@oxyhq/services 21.0.0 → 21.0.1

package/src/ui/hooks/queries/queryKeys.ts

@@ -71,6 +71,12 @@ export const queryKeys = {
       [...queryKeys.security.all, 'infinite', limit, eventType] as const,
   },
 
+  // Linked authentication methods (passwords, identity keys, passkeys, social)
+  authMethods: {
+    all: ['authMethods'] as const,
+    list: (userId?: string) => [...queryKeys.authMethods.all, 'list', userId || 'current'] as const,
+  },
+
   // Storage usage queries
   storage: {
     all: ['storage'] as const,
@@ -159,6 +165,14 @@ export const invalidateStorageQueries = (queryClient: QueryClient): void => {
   queryClient.invalidateQueries({ queryKey: queryKeys.storage.all });
 };
 
+/**
+ * Helper to invalidate the user's linked auth-methods list (call after linking
+ * or removing a passkey / password / identity key).
+ */
+export const invalidateAuthMethodsQueries = (queryClient: QueryClient): void => {
+  queryClient.invalidateQueries({ queryKey: queryKeys.authMethods.all });
+};
+
 /**
  * Helper to invalidate all payments / wallet / subscription queries
  */

package/src/ui/hooks/queries/useAuthMethods.ts

@@ -0,0 +1,45 @@
+import { useMemo } from 'react';
+import { useQuery } from '@tanstack/react-query';
+import type { AuthMethodEntry, AuthMethodsResponse } from '@oxyhq/contracts';
+import { queryKeys } from './queryKeys';
+import { useOxy } from '../../context/OxyContext';
+
+/** Stable empty list so the derived selectors keep a stable reference while loading. */
+const EMPTY_METHODS: readonly AuthMethodEntry[] = Object.freeze([]);
+
+/**
+ * The current account's linked authentication methods (`GET /auth/methods`),
+ * plus convenience projections. Backs the security / account surfaces that let a
+ * user see and manage their passwords, identity key, social logins, and passkeys.
+ *
+ * `passkeys` is the `type === 'webauthn'` subset — one entry per registered
+ * credential. Invalidate via `queryKeys.authMethods.all` after linking a passkey
+ * (`useOxy().addPasskey()` does this) or removing one.
+ */
+export const useAuthMethods = (options?: { enabled?: boolean }) => {
+  const { oxyServices, activeSessionId } = useOxy();
+
+  const query = useQuery<AuthMethodsResponse>({
+    queryKey: queryKeys.authMethods.list(),
+    queryFn: () => oxyServices.listAuthMethods(),
+    enabled: options?.enabled !== false && !!activeSessionId,
+    staleTime: 5 * 60 * 1000, // 5 minutes
+    gcTime: 10 * 60 * 1000, // 10 minutes
+  });
+
+  const methods = query.data?.methods ?? EMPTY_METHODS;
+  const passkeys = useMemo(
+    () => methods.filter((method) => method.type === 'webauthn'),
+    [methods],
+  );
+
+  return {
+    ...query,
+    /** Every linked auth method. Empty while loading. */
+    methods,
+    /** The registered passkeys (a `type === 'webauthn'` subset of `methods`). */
+    passkeys,
+    /** The account's DID, or `null` while loading. */
+    did: query.data?.did ?? null,
+  };
+};

package/src/webauthn/passkeyClient.native.ts

@@ -0,0 +1,26 @@
+/**
+ * Passkey / WebAuthn ceremony client — NATIVE implementation.
+ *
+ * React Native has no browser WebAuthn API, and Oxy's native passkey story is
+ * Commons (shared-keychain / QR handoff), NOT `navigator.credentials`. So this
+ * variant imports NOTHING browser-specific and mirrors the clean default:
+ * unsupported, and the ceremony helpers throw if a caller skipped the gate.
+ */
+
+const WEBAUTHN_WEB_ONLY_MESSAGE =
+  'WebAuthn is web-only; native uses Commons. Passkeys are not available on this platform.';
+
+/** Always `false` on native — there is no browser WebAuthn API. */
+export function isPasskeySupported(): boolean {
+  return false;
+}
+
+/** Not available on native — throws. Guard with {@link isPasskeySupported} first. */
+export async function runRegistrationCeremony(_optionsJSON: unknown): Promise<unknown> {
+  throw new Error(WEBAUTHN_WEB_ONLY_MESSAGE);
+}
+
+/** Not available on native — throws. Guard with {@link isPasskeySupported} first. */
+export async function runAuthenticationCeremony(_optionsJSON: unknown): Promise<unknown> {
+  throw new Error(WEBAUTHN_WEB_ONLY_MESSAGE);
+}

