@oxyhq/services 19.1.2 → 19.2.0

package/src/ui/session/__tests__/tokenTransport.test.ts

@@ -1,23 +1,17 @@
 import type { DeviceSessionState } from '@oxyhq/contracts';
-import { logger, createMemoryAuthStateStore, refreshPersistedSession } from '@oxyhq/core';
+import { logger } from '@oxyhq/core';
 import { createTokenTransport } from '../tokenTransport';
 
-// The device-first transport mints a fallback token from the persisted
-// zero-cookie device credential via `refreshPersistedSession` (the ONE unified
-// refresh path) — there is no `silentSignIn`/`signInWithSharedIdentity` arm
-// anymore. Mock that one core function so the transport's own coalescing /
-// logging contract can be exercised in isolation; keep the real `logger` +
-// memory store.
-jest.mock('@oxyhq/core', () => {
-  const actual = jest.requireActual('@oxyhq/core');
-  return { __esModule: true, ...actual, refreshPersistedSession: jest.fn() };
-});
-
-const mockedRefresh = refreshPersistedSession as jest.MockedFunction<typeof refreshPersistedSession>;
+// The device-first transport no longer owns a private mint single-flight: it
+// routes through the ONE shared `oxyServices.httpService.refreshAccessToken(...)`
+// the scheduler/preflight/401 use, so concurrent lanes can never double-rotate
+// the device secret. These tests exercise the transport's own no-op / error /
+// swallow contract around that single call.
 
-function fakeOxy(accessToken: string | null) {
+function fakeOxy(accessToken: string | null, refreshAccessToken = jest.fn(async () => 'minted-token')) {
   return {
     getAccessToken: jest.fn().mockReturnValue(accessToken),
+    httpService: { refreshAccessToken },
   };
 }
 
@@ -30,35 +24,33 @@ const state: DeviceSessionState = {
 };
 
 describe('createTokenTransport', () => {
-  beforeEach(() => {
-    jest.clearAllMocks();
-    mockedRefresh.mockResolvedValue('minted-token');
-  });
-
   test('no-ops when a token is already present', async () => {
-    const oxy = fakeOxy('tok');
-    const transport = createTokenTransport(oxy as never, createMemoryAuthStateStore());
+    const refreshAccessToken = jest.fn(async () => 'minted-token');
+    const oxy = fakeOxy('tok', refreshAccessToken);
+    const transport = createTokenTransport(oxy as never);
 
     await transport.ensureActiveToken(state);
 
-    expect(mockedRefresh).not.toHaveBeenCalled();
+    expect(refreshAccessToken).not.toHaveBeenCalled();
   });
 
-  test('mints via refreshPersistedSession when no token is present', async () => {
-    const oxy = fakeOxy(null);
-    const store = createMemoryAuthStateStore();
-    const transport = createTokenTransport(oxy as never, store);
+  test('mints via the shared httpService.refreshAccessToken single-flight when no token is present', async () => {
+    const refreshAccessToken = jest.fn(async () => 'minted-token');
+    const oxy = fakeOxy(null, refreshAccessToken);
+    const transport = createTokenTransport(oxy as never);
 
     await transport.ensureActiveToken(state);
 
-    expect(mockedRefresh).toHaveBeenCalledTimes(1);
-    expect(mockedRefresh).toHaveBeenCalledWith({ oxy, store });
+    expect(refreshAccessToken).toHaveBeenCalledTimes(1);
+    expect(refreshAccessToken).toHaveBeenCalledWith('preflight');
   });
 
   test('resolves (never rejects) and logs a warning when the refresh throws', async () => {
-    const oxy = fakeOxy(null);
-    mockedRefresh.mockRejectedValue(new Error('mint boom'));
-    const transport = createTokenTransport(oxy as never, createMemoryAuthStateStore());
+    const refreshAccessToken = jest.fn(async () => {
+      throw new Error('mint boom');
+    });
+    const oxy = fakeOxy(null, refreshAccessToken);
+    const transport = createTokenTransport(oxy as never);
     const warnSpy = jest.spyOn(logger, 'warn').mockImplementation(() => undefined);
 
     await expect(transport.ensureActiveToken(state)).resolves.toBeUndefined();
@@ -73,48 +65,39 @@ describe('createTokenTransport', () => {
   });
 
   test('resolves cleanly when the refresh produces no session', async () => {
-    const oxy = fakeOxy(null);
-    mockedRefresh.mockResolvedValue(null);
-    const transport = createTokenTransport(oxy as never, createMemoryAuthStateStore());
+    const refreshAccessToken = jest.fn(async () => null);
+    const oxy = fakeOxy(null, refreshAccessToken);
+    const transport = createTokenTransport(oxy as never);
 
     await expect(transport.ensureActiveToken(state)).resolves.toBeUndefined();
-    expect(mockedRefresh).toHaveBeenCalledTimes(1);
+    expect(refreshAccessToken).toHaveBeenCalledTimes(1);
   });
 
