@oxyhq/services 19.0.0 → 19.1.0

package/lib/module/ui/context/OxyContext.js

@@ -3,8 +3,12 @@
 import { createContext, useCallback, useContext, useEffect, useMemo, useRef, useState } from 'react';
 import { Linking } from 'react-native';
 import { OxyServices, oxyClient } from '@oxyhq/core';
-import { KeyManager, runSessionColdBoot, installAuthRefreshHandler, startTokenRefreshScheduler, createAccountDialogController, logger as loggerUtil } from '@oxyhq/core';
+import { KeyManager, installAuthRefreshHandler, startTokenRefreshScheduler, createAccountDialogController, refreshPersistedSession, logger as loggerUtil, syncHubAfterSignIn } from '@oxyhq/core';
 import { registerAccountDialogControls, notifyAccountDialogVisibility } from "../navigation/accountDialogManager.js";
+import { redirectToAuthorize } from "../components/oauthNavigation.js";
+import { isWebBrowser } from "../utils/isWebBrowser.js";
+import { runProviderColdBoot } from "../boot/runProviderColdBoot.js";
+import { loadPersistedDeviceCredential } from "../utils/deviceCredential.js";
 import { useAuthStore } from "../stores/authStore.js";
 import { useShallow } from 'zustand/react/shallow';
 import { useLanguageManagement } from "../hooks/useLanguageManagement.js";
@@ -17,99 +21,11 @@ import { useQueryClient } from '@tanstack/react-query';
 import { clearQueryCache } from "../hooks/queryClient.js";
 import { useAvatarPicker } from "../hooks/useAvatarPicker.js";
 import { useAccountStore } from "../stores/accountStore.js";
-import { isWebBrowser } from "../utils/isWebBrowser.js";
 import { createSessionClient, createPlatformAuthStateStore, deviceStateToClientSessions, activeSessionIdOf, activeUserOf, accountIdsOf } from "../session/index.js";
+import { DEFAULT_SESSION_VALIDITY_MS, loadUseFollowHook } from "./oxyContextHelpers.js";
+import { useOxyAccountGraph } from "./useOxyAccountGraph.js";
 import { jsx as _jsx } from "react/jsx-runtime";
 const OxyContext = /*#__PURE__*/createContext(null);
-
-/**
- * Result of {@link OxyContextState.signInWithPassword}.
- *
- * `'ok'` — the password was accepted and the session committed (so
- * `isAuthenticated` / `user` are updated and the device credential persisted).
- * `securityAlert` is present when the server flagged this sign-in as anomalous
- * (new device / location) — the caller shows a "New sign-in detected"
- * acknowledgement before proceeding; the session is already committed.
- *
- * `'2fa_required'` — the account has two-factor auth enabled, so NO session was
- * created. Complete the challenge with the returned short-lived `loginToken`
- * via {@link OxyContextState.completeTwoFactorSignIn}.
- */
-
-/**
- * Fallback client-session validity window (ms) — 7 days — applied when a
- * committed session does not carry an explicit `expiresAt`. This is only a
- * local display hint for the multi-session store; the server remains the source
- * of truth for actual session expiry.
- */
-const DEFAULT_SESSION_VALIDITY_MS = 7 * 24 * 60 * 60 * 1000;
-
-/**
- * How long the cold boot WAITS for the post-boot SessionClient handoff
- * (`addCurrentAccount` + `start` + `syncFromClient`) before it resolves auth and
- * stops blocking. Once a boot step planted a token the user is already
- * authenticated — the handoff only populates the multi-account set and the
- * server-authoritative active account, and those also arrive via the socket
- * subscription. So on a slow backend we stop AWAITING the handoff here (it keeps
- * running in the background and projects when it lands) rather than delaying
- * auth resolution.
- */
-const SESSION_HANDOFF_DEADLINE = 6000;
-
-/** The internal commit input — a session plus the zero-cookie device credential
- * (`deviceId` + `deviceSecret`) that is not on the public `SessionLoginResponse`.
