@oxyhq/services 22.12.5 → 22.13.1

package/src/ui/boot/__tests__/coldBootWebAuthMode.test.ts

@@ -0,0 +1,281 @@
+/**
+ * `runProviderColdBoot` — the `webAuthMode` transport gate (#691 phase 7).
+ *
+ * `webAuthMode: 'popup'` must never let the boot navigate the RP's top-level
+ * window: no silent `prompt=none` restore, no authorize redirect, a signed-out
+ * domain simply resolves signed out. `'redirect'` — still the default and the
+ * compatibility path — must behave exactly as before.
+ *
+ * Unlike `__tests__/boot/runProviderColdBoot.test.ts` (deadline + connectivity
+ * wiring, with `crossOriginRestore` stubbed out), this suite keeps the restore
+ * lane REAL so the redirect-mode assertions reach the actual navigation
+ * primitive — the thing popup mode has to suppress.
+ */
+
+import type { AuthStateStore, PersistedAuthState, SessionClient } from '@oxyhq/core';
+
+// Only `runSessionColdBoot` and the origin-CLASSIFICATION predicates are faked.
+// jsdom's `location` is non-configurable, so origin eligibility has to be driven
+// through the predicates (their real behaviour is covered by core's own tests);
+// everything else in core (PKCE, authorize-URL builder, handshake store) stays
+// real so the redirect-mode lane is exercised end to end.
+jest.mock('@oxyhq/core', () => {
+  const actual = jest.requireActual('@oxyhq/core');
+  return {
+    __esModule: true,
+    ...actual,
+    runSessionColdBoot: jest.fn(),
+    isLoopbackOrigin: jest.fn(() => false),
+    isOfficialWebOrigin: jest.fn(() => true),
+    isIdpHubOrigin: jest.fn(() => false),
+  };
+});
+
+// The ONLY top-level-window navigation primitive either lane can reach.
+jest.mock('../../components/oauthNavigation', () => ({
+  redirectToAuthorize: jest.fn(),
+}));
+
+// Spied but REAL: redirect mode must still perform the actual restore.
+jest.mock('../../utils/crossOriginRestore', () => {
+  const actual = jest.requireActual('../../utils/crossOriginRestore');
+  return {
+    __esModule: true,
+    ...actual,
+    maybeStartSilentOAuthRestore: jest.fn(actual.maybeStartSilentOAuthRestore),
+    consumeSilentOAuthError: jest.fn(actual.consumeSilentOAuthError),
+  };
+});
+
+jest.mock('../../utils/oauthReturn', () => {
+  const actual = jest.requireActual('../../utils/oauthReturn');
+  return {
+    __esModule: true,
+    ...actual,
+    tryCompleteOAuthReturn: jest.fn(async () => false),
+    consumeHubSyncFailure: jest.fn(actual.consumeHubSyncFailure),
+  };
+});
+
+import { runSessionColdBoot } from '@oxyhq/core';
+import { redirectToAuthorize } from '../../components/oauthNavigation';
+import {
+  clearCrossOriginRestoreGuards,
+  consumeSilentOAuthError,
+  maybeStartSilentOAuthRestore,
+} from '../../utils/crossOriginRestore';
+import { consumeHubSyncFailure, tryCompleteOAuthReturn } from '../../utils/oauthReturn';
+import { runProviderColdBoot, type RunProviderColdBootOptions } from '../runProviderColdBoot';
+
+const mockRunSessionColdBoot = runSessionColdBoot as jest.Mock;
+const mockRedirectToAuthorize = redirectToAuthorize as jest.Mock;
+const mockSilentRestore = maybeStartSilentOAuthRestore as jest.Mock;
+const mockConsumeSilentOAuthError = consumeSilentOAuthError as jest.Mock;
+const mockConsumeHubSyncFailure = consumeHubSyncFailure as jest.Mock;
+const mockTryCompleteOAuthReturn = tryCompleteOAuthReturn as jest.Mock;
+
+const CLIENT_ID = 'oxy_dk_test';
+
+/** An auth store holding no device credential — the signed-out domain case. */
+function makeEmptyAuthStore(): AuthStateStore {
+  return {
+    load: jest.fn(async (): Promise<PersistedAuthState | null> => null),
+    save: jest.fn(async () => undefined),
+    clear: jest.fn(async () => undefined),
+  } as unknown as AuthStateStore;
+}
+
+interface Harness {
+  options: RunProviderColdBootOptions;
+  commitSession: jest.Mock;
+  markAuthResolved: jest.Mock;
