@oxyhq/services 22.12.4 → 22.12.7

package/src/ui/oauth/oauthPopupMessages.ts

@@ -0,0 +1,136 @@
+/**
+ * Runtime validation for the popup OAuth `postMessage` channel.
+ *
+ * Everything arriving on `window`'s `message` event is untrusted: any frame on
+ * the page, any other popup, and any browser extension can post to us. This
+ * module is the ONLY place that decides whether an incoming event is a genuine
+ * authorization response, and it answers with a value — never a thrown error.
+ *
+ * A message is accepted only when ALL of these hold:
+ *   1. `event.origin` is EXACTLY the authorize endpoint's origin,
+ *   2. `event.source` is the exact `Window` reference we opened,
+ *   3. `event.data` matches one of the two frozen message shapes,
+ *   4. the `state` it carries matches the one this RP sent.
+ *
+ * Failing (1)–(3) is indistinguishable from unrelated page traffic, so the
+ * message is IGNORED and the flow keeps waiting. Failing (4) means our own
+ * popup answered a different request than the one in flight, which is terminal:
+ * it is reported as a mismatch rather than left to hang until the timeout.
+ */
+
+import { logger } from '@oxyhq/core';
+import type { OAuthPopupHandle, OxyOAuthMessage } from './types';
+
+/** `postMessage` discriminator for a successful authorization. */
+export const OXY_OAUTH_CODE_MESSAGE_TYPE = 'oxy:oauth:code';
+
+/** `postMessage` discriminator for a typed OAuth failure. */
+export const OXY_OAUTH_ERROR_MESSAGE_TYPE = 'oxy:oauth:error';
+
+/** Verdict for one incoming `message` event. */
+export type OAuthPopupMessageVerdict =
+  /** Not ours (wrong origin/source) or not a valid message — keep waiting. */
+  | { kind: 'ignore' }
+  | { kind: 'code'; code: string; state: string }
+  | { kind: 'oauth-error'; error: string; errorDescription?: string }
+  /** Well-formed, from our popup, but bound to a different authorize request. */
+  | { kind: 'state-mismatch' };
+
+/** What {@link readOAuthPopupMessage} validates an event against. */
+export interface OAuthPopupMessageContext {
+  /** Exact origin of the authorize endpoint (`new URL(authorizeUrl).origin`). */
+  expectedOrigin: string;
+  /** The CSRF `state` this RP sent on the authorize request. */
+  expectedState: string;
+  /** The exact popup reference `window.open()` returned. */
+  popup: OAuthPopupHandle;
+}
+
+function isNonEmptyString(value: unknown): value is string {
+  return typeof value === 'string' && value.length > 0;
+}
+
+/**
+ * Reference equality across two `unknown` values.
+ *
+ * `event.source` is a `WindowProxy` and {@link OAuthPopupHandle} is a narrow
+ * structural type, so comparing them directly is a type error. Widening both to
+ * `unknown` keeps the check a plain identity comparison — which is exactly the
+ * security property we want — without a cast.
+ */
+function isSameWindowReference(a: unknown, b: unknown): boolean {
+  return a === b;
+}
+
+/**
+ * Parse untrusted `event.data` into one of the two frozen message shapes, or
+ * `null` when it is anything else (including `null`, primitives, arrays, and
+ * objects with missing/wrong-typed fields).
+ *
+ * Unknown extra properties are tolerated but never read: only the fields below
+ * are ever surfaced, so a hostile sender cannot smuggle values past this point.
+ */
+export function parseOAuthPopupMessage(data: unknown): OxyOAuthMessage | null {
+  if (typeof data !== 'object' || data === null || Array.isArray(data)) return null;
+  const record = data as Record<string, unknown>;
+
+  if (record.type === OXY_OAUTH_CODE_MESSAGE_TYPE) {
+    if (!isNonEmptyString(record.code) || !isNonEmptyString(record.state)) return null;
+    return { type: OXY_OAUTH_CODE_MESSAGE_TYPE, code: record.code, state: record.state };
+  }
+
+  if (record.type === OXY_OAUTH_ERROR_MESSAGE_TYPE) {
+    if (!isNonEmptyString(record.error)) return null;
+    return {
+      type: OXY_OAUTH_ERROR_MESSAGE_TYPE,
+      error: record.error,
+      ...(isNonEmptyString(record.errorDescription)
+        ? { errorDescription: record.errorDescription }
+        : {}),
+      ...(isNonEmptyString(record.state) ? { state: record.state } : {}),
+    };
+  }
+
+  return null;
+}
+
+/**
+ * Classify one `message` event against the in-flight authorize request.
+ *
+ * Never throws. See the module header for the acceptance rules.
+ */
+export function readOAuthPopupMessage(
+  event: MessageEvent,
+  context: OAuthPopupMessageContext,
+): OAuthPopupMessageVerdict {
+  if (event.origin !== context.expectedOrigin) return { kind: 'ignore' };
+  if (!isSameWindowReference(event.source, context.popup)) return { kind: 'ignore' };
+
+  const message = parseOAuthPopupMessage(event.data);
+  if (!message) {
+    // Origin and source matched, so this came from the IdP window we opened —
+    // a shape we cannot read is worth a breadcrumb, unlike ordinary page noise.
+    logger.debug(
+      'Ignored an unrecognised message from the OAuth popup',
+      { component: 'oauthPopupMessages' },
+    );
+    return { kind: 'ignore' };
+  }
+
+  if (message.type === OXY_OAUTH_CODE_MESSAGE_TYPE) {
+    if (message.state !== context.expectedState) return { kind: 'state-mismatch' };
+    return { kind: 'code', code: message.code, state: message.state };
+  }
+
+  // An error MAY carry `state` (the IdP omits it when the request never got far
+  // enough to bind one). When present it must match: a foreign error must not be
+  // able to end an unrelated in-flight sign-in.
+  if (message.state !== undefined && message.state !== context.expectedState) {
+    return { kind: 'state-mismatch' };
+  }
+  return {
+    kind: 'oauth-error',
+    error: message.error,
+    ...(message.errorDescription ? { errorDescription: message.errorDescription } : {}),
+  };
+}

