@oxyhq/services 22.13.0 → 23.0.0

package/src/ui/utils/__tests__/crossOriginRestore.test.ts

@@ -1,160 +0,0 @@
-import type { OxyServices } from '@oxyhq/core';
-
-// Spy on the platform redirect so no real navigation happens and we can assert
-// the authorize URL the silent-restore flow hands to the browser.
-jest.mock('../../components/oauthNavigation', () => ({
-  redirectToAuthorize: jest.fn(),
-}));
-
-// jsdom's `location` is non-configurable, so the origin the code reads cannot be
-// reassigned per-test. Instead, drive the ORIGIN-CLASSIFICATION predicates
-// (whose real behaviour is covered by core's officialOrigins.test.ts) and keep
-// every other core helper real (PKCE, authorize-URL builder, handshake store).
-jest.mock('@oxyhq/core', () => {
-  const actual = jest.requireActual('@oxyhq/core');
-  return {
-    __esModule: true,
-    ...actual,
-    isLoopbackOrigin: jest.fn(),
-    isOfficialWebOrigin: jest.fn(),
-    isIdpHubOrigin: jest.fn(),
-  };
-});
-
-import {
-  isLoopbackOrigin,
-  isOfficialWebOrigin,
-  isIdpHubOrigin,
-  OXY_OAUTH_REDIRECT_URI_STORAGE_KEY,
-} from '@oxyhq/core';
-import { redirectToAuthorize } from '../../components/oauthNavigation';
-import {
-  isSilentRestoreEligibleOrigin,
-  maybeStartSilentOAuthRestore,
-  clearCrossOriginRestoreGuards,
-} from '../crossOriginRestore';
-
-const mockRedirect = redirectToAuthorize as jest.Mock;
-const mockIsLoopback = isLoopbackOrigin as jest.Mock;
-const mockIsOfficial = isOfficialWebOrigin as jest.Mock;
-const mockIsIdpHub = isIdpHubOrigin as jest.Mock;
-
-const OXY_SERVICES_STUB = {} as OxyServices;
-
-/** Default to an eligible official origin; individual tests narrow this. */
-function makeOriginEligible(): void {
-  mockIsLoopback.mockReturnValue(false);
-  mockIsIdpHub.mockReturnValue(false);
-  mockIsOfficial.mockReturnValue(true);
-}
-
-describe('crossOriginRestore', () => {
-  beforeEach(() => {
-    mockRedirect.mockClear();
-    mockIsLoopback.mockReset();
-    mockIsOfficial.mockReset();
-    mockIsIdpHub.mockReset();
-    globalThis.sessionStorage?.clear();
-    clearCrossOriginRestoreGuards();
-  });
-
-  describe('isSilentRestoreEligibleOrigin', () => {
-    it('rejects loopback / local-dev origins', () => {
-      mockIsLoopback.mockReturnValue(true);
-      mockIsIdpHub.mockReturnValue(false);
-      mockIsOfficial.mockReturnValue(true);
-      expect(isSilentRestoreEligibleOrigin('http://localhost:3000')).toBe(false);
-    });
-
-    it('rejects the central IdP hub origin (no self-hop)', () => {
-      mockIsLoopback.mockReturnValue(false);
-      mockIsIdpHub.mockReturnValue(true);
-      mockIsOfficial.mockReturnValue(true);
-      expect(isSilentRestoreEligibleOrigin('https://auth.oxy.so')).toBe(false);
-    });
-
-    it('rejects non-official origins', () => {
-      mockIsLoopback.mockReturnValue(false);
-      mockIsIdpHub.mockReturnValue(false);
-      mockIsOfficial.mockReturnValue(false);
-      expect(isSilentRestoreEligibleOrigin('https://evil.example')).toBe(false);
-    });
-
-    it('accepts official, non-loopback, non-IdP origins', () => {
-      makeOriginEligible();
-      expect(isSilentRestoreEligibleOrigin('https://accounts.oxy.so')).toBe(true);
-    });
-  });
-
-  describe('maybeStartSilentOAuthRestore', () => {
-    it('is SKIPPED on a loopback origin (no redirect)', async () => {
-      mockIsLoopback.mockReturnValue(true);
-      mockIsIdpHub.mockReturnValue(false);
-      mockIsOfficial.mockReturnValue(true);
-      const redirected = await maybeStartSilentOAuthRestore({
-        oxyServices: OXY_SERVICES_STUB,
-        clientId: 'oxy_dk_test',
-      });
-      expect(redirected).toBe(false);
-      expect(mockRedirect).not.toHaveBeenCalled();
-    });
-
-    it('is SKIPPED on a non-official origin (no redirect)', async () => {
-      mockIsLoopback.mockReturnValue(false);
-      mockIsIdpHub.mockReturnValue(false);
-      mockIsOfficial.mockReturnValue(false);
-      const redirected = await maybeStartSilentOAuthRestore({
-        oxyServices: OXY_SERVICES_STUB,
-        clientId: 'oxy_dk_test',
