@oxyhq/services 26.0.0 → 26.0.1

package/src/ui/types/navigation.ts

@@ -74,11 +74,11 @@ export interface OxyProviderProps {
     authWebUrl?: string;
     authRedirectUri?: string;
     /**
-     * Authorize endpoint override for web "Sign in with Oxy". Defaults to the
-     * production Oxy IdP (`https://auth.oxy.so/authorize`) when unset. Set this
-     * from an env var (e.g. Vite `VITE_OXY_AUTHORIZE_URL`, Expo
-     * `EXPO_PUBLIC_OXY_AUTHORIZE_URL`) so a local/staging deployment targets its
-     * own IdP instead of production.
+     * Authorize endpoint override for silent cross-origin session restore
+     * (web cross-app SSO on cold boot). Defaults to the production Oxy IdP
+     * (`https://auth.oxy.so/authorize`) when unset. Set this from an env var
+     * (e.g. Vite `VITE_OXY_AUTHORIZE_URL`, Expo `EXPO_PUBLIC_OXY_AUTHORIZE_URL`)
+     * so a local/staging deployment targets its own IdP instead of production.
      */
     authorizeBaseUrl?: string;
     /**
@@ -98,9 +98,9 @@ export interface OxyProviderProps {
      * rather than hidden in the UI: `accounts` stays empty and is never fetched,
      * `switchToAccount` / `switchSession` reject with `IdentityBoundSessionError`,
      * `accountDialogController` is `null` and `openAccountDialog()` does nothing,
-     * and the web OAuth cold-boot lane (the authorization-code return leg) is
-     * skipped — it commits whichever account the IdP resolves, which is not
-     * necessarily the local key's owner.
+     * and the two web OAuth cold-boot lanes (authorization-code return + silent
+     * cross-origin restore) are skipped — all of them commit whichever account
+     * the IdP resolves, which is not necessarily the local key's owner.
      *
      * Read once at mount, like `baseURL` / `oxyServices`: changing it on a
      * mounted provider does not re-bind the session.
@@ -110,23 +110,22 @@ export interface OxyProviderProps {
     /**
      * How a WEB third-party "Sign in with Oxy" hands the user to the IdP.
      *
-     * - `'popup'` (default) — a small `auth.oxy.so` window opened from the
-     *   user's click. The app stays MOUNTED and becomes authenticated without a
-     *   reload; the IdP delivers only the authorization code + `state` back to
-     *   the opener via `postMessage` (never a token, device secret, or PKCE
-     *   verifier). A blocked popup falls back to the redirect automatically.
-     * - `'redirect'` — a full-page navigation to `auth.oxy.so`, which returns to
-     *   the registered `redirect_uri` with `?code=`. The tab unmounts and
-     *   remounts, so route and unsaved state are lost.
-     *
-     * Either way the navigation only ever happens from a real user gesture: the
-     * SDK never bounces the top-level window on its own (#691 phase 7b).
+     * - `'redirect'` (default) — a full-page navigation to `auth.oxy.so`, which
+     *   returns to the registered `redirect_uri` with `?code=`. The tab unmounts
+     *   and remounts, so route and unsaved state are lost.
+     * - `'popup'` — a small `auth.oxy.so` window opened from the user's click.
+     *   The app stays MOUNTED and becomes authenticated without a reload; the
+     *   IdP delivers only the authorization code + `state` back to the opener
+     *   via `postMessage` (never a token, device secret, or PKCE verifier). A
+     *   blocked popup falls back to the redirect automatically.
      *
      * Native is unaffected — it always uses an in-app auth session.
-     * @default 'popup'
+     * @default 'redirect'
      */
     webAuthMode?: WebAuthMode;
     queryClient?: QueryClient;
+    /** Sync device credentials to auth.oxy.so after interactive sign-in. @default true */
+    hubSync?: boolean;
     /**
      * Convenience: wrap the whole app subtree in `<RequireOxyAuth prompt=...>`.
      * `off` (default) renders children unconditionally; `soft` adds a dismissible
@@ -136,11 +135,4 @@ export interface OxyProviderProps {
      * @default 'off'
      */
     requireAuth?: 'off' | 'soft' | 'hard';
-    /**
-     * When true, provisions a non-rotating background credential for native code
-     * (Android widgets) that runs without a JS runtime. Android-only today; inert
-     * on web and iOS.
-     * @default false
-     */
-    backgroundSession?: boolean;
 }