package/src/ui/oauth/types.ts

@@ -0,0 +1,150 @@
+/**
+ * Typed contracts shared by the browser "Sign in with Oxy" OAuth transports.
+ *
+ * Two transports deliver the same authorization code to the same completion
+ * path (see `completeOAuthCode.ts`):
+ *
+ * - `redirect` — the historical full-page hand-off to `auth.oxy.so/authorize`.
+ *   The RP tab navigates away and comes back to its registered `redirect_uri`
+ *   with `?code=…&state=…`; cold boot finishes the exchange.
+ * - `popup` — a small `auth.oxy.so` window opened from the user's click. The RP
+ *   stays mounted with its route and unsaved state intact; the IdP delivers the
+ *   result to `window.opener` via `postMessage` and closes itself.
+ *
+ * Only the authorization code, the CSRF `state`, and a typed OAuth error ever
+ * cross the `postMessage` channel. Access tokens, device secrets, and the PKCE
+ * `code_verifier` NEVER do — the opener keeps the verifier and performs the code
+ * exchange itself.
+ */
+
+/** How a web relying party hands the user to the IdP for third-party sign-in. */
+export type WebAuthMode = 'popup' | 'redirect';
+
+/**
+ * Minimal structural handle over a popup `Window` — exactly what the popup
+ * transport needs: navigate it once the authorize URL is built, detect the user
+ * closing it (`closed`, polled — there is no cross-origin close event), and
+ * close it programmatically on completion. Satisfied directly by the value
+ * `window.open()` returns.
+ *
+ * Deliberately NOT `Window`: the transport must never read cross-origin
+ * properties off the popup, and a narrow handle makes that impossible to do by
+ * accident (and trivial to fake in tests).
+ */
+export interface OAuthPopupHandle {
+  readonly closed: boolean;
+  close(): void;
+  location: { href: string };
+}
+
+/**
+ * The RP-side OAuth handshake for one authorize request: the CSRF `state` sent
+ * to the IdP and the PKCE `code_verifier` replayed on the token exchange.
+ *
+ * In `redirect` mode it is persisted to `sessionStorage` across the full-page
+ * navigation; in `popup` mode it never leaves memory.
+ */
+export interface OAuthHandshake {
+  /** Opaque CSRF token echoed back by the IdP and validated before any exchange. */
+  state: string;
+  /** The PKCE secret. Never crosses `postMessage`, a URL, or storage in popup mode. */
+  codeVerifier: string;
+}
+
+/** Successful authorization delivered by the IdP over `postMessage`. */
+export interface OxyOAuthCodeMessage {
+  type: 'oxy:oauth:code';
+  code: string;
+  state: string;
+}
+
+/** Typed OAuth failure delivered by the IdP over `postMessage`. */
+export interface OxyOAuthErrorMessage {
+  type: 'oxy:oauth:error';
+  error: string;
+  errorDescription?: string;
+  state?: string;
+}
+
+/** The ONLY two message shapes that may cross the popup channel. */
+export type OxyOAuthMessage = OxyOAuthCodeMessage | OxyOAuthErrorMessage;
+
+/** Session material handed to the provider's commit funnel after an exchange. */
+export interface OAuthSessionCommitInput {
+  sessionId: string;
+  accessToken?: string;
+  deviceId?: string;
+  deviceSecret?: string;
+  userId: string;
+  expiresAt?: string;
