@oxyhq/services 13.3.0 → 14.0.0

package/src/ui/hooks/useSessionSocket.ts

@@ -1,233 +0,0 @@
-import { useEffect, useRef } from 'react';
-import io, { type Socket } from 'socket.io-client';
-import { toast } from '@oxyhq/bloom';
-import { logger } from '@oxyhq/core';
-import { createDebugLogger } from '@oxyhq/core';
-
-const debug = createDebugLogger('SessionSocket');
-
-/**
- * Server-emitted event types on the `session_update` channel.
- *
- * `session_removed`, `device_removed`, `sessions_removed` are the ONLY
- * events that may sign the user out. Anything else (e.g. `session_created`
- * fired right after a successful sign-in) MUST NOT trigger sign-out — see
- * the comment on the `default` branch below.
- */
-type SessionEventType =
-  | 'session_removed'
-  | 'device_removed'
-  | 'sessions_removed'
-  | 'session_created'
-  | 'session_update';
-
-interface SessionUpdatePayload {
-  type: SessionEventType | string;
-  sessionId?: string;
-  deviceId?: string;
-  sessionIds?: string[];
-}
-
-interface UseSessionSocketProps {
-  userId: string | null | undefined;
-  activeSessionId: string | null | undefined;
-  currentDeviceId: string | null | undefined;
-  refreshSessions: () => Promise<void>;
-  clearSessionState: () => Promise<void>;
-  baseURL: string;
-  getAccessToken: () => string | null;
-  onRemoteSignOut?: () => void;
-  onSessionRemoved?: (sessionId: string) => void;
-}
-
-export function useSessionSocket({
-  userId,
-  activeSessionId,
-  currentDeviceId,
-  refreshSessions,
-  clearSessionState,
-  baseURL,
-  getAccessToken,
-  onRemoteSignOut,
-  onSessionRemoved,
-}: UseSessionSocketProps) {
-  const socketRef = useRef<Socket | null>(null);
-
-  // Store callbacks in refs to avoid reconnecting when they change
-  const refreshSessionsRef = useRef(refreshSessions);
-  const clearSessionStateRef = useRef(clearSessionState);
-  const onRemoteSignOutRef = useRef(onRemoteSignOut);
-  const onSessionRemovedRef = useRef(onSessionRemoved);
-  const activeSessionIdRef = useRef(activeSessionId);
-  const currentDeviceIdRef = useRef(currentDeviceId);
-  const getAccessTokenRef = useRef(getAccessToken);
-
-  // Update refs when callbacks change
-  useEffect(() => {
-    refreshSessionsRef.current = refreshSessions;
-    clearSessionStateRef.current = clearSessionState;
-    onRemoteSignOutRef.current = onRemoteSignOut;
-    onSessionRemovedRef.current = onSessionRemoved;
-    activeSessionIdRef.current = activeSessionId;
-    currentDeviceIdRef.current = currentDeviceId;
-    getAccessTokenRef.current = getAccessToken;
-  }, [refreshSessions, clearSessionState, onRemoteSignOut, onSessionRemoved, activeSessionId, currentDeviceId, getAccessToken]);
-
-  useEffect(() => {
-    if (!userId || !baseURL) {
-      // Clean up if userId or baseURL becomes invalid
-      if (socketRef.current) {
-        socketRef.current.disconnect();
-        socketRef.current = null;
-      }
-      return;
-    }
-
-    // Disconnect previous socket if switching users
-    if (socketRef.current) {
-      socketRef.current.disconnect();
-      socketRef.current = null;
-    }
-
-    // Connect with auth token; use callback so reconnections get a fresh token
-    socketRef.current = io(baseURL, {
-      transports: ['websocket'],
-      auth: (cb) => {
-        const token = getAccessTokenRef.current();
-        cb({ token: token ?? '' });
-      },
-    });
-    const socket = socketRef.current;
-
-    // Server auto-joins the user to `user:<userId>` room on connection
-    const handleConnect = () => {
-      debug.log('Socket connected:', socket.id);
-    };
-
-    const refreshSessionsSafe = () => {
-      refreshSessionsRef.current().catch((error: unknown) => {
-        // Refresh errors shouldn't break the socket handler. They happen
-        // routinely when sessions are removed mid-fetch — log and move on.
-        if (__DEV__) {
-          logger.debug(
-            'Failed to refresh sessions after session_update',
-            { component: 'useSessionSocket' },
-            error,
-          );
-        }
-      });
-    };
-
-    const triggerLocalSignOut = async (toastMessage: string, errorContext: string) => {
-      if (onRemoteSignOutRef.current) {
