@oxyhq/services 16.0.0 → 18.0.0

package/src/ui/context/OxyContext.tsx

@@ -9,6 +9,7 @@ import {
   useState,
   type ReactNode,
 } from 'react';
+import { Linking } from 'react-native';
 import { OxyServices, oxyClient } from '@oxyhq/core';
 import type {
   User,
@@ -19,14 +20,21 @@ import type {
   ClientSession,
   AuthStateStore,
   PersistedAuthState,
+  AccountDialogController,
+  AccountDialogView,
 } from '@oxyhq/core';
 import {
   KeyManager,
   runSessionColdBoot,
   installAuthRefreshHandler,
   startTokenRefreshScheduler,
+  createAccountDialogController,
   logger as loggerUtil,
 } from '@oxyhq/core';
+import {
+  registerAccountDialogControls,
+  notifyAccountDialogVisibility,
+} from '../navigation/accountDialogManager';
 import { useAuthStore, type AuthState } from '../stores/authStore';
 import { useShallow } from 'zustand/react/shallow';
 import type { UseFollowHook } from '../hooks/useFollow.types';
@@ -157,6 +165,22 @@ export interface OxyContextState {
   showBottomSheet?: (screenOrConfig: RouteName | { screen: RouteName; props?: Record<string, unknown> }) => void;
   openAvatarPicker: () => void;
 
+  // Unified account dialog (the single switcher + sign-in surface). The headless
+  // state machine lives in `@oxyhq/core`; `OxyAccountDialog` (mounted by
+  // `OxyProvider`) binds to it. `null` in the no-provider loading state.
+  /** The headless controller driving {@link openAccountDialog}. `null` before mount. */
+  accountDialogController: AccountDialogController | null;
+  /** Whether the unified account dialog is currently presented. */
+  isAccountDialogOpen: boolean;
+  /**
+   * Open the unified account dialog. `accounts` (default) shows the switcher;
+   * `signin` / `add` open the sign-in entry. Replaces every prior device/account
+   * surface and the standalone sign-in modal.
+   */
+  openAccountDialog: (view?: AccountDialogView) => void;
+  /** Dismiss the unified account dialog and cancel any in-flight sign-in flow. */
+  closeAccountDialog: () => void;
+
   // Unified account graph (self, owned orgs/projects/bots, accounts shared with
   // the caller). The cryptographic Commons/DID "identity" is a SEPARATE concept.
   //
@@ -210,6 +234,20 @@ export interface OxyContextProviderProps {
    * for the cross-app device sign-in flow. See {@link OxyContextState.clientId}.
    */
   clientId?: string;
+  /**
+   * Whether this provider is the device-first **session authority**. `true`
+   * (default) runs `runSessionColdBoot` on mount and opens the signed-out
+   * device-state socket — the correct behavior for every Relying Party app.
+   *
+   * `false` is the IdP host (`auth.oxy.so`) opt-out: the IdP is NOT a session
+   * authority (handoff "IdP vs RP"), so it must NOT restore or reproject an
+   * ambient device session. With `coldBoot={false}` the cold boot never runs
+   * and the signed-out device socket never opens; auth resolves immediately as
+   * signed out. Interactive sign-in still commits a normal session on this
+   * origin — only the automatic restore/reproject is suppressed.
+   * @default true
+   */
+  coldBoot?: boolean;
   onAuthStateChange?: (user: User | null) => void;
   onError?: (error: ApiError) => void;
 }
@@ -312,6 +350,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
   authRedirectUri,
   storageKeyPrefix = 'oxy_session',
   clientId: clientIdProp,
+  coldBoot = true,
   onAuthStateChange,
   onError,
 }) => {
@@ -367,6 +406,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
   userRef.current = user;
   isAuthenticatedRef.current = isAuthenticated;
   const [initialized, setInitialized] = useState(false);
+  const [accountDialogOpen, setAccountDialogOpen] = useState(false);
   const setAuthState = useAuthStore.setState;
 