+  setTokenReady: jest.Mock;
+  sessionClientStart: jest.Mock;
+}
+
+function makeHarness(overrides: Partial<RunProviderColdBootOptions> = {}): Harness {
+  const commitSession = jest.fn(async () => undefined);
+  const markAuthResolved = jest.fn();
+  const setTokenReady = jest.fn();
+  const sessionClientStart = jest.fn(async () => undefined);
+
+  const options: RunProviderColdBootOptions = {
+    oxyServices: {} as RunProviderColdBootOptions['oxyServices'],
+    authStore: makeEmptyAuthStore(),
+    clientId: CLIENT_ID,
+    sessionClient: { start: sessionClientStart } as unknown as SessionClient,
+    syncDeviceCredentialToHost: jest.fn(async () => undefined),
+    commitSession,
+    markAuthResolved,
+    setTokenReady,
+    ...overrides,
+  };
+
+  return { options, commitSession, markAuthResolved, setTokenReady, sessionClientStart };
+}
+
+/** `runSessionColdBoot` finding no session at all — the signed-out domain. */
+function stubSignedOutBoot(): void {
+  mockRunSessionColdBoot.mockImplementation(async (opts: Parameters<typeof runSessionColdBoot>[0]) => {
+    await opts.onSignedOut?.('no_session');
+    return { kind: 'unauthenticated' } as const;
+  });
+}
+
+describe('runProviderColdBoot — webAuthMode transport gate (#691 phase 7)', () => {
+  beforeEach(() => {
+    mockRunSessionColdBoot.mockReset();
+    mockRedirectToAuthorize.mockClear();
+    mockSilentRestore.mockClear();
+    mockConsumeSilentOAuthError.mockClear();
+    mockConsumeHubSyncFailure.mockClear();
+    mockTryCompleteOAuthReturn.mockClear();
+    mockTryCompleteOAuthReturn.mockImplementation(async () => false);
+    globalThis.sessionStorage?.clear();
+    clearCrossOriginRestoreGuards();
+  });
+
+  describe("webAuthMode: 'popup'", () => {
+    it('never starts the silent restore and never navigates the top-level window', async () => {
+      stubSignedOutBoot();
+      const { options } = makeHarness({ webAuthMode: 'popup' });
+
+      await runProviderColdBoot(options);
+
+      expect(mockSilentRestore).not.toHaveBeenCalled();
+      expect(mockRedirectToAuthorize).not.toHaveBeenCalled();
+    });
+
+    it('resolves a domain with no local credential SIGNED OUT instead of bouncing', async () => {
+      stubSignedOutBoot();
+      const { options, markAuthResolved, commitSession, sessionClientStart } = makeHarness({
+        webAuthMode: 'popup',
+      });
+
+      await runProviderColdBoot(options);
+
+      // Auth resolution concluded (routing can settle), nothing was committed,
+      // and with no persisted credential the device socket is not started.
+      expect(markAuthResolved).toHaveBeenCalled();
+      expect(commitSession).not.toHaveBeenCalled();
+      expect(sessionClientStart).not.toHaveBeenCalled();
+      expect(mockRedirectToAuthorize).not.toHaveBeenCalled();
+    });
+
+    it('still completes an authorization code already on the URL (blocked-popup fallback)', async () => {
+      // A popup-mode app lands here whenever the browser blocked the popup and
+      // `startWebOAuthSignIn` fell back to a full-page redirect.
+      mockTryCompleteOAuthReturn.mockImplementation(async () => true);
+      const { options, markAuthResolved, setTokenReady } = makeHarness({ webAuthMode: 'popup' });
+
+      await runProviderColdBoot(options);
+
+      expect(mockTryCompleteOAuthReturn).toHaveBeenCalledTimes(1);
+      expect(setTokenReady).toHaveBeenLastCalledWith(true);
+      expect(markAuthResolved).toHaveBeenCalled();
+      // The device mint is short-circuited by the completed return leg.
+      expect(mockRunSessionColdBoot).not.toHaveBeenCalled();
+      expect(mockRedirectToAuthorize).not.toHaveBeenCalled();
+    });
+
+    it('commits the OAuth return WITHOUT hub sync', async () => {
+      mockTryCompleteOAuthReturn.mockImplementation(async () => true);
