@oxyhq/services 13.1.2 → 13.1.3

package/src/ui/context/OxyContext.tsx

@@ -1334,16 +1334,27 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     // to the cross-domain fallbacks exactly as before.
     const prioritizeMultiAccount = isWebBrowser() && readActiveAuthuser() !== null;
 
-    // DELIBERATELY-SIGNED-OUT gate (web): when the user pressed "Sign out", the
-    // central IdP session (FedCM credential association / per-apex `fedcm_session`
-    // cookie) can still be live, so the AUTOMATIC silent steps below
-    // (`fedcm-silent`, `silent-iframe`) would re-mint a session on the very next
-    // cold boot and sign the user back in without intent. Read the durable flag
-    // ONCE here (synchronously usable by the step `enabled` gates) and skip those
-    // two steps while it is set. Any deliberate sign-in clears it. The `sso-bounce`
-    // step is already self-suppressed after sign-out (its `hasPriorSession` hint is
-    // cleared), and the local restore steps (`stored-session`, cookie-restore) are
-    // unaffected — a deliberate sign-out clears those credentials anyway.
+    // DELIBERATELY-SIGNED-OUT gate (web): when the user pressed "Sign out", any
+    // credential that can silently re-mint a session may still be live on the
+    // next reload — the central IdP session (FedCM credential association /
+    // per-apex `fedcm_session` cookie) AND the device refresh cookies. Since
+    // PR #455 the PRIMARY web session also joins the `oxy_rt_<authuser>` device
+    // set, so the un-gated cookie-restore steps would `refresh-all` that still-
+    // present cookie and sign the user back in without intent — exactly the
+    // "sign-out is silently undone" regression. So this flag gates EVERY
+    // AUTOMATIC silent-restore cold-boot step: `stored-session`,
+    // `cookie-restore-active`, `fedcm-silent`, `silent-iframe`, and
+    // `cookie-restore`. The gate — not a cookie wipe — is the authority: the
+    // account may stay "known" for a fast deliberate re-sign-in, but no step
+    // restores it silently while the flag is set. Read the durable flag ONCE here
+    // (synchronously usable by every step `enabled` gate). Any deliberate sign-in
+    // (password, FedCM, account switch, device claim) clears it, so there is no
+    // "stuck signed out" state. The `sso-bounce` step needs no extra gate: it is
+    // already self-suppressed after sign-out (its `hasPriorSession` hint is
+    // cleared). `sso-return` is NOT gated — it commits the result of a deliberate
+    // top-level `/sso` bounce the user just initiated. `shared-key-signin` is
+    // native-only and the flag never sets on native (`markSignedOut` no-ops
+    // off-web), so its gate would be moot; it is left untouched.
     const silentRestoreBlocked = isSilentRestoreSuppressed();
 
     try {
@@ -1363,12 +1374,17 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
             },
           },
           {
-            // 2) Stored-session bearer restore. NO `enabled` gate — runs on ALL
-            // platforms. This is native's ONLY restore path (every web-only step
-            // is disabled off-browser, so native reaches exactly this) AND the
-            // common WEB reload winner.
+            // 2) Stored-session bearer restore. Runs on ALL platforms EXCEPT when
+            // the deliberately-signed-out flag is set (web only — it never sets on
+            // native, so native still always reaches exactly this step, its ONLY
+            // restore path). This is also the common WEB reload winner.
             //
-            // ORDERING (FIX A): this step now runs BEFORE the slow web-only
+            // SIGNED-OUT GATE: after a deliberate full sign-out the stored session
+            // state is cleared, so this would normally skip anyway — but the gate
+            // makes that authoritative rather than incidental, so no residual
+            // stored token can silently restore while the user is signed out.
+            //
+            // ORDERING (FIX A): this step runs BEFORE the slow web-only
             // probes (`fedcm-silent`, `silent-iframe`, `cookie-restore`). On a
             // normal reload the local bearer validates in one round-trip and
             // wins; `runColdBoot` then short-circuits and never even evaluates
@@ -1379,6 +1395,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
             // local session this step skips and the cross-domain fallback chain
             // (fedcm → iframe → cookie → sso-bounce) runs exactly as before.
             id: 'stored-session',
+            enabled: () => !silentRestoreBlocked,
             run: async () => {
               const restored = await restoreStoredSession();
               if (restored) {
@@ -1455,8 +1472,14 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
             // When no slot is persisted this is disabled and the original order is
             // unchanged; when the slot's cookies have lapsed it returns no accounts
             // and the chain falls through to the cross-domain fallbacks below.
+            //
+            // SIGNED-OUT GATE: since PR #455 the primary's `oxy_rt` slot survives a
+            // deliberate sign-out, so without this gate `refresh-all` would re-mint
+            // and silently re-log-in the user on reload. The flag is cleared by any
+            // deliberate sign-in (including an account SWITCH, which also writes the
+            // new active slot), so the switch-survives-reload path is unaffected.
             id: 'cookie-restore-active',
-            enabled: () => prioritizeMultiAccount,
+            enabled: () => prioritizeMultiAccount && !silentRestoreBlocked,
             run: async () => {
               const restored = await restoreViaRefreshCookie();
               return restored ? { kind: 'session', session: true } : { kind: 'skip' };
@@ -1546,8 +1569,13 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
             // would be a redundant second `refreshAllSessions`. It still runs in the
             // common no-persisted-slot case (e.g. first visit to a first-party app
             // whose central refresh cookies already exist).
+            //
+            // SIGNED-OUT GATE (same rationale as `cookie-restore-active`): the
+            // primary's `oxy_rt` slot survives a deliberate sign-out (PR #455), so
+            // this must be skipped while the signed-out flag is set or it would
+            // silently re-restore the primary on reload.
             id: 'cookie-restore',
-            enabled: () => isWebBrowser() && !prioritizeMultiAccount,
+            enabled: () => isWebBrowser() && !prioritizeMultiAccount && !silentRestoreBlocked,
             run: async () => {
               const restored = await restoreViaRefreshCookie();
               return restored ? { kind: 'session', session: true } : { kind: 'skip' };