package/src/webauthn/passkeyClient.ts

@@ -0,0 +1,31 @@
+/**
+ * Passkey / WebAuthn ceremony client — clean default (non-web) implementation.
+ *
+ * This is the base module TypeScript resolves for TYPES and any bundler that
+ * does not pick a platform variant. It intentionally imports NOTHING browser-
+ * specific (no `@simplewebauthn/browser`) so it stays safe for Metro, native
+ * builds, and SSR. The real ceremony lives in `passkeyClient.web.ts`; native
+ * passkeys are Commons' job, so there is no WebAuthn ceremony here.
+ *
+ * `isPasskeySupported()` returns `false` (no relying-party origin / no browser
+ * WebAuthn API), and the ceremony helpers throw a clear error so a caller that
+ * skipped the support gate fails loudly instead of silently.
+ */
+
+const WEBAUTHN_WEB_ONLY_MESSAGE =
+  'WebAuthn is web-only; native uses Commons. Passkeys are not available on this platform.';
+
+/** Always `false` off the web — there is no relying-party origin or WebAuthn API. */
+export function isPasskeySupported(): boolean {
+  return false;
+}
+
+/** Not available off the web — throws. Guard with {@link isPasskeySupported} first. */
+export async function runRegistrationCeremony(_optionsJSON: unknown): Promise<unknown> {
+  throw new Error(WEBAUTHN_WEB_ONLY_MESSAGE);
+}
+
+/** Not available off the web — throws. Guard with {@link isPasskeySupported} first. */
+export async function runAuthenticationCeremony(_optionsJSON: unknown): Promise<unknown> {
+  throw new Error(WEBAUTHN_WEB_ONLY_MESSAGE);
+}

package/src/webauthn/passkeyClient.web.ts

@@ -0,0 +1,56 @@
+/**
+ * Passkey / WebAuthn ceremony client — WEB implementation.
+ *
+ * The browser half of the passkey flow: it drives `navigator.credentials`
+ * through `@simplewebauthn/browser`, turning the OPAQUE options the server
+ * emitted (`OxyServices.webauthn{Register,Login}Options`) into the opaque
+ * response the matching `verify` endpoint consumes. Oxy never owns those wire
+ * shapes — `@simplewebauthn/browser` does — so options flow in as `unknown` and
+ * the single cast at this boundary hands them to the library's own types.
+ *
+ * This file is selected ONLY on web (react-native-web / Vite RNW): the sibling
+ * `passkeyClient.native.ts` + the clean default `passkeyClient.ts` deliberately
+ * do NOT import `@simplewebauthn/browser` (a browser-only dependency), per the
+ * platform-split rule. Native passkeys are Commons' job — there is no WebAuthn
+ * ceremony off the web.
+ */
+
+import {
+  startRegistration,
+  startAuthentication,
+  type PublicKeyCredentialCreationOptionsJSON,
+  type PublicKeyCredentialRequestOptionsJSON,
+  type RegistrationResponseJSON,
+  type AuthenticationResponseJSON,
+} from '@simplewebauthn/browser';
+
+/**
+ * True iff this browser can run a WebAuthn ceremony (exposes the
+ * `PublicKeyCredential` global). Gate all passkey UI/entrypoints on this so an
+ * unsupported browser fails loudly rather than throwing mid-ceremony.
+ */
+export function isPasskeySupported(): boolean {
+  return typeof window !== 'undefined' && typeof window.PublicKeyCredential !== 'undefined';
+}
+
+/**
+ * Run the WebAuthn REGISTRATION ceremony (`navigator.credentials.create`) from
+ * the server's opaque creation options, returning the opaque attestation
+ * response for `OxyServices.webauthnRegisterVerify`.
+ */
+export async function runRegistrationCeremony(
+  optionsJSON: unknown,
+): Promise<RegistrationResponseJSON> {
+  return startRegistration({ optionsJSON: optionsJSON as PublicKeyCredentialCreationOptionsJSON });
+}
+
+/**
+ * Run the WebAuthn AUTHENTICATION ceremony (`navigator.credentials.get`) from
+ * the server's opaque request options, returning the opaque assertion response
+ * for `OxyServices.webauthnLoginVerify`.
+ */
+export async function runAuthenticationCeremony(
+  optionsJSON: unknown,
+): Promise<AuthenticationResponseJSON> {
+  return startAuthentication({ optionsJSON: optionsJSON as PublicKeyCredentialRequestOptionsJSON });
+}