package/src/ui/utils/__tests__/crossOriginRestore.test.ts

@@ -0,0 +1,143 @@
+import type { OxyServices } from '@oxyhq/core';
+
+// Spy on the platform redirect so no real navigation happens and we can assert
+// the authorize URL the silent-restore flow hands to the browser.
+jest.mock('../../components/oauthNavigation', () => ({
+  redirectToAuthorize: jest.fn(),
+}));
+
+// jsdom's `location` is non-configurable, so the origin the code reads cannot be
+// reassigned per-test. Instead, drive the ORIGIN-CLASSIFICATION predicates
+// (whose real behaviour is covered by core's officialOrigins.test.ts) and keep
+// every other core helper real (PKCE, authorize-URL builder, handshake store).
+jest.mock('@oxyhq/core', () => {
+  const actual = jest.requireActual('@oxyhq/core');
+  return {
+    __esModule: true,
+    ...actual,
+    isLoopbackOrigin: jest.fn(),
+    isOfficialWebOrigin: jest.fn(),
+    isIdpHubOrigin: jest.fn(),
+  };
+});
+
+import {
+  isLoopbackOrigin,
+  isOfficialWebOrigin,
+  isIdpHubOrigin,
+} from '@oxyhq/core';
+import { redirectToAuthorize } from '../../components/oauthNavigation';
+import {
+  isSilentRestoreEligibleOrigin,
+  maybeStartSilentOAuthRestore,
+  clearCrossOriginRestoreGuards,
+} from '../crossOriginRestore';
+
+const mockRedirect = redirectToAuthorize as jest.Mock;
+const mockIsLoopback = isLoopbackOrigin as jest.Mock;
+const mockIsOfficial = isOfficialWebOrigin as jest.Mock;
+const mockIsIdpHub = isIdpHubOrigin as jest.Mock;
+
+const OXY_SERVICES_STUB = {} as OxyServices;
+
+/** Default to an eligible official origin; individual tests narrow this. */
+function makeOriginEligible(): void {
+  mockIsLoopback.mockReturnValue(false);
+  mockIsIdpHub.mockReturnValue(false);
+  mockIsOfficial.mockReturnValue(true);
+}
+
+describe('crossOriginRestore', () => {
+  beforeEach(() => {
+    mockRedirect.mockClear();
+    mockIsLoopback.mockReset();
+    mockIsOfficial.mockReset();
+    mockIsIdpHub.mockReset();
+    globalThis.sessionStorage?.clear();
+    clearCrossOriginRestoreGuards();
+  });
+
+  describe('isSilentRestoreEligibleOrigin', () => {
+    it('rejects loopback / local-dev origins', () => {
+      mockIsLoopback.mockReturnValue(true);
+      mockIsIdpHub.mockReturnValue(false);
+      mockIsOfficial.mockReturnValue(true);
+      expect(isSilentRestoreEligibleOrigin('http://localhost:3000')).toBe(false);
+    });
+
+    it('rejects the central IdP hub origin (no self-hop)', () => {
+      mockIsLoopback.mockReturnValue(false);
+      mockIsIdpHub.mockReturnValue(true);
+      mockIsOfficial.mockReturnValue(true);
+      expect(isSilentRestoreEligibleOrigin('https://auth.oxy.so')).toBe(false);
+    });
+
+    it('rejects non-official origins', () => {
+      mockIsLoopback.mockReturnValue(false);
+      mockIsIdpHub.mockReturnValue(false);
+      mockIsOfficial.mockReturnValue(false);
+      expect(isSilentRestoreEligibleOrigin('https://evil.example')).toBe(false);
+    });
+
+    it('accepts official, non-loopback, non-IdP origins', () => {
+      makeOriginEligible();
+      expect(isSilentRestoreEligibleOrigin('https://accounts.oxy.so')).toBe(true);
+    });
+  });
+
+  describe('maybeStartSilentOAuthRestore', () => {
+    it('is SKIPPED on a loopback origin (no redirect)', async () => {
+      mockIsLoopback.mockReturnValue(true);
+      mockIsIdpHub.mockReturnValue(false);
+      mockIsOfficial.mockReturnValue(true);
+      const redirected = await maybeStartSilentOAuthRestore({
+        oxyServices: OXY_SERVICES_STUB,
+        clientId: 'oxy_dk_test',
+      });
+      expect(redirected).toBe(false);
+      expect(mockRedirect).not.toHaveBeenCalled();
+    });
+
+    it('is SKIPPED on a non-official origin (no redirect)', async () => {
+      mockIsLoopback.mockReturnValue(false);
+      mockIsIdpHub.mockReturnValue(false);
+      mockIsOfficial.mockReturnValue(false);
+      const redirected = await maybeStartSilentOAuthRestore({
+        oxyServices: OXY_SERVICES_STUB,
+        clientId: 'oxy_dk_test',
+      });
+      expect(redirected).toBe(false);
+      expect(mockRedirect).not.toHaveBeenCalled();
+    });
+
+    it('redirects to the PROD IdP by default on an eligible origin', async () => {
+      makeOriginEligible();
+      const redirected = await maybeStartSilentOAuthRestore({
+        oxyServices: OXY_SERVICES_STUB,
+        clientId: 'oxy_dk_test',
+      });
+      expect(redirected).toBe(true);
+      expect(mockRedirect).toHaveBeenCalledTimes(1);
+      const url = mockRedirect.mock.calls[0][0] as string;
+      expect(url.startsWith('https://auth.oxy.so/authorize?')).toBe(true);
+      const params = new URL(url).searchParams;
+      expect(params.get('client_id')).toBe('oxy_dk_test');
+      expect(params.get('prompt')).toBe('none');
+    });
+
+    it('honors an authorizeBaseUrl override (self-hosted / staging IdP)', async () => {
+      makeOriginEligible();
+      const redirected = await maybeStartSilentOAuthRestore({
+        oxyServices: OXY_SERVICES_STUB,
+        clientId: 'oxy_dk_test',
+        authorizeBaseUrl: 'https://auth.staging.oxy.so/authorize',
+      });
+      expect(redirected).toBe(true);
+      const url = mockRedirect.mock.calls[0][0] as string;
+      expect(url.startsWith('https://auth.staging.oxy.so/authorize?')).toBe(true);
+      const params = new URL(url).searchParams;
+      expect(params.get('client_id')).toBe('oxy_dk_test');
+      expect(params.get('prompt')).toBe('none');
+    });
+  });
+});