+      const { options } = makeHarness({ webAuthMode: 'popup' });
+
+      await runProviderColdBoot(options);
+
+      const commit = mockTryCompleteOAuthReturn.mock.calls[0][0] as {
+        commitSession: (input: unknown) => Promise<void>;
+      };
+      await commit.commitSession({ sessionId: 's1', userId: 'u1' });
+      expect(options.commitSession).toHaveBeenCalledWith(
+        { sessionId: 's1', userId: 'u1' },
+        { activate: true, hubSync: false },
+      );
+    });
+  });
+
+  describe("webAuthMode: 'redirect' (unchanged compatibility path)", () => {
+    it('starts the silent restore and navigates to the IdP with prompt=none', async () => {
+      stubSignedOutBoot();
+      const { options } = makeHarness({ webAuthMode: 'redirect' });
+
+      await runProviderColdBoot(options);
+
+      expect(mockSilentRestore).toHaveBeenCalledTimes(1);
+      expect(mockRedirectToAuthorize).toHaveBeenCalledTimes(1);
+      const url = new URL(mockRedirectToAuthorize.mock.calls[0][0] as string);
+      expect(url.origin + url.pathname).toBe('https://auth.oxy.so/authorize');
+      expect(url.searchParams.get('client_id')).toBe(CLIENT_ID);
+      expect(url.searchParams.get('prompt')).toBe('none');
+    });
+
+    it('is the DEFAULT when no webAuthMode is supplied', async () => {
+      stubSignedOutBoot();
+      const { options } = makeHarness();
+
+      await runProviderColdBoot(options);
+
+      expect(mockSilentRestore).toHaveBeenCalledTimes(1);
+      expect(mockRedirectToAuthorize).toHaveBeenCalledTimes(1);
+    });
+
+    it('does NOT restore when the mint already resolved a session', async () => {
+      mockRunSessionColdBoot.mockImplementation(async (opts: Parameters<typeof runSessionColdBoot>[0]) => {
+        const session = { sessionId: 's1', userId: 'u1', accessToken: 'at', via: 'device-secret-mint' };
+        await opts.onSession?.(session);
+        return { kind: 'session', via: session.via, session } as const;
+      });
+      const { options, commitSession } = makeHarness({ webAuthMode: 'redirect' });
+
+      await runProviderColdBoot(options);
+
+      expect(commitSession).toHaveBeenCalledWith(
+        { sessionId: 's1', accessToken: 'at', userId: 'u1' },
+        { activate: false },
+      );
+      expect(mockSilentRestore).not.toHaveBeenCalled();
+      expect(mockRedirectToAuthorize).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('URL-cleanup consumers run in BOTH modes', () => {
+    it.each(['popup', 'redirect'] as const)(
+      'consumes the silent-OAuth error and hub-sync failure params (%s)',
+      async (webAuthMode) => {
+        stubSignedOutBoot();
+        const { options } = makeHarness({ webAuthMode });
+
+        await runProviderColdBoot(options);
+
+        expect(mockConsumeSilentOAuthError).toHaveBeenCalledTimes(1);
+        expect(mockConsumeHubSyncFailure).toHaveBeenCalledTimes(1);
+      },
+    );
+
+    it.each(['popup', 'redirect'] as const)(
+      'consumes an authorization code left on the URL (%s)',
+      async (webAuthMode) => {
+        stubSignedOutBoot();
+        const { options } = makeHarness({ webAuthMode });
+
+        await runProviderColdBoot(options);
+
+        expect(mockTryCompleteOAuthReturn).toHaveBeenCalledTimes(1);
+      },
+    );
+  });
+
+  describe('identity mode still skips both web OAuth lanes in either transport', () => {
+    it.each(['popup', 'redirect'] as const)('skips the return leg and the restore (%s)', async (webAuthMode) => {
+      stubSignedOutBoot();
+      const { options } = makeHarness({ webAuthMode, sessionMode: 'identity' });
+
+      await runProviderColdBoot(options);
+
+      expect(mockTryCompleteOAuthReturn).not.toHaveBeenCalled();
+      expect(mockSilentRestore).not.toHaveBeenCalled();
+      expect(mockRedirectToAuthorize).not.toHaveBeenCalled();
+    });
+  });
+});

