@oxyhq/services 22.13.0 → 23.0.0

package/src/ui/context/OxyContext.tsx

@@ -26,7 +26,6 @@ import {
   startTokenRefreshScheduler,
   createAccountDialogController,
   logger as loggerUtil,
-  syncHubAfterSignIn,
 } from '@oxyhq/core';
 import {
   registerAccountDialogControls,
@@ -79,7 +78,7 @@ import type {
   CommitInput,
 } from './oxyContextTypes';
 import { DEFAULT_SESSION_VALIDITY_MS, loadUseFollowHook } from './oxyContextHelpers';
-import { commitDeviceSetAndResolve, maybeSyncHubAfterCommit } from './commitSessionFlow';
+import { commitDeviceSetAndResolve } from './commitSessionFlow';
 import { runPasskeyLogin, runPasskeyRegister, runPasskeyAdd } from './passkeyFlow';
 import {
   isPasskeySupported,
@@ -103,8 +102,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
   storageKeyPrefix = 'oxy_session',
   clientId: clientIdProp,
   sessionMode = 'account',
-  webAuthMode = 'redirect',
-  hubSync = true,
+  webAuthMode = 'popup',
   onAuthStateChange,
   onError,
 }) => {
@@ -586,7 +584,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     };
     handleTokenChange(oxyServices.getAccessToken());
     return oxyServices.onTokensChanged(handleTokenChange);
-  }, [logger, oxyServices]);
+  }, [logger, oxyServices, sessionClient]);
 
   // Unified in-session refresh (SDK-owned; every RP inherits it). Installs the
   // ONE core refresh handler (re-mint from the persisted zero-cookie device
@@ -616,10 +614,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
   // Used by the QR device flow (`handleWebSession`), password sign-in, 2FA
   // completion, and the cold boot.
   const commitSession = useCallback(
-    async (
-      input: CommitInput,
-      options: { activate: boolean; hubSync?: boolean },
-    ): Promise<void> => {
+    async (input: CommitInput, options: { activate: boolean }): Promise<void> => {
       if (input.accessToken) {
         oxyServices.setTokens(input.accessToken);
       }
@@ -687,21 +682,8 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
         onAuthStateChange: onAuthStateChangeRef.current,
         markAuthResolved: markAuthResolvedRef.current,
       });
-
-      // Post-sign-in hub sync — a full-page redirect to auth.oxy.so. Gated HERE,
-      // inside the ONE commit funnel, so NO commit path (QR device flow,
-      // password/2FA through the account dialog, passkey, popup OAuth, cold
-      // boot) can bounce a `webAuthMode: 'popup'` tab to the IdP. See
-      // `maybeSyncHubAfterCommit` for the full gate list.
-      await maybeSyncHubAfterCommit({
-        activate: options.activate,
-        hubSyncRequested: options.hubSync === true,
-        hubSyncEnabled: hubSync,
-        webAuthMode,
-        syncHub: () => syncHubAfterSignIn(oxyServices, { enabled: hubSync }),
-      });
     },
-    [oxyServices, authStore, updateSessions, setActiveSessionId, sessionClient, sessionClientHost, syncFromClient, loginSuccess, logger, hubSync, webAuthMode],
+    [oxyServices, authStore, updateSessions, setActiveSessionId, sessionClient, sessionClientHost, syncFromClient, loginSuccess, logger],
   );
   const commitSessionRef = useRef(commitSession);
   commitSessionRef.current = commitSession;
@@ -723,16 +705,16 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
           userId: session.user.id,
           user: session.user,
         },
-        { activate: true, hubSync: true },
+        { activate: true },
       );
     },
     [commitSession],
   );
 