-  test('coalesces concurrent calls into a single mint', async () => {
-    const oxy = fakeOxy(null);
-    let resolveMint: ((value: string | null) => void) | null = null;
-    mockedRefresh.mockImplementation(
-      () =>
-        new Promise<string | null>((resolve) => {
-          resolveMint = resolve;
-        }),
-    );
-    const transport = createTokenTransport(oxy as never, createMemoryAuthStateStore());
+  test('delegates concurrent calls to the shared single-flight (no private guard of its own)', async () => {
+    // The transport keeps NO local coalescing — it forwards each call to the
+    // shared `httpService.refreshAccessToken`, which owns the single-flight that
+    // collapses concurrent mints into one server rotation (covered in core).
+    const refreshAccessToken = jest.fn(async () => 'minted-token');
+    const oxy = fakeOxy(null, refreshAccessToken);
+    const transport = createTokenTransport(oxy as never);
 
     const first = transport.ensureActiveToken(state);
     const second = transport.ensureActiveToken(state);
+    // Both concurrent callers reached the shared entry point synchronously — the
+    // transport does not swallow the second behind a private guard; dedup is the
+    // shared single-flight's job.
+    expect(refreshAccessToken).toHaveBeenCalledTimes(2);
 
-    expect(mockedRefresh).toHaveBeenCalledTimes(1);
-
-    resolveMint?.(null);
-    await Promise.all([first, second]);
-
-    expect(mockedRefresh).toHaveBeenCalledTimes(1);
-
-    // A later call after the in-flight mint settled starts a fresh mint.
-    const third = transport.ensureActiveToken(state);
-    expect(mockedRefresh).toHaveBeenCalledTimes(2);
-    resolveMint?.(null);
-    await third;
+    await expect(Promise.all([first, second])).resolves.toEqual([undefined, undefined]);
   });
 
   test('treats a throwing getAccessToken as no-token and still mints', async () => {
-    const oxy = fakeOxy(null);
+    const refreshAccessToken = jest.fn(async () => 'minted-token');
+    const oxy = fakeOxy(null, refreshAccessToken);
     oxy.getAccessToken.mockImplementation(() => {
       throw new Error('storage unavailable');
     });
-    const transport = createTokenTransport(oxy as never, createMemoryAuthStateStore());
+    const transport = createTokenTransport(oxy as never);
     const warnSpy = jest.spyOn(logger, 'warn').mockImplementation(() => undefined);
 
     await expect(transport.ensureActiveToken(state)).resolves.toBeUndefined();
@@ -124,7 +107,7 @@ describe('createTokenTransport', () => {
       { component: 'TokenTransport' },
       expect.any(Error),
     );
-    expect(mockedRefresh).toHaveBeenCalledTimes(1);
+    expect(refreshAccessToken).toHaveBeenCalledTimes(1);
 
     warnSpy.mockRestore();
   });

package/src/ui/session/createSessionClient.ts

@@ -2,8 +2,8 @@ import { io } from 'socket.io-client';
 import {
   SessionClient,
   createSessionClientHost,
-  type AuthStateStore,
   type OxyServices,
+  type SessionStateOrigin,
 } from '@oxyhq/core';
 import { createTokenTransport } from './tokenTransport';
 