package/src/ui/boot/runProviderColdBoot.ts

@@ -2,7 +2,9 @@ import {
   logger as loggerUtil,
   runSessionColdBoot,
   type AuthStateStore,
+  type IdentityBinding,
   type OxyServices,
+  type SessionMode,
 } from '@oxyhq/core';
 import type { SessionClient } from '@oxyhq/core';
 import { loadPersistedDeviceCredential } from '../utils/deviceCredential';
@@ -13,6 +15,8 @@ import {
 } from '../utils/crossOriginRestore';
 import { tryCompleteOAuthReturn, consumeHubSyncFailure } from '../utils/oauthReturn';
 import { isWebBrowser } from '../utils/isWebBrowser';
+import { allowsAutomaticIdpRedirect } from '../oauth/legacyRedirectLanes';
+import type { WebAuthMode } from '../oauth/types';
 import type { CommitInput } from '../context/oxyContextTypes';
 
 /** How long the cold boot waits for the post-boot SessionClient handoff (ms). */
@@ -82,6 +86,27 @@ export interface RunProviderColdBootOptions {
    * silent-restore redirect targets its own IdP, never production.
    */
   authorizeBaseUrl?: string;
+  /**
+   * Who owns the session this boot resolves. `'account'` (the default) is the
+   * device's active account — every ordinary Oxy app. `'identity'` binds the
+   * boot to the owner of this device's PRIMARY identity key and REQUIRES
+   * {@link identity}; it also disables the two web OAuth lanes below, which
+   * commit whatever account the IdP hands back.
+   */
+  sessionMode?: SessionMode;
+  /** The identity binding required by `sessionMode: 'identity'`. */
+  identity?: IdentityBinding;
+  /**
+   * How this provider's WEB sign-in reaches the IdP
+   * (`OxyProviderProps.webAuthMode`).
+   *
+   * A first-class INPUT to the boot, not a UI-only concern: `'popup'` forbids
+   * the automatic full-page `prompt=none` restore in step 3, so a domain with no
+   * local credential resolves SIGNED OUT instead of bouncing the top-level
+   * window to `auth.oxy.so`. See `allowsAutomaticIdpRedirect`.
+   * @default 'redirect'
+   */
+  webAuthMode?: WebAuthMode;
   sessionClient: SessionClient;
   syncDeviceCredentialToHost: () => Promise<void>;
   commitSession: (
@@ -97,8 +122,18 @@ export interface RunProviderColdBootOptions {
  *
  * Ordered pipeline:
  * 1. Complete OAuth authorization-code return (web)
- * 2. `runSessionColdBoot` — device-secret mint (+ native shared-key)
+ * 2. `runSessionColdBoot` — device-secret mint (+ native shared-key, or the
+ *    primary-identity-key lane in `sessionMode: 'identity'`)
  * 3. Silent OAuth for all web apps when mint finds no session
+ *
+ * Steps 1 and 3 are ACCOUNT-MODE ONLY: both commit whichever account the IdP
+ * resolves, which for an identity-bound client is somebody else's account by
+ * construction. In `'identity'` mode the boot is exactly step 2.
+ *
+ * Step 3 is additionally REDIRECT-MODE ONLY: it navigates the top-level window
+ * with no user gesture behind it, which `webAuthMode: 'popup'` exists to
+ * eliminate. In popup mode the boot is steps 1 and 2, and a domain with no local
+ * credential simply resolves signed out. See `allowsAutomaticIdpRedirect`.
  */
 export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Promise<void> {
   const {
@@ -107,6 +142,9 @@ export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Pro
     clientId,
     authRedirectUri,
     authorizeBaseUrl,
+    sessionMode = 'account',
+    identity,
+    webAuthMode = 'redirect',
     sessionClient,
     syncDeviceCredentialToHost,
     commitSession,
@@ -114,18 +152,34 @@ export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Pro
     setTokenReady,
   } = opts;
 