+  user?: { id: string; username?: string; avatar?: string };
+}
+
+/**
+ * Terminal outcome of one popup sign-in attempt. Every expected path — the user
+ * closing the window, a timeout, an IdP error — is a value, never a thrown
+ * exception.
+ */
+export type OAuthPopupOutcome =
+  /** The IdP delivered an authorization code whose `state` matched. */
+  | { kind: 'code'; code: string; state: string }
+  /** The IdP delivered a typed OAuth error (`access_denied`, `login_required`, …). */
+  | { kind: 'oauth-error'; error: string; errorDescription?: string }
+  /** A well-formed message from our popup carried the wrong `state`. */
+  | { kind: 'state-mismatch' }
+  /** The user dismissed the popup without completing sign-in. */
+  | { kind: 'closed' }
+  /** No result arrived within the allotted window. */
+  | { kind: 'timed-out' }
+  /** No DOM message host (SSR / native) — the popup transport does not apply. */
+  | { kind: 'unsupported' };
+
+/** Why the shared completion path could not produce a session. */
+export type OAuthCompletionFailure = 'state-mismatch' | 'exchange-failed';
+
+/** Result of the ONE completion path both transports run. */
+export type OAuthCompletionResult =
+  | { ok: true }
+  | { ok: false; reason: OAuthCompletionFailure };
+
+/** Why the transport fell back to a full-page redirect. */
+export type WebOAuthRedirectReason =
+  /** `webAuthMode: 'redirect'` — the configured transport. */
+  | 'redirect-mode'
+  /** The browser refused `window.open` (blocker, or no gesture attribution). */
+  | 'popup-blocked'
+  /** The popup opened but could not be navigated to the authorize URL. */
+  | 'popup-navigation-failed';
+
+/** Why a web sign-in attempt failed outright. */
+export type WebOAuthFailureReason =
+  /** The handshake could not be persisted for the redirect return (no/blocked storage). */
+  | 'handshake-storage'
+  /** The `state` returned by the IdP did not match the one we sent. */
+  | 'state-mismatch'
+  /** `POST /auth/oauth/token` or the session commit failed. */
+  | 'exchange-failed'
+  /** The IdP reported a typed OAuth error. */
+  | 'idp-error';
+
+/** Why a web sign-in attempt was not applicable at all. */
+export type WebOAuthUnsupportedReason =
+  /** Not a browser (native / SSR) — native uses `openAuthorizeUrlNative`. */
+  | 'no-browser'
+  /** `sessionMode: 'identity'` has no third-party OAuth lane by construction. */
+  | 'identity-bound'
+  /** No `clientId` is configured on the provider. */
+  | 'missing-client-id';
+
+/** Terminal, typed outcome of a web third-party sign-in attempt. */
+export type WebOAuthSignInResult =
+  /** A session was committed; the RP is authenticated without a reload. */
+  | { status: 'signed-in' }
+  /** The tab is navigating to the IdP; nothing else will resolve in this document. */
+  | { status: 'redirecting'; via: WebOAuthRedirectReason }
+  /** The user dismissed the popup. */
+  | { status: 'cancelled' }
+  /** No result arrived within the allotted window. */
+  | { status: 'timed-out' }
+  | { status: 'failed'; reason: WebOAuthFailureReason; description?: string }
+  | { status: 'unsupported'; reason: WebOAuthUnsupportedReason };