package/src/ui/utils/crossOriginRestore.ts

@@ -0,0 +1,169 @@
+import type { OxyServices } from '@oxyhq/core';
+import {
+  buildOAuthAuthorizeUrl,
+  generateOAuthState,
+  generatePkcePair,
+  isIdpHubOrigin,
+  isLoopbackOrigin,
+  isOfficialWebOrigin,
+  OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY,
+  OXY_SILENT_OAUTH_ATTEMPTED_KEY,
+  clearOAuthHandshake,
+  persistOAuthHandshake,
+  normalizeOAuthRedirectUri,
+  logger,
+} from '@oxyhq/core';
+import { isWebBrowser } from './isWebBrowser';
+import { replaceUrlAfterOAuthReturn } from './oauthReturn';
+import { redirectToAuthorize } from '../components/oauthNavigation';
+
+function sessionStore(): Storage | undefined {
+  return (globalThis as { sessionStorage?: Storage }).sessionStorage;
+}
+
+/** True when this tab already attempted cross-origin silent OAuth restore. */
+export function isCrossOriginRestoreBlocked(): boolean {
+  const store = sessionStore();
+  if (!store) return false;
+  return Boolean(
+    store.getItem(OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY) ||
+      store.getItem(OXY_SILENT_OAUTH_ATTEMPTED_KEY),
+  );
+}
+
+/** Mark restore as attempted — never auto-retry until sign-out clears guards. */
+export function markCrossOriginRestoreAttempted(): void {
+  const store = sessionStore();
+  if (!store) return;
+  store.setItem(OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY, '1');
+  store.setItem(OXY_SILENT_OAUTH_ATTEMPTED_KEY, '1');
+}
+
+/** Clear all cross-origin restore loop guards (call on sign-out). */
+export function clearCrossOriginRestoreGuards(): void {
+  const store = sessionStore();
+  if (!store) return;
+  for (const key of [OXY_CROSS_ORIGIN_RESTORE_ATTEMPTED_KEY, OXY_SILENT_OAUTH_ATTEMPTED_KEY]) {
+    store.removeItem(key);
+  }
+}
+
+/**
+ * Whether cold boot should attempt silent cross-origin OAuth restore for the
+ * given web origin.
+ *
+ * Mirrors the hub-sync WRITE gate (`syncHubAfterSignIn`): only OFFICIAL Oxy web
+ * origins participate in cross-app SSO — a random third-party / preview origin
+ * must never have its tab bounced to the IdP. Additionally, loopback / local-dev
+ * origins are EXCLUDED here even though {@link isOfficialWebOrigin} treats them
+ * as official: a developer's local app must never be redirected to a hosted IdP
+ * on cold boot (it signs in through the in-app dialog instead). The central IdP
+ * hub's own origin is excluded to avoid a wasteful self-hop.
+ */
+export function isSilentRestoreEligibleOrigin(origin: string): boolean {
+  if (isLoopbackOrigin(origin)) return false;
+  if (isIdpHubOrigin()) return false;
+  return isOfficialWebOrigin(origin);
+}
+
+export interface SilentOAuthRestoreOptions {
+  oxyServices: OxyServices;
+  clientId: string;
+  redirectUri?: string;
+  scope?: string;
+  /**
+   * Authorize endpoint override (env-configurable per deployment). Defaults to
+   * the production Oxy IdP when unset, so a local/staging app points silent
