@oxyhq/services 22.12.4 → 22.12.7

package/lib/commonjs/ui/oauth/completeOAuthCode.js

@@ -0,0 +1,78 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.completeOAuthCode = completeOAuthCode;
+var _core = require("@oxyhq/core");
+/**
+ * The ONE path from an OAuth authorization code to a committed session.
+ *
+ * Both web transports end here — the popup with an in-memory handshake, the
+ * redirect lane with one read back from `sessionStorage` — so state validation,
+ * the PKCE exchange, the session commit, and handshake cleanup exist exactly
+ * once. Duplicating any of those per transport is how the two lanes would drift
+ * apart on the security-critical steps.
+ *
+ * Ordering is deliberate and load-bearing:
+ *   1. validate `state` BEFORE anything is sent to the token endpoint,
+ *   2. exchange the code for a session,
+ *   3. run `cleanup` (drop the persisted handshake / strip `?code=` from the
+ *      URL) BEFORE the commit, so a stale code can never re-enter the exchange,
+ *   4. commit the session.
+ *
+ * `cleanup` runs exactly once on EVERY exit path, including a state mismatch
+ * and a failed exchange.
+ */
+
+/** Inputs for {@link completeOAuthCode}. */
+
+async function completeOAuthCode(input) {
+  let cleaned = false;
+  const runCleanup = () => {
+    if (cleaned) return;
+    cleaned = true;
+    input.cleanup?.();
+  };
+  if (!input.handshake || !input.returnedState || input.handshake.state !== input.returnedState) {
+    _core.logger.warn('OAuth completion rejected: missing or mismatched state', {
+      component: 'completeOAuthCode'
+    });
+    runCleanup();
+    return {
+      ok: false,
+      reason: 'state-mismatch'
+    };
+  }
+  try {
+    const result = await input.oxyServices.exchangeOAuthCode({
+      code: input.code,
+      clientId: input.clientId,
+      redirectUri: input.redirectUri,
+      codeVerifier: input.handshake.codeVerifier
+    });
+    runCleanup();
+    await input.commitSession({
+      sessionId: result.sessionId,
+      accessToken: result.accessToken,
+      deviceId: result.deviceId,
+      deviceSecret: result.deviceSecret,
+      userId: result.user.id,
+      expiresAt: result.expiresAt,
+      user: result.user
+    });
+    return {
+      ok: true
+    };
+  } catch (error) {
+    _core.logger.warn('OAuth code exchange failed', {
+      component: 'completeOAuthCode'
+    }, error);
+    runCleanup();
+    return {
+      ok: false,
+      reason: 'exchange-failed'
+    };
+  }
+}
+//# sourceMappingURL=completeOAuthCode.js.map

package/lib/commonjs/ui/oauth/completeOAuthCode.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_core","require","completeOAuthCode","input","cleaned","runCleanup","cleanup","handshake","returnedState","state","logger","warn","component","ok","reason","result","oxyServices","exchangeOAuthCode","code","clientId","redirectUri","codeVerifier","commitSession","sessionId","accessToken","deviceId","deviceSecret","userId","user","id","expiresAt","error"],"sourceRoot":"../../../../src","sources":["ui/oauth/completeOAuthCode.ts"],"mappings":";;;;;;AAqBA,IAAAA,KAAA,GAAAC,OAAA;AArBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAMA;;AA2BO,eAAeC,iBAAiBA,CACrCC,KAA6B,EACG;EAChC,IAAIC,OAAO,GAAG,KAAK;EACnB,MAAMC,UAAU,GAAGA,CAAA,KAAY;IAC7B,IAAID,OAAO,EAAE;IACbA,OAAO,GAAG,IAAI;IACdD,KAAK,CAACG,OAAO,GAAG,CAAC;EACnB,CAAC;EAED,IAAI,CAACH,KAAK,CAACI,SAAS,IAAI,CAACJ,KAAK,CAACK,aAAa,IAAIL,KAAK,CAACI,SAAS,CAACE,KAAK,KAAKN,KAAK,CAACK,aAAa,EAAE;IAC7FE,YAAM,CAACC,IAAI,CAAC,wDAAwD,EAAE;MACpEC,SAAS,EAAE;IACb,CAAC,CAAC;IACFP,UAAU,CAAC,CAAC;IACZ,OAAO;MAAEQ,EAAE,EAAE,KAAK;MAAEC,MAAM,EAAE;IAAiB,CAAC;EAChD;EAEA,IAAI;IACF,MAAMC,MAAM,GAAG,MAAMZ,KAAK,CAACa,WAAW,CAACC,iBAAiB,CAAC;MACvDC,IAAI,EAAEf,KAAK,CAACe,IAAI;MAChBC,QAAQ,EAAEhB,KAAK,CAACgB,QAAQ;MACxBC,WAAW,EAAEjB,KAAK,CAACiB,WAAW;MAC9BC,YAAY,EAAElB,KAAK,CAACI,SAAS,CAACc;IAChC,CAAC,CAAC;IACFhB,UAAU,CAAC,CAAC;IACZ,MAAMF,KAAK,CAACmB,aAAa,CAAC;MACxBC,SAAS,EAAER,MAAM,CAACQ,SAAS;MAC3BC,WAAW,EAAET,MAAM,CAACS,WAAW;MAC/BC,QAAQ,EAAEV,MAAM,CAACU,QAAQ;MACzBC,YAAY,EAAEX,MAAM,CAACW,YAAY;MACjCC,MAAM,EAAEZ,MAAM,CAACa,IAAI,CAACC,EAAE;MACtBC,SAAS,EAAEf,MAAM,CAACe,SAAS;MAC3BF,IAAI,EAAEb,MAAM,CAACa;IACf,CAAC,CAAC;IACF,OAAO;MAAEf,EAAE,EAAE;IAAK,CAAC;EACrB,CAAC,CAAC,OAAOkB,KAAK,EAAE;IACdrB,YAAM,CAACC,IAAI,CAAC,4BAA4B,EAAE;MAAEC,SAAS,EAAE;IAAoB,CAAC,EAAEmB,KAAK,CAAC;IACpF1B,UAAU,CAAC,CAAC;IACZ,OAAO;MAAEQ,EAAE,EAAE,KAAK;MAAEC,MAAM,EAAE;IAAkB,CAAC;EACjD;AACF","ignoreList":[]}

