@oxyhq/services 16.0.0 → 17.0.0

package/src/utils/__tests__/deviceFlowSignIn.test.ts

@@ -1,231 +0,0 @@
-/**
- * @jest-environment node
- *
- * Regression coverage for the device-flow ("Sign in with Oxy" QR / "Open Oxy
- * Auth") sign-in orchestration:
- *
- *   BUG 1 (native): tapping "Sign In with Oxy" opens `OxyAuthScreen`, which
- *   creates a device-flow AuthSession. The user signs in successfully, the API
- *   authorizes the session and notifies the client — but the screen then called
- *   `switchSession` DIRECTLY without first claiming the bearer with the secret
- *   `sessionToken`. The session was authorized server-side but the app never
- *   became authenticated ("nothing happens").
- *
- *   BUG 2 (session-sync cutover regression): once claiming was fixed,
- *   `completeDeviceFlowSignIn` still committed the claimed session through
- *   `switchSession`, which after the cutover is an account-SWITCH between
- *   accounts already registered on the device and throws `No device account
- *   found for session "..."` for a freshly-claimed session. The fix commits the
- *   claimed session through `commitSession` (`useOxy().handleWebSession`)
- *   instead — the SAME path a fresh password sign-in uses to register the
- *   account into the device's server-authoritative session set.
- *
- * These tests pin the order (claim before commit), the fail-fast behaviour on a
- * claim that returns no usable session, propagation of a `commitSession`
- * failure, and (device-first) that the rotating refresh token the claim returns
- * is threaded into `commitSession` so the QR sign-in persists a durable session.
- */
-
-import type { SessionLoginResponse, User } from '@oxyhq/core';
-import {
-  completeDeviceFlowSignIn,
-  type DeviceFlowClient,
-} from '../deviceFlowSignIn';
-
-const SESSION_ID = 'session-id-123';
-const SESSION_TOKEN = 'a'.repeat(32);
-const ACCESS_TOKEN = 'access-token-abc';
-const REFRESH_TOKEN = 'refresh-token-def';
-const USER = {
-  id: 'user-1',
-  username: 'nate',
-  name: { displayName: 'Nate' },
-  privacySettings: {},
-} as User;
-// The session carries only the minimal shape (`id`/`username`/`name`/`avatar`)
-// — this is what `commitSession` receives, not the full claimed `User`.
-const MINIMAL_USER = { id: USER.id, username: USER.username, name: USER.name, avatar: undefined };
-
-describe('completeDeviceFlowSignIn', () => {
-  it('claims the sessionToken BEFORE committing the session', async () => {
-    const order: string[] = [];
-
-    const oxyServices: DeviceFlowClient = {
-      claimSessionByToken: jest.fn(async (token: string) => {
-        expect(token).toBe(SESSION_TOKEN);
-        order.push('claim');
-        return {
-          accessToken: ACCESS_TOKEN,
-          sessionId: SESSION_ID,
-          deviceId: 'device-1',
-          expiresAt: '2026-01-01T00:00:00.000Z',
-          user: USER,
-        };
-      }),
-    };
-    const commitSession = jest.fn(async (session: SessionLoginResponse): Promise<void> => {
-      expect(session).toEqual({
-        sessionId: SESSION_ID,
-        deviceId: 'device-1',
-        expiresAt: '2026-01-01T00:00:00.000Z',
-        user: MINIMAL_USER,
-        accessToken: ACCESS_TOKEN,
-      });
-      order.push('commit');
-    });
-
-    const user = await completeDeviceFlowSignIn({
-      oxyServices,
-      sessionId: SESSION_ID,
-      sessionToken: SESSION_TOKEN,
-      commitSession,
-    });
-
-    expect(order).toEqual(['claim', 'commit']);
-    expect(oxyServices.claimSessionByToken).toHaveBeenCalledWith(SESSION_TOKEN);
-    expect(commitSession).toHaveBeenCalledTimes(1);
-    expect(user).toBe(USER);
-  });
-
-  it('threads the claim rotating refreshToken into commitSession (durable QR session)', async () => {
-    const oxyServices: DeviceFlowClient = {
-      claimSessionByToken: jest.fn(async () => ({
-        accessToken: ACCESS_TOKEN,
-        refreshToken: REFRESH_TOKEN,
-        sessionId: SESSION_ID,
-        deviceId: 'device-1',
-        expiresAt: '2026-01-01T00:00:00.000Z',
-        user: USER,
-      })),
-    };
-    const commitSession = jest.fn(async (): Promise<void> => {});
-
-    await completeDeviceFlowSignIn({
-      oxyServices,
-      sessionId: SESSION_ID,
-      sessionToken: SESSION_TOKEN,
-      commitSession,
-    });
-
-    // The rotating refresh family is carried into the commit funnel so it
-    // persists a durable session that survives a reload without a redirect.