package/src/ui/screens/NotificationsScreen.tsx

@@ -159,7 +159,7 @@ const NotificationsScreen: React.FC<BaseScreenProps> = ({ onClose, goBack }) =>
                         <SettingsListItem
                             icon={
                                 <SettingsIcon
-                                    name="megaphone"
+                                    name="bullhorn"
                                     color={bloomTheme.colors.secondary}
                                 />
                             }

package/src/ui/utils/__tests__/activeAuthuser.test.ts

@@ -0,0 +1,75 @@
+/**
+ * Fail-safe guarantees for the web `activeAuthuser` storage helpers.
+ *
+ * The PROPERTY ACCESS `window.localStorage` can throw a `SecurityError`
+ * synchronously in opaque-origin / sandboxed iframes or when storage is
+ * disabled — not just `getItem`/`setItem`. These helpers run during cold boot
+ * (and feed render-phase gate values in the providers), so they MUST never
+ * propagate that throw: reads fail safe to a benign default and writes no-op.
+ */
+
+import {
+  readActiveAuthuser,
+  writeActiveAuthuser,
+  clearActiveAuthuser,
+  markSignedOut,
+  clearSignedOut,
+  isSilentRestoreSuppressed,
+} from '../activeAuthuser';
+
+describe('activeAuthuser helpers — localStorage fail-safe', () => {
+  const realDescriptor = Object.getOwnPropertyDescriptor(window, 'localStorage');
+
+  afterEach(() => {
+    if (realDescriptor) {
+      Object.defineProperty(window, 'localStorage', realDescriptor);
+    }
+    window.localStorage?.clear?.();
+  });
+
+  /** Replace the `localStorage` accessor so reading the property throws. */
+  function makeLocalStorageGetterThrow(): void {
+    Object.defineProperty(window, 'localStorage', {
+      configurable: true,
+      get() {
+        throw new DOMException('denied', 'SecurityError');
+      },
+    });
+  }
+
+  it('readActiveAuthuser returns null (never throws) when the getter throws', () => {
+    makeLocalStorageGetterThrow();
+    expect(() => readActiveAuthuser()).not.toThrow();
+    expect(readActiveAuthuser()).toBeNull();
+  });
+
+  it('isSilentRestoreSuppressed returns false (never throws) when the getter throws', () => {
+    makeLocalStorageGetterThrow();
+    expect(() => isSilentRestoreSuppressed()).not.toThrow();
+    expect(isSilentRestoreSuppressed()).toBe(false);
+  });
+
+  it('writeActiveAuthuser / clearActiveAuthuser / markSignedOut / clearSignedOut no-op when the getter throws', () => {
+    makeLocalStorageGetterThrow();
+    expect(() => {
+      writeActiveAuthuser(2);
+      clearActiveAuthuser();
+      markSignedOut();
+      clearSignedOut();
+    }).not.toThrow();
+  });
+
+  it('round-trips normally when storage works (zero behavior change)', () => {
+    writeActiveAuthuser(3);
+    expect(readActiveAuthuser()).toBe(3);
+
+    expect(isSilentRestoreSuppressed()).toBe(false);
+    markSignedOut();
+    expect(isSilentRestoreSuppressed()).toBe(true);
+    clearSignedOut();
+    expect(isSilentRestoreSuppressed()).toBe(false);
+
+    clearActiveAuthuser();
+    expect(readActiveAuthuser()).toBeNull();
+  });
+});

package/src/ui/utils/activeAuthuser.ts

@@ -30,8 +30,22 @@ import {
 
 const ACTIVE_AUTHUSER_KEY = 'oxy_active_authuser';
 
