@oxyhq/services 14.0.1 → 15.0.0

package/src/ui/context/hooks/useAuthOperations.ts

@@ -1,5 +1,5 @@
 import { useCallback } from 'react';
-import type { ApiError, SessionClient, User } from '@oxyhq/core';
+import type { ApiError, AuthStateStore, SessionClient, User } from '@oxyhq/core';
 import type { AuthState } from '../../stores/authStore';
 import type { ClientSession, SessionLoginResponse } from '@oxyhq/core';
 import { DeviceManager } from '@oxyhq/core';
@@ -8,30 +8,24 @@ import { handleAuthError, isInvalidSessionError } from '../../utils/errorHandler
 import type { StorageInterface } from '../../utils/storageHelpers';
 import type { OxyServices } from '@oxyhq/core';
 import { SignatureService } from '@oxyhq/core';
-import { isWebBrowser } from '../../hooks/useWebSSO';
-import {
-  clearSsoBounceState,
-  markSignedOut,
-  clearSignedOut,
-} from '../../utils/activeAuthuser';
-import { isCrossApexWeb, CrossApexDirectSignInError } from '../../../utils/crossApex';
 
 export interface UseAuthOperationsOptions {
   oxyServices: OxyServices;
   storage: StorageInterface | null;
+  /**
+   * The device-first persisted auth-state store. On EXPLICIT full sign-out the
+   * session blob is cleared (`store.clear()`) so a reload's cold boot finds no
+   * refresh family to restore; on sign-in a returned rotating refresh token is
+   * persisted so the next boot warm-restores without a redirect. The long-lived
+   * device token SURVIVES sign-out (the device is unchanged), so it is never
+   * cleared here.
+   */
+  store: AuthStateStore;
   activeSessionId: string | null;
   setActiveSessionId: (sessionId: string | null) => void;
   updateSessions: (sessions: ClientSession[], options?: { merge?: boolean }) => void;
   saveActiveSessionId: (sessionId: string) => Promise<void>;
   clearSessionState: () => Promise<void>;
-  /**
-   * Clear the durable returning-user hint (`storageKeys.priorSession`). Called
-   * ONLY on EXPLICIT full sign-out — alongside `clearSsoBounceState()` — so the
-   * next cold boot treats this device as a first-time anonymous visitor (no
-   * forced `/sso` bounce). NEVER called on the passive token-expiry path, so an
-   * expired session still recovers via a returning-user bounce. Best-effort.
-   */
-  clearPriorSessionHint: () => Promise<void>;
   /** Used only by `performSignIn`'s same-user duplicate-session dedup (legacy session-validate path; unrelated to the SessionClient device-account set). */
   switchSession: (sessionId: string) => Promise<User>;
   /**
@@ -67,25 +61,19 @@ const LOGOUT_ERROR_CODE = 'LOGOUT_ERROR';
 const LOGOUT_ALL_ERROR_CODE = 'LOGOUT_ALL_ERROR';
 
 /**
- * Fire-and-forget the durable returning-user hint clear on explicit sign-out.
- *
- * Mirrors the synchronous, non-blocking nature of the sibling
- * `clearSsoBounceState()`: sign-out must NEVER block on (or fail because of) a
- * best-effort storage write. The clear is invoked synchronously (so unit tests
- * can assert it ran) but its async settle is detached; any rejection is logged,
- * never thrown.
- *
- * Exported so `OxyContext`'s `syncFromClient` zero-account branch (a REMOTE
- * full sign-out) can invoke the EXACT same cleanup as the LOCAL `logout` /
- * `logoutAll` paths below — a remote sign-out must be indistinguishable from
- * a local one to the next cold boot.
+ * Clear the persisted refresh-token family on an explicit full sign-out.
+ * Best-effort and non-blocking: sign-out must never fail because a storage
+ * write threw. Exported so `OxyContext`'s zero-account branch (a REMOTE full
+ * sign-out pushed over the socket) runs the EXACT same cleanup as the local
+ * `logout` / `logoutAll` paths — a remote sign-out is indistinguishable from a
+ * local one to the next cold boot.
  */
-export function clearPriorSessionHintSafe(
-  clearPriorSessionHint: () => Promise<void>,
+export function clearPersistedAuthSafe(
+  store: AuthStateStore,
   logger?: (message: string, error?: unknown) => void,
 ): void {
-  clearPriorSessionHint().catch((hintError) => {
-    logger?.('Failed to clear prior-session hint on sign-out', hintError);
+  store.clear().catch((clearError) => {
+    logger?.('Failed to clear persisted auth state on sign-out', clearError);
   });
 }
 