- * All extras optional so `SessionLoginResponse` is assignable. */
-
-function getHttpStatus(error) {
-  if (!error || typeof error !== 'object') {
-    return undefined;
-  }
-  if ('status' in error) {
-    const status = error.status;
-    if (typeof status === 'number') {
-      return status;
-    }
-  }
-  if ('response' in error) {
-    const response = error.response;
-    if (response && typeof response === 'object' && 'status' in response) {
-      const status = response.status;
-      if (typeof status === 'number') {
-        return status;
-      }
-    }
-  }
-  return undefined;
-}
-function isUnauthorizedStatus(error) {
-  return getHttpStatus(error) === 401;
-}
-let cachedUseFollowHook = null;
-const loadUseFollowHook = () => {
-  if (cachedUseFollowHook) {
-    return cachedUseFollowHook;
-  }
-  try {
-    // eslint-disable-next-line @typescript-eslint/no-var-requires
-    const {
-      useFollow
-    } = require('../hooks/useFollow');
-    cachedUseFollowHook = useFollow;
-    return cachedUseFollowHook;
-  } catch (error) {
-    if (__DEV__) {
-      loggerUtil.warn('useFollow hook is not available. Please import useFollow from @oxyhq/services directly.', {
-        component: 'OxyContext',
-        method: 'loadUseFollowHook'
-      }, error);
-    }
-    const fallback = () => {
-      throw new Error('useFollow hook is only available in the UI bundle. Import it from @oxyhq/services.');
-    };
-    cachedUseFollowHook = fallback;
-    return cachedUseFollowHook;
-  }
-};
 export const OxyProvider = ({
   children,
   oxyServices: providedOxyServices,
@@ -118,7 +34,7 @@ export const OxyProvider = ({
   authRedirectUri,
   storageKeyPrefix = 'oxy_session',
   clientId: clientIdProp,
-  coldBoot = true,
+  hubSync = true,
   onAuthStateChange,
   onError
 }) => {
@@ -316,12 +232,9 @@ export const OxyProvider = ({
   markAuthResolvedRef.current = markAuthResolved;
 
   // Server-authoritative device session client. Built ONCE per `oxyServices`
-  // instance. `onUnauthenticated` (a device signout-all pushed over the
-  // bearer-authenticated socket, or bootstrapped as zero-account) clears the
-  // persisted store + local state so a reload does not try to restore a session
-  // the device no longer has. The realtime socket is bearer-only now: a
-  // signed-out tab cannot join any device room, so there is no signed-out sync
-  // wiring here.
+  // instance. Device-scoped sockets connect with deviceId+deviceSecret when no
+  // bearer is planted yet, so cross-origin apps sync via `session_state` after
+  // the one-shot join redirect.
   const sessionClientPairRef = useRef(null);
   if (!sessionClientPairRef.current) {
     sessionClientPairRef.current = createSessionClient(oxyServices, authStore, () => {
@@ -376,6 +289,10 @@ export const OxyProvider = ({
   }, [oxyServices, sessionClient, sessionClientHost, authStore, updateSessions, setActiveSessionId, loginSuccess, clearSessionState, logger]);
   const syncFromClientRef = useRef(syncFromClient);
   syncFromClientRef.current = syncFromClient;
+  const syncDeviceCredentialToHost = useCallback(async () => {
+    const cred = await loadPersistedDeviceCredential(authStore);
+    sessionClientHost.setDeviceCredential(cred);
+  }, [authStore, sessionClientHost]);
   useEffect(() => {
     return sessionClient.subscribe(() => {
       void syncFromClient();
@@ -406,6 +323,15 @@ export const OxyProvider = ({
     setAuthState,
     logger
   });
+
+  // "That wasn't me": repudiating a flagged sign-in IS revoking the device
+  // session that just committed — the same server-authoritative
+  // `sessionClient.signOut(...)` path `logout` uses, which also clears the
+  // persisted device credential + local state when no sibling account remains.
+  // No dedicated "report suspicious" API endpoint exists (or is needed).
