@oxyhq/services 26.0.1 → 26.0.3

package/src/ui/context/__tests__/commitSessionFlow.test.ts

@@ -1,11 +1,8 @@
 import type { User } from '@oxyhq/core';
 import { logger } from '@oxyhq/core';
-import type { WebAuthMode } from '../../oauth/types';
 import {
   commitDeviceSetAndResolve,
-  maybeSyncHubAfterCommit,
   type CommitDeviceSetAndResolveDeps,
-  type MaybeSyncHubAfterCommitDeps,
 } from '../commitSessionFlow';
 
 // A resolved promise chain (addCurrentAccount -> start -> syncFromClient) settles
@@ -132,6 +129,19 @@ describe('commitDeviceSetAndResolve — cold boot (activate: false)', () => {
     expect(deps.markAuthResolved).toHaveBeenCalledTimes(1);
   });
 
+  it('falls back to the minimal commit-input user when getCurrentUser returns null', async () => {
+    const order: string[] = [];
+    const deps = buildDeps(order, {
+      getCurrentUser: jest.fn(async () => null),
+    });
+
+    await commitDeviceSetAndResolve(deps);
+    await flush();
+
+    expect(deps.loginSuccess).toHaveBeenCalledWith(makeUser('fallback'));
+    expect(deps.markAuthResolved).toHaveBeenCalledTimes(1);
+  });
+
   it('logs (never swallows) a failing background reconcile and still resolves', async () => {
     const warnSpy = jest.spyOn(logger, 'warn').mockImplementation(() => undefined);
     const order: string[] = [];
@@ -181,92 +191,6 @@ describe('commitDeviceSetAndResolve — cold boot (activate: false)', () => {
   });
 });
 
-/**
- * Post-sign-in hub sync is a FULL-PAGE redirect to auth.oxy.so. It runs from the
- * ONE commit funnel, so gating it here gates every commit path at once —
- * `webAuthMode: 'popup'` must never bounce the tab, whichever path signed the
- * user in (#691 phase 7).
- */
-describe('maybeSyncHubAfterCommit — webAuthMode transport gate (#691 phase 7)', () => {
-  const buildHubDeps = (
-    overrides: Partial<MaybeSyncHubAfterCommitDeps> = {},
-  ): MaybeSyncHubAfterCommitDeps => ({
-    activate: true,
-    hubSyncRequested: true,
-    hubSyncEnabled: true,
-    webAuthMode: 'redirect',
-    syncHub: jest.fn(async () => true),
-    ...overrides,
-  });
-
-  it("redirect mode: syncs the hub after a deliberate sign-in (unchanged)", async () => {
-    const deps = buildHubDeps();
-
-    await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(true);
-
-    expect(deps.syncHub).toHaveBeenCalledTimes(1);
-  });
-
-  it('popup mode: NEVER syncs the hub, even on an otherwise-eligible sign-in', async () => {
-    const deps = buildHubDeps({ webAuthMode: 'popup' });
-
-    await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
-
-    expect(deps.syncHub).not.toHaveBeenCalled();
-  });
-
-  it('popup mode: no commit path can opt back in', async () => {
-    // Every commit path differs only in `activate` / `hubSyncRequested`; the
-    // transport gate outranks all of them.
-    for (const activate of [true, false]) {
-      for (const hubSyncRequested of [true, false]) {
-        const deps = buildHubDeps({ webAuthMode: 'popup', activate, hubSyncRequested });
-        await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
-        expect(deps.syncHub).not.toHaveBeenCalled();
-      }
-    }
-  });
-
-  it.each(['popup', 'redirect'] as const)(
-    'never syncs on a cold-boot restore, in either mode (%s)',
-    async (webAuthMode: WebAuthMode) => {
-      const deps = buildHubDeps({ webAuthMode, activate: false });
-
-      await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
-
-      expect(deps.syncHub).not.toHaveBeenCalled();
-    },
-  );
-
-  it('redirect mode: honours the per-commit opt-out (account switch / popup OAuth lanes)', async () => {
-    const deps = buildHubDeps({ hubSyncRequested: false });
-
-    await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
-
-    expect(deps.syncHub).not.toHaveBeenCalled();
-  });
-
-  it('redirect mode: honours the provider-level hubSync opt-out', async () => {
-    const deps = buildHubDeps({ hubSyncEnabled: false });
-
-    await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
-
-    expect(deps.syncHub).not.toHaveBeenCalled();
-  });
-
-  it('redirect mode: a failing hub sync is non-fatal and never rejects', async () => {
-    const deps = buildHubDeps({
-      syncHub: jest.fn(async () => {
-        throw new Error('hub ticket failed');
-      }),
-    });
-
-    await expect(maybeSyncHubAfterCommit(deps)).resolves.toBe(false);
-
-    expect(deps.syncHub).toHaveBeenCalledTimes(1);
-  });
-});
-
 describe('commitDeviceSetAndResolve — deliberate sign-in (activate: true)', () => {
   it('BLOCKS on the device-set reconcile before resolving auth (unchanged ordering)', async () => {
     const order: string[] = [];

