@oxyhq/services 10.5.0 → 11.1.0

package/src/ui/components/fileManagement/FileViewer.tsx

@@ -266,8 +266,8 @@ export const FileViewer: React.FC<FileViewerProps> = ({
                             style={fileManagementStyles.downloadButtonLarge}
                             onPress={() => onDownload(file.id, file.filename)}
                         >
-                            <MaterialCommunityIcons name="download" size={18} color={colors.negativeForeground} />
-                            <Text style={fileManagementStyles.downloadButtonText}>Download PDF</Text>
+                            <MaterialCommunityIcons name="download" size={18} color={colors.primaryForeground} />
+                            <Text style={[fileManagementStyles.downloadButtonText, { color: colors.primaryForeground }]}>Download PDF</Text>
                         </TouchableOpacity>
                     </View>
                 ) : isVideo && fileContent ? (
@@ -289,8 +289,8 @@ export const FileViewer: React.FC<FileViewerProps> = ({
                             style={fileManagementStyles.downloadButtonLarge}
                             onPress={() => onDownload(file.id, file.filename)}
                         >
-                            <MaterialCommunityIcons name="download" size={18} color={colors.negativeForeground} />
-                            <Text style={fileManagementStyles.downloadButtonText}>Download Video</Text>
+                            <MaterialCommunityIcons name="download" size={18} color={colors.primaryForeground} />
+                            <Text style={[fileManagementStyles.downloadButtonText, { color: colors.primaryForeground }]}>Download Video</Text>
                         </TouchableOpacity>
                     </View>
                 ) : isAudio && fileContent ? (
@@ -312,8 +312,8 @@ export const FileViewer: React.FC<FileViewerProps> = ({
                             style={fileManagementStyles.downloadButtonLarge}
                             onPress={() => onDownload(file.id, file.filename)}
                         >
-                            <MaterialCommunityIcons name="download" size={18} color={colors.negativeForeground} />
-                            <Text style={fileManagementStyles.downloadButtonText}>Download Audio</Text>
+                            <MaterialCommunityIcons name="download" size={18} color={colors.primaryForeground} />
+                            <Text style={[fileManagementStyles.downloadButtonText, { color: colors.primaryForeground }]}>Download Audio</Text>
                         </TouchableOpacity>
                     </View>
                 ) : (
@@ -335,8 +335,8 @@ export const FileViewer: React.FC<FileViewerProps> = ({
                             style={fileManagementStyles.downloadButtonLarge}
                             onPress={() => onDownload(file.id, file.filename)}
                         >
-                            <MaterialCommunityIcons name="download" size={18} color={colors.negativeForeground} />
-                            <Text style={fileManagementStyles.downloadButtonText}>Download File</Text>
+                            <MaterialCommunityIcons name="download" size={18} color={colors.primaryForeground} />
+                            <Text style={[fileManagementStyles.downloadButtonText, { color: colors.primaryForeground }]}>Download File</Text>
                         </TouchableOpacity>
                     </View>
                 )}
@@ -387,7 +387,7 @@ export const FileViewer: React.FC<FileViewerProps> = ({
                                     }}
                                 >
                                     <MaterialCommunityIcons name="delete" size={16} color={colors.negativeForeground} />
-                                    <Text style={fileManagementStyles.fileDetailsActionText}>Delete</Text>
+                                    <Text style={[fileManagementStyles.fileDetailsActionText, { color: colors.negativeForeground }]}>Delete</Text>
                                 </TouchableOpacity>
                             </View>
                         )}

package/src/ui/components/fileManagement/UploadPreview.tsx

@@ -123,8 +123,8 @@ const UploadPreviewContent: React.FC<{
                             style={fileManagementStyles.uploadPreviewConfirmButton}
                             onPress={onConfirm}
                         >
-                            <Ionicons name="cloud-upload" size={20} color={colors.negativeForeground} />
-                            <Text style={fileManagementStyles.uploadPreviewConfirmText}>Upload</Text>
+                            <Ionicons name="cloud-upload" size={20} color={colors.primaryForeground} />
+                            <Text style={[fileManagementStyles.uploadPreviewConfirmText, { color: colors.primaryForeground }]}>Upload</Text>
                         </TouchableOpacity>
                     </View>
                 )}

package/src/ui/context/OxyContext.tsx

@@ -19,6 +19,7 @@ import {
   runColdBoot,
   resolveCentralAuthUrl,
   autoDetectAuthWebUrl,
+  registrableApex,
   SSO_CALLBACK_PATH,
   ssoStateKey,
   ssoGuardKey,
@@ -92,6 +93,24 @@ export interface OxyContextState {
   // Authentication
   signIn: (publicKey: string, deviceName?: string) => Promise<User>;
 