-        onRemoteSignOutRef.current();
-      } else {
-        toast.info(toastMessage);
-      }
-      // Clear local state since the server has already removed the session.
-      // Await so storage cleanup completes before any subsequent navigation.
-      try {
-        await clearSessionStateRef.current();
-      } catch (error) {
-        if (__DEV__) {
-          logger.error(
-            `Failed to clear session state after ${errorContext}`,
-            error instanceof Error ? error : new Error(String(error)),
-            { component: 'useSessionSocket' },
-          );
-        }
-      }
-    };
-
-    const handleSessionUpdate = async (data: SessionUpdatePayload) => {
-      debug.log('Received session_update:', data);
-
-      const currentActiveSessionId = activeSessionIdRef.current;
-      const currentDeviceIdValue = currentDeviceIdRef.current;
-
-      // Strict whitelist. Every event type that may sign the user out must
-      // appear in the switch. Anything unknown falls through to `default`,
-      // which is intentionally a no-op for session lifecycle — it only logs
-      // in dev. This guards against future server-side event additions
-      // accidentally triggering sign-out.
-      switch (data.type) {
-        case 'session_removed': {
-          if (data.sessionId && onSessionRemovedRef.current) {
-            onSessionRemovedRef.current(data.sessionId);
-          }
-          if (data.sessionId && data.sessionId === currentActiveSessionId) {
-            await triggerLocalSignOut('You have been signed out remotely.', 'session_removed');
-          } else {
-            refreshSessionsSafe();
-          }
-          break;
-        }
-        case 'device_removed': {
-          if (data.sessionIds && onSessionRemovedRef.current) {
-            for (const sessionId of data.sessionIds) {
-              onSessionRemovedRef.current(sessionId);
-            }
-          }
-          if (data.deviceId && currentDeviceIdValue && data.deviceId === currentDeviceIdValue) {
-            await triggerLocalSignOut(
-              'This device has been removed. You have been signed out.',
-              'device_removed',
-            );
-          } else {
-            refreshSessionsSafe();
-          }
-          break;
-        }
-        case 'sessions_removed': {
-          if (data.sessionIds && onSessionRemovedRef.current) {
-            for (const sessionId of data.sessionIds) {
-              onSessionRemovedRef.current(sessionId);
-            }
-          }
-          if (
-            data.sessionIds &&
-            currentActiveSessionId &&
-            data.sessionIds.includes(currentActiveSessionId)
-          ) {
-            await triggerLocalSignOut('You have been signed out remotely.', 'sessions_removed');
-          } else {
-            refreshSessionsSafe();
-          }
-          break;
-        }
-        case 'session_created':
-        case 'session_update': {
-          // Lifecycle event for the current user. Just resync the sessions
-          // list — never sign out. A prior implementation compared
-          // `data.sessionId === currentActiveSessionId` and signed the user
-          // out if true, which was catastrophic: a
-          // `session_created` event fired immediately after a successful
-          // sign-in carries the user's NEW (now-active) session id, which
-          // matched and triggered an instant remote sign-out toast on every
-          // login. Whitelist explicitly; never fall through.
-          refreshSessionsSafe();
-          break;
-        }
-        default: {
-          if (__DEV__) {
-            logger.warn('Unknown session socket event type', {
-              component: 'useSessionSocket',
-              type: data.type,
-            });
-          }
-          break;
-        }
-      }
-    };
-
-    socket.on('connect', handleConnect);
-    socket.on('session_update', handleSessionUpdate);
-
-    return () => {
-      socket.off('connect', handleConnect);
-      socket.off('session_update', handleSessionUpdate);
-      socket.disconnect();
-      socketRef.current = null;
-    };
-  }, [userId, baseURL]); // Only depend on userId and baseURL - callbacks are in refs
-}