-      });
-      expect(redirected).toBe(false);
-      expect(mockRedirect).not.toHaveBeenCalled();
-    });
-
-    it('redirects to the PROD IdP by default on an eligible origin', async () => {
-      makeOriginEligible();
-      const redirected = await maybeStartSilentOAuthRestore({
-        oxyServices: OXY_SERVICES_STUB,
-        clientId: 'oxy_dk_test',
-      });
-      expect(redirected).toBe(true);
-      expect(mockRedirect).toHaveBeenCalledTimes(1);
-      const url = mockRedirect.mock.calls[0][0] as string;
-      expect(url.startsWith('https://auth.oxy.so/authorize?')).toBe(true);
-      const params = new URL(url).searchParams;
-      expect(params.get('client_id')).toBe('oxy_dk_test');
-      expect(params.get('prompt')).toBe('none');
-    });
-
-    it('honors an authorizeBaseUrl override (self-hosted / staging IdP)', async () => {
-      makeOriginEligible();
-      const redirected = await maybeStartSilentOAuthRestore({
-        oxyServices: OXY_SERVICES_STUB,
-        clientId: 'oxy_dk_test',
-        authorizeBaseUrl: 'https://auth.staging.oxy.so/authorize',
-      });
-      expect(redirected).toBe(true);
-      const url = mockRedirect.mock.calls[0][0] as string;
-      expect(url.startsWith('https://auth.staging.oxy.so/authorize?')).toBe(true);
-      const params = new URL(url).searchParams;
-      expect(params.get('client_id')).toBe('oxy_dk_test');
-      expect(params.get('prompt')).toBe('none');
-    });
-
-    it('persists the path-qualified redirect_uri in the handshake for token exchange', async () => {
-      makeOriginEligible();
-      const redirectUri = 'https://app.example/oauth/callback';
-      const redirected = await maybeStartSilentOAuthRestore({
-        oxyServices: OXY_SERVICES_STUB,
-        clientId: 'oxy_dk_test',
-        redirectUri,
-      });
-      expect(redirected).toBe(true);
-      expect(globalThis.sessionStorage?.getItem(OXY_OAUTH_REDIRECT_URI_STORAGE_KEY)).toBe(
-        redirectUri,
-      );
-      const url = mockRedirect.mock.calls[0][0] as string;
-      expect(new URL(url).searchParams.get('redirect_uri')).toBe(redirectUri);
-    });
-  });
-});

package/src/ui/utils/crossOriginRestore.ts

@@ -1,168 +0,0 @@
-import type { OxyServices } from '@oxyhq/core';
-import {
-  buildOAuthAuthorizeUrl,
-  generateOAuthState,
-  generatePkcePair,
-  isIdpHubOrigin,
-  isLoopbackOrigin,
-  isOfficialWebOrigin,
-  OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY,
-  OXY_SILENT_OAUTH_ATTEMPTED_KEY,
-  clearOAuthHandshake,
-  persistOAuthHandshake,
-  canonicalizeOAuthRedirectUri,
-  logger,
-} from '@oxyhq/core';
-import { isWebBrowser } from './isWebBrowser';
-import { replaceUrlAfterOAuthReturn } from './oauthReturn';
-import { redirectToAuthorize } from '../components/oauthNavigation';
-
-function sessionStore(): Storage | undefined {
-  return (globalThis as { sessionStorage?: Storage }).sessionStorage;
-}
-
-/** True when this tab already attempted cross-origin silent OAuth restore. */
-export function isCrossOriginRestoreBlocked(): boolean {
-  const store = sessionStore();
-  if (!store) return false;
-  return Boolean(
-    store.getItem(OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY) ||
-      store.getItem(OXY_SILENT_OAUTH_ATTEMPTED_KEY),
-  );
-}
-
-/** Mark restore as attempted — never auto-retry until sign-out clears guards. */
-export function markCrossOriginRestoreAttempted(): void {
-  const store = sessionStore();
-  if (!store) return;
-  store.setItem(OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY, '1');
-  store.setItem(OXY_SILENT_OAUTH_ATTEMPTED_KEY, '1');
-}
-
-/** Clear all cross-origin restore loop guards (call on sign-out). */
-export function clearCrossOriginRestoreGuards(): void {
-  const store = sessionStore();
-  if (!store) return;
-  for (const key of [OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY, OXY_SILENT_OAUTH_ATTEMPTED_KEY]) {
-    store.removeItem(key);
-  }
-}
-
-/**
- * Whether cold boot should attempt silent cross-origin OAuth restore for the
- * given web origin.