@@ -95,12 +83,12 @@ export function clearPriorSessionHintSafe(
  */
 export const useAuthOperations = ({
   oxyServices,
+  store,
   activeSessionId,
   setActiveSessionId,
   updateSessions,
   saveActiveSessionId,
   clearSessionState,
-  clearPriorSessionHint,
   switchSession,
   sessionClient,
   syncFromClient,
@@ -148,21 +136,40 @@ export const useAuthOperations = ({
         deviceFingerprint,
       );
 
-      // Deliberate sign-in re-enables automatic silent restore: clear the durable
-      // "deliberately signed out" flag so a prior sign-out no longer suppresses
-      // the per-apex iframe cold-boot step.
-      clearSignedOut();
+      // Persist the per-origin refresh family so a reload warm-restores this
+      // session without a redirect. `verifyChallenge` plants the access token
+      // internally; when the (trusted-lane) response also carries a rotating
+      // refresh token, persist the durable blob. Best-effort — a failed persist
+      // never fails the sign-in (native additionally re-mints via the shared
+      // keychain on the next cold boot). `SessionLoginResponse` does not type
+      // `refreshToken`; read it defensively from the runtime payload.
+      const refreshToken = (sessionResponse as { refreshToken?: string }).refreshToken;
+      if (refreshToken) {
+        try {
+          const deviceToken = (await store.loadDeviceToken()) ?? undefined;
+          await store.save({
+            sessionId: sessionResponse.sessionId,
+            refreshToken,
+            userId: sessionResponse.user.id,
+            ...(deviceToken ? { deviceToken } : {}),
+            ...(sessionResponse.accessToken ? { accessToken: sessionResponse.accessToken } : {}),
+            ...(sessionResponse.expiresAt ? { expiresAt: sessionResponse.expiresAt } : {}),
+          });
+        } catch (persistError) {
+          logger?.('Failed to persist auth state after sign-in', persistError);
+        }
+      }
 
       // Register this recovered account+session into the server-authoritative
-      // device-session set: `sessionClient.addCurrentAccount()` ->
-      // `POST /session/device/add` derives identity from the bearer
-      // `verifyChallenge` already planted internally, then `syncFromClient()`
-      // reprojects the resulting server state onto the exposed
-      // sessions/activeSessionId/user. Best-effort: a failure here must NEVER
-      // fail the sign-in itself — cold boot re-registers this account into the
-      // device set on the next load regardless.
+      // device-session set AND make it active: `registerAndActivate()` adds via
+      // `POST /session/device/add` (identity derived from the bearer
+      // `verifyChallenge` already planted) then switches to it, and
+      // `syncFromClient()` reprojects the resulting server state onto the
+      // exposed sessions/activeSessionId/user. Best-effort: a failure here must
+      // NEVER fail the sign-in itself — cold boot re-registers this account into
+      // the device set on the next load regardless.
       try {
-        await sessionClient.addCurrentAccount();
+        await sessionClient.registerAndActivate(sessionResponse.user.id);
         await syncFromClient();
       } catch (registrationError) {
         logger?.('Failed to register sign-in into device session set', registrationError);
@@ -230,6 +237,7 @@ export const useAuthOperations = ({
       saveActiveSessionId,
       sessionClient,
       setActiveSessionId,
+      store,
       switchSession,
       syncFromClient,
       updateSessions,
@@ -241,13 +249,6 @@ export const useAuthOperations = ({
    */
   const signIn = useCallback(
     async (publicKey: string, deviceName?: string): Promise<User> => {
-      // On a cross-apex web RP a direct public-key sign-in mints a bearer against
-      // the Oxy API but establishes no `fedcm_session`, so the session would be
-      // lost on reload. Refuse it and direct the app to the durable IdP popup
-      // ("Continue with Oxy"). Native and same-apex `*.oxy.so` are unaffected.
-      if (isCrossApexWeb()) {
-        throw new CrossApexDirectSignInError();
-      }
       setAuthState({ isLoading: true, error: null });
 