+  const revokeSuspiciousSignIn = useCallback(async () => {
+    await logout();
+  }, [logout]);
   const clearAllAccountData = useCallback(async () => {
     queryClient.clear();
     if (storage) {
@@ -447,6 +373,9 @@ export const OxyProvider = ({
       setHasAccessToken(Boolean(accessToken));
       if (accessToken) {
         setTokenReady(true);
+        if (sessionClient.getState()?.accounts.length) {
+          void syncFromClientRef.current();
+        }
         return;
       }
       if (userRef.current || isAuthenticatedRef.current) {
@@ -501,15 +430,13 @@ export const OxyProvider = ({
       oxyServices.setTokens(input.accessToken);
     }
 
-    // Persist the durable blob when the zero-cookie device credential
-    // (`deviceId` + `deviceSecret`) is present. The cold boot has usually
-    // persisted already; this is idempotent. Without the credential there is
-    // nothing durable to persist and the session lives only for this runtime.
-    if (input.deviceId && input.deviceSecret && input.userId) {
+    // Persist the durable blob when the zero-cookie device credential is present.
+    if (input.deviceId && input.deviceSecret) {
       try {
+        const prior = await authStore.load();
         const next = {
-          sessionId: input.sessionId,
-          userId: input.userId,
+          sessionId: input.sessionId || prior?.sessionId || '',
+          userId: input.userId || prior?.userId || '',
           deviceId: input.deviceId,
           deviceSecret: input.deviceSecret,
           ...(input.accessToken ? {
@@ -520,6 +447,10 @@ export const OxyProvider = ({
           } : {})
         };
         await authStore.save(next);
+        sessionClientHost.setDeviceCredential({
+          deviceId: input.deviceId,
+          deviceSecret: input.deviceSecret
+        });
       } catch (persistError) {
         logger('Failed to persist auth state on commit', persistError);
       }
@@ -581,7 +512,21 @@ export const OxyProvider = ({
       onAuthStateChangeRef.current?.(fullUser);
     }
     markAuthResolvedRef.current();
-  }, [oxyServices, authStore, updateSessions, setActiveSessionId, sessionClient, syncFromClient, loginSuccess, logger]);
+    if (options.activate && options.hubSync && hubSync && isWebBrowser()) {
+      try {
+        await syncHubAfterSignIn(oxyServices, {
+          enabled: hubSync
+        });
+      } catch (hubError) {
+        if (__DEV__) {
+          loggerUtil.debug('Hub sync after sign-in failed (non-fatal)', {
+            component: 'OxyContext',
+            method: 'commitSession'
+          }, hubError);
+        }
+      }
+    }
+  }, [oxyServices, authStore, updateSessions, setActiveSessionId, sessionClient, sessionClientHost, syncFromClient, loginSuccess, logger, hubSync]);
   const commitSessionRef = useRef(commitSession);
   commitSessionRef.current = commitSession;
 
@@ -602,7 +547,8 @@ export const OxyProvider = ({
       userId: session.user.id,
       user: session.user
     }, {
-      activate: true
+      activate: true,
+      hubSync: true
     });
   }, [commitSession]);
 
@@ -620,10 +566,15 @@ export const OxyProvider = ({
       oxyServices,
       sessionClient,
       clientId,
+      authRedirectUri,
       locale: currentLanguage,
       commitSession: session => handleWebSessionRef.current(session),
       onSignedIn: () => setAccountDialogOpen(false),
       openUrl: url => {
+        if (isWebBrowser()) {
+          redirectToAuthorize(url);
+          return;
+        }
         void Linking.openURL(url);
       }
     });
@@ -646,7 +597,7 @@ export const OxyProvider = ({
   }, []);
 
   // Expose the live open/close controls to the imperative manager so
-  // `showSignInModal()` (and any app-level imperative "sign in" handler) works.
+  // Imperative `openAccountDialog('signin')` (and app-level sign-in handlers) works.
   useEffect(() => registerAccountDialogControls({
     open: openAccountDialog,
     close: closeAccountDialog
@@ -660,9 +611,11 @@ export const OxyProvider = ({
 
   // Keyless password sign-in: username/email + password.