   // Keep the shared `oxyClient` singleton's token store in lockstep with the
@@ -505,18 +545,47 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
   const markAuthResolvedRef = useRef(markAuthResolved);
   markAuthResolvedRef.current = markAuthResolved;
 
+  // Re-boot indirection: the SessionClient is built in the ref initializer below
+  // (before `runColdBoot` is defined), but its `onSessionAppeared` must re-run the
+  // cold boot to self-acquire when a sibling signs in on this device. A ref bridges
+  // the ordering; it is assigned right after `runColdBoot` is declared.
+  const runColdBootRef = useRef<(() => Promise<void>) | null>(null);
+
   // Server-authoritative device session client. Built ONCE per `oxyServices`
   // instance. `onUnauthenticated` (a device signout-all pushed over the socket,
   // or bootstrapped as zero-account) clears the persisted store + local state so
   // a reload does not try to restore a session the device no longer has.
+  // `signedOutSocketAuth` + `onSessionAppeared` power the signed-out sync channel:
+  // an idle tab joins its `device:<id>` room (web via the `oxy_device` cookie,
+  // native via the shared device token) and self-acquires on a sibling sign-in.
   const sessionClientPairRef = useRef<ReturnType<typeof createSessionClient> | null>(null);
   if (!sessionClientPairRef.current) {
-    sessionClientPairRef.current = createSessionClient(oxyServices, authStore, () => {
-      clearPersistedAuthSafe(authStore, logger);
-      void clearSessionStateRef.current().catch((clearError) => {
-        logger('Failed to clear local state on remote sign-out', clearError);
-      });
-    });
+    sessionClientPairRef.current = createSessionClient(
+      oxyServices,
+      authStore,
+      () => {
+        clearPersistedAuthSafe(authStore, logger);
+        void clearSessionStateRef.current().catch((clearError) => {
+          logger('Failed to clear local state on remote sign-out', clearError);
+        });
+      },
+      {
+        signedOutSocketAuth: async () => {
+          // Web (`*.oxy.so`): the first-party `oxy_device` cookie rides the
+          // same-site handshake automatically — just connect.
+          if (isWebBrowser()) return true;
+          // Native (no cookie jar): present the shared device token if we have one.
+          try {
+            return (await authStore.loadDeviceToken()) ?? false;
+          } catch {
+            return false;
+          }
+        },
+        onSessionAppeared: () => {
+          void runColdBootRef.current?.();
+        },
+      },
+    );
   }
   const { client: sessionClient, host: sessionClientHost } = sessionClientPairRef.current;
 
@@ -804,6 +873,61 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     [commitSession],
   );
 