-    expect(commitSession).toHaveBeenCalledWith({
-      sessionId: SESSION_ID,
-      deviceId: 'device-1',
-      expiresAt: '2026-01-01T00:00:00.000Z',
-      user: MINIMAL_USER,
-      accessToken: ACCESS_TOKEN,
-      refreshToken: REFRESH_TOKEN,
-    });
-  });
-
-  it('falls back to the delivered sessionId/deviceId/expiresAt when the claim omits them', async () => {
-    const oxyServices: DeviceFlowClient = {
-      claimSessionByToken: jest.fn(async () => ({
-        accessToken: ACCESS_TOKEN,
-        user: USER,
-      })),
-    };
-    const commitSession = jest.fn(async (): Promise<void> => {});
-
-    await completeDeviceFlowSignIn({
-      oxyServices,
-      sessionId: SESSION_ID,
-      sessionToken: SESSION_TOKEN,
-      commitSession,
-    });
-
-    expect(commitSession).toHaveBeenCalledWith({
-      sessionId: SESSION_ID,
-      deviceId: '',
-      expiresAt: '',
-      user: MINIMAL_USER,
-      accessToken: ACCESS_TOKEN,
-    });
-  });
-
-  it('does NOT commit the session when the claim fails (the original native regression)', async () => {
-    const claimError = new Error('claim failed (401)');
-    const oxyServices: DeviceFlowClient = {
-      claimSessionByToken: jest.fn(async () => {
-        throw claimError;
-      }),
-    };
-    const commitSession = jest.fn(async (): Promise<void> => {});
-
-    await expect(
-      completeDeviceFlowSignIn({
-        oxyServices,
-        sessionId: SESSION_ID,
-        sessionToken: SESSION_TOKEN,
-        commitSession,
-      }),
-    ).rejects.toThrow('claim failed (401)');
-
-    // The bearer was never planted, so we must not attempt the bearer-protected
-    // commit — surfacing the failure to the caller instead.
