@oxyhq/services 13.0.2 → 13.1.0

package/lib/module/ui/context/OxyContext.js

@@ -14,7 +14,7 @@ import { useAuthOperations } from "./hooks/useAuthOperations.js";
 import { useDeviceManagement } from "../hooks/useDeviceManagement.js";
 import { getStorageKeys, createPlatformStorage } from "../utils/storageHelpers.js";
 import { isInvalidSessionError, isTimeoutOrNetworkError } from "../utils/errorHandlers.js";
-import { readActiveAuthuser, writeActiveAuthuser } from "../utils/activeAuthuser.js";
+import { readActiveAuthuser, writeActiveAuthuser, clearSignedOut, isSilentRestoreSuppressed } from "../utils/activeAuthuser.js";
 import { showBottomSheet as globalShowBottomSheet } from "../navigation/bottomSheetManager.js";
 import { useQueryClient } from '@tanstack/react-query';
 import { clearQueryCache } from "../hooks/queryClient.js";
@@ -1091,6 +1091,54 @@ export const OxyProvider = ({
         }, priorSessionReadError);
       }
     }
+
+    // LAST-ACTIVE-ACCOUNT priority (web multi-account). When the user has an
+    // explicit persisted active slot (`oxy_active_authuser`, written on every
+    // device sign-in / account SWITCH / cookie restore), the multi-account
+    // refresh-cookie restore is the ONLY cold-boot step that honors WHICH slot
+    // was last active — `restoreViaRefreshCookie` selects it via
+    // `selectActiveRefreshAccount(accounts, readActiveAuthuser())`. The
+    // `fedcm-silent` and per-apex `silent-iframe` steps only ever recover the
+    // PRIMARY central IdP session, so if either ran first they would clobber a
+    // switched (managed/org) account back to the primary on reload — the exact
+    // "switch is lost on reload" regression. So when a slot selection exists we
+    // run cookie-restore BEFORE those probes (and disable the later duplicate).
+    //
+    // Read ONCE here (synchronously usable by the step `enabled` gates below).
+    // It is non-null ONLY on first-party web apps that persist the slot. Both the
+    // device sign-in/switch paths AND `handleWebSSOSession` (FedCM/SSO/credentials
+    // commit funnel) now persist it — but only when the session genuinely joined
+    // the device set: `establishDeviceRefreshSlot` returns an `authuser` ONLY on
+    // first-party web (same registrable apex as the API), so a cross-apex RP never
+    // writes a phantom slot and native has no localStorage. Both therefore keep
+    // their existing order untouched. The earlier `stored-session` step still runs
+    // first (FIX-A latency), and when a slot exists but its cookies have all
+    // lapsed, cookie-restore simply returns no accounts and the chain falls through
+    // to the cross-domain fallbacks exactly as before.
+    const prioritizeMultiAccount = isWebBrowser() && readActiveAuthuser() !== null;
+
+    // DELIBERATELY-SIGNED-OUT gate (web): when the user pressed "Sign out", any
+    // credential that can silently re-mint a session may still be live on the
+    // next reload — the central IdP session (FedCM credential association /
+    // per-apex `fedcm_session` cookie) AND the device refresh cookies. Since
+    // PR #455 the PRIMARY web session also joins the `oxy_rt_<authuser>` device
+    // set, so the un-gated cookie-restore steps would `refresh-all` that still-
+    // present cookie and sign the user back in without intent — exactly the
+    // "sign-out is silently undone" regression. So this flag gates EVERY
+    // AUTOMATIC silent-restore cold-boot step: `stored-session`,
+    // `cookie-restore-active`, `fedcm-silent`, `silent-iframe`, and
+    // `cookie-restore`. The gate — not a cookie wipe — is the authority: the
+    // account may stay "known" for a fast deliberate re-sign-in, but no step
+    // restores it silently while the flag is set. Read the durable flag ONCE here
+    // (synchronously usable by every step `enabled` gate). Any deliberate sign-in
+    // (password, FedCM, account switch, device claim) clears it, so there is no
+    // "stuck signed out" state. The `sso-bounce` step needs no extra gate: it is
+    // already self-suppressed after sign-out (its `hasPriorSession` hint is
+    // cleared). `sso-return` is NOT gated — it commits the result of a deliberate
+    // top-level `/sso` bounce the user just initiated. `shared-key-signin` is
+    // native-only and the flag never sets on native (`markSignedOut` no-ops
+    // off-web), so its gate would be moot; it is left untouched.