   const signInWithPassword = useCallback(async (identifier, password, opts) => {
+    const persisted = await authStore.load();
     const result = await oxyServices.passwordSignIn(identifier, password, {
       deviceName: opts?.deviceName,
-      deviceFingerprint: opts?.deviceFingerprint
+      deviceFingerprint: opts?.deviceFingerprint,
+      deviceId: persisted?.deviceId
     });
     if ('twoFactorRequired' in result) {
       return {
@@ -680,7 +633,8 @@ export const OxyProvider = ({
       userId: result.user.id,
       user: result.user
     }, {
-      activate: true
+      activate: true,
+      hubSync: true
     });
     return {
       status: 'ok',
@@ -690,11 +644,13 @@ export const OxyProvider = ({
     };
   }, [oxyServices, commitSession]);
   const completeTwoFactorSignIn = useCallback(async params => {
+    const persisted = await authStore.load();
     const result = await oxyServices.completeTwoFactorSignIn({
       loginToken: params.loginToken,
       token: params.token,
       backupCode: params.backupCode,
-      deviceName: params.deviceName
+      deviceName: params.deviceName,
+      deviceId: persisted?.deviceId
     });
     await commitSession({
       sessionId: result.sessionId,
@@ -705,7 +661,8 @@ export const OxyProvider = ({
       userId: result.user.id,
       user: result.user
     }, {
-      activate: true
+      activate: true,
+      hubSync: true
     });
     return {
       securityAlert: result.securityAlert
@@ -713,84 +670,24 @@ export const OxyProvider = ({
   }, [oxyServices, commitSession]);
 
   // ── Cold boot ────────────────────────────────────────────────────────────
-  // The single device-first session restore. Runs ONCE after storage init.
-  // `runSessionColdBoot` resolves the device's session (bootstrap-return →
-  // stored-tokens → shared-key (native) → bootstrap-hop (web)) WITHOUT ever
-  // redirecting to a login page; an unresolved boot ends signed-out and the app
-  // renders its "Sign in with Oxy" affordance. On a winning boot the token is
-  // already planted + persisted, so `onSession` only hands off to the
-  // SessionClient (membership + active account + realtime socket) and marks
-  // auth resolved. `onSignedOut` marks auth resolved with no session.
+  // Device-first session restore via `runProviderColdBoot` (see boot/runProviderColdBoot.ts).
   const runColdBoot = useCallback(async () => {
-    setTokenReady(false);
-    try {
-      await runSessionColdBoot({
-        oxy: oxyServices,
-        store: authStore,
-        platform: {
-          isWeb: isWebBrowser(),
-          isNative: !isWebBrowser()
-        },
-        onSession: async session => {
-          // Bound how long auth resolution waits for the handoff — the token is
-          // already planted, so on a slow backend we proceed and let the handoff
-          // land asynchronously (the socket subscription re-projects when it does).
-          const handoff = commitSessionRef.current({
-            sessionId: session.sessionId,
-            accessToken: session.accessToken,
-            userId: session.userId
-          }, {
-            activate: false
-          });
-          let handoffDeadlineId;
-          await Promise.race([handoff, new Promise(resolve => {
-            handoffDeadlineId = setTimeout(resolve, SESSION_HANDOFF_DEADLINE);
-          })]).finally(() => {
-            if (handoffDeadlineId !== undefined) {
-              clearTimeout(handoffDeadlineId);
-            }
-          });
-          markAuthResolvedRef.current();
-        },
-        onSignedOut: () => {
-          // The realtime socket is bearer-only: a signed-out tab cannot join any
-          // device room, so there is no signed-out socket to start here.
-          markAuthResolvedRef.current();
-        },
-        onStepError: (id, error) => {
-          if (__DEV__) {
-            loggerUtil.debug(`Cold-boot step "${id}" errored (non-fatal, falling through)`, {
-              component: 'OxyContext',
-              method: 'runColdBoot'
-            }, error);
-          }
-        }
-      });
-    } catch (error) {
-      if (__DEV__) {
-        loggerUtil.error('Cold boot error', error instanceof Error ? error : new Error(String(error)), {
-          component: 'OxyContext',
-          method: 'runColdBoot'
-        });
-      }
-    } finally {
-      // Backstop: resolve on every exit path so the gate can never hang.
-      markAuthResolvedRef.current();
-    }
-  }, [oxyServices, authStore]);
+    await runProviderColdBoot({
+      oxyServices,
+      authStore,
+      clientId: clientIdProp,
+      authRedirectUri,
+      sessionClient,
+      syncDeviceCredentialToHost,
+      commitSession: (input, options) => commitSessionRef.current(input, options),
+      markAuthResolved: () => markAuthResolvedRef.current(),
+      setTokenReady
+    });
+  }, [oxyServices, authStore, clientIdProp, authRedirectUri, syncDeviceCredentialToHost, sessionClient]);
   useEffect(() => {
     if (initialized) {
       return;
     }
-    // IdP mode (`coldBoot={false}`): this provider is NOT the ecosystem session
-    // authority, so it never runs the device-first restore. Resolve auth
-    // immediately as signed out so there is no boot spinner; a deliberate sign-in
-    // still commits a normal session.
