@oxyhq/services 17.0.0 → 18.1.0

package/src/ui/context/__tests__/OxyContext.coldBoot.test.tsx

@@ -0,0 +1,165 @@
+/**
+ * `OxyContextProvider` cold-boot opt-out (IdP mode).
+ *
+ * The provider is the ecosystem's device-first session authority by default:
+ * it runs `runSessionColdBoot` on mount and opens the signed-out device-state
+ * socket. The IdP host (`auth.oxy.so`) is NOT a session authority, so it mounts
+ * the provider with `coldBoot={false}` — the cold boot must never run and the
+ * device socket must never open, yet interactive sign-in must still commit a
+ * normal session on that origin.
+ */
+import { render, act, waitFor } from '@testing-library/react';
+import type { ReactNode } from 'react';
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { OxyServices, runSessionColdBoot } from '@oxyhq/core';
+import type { User } from '@oxyhq/core';
+import type { LoginSessionResult } from '@oxyhq/contracts';
+import { OxyContextProvider, useOxy, type OxyContextState } from '../OxyContext';
+import { createSessionClient } from '../../session';
+
+// Spy on the device-first cold boot without touching the rest of core.
+jest.mock('@oxyhq/core', () => {
+  const actual = jest.requireActual('@oxyhq/core');
+  return {
+    __esModule: true,
+    ...actual,
+    runSessionColdBoot: jest.fn(() => Promise.resolve()),
+  };
+});
+
+// Replace the real SessionClient with an inert fake so no socket connects and
+// no network is hit. `getState()` returns null, so `syncFromClient` short-
+// circuits and never reaches profile resolution.
+jest.mock('../../session', () => {
+  const actual = jest.requireActual('../../session');
+  return {
+    __esModule: true,
+    ...actual,
+    createSessionClient: jest.fn(() => {
+      const listeners = new Set<() => void>();
+      const client = {
+        getState: jest.fn(() => null),
+        subscribe: jest.fn((listener: () => void) => {
+          listeners.add(listener);
+          return () => {
+            listeners.delete(listener);
+          };
+        }),
+        start: jest.fn(() => Promise.resolve()),
+        bootstrap: jest.fn(() => Promise.resolve()),
+        addCurrentAccount: jest.fn(() => Promise.resolve()),
+        registerAndActivate: jest.fn(() => Promise.resolve()),
+        switchAccount: jest.fn(() => Promise.resolve()),
+      };
+      const host = { setCurrentAccountId: jest.fn() };
+      return { client, host };
+    }),
+  };
+});
+
+const coldBootMock = runSessionColdBoot as jest.Mock;
+const createSessionClientMock = createSessionClient as jest.Mock;
+
+function renderProvider(props: { coldBoot?: boolean; oxyServices: OxyServices }) {
+  let latest: OxyContextState | null = null;
+  const Probe = (): ReactNode => {
+    latest = useOxy();
+    return null;
+  };
+  const queryClient = new QueryClient({
+    defaultOptions: { queries: { retry: false }, mutations: { retry: false } },
+  });
+  const view = render(
+    <QueryClientProvider client={queryClient}>
+      <OxyContextProvider oxyServices={props.oxyServices} coldBoot={props.coldBoot}>
+        <Probe />
+      </OxyContextProvider>
+    </QueryClientProvider>,
+  );
+  return { ...view, getState: (): OxyContextState | null => latest };
+}
+
+/** The most recently constructed fake SessionClient. */
+function lastSessionClient(): { start: jest.Mock } {
+  const results = createSessionClientMock.mock.results;
+  return results[results.length - 1].value.client as { start: jest.Mock };
+}
+
+beforeEach(() => {
+  coldBootMock.mockClear();
+  createSessionClientMock.mockClear();
+});
+
+describe('OxyContextProvider coldBoot opt-out (IdP mode)', () => {
+  it('coldBoot={false}: never runs the cold boot and resolves auth immediately as signed out', async () => {
+    const oxy = new OxyServices({ baseURL: 'https://api.test.local' });
+    const { getState } = renderProvider({ coldBoot: false, oxyServices: oxy });
+
+    await waitFor(() => {
+      expect(getState()?.isAuthResolved).toBe(true);
+    });
+
+    expect(coldBootMock).not.toHaveBeenCalled();
+    expect(getState()?.isAuthenticated).toBe(false);
+    expect(getState()?.user).toBeNull();
+    // No boot spinner: private-API readiness settles to a definitive "no".
+    expect(getState()?.isPrivateApiPending).toBe(false);
+    expect(getState()?.canUsePrivateApi).toBe(false);
+    // The signed-out device-state socket must never open in IdP mode.
+    expect(lastSessionClient().start).not.toHaveBeenCalled();
+  });
+
+  it('coldBoot={false}: interactive password sign-in still commits a normal session', async () => {
+    const oxy = new OxyServices({ baseURL: 'https://api.test.local' });
+    const loginResult: LoginSessionResult = {
+      sessionId: 's-1',
+      deviceId: 'd-1',
+      expiresAt: new Date(Date.now() + 3_600_000).toISOString(),
+      accessToken: 'access-1',
+      refreshToken: 'refresh-1',
+      user: { id: 'u-1', username: 'alice' },
+    };
+    jest.spyOn(oxy, 'passwordSignIn').mockResolvedValue(loginResult);
+    jest.spyOn(oxy, 'getCurrentUser').mockResolvedValue({
+      id: 'u-1',
+      username: 'alice',
+      name: { displayName: 'Alice' },
+    } as User);
+
+    const { getState } = renderProvider({ coldBoot: false, oxyServices: oxy });
+    await waitFor(() => {
+      expect(getState()?.isAuthResolved).toBe(true);
+    });
+
+    const state = getState();
+    if (!state) {
+      throw new Error('context did not resolve');
+    }
+    await act(async () => {
+      const result = await state.signInWithPassword('alice', 'secret');
+      expect(result.status).toBe('ok');
+    });
+
+    await waitFor(() => {
+      expect(getState()?.isAuthenticated).toBe(true);
+    });
+    expect(getState()?.user?.id).toBe('u-1');
+    expect(oxy.passwordSignIn).toHaveBeenCalledWith(
+      'alice',
+      'secret',
+      expect.objectContaining({ deviceToken: undefined }),
+    );
+  });
+
+  it('default (coldBoot omitted): runs the device-first cold boot', async () => {
+    const oxy = new OxyServices({ baseURL: 'https://api.test.local' });
+    const { getState } = renderProvider({ oxyServices: oxy });
+
+    await waitFor(() => {
+      expect(coldBootMock).toHaveBeenCalledTimes(1);
+    });
+    await waitFor(() => {
+      expect(getState()?.isAuthResolved).toBe(true);
+    });
+  });
+});

