

package/src/utils/officialOrigins.ts

@@ -0,0 +1,124 @@
+/**
+ * Official first-party web origin allowlist — shared by hub-ticket issuance,
+ * OAuth redirect validation, and cross-origin session restore.
+ */
+
+import { CENTRAL_IDP_APEX } from './authWebUrl';
+import { registrableApex } from './registrableApex';
+
+/** Official first-party registrable apexes (mirrors API trusted origins). */
+const OFFICIAL_APEXES = new Set([
+  'oxy.so',
+  'fairco.in',
+  'mention.earth',
+  'homiio.com',
+  'alia.onl',
+  'syra.fm',
+  'allo.you',
+  'tnp.network',
+  'moovo.now',
+  'mercaria.co',
+]);
+
+export function buildIdpHubOrigin(): string {
+  return `https://auth.${CENTRAL_IDP_APEX}`;
+}
+
+/** Whether the current web origin is the central IdP hub (`auth.oxy.so`). */
+export function isIdpHubOrigin(): boolean {
+  if (typeof globalThis === 'undefined') {
+    return false;
+  }
+  const location = (globalThis as { location?: Location }).location;
+  if (!location) {
+    return false;
+  }
+  try {
+    const { hostname } = new URL(location.href);
+    return hostname === `auth.${CENTRAL_IDP_APEX}`;
+  } catch {
+    return false;
+  }
+}
+
+function isLoopbackOrigin(origin: string): boolean {
+  try {
+    const parsed = new URL(origin);
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+      return false;
+    }
+    const host = parsed.hostname.toLowerCase();
+    return host === 'localhost' || host === '127.0.0.1' || host === '[::1]';
+  } catch {
+    return false;
+  }
+}
+
+/** Whether an origin belongs to the official Oxy web ecosystem. */
+export function isOfficialWebOrigin(origin: string): boolean {
+  if (isLoopbackOrigin(origin)) {
+    return true;
+  }
+  try {
+    const parsed = new URL(origin);
+    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+      return false;
+    }
+    const host = parsed.hostname.toLowerCase();
+    if (host === CENTRAL_IDP_APEX || host.endsWith(`.${CENTRAL_IDP_APEX}`)) {
+      return true;
+    }
+    const apex = registrableApex(host);
+    return apex != null && OFFICIAL_APEXES.has(apex);
+  } catch {
+    return false;
+  }
+}
+
+/** Normalize and validate a return URL against official origins. Returns origin only. */
+export function normalizeOfficialReturnOrigin(raw: string): string | null {
+  try {
+    const parsed = new URL(raw);
+    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+      return null;
+    }
+    if (!isOfficialWebOrigin(parsed.origin)) {
+      return null;
+    }
+    return parsed.origin;
+  } catch {
+    return null;
+  }
+}
+
+/** Validate a hub-sync return URL; returns the full normalized URL string. */
+export function parseHubSyncReturnUrl(raw: string | null): string | null {
+  if (!raw) {
+    return null;
+  }
+  try {
+    const parsed = new URL(raw);
+    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+      return null;
+    }
+    if (!isOfficialWebOrigin(parsed.origin)) {
+      return null;
+    }
+    return parsed.toString();
+  } catch {
+    return null;
+  }
+}
+
+/** Build auth.oxy.so/sync redirect URL with a one-time hub ticket. */
+export function buildHubSyncUrl(ticket: string, returnUrl?: string): string {
+  const url = new URL('/sync', buildIdpHubOrigin());
+  url.searchParams.set('ticket', ticket);
+  if (returnUrl) {
+    url.searchParams.set('return', returnUrl);
+  }
+  return url.toString();
+}
+
+/** @deprecated Use {@link isOfficialWebOrigin}. */
+export const isAllowedDeviceJoinOrigin = isOfficialWebOrigin;