@oxyhq/services 13.0.3 → 13.1.0

package/src/ui/context/hooks/useAuthOperations.ts

@@ -9,7 +9,13 @@ import type { StorageInterface } from '../../utils/storageHelpers';
 import type { OxyServices } from '@oxyhq/core';
 import { SignatureService } from '@oxyhq/core';
 import { isWebBrowser } from '../../hooks/useWebSSO';
-import { clearActiveAuthuser, clearSsoBounceState } from '../../utils/activeAuthuser';
+import {
+  clearActiveAuthuser,
+  clearSsoBounceState,
+  writeActiveAuthuser,
+  markSignedOut,
+  clearSignedOut,
+} from '../../utils/activeAuthuser';
 import { isCrossApexWeb, CrossApexDirectSignInError } from '../../../utils/crossApex';
 
 export interface UseAuthOperationsOptions {
@@ -133,6 +139,23 @@ export const useAuthOperations = ({
         deviceFingerprint,
       );
 
+      // Deliberate sign-in re-enables automatic silent restore: clear the durable
+      // "deliberately signed out" flag so a prior sign-out no longer suppresses
+      // the `fedcm-silent` / per-apex iframe cold-boot steps.
+      clearSignedOut();
+
+      // Register this primary session in the device's first-party multi-account
+      // refresh-cookie set so a web key-based sign-in survives reload via
+      // `refresh-all` and coexists with switched accounts. `/auth/verify` mints the
+      // session but (unlike `/auth/login` / `/fedcm/exchange`) does NOT plant an
+      // `oxy_rt_<authuser>` slot, so we establish it here through the shared
+      // `POST /auth/session` primitive. No-op on native and cross-apex (returns
+      // `null`); records the active slot when one is genuinely allocated.
+      const verifyAuthuser = await oxyServices.establishDeviceRefreshSlot();
+      if (typeof verifyAuthuser === 'number') {
+        writeActiveAuthuser(verifyAuthuser);
+      }
+
       // Get full user data
       fullUser = await oxyServices.getUserBySession(sessionResponse.sessionId);
 
@@ -260,7 +283,14 @@ export const useAuthOperations = ({
             await switchSession(filteredSessions[0].sessionId);
           } else {
             // Genuine FULL sign-out (no sessions remain): clear the per-origin
-            // SSO bounce state so a fresh deliberate sign-in can re-probe.
+            // SSO bounce state so a fresh deliberate sign-in can re-probe, drop
+            // the persisted active device slot so the next cold boot does not
+            // prioritize a now-signed-out `oxy_active_authuser`, and SET the
+            // deliberately-signed-out flag so the silent cold-boot steps
+            // (`fedcm-silent` / per-apex iframe) do not re-mint a session from a
+            // still-live IdP session on the next reload (mirrors `logoutAll`).
+            markSignedOut();
+            clearActiveAuthuser();
             clearSsoBounceState();
             clearPriorSessionHintSafe(clearPriorSessionHint, logger);
             await clearSessionState();
@@ -322,6 +352,9 @@ export const useAuthOperations = ({
       if (isWebBrowser()) {
         await oxyServices.logoutAllSessionsViaCookie();
         clearActiveAuthuser();
+        // Deliberate full sign-out: suppress automatic silent restore on the next
+        // cold boot so a still-live IdP session does not re-mint a session.
+        markSignedOut();
       }
       // logoutAll is ALWAYS a full sign-out: clear the per-origin SSO bounce
       // state (web-guarded internally) so a fresh sign-in can re-probe, and drop

package/src/ui/index.ts

@@ -27,6 +27,8 @@ export { FontLoader, setupFonts } from './components/FontLoader';
 export { default as OxyIcon } from './components/icon/OxyIcon';
 export { default as AccountMenu } from './components/AccountMenu';
 export { default as AccountMenuButton } from './components/AccountMenuButton';
+export { default as ProfileButton } from './components/ProfileButton';
+export { default as ProfileMenu } from './components/ProfileMenu';
 export { default as AccountSwitcher, AccountSwitcherView } from './components/AccountSwitcher';
 