- *
- * Mirrors the hub-sync WRITE gate (`syncHubAfterSignIn`): only OFFICIAL Oxy web
- * origins participate in cross-app SSO — a random third-party / preview origin
- * must never have its tab bounced to the IdP. Additionally, loopback / local-dev
- * origins are EXCLUDED here even though {@link isOfficialWebOrigin} treats them
- * as official: a developer's local app must never be redirected to a hosted IdP
- * on cold boot (it signs in through the in-app dialog instead). The central IdP
- * hub's own origin is excluded to avoid a wasteful self-hop.
- */
-export function isSilentRestoreEligibleOrigin(origin: string): boolean {
-  if (isLoopbackOrigin(origin)) return false;
-  if (isIdpHubOrigin()) return false;
-  return isOfficialWebOrigin(origin);
-}
-
-export interface SilentOAuthRestoreOptions {
-  oxyServices: OxyServices;
-  clientId: string;
-  redirectUri?: string;
-  scope?: string;
-  /**
-   * Authorize endpoint override (env-configurable per deployment). Defaults to
-   * the production Oxy IdP when unset, so a local/staging app points silent
-   * restore at its OWN IdP instead of production `auth.oxy.so`.
-   */
-  authorizeBaseUrl?: string;
-}
-
-/**
- * Top-level redirect to auth.oxy.so/authorize with `prompt=none` for silent
- * cross-origin session restore on all web apps (official + third-party).
- */
-export async function maybeStartSilentOAuthRestore(
-  opts: SilentOAuthRestoreOptions,
-): Promise<boolean> {
-  if (!isWebBrowser()) return false;
-
-  const location = (globalThis as { location?: Location }).location;
-  if (!location) return false;
-
-  // Defense-in-depth: never bounce a loopback / non-official / IdP-hub origin to
-  // a hosted authorize endpoint (the caller gates on this too).
-  if (!isSilentRestoreEligibleOrigin(location.origin)) {
-    return false;
-  }
-
-  if (isCrossOriginRestoreBlocked()) {
-    return false;
-  }
-
-  const params = new URLSearchParams(location.search);
-  if (params.has('code') || params.has('error')) {
-    return false;
-  }
-
-  try {
-    const { codeVerifier, codeChallenge } = await generatePkcePair();
-    const state = await generateOAuthState();
-    const redirectUri = canonicalizeOAuthRedirectUri(
-      opts.redirectUri ?? location.origin,
-    );
-    if (!persistOAuthHandshake(state, codeVerifier, redirectUri)) {
-      return false;
-    }
-
-    const authorizeUrl = buildOAuthAuthorizeUrl({
-      authorizeBaseUrl: opts.authorizeBaseUrl,
-      clientId: opts.clientId,
-      redirectUri,
-      state,
-      codeChallenge,
-      scope: opts.scope,
-      prompt: 'none',
-    });
-
-    markCrossOriginRestoreAttempted();
-    redirectToAuthorize(authorizeUrl);
-    return true;
-  } catch (error) {
-    logger.warn('Silent OAuth restore skipped', { component: 'crossOriginRestore' }, error);
-    return false;
-  }
-}
-
-/**
- * When the RP lands with OAuth error params from a silent authorize attempt,
- * strip them and return whether the error was terminal for silent restore.
- */
-export function consumeSilentOAuthError(): 'login_required' | 'consent_required' | null {
-  if (!isWebBrowser()) return null;
-  const location = (globalThis as { location?: Location; history?: History }).location;
-  const history = (globalThis as { history?: History }).history;
-  if (!location) return null;
-
-  const params = new URLSearchParams(location.search);
-  const error = params.get('error');
-  if (error !== 'login_required' && error !== 'consent_required') {
-    return null;
-  }
-
-  markCrossOriginRestoreAttempted();
-
-  if (history?.replaceState) {
-    const url = new URL(location.href);
-    url.searchParams.delete('error');
-    url.searchParams.delete('error_description');
-    url.searchParams.delete('state');
-    // Silent restore failed, but the visitor still asked for a specific page.
-    // Put them back on it rather than leaving them on the bare origin the IdP
-    // redirected to.
-    replaceUrlAfterOAuthReturn(`${url.pathname}${url.search}${url.hash}`);
-  }
-  clearOAuthHandshake();
-  return error;
-}