@oxyhq/services 26.0.0 → 26.0.1

package/src/ui/context/commitSessionFlow.ts

@@ -1,5 +1,8 @@
 import type { User } from '@oxyhq/core';
 import { logger as loggerUtil } from '@oxyhq/core';
+import { allowsAutomaticIdpRedirect } from '../oauth/legacyRedirectLanes';
+import type { WebAuthMode } from '../oauth/types';
+import { isWebBrowser } from '../utils/isWebBrowser';
 import { isUnauthorizedStatus } from './oxyContextHelpers';
 
 const LOG_CONTEXT = { component: 'OxyContext', method: 'commitSession' } as const;
@@ -98,9 +101,6 @@ export async function commitDeviceSetAndResolve(
       }
       fullUser = fallbackUser;
     }
-    if (!fullUser) {
-      fullUser = fallbackUser;
-    }
     if (fullUser) {
       loginSuccess(fullUser);
       onAuthStateChange?.(fullUser);
@@ -126,3 +126,61 @@ export async function commitDeviceSetAndResolve(
   await hydrateAndResolve();
   void reconcileDeviceSet().catch(logReconcileError);
 }
+
+export interface MaybeSyncHubAfterCommitDeps {
+  /** Deliberate sign-in (`true`) vs. a cold-boot / background commit (`false`). */
+  activate: boolean;
+  /** Per-commit opt-in — `commitSession`'s `options.hubSync`. */
+  hubSyncRequested: boolean;
+  /** Provider-level opt-out — `OxyProviderProps.hubSync`. */
+  hubSyncEnabled: boolean;
+  /**
+   * The provider's web sign-in transport — `OxyProviderProps.webAuthMode`.
+   * A first-class input: `'popup'` forbids the redirect outright.
+   */
+  webAuthMode: WebAuthMode;
+  /**
+   * Starts the full-page hop to `auth.oxy.so/sync`; resolves `true` when the
+   * navigation was actually started.
+   */
+  syncHub: () => Promise<boolean>;
+}
+
+/**
+ * Post-sign-in hub sync: plant this device's credential on the IdP hub so OTHER
+ * official origins can silently restore a session on their next cold boot.
+ *
+ * The tail of the ONE commit funnel (`commitSession`), extracted so every gate
+ * on this legacy lane lives — and is tested — in one place. Returns whether the
+ * full-page redirect was started; a failure is non-fatal and never propagates
+ * (the sign-in itself already succeeded).
+ *
+ * Four gates, all of which must pass:
+ * 1. `activate` — only a deliberate sign-in syncs; a cold-boot restore never does.
+ * 2. `hubSyncRequested` — the in-place lanes (account switch, popup OAuth) opt out.
+ * 3. `hubSyncEnabled` — the provider-level `hubSync` prop.
+ * 4. `allowsAutomaticIdpRedirect(webAuthMode)` — hub sync REPLACES the document
+ *    with `auth.oxy.so`, so `webAuthMode: 'popup'` forbids it: a redirect that
+ *    bounces the tab defeats the entire point of the mode, no matter which
+ *    commit path produced the session (issue #691, "Cold boot and cross-domain
+ *    behavior"). Redirect mode — the default and the compatibility path — is
+ *    unchanged, and this whole function disappears with it in phase 7b.
+ */
+export async function maybeSyncHubAfterCommit(
+  deps: MaybeSyncHubAfterCommitDeps,
+): Promise<boolean> {
+  const { activate, hubSyncRequested, hubSyncEnabled, webAuthMode, syncHub } = deps;
+
+  if (!activate || !hubSyncRequested || !hubSyncEnabled) return false;
+  if (!allowsAutomaticIdpRedirect(webAuthMode)) return false;
+  if (!isWebBrowser()) return false;
+
+  try {
+    return await syncHub();
+  } catch (hubError) {
+    if (__DEV__) {
+      loggerUtil.debug('Hub sync after sign-in failed (non-fatal)', LOG_CONTEXT, hubError);
+    }
+    return false;
+  }
+}