+  const identityBound = sessionMode === 'identity';
+
   setTokenReady(false);
 
   try {
+    // MODE-INDEPENDENT URL cleanup, deliberately so: both consume query params a
+    // PREVIOUS redirect-mode session left in the address bar (`?error=login_required`
+    // from a silent authorize, `?hub_sync=failed` from the hub) and restore the
+    // page the visit started on. Flipping an app to popup mode must not strand
+    // those params, so neither is gated on `webAuthMode`. Neither starts a
+    // navigation — they only rewrite the URL via `history.replaceState`.
     consumeSilentOAuthError();
     consumeHubSyncFailure();
 
-    const oauthCompleted = await tryCompleteOAuthReturn({
-      oxyServices,
-      clientId,
-      authRedirectUri,
-      commitSession: (input) => commitSession(input, { activate: true, hubSync: false }),
-    });
+    // The redirect transport's RETURN leg — also NOT gated on `webAuthMode`. A
+    // popup-mode app legitimately lands here with `?code=` whenever the browser
+    // blocked the popup and `startWebOAuthSignIn` fell back to a full-page
+    // redirect (`popup-blocked` / `popup-navigation-failed`), and an app that
+    // switched modes mid-flight must not be stranded with a dead `?code=`
+    // either. It consumes a code already on the URL; it never starts one.
+    const oauthCompleted = identityBound
+      ? false
+      : await tryCompleteOAuthReturn({
+          oxyServices,
+          clientId,
+          authRedirectUri,
+          commitSession: (input) => commitSession(input, { activate: true, hubSync: false }),
+        });
     if (oauthCompleted) {
       setTokenReady(true);
       markAuthResolved();
@@ -142,6 +196,8 @@ export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Pro
       oxy: oxyServices,
       store: authStore,
       platform: { isWeb: isWebBrowser(), isNative: !isWebBrowser() },
+      sessionMode,
+      identity,
       overallDeadlineMs: COLD_BOOT_OVERALL_DEADLINE_MS,
       isOffline: () => offline,
       onStepDeadline: (stepId) => {
@@ -204,16 +260,30 @@ export async function runProviderColdBoot(opts: RunProviderColdBootOptions): Pro
       },
     });
 
-    // Silent cross-origin OAuth restore (web cross-app SSO). Gate it the SAME
-    // way the hub-sync WRITE side (`syncHubAfterSignIn`) gates: official web
-    // origins only, never the IdP hub itself, and — unlike the write side —
-    // never a loopback / local-dev origin (which must not be bounced to a hosted
-    // IdP on cold boot). The authorize endpoint is env-configurable so a
-    // local/staging app targets its own IdP instead of production.
+    // Silent cross-origin OAuth restore (web cross-app SSO): a full-page
+    // `prompt=none` bounce to the IdP when the mint found no local session.
+    //
+    // TRANSPORT gate (`allowsAutomaticIdpRedirect`): `webAuthMode: 'popup'`
+    // FORBIDS this lane. It navigates the top-level window with no user gesture
+    // behind it, which is precisely what popup mode exists to eliminate — a
+    // popup-mode domain without a local credential resolves signed out right
+    // here and waits for the user's next explicit "Continue with Oxy" (issue
+    // #691, "Cold boot and cross-domain behavior"). `'redirect'` — still the
+    // default and the compatibility path — reaches this lane unchanged, and this
+    // whole block disappears with the transport in phase 7b.
+    //
+    // ORIGIN gate: same as the hub-sync WRITE side (`syncHubAfterSignIn`) —
+    // official web origins only, never the IdP hub itself, and — unlike the
+    // write side — never a loopback / local-dev origin (which must not be
+    // bounced to a hosted IdP on cold boot). The authorize endpoint is
+    // env-configurable so a local/staging app targets its own IdP instead of
+    // production.
     const webOrigin = isWebBrowser()
       ? (globalThis as { location?: Location }).location?.origin
       : undefined;
     if (
+      !identityBound &&
+      allowsAutomaticIdpRedirect(webAuthMode) &&
       clientId &&
       outcome.kind !== 'session' &&
       webOrigin &&