package/src/ui/context/commitSessionFlow.ts

@@ -1,8 +1,5 @@
 import type { User } from '@oxyhq/core';
 import { logger as loggerUtil } from '@oxyhq/core';
-import { allowsAutomaticIdpRedirect } from '../oauth/legacyRedirectLanes';
-import type { WebAuthMode } from '../oauth/types';
-import { isWebBrowser } from '../utils/isWebBrowser';
 import { isUnauthorizedStatus } from './oxyContextHelpers';
 
 const LOG_CONTEXT = { component: 'OxyContext', method: 'commitSession' } as const;
@@ -101,6 +98,9 @@ export async function commitDeviceSetAndResolve(
       }
       fullUser = fallbackUser;
     }
+    if (!fullUser) {
+      fullUser = fallbackUser;
+    }
     if (fullUser) {
       loginSuccess(fullUser);
       onAuthStateChange?.(fullUser);
@@ -126,61 +126,3 @@ export async function commitDeviceSetAndResolve(
   await hydrateAndResolve();
   void reconcileDeviceSet().catch(logReconcileError);
 }
-
-export interface MaybeSyncHubAfterCommitDeps {
-  /** Deliberate sign-in (`true`) vs. a cold-boot / background commit (`false`). */
-  activate: boolean;
-  /** Per-commit opt-in — `commitSession`'s `options.hubSync`. */
-  hubSyncRequested: boolean;
-  /** Provider-level opt-out — `OxyProviderProps.hubSync`. */
-  hubSyncEnabled: boolean;
-  /**
-   * The provider's web sign-in transport — `OxyProviderProps.webAuthMode`.
-   * A first-class input: `'popup'` forbids the redirect outright.
-   */
-  webAuthMode: WebAuthMode;
-  /**
-   * Starts the full-page hop to `auth.oxy.so/sync`; resolves `true` when the
-   * navigation was actually started.
-   */
-  syncHub: () => Promise<boolean>;
-}
-
-/**
- * Post-sign-in hub sync: plant this device's credential on the IdP hub so OTHER
- * official origins can silently restore a session on their next cold boot.
- *
- * The tail of the ONE commit funnel (`commitSession`), extracted so every gate
- * on this legacy lane lives — and is tested — in one place. Returns whether the
- * full-page redirect was started; a failure is non-fatal and never propagates
- * (the sign-in itself already succeeded).
- *
- * Four gates, all of which must pass:
- * 1. `activate` — only a deliberate sign-in syncs; a cold-boot restore never does.
- * 2. `hubSyncRequested` — the in-place lanes (account switch, popup OAuth) opt out.
- * 3. `hubSyncEnabled` — the provider-level `hubSync` prop.
- * 4. `allowsAutomaticIdpRedirect(webAuthMode)` — hub sync REPLACES the document
- *    with `auth.oxy.so`, so `webAuthMode: 'popup'` forbids it: a redirect that
- *    bounces the tab defeats the entire point of the mode, no matter which
- *    commit path produced the session (issue #691, "Cold boot and cross-domain
- *    behavior"). Redirect mode — the default and the compatibility path — is
- *    unchanged, and this whole function disappears with it in phase 7b.
- */
-export async function maybeSyncHubAfterCommit(
-  deps: MaybeSyncHubAfterCommitDeps,
-): Promise<boolean> {
-  const { activate, hubSyncRequested, hubSyncEnabled, webAuthMode, syncHub } = deps;
-
-  if (!activate || !hubSyncRequested || !hubSyncEnabled) return false;
-  if (!allowsAutomaticIdpRedirect(webAuthMode)) return false;
-  if (!isWebBrowser()) return false;
-
-  try {
-    return await syncHub();
-  } catch (hubError) {
-    if (__DEV__) {
-      loggerUtil.debug('Hub sync after sign-in failed (non-fatal)', LOG_CONTEXT, hubError);
-    }
-    return false;
-  }
-}