package/src/ui/context/hooks/useAuthOperations.ts

@@ -1,5 +1,5 @@
 import { useCallback } from 'react';
-import type { ApiError, AuthStateStore, IdentityBinding, SessionClient, User } from '@oxyhq/core';
+import type { ApiError, AuthStateStore, SessionClient, User } from '@oxyhq/core';
 import type { AuthState } from '../../stores/authStore';
 import type { ClientSession, SessionLoginResponse } from '@oxyhq/core';
 import { DeviceManager } from '@oxyhq/core';
@@ -43,15 +43,6 @@ export interface UseAuthOperationsOptions {
   logoutStore: () => void;
   setAuthState: (state: Partial<AuthState>) => void;
   logger?: (message: string, error?: unknown) => void;
-  /**
-   * Identity-bound session (`sessionMode: 'identity'`). When set, a successful
-   * key sign-in writes the durable `{publicKey, accountId}` pin so pinned
-   * re-mints and projections bind immediately instead of waiting for a second
-   * `establishIdentitySession` round-trip.
-   */
-  identityBinding?: IdentityBinding;
-  /** Refreshes the provider's memoised pinned account id after the pin lands. */
-  refreshPinnedAccountId?: () => Promise<string | null>;
 }
 
 export interface UseAuthOperationsResult {
@@ -106,8 +97,6 @@ export const useAuthOperations = ({
   logoutStore,
   setAuthState,
   logger,
-  identityBinding,
-  refreshPinnedAccountId,
 }: UseAuthOperationsOptions): UseAuthOperationsResult => {
   /**
    * Internal function to perform challenge-response sign in.
@@ -166,18 +155,6 @@ export const useAuthOperations = ({
         }
       }
 
-      if (identityBinding) {
-        try {
-          await identityBinding.pinStore.save({
-            publicKey: publicKey.toLowerCase(),
-            accountId: sessionResponse.user.id,
-          });
-          await refreshPinnedAccountId?.();
-        } catch (pinError) {
-          logger?.('Failed to persist identity pin after sign-in', pinError);
-        }
-      }
-
       // Register this recovered account+session into the server-authoritative
       // device-session set AND make it active: `registerAndActivate()` adds via
       // `POST /session/device/add` (identity derived from the bearer
@@ -260,8 +237,6 @@ export const useAuthOperations = ({
       switchSession,
       syncFromClient,
       updateSessions,
-      identityBinding,
-      refreshPinnedAccountId,
     ],
   );
 

package/src/ui/context/oxyContextTypes.ts

@@ -158,9 +158,10 @@ export interface OxyContextProviderProps {
   authWebUrl?: string;
   authRedirectUri?: string;
   /**
-   * Authorize endpoint override for web "Sign in with Oxy". Defaults to the
-   * production Oxy IdP when unset; a local/staging deployment points it at its
-   * own IdP so sign-in never reaches production `auth.oxy.so`.
+   * Authorize endpoint override for silent cross-origin session restore
+   * (web cross-app SSO). Defaults to the production Oxy IdP when unset; a
+   * local/staging deployment points it at its own IdP so cold boot never
+   * bounces the tab to production `auth.oxy.so`.
    */
   authorizeBaseUrl?: string;
   storageKeyPrefix?: string;
@@ -173,31 +174,11 @@ export interface OxyContextProviderProps {
   sessionMode?: SessionMode;
   /**
    * Transport for WEB third-party sign-in. See `OxyProviderProps.webAuthMode`.
-   * @default 'popup'
+   * @default 'redirect'
    */
   webAuthMode?: WebAuthMode;
-  /**
-   * Let NATIVE background code (a home-screen widget's WorkManager worker, a sync
-   * job) authenticate while the app process is dead and there is no JS runtime.
-   *
-   * With this on, the SDK provisions a purpose-built background credential
-   * whenever the app runs and stores it where `so.oxy.session.OxyBackgroundSession`
-   * can read it; Kotlin then exchanges it for a short access token on demand. The
-   * app writes no session code — this prop is the whole integration.
-   *
-   * OFF by default, because a credential that nobody needs is exposure that
-   * nobody needs. Turn it on only in an app that actually has background code to
-   * authenticate. Android-only today; inert on web and iOS.
-   *
-   * The credential cannot create a session (only the running app can provision
-   * one), cannot rotate or otherwise disturb the app's own device credential, and
-   * is re-authorized server-side on every use so it can never outlive a sign-out.
-   * It does NOT reduce authority: the token it mints is a full user access token,
-   * exactly like the device credential's.
-   *
-   * @default false
-   */
-  backgroundSession?: boolean;
+  /** Sync device credentials to auth.oxy.so after interactive sign-in. @default true */
+  hubSync?: boolean;
   onAuthStateChange?: (user: User | null) => void;
   onError?: (error: ApiError) => void;
 }