package/src/ui/client.ts

@@ -17,7 +17,6 @@ export { LogoIcon } from './components/logo/LogoIcon';
 export { LogoText } from './components/logo/LogoText';
 export { default as FollowButton } from './components/FollowButton';
 export { default as OxyPayButton } from './components/OxyPayButton';
-export { FontLoader, setupFonts } from './components/FontLoader';
 
 // Context
 export { useOxy } from './context/OxyContext';

package/src/ui/components/OxyAccountDialogScreen.tsx

@@ -75,7 +75,19 @@ const OxyAccountDialogScreen: React.FC<BaseScreenProps> = ({ canGoBack }) => {
   const { view } = snapshot;
   const showBack =
     view === 'qr' || view === 'signup' || (view === 'add' && snapshot.accounts.length > 0);
-  const goToAccounts = useCallback(() => controller?.setView('accounts'), [controller]);
+  const goToAccounts = useCallback(() => {
+    if (!controller) return;
+    const { view: currentView, signIn } = controller.getSnapshot();
+    // Backing out of an active request must withdraw it — otherwise the
+    // authorizeCode stays approvable until expiry (issue #691 phase 5).
+    if (
+      (currentView === 'qr' || currentView === 'add') &&
+      (signIn.phase === 'starting' || signIn.phase === 'waiting')
+    ) {
+      controller.cancelSignIn();
+    }
+    controller.setView('accounts');
+  }, [controller]);
   // An ENTRY view (accounts / signin — no in-dialog back of its own) that is
   // MORPHED into a host surface (ManageAccount → switcher) has a frame beneath it,
   // so its back CLOSES the dialog and reshapes back to the host — routed through
@@ -118,10 +130,16 @@ function headerCopy(
   t: Translate,
 ): { title: string; subtitle: string | null } {
   switch (view) {
+    // The ACTIVE REQUEST. Its header is deliberately route-AGNOSTIC: Oxy picks
+    // the delivery route (QR here, a push to the user's phone, or opening
+    // Commons on this device — issue #691), so naming one of them in the bar
+    // would contradict the other two. The route-specific status line lives in
+    // the body, derived from `signIn.progress`, and is the only thing that
+    // describes HOW the request is travelling.
     case 'qr':
       return {
-        title: t('accountSwitcher.scanTitle') || 'Sign in with Oxy',
-        subtitle: t('accountSwitcher.scanSubtitle') || 'Scan with Commons on your phone.',
+        title: t('accountSwitcher.signInWithOxy') || 'Sign in with Oxy',
+        subtitle: null,
       };
     case 'signup':
       return {
@@ -148,7 +166,18 @@ const EMPTY_SNAPSHOT: AccountDialogSnapshot = {
   loading: false,
   error: null,
   switchingAccountId: null,
-  signIn: { phase: 'idle', authorizeCode: null, qrPayload: null, expiresAt: null, error: null },
+  signIn: {
+    phase: 'idle',
+    authorizeCode: null,
+    qrPayload: null,
+    expiresAt: null,
+    error: null,
+    route: null,
+    routeFailed: false,
+    pushSentAt: null,
+    openedAt: null,
+    progress: 'idle',
+  },
   commonsAvailability: 'unknown',
 };