 // Context + hooks

package/src/ui/utils/__tests__/activeAuthuser.test.ts

@@ -0,0 +1,75 @@
+/**
+ * Fail-safe guarantees for the web `activeAuthuser` storage helpers.
+ *
+ * The PROPERTY ACCESS `window.localStorage` can throw a `SecurityError`
+ * synchronously in opaque-origin / sandboxed iframes or when storage is
+ * disabled — not just `getItem`/`setItem`. These helpers run during cold boot
+ * (and feed render-phase gate values in the providers), so they MUST never
+ * propagate that throw: reads fail safe to a benign default and writes no-op.
+ */
+
+import {
+  readActiveAuthuser,
+  writeActiveAuthuser,
+  clearActiveAuthuser,
+  markSignedOut,
+  clearSignedOut,
+  isSilentRestoreSuppressed,
+} from '../activeAuthuser';
+
+describe('activeAuthuser helpers — localStorage fail-safe', () => {
+  const realDescriptor = Object.getOwnPropertyDescriptor(window, 'localStorage');
+
+  afterEach(() => {
+    if (realDescriptor) {
+      Object.defineProperty(window, 'localStorage', realDescriptor);
+    }
+    window.localStorage?.clear?.();
+  });
+
+  /** Replace the `localStorage` accessor so reading the property throws. */
+  function makeLocalStorageGetterThrow(): void {
+    Object.defineProperty(window, 'localStorage', {
+      configurable: true,
+      get() {
+        throw new DOMException('denied', 'SecurityError');
+      },
+    });
+  }
+
+  it('readActiveAuthuser returns null (never throws) when the getter throws', () => {
+    makeLocalStorageGetterThrow();
+    expect(() => readActiveAuthuser()).not.toThrow();
+    expect(readActiveAuthuser()).toBeNull();
+  });
+
+  it('isSilentRestoreSuppressed returns false (never throws) when the getter throws', () => {
+    makeLocalStorageGetterThrow();
+    expect(() => isSilentRestoreSuppressed()).not.toThrow();
+    expect(isSilentRestoreSuppressed()).toBe(false);
+  });
+
+  it('writeActiveAuthuser / clearActiveAuthuser / markSignedOut / clearSignedOut no-op when the getter throws', () => {
+    makeLocalStorageGetterThrow();
+    expect(() => {
+      writeActiveAuthuser(2);
+      clearActiveAuthuser();
+      markSignedOut();
+      clearSignedOut();
+    }).not.toThrow();
+  });
+
+  it('round-trips normally when storage works (zero behavior change)', () => {
+    writeActiveAuthuser(3);
+    expect(readActiveAuthuser()).toBe(3);
+
+    expect(isSilentRestoreSuppressed()).toBe(false);
+    markSignedOut();
+    expect(isSilentRestoreSuppressed()).toBe(true);
+    clearSignedOut();
+    expect(isSilentRestoreSuppressed()).toBe(false);
+
+    clearActiveAuthuser();
+    expect(readActiveAuthuser()).toBeNull();
+  });
+});

package/src/ui/utils/activeAuthuser.ts

@@ -24,12 +24,28 @@ import {
   ssoGuardKey,
   ssoStateKey,
   ssoDestKey,
+  ssoSignedOutKey,
+  silentRestoreSuppressed,
 } from '@oxyhq/core';
 
 const ACTIVE_AUTHUSER_KEY = 'oxy_active_authuser';
 
-function hasLocalStorage(): boolean {
-  return typeof window !== 'undefined' && typeof window.localStorage !== 'undefined';
+/**
+ * Safely resolve `window.localStorage`, returning `null` when it is
+ * unavailable. The PROPERTY ACCESS itself (`window.localStorage`) can throw a
+ * `SecurityError` synchronously in opaque-origin / sandboxed iframes or when
+ * storage is disabled — even `typeof window.localStorage` evaluates the getter
+ * and throws. Every read/write in this module routes through here so the getter
+ * throw is caught once, at the source, and callers stay clean. Returns `null`
+ * off-web and on any access failure (fail safe).
+ */
+function getLocalStorage(): Storage | null {
+  if (typeof window === 'undefined') return null;
+  try {
+    return window.localStorage ?? null;
+  } catch {
+    return null;
+  }
 }
 