package/lib/commonjs/ui/oauth/legacyRedirectLanes.js

@@ -0,0 +1,48 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.allowsAutomaticIdpRedirect = allowsAutomaticIdpRedirect;
+/**
+ * The legacy, redirect-mode-only lanes that navigate the RP's TOP-LEVEL window
+ * to the IdP without a user gesture.
+ *
+ * `webAuthMode: 'popup'` exists to guarantee exactly one thing: the relying
+ * party never leaves its route. Two mechanics in this SDK break that guarantee,
+ * because each replaces the whole document on its own initiative:
+ *
+ * 1. **Cold-boot silent restore** — a full-page `prompt=none` authorize bounce
+ *    to `auth.oxy.so` when the device-secret mint finds no local session
+ *    (`maybeStartSilentOAuthRestore`, called from `runProviderColdBoot`).
+ * 2. **Post-sign-in hub sync** — a full-page hop to `auth.oxy.so/sync` that
+ *    plants this device's credential on the IdP hub so OTHER origins can later
+ *    run lane 1 (`syncHubAfterSignIn`, called from the `commitSession` funnel).
+ *
+ * Both belong to the redirect transport and are kept only for the migration
+ * window (issue #691, "Cold boot and cross-domain behavior"). In popup mode a
+ * domain with no local credential simply resolves SIGNED OUT, and the user's
+ * next explicit "Continue with Oxy" opens the popup — from a real user gesture,
+ * never automatically.
+ *
+ * NOT covered here, and correctly enabled in BOTH modes: navigations the user
+ * asked for. When the browser blocks the popup, `startWebOAuthSignIn` still
+ * falls back to a full-page redirect rather than dead-ending the sign-in, and
+ * `tryCompleteOAuthReturn` still consumes a `?code=` that is already on the URL.
+ *
+ * PHASE 7b: once the pilot flips the default transport to `'popup'`, this
+ * predicate and BOTH lanes above are deleted outright. Grepping this symbol
+ * finds every site that has to go.
+ */
+
+/**
+ * Whether a provider running `webAuthMode` may perform an SDK-initiated,
+ * non-gesture, full-page navigation to the IdP.
+ *
+ * `true` only for `'redirect'` — still the default and the compatibility path,
+ * whose behaviour must stay byte-for-byte unchanged.
+ */
+function allowsAutomaticIdpRedirect(webAuthMode) {
+  return webAuthMode === 'redirect';
+}
+//# sourceMappingURL=legacyRedirectLanes.js.map

package/lib/commonjs/ui/oauth/legacyRedirectLanes.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["allowsAutomaticIdpRedirect","webAuthMode"],"sourceRoot":"../../../../src","sources":["ui/oauth/legacyRedirectLanes.ts"],"mappings":";;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASA,0BAA0BA,CAACC,WAAwB,EAAW;EAC5E,OAAOA,WAAW,KAAK,UAAU;AACnC","ignoreList":[]}

package/lib/commonjs/ui/oauth/oauthHandshake.js

@@ -0,0 +1,53 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.prepareAuthorizeRequest = prepareAuthorizeRequest;
+var _core = require("@oxyhq/core");
+/**
+ * The RP half of an OAuth authorize request: a fresh CSRF `state` + PKCE pair,
+ * and the authorize URL built from them.
+ *
+ * Both web transports start here, and the ONLY difference between them is one
+ * parameter: `popup` asks the IdP for `response_mode=web_message` so the result
+ * comes back to `window.opener` instead of navigating the RP's tab. Everything
+ * else — `S256` PKCE, exact registered `redirect_uri`, random `state` — is
+ * identical, which is what lets both lanes converge on one completion path.
+ */
+
+/** Inputs for {@link prepareAuthorizeRequest}. */
+
+/** A ready-to-use authorize request plus the secrets that finish it. */
+
+/**
+ * Generate a fresh handshake and build the authorize URL around it.
+ *
+ * The verifier is returned to the caller and never stored here: the popup
+ * transport keeps it in memory for the lifetime of the attempt, and the
+ * redirect transport persists it through `persistOAuthHandshake` because a
+ * full-page navigation destroys the running document.
+ */
+async function prepareAuthorizeRequest(params) {
+  const [pkce, state] = await Promise.all([(0, _core.generatePkcePair)(), (0, _core.generateOAuthState)()]);
+  const authorizeUrl = (0, _core.buildOAuthAuthorizeUrl)({
+    authorizeBaseUrl: params.authorizeBaseUrl,
+    clientId: params.clientId,
+    redirectUri: params.redirectUri,
+    scope: params.scope,
+    state,
+    codeChallenge: pkce.codeChallenge,
+    ...(params.responseMode ? {
+      responseMode: params.responseMode
+    } : {})
+  });
+  return {
+    authorizeUrl,
+    authorizeOrigin: new URL(authorizeUrl).origin,
+    handshake: {
+      state,
+      codeVerifier: pkce.codeVerifier
+    }
+  };
+}
+//# sourceMappingURL=oauthHandshake.js.map