+    const silentRestoreBlocked = isSilentRestoreSuppressed();
     try {
       const outcome = await runColdBoot({
         steps: [{
@@ -1111,12 +1159,17 @@ export const OxyProvider = ({
             };
           }
         }, {
-          // 2) Stored-session bearer restore. NO `enabled` gate — runs on ALL
-          // platforms. This is native's ONLY restore path (every web-only step
-          // is disabled off-browser, so native reaches exactly this) AND the
-          // common WEB reload winner.
+          // 2) Stored-session bearer restore. Runs on ALL platforms EXCEPT when
+          // the deliberately-signed-out flag is set (web only — it never sets on
+          // native, so native still always reaches exactly this step, its ONLY
+          // restore path). This is also the common WEB reload winner.
+          //
+          // SIGNED-OUT GATE: after a deliberate full sign-out the stored session
+          // state is cleared, so this would normally skip anyway — but the gate
+          // makes that authoritative rather than incidental, so no residual
+          // stored token can silently restore while the user is signed out.
           //
-          // ORDERING (FIX A): this step now runs BEFORE the slow web-only
+          // ORDERING (FIX A): this step runs BEFORE the slow web-only
           // probes (`fedcm-silent`, `silent-iframe`, `cookie-restore`). On a
           // normal reload the local bearer validates in one round-trip and
           // wins; `runColdBoot` then short-circuits and never even evaluates
@@ -1127,6 +1180,7 @@ export const OxyProvider = ({
           // local session this step skips and the cross-domain fallback chain
           // (fedcm → iframe → cookie → sso-bounce) runs exactly as before.
           id: 'stored-session',
+          enabled: () => !silentRestoreBlocked,
           run: async () => {
             const restored = await restoreStoredSession();
             if (restored) {
@@ -1195,6 +1249,38 @@ export const OxyProvider = ({
               session: true
             };
           }
+        }, {
+          // 2.75) LAST-ACTIVE multi-account restore (WEB, prioritized). Runs
+          // ONLY when an explicit persisted slot selection exists
+          // (`prioritizeMultiAccount`) — i.e. the user previously signed in or
+          // SWITCHED accounts on this first-party app. It runs BEFORE the
+          // `fedcm-silent` / `silent-iframe` probes (which only ever recover the
+          // PRIMARY central session) so a switched managed/org account survives
+          // reload instead of being clobbered back to the primary. The restore
+          // itself is the SAME `restoreViaRefreshCookie` as the terminal-tier
+          // step below: it rotates every device-local `oxy_rt_<authuser>` cookie
+          // and picks the persisted slot via `selectActiveRefreshAccount`,
+          // committing it (token + state + durable persistence + `markAuthResolved`).
+          // When no slot is persisted this is disabled and the original order is
+          // unchanged; when the slot's cookies have lapsed it returns no accounts
+          // and the chain falls through to the cross-domain fallbacks below.
+          //
+          // SIGNED-OUT GATE: since PR #455 the primary's `oxy_rt` slot survives a
+          // deliberate sign-out, so without this gate `refresh-all` would re-mint
+          // and silently re-log-in the user on reload. The flag is cleared by any
+          // deliberate sign-in (including an account SWITCH, which also writes the
+          // new active slot), so the switch-survives-reload path is unaffected.