package/src/ui/screens/AccountMembersScreen.tsx

@@ -5,7 +5,7 @@ import {
   TouchableOpacity,
   ActivityIndicator,
 } from 'react-native';
-import { Ionicons } from '@expo/vector-icons';
+import Ionicons from '@expo/vector-icons/Ionicons';
 import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query';
 import { toast } from '@oxyhq/bloom';
 import { surfaces } from '@oxyhq/bloom/surfaces';

package/src/ui/screens/CreateAccountScreen.tsx

@@ -1,7 +1,7 @@
 import type React from 'react';
 import { useState, useCallback, useRef, useEffect } from 'react';
 import { View, ActivityIndicator } from 'react-native';
-import { Ionicons } from '@expo/vector-icons';
+import Ionicons from '@expo/vector-icons/Ionicons';
 import type { AccountKind, CreateAccountInput, OrganizationCategory } from '@oxyhq/core';
 import { ORGANIZATION_CATEGORIES } from '@oxyhq/core';
 import type { BaseScreenProps } from '../types/navigation';

package/src/ui/screens/EditProfileFieldScreen.tsx

@@ -6,7 +6,7 @@ import {
     TouchableOpacity,
     type TextInputProps,
 } from 'react-native';
-import { Ionicons } from '@expo/vector-icons';
+import Ionicons from '@expo/vector-icons/Ionicons';
 import type { BaseScreenProps } from '../types/navigation';
 import { useTheme } from '@oxyhq/bloom/theme';
 import { Text } from '@oxyhq/bloom/typography';

package/src/ui/screens/FAQScreen.tsx

@@ -1,7 +1,7 @@
 import type React from 'react';
 import { useState, useEffect, useCallback, useMemo } from 'react';
 import { View, ScrollView, StyleSheet } from 'react-native';
-import { Ionicons } from '@expo/vector-icons';
+import Ionicons from '@expo/vector-icons/Ionicons';
 import { toast } from '@oxyhq/bloom';
 import { useTheme } from '@oxyhq/bloom/theme';
 import { Search } from '@oxyhq/bloom/search';

package/src/ui/screens/FeedbackScreen.tsx

@@ -10,7 +10,8 @@ import type { BaseScreenProps } from '../types/navigation';
 import { normalizeTheme } from '@oxyhq/core';
 import { packageInfo } from '@oxyhq/core';
 import { useTheme } from '@oxyhq/bloom/theme';
-import { Ionicons, type MaterialCommunityIcons } from '@expo/vector-icons';
+import Ionicons from '@expo/vector-icons/Ionicons';
+import type MaterialCommunityIcons from '@expo/vector-icons/MaterialCommunityIcons';
 import { toast } from '@oxyhq/bloom';
 import { H2, Text } from '@oxyhq/bloom/typography';
 import { Button } from '@oxyhq/bloom/button';

package/src/ui/screens/FileManagementScreen.tsx

@@ -17,7 +17,8 @@ import type { FileManagementScreenProps } from '../types/fileManagement';
 import { toast } from '@oxyhq/bloom';
 import { surfaces } from '@oxyhq/bloom/surfaces';
 import * as Skeleton from '@oxyhq/bloom/skeleton';
-import { Ionicons, MaterialCommunityIcons } from '@expo/vector-icons';
+import Ionicons from '@expo/vector-icons/Ionicons';
+import MaterialCommunityIcons from '@expo/vector-icons/MaterialCommunityIcons';
 import { Pressable } from 'react-native';
 import type { FileMetadata } from '@oxyhq/core';
 import { queryKeys } from '../hooks/queries/queryKeys';

