@oxyhq/core 9.1.0 → 9.2.1

package/dist/cjs/utils/oauthPkce.js

@@ -17,11 +17,15 @@
  * React Native. No `require()`, so the ESM build stays bundler-clean.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_OAUTH_SCOPE = exports.OXY_AUTHORIZE_URL = void 0;
+exports.OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY = exports.OXY_SILENT_OAUTH_ATTEMPTED_KEY = exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = exports.OXY_OAUTH_STATE_STORAGE_KEY = exports.DEFAULT_OAUTH_SCOPE = exports.OXY_AUTHORIZE_URL = void 0;
 exports.computeCodeChallenge = computeCodeChallenge;
 exports.generatePkcePair = generatePkcePair;
 exports.generateOAuthState = generateOAuthState;
 exports.buildOAuthAuthorizeUrl = buildOAuthAuthorizeUrl;
+exports.normalizeOAuthRedirectUri = normalizeOAuthRedirectUri;
+exports.persistOAuthHandshake = persistOAuthHandshake;
+exports.readOAuthHandshake = readOAuthHandshake;
+exports.clearOAuthHandshake = clearOAuthHandshake;
 const protocol_1 = require("@oxyhq/protocol");
 const loggerUtils_1 = require("./loggerUtils");
 /** The central Oxy IdP authorization endpoint used by default. */
@@ -138,5 +142,65 @@ function buildOAuthAuthorizeUrl(params) {
     url.searchParams.set('scope', scope);
     url.searchParams.set('code_challenge', codeChallenge);
     url.searchParams.set('code_challenge_method', 'S256');
+    if (params.prompt) {
+        url.searchParams.set('prompt', params.prompt);
+    }
     return url.toString();
 }
+/** `sessionStorage` key for the OAuth CSRF `state` across an authorize redirect. */
+exports.OXY_OAUTH_STATE_STORAGE_KEY = 'oxy_oauth_state';
+/** `sessionStorage` key for the PKCE `code_verifier` across an authorize redirect. */
+exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY = 'oxy_oauth_code_verifier';
+/** `sessionStorage` key — at most one silent OAuth attempt per navigation. */
+exports.OXY_SILENT_OAUTH_ATTEMPTED_KEY = 'oxy.silent_oauth_attempted';
+/** `sessionStorage` key — blocks further cross-origin auto-restore in this tab. */
+exports.OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY = 'oxy.cross_origin_restore_attempted';
+/**
+ * Normalize a redirect URI to its origin. Official Oxy apps register apex
+ * origins (`https://inbox.oxy.so`) — never path-qualified URLs.
+ */
+function normalizeOAuthRedirectUri(input) {
+    try {
+        return new URL(input).origin;
+    }
+    catch {
+        return input;
+    }
+}
+/** Persist the OAuth handshake for a full-page redirect return (web only). */
+function persistOAuthHandshake(state, codeVerifier) {
+    const store = globalThis.sessionStorage;
+    try {
+        if (!store)
+            throw new Error('sessionStorage is unavailable');
+        store.setItem(exports.OXY_OAUTH_STATE_STORAGE_KEY, state);
+        store.setItem(exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY, codeVerifier);
+        return true;
+    }
+    catch (error) {
+        loggerUtils_1.logger.warn('Could not persist OAuth handshake to sessionStorage', { component: 'oauthPkce' }, error);
+        return false;
+    }
+}
+/** Read the persisted OAuth handshake, or `null` when absent. */
+function readOAuthHandshake() {
+    const store = globalThis.sessionStorage;
+    if (!store)
+        return null;
+    const state = store.getItem(exports.OXY_OAUTH_STATE_STORAGE_KEY);
+    const codeVerifier = store.getItem(exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY);
+    if (!state || !codeVerifier)
+        return null;
+    return { state, codeVerifier };
+}
+/** Drop persisted OAuth handshake keys after a successful or aborted return. */
+function clearOAuthHandshake() {
+    const store = globalThis.sessionStorage;
+    try {
+        store?.removeItem(exports.OXY_OAUTH_STATE_STORAGE_KEY);
+        store?.removeItem(exports.OXY_OAUTH_CODE_VERIFIER_STORAGE_KEY);
+    }
+    catch {
+        // Best-effort cleanup only.
+    }
+}

