@oxyhq/services 16.0.0 → 17.0.0

package/lib/commonjs/utils/deviceFlowSignIn.js

@@ -1,109 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.completeDeviceFlowSignIn = completeDeviceFlowSignIn;
-var _core = require("@oxyhq/core");
-/**
- * Shared, pure orchestration for completing the cross-app device-flow sign-in
- * (the QR-code / "Open Oxy Auth" path used on native and web).
- *
- * THE FIRST BUG THIS FIXES (native): once another authenticated device
- * approves the pending AuthSession, the originating client is notified
- * (socket / poll / deep-link) with the authorized `sessionId`. Before any
- * session-management code can use it, the client MUST exchange the secret
- * 128-bit `sessionToken` (held only by this client, generated for THIS flow)
- * for the first access token via `claimSessionByToken` — the device-flow
- * equivalent of OAuth's code-for-token exchange (RFC 8628 §3.4).
- *
- * THE SECOND BUG THIS FIXES (session-sync cutover regression): the
- * freshly-claimed session is NOT yet registered in the device's
- * server-authoritative session set — nothing has run
- * `sessionClient.addCurrentAccount()` for it — so it must NOT be committed
- * through `switchSession`. That path is now an account-SWITCH between
- * accounts already registered on this device (`OxyContext`'s
- * `switchSessionForContext`), and throws `No device account found for
- * session "..."` for anything else, surfacing as "Authorization successful
- * but failed to complete sign in." Instead the claimed session must be
- * committed through the SAME path a fresh password sign-in uses —
- * `useOxy().handleWebSession` (`OxyContext`'s `handleWebSSOSession`) — which
- * registers the account into the device set, persists it durably, and
- * hydrates the full user profile.
- *
- * Skipping the claim leaves the SDK with NO bearer token: the session is
- * authorized server-side but the app never becomes authenticated and the UI
- * sits "Waiting for authorization..." forever. Consolidating the
- * claim->commit sequence here keeps native and web identical and
- * unit-testable.
- */
-
-/**
- * The minimal `OxyServices` surface this orchestration needs. Kept as a
- * structural type (rather than importing the full client) so the helper is
- * trivially unit-testable with a stub and never pulls the RN/Expo runtime into
- * a test bundle.
- *
- */
-
-/**
- * Complete a device-flow sign-in: claim the first access token with the secret
- * `sessionToken` (planting the bearer), then commit the resulting session via
- * `commitSession` (registers it into the device's server-authoritative session
- * set and hydrates the full user). Returns the authenticated user.
- *
- * Throws if the claim did not return a usable session, or if either the claim
- * or the commit fails; callers surface a retry UI.
- */
-async function completeDeviceFlowSignIn({
-  oxyServices,
-  sessionId,
-  sessionToken,
-  commitSession
-}) {
-  // 1) Plant the bearer + refresh tokens. The claim response is also persisted
-  //    to native shared secure storage so a later cold boot has a bearer before
-  //    it validates stored sessions. On web this is a no-op.
-  const claimed = await oxyServices.claimSessionByToken(sessionToken);
-  if (claimed?.accessToken) {
-    await _core.KeyManager.storeSharedSession(claimed.sessionId || sessionId, claimed.accessToken);
-  }
-  if (!claimed?.accessToken || !claimed.user) {
-    throw new Error('Device-flow claim did not return a usable session');
-  }
-
-  // `SessionLoginResponse.user` is the minimal session-carried shape (avatar
-  // is `string | undefined`); the claim response returns the full `User`
-  // (avatar is `string | null | undefined`). Normalize rather than widening
-  // `SessionLoginResponse.user` to accept `null`.
-  const minimalUser = {
-    id: claimed.user.id,
-    username: claimed.user.username,
-    name: claimed.user.name,
-    avatar: claimed.user.avatar ?? undefined
-  };
-
-  // 2) Bearer is now planted — commit the session through the same path a
-  //    fresh sign-in uses so it is registered into the device's
-  //    server-authoritative session set instead of an account switch. Thread
-  //    the rotating refresh token so the commit funnel persists a durable
-  //    session that survives a reload.
-  await commitSession({
-    sessionId: claimed.sessionId || sessionId,
-    deviceId: claimed.deviceId ?? '',
-    expiresAt: claimed.expiresAt ?? '',
-    user: minimalUser,
-    accessToken: claimed.accessToken,
-    ...(claimed.refreshToken ? {
-      refreshToken: claimed.refreshToken
-    } : {})
-  });
-
-  // The commit funnel persisted the rotating refresh family and registered the
-  // account into the device set, so a reload restores the session locally (web:
-  // stored-tokens / same-apex web-session; native: shared keychain) WITHOUT any
-  // IdP `fedcm_session` cookie or top-level establish hop.
-
-  return claimed.user;
-}
-//# sourceMappingURL=deviceFlowSignIn.js.map