package/lib/commonjs/ui/oauth/oauthHandshake.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_core","require","prepareAuthorizeRequest","params","pkce","state","Promise","all","generatePkcePair","generateOAuthState","authorizeUrl","buildOAuthAuthorizeUrl","authorizeBaseUrl","clientId","redirectUri","scope","codeChallenge","responseMode","authorizeOrigin","URL","origin","handshake","codeVerifier"],"sourceRoot":"../../../../src","sources":["ui/oauth/oauthHandshake.ts"],"mappings":";;;;;;AAWA,IAAAA,KAAA,GAAAC,OAAA;AAXA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAKA;;AAkBA;;AAaA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeC,uBAAuBA,CAC3CC,MAAqC,EACF;EACnC,MAAM,CAACC,IAAI,EAAEC,KAAK,CAAC,GAAG,MAAMC,OAAO,CAACC,GAAG,CAAC,CAAC,IAAAC,sBAAgB,EAAC,CAAC,EAAE,IAAAC,wBAAkB,EAAC,CAAC,CAAC,CAAC;EAEnF,MAAMC,YAAY,GAAG,IAAAC,4BAAsB,EAAC;IAC1CC,gBAAgB,EAAET,MAAM,CAACS,gBAAgB;IACzCC,QAAQ,EAAEV,MAAM,CAACU,QAAQ;IACzBC,WAAW,EAAEX,MAAM,CAACW,WAAW;IAC/BC,KAAK,EAAEZ,MAAM,CAACY,KAAK;IACnBV,KAAK;IACLW,aAAa,EAAEZ,IAAI,CAACY,aAAa;IACjC,IAAIb,MAAM,CAACc,YAAY,GAAG;MAAEA,YAAY,EAAEd,MAAM,CAACc;IAAa,CAAC,GAAG,CAAC,CAAC;EACtE,CAAC,CAAC;EAEF,OAAO;IACLP,YAAY;IACZQ,eAAe,EAAE,IAAIC,GAAG,CAACT,YAAY,CAAC,CAACU,MAAM;IAC7CC,SAAS,EAAE;MAAEhB,KAAK;MAAEiB,YAAY,EAAElB,IAAI,CAACkB;IAAa;EACtD,CAAC;AACH","ignoreList":[]}