package/src/ui/screens/LanguageSelectorScreen.tsx

@@ -2,7 +2,7 @@ import React, { useCallback, useMemo, useState } from 'react';
 import { View, StyleSheet, TouchableOpacity } from 'react-native';
 import type { BaseScreenProps } from '../types/navigation';
 import { useTheme } from '@oxyhq/bloom/theme';
-import { Ionicons } from '@expo/vector-icons';
+import Ionicons from '@expo/vector-icons/Ionicons';
 import { toast } from '@oxyhq/bloom';
 import { Text } from '@oxyhq/bloom/typography';
 import { Search } from '@oxyhq/bloom/search';

package/src/ui/screens/ManageAccountScreen.tsx

@@ -6,7 +6,7 @@ import {
     ActivityIndicator,
     Platform,
 } from 'react-native';
-import { Ionicons } from '@expo/vector-icons';
+import Ionicons from '@expo/vector-icons/Ionicons';
 import { toast } from '@oxyhq/bloom';
 import { surfaces } from '@oxyhq/bloom/surfaces';
 import { useTheme } from '@oxyhq/bloom/theme';

package/src/ui/screens/PaymentGatewayScreen.tsx

@@ -10,7 +10,7 @@ import type { BaseScreenProps } from '../types/navigation';
 import { Button } from '@oxyhq/bloom/button';
 import { useTheme } from '@oxyhq/bloom/theme';
 import { H4 } from '@oxyhq/bloom/typography';
-import { Ionicons } from '@expo/vector-icons';
+import Ionicons from '@expo/vector-icons/Ionicons';
 import { useI18n } from '../hooks/useI18n';
 import { useSurfaceHeader } from '../hooks/useSurfaceHeader';
 import QRCode from 'react-native-qrcode-svg';

package/src/ui/screens/PremiumSubscriptionScreen.tsx

@@ -16,7 +16,7 @@ import {
     SegmentedControlItem,
     SegmentedControlItemText,
 } from '@oxyhq/bloom/segmented-control';
-import { Ionicons } from '@expo/vector-icons';
+import Ionicons from '@expo/vector-icons/Ionicons';
 import { useI18n } from '../hooks/useI18n';
 import { useSurfaceHeader } from '../hooks/useSurfaceHeader';
 import { useOxy } from '../context/OxyContext';

package/src/ui/screens/ProfileScreen.tsx

@@ -10,7 +10,7 @@ import { SettingsListGroup, SettingsListItem } from '@oxyhq/bloom/settings-list'
 import { Avatar } from '@oxyhq/bloom/avatar';
 import FollowButton from '../components/FollowButton';
 import { useFollow } from '../hooks/useFollow';
-import { Ionicons } from '@expo/vector-icons';
+import Ionicons from '@expo/vector-icons/Ionicons';
 import { useI18n } from '../hooks/useI18n';
 import { useSurfaceHeader } from '../hooks/useSurfaceHeader';
 import { useOxy } from '../context/OxyContext';

package/src/ui/screens/UserListScreen.tsx

@@ -14,7 +14,7 @@ import { H6, Text } from '@oxyhq/bloom/typography';
 import { Button } from '@oxyhq/bloom/button';
 import { Avatar } from '@oxyhq/bloom/avatar';
 import FollowButton from '../components/FollowButton';
-import { Ionicons } from '@expo/vector-icons';
+import Ionicons from '@expo/vector-icons/Ionicons';
 import { useI18n } from '../hooks/useI18n';
 import { useSurfaceHeader } from '../hooks/useSurfaceHeader';
 import { useOxy } from '../context/OxyContext';

package/src/ui/screens/WelcomeNewUserScreen.tsx

@@ -3,7 +3,7 @@ import { useCallback, useMemo, useRef, useState } from 'react';
 import { View, StyleSheet, Platform, Animated } from 'react-native';
 import type { BaseScreenProps } from '../types/navigation';
 import { Avatar } from '@oxyhq/bloom/avatar';
-import { Ionicons } from '@expo/vector-icons';
+import Ionicons from '@expo/vector-icons/Ionicons';
 import { toast } from '@oxyhq/bloom';
 import { useTheme } from '@oxyhq/bloom/theme';
 import { Button } from '@oxyhq/bloom/button';

