@oxyhq/core 9.2.0 → 9.2.2

package/src/session/__tests__/accountDialogController.test.ts

@@ -461,6 +461,7 @@ describe('AccountDialogController — sign in with Oxy', () => {
         accessToken: 'access-1',
         sessionId: 'sess-1',
         deviceId: 'device-1',
+        deviceSecret: 'claimed-secret',
         expiresAt: '2030-01-01T00:00:00Z',
         user: user('a1'),
       });
@@ -473,7 +474,13 @@ describe('AccountDialogController — sign in with Oxy', () => {
 
       await jest.advanceTimersByTimeAsync(1000); // second poll → authorized → claim
       expect(oxy.claimSessionByToken).toHaveBeenCalledWith('secret-tok');
-      expect(commitSession).toHaveBeenCalledWith(expect.objectContaining({ sessionId: 'sess-1', accessToken: 'access-1' }));
+      expect(commitSession).toHaveBeenCalledWith(
+        expect.objectContaining({
+          sessionId: 'sess-1',
+          accessToken: 'access-1',
+          deviceSecret: 'claimed-secret',
+        }),
+      );
       expect(onSignedIn).toHaveBeenCalledWith(expect.objectContaining({ id: 'a1' }));
       expect(controller.getSnapshot().view).toBe('accounts');
     } finally {
@@ -533,6 +540,91 @@ describe('AccountDialogController — sign in with Oxy', () => {
   });
 });
 
+describe('AccountDialogController — Commons deep-link (canOpenApp)', () => {
+  const START_HANDLE = {
+    sessionToken: 'secret-tok',
+    authorizeCode: 'AUTH-CODE',
+    qrPayload: 'oxycommons://approve?v=1&code=AUTH-CODE',
+    expiresAt: Date.now() + 600_000,
+    status: 'pending' as const,
+  };
+
+  function makeController(opts: {
+    openUrl?: jest.Mock;
+    canOpenApp?: jest.Mock;
+  }): { controller: AccountDialogController; oxy: OxyMock } {
+    const oxy = makeOxy();
+    oxy.startCommonsSignIn.mockResolvedValue(START_HANDLE);
+    oxy.pollCommonsSignIn.mockResolvedValue({ authorized: false, status: 'pending' });
+    const controller = new AccountDialogController({
+      oxyServices: oxy as unknown as OxyServices,
+      sessionClient: new TestSessionClient(host()),
+      clientId: 'oxy_dk_test',
+      pollIntervalMs: 1000,
+      openUrl: opts.openUrl,
+      canOpenApp: opts.canOpenApp,
+    });
+    return { controller, oxy };
+  }
+
+  it('deep-links into Commons via openUrl when canOpenApp reports it installed, keeping the QR/polling fallback', async () => {
+    const openUrl = jest.fn();
+    const canOpenApp = jest.fn().mockResolvedValue(true);
+    const { controller } = makeController({ openUrl, canOpenApp });
+
+    await controller.showQr();
+    await flush(); // let the (non-awaited) canOpenApp probe resolve
+
+    expect(canOpenApp).toHaveBeenCalledWith('oxycommons://');
+    expect(openUrl).toHaveBeenCalledWith('oxycommons://approve?v=1&code=AUTH-CODE');
+    // The QR + polling remain the fallback path — the flow is still waiting.
+    const snap = controller.getSnapshot();
+    expect(snap.view).toBe('qr');
+    expect(snap.signIn.phase).toBe('waiting');
+    expect(snap.signIn.qrPayload).toBe('oxycommons://approve?v=1&code=AUTH-CODE');
+    controller.cancelSignIn();
+  });
+
+  it('does NOT open Commons when canOpenApp reports it absent (renders QR only)', async () => {
+    const openUrl = jest.fn();
+    const canOpenApp = jest.fn().mockResolvedValue(false);
+    const { controller } = makeController({ openUrl, canOpenApp });
+
+    await controller.showQr();
+    await flush();
+
+    expect(canOpenApp).toHaveBeenCalledWith('oxycommons://');
+    expect(openUrl).not.toHaveBeenCalled();
+    expect(controller.getSnapshot().signIn.phase).toBe('waiting');
+    controller.cancelSignIn();
+  });
+
+  it('never probes or opens when canOpenApp is absent (web — unchanged behavior)', async () => {
+    const openUrl = jest.fn();
+    const { controller } = makeController({ openUrl });
+
+    await controller.showQr();
+    await flush();
+
+    expect(openUrl).not.toHaveBeenCalled();
+    expect(controller.getSnapshot().signIn.qrPayload).toBe('oxycommons://approve?v=1&code=AUTH-CODE');
+    controller.cancelSignIn();
+  });
+
+  it('swallows a canOpenApp probe rejection and keeps the QR fallback', async () => {
+    const openUrl = jest.fn();
+    const canOpenApp = jest.fn().mockRejectedValue(new Error('probe boom'));
+    const { controller } = makeController({ openUrl, canOpenApp });
+
+    await controller.showQr();
+    await flush();
+
+    expect(openUrl).not.toHaveBeenCalled();
+    expect(controller.getSnapshot().signIn.phase).toBe('waiting');
+    controller.cancelSignIn();
+  });
+});
+
 describe('AccountDialogController — openPasswordAtOxyAuth', () => {
   beforeEach(() => {
     const store = new Map<string, string>();