+   * restore at its OWN IdP instead of production `auth.oxy.so`.
+   */
+  authorizeBaseUrl?: string;
+}
+
+/**
+ * Top-level redirect to auth.oxy.so/authorize with `prompt=none` for silent
+ * cross-origin session restore on all web apps (official + third-party).
+ */
+export async function maybeStartSilentOAuthRestore(
+  opts: SilentOAuthRestoreOptions,
+): Promise<boolean> {
+  if (!isWebBrowser()) return false;
+
+  const location = (globalThis as { location?: Location }).location;
+  if (!location) return false;
+
+  // Defense-in-depth: never bounce a loopback / non-official / IdP-hub origin to
+  // a hosted authorize endpoint (the caller gates on this too).
+  if (!isSilentRestoreEligibleOrigin(location.origin)) {
+    return false;
+  }
+
+  if (isCrossOriginRestoreBlocked()) {
+    return false;
+  }
+
+  const params = new URLSearchParams(location.search);
+  if (params.has('code') || params.has('error')) {
+    return false;
+  }
+
+  try {
+    const { codeVerifier, codeChallenge } = await generatePkcePair();
+    const state = await generateOAuthState();
+    if (!persistOAuthHandshake(state, codeVerifier)) {
+      return false;
+    }
+
+    const redirectUri = normalizeOAuthRedirectUri(
+      opts.redirectUri ?? location.origin,
+    );
+
+    const authorizeUrl = buildOAuthAuthorizeUrl({
+      authorizeBaseUrl: opts.authorizeBaseUrl,
+      clientId: opts.clientId,
+      redirectUri,
+      state,
+      codeChallenge,
+      scope: opts.scope,
+      prompt: 'none',
+    });
+
+    markCrossOriginRestoreAttempted();
+    redirectToAuthorize(authorizeUrl);
+    return true;
+  } catch (error) {
+    logger.warn('Silent OAuth restore skipped', { component: 'crossOriginRestore' }, error);
+    return false;
+  }
+}
+
+/**
+ * When the RP lands with OAuth error params from a silent authorize attempt,
+ * strip them and return whether the error was terminal for silent restore.
+ */
+export function consumeSilentOAuthError(): 'login_required' | 'consent_required' | null {
+  if (!isWebBrowser()) return null;
+  const location = (globalThis as { location?: Location; history?: History }).location;
+  const history = (globalThis as { history?: History }).history;
+  if (!location) return null;
+
+  const params = new URLSearchParams(location.search);
+  const error = params.get('error');
+  if (error !== 'login_required' && error !== 'consent_required') {
+    return null;
+  }
+
+  markCrossOriginRestoreAttempted();
+
+  if (history?.replaceState) {
+    const url = new URL(location.href);
+    url.searchParams.delete('error');
+    url.searchParams.delete('error_description');
+    url.searchParams.delete('state');
+    // Silent restore failed, but the visitor still asked for a specific page.
+    // Put them back on it rather than leaving them on the bare origin the IdP
+    // redirected to.
+    replaceUrlAfterOAuthReturn(`${url.pathname}${url.search}${url.hash}`);
+  }
+  clearOAuthHandshake();
+  return error;
+}

