@oxyhq/services 22.12.4 → 22.13.0

package/src/ui/boot/runProviderColdBoot.ts

@@ -2,7 +2,9 @@ import {
   logger as loggerUtil,
   runSessionColdBoot,
   type AuthStateStore,
+  type IdentityBinding,
   type OxyServices,
+  type SessionMode,
 } from '@oxyhq/core';
 import type { SessionClient } from '@oxyhq/core';
 import { loadPersistedDeviceCredential } from '../utils/deviceCredential';
@@ -13,6 +15,8 @@ import {
 } from '../utils/crossOriginRestore';
 import { tryCompleteOAuthReturn, consumeHubSyncFailure } from '../utils/oauthReturn';
 import { isWebBrowser } from '../utils/isWebBrowser';
+import { allowsAutomaticIdpRedirect } from '../oauth/legacyRedirectLanes';
+import type { WebAuthMode } from '../oauth/types';
 import type { CommitInput } from '../context/oxyContextTypes';
 
 /** How long the cold boot waits for the post-boot SessionClient handoff (ms). */
@@ -82,6 +86,27 @@ export interface RunProviderColdBootOptions {
    * silent-restore redirect targets its own IdP, never production.
    */
   authorizeBaseUrl?: string;
+  /**
+   * Who owns the session this boot resolves. `'account'` (the default) is the
+   * device's active account — every ordinary Oxy app. `'identity'` binds the
+   * boot to the owner of this device's PRIMARY identity key and REQUIRES
+   * {@link identity}; it also disables the two web OAuth lanes below, which
+   * commit whatever account the IdP hands back.
+   */
+  sessionMode?: SessionMode;
+  /** The identity binding required by `sessionMode: 'identity'`. */
+  identity?: IdentityBinding;
+  /**
+   * How this provider's WEB sign-in reaches the IdP
+   * (`OxyProviderProps.webAuthMode`).
+   *
+   * A first-class INPUT to the boot, not a UI-only concern: `'popup'` forbids
+   * the automatic full-page `prompt=none` restore in step 3, so a domain with no
+   * local credential resolves SIGNED OUT instead of bouncing the top-level
+   * window to `auth.oxy.so`. See `allowsAutomaticIdpRedirect`.
+   * @default 'redirect'
+   */
+  webAuthMode?: WebAuthMode;
   sessionClient: SessionClient;
   syncDeviceCredentialToHost: () => Promise<void>;
   commitSession: (
@@ -97,8 +122,18 @@ export interface RunProviderColdBootOptions {
  *
  * Ordered pipeline:
  * 1. Complete OAuth authorization-code return (web)
- * 2. `runSessionColdBoot` — device-secret mint (+ native shared-key)
+ * 2. `runSessionColdBoot` — device-secret mint (+ native shared-key, or the
+ *    primary-identity-key lane in `sessionMode: 'identity'`)
  * 3. Silent OAuth for all web apps when mint finds no session
+ *
+ * Steps 1 and 3 are ACCOUNT-MODE ONLY: both commit whichever account the IdP
+ * resolves, which for an identity-bound client is somebody else's account by
+ * construction. In `'identity'` mode the boot is exactly step 2.
+ *
+ * Step 3 is additionally REDIRECT-MODE ONLY: it navigates the top-level window
+ * with no user gesture behind it, which `webAuthMode: 'popup'` exists to
+ * eliminate. In popup mode the boot is steps 1 and 2, and a domain with no local
+ * credential simply resolves signed out. See `allowsAutomaticIdpRedirect`.
  */
 export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Promise<void> {
   const {
@@ -107,6 +142,9 @@ export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Pro
     clientId,
     authRedirectUri,
     authorizeBaseUrl,
+    sessionMode = 'account',
+    identity,
+    webAuthMode = 'redirect',
     sessionClient,
     syncDeviceCredentialToHost,
     commitSession,
@@ -114,18 +152,34 @@ export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Pro
     setTokenReady,
   } = opts;
 
+  const identityBound = sessionMode === 'identity';
+
   setTokenReady(false);
 
   try {
+    // MODE-INDEPENDENT URL cleanup, deliberately so: both consume query params a
+    // PREVIOUS redirect-mode session left in the address bar (`?error=login_required`
+    // from a silent authorize, `?hub_sync=failed` from the hub) and restore the
+    // page the visit started on. Flipping an app to popup mode must not strand
+    // those params, so neither is gated on `webAuthMode`. Neither starts a
+    // navigation — they only rewrite the URL via `history.replaceState`.
     consumeSilentOAuthError();
     consumeHubSyncFailure();
 
-    const oauthCompleted = await tryCompleteOAuthReturn({
-      oxyServices,
-      clientId,
-      authRedirectUri,
-      commitSession: (input) => commitSession(input, { activate: true, hubSync: false }),
-    });
+    // The redirect transport's RETURN leg — also NOT gated on `webAuthMode`. A
+    // popup-mode app legitimately lands here with `?code=` whenever the browser
+    // blocked the popup and `startWebOAuthSignIn` fell back to a full-page
+    // redirect (`popup-blocked` / `popup-navigation-failed`), and an app that
+    // switched modes mid-flight must not be stranded with a dead `?code=`
+    // either. It consumes a code already on the URL; it never starts one.
+    const oauthCompleted = identityBound
+      ? false
+      : await tryCompleteOAuthReturn({
+          oxyServices,
+          clientId,
+          authRedirectUri,
+          commitSession: (input) => commitSession(input, { activate: true, hubSync: false }),
+        });
     if (oauthCompleted) {
       setTokenReady(true);
       markAuthResolved();
@@ -142,6 +196,8 @@ export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Pro
       oxy: oxyServices,
       store: authStore,
       platform: { isWeb: isWebBrowser(), isNative: !isWebBrowser() },
+      sessionMode,
+      identity,
       overallDeadlineMs: COLD_BOOT_OVERALL_DEADLINE_MS,
       isOffline: () => offline,
       onStepDeadline: (stepId) => {
@@ -204,16 +260,30 @@ export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Pro
       },
     });
 