+  // ── Unified account dialog ─────────────────────────────────────────────────
+  // The single account-chooser + sign-in surface. Built ONCE per provider mount
+  // and bound to the live `oxyServices` + `sessionClient` + this provider's
+  // `handleWebSession` commit funnel. `handleWebSession` is threaded through a ref
+  // so the controller keeps a STABLE `commitSession` (rebuilding the controller
+  // on every commit-identity change would drop its subscription + state).
+  const handleWebSessionRef = useRef(handleWebSession);
+  handleWebSessionRef.current = handleWebSession;
+
+  const accountDialogControllerRef = useRef<AccountDialogController | null>(null);
+  if (!accountDialogControllerRef.current) {
+    accountDialogControllerRef.current = createAccountDialogController({
+      oxyServices,
+      sessionClient,
+      clientId,
+      locale: currentLanguage,
+      commitSession: (session) => handleWebSessionRef.current(session),
+      onSignedIn: () => setAccountDialogOpen(false),
+      openUrl: (url) => {
+        void Linking.openURL(url);
+      },
+    });
+  }
+  const accountDialogController = accountDialogControllerRef.current;
+
+  const openAccountDialog = useCallback((view?: AccountDialogView): void => {
+    accountDialogControllerRef.current?.setView(view ?? 'accounts');
+    setAccountDialogOpen(true);
+  }, []);
+
+  const closeAccountDialog = useCallback((): void => {
+    accountDialogControllerRef.current?.cancelSignIn();
+    setAccountDialogOpen(false);
+  }, []);
+
+  // Start driving the dialog on mount; tear it down on unmount.
+  useEffect(() => {
+    const controller = accountDialogControllerRef.current;
+    controller?.start();
+    return () => controller?.destroy();
+  }, []);
+
+  // Expose the live open/close controls to the imperative manager so
+  // `showSignInModal()` (and any app-level imperative "sign in" handler) works.
+  useEffect(
+    () => registerAccountDialogControls({ open: openAccountDialog, close: closeAccountDialog }),
+    [openAccountDialog, closeAccountDialog],
+  );
+
+  // Broadcast visibility so `OxySignInButton`'s "Signing in…" affordance stays
+  // accurate regardless of what opened or dismissed the dialog.
+  useEffect(() => {
+    notifyAccountDialogVisibility(accountDialogOpen);
+  }, [accountDialogOpen]);
+
   // Keyless password sign-in: username/email + password.
   const signInWithPassword = useCallback(
     async (
@@ -908,6 +1032,18 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
         },
         onSignedOut: () => {
           markAuthResolvedRef.current();
+          // Open the signed-out realtime channel so this idle tab joins its
+          // `device:<id>` room (web `oxy_device` cookie / native device token)
+          // and self-acquires when a sibling signs in. Idempotent, best-effort.
+          void sessionClient.start().catch((startError) => {
+            if (__DEV__) {
+              loggerUtil.debug(
+                'signed-out socket start failed (non-fatal)',
+                { component: 'OxyContext', method: 'runColdBoot' },
+                startError as unknown,
+              );
+            }
+          });
         },
         onStepError: (id, error) => {
           if (__DEV__) {
@@ -931,10 +1067,26 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
       // Backstop: resolve on every exit path so the gate can never hang.
       markAuthResolvedRef.current();
     }
-  }, [oxyServices, authStore]);
+  }, [oxyServices, authStore, sessionClient]);
+  // Bridge for `onSessionAppeared` (SessionClient) → re-run the cold boot to
+  // self-acquire when a sibling signs in on this device while this tab is idle.
+  runColdBootRef.current = runColdBoot;
 
   useEffect(() => {
-    if (!storage || initialized) {
+    if (initialized) {
+      return;
+    }
+    // IdP mode (`coldBoot={false}`): this provider is NOT the ecosystem session
+    // authority, so it never runs the device-first restore and never opens the
+    // signed-out device-state socket (`runColdBoot` → `onSignedOut` is the sole
+    // place that socket starts). Resolve auth immediately as signed out so there
+    // is no boot spinner; a deliberate sign-in still commits a normal session.
+    if (!coldBoot) {
+      setInitialized(true);
+      markAuthResolved();
+      return;
+    }
+    if (!storage) {
       return;
     }
     setInitialized(true);
@@ -943,7 +1095,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
         logger('Cold boot failed', error);
       }
     });
-  }, [runColdBoot, storage, initialized, logger]);
+  }, [coldBoot, runColdBoot, storage, initialized, logger, markAuthResolved]);
 
   // Exposed `refreshSessions`: re-bootstrap the server-authoritative device
   // state and reproject — the manual counterpart to the realtime socket.
@@ -1018,6 +1170,9 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
   useEffect(() => {
     if (isAuthenticated && initialized && tokenReady) {
       refreshAccounts();
+      // Reload the dialog's own account graph too, so a session restored OUTSIDE
+      // the dialog (cold boot / password sign-in) surfaces its graph accounts.
+      void accountDialogControllerRef.current?.refresh();
     }
   }, [isAuthenticated, initialized, tokenReady, refreshAccounts]);
 