package/src/session/__tests__/authStateStore.test.ts

@@ -3,6 +3,7 @@ import {
   createNativeAuthStateStore,
   createMemoryAuthStateStore,
   AUTH_STATE_STORAGE_KEY,
+  AUTH_STATE_TOKEN_STORAGE_KEY,
   type PersistedAuthState,
   type NativeKeyValueStorage,
 } from '../authStateStore';
@@ -161,6 +162,103 @@ describe('createWebAuthStateStore', () => {
     // The authoritative in-memory mirror still reports the cleared state.
     expect(await store.load()).toBeNull();
   });
+
+  it('splits the token into the warm key and keeps the durable blob token-free', async () => {
+    const storage = makeFakeStorage();
+    installLocalStorage(storage);
+    const store = createWebAuthStateStore();
+
+    await store.save({ ...SAMPLE, deviceId: 'dev-1', deviceSecret: 'ds-1' });
+
+    // Durable key holds ONLY the small mint-critical fields — never the JWT.
+    const durableRaw = storage.getItem(AUTH_STATE_STORAGE_KEY);
+    expect(durableRaw).toBeTruthy();
+    expect(JSON.parse(durableRaw ?? '{}')).toEqual({
+      sessionId: 's-1',
+      userId: 'u-1',
+      deviceId: 'dev-1',
+      deviceSecret: 'ds-1',
+    });
+
+    // Warm key holds ONLY the short-lived token pair.
+    const warmRaw = storage.getItem(AUTH_STATE_TOKEN_STORAGE_KEY);
+    expect(warmRaw).toBeTruthy();
+    expect(JSON.parse(warmRaw ?? '{}')).toEqual({
+      accessToken: 'a-jwt',
+      expiresAt: '2030-01-01T00:00:00.000Z',
+    });
+
+    // A FRESH store (empty mirror) composes both keys back into the same shape.
+    expect(await createWebAuthStateStore().load()).toEqual({
+      ...SAMPLE,
+      deviceId: 'dev-1',
+      deviceSecret: 'ds-1',
+    });
+  });
+
+  it('persists the durable credential even when the warm-token write fails', async () => {
+    const map = new Map<string, string>();
+    const storage = {
+      getItem: (k: string) => map.get(k) ?? null,
+      setItem: (k: string, v: string) => {
+        // Simulate the warm token exceeding the store's capacity while the small
+        // durable blob writes fine.
+        if (k === AUTH_STATE_TOKEN_STORAGE_KEY) {
+          throw new DOMException('QuotaExceededError', 'QuotaExceededError');
+        }
+        map.set(k, v);
+      },
+      removeItem: (k: string) => {
+        map.delete(k);
+      },
+      clear: () => map.clear(),
+      key: (i: number) => Array.from(map.keys())[i] ?? null,
+      get length() {
+        return map.size;
+      },
+    } as Storage;
+    installLocalStorage(storage);
+    const store = createWebAuthStateStore();
+
+    await expect(
+      store.save({ ...SAMPLE, deviceId: 'dev-abc', deviceSecret: 'ds-secret-xyz' }),
+    ).resolves.toBeUndefined();
+
+    // The durable mint credential landed despite the warm-token write throwing.
+    const durableRaw = storage.getItem(AUTH_STATE_STORAGE_KEY);
+    expect(durableRaw).toBeTruthy();
+    const durable = JSON.parse(durableRaw ?? '{}');
+    expect(durable.deviceId).toBe('dev-abc');
+    expect(durable.deviceSecret).toBe('ds-secret-xyz');
+    expect(durable.accessToken).toBeUndefined();
+    // The warm-token key never persisted.
+    expect(storage.getItem(AUTH_STATE_TOKEN_STORAGE_KEY)).toBeNull();
+
+    // A fresh store restores the mint credential from disk; no warm token survives.
+    const loaded = await createWebAuthStateStore().load();
+    expect(loaded?.deviceId).toBe('dev-abc');
+    expect(loaded?.deviceSecret).toBe('ds-secret-xyz');
+    expect(loaded?.accessToken).toBeUndefined();
+  });
+
+  it('load() reads an old combined oxy.auth.v1 blob (pre-split back-compat)', async () => {
+    const storage = makeFakeStorage();
+    installLocalStorage(storage);
+    // A user upgraded from the pre-split build: the WHOLE state (incl. the token)
+    // lives in the single durable key; the warm key does not exist yet.
+    storage.setItem(
+      AUTH_STATE_STORAGE_KEY,
+      JSON.stringify({ ...SAMPLE, deviceId: 'dev-old', deviceSecret: 'ds-old' }),
+    );
+    expect(storage.getItem(AUTH_STATE_TOKEN_STORAGE_KEY)).toBeNull();
+
+    const store = createWebAuthStateStore();
+    const loaded = await store.load();
+    // The token is read back from the combined blob (no one is logged out).
+    expect(loaded).toEqual({ ...SAMPLE, deviceId: 'dev-old', deviceSecret: 'ds-old' });
+    expect(loaded?.accessToken).toBe('a-jwt');
+    expect(loaded?.expiresAt).toBe('2030-01-01T00:00:00.000Z');
+  });
 });
 