package/dist/cjs/utils/officialOrigins.js

@@ -0,0 +1,128 @@
+"use strict";
+/**
+ * Official first-party web origin allowlist — shared by hub-ticket issuance,
+ * OAuth redirect validation, and cross-origin session restore.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isAllowedDeviceJoinOrigin = void 0;
+exports.buildIdpHubOrigin = buildIdpHubOrigin;
+exports.isIdpHubOrigin = isIdpHubOrigin;
+exports.isOfficialWebOrigin = isOfficialWebOrigin;
+exports.normalizeOfficialReturnOrigin = normalizeOfficialReturnOrigin;
+exports.parseHubSyncReturnUrl = parseHubSyncReturnUrl;
+exports.buildHubSyncUrl = buildHubSyncUrl;
+const authWebUrl_1 = require("./authWebUrl");
+const registrableApex_1 = require("./registrableApex");
+/** Official first-party registrable apexes (mirrors API trusted origins). */
+const OFFICIAL_APEXES = new Set([
+    'oxy.so',
+    'fairco.in',
+    'mention.earth',
+    'homiio.com',
+    'alia.onl',
+    'syra.fm',
+    'allo.you',
+    'tnp.network',
+    'moovo.now',
+    'mercaria.co',
+]);
+function buildIdpHubOrigin() {
+    return `https://auth.${authWebUrl_1.CENTRAL_IDP_APEX}`;
+}
+/** Whether the current web origin is the central IdP hub (`auth.oxy.so`). */
+function isIdpHubOrigin() {
+    if (typeof globalThis === 'undefined') {
+        return false;
+    }
+    const location = globalThis.location;
+    if (!location) {
+        return false;
+    }
+    try {
+        const { hostname } = new URL(location.href);
+        return hostname === `auth.${authWebUrl_1.CENTRAL_IDP_APEX}`;
+    }
+    catch {
+        return false;
+    }
+}
+function isLoopbackOrigin(origin) {
+    try {
+        const parsed = new URL(origin);
+        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+            return false;
+        }
+        const host = parsed.hostname.toLowerCase();
+        return host === 'localhost' || host === '127.0.0.1' || host === '[::1]';
+    }
+    catch {
+        return false;
+    }
+}
+/** Whether an origin belongs to the official Oxy web ecosystem. */
+function isOfficialWebOrigin(origin) {
+    if (isLoopbackOrigin(origin)) {
+        return true;
+    }
+    try {
+        const parsed = new URL(origin);
+        if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+            return false;
+        }
+        const host = parsed.hostname.toLowerCase();
+        if (host === authWebUrl_1.CENTRAL_IDP_APEX || host.endsWith(`.${authWebUrl_1.CENTRAL_IDP_APEX}`)) {
+            return true;
+        }
+        const apex = (0, registrableApex_1.registrableApex)(host);
+        return apex != null && OFFICIAL_APEXES.has(apex);
+    }
+    catch {
+        return false;
+    }
+}
+/** Normalize and validate a return URL against official origins. Returns origin only. */
+function normalizeOfficialReturnOrigin(raw) {
+    try {
+        const parsed = new URL(raw);
+        if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+            return null;
+        }
+        if (!isOfficialWebOrigin(parsed.origin)) {
+            return null;
+        }
+        return parsed.origin;
+    }
+    catch {
+        return null;
+    }
+}
+/** Validate a hub-sync return URL; returns the full normalized URL string. */
+function parseHubSyncReturnUrl(raw) {
+    if (!raw) {
+        return null;
+    }
+    try {
+        const parsed = new URL(raw);
+        if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+            return null;
+        }
+        if (!isOfficialWebOrigin(parsed.origin)) {
+            return null;
+        }
+        return parsed.toString();
+    }
+    catch {
+        return null;
+    }
+}
+/** Build auth.oxy.so/sync redirect URL with a one-time hub ticket. */
+function buildHubSyncUrl(ticket, returnUrl) {
+    const url = new URL('/sync', buildIdpHubOrigin());
+    url.searchParams.set('ticket', ticket);
+    if (returnUrl) {
+        url.searchParams.set('return', returnUrl);
+    }
+    return url.toString();
+}
+/** @deprecated Use {@link isOfficialWebOrigin}. */
+exports.isAllowedDeviceJoinOrigin = isOfficialWebOrigin;