@@ -19,27 +19,30 @@ import { createTokenTransport } from './tokenTransport';
  *    core's lazy dynamic import of a bare specifier — bundler-fragile in
  *    Metro/Expo-web against the published core dist.
  *  - the device-first {@link createTokenTransport}, which mints a fallback token
- *    from the persisted device credential (`store` → `deviceId` + `deviceSecret`).
+ *    through the ONE shared `httpService.refreshAccessToken` single-flight (it
+ *    reads the persisted `deviceId` + `deviceSecret` via the installed handler,
+ *    so it takes no `store` of its own).
  *
- * `onUnauthenticated` fires when an applied device state has zero accounts (a
- * device signout-all): the provider clears the persisted store + local state so
- * a reload does not try to restore a dead session. The host is returned
- * alongside the client so the caller can call `host.setCurrentAccountId(...)`
- * as the active account changes.
+ * `onUnauthenticated` fires when an applied device state has zero accounts. It
+ * receives the {@link SessionStateOrigin} so the provider can gate the
+ * destructive credential wipe: a `request`-origin verdict (a REST sign-out /
+ * revocation) clears the persisted store; a `push`-origin verdict (a possibly
+ * transient socket broadcast) clears only the local UI session and KEEPS the
+ * durable device credential. The host is returned alongside the client so the
+ * caller can call `host.setCurrentAccountId(...)` as the active account changes.
  *
  * The realtime socket uses bearer when authenticated, or deviceId+deviceSecret
  * when signed out (after the one-shot join redirect).
  */
 export function createSessionClient(
   oxyServices: OxyServices,
-  store: AuthStateStore,
-  onUnauthenticated?: () => void,
+  onUnauthenticated?: (origin: SessionStateOrigin) => void,
 ): {
   client: SessionClient;
   host: ReturnType<typeof createSessionClientHost>;
 } {
   const host = createSessionClientHost(oxyServices);
-  const transport = createTokenTransport(oxyServices, store);
+  const transport = createTokenTransport(oxyServices);
   const client = new SessionClient(host, { transport, socketFactory: io, onUnauthenticated });
   return { client, host };
 }

package/src/ui/session/tokenTransport.ts

@@ -1,10 +1,4 @@
-import {
-  refreshPersistedSession,
-  logger,
-  type AuthStateStore,
-  type OxyServices,
-  type TokenTransport,
-} from '@oxyhq/core';
+import { logger, type OxyServices, type TokenTransport } from '@oxyhq/core';
 import type { DeviceSessionState } from '@oxyhq/contracts';
 
 /**
@@ -12,21 +6,18 @@ import type { DeviceSessionState } from '@oxyhq/contracts';
  *
  * `ensureActiveToken` is the fallback the client uses when a `session_state`
  * push arrived WITHOUT an embedded `activeToken` and the app currently holds no
- * bearer. It mints one through the ONE unified refresh path
- * (`refreshPersistedSession`), which presents the persisted zero-cookie device
- * credential (`deviceId` + `deviceSecret`) at `POST /session/device/token`. The
- * persisted device credential is the sole durable restore credential.
+ * bearer. It mints one through the ONE unified single-flight the scheduler, the
+ * request-time preflight, and the 401 retry all use —
+ * `oxyServices.httpService.refreshAccessToken(...)` — which runs the installed
+ * refresh handler (present the persisted zero-cookie `deviceId` + `deviceSecret`
+ * at `POST /session/device/token`). Routing through the SAME entry point means
+ * this lane can never double-rotate the device secret against the others: it has
+ * NO private single-flight of its own.
  *
- * Concurrent pushes coalesce onto one in-flight mint. A failure is logged and
- * swallowed: this method must never throw out (it runs inside the socket state
- * handler).
+ * A failure is logged and swallowed: this method must never throw out (it runs
+ * inside the socket state handler).
  */
-export function createTokenTransport(
-  oxyServices: OxyServices,
-  store: AuthStateStore,
-): TokenTransport {
-  let inFlightMint: Promise<void> | null = null;
-
+export function createTokenTransport(oxyServices: OxyServices): TokenTransport {
   return {
     async ensureActiveToken(state: DeviceSessionState): Promise<void> {
       try {
@@ -37,28 +28,18 @@ export function createTokenTransport(
         logger.warn('ensureActiveToken: getAccessToken threw', { component: 'TokenTransport' }, error);
       }
 
-      if (inFlightMint) {
-        return inFlightMint;
-      }
-
-      inFlightMint = (async () => {
-        try {
-          const token = await refreshPersistedSession({ oxy: oxyServices, store });
-          if (!token) {
-            logger.debug('ensureActiveToken: refresh produced no session', {
-              component: 'TokenTransport',
-              deviceId: state.deviceId,
-            });
-          }
-        } catch (error) {
-          logger.warn('ensureActiveToken: refresh failed', { component: 'TokenTransport' }, error);
-        }
-      })();
-
       try {
-        await inFlightMint;
-      } finally {
-        inFlightMint = null;
+        // The shared HttpService single-flight coalesces concurrent callers onto
+        // one in-flight mint; no local `inFlightMint` guard is needed.
+        const token = await oxyServices.httpService.refreshAccessToken('preflight');
+        if (!token) {
+          logger.debug('ensureActiveToken: refresh produced no session', {
+            component: 'TokenTransport',
+            deviceId: state.deviceId,
+          });
+        }
+      } catch (error) {
+        logger.warn('ensureActiveToken: refresh failed', { component: 'TokenTransport' }, error);
       }
     },
   };