package/lib/commonjs/ui/oauth/oauthPopup.js

@@ -0,0 +1,229 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.OXY_OAUTH_POPUP_WINDOW_NAME = exports.DEFAULT_OAUTH_POPUP_TIMEOUT_MS = void 0;
+exports.awaitOAuthPopupResult = awaitOAuthPopupResult;
+exports.closeOAuthPopup = closeOAuthPopup;
+exports.navigateOAuthPopup = navigateOAuthPopup;
+exports.openOAuthPopup = openOAuthPopup;
+var _core = require("@oxyhq/core");
+var _oauthPopupMessages = require("./oauthPopupMessages.js");
+/**
+ * Popup lifecycle for the web OAuth transport.
+ *
+ * Owns the window itself — opening it, navigating it, watching it, and tearing
+ * every listener and timer down — and nothing else: message validation lives in
+ * `oauthPopupMessages.ts`, and the code exchange in `completeOAuthCode.ts`.
+ *
+ * Three browser realities shape this module:
+ *
+ * - **Gesture attribution.** `window.open` only succeeds while the user's click
+ *   is still being handled. Anything awaited first (resolving the application,
+ *   generating PKCE) loses it and the popup is silently blocked. So the window
+ *   is opened EMPTY up front and navigated once the authorize URL exists —
+ *   the same shape as `passkeyHubPopup.ts`.
+ * - **No close event.** A cross-origin popup fires nothing when the user
+ *   dismisses it; polling `closed` is the only mechanism (as in core's
+ *   `AccountDialogController.watchPopup`).
+ * - **No cross-origin reads.** The popup's URL, title, and document are all
+ *   opaque. The authorization result arrives ONLY as a `postMessage`.
+ */
+
+/**
+ * Window name for the sign-in popup. Naming the target means a second press
+ * REUSES the same window instead of stacking a new one behind the first.
+ */
+const OXY_OAUTH_POPUP_WINDOW_NAME = exports.OXY_OAUTH_POPUP_WINDOW_NAME = 'oxy-oauth';
+
+/** Chrome-free window roughly sized for the IdP's sign-in / QR surface. */
+const POPUP_FEATURES = 'popup=yes,width=460,height=700,menubar=no,toolbar=no,location=no,status=no';
+
+/**
+ * How long a popup sign-in may stay unanswered (ms).
+ *
+ * Generous on purpose: the IdP surface can involve scanning a QR and approving
+ * on a phone, so this tracks the authorize handle's own ~5-minute lifetime
+ * rather than a UI-scale timeout. It is a backstop against a wedged popup, not
+ * a pace-setter — a user who gives up closes the window and gets the faster
+ * `closed` outcome.
+ */
+const DEFAULT_OAUTH_POPUP_TIMEOUT_MS = exports.DEFAULT_OAUTH_POPUP_TIMEOUT_MS = 300_000;
+
+/** How often the popup's `closed` flag is sampled (ms). */
+const CLOSE_POLL_INTERVAL_MS = 1000;
+
+/**
+ * Grace period (ms) after `closed` flips before reporting cancellation.
+ *
+ * The IdP posts its result and THEN closes itself. Both land as separate tasks,
+ * so a poll tick that happens to fall between them would otherwise turn a
+ * successful sign-in into a "user cancelled". One short grace window lets the
+ * already-queued message win.
+ */
+const CLOSE_GRACE_MS = 400;
+
+/** The `message` half of the DOM host, absent on native and during SSR. */
+
+/** The `open` half of the DOM host, absent on native and during SSR. */
+
+function messageEventHost() {
+  const win = globalThis.window;
+  if (!win || typeof win.addEventListener !== 'function' || typeof win.removeEventListener !== 'function') {
+    return null;
+  }
+  return win;
+}
+
+/**
+ * Open a new, EMPTY sign-in popup.
+ *
+ * MUST be called SYNCHRONOUSLY from a user-gesture handler, before any `await`.
+ * Returns `null` when the browser blocked it, when `window.open` threw, and on
+ * hosts with no DOM (native / SSR) — never throws, because "no popup" is an
+ * ordinary outcome the caller answers by falling back to a redirect.
+ */
+function openOAuthPopup() {
+  const win = globalThis.window;
+  if (!win || typeof win.open !== 'function') return null;
+  try {
+    return win.open('', OXY_OAUTH_POPUP_WINDOW_NAME, POPUP_FEATURES) ?? null;
+  } catch (error) {
+    _core.logger.warn('Could not open the OAuth sign-in popup', {
+      component: 'oauthPopup'
+    }, error);
+    return null;
+  }
+}
+
+/**
+ * Point an already-open popup at the authorize URL. Returns `false` when the
+ * assignment threw (a window closed between opening and navigating), so the
+ * caller can fall back to a redirect instead of waiting on a dead window.
+ */
+function navigateOAuthPopup(popup, url) {
+  try {
+    popup.location.href = url;
+    return true;
+  } catch (error) {
+    _core.logger.warn('Could not navigate the OAuth sign-in popup', {
+      component: 'oauthPopup'
+    }, error);
+    return false;
+  }
+}
+
+/** Close the popup if it is still open. Idempotent, null-safe, never throws. */
+function closeOAuthPopup(popup) {
+  if (!popup || popup.closed) return;
+  try {
+    popup.close();
+  } catch (error) {
+    _core.logger.debug('OAuth popup close failed', {
+      component: 'oauthPopup'
+    }, error);
+  }
+}
+
+/** Inputs for {@link awaitOAuthPopupResult}. */
+
+/**
+ * Wait for the popup to deliver an authorization result.
+ *
+ * Settles EXACTLY once, with a typed outcome for every path — code, IdP error,
+ * state mismatch, user-closed, timeout — and removes its listener, its close
+ * poll, and both timers before resolving, whatever the outcome. Messages that
+ * arrive after settling reach nothing, so a duplicate delivery is inert.
+ *
+ * Never rejects: closing the window and running out of time are expected
+ * outcomes, not exceptions.
+ */
+function awaitOAuthPopupResult(options) {
+  const {
+    popup,
+    expectedOrigin,
+    expectedState,
+    timeoutMs = DEFAULT_OAUTH_POPUP_TIMEOUT_MS
+  } = options;
+  const host = messageEventHost();
+  if (!host) return Promise.resolve({
+    kind: 'unsupported'
+  });
+  return new Promise(resolve => {
+    let settled = false;
+    let timeoutTimer = null;
+    let closeGraceTimer = null;
+    let closePoll = null;
+    const onMessage = event => {
+      const verdict = (0, _oauthPopupMessages.readOAuthPopupMessage)(event, {
+        expectedOrigin,
+        expectedState,
+        popup
+      });
+      switch (verdict.kind) {
+        case 'ignore':
+          return;
+        case 'code':
+          settle({
+            kind: 'code',
+            code: verdict.code,
+            state: verdict.state
+          });
+          return;
+        case 'oauth-error':
+          settle({
+            kind: 'oauth-error',
+            error: verdict.error,
+            ...(verdict.errorDescription ? {
+              errorDescription: verdict.errorDescription
+            } : {})
+          });
+          return;
+        case 'state-mismatch':
+          settle({
+            kind: 'state-mismatch'
+          });
+          return;
+      }
+    };
+    const cleanup = () => {
+      host.removeEventListener('message', onMessage);
+      if (timeoutTimer !== null) {
+        clearTimeout(timeoutTimer);
+        timeoutTimer = null;
+      }
+      if (closeGraceTimer !== null) {
+        clearTimeout(closeGraceTimer);
+        closeGraceTimer = null;
+      }
+      if (closePoll !== null) {
+        clearInterval(closePoll);
+        closePoll = null;
+      }
+    };
+    function settle(outcome) {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      resolve(outcome);
+    }
+    host.addEventListener('message', onMessage);
+    timeoutTimer = setTimeout(() => settle({
+      kind: 'timed-out'
+    }), timeoutMs);
+    closePoll = setInterval(() => {
+      if (!popup.closed) return;
+      // Stop sampling immediately: the window is gone and only the in-flight
+      // message (if any) can still change the outcome.
+      if (closePoll !== null) {
+        clearInterval(closePoll);
+        closePoll = null;
+      }
+      closeGraceTimer = setTimeout(() => settle({
+        kind: 'closed'
+      }), CLOSE_GRACE_MS);
+    }, CLOSE_POLL_INTERVAL_MS);
+  });
+}
+//# sourceMappingURL=oauthPopup.js.map