package/src/ui/screens/fileManagement/FileLibraryError.tsx

@@ -1,6 +1,6 @@
 import type React from 'react';
 import { View, Text, TouchableOpacity } from 'react-native';
-import { Ionicons } from '@expo/vector-icons';
+import Ionicons from '@expo/vector-icons/Ionicons';
 
 export interface FileLibraryErrorProps {
     title: string;

package/src/ui/screens/fileManagement/FileListSection.tsx

@@ -7,7 +7,7 @@ import {
     RefreshControl,
     ActivityIndicator,
 } from 'react-native';
-import { Ionicons } from '@expo/vector-icons';
+import Ionicons from '@expo/vector-icons/Ionicons';
 import type { FileMetadata } from '@oxyhq/core';
 import { SettingsListGroup, SettingsListItem } from '@oxyhq/bloom/settings-list';
 import type { useTheme } from '@oxyhq/bloom/theme';

package/src/ui/screens/fileManagement/PhotoPickerSection.tsx

@@ -12,7 +12,8 @@ import {
     type LayoutChangeEvent,
 } from 'react-native';
 import { Image as ExpoImage } from 'expo-image';
-import { Ionicons, MaterialCommunityIcons } from '@expo/vector-icons';
+import Ionicons from '@expo/vector-icons/Ionicons';
+import MaterialCommunityIcons from '@expo/vector-icons/MaterialCommunityIcons';
 import * as Skeleton from '@oxyhq/bloom/skeleton';
 import type { FileMetadata } from '@oxyhq/core';
 import { computePhotoGridLayout } from './photoGridLayout';

package/src/ui/screens/fileManagement/UploadBar.tsx

@@ -1,6 +1,6 @@
 import type React from 'react';
 import { View, Text, ActivityIndicator, StyleSheet, Platform, type ViewStyle } from 'react-native';
-import { Ionicons } from '@expo/vector-icons';
+import Ionicons from '@expo/vector-icons/Ionicons';
 
 export interface UploadBarProps {
     /** Aggregate upload progress, or null when indeterminate. */

package/src/ui/screens/trust/TrustCenterScreen.tsx

@@ -2,7 +2,7 @@ import type React from 'react';
 import { useEffect, useMemo, useState } from 'react';
 import { View, StyleSheet } from 'react-native';
 import type { ReputationTransaction, TrustTier } from '@oxyhq/core';
-import { Ionicons } from '@expo/vector-icons';
+import Ionicons from '@expo/vector-icons/Ionicons';
 import { Chip } from '@oxyhq/bloom/chip';
 import { useTheme } from '@oxyhq/bloom/theme';
 import { H1, Text } from '@oxyhq/bloom/typography';

package/src/ui/screens/trust/TrustLeaderboardScreen.tsx

@@ -13,7 +13,7 @@ import { useTheme } from '@oxyhq/bloom/theme';
 import { H6, Text } from '@oxyhq/bloom/typography';
 import { Chip } from '@oxyhq/bloom/chip';
 import { Button } from '@oxyhq/bloom/button';
-import { Ionicons } from '@expo/vector-icons';
+import Ionicons from '@expo/vector-icons/Ionicons';
 import type { BaseScreenProps } from '../../types/navigation';
 import { Avatar } from '@oxyhq/bloom/avatar';
 import { useI18n } from '../../hooks/useI18n';

package/src/ui/screens/trust/TrustRewardsScreen.tsx

@@ -3,7 +3,7 @@ import { useMemo, useState, useEffect } from 'react';
 import { View, StyleSheet } from 'react-native';
 import type { BaseScreenProps } from '../../types/navigation';
 import { useSurfaceHeader } from '../../hooks/useSurfaceHeader';
-import { Ionicons } from '@expo/vector-icons';
+import Ionicons from '@expo/vector-icons/Ionicons';
 import { useTheme } from '@oxyhq/bloom/theme';
 import { H1, H4, H5, Text } from '@oxyhq/bloom/typography';
 import { useI18n } from '../../hooks/useI18n';

package/src/ui/server.ts

@@ -20,8 +20,6 @@ export const LogoIcon = noopComponent;
 export const LogoText = noopComponent;
 export const FollowButton = noopComponent;
 export const OxyPayButton = noopComponent;
-export const FontLoader = noopComponent;
-export const setupFonts = async (): Promise<boolean> => true;
 