-    if (!coldBoot) {
-      setInitialized(true);
-      markAuthResolved();
-      return;
-    }
     if (!storage) {
       return;
     }
@@ -800,7 +697,32 @@ export const OxyProvider = ({
         logger('Cold boot failed', error);
       }
     });
-  }, [coldBoot, runColdBoot, storage, initialized, logger, markAuthResolved]);
+  }, [runColdBoot, storage, initialized, logger]);
+
+  // Reconcile device state when the tab returns to foreground (background tabs may
+  // miss socket pushes or have stale bearer tokens).
+  useEffect(() => {
+    if (!isWebBrowser()) return;
+    const onVisibility = () => {
+      if (document.visibilityState !== 'visible') return;
+      const reconcile = async () => {
+        if (!oxyServices.getAccessToken() && sessionClientHost.getDeviceCredential()) {
+          await refreshPersistedSession({
+            oxy: oxyServices,
+            store: authStore
+          });
+        }
+        if (!oxyServices.getAccessToken() && !sessionClientHost.getDeviceCredential()) {
+          return;
+        }
+        await sessionClient.bootstrap();
+        await syncFromClient();
+      };
+      void reconcile().catch(() => undefined);
+    };
+    document.addEventListener('visibilitychange', onVisibility);
+    return () => document.removeEventListener('visibilitychange', onVisibility);
+  }, [oxyServices, sessionClient, sessionClientHost, authStore, syncFromClient]);
 
   // Exposed `refreshSessions`: re-bootstrap the server-authoritative device
   // state and reproject — the manual counterpart to the realtime socket.
@@ -839,78 +761,23 @@ export const OxyProvider = ({
     queryClient,
     showBottomSheet: showBottomSheetForContext
   });
-
-  // ── Account graph ──────────────────────────────────────────────────────────
-  const [accounts, setAccounts] = useState([]);
-  const refreshAccounts = useCallback(async () => {
-    if (!isAuthenticated || !tokenReady || !oxyServices.getAccessToken()) {
-      setAccounts([]);
-      return;
-    }
-    try {
-      const list = await oxyServices.listAccounts();
-      setAccounts(list);
-    } catch (err) {
-      if (isUnauthorizedStatus(err)) {
-        setAccounts([]);
-        await clearSessionStateRef.current();
-        return;
-      }
-      if (__DEV__) {
-        loggerUtil.debug('Failed to load accounts', {
-          component: 'OxyContext'
-        }, err);
-      }
-    }
-  }, [isAuthenticated, oxyServices, tokenReady]);
-  useEffect(() => {
-    if (isAuthenticated && initialized && tokenReady) {
-      refreshAccounts();
-      // Reload the dialog's own account graph too, so a session restored OUTSIDE
-      // the dialog (cold boot / password sign-in) surfaces its graph accounts.
-      void accountDialogControllerRef.current?.refresh();
-    }
-  }, [isAuthenticated, initialized, tokenReady, refreshAccounts]);
-  const runPostAccountSwitchSideEffects = useCallback(async () => {
-    await refreshAccounts();
-    queryClient.invalidateQueries();
-  }, [refreshAccounts, queryClient]);
-
-  // Switch the active session INTO an account from the unified graph. In the
-  // real-session model this is identical to switching device sign-ins.
-  const switchToAccount = useCallback(async accountId => {
-    const deviceState = sessionClient.getState();
-    if (deviceState?.accounts.some(account => account.accountId === accountId)) {
-      await sessionClient.switchAccount(accountId);
-      await syncFromClient();
-      await runPostAccountSwitchSideEffects();
-      return;
-    }
-    const result = await oxyServices.switchToAccount(accountId);
-    if (!result?.user || !result?.sessionId) {
-      throw new Error('Account switch did not return a valid session');
-    }
-    // `oxyServices.switchToAccount` already planted the access token; commit
-    // the minted session through the shared funnel (persist + register +
-    // hydrate) as a deliberate activation.