@@ -1115,6 +1270,10 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
       useFollow: useFollowHook,
       showBottomSheet: showBottomSheetForContext,
       openAvatarPicker,
+      accountDialogController,
+      isAccountDialogOpen: accountDialogOpen,
+      openAccountDialog,
+      closeAccountDialog,
       accounts,
       switchToAccount,
       refreshAccounts,
@@ -1159,6 +1318,10 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
       useFollowHook,
       showBottomSheetForContext,
       openAvatarPicker,
+      accountDialogController,
+      accountDialogOpen,
+      openAccountDialog,
+      closeAccountDialog,
       accounts,
       switchToAccount,
       refreshAccounts,
@@ -1221,6 +1384,10 @@ const LOADING_STATE: OxyContextState = {
   clientId: null,
   oxyServices: LOADING_STATE_OXY_SERVICES,
   openAvatarPicker: () => {},
+  accountDialogController: null,
+  isAccountDialogOpen: false,
+  openAccountDialog: () => {},
+  closeAccountDialog: () => {},
   accounts: [],
   switchToAccount: () => rejectMissingProvider<void>(),
   refreshAccounts: () => rejectMissingProvider<void>(),

package/src/ui/context/__tests__/OxyContext.coldBoot.test.tsx

@@ -0,0 +1,165 @@
+/**
+ * `OxyContextProvider` cold-boot opt-out (IdP mode).
+ *
+ * The provider is the ecosystem's device-first session authority by default:
+ * it runs `runSessionColdBoot` on mount and opens the signed-out device-state
+ * socket. The IdP host (`auth.oxy.so`) is NOT a session authority, so it mounts
+ * the provider with `coldBoot={false}` — the cold boot must never run and the
+ * device socket must never open, yet interactive sign-in must still commit a
+ * normal session on that origin.
+ */
+import { render, act, waitFor } from '@testing-library/react';
+import type { ReactNode } from 'react';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { OxyServices, runSessionColdBoot } from '@oxyhq/core';
+import type { User } from '@oxyhq/core';
+import type { LoginSessionResult } from '@oxyhq/contracts';
+import { OxyContextProvider, useOxy, type OxyContextState } from '../OxyContext';
+import { createSessionClient } from '../../session';
+
+// Spy on the device-first cold boot without touching the rest of core.
+jest.mock('@oxyhq/core', () => {
+  const actual = jest.requireActual('@oxyhq/core');
+  return {
+    __esModule: true,
+    ...actual,
+    runSessionColdBoot: jest.fn(() => Promise.resolve()),
+  };
+});
+
+// Replace the real SessionClient with an inert fake so no socket connects and
+// no network is hit. `getState()` returns null, so `syncFromClient` short-
+// circuits and never reaches profile resolution.
+jest.mock('../../session', () => {
+  const actual = jest.requireActual('../../session');
+  return {
+    __esModule: true,
+    ...actual,
+    createSessionClient: jest.fn(() => {
+      const listeners = new Set<() => void>();
+      const client = {
+        getState: jest.fn(() => null),
+        subscribe: jest.fn((listener: () => void) => {
+          listeners.add(listener);
+          return () => {
+            listeners.delete(listener);
+          };
+        }),
+        start: jest.fn(() => Promise.resolve()),
+        bootstrap: jest.fn(() => Promise.resolve()),
+        addCurrentAccount: jest.fn(() => Promise.resolve()),
+        registerAndActivate: jest.fn(() => Promise.resolve()),
+        switchAccount: jest.fn(() => Promise.resolve()),
+      };
+      const host = { setCurrentAccountId: jest.fn() };
+      return { client, host };
+    }),
+  };
+});
+
+const coldBootMock = runSessionColdBoot as jest.Mock;
+const createSessionClientMock = createSessionClient as jest.Mock;
+
+function renderProvider(props: { coldBoot?: boolean; oxyServices: OxyServices }) {
+  let latest: OxyContextState | null = null;