 // Context
 export const useOxy = noopHook;

package/src/ui/session/__tests__/createSessionClient.test.ts

@@ -83,4 +83,30 @@ describe('createSessionClient', () => {
     expect(ioMock).toHaveBeenCalledTimes(1);
     client.stop();
   });
+
+  test('threads the pinned-account resolver through: a pinned registerAndActivate only ADDS', async () => {
+    // `sessionMode: 'identity'`. The pin reaching `SessionClient` is observable
+    // here: a pinned client's own session is minted for the pinned account
+    // explicitly, so registering it must never SWITCH the shared device session
+    // (which would re-elect the active account under every other app on it).
+    const oxy = fakeOxy();
+
+    const { client } = createSessionClient(oxy as never, undefined, () => 'pinned-account');
+    await client.registerAndActivate('pinned-account');
+
+    const paths = oxy.makeRequest.mock.calls.map((call) => call[1]);
+    expect(paths).toContain('/session/device/add');
+    expect(paths).not.toContain('/session/device/switch');
+  });
+
+  test('a resolver reporting no pin (account mode) leaves registerAndActivate switching', async () => {
+    const oxy = fakeOxy();
+
+    const { client } = createSessionClient(oxy as never, undefined, () => null);
+    await client.registerAndActivate('u1');
+
+    const paths = oxy.makeRequest.mock.calls.map((call) => call[1]);
+    expect(paths).toContain('/session/device/add');
+    expect(paths).toContain('/session/device/switch');
+  });
 });

package/src/ui/session/__tests__/tokenTransport.test.ts

@@ -106,6 +106,40 @@ describe('createTokenTransport', () => {
     await expect(Promise.all([first, second])).resolves.toEqual([undefined, undefined]);
   });
 
+  test('never mints while identity-bound, even when the device switched to another account', async () => {
+    // `sessionMode: 'identity'`: the bearer belongs to the PINNED account and is
+    // minted for it by the cold boot / re-mint lane. Converging it on
+    // `state.activeAccountId` — here a DIFFERENT account another app switched the
+    // device to — is exactly the drift the mode prevents, so the transport must
+    // short-circuit even though the bearer/active-account check disagrees.
+    const refreshAccessToken = jest.fn(async () => 'minted-token');
+    const oxy = fakeOxy('pinned-account', refreshAccessToken);
+    const transport = createTokenTransport(oxy as never, () => 'pinned-account');
+
+    await transport.ensureActiveToken({
+      ...state,
+      accounts: [
+        { accountId: 'pinned-account', sessionId: 'sess-pinned', authuser: 0 },
+        { accountId: 'a1', sessionId: 'sess-a1', authuser: 1 },
+      ],
+      activeAccountId: 'a1',
+    });
+
+    expect(refreshAccessToken).not.toHaveBeenCalled();
+    expect(oxy.getCurrentUserId).not.toHaveBeenCalled();
+  });
+
+  test('a resolver reporting no pin (every account-mode provider) behaves exactly as an absent one', async () => {
+    const refreshAccessToken = jest.fn(async () => 'minted-token');
+    const oxy = fakeOxy('previous-account', refreshAccessToken);
+    const transport = createTokenTransport(oxy as never, () => null);
+
+    await transport.ensureActiveToken(state);
+
+    expect(refreshAccessToken).toHaveBeenCalledTimes(1);
+    expect(refreshAccessToken).toHaveBeenCalledWith('preflight');
+  });
+
   test('treats a throwing bearer-account check as a mismatch and still mints', async () => {
     const refreshAccessToken = jest.fn(async () => 'minted-token');
     const oxy = fakeOxy(null, refreshAccessToken);