+  /**
+   * Sign in with a username/email + password.
+   *
+   * Commits a successful session into context state through the SAME path FedCM
+   * / SSO use (so `isAuthenticated` / `user` update and the session is persisted
+   * durably). Returns a discriminated result so the caller can branch on the
+   * two-factor-required case — which creates NO session; the caller completes
+   * the 2FA challenge with the returned `loginToken`.
+   *
+   * This is the keyless native sign-in path for the slimmed Accounts app, which
+   * no longer holds a local cryptographic identity key.
+   */
+  signInWithPassword: (
+    identifier: string,
+    password: string,
+    opts?: { deviceName?: string; deviceFingerprint?: string },
+  ) => Promise<PasswordSignInResult>;
+
   /**
    * Handle a session returned by web SSO.
    * Updates auth state, persists session metadata to storage.
@@ -145,6 +164,22 @@ export interface OxyContextState {
 
 const OxyContext = createContext<OxyContextState | null>(null);
 
+/**
+ * Result of {@link OxyContextState.signInWithPassword}.
+ *
+ * `'ok'` — the password was accepted and the resulting session has been
+ * committed into context state (the SAME path FedCM / SSO sessions use), so
+ * `isAuthenticated` / `user` are updated and the session is durably persisted;
+ * the caller can proceed (e.g. navigate into the app).
+ *
+ * `'2fa_required'` — the account has two-factor auth enabled, so NO session was
+ * created. The caller must complete the challenge with the returned short-lived
+ * `loginToken` (`POST /security/2fa/verify-login`) before a session exists.
+ */
+export type PasswordSignInResult =
+  | { status: 'ok' }
+  | { status: '2fa_required'; loginToken: string };
+
 // Active-authuser persistence helpers (web localStorage; native no-op) live in
 // `../utils/activeAuthuser` so the session-management and auth-operations hooks
 // can share them without re-importing this 1k-line context file.
@@ -236,6 +271,20 @@ const SILENT_IFRAME_TIMEOUT = 2500;
  */
 const COOKIE_RESTORE_TIMEOUT = 3000;
 
+/**
+ * Per-step fail-fast budget (ms) for the native shared-key cold-boot step
+ * (`signInWithSharedIdentity`).
+ *
+ * That step does a challenge round-trip plus a verify against the shared
+ * cross-app identity key; if the device holds no shared identity it returns
+ * `null` quickly, but a slow/offline network must not let it block the cold
+ * boot. 8s mirrors the stored-session bearer-validation budget
+ * (`VALIDATION_TIMEOUT`) since both perform comparable bounded network work; on
+ * expiry the step resolves to `null` and cold boot falls through (native then
+ * reaches the unauthenticated backstop, web never runs this step at all).
+ */
+const SHARED_KEY_SIGNIN_TIMEOUT = 8000;
+
 /**
  * HARD overall deadline (ms) for the entire cold-boot step loop —
  * defense-in-depth so a single non-settling step can NEVER hang auth resolution
@@ -265,13 +314,17 @@ const COOKIE_RESTORE_TIMEOUT = 3000;
 const COLD_BOOT_OVERALL_DEADLINE = 20000;
 
 /**
- * Per-session timeout (ms) for the parallel stored-session validation in
+ * Per-session soft timeout (ms) for the parallel stored-session validation in
  * `restoreStoredSession`. Each `validateSession` call races against this timer
  * so a single slow/offline session never blocks the whole startup validation
- * sweep — sessions that don't answer in time resolve to `null` (treated as
- * unvalidated) and the remaining sessions still settle.
+ * sweep. Sessions that don't answer in time are treated as unvalidated and kept
+ * in the persisted ID list; only explicit invalid-session responses are pruned.
  */
 const VALIDATION_TIMEOUT = 8000;
+const VALIDATION_TIMEOUT_RESULT = 'validation-timeout' as const;
+type StoredSessionValidationResult =
+  | { session: ClientSession | null; timedOut: false }
+  | { sessionId: string; timedOut: true };
 