+  const Probe = (): ReactNode => {
+    latest = useOxy();
+    return null;
+  };
+  const queryClient = new QueryClient({
+    defaultOptions: { queries: { retry: false }, mutations: { retry: false } },
+  });
+  const view = render(
+    <QueryClientProvider client={queryClient}>
+      <OxyContextProvider oxyServices={props.oxyServices} coldBoot={props.coldBoot}>
+        <Probe />
+      </OxyContextProvider>
+    </QueryClientProvider>,
+  );
+  return { ...view, getState: (): OxyContextState | null => latest };
+}
+
+/** The most recently constructed fake SessionClient. */
+function lastSessionClient(): { start: jest.Mock } {
+  const results = createSessionClientMock.mock.results;
+  return results[results.length - 1].value.client as { start: jest.Mock };
+}
+
+beforeEach(() => {
+  coldBootMock.mockClear();
+  createSessionClientMock.mockClear();
+});
+
+describe('OxyContextProvider coldBoot opt-out (IdP mode)', () => {
+  it('coldBoot={false}: never runs the cold boot and resolves auth immediately as signed out', async () => {
+    const oxy = new OxyServices({ baseURL: 'https://api.test.local' });
+    const { getState } = renderProvider({ coldBoot: false, oxyServices: oxy });
+
+    await waitFor(() => {
+      expect(getState()?.isAuthResolved).toBe(true);
+    });
+
+    expect(coldBootMock).not.toHaveBeenCalled();
+    expect(getState()?.isAuthenticated).toBe(false);
+    expect(getState()?.user).toBeNull();
+    // No boot spinner: private-API readiness settles to a definitive "no".
+    expect(getState()?.isPrivateApiPending).toBe(false);
+    expect(getState()?.canUsePrivateApi).toBe(false);
+    // The signed-out device-state socket must never open in IdP mode.
+    expect(lastSessionClient().start).not.toHaveBeenCalled();
+  });
+
+  it('coldBoot={false}: interactive password sign-in still commits a normal session', async () => {
+    const oxy = new OxyServices({ baseURL: 'https://api.test.local' });
+    const loginResult: LoginSessionResult = {
+      sessionId: 's-1',
+      deviceId: 'd-1',
+      expiresAt: new Date(Date.now() + 3_600_000).toISOString(),
+      accessToken: 'access-1',
+      refreshToken: 'refresh-1',
+      user: { id: 'u-1', username: 'alice' },
+    };
+    jest.spyOn(oxy, 'passwordSignIn').mockResolvedValue(loginResult);
+    jest.spyOn(oxy, 'getCurrentUser').mockResolvedValue({
+      id: 'u-1',
+      username: 'alice',
+      name: { displayName: 'Alice' },
+    } as User);
+
+    const { getState } = renderProvider({ coldBoot: false, oxyServices: oxy });
+    await waitFor(() => {
+      expect(getState()?.isAuthResolved).toBe(true);
+    });
+
+    const state = getState();
+    if (!state) {
+      throw new Error('context did not resolve');
+    }
+    await act(async () => {
+      const result = await state.signInWithPassword('alice', 'secret');
+      expect(result.status).toBe('ok');
+    });
+
+    await waitFor(() => {
+      expect(getState()?.isAuthenticated).toBe(true);
+    });
+    expect(getState()?.user?.id).toBe('u-1');
+    expect(oxy.passwordSignIn).toHaveBeenCalledWith(
+      'alice',
+      'secret',
+      expect.objectContaining({ deviceToken: undefined }),
+    );
+  });
+
+  it('default (coldBoot omitted): runs the device-first cold boot', async () => {
+    const oxy = new OxyServices({ baseURL: 'https://api.test.local' });
+    const { getState } = renderProvider({ oxyServices: oxy });
+
+    await waitFor(() => {
+      expect(coldBootMock).toHaveBeenCalledTimes(1);
+    });
+    await waitFor(() => {
+      expect(getState()?.isAuthResolved).toBe(true);
+    });
+  });
+});

package/src/ui/hooks/mutations/useAccountMutations.ts

@@ -109,7 +109,7 @@ export const useUpdateProfile = () => {
         refreshAvatarInStore(activeSessionId, updates.avatar, oxyServices);
       }
 