       try {
@@ -300,23 +301,18 @@ export const useAuthOperations = ({
         await syncFromClient();
 
         if (sessionToLogout === activeSessionId && remainingAccounts.length === 0) {
-          // Genuine FULL sign-out (no sessions remain): clear the per-origin
-          // SSO bounce state so a fresh deliberate sign-in can re-probe, and
-          // SET the deliberately-signed-out flag so the silent cold-boot step
-          // (per-apex iframe) does not re-mint a session from a
-          // still-live IdP session on the next reload (mirrors `logoutAll`).
-          markSignedOut();
-          clearSsoBounceState();
-          clearPriorSessionHintSafe(clearPriorSessionHint, logger);
+          // Genuine FULL sign-out (no sessions remain): clear the persisted
+          // refresh family so a reload's cold boot finds nothing to restore,
+          // then tear down local state.
+          clearPersistedAuthSafe(store, logger);
           await clearSessionState();
         }
       } catch (error) {
         const isInvalid = isInvalidSessionError(error);
 
         if (isInvalid && targetSessionId === activeSessionId) {
-          // The active session is invalid → full sign-out; clear SSO state too.
-          clearSsoBounceState();
-          clearPriorSessionHintSafe(clearPriorSessionHint, logger);
+          // The active session is invalid → full sign-out; clear persisted state.
+          clearPersistedAuthSafe(store, logger);
           await clearSessionState();
           return;
         }
@@ -334,7 +330,7 @@ export const useAuthOperations = ({
     [
       activeSessionId,
       clearSessionState,
-      clearPriorSessionHint,
+      store,
       logger,
       onError,
       sessionClient,
@@ -360,17 +356,10 @@ export const useAuthOperations = ({
       // `{ all: true }`) — replaces the bearer `logoutAllSessions` +
       // web-cookie `logoutAllSessionsViaCookie` pair.
       await sessionClient.signOut({ all: true });
-      if (isWebBrowser()) {
-        // Deliberate full sign-out: suppress automatic silent restore on the next
-        // cold boot so a still-live IdP session does not re-mint a session.
-        markSignedOut();
-      }
-      // logoutAll is ALWAYS a full sign-out: clear the per-origin SSO bounce
-      // state (web-guarded internally) so a fresh sign-in can re-probe, and drop
-      // the durable returning-user hint so the next cold boot is treated as a
-      // first-time anonymous visitor (no forced `/sso` bounce after sign-out).
-      clearSsoBounceState();
-      clearPriorSessionHintSafe(clearPriorSessionHint, logger);
+      // logoutAll is ALWAYS a full sign-out: clear the persisted refresh family
+      // so the next cold boot finds no session to restore, then tear down local
+      // state. The long-lived device token survives (the device is unchanged).
+      clearPersistedAuthSafe(store, logger);
       await clearSessionState();
     } catch (error) {
       handleAuthError(error, {
@@ -382,7 +371,7 @@ export const useAuthOperations = ({
       });
       throw error instanceof Error ? error : new Error('Logout all failed');
     }
-  }, [activeSessionId, clearSessionState, clearPriorSessionHint, logger, onError, sessionClient, setAuthState]);
+  }, [activeSessionId, clearSessionState, store, logger, onError, sessionClient, setAuthState]);
 
   return {
     signIn,

package/src/ui/hooks/useAuth.ts

@@ -26,7 +26,8 @@
 import { useCallback, useState } from 'react';
 import { useOxy } from '../context/OxyContext';
 import type { User } from '@oxyhq/core';
-import { isWebBrowser } from './useWebSSO';
+import { isWebBrowser } from '../utils/isWebBrowser';
+import { showSignInModal } from '../components/SignInModal';
 
 export interface AuthState {
   /** Current authenticated user, null if not authenticated */
@@ -140,35 +141,24 @@ export function useAuth(): UseAuthReturn {
   } = useOxy();
 