+          id: 'cookie-restore-active',
+          enabled: () => prioritizeMultiAccount && !silentRestoreBlocked,
+          run: async () => {
+            const restored = await restoreViaRefreshCookie();
+            return restored ? {
+              kind: 'session',
+              session: true
+            } : {
+              kind: 'skip'
+            };
+          }
         }, {
           // 3) FedCM silent reauthn (Chrome) against the CENTRAL IdP
           // (auth.oxy.so). `silentSignInWithFedCM` plants the access token
@@ -1207,7 +1293,7 @@ export const OxyProvider = ({
           // already recovered a local session — the probe cannot improve on a
           // valid local bearer, and skipping it avoids the silent round-trip.
           id: 'fedcm-silent',
-          enabled: () => !storedSessionRestored && fedcmSupported && !servicesSilentAttempted.has(silentKey),
+          enabled: () => !storedSessionRestored && !silentRestoreBlocked && fedcmSupported && !servicesSilentAttempted.has(silentKey),
           run: async () => {
             servicesSilentAttempted.add(silentKey);
             const session = await oxyServices.silentSignInWithFedCM?.();
@@ -1246,7 +1332,7 @@ export const OxyProvider = ({
           // FIX-D: bounded by `SILENT_IFRAME_TIMEOUT` (plus `iframe.onerror`
           // fail-fast in core) so a no-message iframe cannot stall cold boot.
           id: 'silent-iframe',
-          enabled: () => !storedSessionRestored && isWebBrowser(),
+          enabled: () => !storedSessionRestored && !silentRestoreBlocked && isWebBrowser(),
           run: async () => {
             if (!commitWebSession) {
               return {
@@ -1278,8 +1364,20 @@ export const OxyProvider = ({
           // is correct; cross-domain restore is handled by the SSO bounce.
           // FIX-D: `restoreViaRefreshCookie` bounds the request with
           // `COOKIE_RESTORE_TIMEOUT` so a cross-domain stall cannot hang here.
+          //
+          // Disabled when `prioritizeMultiAccount` already ran the
+          // `cookie-restore-active` step above (an explicit persisted slot) — that
+          // earlier step is the identical restore, so this terminal-tier copy
+          // would be a redundant second `refreshAllSessions`. It still runs in the
+          // common no-persisted-slot case (e.g. first visit to a first-party app
+          // whose central refresh cookies already exist).
+          //
+          // SIGNED-OUT GATE (same rationale as `cookie-restore-active`): the
+          // primary's `oxy_rt` slot survives a deliberate sign-out (PR #455), so
+          // this must be skipped while the signed-out flag is set or it would
+          // silently re-restore the primary on reload.
           id: 'cookie-restore',
-          enabled: () => isWebBrowser(),
+          enabled: () => isWebBrowser() && !prioritizeMultiAccount && !silentRestoreBlocked,
           run: async () => {
             const restored = await restoreViaRefreshCookie();
             return restored ? {
@@ -1519,13 +1617,48 @@ export const OxyProvider = ({
       throw new Error('Session response did not include an access token');
     }
     oxyServices.httpService.setTokens(session.accessToken);
+
+    // A committed web session re-enables automatic silent restore: clear the
+    // durable "deliberately signed out" flag. This funnel is reached by deliberate
+    // sign-ins (password, interactive FedCM, `/sso` return) AND by the silent
+    // cold-boot steps — but those are GATED on the flag, so when it is set they
+    // never run and never reach here; clearing is therefore only hit on a genuine
+    // (re-)sign-in or when restore was already permitted, both correct.
+    clearSignedOut();
+
+    // Register this primary session in the device's first-party multi-account
+    // refresh-cookie set (web only). Every web primary-session restore funnels
+    // through here — FedCM silent (`/fedcm/exchange`), per-apex `/auth/silent`
+    // iframe, central `/sso` return, and keyless password sign-in. Of those, only
+    // a same-apex `/fedcm/exchange` plants an `oxy_rt_<authuser>` slot as a side
+    // effect; the cross-origin/credential-less restores (`/sso/exchange`,
+    // `/auth/silent` postMessage) cannot set an `api.oxy.so` cookie at all. So
+    // WITHOUT this call a web primary never joins the device set: `refresh-all`
+    // returns zero accounts, and account-switch persistence + the
+    // `cookie-restore-active` cold-boot step have no foundation. Calling the shared
+    // `POST /auth/session` primitive here makes EVERY primary participate in the
+    // set, re-plants the rotated token, and records the active `authuser` so the
+    // next cold boot's `cookie-restore-active` reconciles the persisted active
+    // (possibly switched) account instead of `fedcm-silent` clobbering it back to
+    // the primary. Best-effort: a `null` result (native / transient failure)
+    // leaves the in-session token untouched.