package/src/ui/context/useOxyAccountGraph.ts

@@ -22,7 +22,7 @@ interface UseOxyAccountGraphParams {
   oxyServices: OxyServices;
   sessionClient: SessionClient;
   syncFromClient: () => Promise<void>;
-  commitSession: (input: CommitInput, options: { activate: boolean }) => Promise<void>;
+  commitSession: (input: CommitInput, options: { activate: boolean; hubSync?: boolean }) => Promise<void>;
   queryClient: QueryClient;
   accountDialogControllerRef: RefObject<AccountDialogController | null>;
   clearSessionStateRef: RefObject<() => Promise<void>>;
@@ -110,9 +110,9 @@ export function useOxyAccountGraph({
           userId: result.user.id,
           user: result.user,
         },
-        // A switch is IN-PLACE. Cross-tab/app propagation rides the
-        // `session_state` socket.
-        { activate: true },
+        // A switch is IN-PLACE: never run the cross-origin hub-sync full-page
+        // redirect. Cross-tab/app propagation rides the `session_state` socket.
+        { activate: true, hubSync: false },
       );
       await runPostAccountSwitchSideEffects();
     },

package/src/ui/hooks/mutations/mutationFactory.ts

@@ -12,7 +12,7 @@
 import type { QueryClient, UseMutationOptions } from '@tanstack/react-query';
 import type { User } from '@oxyhq/core';
 import { queryKeys, invalidateAccountQueries, invalidateUserQueries } from '../queries/queryKeys';
-import { toast } from '@oxyhq/bloom/toast';
+import { toast } from '@oxyhq/bloom';
 import { useAuthStore } from '../../stores/authStore';
 
 /**

package/src/ui/hooks/mutations/useAccountMutations.ts

@@ -17,7 +17,7 @@ import {
 } from '../queries/queryKeys';
 import { mutationKeys } from './mutationKeys';
 import { useOxy } from '../../context/OxyContext';
-import { toast } from '@oxyhq/bloom/toast';
+import { toast } from '@oxyhq/bloom';
 import { refreshAvatarInStore } from '../../utils/avatarUtils';
 import { useAuthStore } from '../../stores/authStore';
 

package/src/ui/hooks/mutations/useServicesMutations.ts

@@ -3,7 +3,7 @@ import type { ClientSession } from '@oxyhq/core';
 import { queryKeys, invalidateSessionQueries } from '../queries/queryKeys';
 import { mutationKeys } from './mutationKeys';
 import { useOxy } from '../../context/OxyContext';
-import { toast } from '@oxyhq/bloom/toast';
+import { toast } from '@oxyhq/bloom';
 
 /**
  * Switch active session

package/src/ui/hooks/queries/paymentTypes.ts

@@ -7,9 +7,8 @@
  * `useUserWalletTransactions`) expose precise types instead of `any`.
  *
  * Source of truth (API):
- *  - Subscription:  GET /subscription/:userId   -> billing-first normalized
- *                   subscription JSON (Stripe `BillingSubscription` with legacy
- *                   `Subscription` fallback), or `{ plan: 'basic' }` when none.
+ *  - Subscription:  GET /subscription/:userId   -> `Subscription` model JSON,
+ *                   or the fallback `{ plan: 'basic' }` when none exists.
  *  - Payments:      GET /payments/user          -> `Payment[]` (sendSuccess).
  *  - Wallet:        GET /wallet/:userId         -> `Wallet` (sendSuccess).
  *  - Transactions:  GET /wallet/transactions/:userId

package/src/ui/hooks/queries/usePaymentQueries.ts

@@ -30,9 +30,8 @@ import type {
  * Get the current user's subscription.
  *
  * Wraps `oxyServices.getCurrentUserSubscription()`
- * (`GET /subscription/:userId`, billing-first). Returns the persisted
- * subscription or the API's `{ plan: 'basic' }` fallback when the user has
- * never subscribed.
+ * (`GET /subscription/:userId`). Returns the persisted subscription or the
+ * API's `{ plan: 'basic' }` fallback when the user has never subscribed.
  */
 export const useUserSubscription = (options?: { enabled?: boolean }) => {
   const { oxyServices, isAuthenticated, activeSessionId, user } = useOxy();