@oxyhq/services 11.1.1 → 12.1.0

package/src/ui/context/silentSessionRestore.ts

@@ -0,0 +1,67 @@
+/**
+ * Silent, no-reload session-restore PRIMITIVES — the single shared
+ * implementation used by BOTH cold boot (`OxyContext.restoreSessionsFromStorage`)
+ * and in-session token refresh (`createInSessionRefreshHandler`). Neither caller
+ * re-implements these; they compose them. Keeping one home avoids the two paths
+ * drifting on "how do we mint a first-party token without a page reload".
+ *
+ * Each function is platform-agnostic at the type level and returns plain data;
+ * the callers own the side effects that differ between them (cold boot COMMITS
+ * the recovered session into provider state; refresh only reads the freshly
+ * planted bearer).
+ */
+import type { OxyServices, SessionLoginResponse } from '@oxyhq/core';
+import { autoDetectAuthWebUrl } from '@oxyhq/core';
+
+/**
+ * Mint a fresh first-party session via the PER-APEX `/auth/silent` iframe — the
+ * durable cross-domain restore path that works WITHOUT a top-level navigation
+ * (so it succeeds under Safari ITP / Firefox TCP and in a backgrounded tab).
+ *
+ * The instance is configured with the CENTRAL auth URL, so we explicitly point
+ * the iframe at the per-apex host (`auth.<rp-apex>`) via `autoDetectAuthWebUrl()`
+ * + `silentSignIn`'s `authWebUrlOverride`. On a `*.oxy.so` app the per-apex host
+ * IS the central host, so this also covers same-apex. When auto-detection bails
+ * (localhost / IP / single-label / off-browser) there is no per-apex IdP and we
+ * return `null`. `silentSignIn` plants the access token internally on success.
+ *
+ * @returns the recovered session (token already planted) when complete, else
+ * `null` (no per-apex IdP, no session, or an incomplete iframe response).
+ */
+export async function mintSessionViaPerApexIframe(
+  oxyServices: OxyServices,
+  timeoutMs: number,
+): Promise<SessionLoginResponse | null> {
+  const perApexAuthUrl = autoDetectAuthWebUrl();
+  if (!perApexAuthUrl) {
+    return null;
+  }
+  const session = await oxyServices.silentSignIn?.({
+    authWebUrlOverride: perApexAuthUrl,
+    timeout: timeoutMs,
+  });
+  if (!session?.user || !session.sessionId) {
+    return null;
+  }
+  return session;
+}
+
+/**
+ * Pick the active account from a `refreshAllSessions` snapshot: the persisted
+ * `authuser` slot when it still matches a returned account, otherwise the lowest
+ * `authuser` (the server sorts ascending, so `[0]`). Callers guarantee a
+ * non-empty list, so the result is always defined.
+ *
+ * Shared by cold-boot cookie restore and the in-session refresh cookie arm so
+ * the active-slot selection can never diverge between them.
+ */
+export function selectActiveRefreshAccount<T extends { authuser: number }>(
+  accounts: T[],
+  persistedAuthuser: number | null,
+): T {
+  const matched =
+    persistedAuthuser !== null
+      ? accounts.find((account) => account.authuser === persistedAuthuser)
+      : undefined;
+  return matched ?? accounts[0];
+}

package/src/ui/index.ts

@@ -12,6 +12,8 @@
  * cannot contain `require()` per CLAUDE.md) and (b) defeated tree-shaking.
  */
 
+/// <reference path="../types/react-native-classname.d.ts" />
+
 // Components
 export { default as OxyProvider } from './components/OxyProvider';
 export { default as OxySignInButton } from './components/OxySignInButton';

package/src/ui/types/navigation.ts

@@ -63,21 +63,4 @@ export interface OxyProviderProps {
     authWebUrl?: string;
     authRedirectUri?: string;
     queryClient?: QueryClient;
-    /**
-     * When `true`, skips ONLY the terminal SSO bounce in the web cold-boot
-     * chain — the force-redirect to `auth.<apex>/sso?prompt=none` that fires
-     * for a visitor with no recoverable local session. This lets a truly
-     * anonymous user keep browsing instead of being bounced to the central
-     * IdP (e.g. a marketplace that allows anonymous browsing like eBay /
-     * Shop.app).
-     *
-     * Session restore still runs in full: the callback consume, FedCM silent,
-     * first-party `/auth/silent` iframe, stored-session bearer, and
-     * cookie-restore steps all execute — so a returning signed-in user is
-     * still silently restored. Only the force-bounce for a genuinely
-     * anonymous visitor is suppressed.
-     *
-     * Default `false` (current behavior: the bounce fires).
-     */
-    disableAutoSso?: boolean;
 }

package/src/ui/utils/storageHelpers.ts

@@ -9,6 +9,17 @@ export interface SessionStorageKeys {
   activeSessionId: string;
   sessionIds: string;
   language: string;
+  /**
+   * DURABLE "this device/app has had a signed-in Oxy session before" hint.
+   *
+   * Lives in the SAME `storageKeyPrefix`-scoped durable store as the stored
+   * session ids, so it survives a session expiring (cleared only on explicit
+   * full sign-out). Read at cold boot to drive the smart `sso-bounce` gate:
+   * a returning visitor still gets ONE establish bounce so a central-only
+   * cross-domain session recovers, while a first-time anonymous visitor is
+   * never force-redirected. See `allowSsoBounce` in `@oxyhq/core`.
+   */
+  priorSession: string;
 }
 
 /**
@@ -125,6 +136,7 @@ export const getStorageKeys = (prefix: string = STORAGE_KEY_PREFIX): SessionStor
   activeSessionId: `${prefix}_active_session_id`,
   sessionIds: `${prefix}_session_ids`,
   language: `${prefix}_language`,
+  priorSession: `${prefix}_prior_session`,
 });