package/src/ui/context/hooks/useAuthOperations.ts

@@ -147,11 +147,18 @@ export const useAuthOperations = ({
       if (refreshToken) {
         try {
           const deviceToken = (await store.loadDeviceToken()) ?? undefined;
+          // Phase 2c: mirror the refreshToken handling for the rotating
+          // deviceSecret — persist it with the response's deviceId so the next
+          // cold boot restores via the zero-cookie mint. `SessionLoginResponse`
+          // types neither; read the secret defensively from the runtime payload.
+          const deviceSecret = (sessionResponse as { deviceSecret?: string }).deviceSecret;
           await store.save({
             sessionId: sessionResponse.sessionId,
             refreshToken,
             userId: sessionResponse.user.id,
             ...(deviceToken ? { deviceToken } : {}),
+            ...(sessionResponse.deviceId ? { deviceId: sessionResponse.deviceId } : {}),
+            ...(deviceSecret ? { deviceSecret } : {}),
             ...(sessionResponse.accessToken ? { accessToken: sessionResponse.accessToken } : {}),
             ...(sessionResponse.expiresAt ? { expiresAt: sessionResponse.expiresAt } : {}),
           });

package/src/ui/types/navigation.ts

@@ -72,4 +72,22 @@ export interface OxyProviderProps {
      * @default 'off'
      */
     requireAuth?: 'off' | 'soft' | 'hard';
+    /**
+     * Whether this provider acts as the ecosystem's device-first **session
+     * authority**. `true` (default) runs the full device-first cold boot on
+     * mount (bootstrap-return → stored tokens → shared key / bootstrap hop) and
+     * opens the signed-out device-state socket so an idle tab self-acquires when
+     * a sibling signs in — the correct behavior for every Relying Party app.
+     *
+     * Set `false` for the **IdP host** (`auth.oxy.so`): the IdP is NOT a session
+     * authority (see the handoff "IdP vs RP" section). With `coldBoot={false}`
+     * the provider skips `runSessionColdBoot` entirely and never opens the
+     * signed-out device socket — auth resolves immediately as signed out (no
+     * boot spinner). Interactive sign-in is unaffected: a user who signs in
+     * through this provider (password, 2FA, or the "Sign in with Oxy" QR device
+     * flow) still commits a normal session scoped to this origin, which is all
+     * the IdP needs to drive its OAuth authorize/consent flow.
+     * @default true
+     */
+    coldBoot?: boolean;
 }