-    expect(commitSession).not.toHaveBeenCalled();
-  });
-
-  it('throws when the claim returns no accessToken (the session-sync regression guard)', async () => {
-    const oxyServices: DeviceFlowClient = {
-      claimSessionByToken: jest.fn(async () => ({ sessionId: SESSION_ID, user: USER })),
-    };
-    const commitSession = jest.fn(async (): Promise<void> => {});
-
-    await expect(
-      completeDeviceFlowSignIn({
-        oxyServices,
-        sessionId: SESSION_ID,
-        sessionToken: SESSION_TOKEN,
-        commitSession,
-      }),
-    ).rejects.toThrow('Device-flow claim did not return a usable session');
-
-    expect(commitSession).not.toHaveBeenCalled();
-  });
-
-  it('throws when the claim returns no user', async () => {
-    const oxyServices: DeviceFlowClient = {
-      claimSessionByToken: jest.fn(async () => ({ accessToken: ACCESS_TOKEN, sessionId: SESSION_ID })),
-    };
-    const commitSession = jest.fn(async (): Promise<void> => {});
-
-    await expect(
-      completeDeviceFlowSignIn({
-        oxyServices,
-        sessionId: SESSION_ID,
-        sessionToken: SESSION_TOKEN,
-        commitSession,
-      }),
-    ).rejects.toThrow('Device-flow claim did not return a usable session');
-
-    expect(commitSession).not.toHaveBeenCalled();
-  });
-
-  it('propagates a commitSession failure after a successful claim', async () => {
-    const commitError = new Error('session invalid');
-    const oxyServices: DeviceFlowClient = {
-      claimSessionByToken: jest.fn(async () => ({
-        accessToken: ACCESS_TOKEN,
-        sessionId: SESSION_ID,
-        user: USER,
-      })),
-    };
-    const commitSession = jest.fn(async (): Promise<void> => {
-      throw commitError;
-    });
-
-    await expect(
-      completeDeviceFlowSignIn({
-        oxyServices,
-        sessionId: SESSION_ID,
-        sessionToken: SESSION_TOKEN,
-        commitSession,
-      }),
-    ).rejects.toThrow('session invalid');
-
-    expect(oxyServices.claimSessionByToken).toHaveBeenCalledTimes(1);
-    expect(commitSession).toHaveBeenCalledTimes(1);
-  });
-});

package/src/utils/deviceFlowSignIn.ts

@@ -1,152 +0,0 @@
-/**
- * Shared, pure orchestration for completing the cross-app device-flow sign-in
- * (the QR-code / "Open Oxy Auth" path used on native and web).
- *
- * THE FIRST BUG THIS FIXES (native): once another authenticated device
- * approves the pending AuthSession, the originating client is notified
- * (socket / poll / deep-link) with the authorized `sessionId`. Before any
- * session-management code can use it, the client MUST exchange the secret
- * 128-bit `sessionToken` (held only by this client, generated for THIS flow)
- * for the first access token via `claimSessionByToken` — the device-flow
- * equivalent of OAuth's code-for-token exchange (RFC 8628 §3.4).
- *
- * THE SECOND BUG THIS FIXES (session-sync cutover regression): the
- * freshly-claimed session is NOT yet registered in the device's
- * server-authoritative session set — nothing has run
- * `sessionClient.addCurrentAccount()` for it — so it must NOT be committed
- * through `switchSession`. That path is now an account-SWITCH between
- * accounts already registered on this device (`OxyContext`'s
- * `switchSessionForContext`), and throws `No device account found for
- * session "..."` for anything else, surfacing as "Authorization successful
- * but failed to complete sign in." Instead the claimed session must be
- * committed through the SAME path a fresh password sign-in uses —
- * `useOxy().handleWebSession` (`OxyContext`'s `handleWebSSOSession`) — which
- * registers the account into the device set, persists it durably, and
- * hydrates the full user profile.
- *
- * Skipping the claim leaves the SDK with NO bearer token: the session is
- * authorized server-side but the app never becomes authenticated and the UI
- * sits "Waiting for authorization..." forever. Consolidating the
- * claim->commit sequence here keeps native and web identical and
- * unit-testable.
- */
-
-import {
-  KeyManager,
-  type MinimalUserData,
-  type SessionLoginResponse,
-  type User,
-} from '@oxyhq/core';
-
-interface DeviceFlowClaimResult {
-  accessToken?: string;
-  /** Rotating refresh-token family head minted by `/auth/session/claim` on the
-   * trusted lane. Not on the core method's typed return, so read defensively;
-   * threaded into `commitSession` so the QR sign-in persists a durable session
-   * that survives a reload without a redirect. */
-  refreshToken?: string;
-  sessionId?: string;
-  deviceId?: string;
-  expiresAt?: string;
-  user?: User;
-}
-
-/**
- * The minimal `OxyServices` surface this orchestration needs. Kept as a
- * structural type (rather than importing the full client) so the helper is
- * trivially unit-testable with a stub and never pulls the RN/Expo runtime into
- * a test bundle.