-  // Commit a minted graph-SWITCH session. Same funnel as `handleWebSession` but
-  // IN-PLACE: `hubSync: false` so switching accounts never triggers the
-  // cross-origin hub-sync full-page redirect. The switch already propagates
-  // across tabs/apps via the server's `session_state` socket broadcast.
+  // Commit a minted graph-SWITCH session through the same funnel as
+  // `handleWebSession`. Nothing extra to do IN-PLACE: the switch already
+  // propagates across tabs/apps via the server's `session_state` socket
+  // broadcast.
   const commitSwitchedSession = useCallback(
     async (session: SessionLoginResponse): Promise<void> => {
       if (!session?.user || !session?.sessionId || !session.accessToken) {
@@ -748,7 +730,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
           userId: session.user.id,
           user: session.user,
         },
-        { activate: true, hubSync: false },
+        { activate: true },
       );
     },
     [commitSession],
@@ -759,11 +741,6 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
   // to, so no consumer ever writes popup listeners or a token exchange. The
   // transport picks popup vs redirect from `webAuthMode`; both lanes land on the
   // SAME completion path (`completeOAuthCode`) and the same commit funnel here.
-  //
-  // `hubSync: false` is deliberate: hub sync is a full-page redirect to
-  // auth.oxy.so, which would undo the one thing popup mode exists to guarantee —
-  // that the relying party never leaves its route. It matches how the redirect
-  // lane's return leg commits (see `runProviderColdBoot`).
   const startWebOAuthSignInForContext = useCallback(
     (options: StartWebOAuthSignInOptions): Promise<WebOAuthSignInResult> =>
       startWebOAuthSignIn(
@@ -773,8 +750,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
           clientId,
           authorizeBaseUrl,
           identityBound: isIdentityBound,
-          commitSession: (input) =>
-            commitSessionRef.current(input, { activate: true, hubSync: false }),
+          commitSession: (input) => commitSessionRef.current(input, { activate: true }),
         },
         options,
       ),
@@ -973,7 +949,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
         getLoginOptions: (username) => oxyServices.webauthnLoginOptions(username),
         runCeremony: runAuthenticationCeremony,
         loginVerify: (response, envelope) => oxyServices.webauthnLoginVerify(response, envelope),
-        commit: (input) => commitSession(input, { activate: true, hubSync: true }),
+        commit: (input) => commitSession(input, { activate: true }),
         username: opts?.username,
         deviceId: persisted?.deviceId,
         deviceName: opts?.deviceName,
@@ -991,7 +967,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
         getRegisterOptions: (username) => oxyServices.webauthnRegisterOptions(username),
         runCeremony: runRegistrationCeremony,
         registerVerify: (response, envelope) => oxyServices.webauthnRegisterVerify(response, envelope),
-        commit: (input) => commitSession(input, { activate: true, hubSync: true }),
+        commit: (input) => commitSession(input, { activate: true }),
         username: params.username,
         deviceName: params.deviceName,
       });
@@ -1043,13 +1019,8 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
       authStore,
       clientId: clientIdProp,
       authRedirectUri,
-      authorizeBaseUrl,
       sessionMode,
       identity: identity?.binding,
-      // Popup mode forbids the boot's automatic full-page `prompt=none` restore:
-      // a domain with no local credential resolves signed out instead of
-      // navigating the tab to the IdP (see `allowsAutomaticIdpRedirect`).
-      webAuthMode,
       sessionClient,
       syncDeviceCredentialToHost,
       commitSession: (input, options) => commitSessionRef.current(input, options),
@@ -1067,10 +1038,8 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     authStore,
     clientIdProp,
     authRedirectUri,
-    authorizeBaseUrl,
     sessionMode,
     identity,
-    webAuthMode,
     syncDeviceCredentialToHost,
     sessionClient,
   ]);
@@ -1372,7 +1341,7 @@ const LOADING_STATE: OxyContextState = {
   isAuthResolved: false,
   isStorageReady: false,
   sessionMode: 'account',
-  webAuthMode: 'redirect',
+  webAuthMode: 'popup',
   error: null,
   currentLanguage: 'en-US',
   currentLanguages: [],

package/src/ui/context/__tests__/commitSessionFlow.test.ts

@@ -1,11 +1,8 @@
 import type { User } from '@oxyhq/core';
 import { logger } from '@oxyhq/core';
-import type { WebAuthMode } from '../../oauth/types';
 import {
   commitDeviceSetAndResolve,
-  maybeSyncHubAfterCommit,
   type CommitDeviceSetAndResolveDeps,
-  type MaybeSyncHubAfterCommitDeps,
 } from '../commitSessionFlow';
 
 // A resolved promise chain (addCurrentAccount -> start -> syncFromClient) settles
@@ -194,92 +191,6 @@ describe('commitDeviceSetAndResolve — cold boot (activate: false)', () => {
   });
 });
 
