@oxyhq/services 18.0.0 → 19.0.0

package/src/ui/context/__tests__/OxyContext.coldBoot.test.tsx

@@ -2,11 +2,11 @@
  * `OxyContextProvider` cold-boot opt-out (IdP mode).
  *
  * The provider is the ecosystem's device-first session authority by default:
- * it runs `runSessionColdBoot` on mount and opens the signed-out device-state
- * socket. The IdP host (`auth.oxy.so`) is NOT a session authority, so it mounts
- * the provider with `coldBoot={false}` — the cold boot must never run and the
- * device socket must never open, yet interactive sign-in must still commit a
- * normal session on that origin.
+ * it runs `runSessionColdBoot` on mount. The IdP host (`auth.oxy.so`) is NOT a
+ * session authority, so it mounts the provider with `coldBoot={false}` — the
+ * cold boot must never run (so the bearer-authenticated device socket never
+ * starts), yet interactive sign-in must still commit a normal session on that
+ * origin.
  */
 import { render, act, waitFor } from '@testing-library/react';
 import type { ReactNode } from 'react';
@@ -105,7 +105,8 @@ describe('OxyContextProvider coldBoot opt-out (IdP mode)', () => {
     // No boot spinner: private-API readiness settles to a definitive "no".
     expect(getState()?.isPrivateApiPending).toBe(false);
     expect(getState()?.canUsePrivateApi).toBe(false);
-    // The signed-out device-state socket must never open in IdP mode.
+    // IdP mode never runs the cold boot and never signs in, so the device
+    // socket is never started.
     expect(lastSessionClient().start).not.toHaveBeenCalled();
   });
 
@@ -116,7 +117,7 @@ describe('OxyContextProvider coldBoot opt-out (IdP mode)', () => {
       deviceId: 'd-1',
       expiresAt: new Date(Date.now() + 3_600_000).toISOString(),
       accessToken: 'access-1',
-      refreshToken: 'refresh-1',
+      deviceSecret: 'ds-1',
       user: { id: 'u-1', username: 'alice' },
     };
     jest.spyOn(oxy, 'passwordSignIn').mockResolvedValue(loginResult);
@@ -144,11 +145,11 @@ describe('OxyContextProvider coldBoot opt-out (IdP mode)', () => {
       expect(getState()?.isAuthenticated).toBe(true);
     });
     expect(getState()?.user?.id).toBe('u-1');
-    expect(oxy.passwordSignIn).toHaveBeenCalledWith(
-      'alice',
-      'secret',
-      expect.objectContaining({ deviceToken: undefined }),
-    );
+    // Zero-cookie cutover: no `deviceToken` is threaded into `passwordSignIn`.
+    expect(oxy.passwordSignIn).toHaveBeenCalledWith('alice', 'secret', {
+      deviceName: undefined,
+      deviceFingerprint: undefined,
+    });
   });
 
   it('default (coldBoot omitted): runs the device-first cold boot', async () => {

package/src/ui/context/hooks/useAuthOperations.ts

@@ -15,10 +15,9 @@ export interface UseAuthOperationsOptions {
   /**
    * The device-first persisted auth-state store. On EXPLICIT full sign-out the
    * session blob is cleared (`store.clear()`) so a reload's cold boot finds no
-   * refresh family to restore; on sign-in a returned rotating refresh token is
-   * persisted so the next boot warm-restores without a redirect. The long-lived
-   * device token SURVIVES sign-out (the device is unchanged), so it is never
-   * cleared here.
+   * device credential to restore; on sign-in the returned zero-cookie device
+   * credential (`deviceId` + `deviceSecret`) is persisted so the next boot
+   * warm-restores without a redirect.
    */
   store: AuthStateStore;
   activeSessionId: string | null;
@@ -61,7 +60,7 @@ const LOGOUT_ERROR_CODE = 'LOGOUT_ERROR';
 const LOGOUT_ALL_ERROR_CODE = 'LOGOUT_ALL_ERROR';
 
 /**
- * Clear the persisted refresh-token family on an explicit full sign-out.
+ * Clear the persisted device credential on an explicit full sign-out.
  * Best-effort and non-blocking: sign-out must never fail because a storage
  * write threw. Exported so `OxyContext`'s zero-account branch (a REMOTE full
  * sign-out pushed over the socket) runs the EXACT same cleanup as the local
@@ -136,22 +135,21 @@ export const useAuthOperations = ({
         deviceFingerprint,
       );
 