 /**
  * Fallback client-session validity window (ms) — 7 days — applied when a
@@ -357,12 +410,11 @@ function isSameSiteIdP(idpOrigin: string): boolean {
   const pageHostname = window.location.hostname;
   if (!idpHostname || !pageHostname) return false;
   if (idpHostname === pageHostname) return true;
-  const apexOf = (hostname: string): string => hostname.split('.').slice(-2).join('.');
-  const pageApex = apexOf(pageHostname);
-  // Require a real registrable apex (≥2 labels) AND an exact apex match AND that
-  // the IdP host is the page apex itself or a subdomain of it.
-  if (pageHostname.split('.').length < 2) return false;
-  if (apexOf(idpHostname) !== pageApex) return false;
+  const pageApex = registrableApex(pageHostname);
+  const idpApex = registrableApex(idpHostname);
+  // Require a real registrable apex (not a shared/public suffix) AND an exact
+  // apex match AND that the IdP host is the page apex itself or a subdomain of it.
+  if (!pageApex || idpApex !== pageApex) return false;
   return idpHostname === pageApex || idpHostname.endsWith(`.${pageApex}`);
 }
 
@@ -948,14 +1000,15 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     ]));
 
     let validSessions: ClientSession[] = [];
+    let unvalidatedSessionIds: string[] = [];
 
     if (storedSessionIds.length > 0) {
       // Validate all sessions in parallel (with a per-session timeout) to avoid
       // sequential blocking that freezes the app on startup
       const results = await Promise.allSettled(
         storedSessionIds.map(async (sessionId) => {
-          const timeoutPromise = new Promise<null>((resolve) =>
-            setTimeout(() => resolve(null), VALIDATION_TIMEOUT),
+          const timeoutPromise = new Promise<typeof VALIDATION_TIMEOUT_RESULT>((resolve) =>
+            setTimeout(() => resolve(VALIDATION_TIMEOUT_RESULT), VALIDATION_TIMEOUT),
           );
           const validationPromise = oxyServices
             .validateSession(sessionId, { useHeaderValidation: true })
@@ -969,6 +1022,9 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
             });
 
           return Promise.race([validationPromise, timeoutPromise]).then((validation) => {
+            if (validation === VALIDATION_TIMEOUT_RESULT) {
+              return { sessionId, timedOut: true as const };
+            }
             if (validation?.valid && validation.user) {
               const now = new Date();
               const clientSession: ClientSession = {
@@ -982,21 +1038,31 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
               if (isWebBrowser() && sessionId === storedActiveSessionId && storedActiveAuthuser !== null) {
                 clientSession.authuser = storedActiveAuthuser;
               }
-              return clientSession;
+              return { session: clientSession, timedOut: false as const };
             }
-            return null;
+            return { session: null, timedOut: false as const };
           });
         }),
       );
 
-      validSessions = results
-        .filter((r): r is PromiseFulfilledResult<ClientSession | null> => r.status === 'fulfilled')
-        .map((r) => r.value)
-        .filter((s): s is ClientSession => s !== null);
+      for (const result of results) {
+        if (result.status !== 'fulfilled') continue;
+        const value: StoredSessionValidationResult = result.value;
+        if (value.timedOut) {
+          unvalidatedSessionIds.push(value.sessionId);
+        } else if (value.session) {
+          validSessions.push(value.session);
+        }
+      }
 
-      // Always persist validated sessions to storage (even empty list)
-      // to clear stale/expired session IDs that would cause 401 loops on restart
-      updateSessionsRef.current(validSessions, { merge: false });
+      // Persist validated sessions while preserving soft-timed-out IDs. This
+      // still clears sessions that were explicitly rejected as invalid, but
+      // avoids logging out valid secondary accounts solely because the API was
+      // slow during startup.
+      updateSessionsRef.current(validSessions, {
+        merge: false,
+        preserveSessionIds: unvalidatedSessionIds,
+      });
     }
 