 function getSessionStorage(): Storage | null {
@@ -49,11 +65,12 @@ function getSessionStorage(): Storage | null {
  * fall back to deterministic selection (lowest authuser).
  */
 export function readActiveAuthuser(): number | null {
-  if (!hasLocalStorage()) {
+  const storage = getLocalStorage();
+  if (!storage) {
     return null;
   }
   try {
-    const raw = window.localStorage.getItem(ACTIVE_AUTHUSER_KEY);
+    const raw = storage.getItem(ACTIVE_AUTHUSER_KEY);
     if (raw === null) return null;
     const parsed = Number.parseInt(raw, 10);
     if (!Number.isFinite(parsed) || parsed < 0) return null;
@@ -69,10 +86,11 @@ export function readActiveAuthuser(): number | null {
  * this succeeding — it is best-effort UX persistence, not authoritative.
  */
 export function writeActiveAuthuser(authuser: number): void {
-  if (!hasLocalStorage()) return;
   if (!Number.isFinite(authuser) || authuser < 0) return;
+  const storage = getLocalStorage();
+  if (!storage) return;
   try {
-    window.localStorage.setItem(ACTIVE_AUTHUSER_KEY, String(authuser));
+    storage.setItem(ACTIVE_AUTHUSER_KEY, String(authuser));
   } catch {
     // Best-effort persistence; swallow QuotaExceededError / SecurityError.
   }
@@ -84,14 +102,62 @@ export function writeActiveAuthuser(authuser: number): void {
  * cleared slot.
  */
 export function clearActiveAuthuser(): void {
-  if (!hasLocalStorage()) return;
+  const storage = getLocalStorage();
+  if (!storage) return;
+  try {
+    storage.removeItem(ACTIVE_AUTHUSER_KEY);
+  } catch {
+    // Best-effort.
+  }
+}
+
+/**
+ * Mark this origin as DELIBERATELY signed out (durable `localStorage`, via the
+ * core {@link ssoSignedOutKey}). Called ONLY on EXPLICIT full sign-out so that
+ * the next cold boot does NOT silently re-mint a session from a still-live IdP
+ * session (`fedcm-silent` / per-apex `/auth/silent` iframe). Cleared by any
+ * deliberate sign-in (see {@link clearSignedOut}). No-ops on native / storage
+ * failure (best-effort).
+ */
+export function markSignedOut(): void {
+  const storage = getLocalStorage();
+  if (!storage) return;
   try {
-    window.localStorage.removeItem(ACTIVE_AUTHUSER_KEY);
+    storage.setItem(ssoSignedOutKey(window.location.origin), '1');
+  } catch {
+    // Best-effort; swallow QuotaExceededError / SecurityError (private mode).
+  }
+}
+
+/**
+ * Clear the durable deliberately-signed-out flag. Called on ANY deliberate
+ * sign-in (password, FedCM, account switch, device claim) so a real sign-in
+ * fully re-enables automatic silent restore — there is no "stuck signed out"
+ * state. No-ops on native / storage failure.
+ */
+export function clearSignedOut(): void {
+  const storage = getLocalStorage();
+  if (!storage) return;
+  try {
+    storage.removeItem(ssoSignedOutKey(window.location.origin));
   } catch {
     // Best-effort.
   }
 }
 
+/**
+ * Whether AUTOMATIC silent restore is suppressed for the current origin because
+ * the user deliberately signed out. Reads the durable flag through the core
+ * {@link silentRestoreSuppressed} predicate. Returns `false` off-web and on any
+ * storage failure (fail safe toward normal restore). Used to gate the
+ * `fedcm-silent` and `silent-iframe` cold-boot steps.
+ */
+export function isSilentRestoreSuppressed(): boolean {
+  const storage = getLocalStorage();
+  if (!storage) return false;
+  return silentRestoreSuppressed(storage, window.location.origin);
+}
+
 /**
  * Clear all per-origin SSO bounce sessionStorage keys. Called ONLY on EXPLICIT
  * user sign-out (logout / logoutAll) — never on a cold-boot failure path — so a