package/src/ui/context/hooks/useAuthOperations.ts

@@ -1,5 +1,5 @@
 import { useCallback } from 'react';
-import type { ApiError, AuthStateStore, SessionClient, User } from '@oxyhq/core';
+import type { ApiError, AuthStateStore, IdentityBinding, SessionClient, User } from '@oxyhq/core';
 import type { AuthState } from '../../stores/authStore';
 import type { ClientSession, SessionLoginResponse } from '@oxyhq/core';
 import { DeviceManager } from '@oxyhq/core';
@@ -43,6 +43,15 @@ export interface UseAuthOperationsOptions {
   logoutStore: () => void;
   setAuthState: (state: Partial<AuthState>) => void;
   logger?: (message: string, error?: unknown) => void;
+  /**
+   * Identity-bound session (`sessionMode: 'identity'`). When set, a successful
+   * key sign-in writes the durable `{publicKey, accountId}` pin so pinned
+   * re-mints and projections bind immediately instead of waiting for a second
+   * `establishIdentitySession` round-trip.
+   */
+  identityBinding?: IdentityBinding;
+  /** Refreshes the provider's memoised pinned account id after the pin lands. */
+  refreshPinnedAccountId?: () => Promise<string | null>;
 }
 
 export interface UseAuthOperationsResult {
@@ -97,6 +106,8 @@ export const useAuthOperations = ({
   logoutStore,
   setAuthState,
   logger,
+  identityBinding,
+  refreshPinnedAccountId,
 }: UseAuthOperationsOptions): UseAuthOperationsResult => {
   /**
    * Internal function to perform challenge-response sign in.
@@ -155,6 +166,18 @@ export const useAuthOperations = ({
         }
       }
 
+      if (identityBinding) {
+        try {
+          await identityBinding.pinStore.save({
+            publicKey: publicKey.toLowerCase(),
+            accountId: sessionResponse.user.id,
+          });
+          await refreshPinnedAccountId?.();
+        } catch (pinError) {
+          logger?.('Failed to persist identity pin after sign-in', pinError);
+        }
+      }
+
       // Register this recovered account+session into the server-authoritative
       // device-session set AND make it active: `registerAndActivate()` adds via
       // `POST /session/device/add` (identity derived from the bearer
@@ -237,6 +260,8 @@ export const useAuthOperations = ({
       switchSession,
       syncFromClient,
       updateSessions,
+      identityBinding,
+      refreshPinnedAccountId,
     ],
   );
 

package/src/ui/context/oxyContextTypes.ts

@@ -158,10 +158,9 @@ export interface OxyContextProviderProps {
   authWebUrl?: string;
   authRedirectUri?: string;
   /**
-   * Authorize endpoint override for silent cross-origin session restore
-   * (web cross-app SSO). Defaults to the production Oxy IdP when unset; a
-   * local/staging deployment points it at its own IdP so cold boot never
-   * bounces the tab to production `auth.oxy.so`.
+   * Authorize endpoint override for web "Sign in with Oxy". Defaults to the
+   * production Oxy IdP when unset; a local/staging deployment points it at its
+   * own IdP so sign-in never reaches production `auth.oxy.so`.
    */
   authorizeBaseUrl?: string;
   storageKeyPrefix?: string;
@@ -174,11 +173,31 @@ export interface OxyContextProviderProps {
   sessionMode?: SessionMode;
   /**
    * Transport for WEB third-party sign-in. See `OxyProviderProps.webAuthMode`.
-   * @default 'redirect'
+   * @default 'popup'
    */
   webAuthMode?: WebAuthMode;
-  /** Sync device credentials to auth.oxy.so after interactive sign-in. @default true */
-  hubSync?: boolean;
+  /**
+   * Let NATIVE background code (a home-screen widget's WorkManager worker, a sync
+   * job) authenticate while the app process is dead and there is no JS runtime.
+   *
+   * With this on, the SDK provisions a purpose-built background credential
+   * whenever the app runs and stores it where `so.oxy.session.OxyBackgroundSession`
+   * can read it; Kotlin then exchanges it for a short access token on demand. The
+   * app writes no session code — this prop is the whole integration.
+   *
+   * OFF by default, because a credential that nobody needs is exposure that
+   * nobody needs. Turn it on only in an app that actually has background code to
+   * authenticate. Android-only today; inert on web and iOS.
+   *
+   * The credential cannot create a session (only the running app can provision
+   * one), cannot rotate or otherwise disturb the app's own device credential, and
+   * is re-authorized server-side on every use so it can never outlive a sign-out.
+   * It does NOT reduce authority: the token it mints is a full user access token,
+   * exactly like the device credential's.
+   *
+   * @default false
+   */
+  backgroundSession?: boolean;
   onAuthStateChange?: (user: User | null) => void;
   onError?: (error: ApiError) => void;
 }