-    // Silent cross-origin OAuth restore (web cross-app SSO). Gate it the SAME
-    // way the hub-sync WRITE side (`syncHubAfterSignIn`) gates: official web
-    // origins only, never the IdP hub itself, and — unlike the write side —
-    // never a loopback / local-dev origin (which must not be bounced to a hosted
-    // IdP on cold boot). The authorize endpoint is env-configurable so a
-    // local/staging app targets its own IdP instead of production.
+    // Silent cross-origin OAuth restore (web cross-app SSO): a full-page
+    // `prompt=none` bounce to the IdP when the mint found no local session.
+    //
+    // TRANSPORT gate (`allowsAutomaticIdpRedirect`): `webAuthMode: 'popup'`
+    // FORBIDS this lane. It navigates the top-level window with no user gesture
+    // behind it, which is precisely what popup mode exists to eliminate — a
+    // popup-mode domain without a local credential resolves signed out right
+    // here and waits for the user's next explicit "Continue with Oxy" (issue
+    // #691, "Cold boot and cross-domain behavior"). `'redirect'` — still the
+    // default and the compatibility path — reaches this lane unchanged, and this
+    // whole block disappears with the transport in phase 7b.
+    //
+    // ORIGIN gate: same as the hub-sync WRITE side (`syncHubAfterSignIn`) —
+    // official web origins only, never the IdP hub itself, and — unlike the
+    // write side — never a loopback / local-dev origin (which must not be
+    // bounced to a hosted IdP on cold boot). The authorize endpoint is
+    // env-configurable so a local/staging app targets its own IdP instead of
+    // production.
     const webOrigin = isWebBrowser()
       ? (globalThis as { location?: Location }).location?.origin
       : undefined;
     if (
+      !identityBound &&
+      allowsAutomaticIdpRedirect(webAuthMode) &&
       clientId &&
       outcome.kind !== 'session' &&
       webOrigin &&

package/src/ui/client.ts

@@ -17,7 +17,6 @@ export { LogoIcon } from './components/logo/LogoIcon';
 export { LogoText } from './components/logo/LogoText';
 export { default as FollowButton } from './components/FollowButton';
 export { default as OxyPayButton } from './components/OxyPayButton';
-export { FontLoader, setupFonts } from './components/FontLoader';
 
 // Context
 export { useOxy } from './context/OxyContext';

package/src/ui/components/OxyAccountDialogScreen.tsx

@@ -75,7 +75,19 @@ const OxyAccountDialogScreen: React.FC<BaseScreenProps> = ({ canGoBack }) => {
   const { view } = snapshot;
   const showBack =
     view === 'qr' || view === 'signup' || (view === 'add' && snapshot.accounts.length > 0);
-  const goToAccounts = useCallback(() => controller?.setView('accounts'), [controller]);
+  const goToAccounts = useCallback(() => {
+    if (!controller) return;
+    const { view: currentView, signIn } = controller.getSnapshot();
+    // Backing out of an active request must withdraw it — otherwise the
+    // authorizeCode stays approvable until expiry (issue #691 phase 5).
+    if (
+      (currentView === 'qr' || currentView === 'add') &&
+      (signIn.phase === 'starting' || signIn.phase === 'waiting')
+    ) {
+      controller.cancelSignIn();
+    }
+    controller.setView('accounts');
+  }, [controller]);
   // An ENTRY view (accounts / signin — no in-dialog back of its own) that is
   // MORPHED into a host surface (ManageAccount → switcher) has a frame beneath it,
   // so its back CLOSES the dialog and reshapes back to the host — routed through
@@ -118,10 +130,16 @@ function headerCopy(
   t: Translate,
 ): { title: string; subtitle: string | null } {
   switch (view) {
+    // The ACTIVE REQUEST. Its header is deliberately route-AGNOSTIC: Oxy picks
+    // the delivery route (QR here, a push to the user's phone, or opening
+    // Commons on this device — issue #691), so naming one of them in the bar
+    // would contradict the other two. The route-specific status line lives in
+    // the body, derived from `signIn.progress`, and is the only thing that
+    // describes HOW the request is travelling.
     case 'qr':
       return {
-        title: t('accountSwitcher.scanTitle') || 'Sign in with Oxy',
-        subtitle: t('accountSwitcher.scanSubtitle') || 'Scan with Commons on your phone.',
+        title: t('accountSwitcher.signInWithOxy') || 'Sign in with Oxy',
+        subtitle: null,
       };
     case 'signup':
       return {
@@ -148,7 +166,18 @@ const EMPTY_SNAPSHOT: AccountDialogSnapshot = {
   loading: false,
   error: null,
   switchingAccountId: null,
-  signIn: { phase: 'idle', authorizeCode: null, qrPayload: null, expiresAt: null, error: null },
+  signIn: {
+    phase: 'idle',
+    authorizeCode: null,
+    qrPayload: null,
+    expiresAt: null,
+    error: null,
+    route: null,
+    routeFailed: false,
+    pushSentAt: null,
+    openedAt: null,
+    progress: 'idle',
+  },
   commonsAvailability: 'unknown',
 };