package/lib/commonjs/ui/oauth/oauthPopup.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_core","require","_oauthPopupMessages","OXY_OAUTH_POPUP_WINDOW_NAME","exports","POPUP_FEATURES","DEFAULT_OAUTH_POPUP_TIMEOUT_MS","CLOSE_POLL_INTERVAL_MS","CLOSE_GRACE_MS","messageEventHost","win","globalThis","window","addEventListener","removeEventListener","openOAuthPopup","open","error","logger","warn","component","navigateOAuthPopup","popup","url","location","href","closeOAuthPopup","closed","close","debug","awaitOAuthPopupResult","options","expectedOrigin","expectedState","timeoutMs","host","Promise","resolve","kind","settled","timeoutTimer","closeGraceTimer","closePoll","onMessage","event","verdict","readOAuthPopupMessage","settle","code","state","errorDescription","cleanup","clearTimeout","clearInterval","outcome","setTimeout","setInterval"],"sourceRoot":"../../../../src","sources":["ui/oauth/oauthPopup.ts"],"mappings":";;;;;;;;;;AAqBA,IAAAA,KAAA,GAAAC,OAAA;AACA,IAAAC,mBAAA,GAAAD,OAAA;AAtBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAMA;AACA;AACA;AACA;AACO,MAAME,2BAA2B,GAAAC,OAAA,CAAAD,2BAAA,GAAG,WAAW;;AAEtD;AACA,MAAME,cAAc,GAAG,4EAA4E;;AAEnG;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMC,8BAA8B,GAAAF,OAAA,CAAAE,8BAAA,GAAG,OAAO;;AAErD;AACA,MAAMC,sBAAsB,GAAG,IAAI;;AAEnC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,cAAc,GAAG,GAAG;;AAE1B;;AAMA;;AAKA,SAASC,gBAAgBA,CAAA,EAA4B;EACnD,MAAMC,GAAG,GAAIC,UAAU,CAA4CC,MAAM;EACzE,IAAI,CAACF,GAAG,IAAI,OAAOA,GAAG,CAACG,gBAAgB,KAAK,UAAU,IAAI,OAAOH,GAAG,CAACI,mBAAmB,KAAK,UAAU,EAAE;IACvG,OAAO,IAAI;EACb;EACA,OAAOJ,GAAG;AACZ;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASK,cAAcA,CAAA,EAA4B;EACxD,MAAML,GAAG,GAAIC,UAAU,CAAkCC,MAAM;EAC/D,IAAI,CAACF,GAAG,IAAI,OAAOA,GAAG,CAACM,IAAI,KAAK,UAAU,EAAE,OAAO,IAAI;EACvD,IAAI;IACF,OAAON,GAAG,CAACM,IAAI,CAAC,EAAE,EAAEb,2BAA2B,EAAEE,cAAc,CAAC,IAAI,IAAI;EAC1E,CAAC,CAAC,OAAOY,KAAK,EAAE;IACdC,YAAM,CAACC,IAAI,CAAC,wCAAwC,EAAE;MAAEC,SAAS,EAAE;IAAa,CAAC,EAAEH,KAAK,CAAC;IACzF,OAAO,IAAI;EACb;AACF;;AAEA;AACA;AACA;AACA;AACA;AACO,SAASI,kBAAkBA,CAACC,KAAuB,EAAEC,GAAW,EAAW;EAChF,IAAI;IACFD,KAAK,CAACE,QAAQ,CAACC,IAAI,GAAGF,GAAG;IACzB,OAAO,IAAI;EACb,CAAC,CAAC,OAAON,KAAK,EAAE;IACdC,YAAM,CAACC,IAAI,CAAC,4CAA4C,EAAE;MAAEC,SAAS,EAAE;IAAa,CAAC,EAAEH,KAAK,CAAC;IAC7F,OAAO,KAAK;EACd;AACF;;AAEA;AACO,SAASS,eAAeA,CAACJ,KAA8B,EAAQ;EACpE,IAAI,CAACA,KAAK,IAAIA,KAAK,CAACK,MAAM,EAAE;EAC5B,IAAI;IACFL,KAAK,CAACM,KAAK,CAAC,CAAC;EACf,CAAC,CAAC,OAAOX,KAAK,EAAE;IACdC,YAAM,CAACW,KAAK,CAAC,0BAA0B,EAAE;MAAET,SAAS,EAAE;IAAa,CAAC,EAAEH,KAAK,CAAC;EAC9E;AACF;;AAEA;;AAYA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASa,qBAAqBA,CACnCC,OAA+B,EACH;EAC5B,MAAM;IAAET,KAAK;IAAEU,cAAc;IAAEC,aAAa;IAAEC,SAAS,GAAG5B;EAA+B,CAAC,GACxFyB,OAAO;EAET,MAAMI,IAAI,GAAG1B,gBAAgB,CAAC,CAAC;EAC/B,IAAI,CAAC0B,IAAI,EAAE,OAAOC,OAAO,CAACC,OAAO,CAAC;IAAEC,IAAI,EAAE;EAAc,CAAC,CAAC;EAE1D,OAAO,IAAIF,OAAO,CAAqBC,OAAO,IAAK;IACjD,IAAIE,OAAO,GAAG,KAAK;IACnB,IAAIC,YAAkD,GAAG,IAAI;IAC7D,IAAIC,eAAqD,GAAG,IAAI;IAChE,IAAIC,SAAgD,GAAG,IAAI;IAE3D,MAAMC,SAAS,GAAIC,KAAmB,IAAW;MAC/C,MAAMC,OAAO,GAAG,IAAAC,yCAAqB,EAACF,KAAK,EAAE;QAAEZ,cAAc;QAAEC,aAAa;QAAEX;MAAM,CAAC,CAAC;MACtF,QAAQuB,OAAO,CAACP,IAAI;QAClB,KAAK,QAAQ;UACX;QACF,KAAK,MAAM;UACTS,MAAM,CAAC;YAAET,IAAI,EAAE,MAAM;YAAEU,IAAI,EAAEH,OAAO,CAACG,IAAI;YAAEC,KAAK,EAAEJ,OAAO,CAACI;UAAM,CAAC,CAAC;UAClE;QACF,KAAK,aAAa;UAChBF,MAAM,CAAC;YACLT,IAAI,EAAE,aAAa;YACnBrB,KAAK,EAAE4B,OAAO,CAAC5B,KAAK;YACpB,IAAI4B,OAAO,CAACK,gBAAgB,GAAG;cAAEA,gBAAgB,EAAEL,OAAO,CAACK;YAAiB,CAAC,GAAG,CAAC,CAAC;UACpF,CAAC,CAAC;UACF;QACF,KAAK,gBAAgB;UACnBH,MAAM,CAAC;YAAET,IAAI,EAAE;UAAiB,CAAC,CAAC;UAClC;MACJ;IACF,CAAC;IAED,MAAMa,OAAO,GAAGA,CAAA,KAAY;MAC1BhB,IAAI,CAACrB,mBAAmB,CAAC,SAAS,EAAE6B,SAAS,CAAC;MAC9C,IAAIH,YAAY,KAAK,IAAI,EAAE;QACzBY,YAAY,CAACZ,YAAY,CAAC;QAC1BA,YAAY,GAAG,IAAI;MACrB;MACA,IAAIC,eAAe,KAAK,IAAI,EAAE;QAC5BW,YAAY,CAACX,eAAe,CAAC;QAC7BA,eAAe,GAAG,IAAI;MACxB;MACA,IAAIC,SAAS,KAAK,IAAI,EAAE;QACtBW,aAAa,CAACX,SAAS,CAAC;QACxBA,SAAS,GAAG,IAAI;MAClB;IACF,CAAC;IAED,SAASK,MAAMA,CAACO,OAA0B,EAAQ;MAChD,IAAIf,OAAO,EAAE;MACbA,OAAO,GAAG,IAAI;MACdY,OAAO,CAAC,CAAC;MACTd,OAAO,CAACiB,OAAO,CAAC;IAClB;IAEAnB,IAAI,CAACtB,gBAAgB,CAAC,SAAS,EAAE8B,SAAS,CAAC;IAE3CH,YAAY,GAAGe,UAAU,CAAC,MAAMR,MAAM,CAAC;MAAET,IAAI,EAAE;IAAY,CAAC,CAAC,EAAEJ,SAAS,CAAC;IAEzEQ,SAAS,GAAGc,WAAW,CAAC,MAAM;MAC5B,IAAI,CAAClC,KAAK,CAACK,MAAM,EAAE;MACnB;MACA;MACA,IAAIe,SAAS,KAAK,IAAI,EAAE;QACtBW,aAAa,CAACX,SAAS,CAAC;QACxBA,SAAS,GAAG,IAAI;MAClB;MACAD,eAAe,GAAGc,UAAU,CAAC,MAAMR,MAAM,CAAC;QAAET,IAAI,EAAE;MAAS,CAAC,CAAC,EAAE9B,cAAc,CAAC;IAChF,CAAC,EAAED,sBAAsB,CAAC;EAC5B,CAAC,CAAC;AACJ","ignoreList":[]}