   const signIn = useCallback(async (publicKey?: string): Promise<User> => {
-    // Check if we're on the identity provider itself
-    // Only the IdP has local login forms - other apps are client apps
-    const authWebUrl = oxyServices.config?.authWebUrl;
-    let idpHostname = 'auth.oxy.so';
-    if (authWebUrl) {
-      try { idpHostname = new URL(authWebUrl).hostname; } catch { /* malformed URL, use default */ }
-    }
-    const isIdentityProvider = isWebBrowser() &&
-      window.location.hostname === idpHostname;
-
-    // Web (not on IdP): use the tokenless redirect SSO flow. The silent
-    // cross-domain restore (per-apex `/auth/silent` iframe + `/sso` bounce)
-    // already ran on page load; an explicit click needs interactive auth.
-    if (isWebBrowser() && !publicKey && !isIdentityProvider) {
-      oxyServices.signInWithRedirect?.({
-        redirectUri: window.location.href,
-      });
+    // Web (no key): open the in-app "Sign in with Oxy" modal. There is NO
+    // automatic navigation to any login page — the device-first cold boot
+    // already restored a session if one existed; an explicit click presents the
+    // SDK sign-in surface (password / QR device flow / add account).
+    if (isWebBrowser() && !publicKey) {
+      showSignInModal();
+      // Resolves when the modal commits a session; the caller typically reacts
+      // to `isAuthenticated` rather than this promise.
       return new Promise<User>(() => undefined);
     }
 
-    // Native: Use cryptographic identity
-    // If public key provided, use it directly
+    // Native: use the cryptographic identity directly when a public key is given.
     if (publicKey) {
       return oxySignIn(publicKey);
     }
 
-    // Try to get existing identity
+    // Native with an existing keychain identity: sign in with it.
     const hasExisting = await hasIdentity();
-
     if (hasExisting) {
       const existingKey = await getPublicKey();
       if (existingKey) {
@@ -176,27 +166,16 @@ export function useAuth(): UseAuthReturn {
       }
     }
 
-    // No identity - show auth UI
+    // Native with no identity: open the auth sheet (password / QR device flow).
     if (showBottomSheet) {
       showBottomSheet('OxyAuth');
-      // Return a promise that resolves when auth completes
       return new Promise((_, reject) => {
         reject(new Error('Please complete sign-in in the auth sheet'));
       });
     }
 
-    // Web fallback: navigate to login page on auth domain
-    if (isWebBrowser()) {
-      const authBase = authWebUrl || 'https://accounts.oxy.so';
-      const loginUrl = window.location.hostname.includes('oxy.so')
-        ? '/login'
-        : `${authBase}/login`;
-      window.location.href = loginUrl;
-      return new Promise(() => {}); // Never resolves, page will redirect
-    }
-
     throw new Error('No authentication method available');
-  }, [oxySignIn, hasIdentity, getPublicKey, showBottomSheet, oxyServices]);
+  }, [oxySignIn, hasIdentity, getPublicKey, showBottomSheet]);
 
   const signOut = useCallback(async (): Promise<void> => {
     await logout();