-/**
- * Post-sign-in hub sync is a FULL-PAGE redirect to auth.oxy.so. It runs from the
- * ONE commit funnel, so gating it here gates every commit path at once —
- * `webAuthMode: 'popup'` must never bounce the tab, whichever path signed the
- * user in (#691 phase 7).
- */
-describe('maybeSyncHubAfterCommit — webAuthMode transport gate (#691 phase 7)', () => {
-  const buildHubDeps = (
-    overrides: Partial<MaybeSyncHubAfterCommitDeps> = {},
-  ): MaybeSyncHubAfterCommitDeps => ({
-    activate: true,
-    hubSyncRequested: true,
-    hubSyncEnabled: true,
-    webAuthMode: 'redirect',
-    syncHub: jest.fn(async () => true),
-    ...overrides,
-  });
-
-  it("redirect mode: syncs the hub after a deliberate sign-in (unchanged)", async () => {
-    const deps = buildHubDeps();
-
-    await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(true);
-
-    expect(deps.syncHub).toHaveBeenCalledTimes(1);
-  });
-
-  it('popup mode: NEVER syncs the hub, even on an otherwise-eligible sign-in', async () => {
-    const deps = buildHubDeps({ webAuthMode: 'popup' });
-
-    await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
-
-    expect(deps.syncHub).not.toHaveBeenCalled();
-  });
-
-  it('popup mode: no commit path can opt back in', async () => {
-    // Every commit path differs only in `activate` / `hubSyncRequested`; the
-    // transport gate outranks all of them.
-    for (const activate of [true, false]) {
-      for (const hubSyncRequested of [true, false]) {
-        const deps = buildHubDeps({ webAuthMode: 'popup', activate, hubSyncRequested });
-        await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
-        expect(deps.syncHub).not.toHaveBeenCalled();
-      }
-    }
-  });
-
-  it.each(['popup', 'redirect'] as const)(
-    'never syncs on a cold-boot restore, in either mode (%s)',
-    async (webAuthMode: WebAuthMode) => {
-      const deps = buildHubDeps({ webAuthMode, activate: false });
-
-      await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
-
-      expect(deps.syncHub).not.toHaveBeenCalled();
-    },
-  );
-
-  it('redirect mode: honours the per-commit opt-out (account switch / popup OAuth lanes)', async () => {
-    const deps = buildHubDeps({ hubSyncRequested: false });
-
-    await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
-
-    expect(deps.syncHub).not.toHaveBeenCalled();
-  });
-
-  it('redirect mode: honours the provider-level hubSync opt-out', async () => {
-    const deps = buildHubDeps({ hubSyncEnabled: false });
-
-    await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
-
-    expect(deps.syncHub).not.toHaveBeenCalled();
-  });
-
-  it('redirect mode: a failing hub sync is non-fatal and never rejects', async () => {
-    const deps = buildHubDeps({
-      syncHub: jest.fn(async () => {
-        throw new Error('hub ticket failed');
-      }),
-    });
-
-    await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
-
-    expect(deps.syncHub).toHaveBeenCalledTimes(1);
-  });
-});
-
 describe('commitDeviceSetAndResolve — deliberate sign-in (activate: true)', () => {
   it('BLOCKS on the device-set reconcile before resolving auth (unchanged ordering)', async () => {
     const order: string[] = [];

package/src/ui/context/commitSessionFlow.ts

@@ -1,8 +1,5 @@
 import type { User } from '@oxyhq/core';
 import { logger as loggerUtil } from '@oxyhq/core';
-import { allowsAutomaticIdpRedirect } from '../oauth/legacyRedirectLanes';
-import type { WebAuthMode } from '../oauth/types';
-import { isWebBrowser } from '../utils/isWebBrowser';
 import { isUnauthorizedStatus } from './oxyContextHelpers';
 