package/src/ui/utils/__tests__/activeAuthuser.test.ts

@@ -1,75 +0,0 @@
-/**
- * Fail-safe guarantees for the web `activeAuthuser` storage helpers.
- *
- * The PROPERTY ACCESS `window.localStorage` can throw a `SecurityError`
- * synchronously in opaque-origin / sandboxed iframes or when storage is
- * disabled — not just `getItem`/`setItem`. These helpers run during cold boot
- * (and feed render-phase gate values in the providers), so they MUST never
- * propagate that throw: reads fail safe to a benign default and writes no-op.
- */
-
-import {
-  readActiveAuthuser,
-  writeActiveAuthuser,
-  clearActiveAuthuser,
-  markSignedOut,
-  clearSignedOut,
-  isSilentRestoreSuppressed,
-} from '../activeAuthuser';
-
-describe('activeAuthuser helpers — localStorage fail-safe', () => {
-  const realDescriptor = Object.getOwnPropertyDescriptor(window, 'localStorage');
-
-  afterEach(() => {
-    if (realDescriptor) {
-      Object.defineProperty(window, 'localStorage', realDescriptor);
-    }
-    window.localStorage?.clear?.();
-  });
-
-  /** Replace the `localStorage` accessor so reading the property throws. */
-  function makeLocalStorageGetterThrow(): void {
-    Object.defineProperty(window, 'localStorage', {
-      configurable: true,
-      get() {
-        throw new DOMException('denied', 'SecurityError');
-      },
-    });
-  }
-
-  it('readActiveAuthuser returns null (never throws) when the getter throws', () => {
-    makeLocalStorageGetterThrow();
-    expect(() => readActiveAuthuser()).not.toThrow();
-    expect(readActiveAuthuser()).toBeNull();
-  });
-
-  it('isSilentRestoreSuppressed returns false (never throws) when the getter throws', () => {
-    makeLocalStorageGetterThrow();
-    expect(() => isSilentRestoreSuppressed()).not.toThrow();
-    expect(isSilentRestoreSuppressed()).toBe(false);
-  });
-
-  it('writeActiveAuthuser / clearActiveAuthuser / markSignedOut / clearSignedOut no-op when the getter throws', () => {
-    makeLocalStorageGetterThrow();
-    expect(() => {
-      writeActiveAuthuser(2);
-      clearActiveAuthuser();
-      markSignedOut();
-      clearSignedOut();
-    }).not.toThrow();
-  });
-
-  it('round-trips normally when storage works (zero behavior change)', () => {
-    writeActiveAuthuser(3);
-    expect(readActiveAuthuser()).toBe(3);
-
-    expect(isSilentRestoreSuppressed()).toBe(false);
-    markSignedOut();
-    expect(isSilentRestoreSuppressed()).toBe(true);
-    clearSignedOut();
-    expect(isSilentRestoreSuppressed()).toBe(false);
-
-    clearActiveAuthuser();
-    expect(readActiveAuthuser()).toBeNull();
-  });
-});