-    await commitSession({
-      sessionId: result.sessionId,
-      accessToken: result.accessToken,
-      deviceSecret: result.deviceSecret,
-      deviceId: result.deviceId,
-      expiresAt: result.expiresAt,
-      userId: result.user.id,
-      user: result.user
-    }, {
-      activate: true
-    });
-    await runPostAccountSwitchSideEffects();
-  }, [oxyServices, sessionClient, syncFromClient, commitSession, runPostAccountSwitchSideEffects]);
-  const createAccountFn = useCallback(async data => {
-    const account = await oxyServices.createAccount(data);
-    await refreshAccounts();
-    return account;
-  }, [oxyServices, refreshAccounts]);
+  const {
+    accounts,
+    refreshAccounts,
+    switchToAccount,
+    createAccount: createAccountFn
+  } = useOxyAccountGraph({
+    isAuthenticated,
+    tokenReady,
+    initialized,
+    oxyServices,
+    sessionClient,
+    syncFromClient,
+    commitSession,
+    queryClient,
+    accountDialogControllerRef,
+    clearSessionStateRef
+  });
   const canUsePrivateApi = authResolved && isAuthenticated && tokenReady && hasAccessToken;
   const isPrivateApiPending = !authResolved || isAuthenticated && (!tokenReady || !hasAccessToken);
   const contextValue = useMemo(() => ({
@@ -935,6 +802,7 @@ export const OxyProvider = ({
     signIn,
     signInWithPassword,
     completeTwoFactorSignIn,
+    revokeSuspiciousSignIn,
     handleWebSession,
     logout,
     logoutAll,
@@ -961,7 +829,7 @@ export const OxyProvider = ({
     switchToAccount,
     refreshAccounts,
     createAccount: createAccountFn
-  }), [user, sessions, activeSessionId, isAuthenticated, isLoading, tokenReady, hasAccessToken, canUsePrivateApi, isPrivateApiPending, authResolved, storage, error, currentLanguage, currentLanguageMetadata, currentLanguageName, currentNativeLanguageName, hasIdentity, getPublicKey, signIn, signInWithPassword, completeTwoFactorSignIn, handleWebSession, logout, logoutAll, switchSessionForContext, refreshSessionsForContext, setLanguage, getDeviceSessions, logoutAllDeviceSessions, updateDeviceName, clearSessionState, clearAllAccountData, storageKeyPrefix, clientId, oxyServices, useFollowHook, showBottomSheetForContext, openAvatarPicker, accountDialogController, accountDialogOpen, openAccountDialog, closeAccountDialog, accounts, switchToAccount, refreshAccounts, createAccountFn]);
+  }), [user, sessions, activeSessionId, isAuthenticated, isLoading, tokenReady, hasAccessToken, canUsePrivateApi, isPrivateApiPending, authResolved, storage, error, currentLanguage, currentLanguageMetadata, currentLanguageName, currentNativeLanguageName, hasIdentity, getPublicKey, signIn, signInWithPassword, completeTwoFactorSignIn, revokeSuspiciousSignIn, handleWebSession, logout, logoutAll, switchSessionForContext, refreshSessionsForContext, setLanguage, getDeviceSessions, logoutAllDeviceSessions, updateDeviceName, clearSessionState, clearAllAccountData, storageKeyPrefix, clientId, oxyServices, useFollowHook, showBottomSheetForContext, openAvatarPicker, accountDialogController, accountDialogOpen, openAccountDialog, closeAccountDialog, accounts, switchToAccount, refreshAccounts, createAccountFn]);
   return /*#__PURE__*/_jsx(OxyContext.Provider, {
     value: contextValue,
     children: children
@@ -1000,6 +868,7 @@ const LOADING_STATE = {
   signIn: () => rejectMissingProvider(),
   signInWithPassword: () => rejectMissingProvider(),
   completeTwoFactorSignIn: () => rejectMissingProvider(),
+  revokeSuspiciousSignIn: () => rejectMissingProvider(),
   handleWebSession: () => rejectMissingProvider(),
   logout: () => rejectMissingProvider(),
   logoutAll: () => rejectMissingProvider(),