 const LOG_CONTEXT = { component: 'OxyContext', method: 'commitSession' } as const;
@@ -129,61 +126,3 @@ export async function commitDeviceSetAndResolve(
   await hydrateAndResolve();
   void reconcileDeviceSet().catch(logReconcileError);
 }
-
-export interface MaybeSyncHubAfterCommitDeps {
-  /** Deliberate sign-in (`true`) vs. a cold-boot / background commit (`false`). */
-  activate: boolean;
-  /** Per-commit opt-in — `commitSession`'s `options.hubSync`. */
-  hubSyncRequested: boolean;
-  /** Provider-level opt-out — `OxyProviderProps.hubSync`. */
-  hubSyncEnabled: boolean;
-  /**
-   * The provider's web sign-in transport — `OxyProviderProps.webAuthMode`.
-   * A first-class input: `'popup'` forbids the redirect outright.
-   */
-  webAuthMode: WebAuthMode;
-  /**
-   * Starts the full-page hop to `auth.oxy.so/sync`; resolves `true` when the
-   * navigation was actually started.
-   */
-  syncHub: () => Promise<boolean>;
-}
-
-/**
- * Post-sign-in hub sync: plant this device's credential on the IdP hub so OTHER
- * official origins can silently restore a session on their next cold boot.
- *
- * The tail of the ONE commit funnel (`commitSession`), extracted so every gate
- * on this legacy lane lives — and is tested — in one place. Returns whether the
- * full-page redirect was started; a failure is non-fatal and never propagates
- * (the sign-in itself already succeeded).
- *
- * Four gates, all of which must pass:
- * 1. `activate` — only a deliberate sign-in syncs; a cold-boot restore never does.
- * 2. `hubSyncRequested` — the in-place lanes (account switch, popup OAuth) opt out.
- * 3. `hubSyncEnabled` — the provider-level `hubSync` prop.
- * 4. `allowsAutomaticIdpRedirect(webAuthMode)` — hub sync REPLACES the document
- *    with `auth.oxy.so`, so `webAuthMode: 'popup'` forbids it: a redirect that
- *    bounces the tab defeats the entire point of the mode, no matter which
- *    commit path produced the session (issue #691, "Cold boot and cross-domain
- *    behavior"). Redirect mode — the default and the compatibility path — is
- *    unchanged, and this whole function disappears with it in phase 7b.
- */
-export async function maybeSyncHubAfterCommit(
-  deps: MaybeSyncHubAfterCommitDeps,
-): Promise<boolean> {
-  const { activate, hubSyncRequested, hubSyncEnabled, webAuthMode, syncHub } = deps;
-
-  if (!activate || !hubSyncRequested || !hubSyncEnabled) return false;
-  if (!allowsAutomaticIdpRedirect(webAuthMode)) return false;
-  if (!isWebBrowser()) return false;
-
-  try {
-    return await syncHub();
-  } catch (hubError) {
-    if (__DEV__) {
-      loggerUtil.debug('Hub sync after sign-in failed (non-fatal)', LOG_CONTEXT, hubError);
-    }
-    return false;
-  }
-}

package/src/ui/context/oxyContextTypes.ts

@@ -158,10 +158,9 @@ export interface OxyContextProviderProps {
   authWebUrl?: string;
   authRedirectUri?: string;
   /**
-   * Authorize endpoint override for silent cross-origin session restore
-   * (web cross-app SSO). Defaults to the production Oxy IdP when unset; a
-   * local/staging deployment points it at its own IdP so cold boot never
-   * bounces the tab to production `auth.oxy.so`.
+   * Authorize endpoint override for web "Sign in with Oxy". Defaults to the
+   * production Oxy IdP when unset; a local/staging deployment points it at its
+   * own IdP so sign-in never reaches production `auth.oxy.so`.
    */
   authorizeBaseUrl?: string;
   storageKeyPrefix?: string;
@@ -174,11 +173,9 @@ export interface OxyContextProviderProps {
   sessionMode?: SessionMode;
   /**
    * Transport for WEB third-party sign-in. See `OxyProviderProps.webAuthMode`.
-   * @default 'redirect'
+   * @default 'popup'
    */
   webAuthMode?: WebAuthMode;
-  /** Sync device credentials to auth.oxy.so after interactive sign-in. @default true */
-  hubSync?: boolean;
   onAuthStateChange?: (user: User | null) => void;
   onError?: (error: ApiError) => void;
 }

package/src/ui/context/useOxyAccountGraph.ts

@@ -22,7 +22,7 @@ interface UseOxyAccountGraphParams {
   oxyServices: OxyServices;
   sessionClient: SessionClient;
   syncFromClient: () => Promise<void>;
-  commitSession: (input: CommitInput, options: { activate: boolean; hubSync?: boolean }) => Promise<void>;
+  commitSession: (input: CommitInput, options: { activate: boolean }) => Promise<void>;
   queryClient: QueryClient;
   accountDialogControllerRef: RefObject<AccountDialogController | null>;
   clearSessionStateRef: RefObject<() => Promise<void>>;
@@ -110,9 +110,9 @@ export function useOxyAccountGraph({
           userId: result.user.id,
           user: result.user,
         },
-        // A switch is IN-PLACE: never run the cross-origin hub-sync full-page
-        // redirect. Cross-tab/app propagation rides the `session_state` socket.
-        { activate: true, hubSync: false },
+        // A switch is IN-PLACE. Cross-tab/app propagation rides the
+        // `session_state` socket.
+        { activate: true },
       );
       await runPostAccountSwitchSideEffects();
     },