     if (storedActiveSessionId) {
@@ -1014,7 +1080,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
           await storage.removeItem(storageKeys.activeSessionId);
           updateSessionsRef.current(
             validSessions.filter((session) => session.sessionId !== storedActiveSessionId),
-            { merge: false },
+            { merge: false, preserveSessionIds: unvalidatedSessionIds },
           );
           // Don't log expected session errors during restoration
         } else if (isTimeoutOrNetworkError(switchError)) {
@@ -1191,6 +1257,56 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
               return { kind: 'skip' };
             },
           },
+          {
+            // 2.5) Shared-key SSO (NATIVE ONLY) — same-device, no interaction.
+            //
+            // When a sibling Oxy app (the Commons identity vault) has written
+            // the cross-app shared identity into the `group.so.oxy.shared`
+            // keychain, this mints THIS app's session from it silently:
+            // `signInWithSharedIdentity()` proves control of the shared key
+            // (challenge → sign → verify, which plants the tokens server-side)
+            // and returns a `SessionLoginResponse`, which we commit through the
+            // SAME path the web SSO steps use (`handleWebSSOSession`), so state,
+            // durable persistence, profile fetch, and `markAuthResolved` all run
+            // identically. Returns `null` when no shared identity is present, so
+            // a device without Commons simply falls through.
+            //
+            // ORDERING: runs immediately AFTER `stored-session` (an already
+            // restored local bearer always wins first — `storedSessionRestored`
+            // gates this off) and BEFORE the web-only probes (which are gated
+            // off on native anyway). Native-only: `enabled` requires
+            // `!isWebBrowser()`, and the core method also returns `null` on web,
+            // so `WebOxyProvider` / the web path are entirely unaffected.
+            // Bounded by `SHARED_KEY_SIGNIN_TIMEOUT` so a slow/offline network
+            // cannot stall cold boot.
+            id: 'shared-key-signin',
+            enabled: () => !isWebBrowser() && !storedSessionRestored,
+            run: async () => {
+              if (!commitWebSession) {
+                return { kind: 'skip' };
+              }
+              let timeoutId: ReturnType<typeof setTimeout> | undefined;
+              const session = await Promise.race<SessionLoginResponse | null>([
+                oxyServices.signInWithSharedIdentity?.() ?? Promise.resolve(null),
+                new Promise<null>((resolve) => {
+                  timeoutId = setTimeout(() => resolve(null), SHARED_KEY_SIGNIN_TIMEOUT);
+                }),
+              ]).finally(() => {
+                if (timeoutId !== undefined) {
+                  clearTimeout(timeoutId);
+                }
+              });
+              if (!session) {
+                return { kind: 'skip' };
+              }
+              await commitWebSession(session);
+              // Record the win so the (web-only) probes below explicitly skip —
+              // belt-and-suspenders; `runColdBoot` already short-circuits on the
+              // first `{kind:'session'}`, and those probes are off on native.
+              storedSessionRestored = true;
+              return { kind: 'session', session: true };
+            },
+          },
           {
             // 3) FedCM silent reauthn (Chrome) against the CENTRAL IdP
             // (auth.oxy.so). `silentSignInWithFedCM` plants the access token
@@ -1560,6 +1676,44 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
   // before the cold-boot effect (gated on `storage`/`initialized`) can fire.
   handleWebSSOSessionRef.current = handleWebSSOSession;
 
+  // Keyless native sign-in: username/email + password. The slimmed Accounts app
+  // (which no longer holds a local identity key) uses this; it commits a
+  // successful session through the SAME `handleWebSSOSession` path FedCM / SSO
+  // use, so state, durable persistence, profile fetch, and `markAuthResolved`
+  // all run identically. The API returns either a full session OR a two-factor
+  // handoff (`{ twoFactorRequired, loginToken }`) — we surface the latter as a
+  // discriminated result so the caller can run the 2FA challenge without any
+  // session being committed.
+  const signInWithPassword = useCallback(
+    async (
+      identifier: string,
+      password: string,
+      opts?: { deviceName?: string; deviceFingerprint?: string },
+    ): Promise<PasswordSignInResult> => {
+      const response = await oxyServices.signIn(
+        identifier,
+        password,
+        opts?.deviceName,
+        opts?.deviceFingerprint,
+      );
+      // Core types `signIn` as `SessionLoginResponse`, but the API may instead
+      // return a 2FA challenge handoff. Widen with optional fields (no `any`) to
+      // read them — the added members are optional, so the base type is
+      // assignable to this intersection.
+      const maybeTwoFactor: SessionLoginResponse & {
+        twoFactorRequired?: boolean;
+        loginToken?: string;
+      } = response;
+      if (maybeTwoFactor.twoFactorRequired && maybeTwoFactor.loginToken) {
+        return { status: '2fa_required', loginToken: maybeTwoFactor.loginToken };
+      }
+      // Full session — commit it through the shared web-session path.
+      await handleWebSSOSession(response);
+      return { status: 'ok' };
+    },
+    [oxyServices, handleWebSSOSession],
+  );
+
   // Cross-domain silent SSO is now owned by the `fedcm-silent` / `silent-iframe`
   // cold-boot steps above (the ordered `runColdBoot` sequence). `useWebSSO`
   // remains mounted for its module-level run-once guard and its interactive
@@ -1831,6 +1985,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     hasIdentity,
     getPublicKey,
     signIn,
+    signInWithPassword,
     handleWebSession: handleWebSSOSession,
     logout,
     logoutAll,
@@ -1857,6 +2012,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
   }), [
     activeSessionId,
     signIn,
+    signInWithPassword,
     handleWebSSOSession,
     currentLanguage,
     currentLanguageMetadata,
@@ -1947,6 +2103,7 @@ const LOADING_STATE: OxyContextState = {
   hasIdentity: () => Promise.resolve(false),
   getPublicKey: () => Promise.resolve(null),
   signIn: () => rejectMissingProvider<User>(),
+  signInWithPassword: () => rejectMissingProvider<PasswordSignInResult>(),
   handleWebSession: () => rejectMissingProvider<void>(),
   logout: () => rejectMissingProvider<void>(),
   logoutAll: () => rejectMissingProvider<void>(),