-      // Persist the per-origin refresh family so a reload warm-restores this
+      // Persist the durable device credential so a reload warm-restores this
       // session without a redirect. `verifyChallenge` plants the access token
-      // internally; when the (trusted-lane) response also carries a rotating
-      // refresh token, persist the durable blob. Best-effort — a failed persist
-      // never fails the sign-in (native additionally re-mints via the shared
-      // keychain on the next cold boot). `SessionLoginResponse` does not type
-      // `refreshToken`; read it defensively from the runtime payload.
-      const refreshToken = (sessionResponse as { refreshToken?: string }).refreshToken;
-      if (refreshToken) {
+      // internally; when the response also carries the zero-cookie device
+      // credential (`deviceId` + `deviceSecret`), persist the durable blob so the
+      // next cold boot re-mints an access token from it. Best-effort — a failed
+      // persist never fails the sign-in. `SessionLoginResponse` does not type
+      // `deviceSecret`; read it defensively from the runtime payload.
+      const deviceSecret = (sessionResponse as { deviceSecret?: string }).deviceSecret;
+      if (sessionResponse.deviceId && deviceSecret) {
         try {
-          const deviceToken = (await store.loadDeviceToken()) ?? undefined;
           await store.save({
             sessionId: sessionResponse.sessionId,
-            refreshToken,
             userId: sessionResponse.user.id,
-            ...(deviceToken ? { deviceToken } : {}),
+            deviceId: sessionResponse.deviceId,
+            deviceSecret,
             ...(sessionResponse.accessToken ? { accessToken: sessionResponse.accessToken } : {}),
             ...(sessionResponse.expiresAt ? { expiresAt: sessionResponse.expiresAt } : {}),
           });
@@ -302,7 +300,7 @@ export const useAuthOperations = ({
 
         if (sessionToLogout === activeSessionId && remainingAccounts.length === 0) {
           // Genuine FULL sign-out (no sessions remain): clear the persisted
-          // refresh family so a reload's cold boot finds nothing to restore,
+          // device credential so a reload's cold boot finds nothing to restore,
           // then tear down local state.
           clearPersistedAuthSafe(store, logger);
           await clearSessionState();
@@ -356,9 +354,9 @@ export const useAuthOperations = ({
       // `{ all: true }`) — replaces the bearer `logoutAllSessions` +
       // web-cookie `logoutAllSessionsViaCookie` pair.
       await sessionClient.signOut({ all: true });
-      // logoutAll is ALWAYS a full sign-out: clear the persisted refresh family
-      // so the next cold boot finds no session to restore, then tear down local
-      // state. The long-lived device token survives (the device is unchanged).
+      // logoutAll is ALWAYS a full sign-out: clear the persisted device
+      // credential so the next cold boot finds no session to restore, then tear
+      // down local state.
       clearPersistedAuthSafe(store, logger);
       await clearSessionState();
     } catch (error) {

package/src/ui/session/__tests__/createSessionClient.test.ts

@@ -16,12 +16,14 @@ jest.mock('socket.io-client', () => ({ __esModule: true, io: (...args: unknown[]
 
 import { createSessionClient } from '../createSessionClient';
 
+// Sockets are bearer-only: `start()` opens a socket only when a bearer token is
+// held. This mock reports one so the wiring test exercises the socket factory.
 function fakeOxy() {
   const listeners = new Set<(t: string | null) => void>();
   return {
     makeRequest: jest.fn().mockResolvedValue(undefined),
     getBaseURL: jest.fn().mockReturnValue('https://api.oxy.so'),
-    getAccessToken: jest.fn().mockReturnValue(null),
+    getAccessToken: jest.fn().mockReturnValue('bearer.jwt.token'),
     setTokens: jest.fn(),
     onTokensChanged: jest.fn((l: (t: string | null) => void) => {
       listeners.add(l);

package/src/ui/session/__tests__/tokenTransport.test.ts

@@ -2,11 +2,12 @@ import type { DeviceSessionState } from '@oxyhq/contracts';
 import { logger, createMemoryAuthStateStore, refreshPersistedSession } from '@oxyhq/core';
 import { createTokenTransport } from '../tokenTransport';
 