package/src/ui/context/useOxyAccountGraph.ts

@@ -22,7 +22,7 @@ interface UseOxyAccountGraphParams {
   oxyServices: OxyServices;
   sessionClient: SessionClient;
   syncFromClient: () => Promise<void>;
-  commitSession: (input: CommitInput, options: { activate: boolean; hubSync?: boolean }) => Promise<void>;
+  commitSession: (input: CommitInput, options: { activate: boolean }) => Promise<void>;
   queryClient: QueryClient;
   accountDialogControllerRef: RefObject<AccountDialogController | null>;
   clearSessionStateRef: RefObject<() => Promise<void>>;
@@ -110,9 +110,9 @@ export function useOxyAccountGraph({
           userId: result.user.id,
           user: result.user,
         },
-        // A switch is IN-PLACE: never run the cross-origin hub-sync full-page
-        // redirect. Cross-tab/app propagation rides the `session_state` socket.
-        { activate: true, hubSync: false },
+        // A switch is IN-PLACE. Cross-tab/app propagation rides the
+        // `session_state` socket.
+        { activate: true },
       );
       await runPostAccountSwitchSideEffects();
     },

package/src/ui/hooks/mutations/mutationFactory.ts

@@ -12,7 +12,7 @@
 import type { QueryClient, UseMutationOptions } from '@tanstack/react-query';
 import type { User } from '@oxyhq/core';
 import { queryKeys, invalidateAccountQueries, invalidateUserQueries } from '../queries/queryKeys';
-import { toast } from '@oxyhq/bloom';
+import { toast } from '@oxyhq/bloom/toast';
 import { useAuthStore } from '../../stores/authStore';
 
 /**

package/src/ui/hooks/mutations/useAccountMutations.ts

@@ -17,7 +17,7 @@ import {
 } from '../queries/queryKeys';
 import { mutationKeys } from './mutationKeys';
 import { useOxy } from '../../context/OxyContext';
-import { toast } from '@oxyhq/bloom';
+import { toast } from '@oxyhq/bloom/toast';
 import { refreshAvatarInStore } from '../../utils/avatarUtils';
 import { useAuthStore } from '../../stores/authStore';
 

package/src/ui/hooks/mutations/useServicesMutations.ts

@@ -3,7 +3,7 @@ import type { ClientSession } from '@oxyhq/core';
 import { queryKeys, invalidateSessionQueries } from '../queries/queryKeys';
 import { mutationKeys } from './mutationKeys';
 import { useOxy } from '../../context/OxyContext';
-import { toast } from '@oxyhq/bloom';
+import { toast } from '@oxyhq/bloom/toast';
 
 /**
  * Switch active session

package/src/ui/hooks/queries/paymentTypes.ts

@@ -7,8 +7,9 @@
  * `useUserWalletTransactions`) expose precise types instead of `any`.
  *
  * Source of truth (API):
- *  - Subscription:  GET /subscription/:userId   -> `Subscription` model JSON,
- *                   or the fallback `{ plan: 'basic' }` when none exists.
+ *  - Subscription:  GET /subscription/:userId   -> billing-first normalized
+ *                   subscription JSON (Stripe `BillingSubscription` with legacy
+ *                   `Subscription` fallback), or `{ plan: 'basic' }` when none.
  *  - Payments:      GET /payments/user          -> `Payment[]` (sendSuccess).
  *  - Wallet:        GET /wallet/:userId         -> `Wallet` (sendSuccess).
  *  - Transactions:  GET /wallet/transactions/:userId

package/src/ui/hooks/queries/usePaymentQueries.ts

@@ -30,8 +30,9 @@ import type {
  * Get the current user's subscription.
  *
  * Wraps `oxyServices.getCurrentUserSubscription()`
- * (`GET /subscription/:userId`). Returns the persisted subscription or the
- * API's `{ plan: 'basic' }` fallback when the user has never subscribed.
+ * (`GET /subscription/:userId`, billing-first). Returns the persisted
+ * subscription or the API's `{ plan: 'basic' }` fallback when the user has
+ * never subscribed.
  */
 export const useUserSubscription = (options?: { enabled?: boolean }) => {
   const { oxyServices, isAuthenticated, activeSessionId, user } = useOxy();