package/src/ui/hooks/usePasswordSignIn.ts

@@ -0,0 +1,207 @@
+/**
+ * `usePasswordSignIn` — the first-party password sign-in state machine.
+ *
+ * Drives the in-app "Sign in with Oxy" password flow shared by the web
+ * `SignInModal` and the native `OxyAuthScreen`: identifier → password → optional
+ * two-factor. It is a thin UI state machine over the context methods
+ * `signInWithPassword` + `completeTwoFactorSignIn` (which own the network call,
+ * the persisted-refresh commit, and the device-set registration) — so both
+ * surfaces present an identical flow without re-implementing any transport.
+ *
+ * On a committed session `onSignedIn` fires (the modal/screen closes); the
+ * device-first cold boot / SessionClient projection then drive the app into the
+ * authenticated state.
+ */
+import { useCallback, useMemo, useRef, useState } from 'react';
+import { useOxy } from '../context/OxyContext';
+import { handleAuthError } from '../utils/errorHandlers';
+
+export type PasswordSignInStep = 'identifier' | 'password' | 'twoFactor';
+
+export interface UsePasswordSignInOptions {
+  /** Fired once a session has been committed (the surface should close). */
+  onSignedIn?: () => void;
+}
+
+export interface UsePasswordSignInResult {
+  step: PasswordSignInStep;
+  identifier: string;
+  setIdentifier: (value: string) => void;
+  password: string;
+  setPassword: (value: string) => void;
+  /** The current 2FA input — a TOTP code or a backup code, per `useBackupCode`. */
+  code: string;
+  setCode: (value: string) => void;
+  useBackupCode: boolean;
+  setUseBackupCode: (value: boolean) => void;
+  error: string | null;
+  isSubmitting: boolean;
+  /** Advance identifier → password (validates a non-empty identifier). */
+  submitIdentifier: () => void;
+  /** Submit the password: commits a one-step session, or advances to 2FA. */
+  submitPassword: () => Promise<void>;
+  /** Submit the 2FA code / backup code and commit the session. */
+  submitTwoFactor: () => Promise<void>;
+  /** Step back one screen (2FA → password → identifier), clearing the error. */
+  back: () => void;
+  /** Reset every field back to the identifier step. */
+  reset: () => void;
+}
+
+export function usePasswordSignIn(options: UsePasswordSignInOptions = {}): UsePasswordSignInResult {
+  const { signInWithPassword, completeTwoFactorSignIn } = useOxy();
+  const { onSignedIn } = options;
+
+  const [step, setStep] = useState<PasswordSignInStep>('identifier');
+  const [identifier, setIdentifier] = useState('');
+  const [password, setPassword] = useState('');
+  const [code, setCode] = useState('');
+  const [useBackupCode, setUseBackupCode] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [isSubmitting, setIsSubmitting] = useState(false);
+  const [loginToken, setLoginToken] = useState<string | null>(null);
+
+  // Synchronous in-flight guard. `isSubmitting` state drives the UI, but a rapid
+  // double-tap fires both handlers in the SAME tick — before React re-renders —
+  // so a state read would still see `false` on the second call and double-fire
+  // the network request (rate-limit + race). This ref is set/checked
+  // synchronously, so the second call is a true no-op.
+  const submittingRef = useRef(false);
+
+  const surfaceError = useCallback((err: unknown, defaultMessage: string): void => {
+    setError(handleAuthError(err, { defaultMessage, code: 'PASSWORD_SIGN_IN_ERROR' }));
+  }, []);
+
+  const submitIdentifier = useCallback(() => {
+    if (!identifier.trim()) {
+      setError('Enter your username or email');
+      return;
+    }
+    setError(null);
+    setStep('password');
+  }, [identifier]);
+
+  const submitPassword = useCallback(async () => {
+    // A second call while one is already in flight is a no-op (double-tap guard).
+    if (submittingRef.current) {
+      return;
+    }
+    if (!password) {
+      setError('Enter your password');
+      return;
+    }
+    setError(null);
+    submittingRef.current = true;
+    setIsSubmitting(true);
+    try {
+      const result = await signInWithPassword(identifier.trim(), password);
+      if (result.status === '2fa_required') {
+        setLoginToken(result.loginToken);
+        setCode('');
+        setUseBackupCode(false);
+        setStep('twoFactor');
+        return;
+      }
+      onSignedIn?.();
+    } catch (err) {
+      surfaceError(err, 'Sign in failed');
+    } finally {
+      submittingRef.current = false;
+      setIsSubmitting(false);
+    }
+  }, [identifier, password, signInWithPassword, onSignedIn, surfaceError]);
+
+  const submitTwoFactor = useCallback(async () => {
+    // A second call while one is already in flight is a no-op (double-tap guard).
+    if (submittingRef.current) {
+      return;
+    }
+    if (!loginToken) {
+      setError('Your sign-in session expired. Start again.');
+      setStep('password');
+      return;
+    }
+    if (!code.trim()) {
+      setError(useBackupCode ? 'Enter a backup code' : 'Enter your 6-digit code');
+      return;
+    }
+    setError(null);
+    submittingRef.current = true;
+    setIsSubmitting(true);
+    try {
+      await completeTwoFactorSignIn({
+        loginToken,
+        ...(useBackupCode ? { backupCode: code.trim() } : { token: code.trim() }),
+      });
+      onSignedIn?.();
+    } catch (err) {
+      surfaceError(err, 'Verification failed');
+    } finally {
+      submittingRef.current = false;
+      setIsSubmitting(false);
+    }
+  }, [loginToken, code, useBackupCode, completeTwoFactorSignIn, onSignedIn, surfaceError]);
+
+  const back = useCallback(() => {
+    setError(null);
+    setStep((current) => {
+      if (current === 'twoFactor') {
+        setLoginToken(null);
+        setCode('');
+        return 'password';
+      }
+      if (current === 'password') {
+        setPassword('');
+        return 'identifier';
+      }
+      return current;
+    });
+  }, []);
+
+  const reset = useCallback(() => {
+    setStep('identifier');
+    setIdentifier('');
+    setPassword('');
+    setCode('');
+    setUseBackupCode(false);
+    setLoginToken(null);
+    setError(null);
+    submittingRef.current = false;
+    setIsSubmitting(false);
+  }, []);
+
+  return useMemo(
+    () => ({
+      step,
+      identifier,
+      setIdentifier,
+      password,
+      setPassword,
+      code,
+      setCode,
+      useBackupCode,
+      setUseBackupCode,
+      error,
+      isSubmitting,
+      submitIdentifier,
+      submitPassword,
+      submitTwoFactor,
+      back,
+      reset,
+    }),
+    [
+      step,
+      identifier,
+      password,
+      code,
+      useBackupCode,
+      error,
+      isSubmitting,
+      submitIdentifier,
+      submitPassword,
+      submitTwoFactor,
+      back,
+      reset,
+    ],
+  );
+}