package/src/utils/__tests__/silentGuardKey.test.ts

@@ -1,82 +0,0 @@
-/**
- * @jest-environment node
- *
- * Regression coverage for the native session-restore crash:
- *
- *   W [component:OxyContext]: Failed to restore sessions from storage
- *   [TypeError: Cannot read property 'origin' of undefined]
- *
- * `silentColdBootKey` (OxyContext) and `ssoSignature` (useWebSSO) both build an
- * `origin|baseURL` guard signature UNCONDITIONALLY at the top of the cold-boot
- * path, on every platform. React Native aliases a global `window` (so
- * `typeof window !== 'undefined'` is `true`) but provides NO `window.location`.
- * The previous `typeof window`-only guard then read `window.location.origin`
- * and threw `Cannot read property 'origin' of undefined`, escaping session
- * restore entirely. Both call sites now delegate to the shared, guarded
- * `buildSilentGuardKey`, verified here under all three platform shapes.
- *
- * Runs in the `node` environment so `window` is genuinely controllable — under
- * jsdom `window.location` is non-configurable and cannot be removed, so the
- * native shape (window present, location absent) is not reproducible there.
- */
-
-import { buildSilentGuardKey, safeWindowOrigin } from '../silentGuardKey';
-
-describe('silentGuardKey native safety', () => {
-  const globalRef = globalThis as { window?: unknown };
-
-  afterEach(() => {
-    delete globalRef.window;
-  });
-
-  describe('safeWindowOrigin', () => {
-    it('returns "no-origin" when there is no window (Node / SSR)', () => {
-      delete globalRef.window;
-      expect(safeWindowOrigin()).toBe('no-origin');
-    });
-
-    it('returns "no-origin" on React Native (window present, no location)', () => {
-      // EXACT native shape: RN aliases a global `window` to the JS global, but
-      // there is no `window.location`. The old `typeof window`-only guard threw
-      // here; the new guard must return the sentinel without throwing.
-      globalRef.window = {};
-      expect(() => safeWindowOrigin()).not.toThrow();
-      expect(safeWindowOrigin()).toBe('no-origin');
-    });
-
-    it('returns the browser origin on web', () => {
-      globalRef.window = { location: { origin: 'https://app.mention.earth' } };
-      expect(safeWindowOrigin()).toBe('https://app.mention.earth');
-    });
-  });
-
-  describe('buildSilentGuardKey', () => {
-    it('does not throw and composes "no-origin|" on React Native', () => {
-      globalRef.window = {};
-      const getBaseURL = () => 'https://api.mention.earth';
-      expect(() => buildSilentGuardKey(getBaseURL)).not.toThrow();
-      expect(buildSilentGuardKey(getBaseURL)).toBe('no-origin|https://api.mention.earth');
-    });
-
-    it('composes "origin|baseURL" on web', () => {
-      globalRef.window = { location: { origin: 'https://app.mention.earth' } };
-      expect(buildSilentGuardKey(() => 'https://api.mention.earth')).toBe(
-        'https://app.mention.earth|https://api.mention.earth',
-      );
-    });
-
-    it('degrades baseURL to empty when getBaseURL is absent', () => {
-      globalRef.window = {};
-      expect(buildSilentGuardKey()).toBe('no-origin|');
-    });
-
-    it('degrades baseURL to empty when getBaseURL throws', () => {
-      globalRef.window = {};
-      const throwing = (): string => {
-        throw new Error('client not initialised');
-      };
-      expect(() => buildSilentGuardKey(throwing)).not.toThrow();
-      expect(buildSilentGuardKey(throwing)).toBe('no-origin|');
-    });
-  });
-});

package/src/utils/silentGuardKey.ts

@@ -1,46 +0,0 @@
-/**
- * Shared, pure helpers for building the `origin|baseURL` signature used as the
- * module-level run-once guard key for cold-boot silent-SSO probes
- * (`silentColdBootKey` in `OxyContext`, `ssoSignature` in `useWebSSO`).
- *
- * NATIVE SAFETY (the bug this fixes): React Native aliases a global `window`
- * (it points at the JS global object), so `typeof window !== 'undefined'` is
- * `true` on native — but `window.location` is `undefined`. Reading
- * `window.location.origin` after only a `typeof window` check therefore throws
- * `TypeError: Cannot read property 'origin' of undefined` on native. Because
- * the key is built UNCONDITIONALLY at the top of the cold-boot path (before its
- * try/catch), that throw escaped session restore entirely and broke
- * cross-session restore on native. Both prior copies of the guard had the same
- * insufficient `typeof window` check and were prone to drift, so the read is
- * consolidated here behind a guard that also verifies `window.location`.
- */
-
-/**
- * Read `window.location.origin` safely on every platform.
- *
- * Returns the browser origin on web, and the sentinel `'no-origin'` anywhere
- * `window.location` is absent (React Native, SSR/Node). Never throws.
- */
-export function safeWindowOrigin(): string {
-  if (typeof window !== 'undefined' && typeof window.location !== 'undefined') {
-    return window.location.origin;
-  }
-  return 'no-origin';
-}
-
-/**
- * Build the stable `origin|baseURL` signature for the silent-SSO run-once
- * guard. Two providers pointed at the same API from the same origin share one
- * attempt. `getBaseURL` is invoked defensively (it may be absent or throw on a
- * partially-initialised client); any failure degrades to an empty baseURL.
- */
-export function buildSilentGuardKey(getBaseURL?: () => string | undefined): string {
-  const origin = safeWindowOrigin();
-  let baseURL = '';
-  try {
-    baseURL = getBaseURL?.() ?? '';
-  } catch {
-    baseURL = '';
-  }
-  return `${origin}|${baseURL}`;
-}