-function hasLocalStorage(): boolean {
-  return typeof window !== 'undefined' && typeof window.localStorage !== 'undefined';
+/**
+ * Safely resolve `window.localStorage`, returning `null` when it is
+ * unavailable. The PROPERTY ACCESS itself (`window.localStorage`) can throw a
+ * `SecurityError` synchronously in opaque-origin / sandboxed iframes or when
+ * storage is disabled — even `typeof window.localStorage` evaluates the getter
+ * and throws. Every read/write in this module routes through here so the getter
+ * throw is caught once, at the source, and callers stay clean. Returns `null`
+ * off-web and on any access failure (fail safe).
+ */
+function getLocalStorage(): Storage | null {
+  if (typeof window === 'undefined') return null;
+  try {
+    return window.localStorage ?? null;
+  } catch {
+    return null;
+  }
 }
 
 function getSessionStorage(): Storage | null {
@@ -51,11 +65,12 @@ function getSessionStorage(): Storage | null {
  * fall back to deterministic selection (lowest authuser).
  */
 export function readActiveAuthuser(): number | null {
-  if (!hasLocalStorage()) {
+  const storage = getLocalStorage();
+  if (!storage) {
     return null;
   }
   try {
-    const raw = window.localStorage.getItem(ACTIVE_AUTHUSER_KEY);
+    const raw = storage.getItem(ACTIVE_AUTHUSER_KEY);
     if (raw === null) return null;
     const parsed = Number.parseInt(raw, 10);
     if (!Number.isFinite(parsed) || parsed < 0) return null;
@@ -71,10 +86,11 @@ export function readActiveAuthuser(): number | null {
  * this succeeding — it is best-effort UX persistence, not authoritative.
  */
 export function writeActiveAuthuser(authuser: number): void {
-  if (!hasLocalStorage()) return;
   if (!Number.isFinite(authuser) || authuser < 0) return;
+  const storage = getLocalStorage();
+  if (!storage) return;
   try {
-    window.localStorage.setItem(ACTIVE_AUTHUSER_KEY, String(authuser));
+    storage.setItem(ACTIVE_AUTHUSER_KEY, String(authuser));
   } catch {
     // Best-effort persistence; swallow QuotaExceededError / SecurityError.
   }
@@ -86,9 +102,10 @@ export function writeActiveAuthuser(authuser: number): void {
  * cleared slot.
  */
 export function clearActiveAuthuser(): void {
-  if (!hasLocalStorage()) return;
+  const storage = getLocalStorage();
+  if (!storage) return;
   try {
-    window.localStorage.removeItem(ACTIVE_AUTHUSER_KEY);
+    storage.removeItem(ACTIVE_AUTHUSER_KEY);
   } catch {
     // Best-effort.
   }
@@ -103,9 +120,10 @@ export function clearActiveAuthuser(): void {
  * failure (best-effort).
  */
 export function markSignedOut(): void {
-  if (!hasLocalStorage()) return;
+  const storage = getLocalStorage();
+  if (!storage) return;
   try {
-    window.localStorage.setItem(ssoSignedOutKey(window.location.origin), '1');
+    storage.setItem(ssoSignedOutKey(window.location.origin), '1');
   } catch {
     // Best-effort; swallow QuotaExceededError / SecurityError (private mode).
   }
@@ -118,9 +136,10 @@ export function markSignedOut(): void {
  * state. No-ops on native / storage failure.
  */
 export function clearSignedOut(): void {
-  if (!hasLocalStorage()) return;
+  const storage = getLocalStorage();
+  if (!storage) return;
   try {
-    window.localStorage.removeItem(ssoSignedOutKey(window.location.origin));
+    storage.removeItem(ssoSignedOutKey(window.location.origin));
   } catch {
     // Best-effort.
   }
@@ -134,8 +153,9 @@ export function clearSignedOut(): void {
  * `fedcm-silent` and `silent-iframe` cold-boot steps.
  */
 export function isSilentRestoreSuppressed(): boolean {
-  if (!hasLocalStorage()) return false;
-  return silentRestoreSuppressed(window.localStorage, window.location.origin);
+  const storage = getLocalStorage();
+  if (!storage) return false;
+  return silentRestoreSuppressed(storage, window.location.origin);
 }
 
 /**