+    const primaryAuthuser = await oxyServices.establishDeviceRefreshSlot();
+    // A non-null slot is returned ONLY on first-party web (the helper gates on
+    // platform + same registrable apex), so recording the active slot here is safe
+    // and never writes a phantom authuser for a cross-apex RP or native.
+    if (typeof primaryAuthuser === 'number') {
+      writeActiveAuthuser(primaryAuthuser);
+    }
     const clientSession = {
       sessionId: session.sessionId,
       deviceId: session.deviceId || '',
       expiresAt: session.expiresAt || new Date(Date.now() + DEFAULT_SESSION_VALIDITY_MS).toISOString(),
       lastActive: new Date().toISOString(),
       userId: session.user.id?.toString() ?? '',
-      isCurrent: true
+      isCurrent: true,
+      ...(typeof primaryAuthuser === 'number' ? {
+        authuser: primaryAuthuser
+      } : null)
     };
     updateSessions([clientSession], {
       merge: true
@@ -1760,42 +1893,8 @@ export const OxyProvider = ({
   });
 
   // --- Account graph state ---
-  const [actingAs, setActingAsState] = useState(null);
   const [accounts, setAccounts] = useState([]);
 
-  // Latest `actingAs`, mirrored into a ref so `refreshAccounts` can reconcile a
-  // stale switch without taking `actingAs` as a dependency (which would re-run
-  // the account load on every switch). See the reconciliation block below.
-  const actingAsRef = useRef(actingAs);
-  actingAsRef.current = actingAs;
-  // `setActingAs` is declared after `refreshAccounts`; route the reconciliation
-  // clear through a ref so the load callback can call the latest implementation.
-  const setActingAsRef = useRef(null);
-
-  // Restore actingAs from storage on startup
-  useEffect(() => {
-    if (!storage || !initialized) return;
-    let mounted = true;
-    (async () => {
-      try {
-        const stored = await storage.getItem(`${storageKeyPrefix}_acting_as`);
-        if (mounted && stored) {
-          setActingAsState(stored);
-          oxyServices.setActingAs(stored);
-        }
-      } catch (err) {
-        if (__DEV__) {
-          loggerUtil.debug('Failed to restore actingAs from storage', {
-            component: 'OxyContext'
-          }, err);
-        }
-      }
-    })();
-    return () => {
-      mounted = false;
-    };
-  }, [storage, initialized, storageKeyPrefix, oxyServices]);
-
   // Load the unified account graph when authenticated
   const refreshAccounts = useCallback(async () => {
     if (!isAuthenticated || !tokenReady || !oxyServices.getAccessToken()) {
@@ -1805,15 +1904,6 @@ export const OxyProvider = ({
     try {
       const list = await oxyServices.listAccounts();
       setAccounts(list);
-      // Reconcile a stale switch: if the active account was switched INTO an id
-      // that is no longer accessible (account removed/archived, or it belonged
-      // to a now-inactive sign-in), drop back to the personal account so the
-      // app never keeps sending a dead `X-Acting-As` header. `list` is the
-      // authoritative accessible set on a successful fetch.