package/lib/commonjs/ui/oauth/oauthPopupMessages.js

@@ -0,0 +1,141 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.OXY_OAUTH_ERROR_MESSAGE_TYPE = exports.OXY_OAUTH_CODE_MESSAGE_TYPE = void 0;
+exports.parseOAuthPopupMessage = parseOAuthPopupMessage;
+exports.readOAuthPopupMessage = readOAuthPopupMessage;
+var _core = require("@oxyhq/core");
+/**
+ * Runtime validation for the popup OAuth `postMessage` channel.
+ *
+ * Everything arriving on `window`'s `message` event is untrusted: any frame on
+ * the page, any other popup, and any browser extension can post to us. This
+ * module is the ONLY place that decides whether an incoming event is a genuine
+ * authorization response, and it answers with a value — never a thrown error.
+ *
+ * A message is accepted only when ALL of these hold:
+ *   1. `event.origin` is EXACTLY the authorize endpoint's origin,
+ *   2. `event.source` is the exact `Window` reference we opened,
+ *   3. `event.data` matches one of the two frozen message shapes,
+ *   4. the `state` it carries matches the one this RP sent.
+ *
+ * Failing (1)–(3) is indistinguishable from unrelated page traffic, so the
+ * message is IGNORED and the flow keeps waiting. Failing (4) means our own
+ * popup answered a different request than the one in flight, which is terminal:
+ * it is reported as a mismatch rather than left to hang until the timeout.
+ */
+
+/** `postMessage` discriminator for a successful authorization. */
+const OXY_OAUTH_CODE_MESSAGE_TYPE = exports.OXY_OAUTH_CODE_MESSAGE_TYPE = 'oxy:oauth:code';
+
+/** `postMessage` discriminator for a typed OAuth failure. */
+const OXY_OAUTH_ERROR_MESSAGE_TYPE = exports.OXY_OAUTH_ERROR_MESSAGE_TYPE = 'oxy:oauth:error';
+
+/** Verdict for one incoming `message` event. */
+
+/** What {@link readOAuthPopupMessage} validates an event against. */
+
+function isNonEmptyString(value) {
+  return typeof value === 'string' && value.length > 0;
+}
+
+/**
+ * Reference equality across two `unknown` values.
+ *
+ * `event.source` is a `WindowProxy` and {@link OAuthPopupHandle} is a narrow
+ * structural type, so comparing them directly is a type error. Widening both to
+ * `unknown` keeps the check a plain identity comparison — which is exactly the
+ * security property we want — without a cast.
+ */
+function isSameWindowReference(a, b) {
+  return a === b;
+}
+
+/**
+ * Parse untrusted `event.data` into one of the two frozen message shapes, or
+ * `null` when it is anything else (including `null`, primitives, arrays, and
+ * objects with missing/wrong-typed fields).
+ *
+ * Unknown extra properties are tolerated but never read: only the fields below
+ * are ever surfaced, so a hostile sender cannot smuggle values past this point.
+ */
+function parseOAuthPopupMessage(data) {
+  if (typeof data !== 'object' || data === null || Array.isArray(data)) return null;
+  const record = data;
+  if (record.type === OXY_OAUTH_CODE_MESSAGE_TYPE) {
+    if (!isNonEmptyString(record.code) || !isNonEmptyString(record.state)) return null;
+    return {
+      type: OXY_OAUTH_CODE_MESSAGE_TYPE,
+      code: record.code,
+      state: record.state
+    };
+  }
+  if (record.type === OXY_OAUTH_ERROR_MESSAGE_TYPE) {
+    if (!isNonEmptyString(record.error)) return null;
+    return {
+      type: OXY_OAUTH_ERROR_MESSAGE_TYPE,
+      error: record.error,
+      ...(isNonEmptyString(record.errorDescription) ? {
+        errorDescription: record.errorDescription
+      } : {}),
+      ...(isNonEmptyString(record.state) ? {
+        state: record.state
+      } : {})
+    };
+  }
+  return null;
+}
+
+/**
+ * Classify one `message` event against the in-flight authorize request.
+ *
+ * Never throws. See the module header for the acceptance rules.
+ */
+function readOAuthPopupMessage(event, context) {
+  if (event.origin !== context.expectedOrigin) return {
+    kind: 'ignore'
+  };
+  if (!isSameWindowReference(event.source, context.popup)) return {
+    kind: 'ignore'
+  };
+  const message = parseOAuthPopupMessage(event.data);
+  if (!message) {
+    // Origin and source matched, so this came from the IdP window we opened —
+    // a shape we cannot read is worth a breadcrumb, unlike ordinary page noise.
+    _core.logger.debug('Ignored an unrecognised message from the OAuth popup', {
+      component: 'oauthPopupMessages'
+    });
+    return {
+      kind: 'ignore'
+    };
+  }
+  if (message.type === OXY_OAUTH_CODE_MESSAGE_TYPE) {
+    if (message.state !== context.expectedState) return {
+      kind: 'state-mismatch'
+    };
+    return {
+      kind: 'code',
+      code: message.code,
+      state: message.state
+    };
+  }
+
+  // An error MAY carry `state` (the IdP omits it when the request never got far
+  // enough to bind one). When present it must match: a foreign error must not be
+  // able to end an unrelated in-flight sign-in.
+  if (message.state !== undefined && message.state !== context.expectedState) {
+    return {
+      kind: 'state-mismatch'
+    };
+  }
+  return {
+    kind: 'oauth-error',
+    error: message.error,
+    ...(message.errorDescription ? {
+      errorDescription: message.errorDescription
+    } : {})
+  };
+}
+//# sourceMappingURL=oauthPopupMessages.js.map