-// The device-first transport mints a fallback token by rotating the persisted
-// refresh family via `refreshPersistedSession` (the ONE unified refresh path) —
-// there is no `silentSignIn`/`signInWithSharedIdentity` arm anymore. Mock that
-// one core function so the transport's own coalescing / logging contract can be
-// exercised in isolation; keep the real `logger` + memory store.
+// The device-first transport mints a fallback token from the persisted
+// zero-cookie device credential via `refreshPersistedSession` (the ONE unified
+// refresh path) — there is no `silentSignIn`/`signInWithSharedIdentity` arm
+// anymore. Mock that one core function so the transport's own coalescing /
+// logging contract can be exercised in isolation; keep the real `logger` +
+// memory store.
 jest.mock('@oxyhq/core', () => {
   const actual = jest.requireActual('@oxyhq/core');
   return { __esModule: true, ...actual, refreshPersistedSession: jest.fn() };

package/src/ui/session/authStore.ts

@@ -1,18 +1,16 @@
 /**
  * Platform `AuthStateStore` for `@oxyhq/services`.
  *
- * The device-first session model persists the rotating refresh-token family
- * head per origin (web) / per device (native). `@oxyhq/core` owns the store
- * shape + logic (`createWebAuthStateStore` / `createNativeAuthStateStore`); this
- * module only supplies the platform storage seam and wires the native device
- * token to the SHARED keychain so every native Oxy app joins one DeviceSession:
+ * The zero-cookie device model persists the durable device credential
+ * (`deviceId` + `deviceSecret`) per origin (web) / per device (native), and the
+ * SDK re-mints the access token from that credential on cold boot. `@oxyhq/core`
+ * owns the store shape + logic (`createWebAuthStateStore` /
+ * `createNativeAuthStateStore`); this module only supplies the platform storage
+ * seam:
  *
  *  - web  → `createWebAuthStateStore()` (localStorage, in-memory fallback).
- *  - native → `createNativeAuthStateStore(secureKV)` for the SESSION blob
- *    (refresh token) over `expo-secure-store` (AsyncStorage fallback), with the
- *    long-lived DEVICE token delegated to `KeyManager`'s shared keychain
- *    (`group.so.oxy.shared`) instead of per-app storage — so an in-app login on
- *    any native Oxy app attributes to the SAME server-side DeviceSession.
+ *  - native → `createNativeAuthStateStore(secureKV)` for the SESSION blob over
+ *    `expo-secure-store` (AsyncStorage fallback).
  *
  * `expo-secure-store` is loaded via a runtime-computed dynamic import (the same
  * optional-native-module pattern `OxyProvider` uses for netinfo / keyboard
@@ -20,12 +18,10 @@
  * back to AsyncStorage rather than crashing.
  */
 import {
-  KeyManager,
   createWebAuthStateStore,
   createNativeAuthStateStore,
   type AuthStateStore,
   type NativeKeyValueStorage,
-  logger,
 } from '@oxyhq/core';
 import { createPlatformStorage, isReactNative } from '../utils/storageHelpers';
 
@@ -112,53 +108,14 @@ function createNativeSecureKeyValueStorage(): NativeKeyValueStorage {
 /**
  * Build the platform {@link AuthStateStore} for this runtime.
  *
- * Native additionally routes the device token through the shared keychain so
- * every native Oxy app shares one server-side DeviceSession; the session blob
- * (refresh token) stays per-app in SecureStore. Best-effort keychain access —
- * a locked/failed shared-keychain read degrades to "no device token" rather
- * than throwing out of cold boot / refresh.
+ * Native persists the SESSION blob (`deviceId` + `deviceSecret` + cached access
+ * token) per-app in SecureStore; the SDK re-mints the access token from the
+ * device credential on the next cold boot.
  */
 export function createPlatformAuthStateStore(): AuthStateStore {
   if (!isReactNative()) {
     return createWebAuthStateStore();
   }
 