package/src/ui/hooks/useProfileEditing.ts

@@ -24,7 +24,6 @@ export interface ProfileUpdateData {
     username?: string;
     email?: string;
     bio?: string;
-    location?: string;
     locations?: ProfileLocation[];
     links?: string[];
     linksMetadata?: ProfileLinkMetadata[];
@@ -67,13 +66,8 @@ export const useProfileEditing = () => {
         if (updates.bio !== undefined) {
             updateData.bio = updates.bio;
         }
-        if (updates.location !== undefined || updates.locations !== undefined) {
-            updateData.location = updates.locations && updates.locations.length > 0 
-                ? updates.locations[0].name 
-                : updates.location || '';
-            if (updates.locations) {
-                updateData.locations = updates.locations;
-            }
+        if (updates.locations !== undefined) {
+            updateData.locations = updates.locations;
         }
         if (updates.links !== undefined) {
             updateData.links = updates.links;

package/src/ui/hooks/useSessionManagement.ts

@@ -8,7 +8,7 @@ import { handleAuthError, isInvalidSessionError } from '../utils/errorHandlers';
 import type { OxyServices } from '@oxyhq/core';
 import type { QueryClient } from '@tanstack/react-query';
 import { clearQueryCache } from './queryClient';
-import { isWebBrowser } from './useWebSSO';
+import { isWebBrowser } from '../utils/isWebBrowser';
 
 export interface UseSessionManagementOptions {
   oxyServices: OxyServices;

package/src/ui/navigation/routes.ts

@@ -26,6 +26,7 @@ export type RouteName =
     | 'UserLinks'
     | 'HistoryView'
     | 'SavesCollections'
+    | 'EditProfile'      // Profile-editing hub: one row per editable field
     | 'EditProfileField' // Dedicated screen for editing a single profile field
     | 'LearnMoreUsernames' // Informational screen about usernames
     | 'TrustCenter'
@@ -67,6 +68,7 @@ const screenLoaders: Record<RouteName, () => ComponentType<BaseScreenProps>> = {
     UserLinks: () => require('../screens/UserLinksScreen').default,
     HistoryView: () => require('../screens/HistoryViewScreen').default,
     SavesCollections: () => require('../screens/SavesCollectionsScreen').default,
+    EditProfile: () => require('../screens/EditProfileScreen').default,
     EditProfileField: () => require('../screens/EditProfileFieldScreen').default,
     // Informational screens
     LearnMoreUsernames: () => require('../screens/LearnMoreUsernamesScreen').default,