package/lib/commonjs/ui/oauth/oauthPopupMessages.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["_core","require","OXY_OAUTH_CODE_MESSAGE_TYPE","exports","OXY_OAUTH_ERROR_MESSAGE_TYPE","isNonEmptyString","value","length","isSameWindowReference","a","b","parseOAuthPopupMessage","data","Array","isArray","record","type","code","state","error","errorDescription","readOAuthPopupMessage","event","context","origin","expectedOrigin","kind","source","popup","message","logger","debug","component","expectedState","undefined"],"sourceRoot":"../../../../src","sources":["ui/oauth/oauthPopupMessages.ts"],"mappings":";;;;;;;;AAoBA,IAAAA,KAAA,GAAAC,OAAA;AApBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAKA;AACO,MAAMC,2BAA2B,GAAAC,OAAA,CAAAD,2BAAA,GAAG,gBAAgB;;AAE3D;AACO,MAAME,4BAA4B,GAAAD,OAAA,CAAAC,4BAAA,GAAG,iBAAiB;;AAE7D;;AASA;;AAUA,SAASC,gBAAgBA,CAACC,KAAc,EAAmB;EACzD,OAAO,OAAOA,KAAK,KAAK,QAAQ,IAAIA,KAAK,CAACC,MAAM,GAAG,CAAC;AACtD;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASC,qBAAqBA,CAACC,CAAU,EAAEC,CAAU,EAAW;EAC9D,OAAOD,CAAC,KAAKC,CAAC;AAChB;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,sBAAsBA,CAACC,IAAa,EAA0B;EAC5E,IAAI,OAAOA,IAAI,KAAK,QAAQ,IAAIA,IAAI,KAAK,IAAI,IAAIC,KAAK,CAACC,OAAO,CAACF,IAAI,CAAC,EAAE,OAAO,IAAI;EACjF,MAAMG,MAAM,GAAGH,IAA+B;EAE9C,IAAIG,MAAM,CAACC,IAAI,KAAKd,2BAA2B,EAAE;IAC/C,IAAI,CAACG,gBAAgB,CAACU,MAAM,CAACE,IAAI,CAAC,IAAI,CAACZ,gBAAgB,CAACU,MAAM,CAACG,KAAK,CAAC,EAAE,OAAO,IAAI;IAClF,OAAO;MAAEF,IAAI,EAAEd,2BAA2B;MAAEe,IAAI,EAAEF,MAAM,CAACE,IAAI;MAAEC,KAAK,EAAEH,MAAM,CAACG;IAAM,CAAC;EACtF;EAEA,IAAIH,MAAM,CAACC,IAAI,KAAKZ,4BAA4B,EAAE;IAChD,IAAI,CAACC,gBAAgB,CAACU,MAAM,CAACI,KAAK,CAAC,EAAE,OAAO,IAAI;IAChD,OAAO;MACLH,IAAI,EAAEZ,4BAA4B;MAClCe,KAAK,EAAEJ,MAAM,CAACI,KAAK;MACnB,IAAId,gBAAgB,CAACU,MAAM,CAACK,gBAAgB,CAAC,GACzC;QAAEA,gBAAgB,EAAEL,MAAM,CAACK;MAAiB,CAAC,GAC7C,CAAC,CAAC,CAAC;MACP,IAAIf,gBAAgB,CAACU,MAAM,CAACG,KAAK,CAAC,GAAG;QAAEA,KAAK,EAAEH,MAAM,CAACG;MAAM,CAAC,GAAG,CAAC,CAAC;IACnE,CAAC;EACH;EAEA,OAAO,IAAI;AACb;;AAEA;AACA;AACA;AACA;AACA;AACO,SAASG,qBAAqBA,CACnCC,KAAmB,EACnBC,OAAiC,EACP;EAC1B,IAAID,KAAK,CAACE,MAAM,KAAKD,OAAO,CAACE,cAAc,EAAE,OAAO;IAAEC,IAAI,EAAE;EAAS,CAAC;EACtE,IAAI,CAAClB,qBAAqB,CAACc,KAAK,CAACK,MAAM,EAAEJ,OAAO,CAACK,KAAK,CAAC,EAAE,OAAO;IAAEF,IAAI,EAAE;EAAS,CAAC;EAElF,MAAMG,OAAO,GAAGlB,sBAAsB,CAACW,KAAK,CAACV,IAAI,CAAC;EAClD,IAAI,CAACiB,OAAO,EAAE;IACZ;IACA;IACAC,YAAM,CAACC,KAAK,CACV,sDAAsD,EACtD;MAAEC,SAAS,EAAE;IAAqB,CACpC,CAAC;IACD,OAAO;MAAEN,IAAI,EAAE;IAAS,CAAC;EAC3B;EAEA,IAAIG,OAAO,CAACb,IAAI,KAAKd,2BAA2B,EAAE;IAChD,IAAI2B,OAAO,CAACX,KAAK,KAAKK,OAAO,CAACU,aAAa,EAAE,OAAO;MAAEP,IAAI,EAAE;IAAiB,CAAC;IAC9E,OAAO;MAAEA,IAAI,EAAE,MAAM;MAAET,IAAI,EAAEY,OAAO,CAACZ,IAAI;MAAEC,KAAK,EAAEW,OAAO,CAACX;IAAM,CAAC;EACnE;;EAEA;EACA;EACA;EACA,IAAIW,OAAO,CAACX,KAAK,KAAKgB,SAAS,IAAIL,OAAO,CAACX,KAAK,KAAKK,OAAO,CAACU,aAAa,EAAE;IAC1E,OAAO;MAAEP,IAAI,EAAE;IAAiB,CAAC;EACnC;EACA,OAAO;IACLA,IAAI,EAAE,aAAa;IACnBP,KAAK,EAAEU,OAAO,CAACV,KAAK;IACpB,IAAIU,OAAO,CAACT,gBAAgB,GAAG;MAAEA,gBAAgB,EAAES,OAAO,CAACT;IAAiB,CAAC,GAAG,CAAC,CAAC;EACpF,CAAC;AACH","ignoreList":[]}

package/lib/commonjs/ui/oauth/types.js

@@ -0,0 +1,2 @@
+"use strict";
+//# sourceMappingURL=types.js.map

package/lib/commonjs/ui/oauth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"names":[],"sourceRoot":"../../../../src","sources":["ui/oauth/types.ts"],"mappings":"","ignoreList":[]}

package/lib/commonjs/ui/screens/AccountMembersScreen.js

@@ -6,7 +6,7 @@ Object.defineProperty(exports, "__esModule", {
 exports.default = void 0;
 var _react = require("react");
 var _reactNative = require("react-native");
-var _vectorIcons = require("@expo/vector-icons");
+var _Ionicons = _interopRequireDefault(require("@expo/vector-icons/Ionicons"));
 var _reactQuery = require("@tanstack/react-query");
 var _bloom = require("@oxyhq/bloom");
 var _surfaces = require("@oxyhq/bloom/surfaces");
@@ -19,6 +19,7 @@ var _OxyContext = require("../context/OxyContext.js");
 var _useI18n = require("../hooks/useI18n.js");
 var _useSurfaceHeader = require("../hooks/useSurfaceHeader.js");
 var _jsxRuntime = require("react/jsx-runtime");
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 /** Roles assignable via invite / role change — everything except `owner`. */
 
 const ASSIGNABLE_ROLES = ['admin', 'editor', 'developer', 'billing', 'viewer'];
@@ -362,7 +363,7 @@ const AccountMembersScreen = ({
                   onPress: () => confirmTransfer(member),
                   activeOpacity: 0.7,
                   className: "flex-row items-center gap-space-4",
-                  children: [/*#__PURE__*/(0, _jsxRuntime.jsx)(_vectorIcons.Ionicons, {
+                  children: [/*#__PURE__*/(0, _jsxRuntime.jsx)(_Ionicons.default, {
                     name: "swap-horizontal-outline",
                     size: 16,
                     color: colors.icon
@@ -376,7 +377,7 @@ const AccountMembersScreen = ({
                   onPress: () => confirmRemove(member),
                   activeOpacity: 0.7,
                   className: "flex-row items-center gap-space-4",
-                  children: [/*#__PURE__*/(0, _jsxRuntime.jsx)(_vectorIcons.Ionicons, {
+                  children: [/*#__PURE__*/(0, _jsxRuntime.jsx)(_Ionicons.default, {
                     name: "trash-outline",
                     size: 16,
                     color: colors.error