 describe('createNativeAuthStateStore', () => {
@@ -210,6 +308,78 @@ describe('createNativeAuthStateStore', () => {
     // The write threw, but the in-memory mirror preserves the session.
     expect(await store.load()).toEqual(SAMPLE);
   });
+
+  it('persists the durable credential even when the warm-token write fails (oversize SecureStore value)', async () => {
+    const map = new Map<string, string>();
+    const storage: NativeKeyValueStorage = {
+      getItem: async (k) => map.get(k) ?? null,
+      // The large JWT exceeds the SecureStore value limit; the small durable blob
+      // writes fine.
+      setItem: async (k, v) => {
+        if (k === AUTH_STATE_TOKEN_STORAGE_KEY) {
+          throw new Error('Value too large for SecureStore');
+        }
+        map.set(k, v);
+      },
+      removeItem: async (k) => {
+        map.delete(k);
+      },
+    };
+    const store = createNativeAuthStateStore(storage);
+
+    await expect(
+      store.save({ ...SAMPLE, deviceId: 'dev-n', deviceSecret: 'ds-n' }),
+    ).resolves.toBeUndefined();
+
+    // The durable mint credential landed to disk.
+    expect(map.get(AUTH_STATE_STORAGE_KEY)).toBeTruthy();
+    const durable = JSON.parse(map.get(AUTH_STATE_STORAGE_KEY) ?? '{}');
+    expect(durable.deviceId).toBe('dev-n');
+    expect(durable.deviceSecret).toBe('ds-n');
+    expect(durable.accessToken).toBeUndefined();
+    expect(map.get(AUTH_STATE_TOKEN_STORAGE_KEY)).toBeUndefined();
+
+    // A FRESH store (empty mirror) restores the mint credential from disk.
+    const loaded = await createNativeAuthStateStore(storage).load();
+    expect(loaded?.deviceId).toBe('dev-n');
+    expect(loaded?.deviceSecret).toBe('ds-n');
+    expect(loaded?.accessToken).toBeUndefined();
+  });
+
+  it('load() reads an old combined blob (pre-split back-compat)', async () => {
+    const map = new Map<string, string>();
+    const storage: NativeKeyValueStorage = {
+      getItem: async (k) => map.get(k) ?? null,
+      setItem: async (k, v) => {
+        map.set(k, v);
+      },
+      removeItem: async (k) => {
+        map.delete(k);
+      },
+    };
+    // Pre-split combined blob in the single durable key; no warm key.
+    map.set(
+      AUTH_STATE_STORAGE_KEY,
+      JSON.stringify({ ...SAMPLE, deviceId: 'dev-old', deviceSecret: 'ds-old' }),
+    );
+
+    const store = createNativeAuthStateStore(storage);
+    expect(await store.load()).toEqual({ ...SAMPLE, deviceId: 'dev-old', deviceSecret: 'ds-old' });
+  });
+
+  it('clear() wipes BOTH the durable and warm keys', async () => {
+    const storage = makeNativeStorage();
+    const store = createNativeAuthStateStore(storage);
+    await store.save({ ...SAMPLE, deviceId: 'dev-1', deviceSecret: 'ds-1' });
+    // Both keys were written by the split save.
+    expect(storage.map.get(AUTH_STATE_STORAGE_KEY)).toBeTruthy();
+    expect(storage.map.get(AUTH_STATE_TOKEN_STORAGE_KEY)).toBeTruthy();
+
+    await store.clear();
+    expect(storage.map.get(AUTH_STATE_STORAGE_KEY)).toBeUndefined();
+    expect(storage.map.get(AUTH_STATE_TOKEN_STORAGE_KEY)).toBeUndefined();
+    expect(await store.load()).toBeNull();
+  });
 });
 