package/src/ui/utils/fileManagement.ts

@@ -1,7 +1,7 @@
-import type Ionicons from "@expo/vector-icons/Ionicons";
-import type { AssetUploadInput, RNFileDescriptor } from "@oxyhq/core";
-import type { ComponentProps } from "react";
-import { Platform } from "react-native";
+import type Ionicons from '@expo/vector-icons/Ionicons';
+import type { AssetUploadInput, RNFileDescriptor } from '@oxyhq/core';
+import type { ComponentProps } from 'react';
+import { Platform } from 'react-native';
 
 /**
  * Extended File interface that includes a `uri` property for mobile preview support.
@@ -9,7 +9,7 @@ import { Platform } from "react-native";
  * on the File object for preview rendering.
  */
 interface FileWithUri extends File {
-	uri?: string;
+  uri?: string;
 }
 
 /**
@@ -18,11 +18,11 @@ interface FileWithUri extends File {
  * descriptor straight to FormData on React Native.
  */
 export interface PickerAsset {
-	file?: File | Blob;
-	uri?: string;
-	name?: string | null;
-	mimeType?: string | null;
-	size?: number | null;
+  file?: File | Blob;
+  uri?: string;
+  name?: string | null;
+  mimeType?: string | null;
+  size?: number | null;
 }
 
 /**
@@ -30,42 +30,37 @@ export interface PickerAsset {
  * (carries a URI but is not a real DOM `File` / `Blob` instance).
  */
 export function isRNFileDescriptor(input: unknown): input is RNFileDescriptor {
-	if (!input || typeof input !== "object") return false;
-	const obj = input as Record<string, unknown>;
-	if (typeof obj.uri !== "string") return false;
-	if (typeof File !== "undefined" && input instanceof File) return false;
-	if (typeof Blob !== "undefined" && input instanceof Blob) return false;
-	return true;
+  if (!input || typeof input !== 'object') return false;
+  const obj = input as Record<string, unknown>;
+  if (typeof obj.uri !== 'string') return false;
+  if (typeof File !== 'undefined' && input instanceof File) return false;
+  if (typeof Blob !== 'undefined' && input instanceof Blob) return false;
+  return true;
 }
 