-      // Invalidate all related queries so every consumer (AccountSwitcher,
+      // Invalidate all related queries so every consumer (the account dialog,
       // session lists, managed accounts, etc.) refetches the fresh profile.
       // This is critical right after `username` is set the first time, when
       // every cached "session profile" still reports the user as unnamed.

package/src/ui/hooks/useAuth.ts

@@ -23,11 +23,10 @@
  * - Manual sign-in: signIn() redirects to the IdP (web) or opens the auth sheet (native)
  */
 
-import { useCallback, useState } from 'react';
+import { useCallback } from 'react';
 import { useOxy } from '../context/OxyContext';
 import type { User } from '@oxyhq/core';
 import { isWebBrowser } from '../utils/isWebBrowser';
-import { showSignInModal } from '../components/SignInModal';
 
 export interface AuthState {
   /** Current authenticated user, null if not authenticated */
@@ -138,44 +137,33 @@ export function useAuth(): UseAuthReturn {
     getPublicKey,
     showBottomSheet,
     openAvatarPicker,
+    openAccountDialog,
   } = useOxy();
 
   const signIn = useCallback(async (publicKey?: string): Promise<User> => {
-    // Web (no key): open the in-app "Sign in with Oxy" modal. There is NO
-    // automatic navigation to any login page — the device-first cold boot
-    // already restored a session if one existed; an explicit click presents the
-    // SDK sign-in surface (password / QR device flow / add account).
-    if (isWebBrowser() && !publicKey) {
-      showSignInModal();
-      // Resolves when the modal commits a session; the caller typically reacts
-      // to `isAuthenticated` rather than this promise.
-      return new Promise<User>(() => undefined);
-    }
-
-    // Native: use the cryptographic identity directly when a public key is given.
+    // Native: sign in directly with the cryptographic identity when a public key
+    // is provided, or an existing keychain identity is found.
     if (publicKey) {
       return oxySignIn(publicKey);
     }
-
-    // Native with an existing keychain identity: sign in with it.
-    const hasExisting = await hasIdentity();
-    if (hasExisting) {
-      const existingKey = await getPublicKey();
-      if (existingKey) {
-        return oxySignIn(existingKey);
+    if (!isWebBrowser()) {
+      const hasExisting = await hasIdentity();
+      if (hasExisting) {
+        const existingKey = await getPublicKey();
+        if (existingKey) {
+          return oxySignIn(existingKey);
+        }
       }
     }
 
-    // Native with no identity: open the auth sheet (password / QR device flow).
-    if (showBottomSheet) {
-      showBottomSheet('OxyAuth');
-      return new Promise((_, reject) => {
-        reject(new Error('Please complete sign-in in the auth sheet'));
-      });
-    }
-
-    throw new Error('No authentication method available');
-  }, [oxySignIn, hasIdentity, getPublicKey, showBottomSheet]);
+    // Web, or native without a keychain identity: open the unified account dialog
+    // on its sign-in view (device flow / QR / password hand-off). There is NO
+    // automatic navigation to a login page — the device-first cold boot already
+    // restored a session if one existed. The caller reacts to `isAuthenticated`,
+    // so this promise intentionally never resolves.
+    openAccountDialog('signin');
+    return new Promise<User>(() => undefined);
+  }, [oxySignIn, hasIdentity, getPublicKey, openAccountDialog]);
 
   const signOut = useCallback(async (): Promise<void> => {
     await logout();