package/lib/commonjs/utils/deviceFlowSignIn.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["_core","require","completeDeviceFlowSignIn","oxyServices","sessionId","sessionToken","commitSession","claimed","claimSessionByToken","accessToken","KeyManager","storeSharedSession","user","Error","minimalUser","id","username","name","avatar","undefined","deviceId","expiresAt","refreshToken"],"sourceRoot":"../../../src","sources":["utils/deviceFlowSignIn.ts"],"mappings":";;;;;;AAiCA,IAAAA,KAAA,GAAAC,OAAA;AAjCA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAsBA;AACA;AACA;AACA;AACA;AACA;AACA;;AAkCA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeC,wBAAwBA,CAAC;EAC7CC,WAAW;EACXC,SAAS;EACTC,YAAY;EACZC;AAC+B,CAAC,EAAiB;EACjD;EACA;EACA;EACA,MAAMC,OAAO,GAAG,MAAMJ,WAAW,CAACK,mBAAmB,CAACH,YAAY,CAAC;EACnE,IAAIE,OAAO,EAAEE,WAAW,EAAE;IACxB,MAAMC,gBAAU,CAACC,kBAAkB,CAACJ,OAAO,CAACH,SAAS,IAAIA,SAAS,EAAEG,OAAO,CAACE,WAAW,CAAC;EAC1F;EAEA,IAAI,CAACF,OAAO,EAAEE,WAAW,IAAI,CAACF,OAAO,CAACK,IAAI,EAAE;IAC1C,MAAM,IAAIC,KAAK,CAAC,mDAAmD,CAAC;EACtE;;EAEA;EACA;EACA;EACA;EACA,MAAMC,WAA4B,GAAG;IACnCC,EAAE,EAAER,OAAO,CAACK,IAAI,CAACG,EAAE;IACnBC,QAAQ,EAAET,OAAO,CAACK,IAAI,CAACI,QAAQ;IAC/BC,IAAI,EAAEV,OAAO,CAACK,IAAI,CAACK,IAAI;IACvBC,MAAM,EAAEX,OAAO,CAACK,IAAI,CAACM,MAAM,IAAIC;EACjC,CAAC;;EAED;EACA;EACA;EACA;EACA;EACA,MAAMb,aAAa,CAAC;IAClBF,SAAS,EAAEG,OAAO,CAACH,SAAS,IAAIA,SAAS;IACzCgB,QAAQ,EAAEb,OAAO,CAACa,QAAQ,IAAI,EAAE;IAChCC,SAAS,EAAEd,OAAO,CAACc,SAAS,IAAI,EAAE;IAClCT,IAAI,EAAEE,WAAW;IACjBL,WAAW,EAAEF,OAAO,CAACE,WAAW;IAChC,IAAIF,OAAO,CAACe,YAAY,GAAG;MAAEA,YAAY,EAAEf,OAAO,CAACe;IAAa,CAAC,GAAG,CAAC,CAAC;EACxE,CAAC,CAAC;;EAEF;EACA;EACA;EACA;;EAEA,OAAOf,OAAO,CAACK,IAAI;AACrB","ignoreList":[]}