 /**
  * Format file size in bytes to human-readable string
  */
 export function formatFileSize(bytes: number): string {
-	if (bytes === 0) return "0 Bytes";
-	const k = 1024;
-	const sizes = ["Bytes", "KB", "MB", "GB"];
-	const i = Math.floor(Math.log(bytes) / Math.log(k));
-	return `${Number.parseFloat((bytes / k ** i).toFixed(2))} ${sizes[i]}`;
+    if (bytes === 0) return '0 Bytes';
+    const k = 1024;
+    const sizes = ['Bytes', 'KB', 'MB', 'GB'];
+    const i = Math.floor(Math.log(bytes) / Math.log(k));
+    return `${Number.parseFloat((bytes / k ** i).toFixed(2))} ${sizes[i]}`;
 }
 
 /**
  * Get icon name for file based on content type
  */
-export function getFileIcon(
-	contentType: string,
-): ComponentProps<typeof Ionicons>["name"] {
-	if (contentType.startsWith("image/")) return "image";
-	if (contentType.startsWith("video/")) return "videocam";
-	if (contentType.startsWith("audio/")) return "musical-notes";
-	if (contentType.includes("pdf")) return "document-text";
-	if (contentType.includes("word") || contentType.includes("doc"))
-		return "document";
-	if (contentType.includes("excel") || contentType.includes("sheet"))
-		return "grid";
-	if (contentType.includes("zip") || contentType.includes("archive"))
-		return "archive";
-	return "document-outline";
+export function getFileIcon(contentType: string): ComponentProps<typeof Ionicons>['name'] {
+    if (contentType.startsWith('image/')) return 'image';
+    if (contentType.startsWith('video/')) return 'videocam';
+    if (contentType.startsWith('audio/')) return 'musical-notes';
+    if (contentType.includes('pdf')) return 'document-text';
+    if (contentType.includes('word') || contentType.includes('doc')) return 'document';
+    if (contentType.includes('excel') || contentType.includes('sheet')) return 'grid';
+    if (contentType.includes('zip') || contentType.includes('archive')) return 'archive';
+    return 'document-outline';
 }
 
 /**
@@ -81,90 +76,79 @@ export function getFileIcon(
  *   'ArrayBuffer' and 'ArrayBufferView' are not supported").
  */
 export async function convertDocumentPickerAssetToFile(
-	doc: PickerAsset,
-	index: number,
+    doc: PickerAsset,
+    index: number
 ): Promise<FileWithUri | RNFileDescriptor | null> {
-	const fileName = doc.name || `file-${index + 1}`;
-	const fileType = doc.mimeType || "application/octet-stream";
+    const fileName = doc.name || `file-${index + 1}`;
+    const fileType = doc.mimeType || 'application/octet-stream';
 
-	// React Native path — return the descriptor as-is. FormData handles it.
-	if (Platform.OS !== "web") {
-		if (!doc.uri) {
-			throw new Error("Missing file data (no uri property)");
-		}
-		return {
-			uri: doc.uri,
-			type: fileType,
-			name: fileName,
-			size: typeof doc.size === "number" ? doc.size : undefined,
-		};
-	}
+    // React Native path — return the descriptor as-is. FormData handles it.
+    if (Platform.OS !== 'web') {
+        if (!doc.uri) {
+            throw new Error('Missing file data (no uri property)');
+        }
+        return {
+            uri: doc.uri,
+            type: fileType,
+            name: fileName,
+            size: typeof doc.size === 'number' ? doc.size : undefined,
+        };
+    }
 
-	try {
-		let file: FileWithUri | null = null;
+    try {
+        let file: FileWithUri | null = null;
 