 describe('createMemoryAuthStateStore', () => {

package/src/session/accountDialogController.ts

@@ -131,10 +131,27 @@ export interface AccountDialogControllerOptions {
    * `Linking.openURL`). Headless core never touches `window`/`Linking` itself.
    */
   openUrl?: (url: string) => void;
+  /**
+   * Optional "can this app open this URL scheme?" probe, symmetric to
+   * {@link openUrl}. When provided, `showQr` uses it to detect an installed
+   * Commons (`oxycommons://`) and, if present, deep-links straight into its
+   * approve screen via {@link openUrl} — while KEEPING the QR/polling active as
+   * the fallback. Injected by the provider (native: `Linking.canOpenURL`; web:
+   * absent/false). Headless core never touches `Linking` itself; when absent
+   * `showQr` behaves exactly as before (render QR only).
+   */
+  canOpenApp?: (url: string) => Promise<boolean>;
 }
 
 const DEFAULT_POLL_INTERVAL_MS = 3000;
 
+/**
+ * Commons's custom URL scheme. Probed via the injected `canOpenApp` to detect an
+ * installed Commons on the same device; the `oxycommons://approve?...` deep link
+ * itself is the flow's `qrPayload`.
+ */
+const COMMONS_APP_SCHEME = 'oxycommons://';
+
 const IDLE_SIGN_IN: SignInFlowState = {
   phase: 'idle',
   authorizeCode: null,
@@ -160,6 +177,7 @@ export class AccountDialogController {
   private readonly authRedirectUri: string | null;
   private readonly pollIntervalMs: number;
   private readonly openUrl?: (url: string) => void;
+  private readonly canOpenApp?: (url: string) => Promise<boolean>;
 
   private readonly listeners = new Set<SnapshotListener>();
 
@@ -197,6 +215,7 @@ export class AccountDialogController {
     this.authRedirectUri = options.authRedirectUri ?? null;
     this.pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
     this.openUrl = options.openUrl;
+    this.canOpenApp = options.canOpenApp;
     this.snapshot = this.computeSnapshot();
   }
 
@@ -534,11 +553,37 @@ export class AccountDialogController {
         error: null,
       });
       this.scheduleNextPoll(handle.sessionToken);
+      // Same-device convenience: if Commons is installed (native only — `canOpenApp`
+      // is undefined/false on web), deep-link straight into its approve screen with
+      // the same `oxycommons://approve?...` payload the QR encodes. The QR + polling
+      // stay live as the fallback, so a user who dismisses the app-open still
+      // completes the sign-in by scanning.
+      void this.maybeOpenCommons(handle.qrPayload);
     } catch (error) {
       this.setSignIn({ ...IDLE_SIGN_IN, phase: 'error', error: errorMessage(error) });
     }
   }
 
+  /**
+   * When a `canOpenApp` probe is injected and reports Commons installed, open the
+   * approve deep link via the injected `openUrl`. Best-effort and non-blocking: a
+   * probe/open failure is logged and swallowed — the QR/polling fallback remains.
+   */
+  private async maybeOpenCommons(qrPayload: string): Promise<void> {
+    if (!this.canOpenApp || !this.openUrl) return;
+    try {
+      if (await this.canOpenApp(COMMONS_APP_SCHEME)) {
+        this.openUrl(qrPayload);
+      }
+    } catch (error) {
+      logger.debug(
+        '[AccountDialogController] Commons deep-link probe failed (QR fallback active)',
+        { component: 'AccountDialogController' },
+        error,
+      );
+    }
+  }
+
   /** Tear down the active sign-in device flow (timers + token) and reset to idle. */
   cancelSignIn(): void {
     this.clearPollTimer();
@@ -638,7 +683,14 @@ export class AccountDialogController {
 
   private async claimAndComplete(sessionId: string, sessionToken: string): Promise<void> {
     this.setSignIn({ ...this.signIn, phase: 'authorized' });
-    let claimed: { accessToken: string; sessionId: string; deviceId: string; expiresAt: string; user: User };
+    let claimed: {
+      accessToken: string;
+      sessionId: string;
+      deviceId: string;
+      expiresAt: string;
+      user: User;
+      deviceSecret?: string;
+    };
     try {
       claimed = await this.oxyServices.claimSessionByToken(sessionToken);
     } catch (error) {
@@ -666,6 +718,7 @@ export class AccountDialogController {
           expiresAt: claimed.expiresAt ?? '',
           user: minimalUser,
           accessToken: claimed.accessToken,
+          ...(claimed.deviceSecret ? { deviceSecret: claimed.deviceSecret } : {}),
         },
         minimalUser,
       );