-  const base = createNativeAuthStateStore(createNativeSecureKeyValueStorage());
-  return {
-    ...base,
-    loadDeviceToken: async () => {
-      try {
-        return await KeyManager.getSharedDeviceToken();
-      } catch (error) {
-        logger.debug(
-          'Shared device-token read failed (treating as none)',
-          { component: 'authStore', method: 'loadDeviceToken' },
-          error,
-        );
-        return null;
-      }
-    },
-    saveDeviceToken: async (token) => {
-      try {
-        await KeyManager.setSharedDeviceToken(token);
-      } catch (error) {
-        logger.debug(
-          'Shared device-token write failed (non-fatal)',
-          { component: 'authStore', method: 'saveDeviceToken' },
-          error,
-        );
-      }
-    },
-    clearDeviceToken: async () => {
-      try {
-        await KeyManager.clearSharedDeviceToken();
-      } catch (error) {
-        logger.debug(
-          'Shared device-token clear failed (non-fatal)',
-          { component: 'authStore', method: 'clearDeviceToken' },
-          error,
-        );
-      }
-    },
-  };
+  return createNativeAuthStateStore(createNativeSecureKeyValueStorage());
 }

package/src/ui/session/createSessionClient.ts

@@ -4,7 +4,6 @@ import {
   createSessionClientHost,
   type AuthStateStore,
   type OxyServices,
-  type SessionClientOptions,
 } from '@oxyhq/core';
 import { createTokenTransport } from './tokenTransport';
 
@@ -20,31 +19,27 @@ import { createTokenTransport } from './tokenTransport';
  *    core's lazy dynamic import of a bare specifier — bundler-fragile in
  *    Metro/Expo-web against the published core dist.
  *  - the device-first {@link createTokenTransport}, which mints a fallback token
- *    by rotating the persisted refresh family (`store`).
+ *    from the persisted device credential (`store` → `deviceId` + `deviceSecret`).
  *
  * `onUnauthenticated` fires when an applied device state has zero accounts (a
  * device signout-all): the provider clears the persisted store + local state so
  * a reload does not try to restore a dead session. The host is returned
  * alongside the client so the caller can call `host.setCurrentAccountId(...)`
  * as the active account changes.
+ *
+ * The realtime socket is bearer-only: a signed-out tab cannot join any device
+ * room, so there is no signed-out socket wiring.
  */
 export function createSessionClient(
   oxyServices: OxyServices,
   store: AuthStateStore,
   onUnauthenticated?: () => void,
-  /**
-   * Optional signed-out realtime wiring: `signedOutSocketAuth` (open the socket
-   * while signed out — web returns `true` to ride the `oxy_device` cookie,
-   * native returns the shared device token) and `onSessionAppeared` (self-acquire
-   * when a sibling signs in on this device).
-   */
-  extra?: Pick<SessionClientOptions, 'signedOutSocketAuth' | 'onSessionAppeared'>,
 ): {
   client: SessionClient;
   host: ReturnType<typeof createSessionClientHost>;
 } {
   const host = createSessionClientHost(oxyServices);
   const transport = createTokenTransport(oxyServices, store);
-  const client = new SessionClient(host, { transport, socketFactory: io, onUnauthenticated, ...extra });
+  const client = new SessionClient(host, { transport, socketFactory: io, onUnauthenticated });
   return { client, host };
 }

package/src/ui/session/tokenTransport.ts

@@ -13,10 +13,9 @@ import type { DeviceSessionState } from '@oxyhq/contracts';
  * `ensureActiveToken` is the fallback the client uses when a `session_state`
  * push arrived WITHOUT an embedded `activeToken` and the app currently holds no
  * bearer. It mints one through the ONE unified refresh path
- * (`refreshPersistedSession`): rotate the persisted refresh-token family
- * (`POST /auth/refresh-token`) and, on native, fall back to the shared-keychain
- * re-mint. There is no FedCM/silent-iframe arm anymore — the per-origin
- * persisted refresh token is the durable web credential.
+ * (`refreshPersistedSession`), which presents the persisted zero-cookie device
+ * credential (`deviceId` + `deviceSecret`) at `POST /session/device/token`. The
+ * persisted device credential is the sole durable restore credential.
  *
  * Concurrent pushes coalesce onto one in-flight mint. A failure is logged and
  * swallowed: this method must never throw out (it runs inside the socket state