- *
- */
-export interface DeviceFlowClient {
-  /**
-   * Exchange the device-flow `sessionToken` for the first access + refresh
-   * token, planting them on the client. Single-use; replay is rejected by the
-   * API. No bearer required — the high-entropy `sessionToken` IS the credential.
-   */
-  claimSessionByToken: (sessionToken: string) => Promise<DeviceFlowClaimResult | undefined>;
-}
-
-export interface CompleteDeviceFlowSignInOptions {
-  /** The OxyServices client (or any object exposing `claimSessionByToken`). */
-  oxyServices: DeviceFlowClient;
-  /** The authorized device session id, delivered by the socket / poll / link. */
-  sessionId: string;
-  /**
-   * The secret `sessionToken` generated for THIS flow and registered via
-   * `POST /auth/session/create`. Required to claim the first access token.
-   */
-  sessionToken: string;
-  /**
-   * `useOxy().handleWebSession` — commits the freshly-claimed session into
-   * context state through the SAME path a password sign-in uses:
-   * registers the account into the device's server-authoritative session set,
-   * persists it durably, and hydrates the full user profile. Runs AFTER the
-   * bearer is planted so its bearer-protected calls succeed.
-   *
-   * The `refreshToken` extra (optional; not on the public `SessionLoginResponse`
-   * type) carries the rotating refresh family so the commit funnel persists a
-   * durable session.
-   */
-  commitSession: (session: SessionLoginResponse & { refreshToken?: string }) => Promise<void>;
-}
-
-/**
- * Complete a device-flow sign-in: claim the first access token with the secret
- * `sessionToken` (planting the bearer), then commit the resulting session via
- * `commitSession` (registers it into the device's server-authoritative session
- * set and hydrates the full user). Returns the authenticated user.
- *
- * Throws if the claim did not return a usable session, or if either the claim
- * or the commit fails; callers surface a retry UI.
- */
-export async function completeDeviceFlowSignIn({
-  oxyServices,
-  sessionId,
-  sessionToken,
-  commitSession,
-}: CompleteDeviceFlowSignInOptions): Promise<User> {
-  // 1) Plant the bearer + refresh tokens. The claim response is also persisted
-  //    to native shared secure storage so a later cold boot has a bearer before
-  //    it validates stored sessions. On web this is a no-op.
-  const claimed = await oxyServices.claimSessionByToken(sessionToken);
-  if (claimed?.accessToken) {
-    await KeyManager.storeSharedSession(claimed.sessionId || sessionId, claimed.accessToken);
-  }
-
-  if (!claimed?.accessToken || !claimed.user) {
-    throw new Error('Device-flow claim did not return a usable session');
-  }
-
-  // `SessionLoginResponse.user` is the minimal session-carried shape (avatar
-  // is `string | undefined`); the claim response returns the full `User`
-  // (avatar is `string | null | undefined`). Normalize rather than widening
-  // `SessionLoginResponse.user` to accept `null`.
-  const minimalUser: MinimalUserData = {
-    id: claimed.user.id,
-    username: claimed.user.username,
-    name: claimed.user.name,
-    avatar: claimed.user.avatar ?? undefined,
-  };
-
-  // 2) Bearer is now planted — commit the session through the same path a
-  //    fresh sign-in uses so it is registered into the device's
-  //    server-authoritative session set instead of an account switch. Thread
-  //    the rotating refresh token so the commit funnel persists a durable
-  //    session that survives a reload.
-  await commitSession({
-    sessionId: claimed.sessionId || sessionId,
-    deviceId: claimed.deviceId ?? '',
-    expiresAt: claimed.expiresAt ?? '',
-    user: minimalUser,
-    accessToken: claimed.accessToken,
-    ...(claimed.refreshToken ? { refreshToken: claimed.refreshToken } : {}),
-  });
-
-  // The commit funnel persisted the rotating refresh family and registered the
-  // account into the device set, so a reload restores the session locally (web:
-  // stored-tokens / same-apex web-session; native: shared keychain) WITHOUT any
-  // IdP `fedcm_session` cookie or top-level establish hop.
-
-  return claimed.user;
-}