-      const current = actingAsRef.current;
-      if (current && !list.some(node => node.accountId === current)) {
-        setActingAsRef.current?.(null);
-      }
     } catch (err) {
       if (isUnauthorizedStatus(err)) {
         setAccounts([]);
@@ -1832,48 +1922,76 @@ export const OxyProvider = ({
       refreshAccounts();
     }
   }, [isAuthenticated, initialized, tokenReady, refreshAccounts]);
-  const setActingAs = useCallback(accountId => {
-    oxyServices.setActingAs(accountId);
-    setActingAsState(accountId);
-    // Switching the acting-as identity changes every server response, but React
-    // Query keys are not namespaced by the acting-as target, so the cache would
-    // otherwise keep serving the previous account's data. Invalidate everything
-    // so each query refetches under the new identity (the next request carries
-    // the updated `X-Acting-As` header). `invalidateQueries` (not `clear`) keeps
-    // the account list/switcher populated mid-switch instead of blanking out.
-    queryClient.invalidateQueries();
-    // Persist to storage
-    if (storage) {
-      if (accountId) {
-        storage.setItem(`${storageKeyPrefix}_acting_as`, accountId).catch(persistError => {
-          loggerUtil.debug('Failed to persist acting-as account', {
-            component: 'OxyContext'
-          }, persistError);
-        });
-      } else {
-        storage.removeItem(`${storageKeyPrefix}_acting_as`).catch(persistError => {
-          loggerUtil.debug('Failed to clear acting-as account', {
-            component: 'OxyContext'
-          }, persistError);
-        });
+
+  // Switch the active session INTO an account from the unified graph. In the
+  // REAL-SESSION model this is identical to switching device sign-ins: mint a
+  // real session for the target and make the whole app that account. The removed
+  // `X-Acting-As` delegation header is gone — `oxyServices.switchToAccount`
+  // plants the minted access token (the refresh token is the server-set httpOnly
+  // `oxy_rt_<authuser>` cookie, so the session joins the device multi-account set
+  // and survives reload / `refresh-all`). We then commit the session into context
+  // state the SAME way sign-in / `switchSession` do, refresh the account graph,
+  // and invalidate every query so all data reloads as the new account.
+  const switchToAccount = useCallback(async accountId => {
+    const result = await oxyServices.switchToAccount(accountId);
+    if (!result?.user || !result?.sessionId) {
+      throw new Error('Account switch did not return a valid session');
+    }
+
+    // A switch is a deliberate sign-in into an account: re-enable automatic silent
+    // restore by clearing any prior "deliberately signed out" flag.
+    clearSignedOut();
+
+    // `oxyServices.switchToAccount` already planted `result.accessToken` as the
+    // active token; mirror the minted session into the multi-account store and
+    // mark it current, recording the device `authuser` slot so web silent-switch
+    // and the device account chooser can address it.
+    const now = new Date();
+    const clientSession = {
+      sessionId: result.sessionId,
+      deviceId: result.deviceId || '',
+      expiresAt: result.expiresAt || new Date(now.getTime() + DEFAULT_SESSION_VALIDITY_MS).toISOString(),
+      lastActive: now.toISOString(),
+      userId: result.user.id?.toString() ?? '',
+      isCurrent: true,
+      ...(typeof result.authuser === 'number' ? {
+        authuser: result.authuser
+      } : null)
+    };
+    updateSessions([clientSession], {
+      merge: true
+    });
+    setActiveSessionId(result.sessionId);
+    if (isWebBrowser() && typeof result.authuser === 'number') {
+      writeActiveAuthuser(result.authuser);
+    }
+    await persistSessionDurably(result.sessionId);
+
+    // Fetch the canonical User for the new account (the switch result carries
+    // only MinimalUserData); fall back to that minimal shape if the profile
+    // fetch fails so the app still reflects the switched identity.
+    let fullUser;
+    try {
+      fullUser = await oxyServices.getCurrentUser();
+    } catch (profileError) {
+      if (__DEV__) {
+        loggerUtil.debug('Failed to fetch full user after account switch; using switch result user', {
+          component: 'OxyContext',
+          method: 'switchToAccount'
+        }, profileError);
       }
+      fullUser = result.user;
     }
-  }, [oxyServices, storage, storageKeyPrefix, queryClient]);
-  setActingAsRef.current = setActingAs;
-
-  // The account switched into, resolved from the loaded graph.