package/src/ui/context/hooks/useAuthOperations.ts

@@ -275,26 +275,15 @@ export const useAuthOperations = ({
     }
 
     try {
-      // Semantics intentionally diverge by platform to match user expectation:
-      //   - Web: "Sign out of all accounts" = sign out every device-local
-      //     account on THIS device. The cookie endpoint is the only path
-      //     that can `Set-Cookie` an immediate expiry on every
-      //     `oxy_rt_${n}` slots AND revoke every presented family server-side.
-      //     The bearer-protected
-      //     `logoutAllSessions(activeSessionId)` would only revoke the
-      //     active user's sessions across devices and leave sibling
-      //     accounts' cookies sitting on this device — wrong UX for the
-      //     chooser's "Sign out of all accounts".
-      //   - Native: there are no per-account cookies; "Sign out of all"
-      //     keeps its long-standing "revoke every session of THIS user"
-      //     meaning via the bearer endpoint.
-      // After clearing on web, also drop the persisted active-authuser so
-      // the next cold boot starts from a clean slate.
+      // Always invoke the bearer-protected global endpoint first: the public
+      // `logoutAll`/`signOutAll` contract means revoking this user's sessions
+      // across devices, not just clearing refresh cookies presented by the
+      // current browser. On web, follow up with the cookie endpoint so every
+      // device-local account slot is expired in the browser as well.
+      await oxyServices.logoutAllSessions(activeSessionId);
       if (isWebBrowser()) {
         await oxyServices.logoutAllSessionsViaCookie();
         clearActiveAuthuser();
-      } else {
-        await oxyServices.logoutAllSessions(activeSessionId);
       }
       // logoutAll is ALWAYS a full sign-out: clear the per-origin SSO bounce
       // state (web-guarded internally) so a fresh sign-in can re-probe.

package/src/ui/hooks/mutations/mutationFactory.ts

@@ -81,20 +81,20 @@ export function createProfileMutation<TVariables>(
 
     onMutate: async (variables) => {
       // Cancel queries that might conflict
-      await queryClient.cancelQueries({ queryKey: queryKeys.accounts.current() });
+      await queryClient.cancelQueries({ queryKey: queryKeys.accounts.current(activeSessionId) });
       for (const key of cancelQueryKeys) {
         await queryClient.cancelQueries({ queryKey: key });
       }
 
       // Snapshot previous user data
-      const previousUser = queryClient.getQueryData<User>(queryKeys.accounts.current());
+      const previousUser = queryClient.getQueryData<User>(queryKeys.accounts.current(activeSessionId));
 
       // Apply optimistic update if provided
       if (previousUser && optimisticUpdate) {
         const updates = optimisticUpdate(previousUser, variables);
         const optimisticUser = { ...previousUser, ...updates };
 
-        queryClient.setQueryData<User>(queryKeys.accounts.current(), optimisticUser);
+        queryClient.setQueryData<User>(queryKeys.accounts.current(activeSessionId), optimisticUser);
 
         if (activeSessionId) {
           queryClient.setQueryData<User>(queryKeys.users.profile(activeSessionId), optimisticUser);
@@ -107,7 +107,7 @@ export function createProfileMutation<TVariables>(
     onError: (error, _variables, context) => {
       // Rollback optimistic update
       if (context?.previousUser) {
-        queryClient.setQueryData(queryKeys.accounts.current(), context.previousUser);
+        queryClient.setQueryData(queryKeys.accounts.current(activeSessionId), context.previousUser);
         if (activeSessionId) {
           queryClient.setQueryData(queryKeys.users.profile(activeSessionId), context.previousUser);
         }
@@ -122,7 +122,7 @@ export function createProfileMutation<TVariables>(
 
     onSuccess: (data, variables) => {
       // Update cache with server response
-      queryClient.setQueryData(queryKeys.accounts.current(), data);
+      queryClient.setQueryData(queryKeys.accounts.current(activeSessionId), data);
       if (activeSessionId) {
         queryClient.setQueryData(queryKeys.users.profile(activeSessionId), data);
       }