-		// Priority 1: Use doc.file if available (web native File API).
-		// This is the most efficient path as it doesn't require fetching.
-		if (
-			doc.file &&
-			typeof globalThis.File !== "undefined" &&
-			doc.file instanceof globalThis.File
-		) {
-			file = doc.file as FileWithUri;
-			// Ensure file has required properties
-			if (!file.name && doc.name) {
-				// Create new File with proper name if missing
-				file = new globalThis.File([file], doc.name, {
-					type: file.type || fileType,
-				});
-			}
-			// Preserve URI for preview if available
-			if (doc.uri) {
-				file.uri = doc.uri;
-			}
-			return file;
-		}
+        // Priority 1: Use doc.file if available (web native File API).
+        // This is the most efficient path as it doesn't require fetching.
+        if (doc.file && typeof globalThis.File !== 'undefined' && doc.file instanceof globalThis.File) {
+            file = doc.file as FileWithUri;
+            // Ensure file has required properties
+            if (!file.name && doc.name) {
+                // Create new File with proper name if missing
+                file = new globalThis.File([file], doc.name, { type: file.type || fileType });
+            }
+            // Preserve URI for preview if available
+            if (doc.uri) {
+                file.uri = doc.uri;
+            }
+            return file;
+        }
 
-		// Priority 2: Build File from URI (web blob URLs or http(s) URLs).
-		if (doc.uri) {
-			try {
-				const response = await fetch(doc.uri);
-				if (!response.ok) {
-					throw new Error(`Failed to fetch file: ${response.statusText}`);
-				}
-				const blob = await response.blob();
-				const resolvedType =
-					doc.mimeType || blob.type || "application/octet-stream";
-				file = new globalThis.File([blob], fileName, {
-					type: resolvedType,
-				}) as FileWithUri;
-				file.uri = doc.uri;
-				return file;
-			} catch (error: unknown) {
-				console.error("Failed to read file from URI:", error);
-				throw new Error(
-					`Failed to load file: ${(error instanceof Error ? error.message : null) || "Unknown error"}`,
-				);
-			}
-		}
+        // Priority 2: Build File from URI (web blob URLs or http(s) URLs).
+        if (doc.uri) {
+            try {
+                const response = await fetch(doc.uri);
+                if (!response.ok) {
+                    throw new Error(`Failed to fetch file: ${response.statusText}`);
+                }
+                const blob = await response.blob();
+                const resolvedType = doc.mimeType || blob.type || 'application/octet-stream';
+                file = new globalThis.File([blob], fileName, { type: resolvedType }) as FileWithUri;
+                file.uri = doc.uri;
+                return file;
+            } catch (error: unknown) {
+                console.error('Failed to read file from URI:', error);
+                throw new Error(`Failed to load file: ${(error instanceof Error ? error.message : null) || 'Unknown error'}`);
+            }
+        }
 
-		// No file or URI available - this shouldn't happen with Expo 54
-		throw new Error("Missing file data (no file or uri property)");
-	} catch (error: unknown) {
-		console.error("Error converting document to file:", error);
-		throw error;
-	}
+        // No file or URI available - this shouldn't happen with Expo 54
+        throw new Error('Missing file data (no file or uri property)');
+    } catch (error: unknown) {
+        console.error('Error converting document to file:', error);
+        throw error;
+    }
 }
 
 /**
  * Upload file raw - helper function for file uploads
  */
 export async function uploadFileRaw(
-	file: AssetUploadInput,
-	userId: string,
-	// biome-ignore lint/suspicious/noExplicitAny: OxyServices type cannot be fully resolved due to mixin composition pattern
-	oxyServices: any,
-	visibility?: "private" | "public" | "unlisted",
+    file: AssetUploadInput,
+    userId: string,
+    // biome-ignore lint/suspicious/noExplicitAny: OxyServices type cannot be fully resolved due to mixin composition pattern
+    oxyServices: any,
+    visibility?: 'private' | 'public' | 'unlisted'
 ) {
-	return await oxyServices.uploadRawFile(file, visibility);
+    return await oxyServices.uploadRawFile(file, visibility);
 }