-  const actingAsAccount = useMemo(() => {
-    if (!actingAs) return null;
-    return accounts.find(node => node.accountId === actingAs) ?? null;
-  }, [actingAs, accounts]);
-
-  // The effective ACTIVE account presented across the app: the switched-into
-  // account's user when a switch is set and resolved, otherwise the signed-in
-  // user's own personal account. Derived (no effect) so identity surfaces always
-  // render the current account without separate syncing. Falls back to `user`
-  // while a just-set switch has not yet resolved in `accounts`, so the header
-  // never flashes empty mid-switch.
-  const activeAccount = useMemo(() => actingAs && actingAsAccount ? actingAsAccount.account : user, [actingAs, actingAsAccount, user]);
+    loginSuccess(fullUser);
+    onAuthStateChange?.(fullUser);
+
+    // Reload the switchable account graph (the new active account's relationships
+    // differ) and invalidate every query so all data refetches as the new
+    // account — the deviceAccounts probe re-enumerates the multi-account set so
+    // the switched account now appears as a device session.
+    await refreshAccounts();
+    queryClient.invalidateQueries();
+  }, [oxyServices, updateSessions, setActiveSessionId, persistSessionDurably, loginSuccess, onAuthStateChange, refreshAccounts, queryClient]);
   const createAccountFn = useCallback(async data => {
     const account = await oxyServices.createAccount(data);
     await refreshAccounts();
@@ -1920,14 +2038,11 @@ export const OxyProvider = ({
     useFollow: useFollowHook,
     showBottomSheet: showBottomSheetForContext,
     openAvatarPicker,
-    actingAs,
     accounts,
-    actingAsAccount,
-    activeAccount,
-    setActingAs,
+    switchToAccount,
     refreshAccounts,
     createAccount: createAccountFn
-  }), [activeSessionId, signIn, signInWithPassword, handleWebSSOSession, currentLanguage, currentLanguageMetadata, currentLanguageName, currentNativeLanguageName, error, getDeviceSessions, hasAccessToken, canUsePrivateApi, isPrivateApiPending, getPublicKey, hasIdentity, isAuthenticated, isLoading, logout, logoutAll, logoutAllDeviceSessions, oxyServices, storageKeyPrefix, clientId, refreshSessionsWithUser, sessions, setLanguage, storage, switchSessionForContext, tokenReady, hasAccessToken, canUsePrivateApi, isPrivateApiPending, authResolved, updateDeviceName, clearAllAccountData, useFollowHook, user, showBottomSheetForContext, openAvatarPicker, actingAs, accounts, actingAsAccount, activeAccount, setActingAs, refreshAccounts, createAccountFn]);
+  }), [activeSessionId, signIn, signInWithPassword, handleWebSSOSession, currentLanguage, currentLanguageMetadata, currentLanguageName, currentNativeLanguageName, error, getDeviceSessions, hasAccessToken, canUsePrivateApi, isPrivateApiPending, getPublicKey, hasIdentity, isAuthenticated, isLoading, logout, logoutAll, logoutAllDeviceSessions, oxyServices, storageKeyPrefix, clientId, refreshSessionsWithUser, sessions, setLanguage, storage, switchSessionForContext, tokenReady, hasAccessToken, canUsePrivateApi, isPrivateApiPending, authResolved, updateDeviceName, clearAllAccountData, useFollowHook, user, showBottomSheetForContext, openAvatarPicker, accounts, switchToAccount, refreshAccounts, createAccountFn]);
   return /*#__PURE__*/_jsx(OxyContext.Provider, {
     value: contextValue,
     children: ssoCallbackIntercepting ? null : children
@@ -1986,11 +2101,8 @@ const LOADING_STATE = {
   clientId: null,
   oxyServices: LOADING_STATE_OXY_SERVICES,
   openAvatarPicker: () => {},
-  actingAs: null,
   accounts: [],
-  actingAsAccount: null,
-  activeAccount: null,
-  setActingAs: () => {},
+  switchToAccount: () => rejectMissingProvider(),
   refreshAccounts: () => rejectMissingProvider(),
   createAccount: () => rejectMissingProvider()
 };