@oxyhq/services 5.14.0 → 5.15.1

package/src/core/mixins/OxyServices.assets.ts

@@ -3,6 +3,7 @@
  */
 import type { AssetInitResponse, AssetUrlResponse, AssetVariant } from '../../models/interfaces';
 import type { OxyServicesBase } from '../OxyServices.base';
+import { File } from 'expo-file-system';
 
 export function OxyServicesAssetsMixin<T extends typeof OxyServicesBase>(Base: T) {
   return class extends Base {
@@ -168,13 +169,139 @@ export function OxyServicesAssetsMixin<T extends typeof OxyServicesBase>(Base: T
     // ============================================================================
 
     /**
-     * Calculate SHA256 hash of file content
+     * Get base64 string from file - uses expo-file-system when URI is available
+     * Returns base64 string directly for use with expo-crypto
+     */
+    async getFileBase64(file: File | Blob): Promise<string> {
+      // Check for URI from DocumentPicker (Expo 54)
+      const uri = (file as any).uri;
+      if (uri && typeof uri === 'string') {
+        // Use Expo 54 FileSystem API
+        try {
+          const fileInstance = new File(uri);
+          return await fileInstance.base64();
+        } catch (error: any) {
+          throw new Error(`Failed to read file from URI: ${error.message || 'Unknown error'}`);
+        }
+      }
+      
+      // For files without URI (web Blobs), convert to base64 using fetch
+      const blobUrl = URL.createObjectURL(file);
+      try {
+        const response = await fetch(blobUrl);
+        if (!response.ok) {
+          throw new Error(`Failed to fetch file: ${response.statusText || 'HTTP ' + response.status}`);
+        }
+        const buffer = await response.arrayBuffer();
+        // Convert ArrayBuffer to base64 using chunked approach to avoid stack overflow
+        return this.arrayBufferToBase64Safe(buffer);
+      } finally {
+        URL.revokeObjectURL(blobUrl);
+      }
+    }
+
+    /**
+     * Convert File or Blob to ArrayBuffer - uses expo-file-system when URI available
+     */
+    async fileToArrayBuffer(file: File | Blob): Promise<ArrayBuffer> {
+      // Check for URI from DocumentPicker (Expo 54)
+      const uri = (file as any).uri;
+      if (uri && typeof uri === 'string') {
+        // Use Expo 54 FileSystem API
+        try {
+          const fileInstance = new File(uri);
+          const bytes = await fileInstance.bytes();
+          return bytes.buffer;
+        } catch (error: any) {
+          throw new Error(`Failed to read file from URI: ${error.message || 'Unknown error'}`);
+        }
+      }
+      
+      // For files without URI, use native arrayBuffer if available, else fetch
+      if (typeof (file as File).arrayBuffer === 'function') {
+        return await (file as File).arrayBuffer();
+      }
+      
+      // Fallback: fetch via blob URL
+      const blobUrl = URL.createObjectURL(file);
+      try {
+        const response = await fetch(blobUrl);
+        if (!response.ok) {
+          throw new Error(`Failed to fetch file: ${response.statusText || 'HTTP ' + response.status}`);
+        }
+        return await response.arrayBuffer();
+      } finally {
+        URL.revokeObjectURL(blobUrl);
+      }
+    }
+
+    /**
+     * Convert ArrayBuffer to hex string
+     */
+    arrayBufferToHex(buffer: ArrayBuffer): string {
+      const bytes = new Uint8Array(buffer);
+      return Array.from(bytes, b => b.toString(16).padStart(2, '0')).join('');
+    }
+
+    /**
+     * Convert base64 string to ArrayBuffer (safe for large files)
+     */
+    base64ToArrayBuffer(base64: string): ArrayBuffer {
+      const binaryString = atob(base64);
+      const bytes = new Uint8Array(binaryString.length);
+      for (let i = 0; i < binaryString.length; i++) {
+        bytes[i] = binaryString.charCodeAt(i);
+      }
+      return bytes.buffer;
+    }
+
+    /**
+     * Convert ArrayBuffer to base64 string (safe chunked approach to avoid stack overflow)
+     */
+    arrayBufferToBase64Safe(buffer: ArrayBuffer): string {
+      const bytes = new Uint8Array(buffer);
+      const chunkSize = 8192; // Process in chunks to avoid stack overflow
+      
+      // Use chunked approach for large buffers
+      if (bytes.length > chunkSize) {
+        let binary = '';
+        for (let i = 0; i < bytes.length; i += chunkSize) {
+          const chunk = bytes.slice(i, i + chunkSize);
+          binary += String.fromCharCode.apply(null, Array.from(chunk));
+        }
+        return typeof btoa !== 'undefined' ? btoa(binary) : Buffer.from(binary, 'binary').toString('base64');
+      }
+      
+      // Small buffers can use direct conversion
+      const binary = String.fromCharCode.apply(null, Array.from(bytes));
+      return typeof btoa !== 'undefined' ? btoa(binary) : Buffer.from(binary, 'binary').toString('base64');
+    }
+
+    /**
+     * Calculate SHA256 hash of file content - uses expo-crypto (Expo 54 unified API)
      */
     async calculateSHA256(file: File | Blob): Promise<string> {
-      const buffer = await file.arrayBuffer();
-      const hashBuffer = await crypto.subtle.digest('SHA-256', buffer);
-      const hashArray = Array.from(new Uint8Array(hashBuffer));
-      return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
+      // Use expo-crypto (works on all platforms with Expo 54)
+      const CryptoModule = await import('expo-crypto' as any).catch(() => null);
+      if (!CryptoModule) {
+        throw new Error('expo-crypto is not available. Install it with: npx expo install expo-crypto');
+      }
+
+      const Crypto = CryptoModule.default || CryptoModule;
+      if (!Crypto?.digestStringAsync) {
+        throw new Error('expo-crypto.digestStringAsync is not available');
+      }
+
+      try {
+        // Read file as base64 (uses expo-file-system if URI available, else converts)
+        const base64 = await this.getFileBase64(file);
+        const algorithm = (Crypto as any).CryptoDigestAlgorithm?.SHA256 || 'SHA256';
+        const encoding = (Crypto as any).CryptoEncoding?.BASE64 || 'base64';
+        return await Crypto.digestStringAsync(algorithm, base64, { encoding });
+      } catch (error: any) {
+        const errorMessage = error?.message || String(error) || 'Unknown error';
+        throw new Error(`Failed to calculate SHA256 hash: ${errorMessage}`);
+      }
     }
 
     /**
@@ -214,40 +341,111 @@ export function OxyServicesAssetsMixin<T extends typeof OxyServicesBase>(Base: T
      * Upload file using Central Asset Service
      */
     async assetUpload(file: File, visibility?: 'private' | 'public' | 'unlisted', metadata?: Record<string, any>, onProgress?: (progress: number) => void): Promise<any> {
+      const fileName = file.name || 'unknown';
+      const fileSize = file.size;
+      const fileType = file.type || 'application/octet-stream';
+      
       try {
         // Calculate SHA256
-        const sha256 = await this.calculateSHA256(file);
+        let sha256: string;
+        try {
+          sha256 = await this.calculateSHA256(file);
+        } catch (error: any) {
+          throw new Error(`Failed to calculate file hash for "${fileName}": ${error.message || 'Unknown error'}`);
+        }
         
         // Initialize upload
-        const initResponse = await this.assetInit(sha256, file.size, file.type);
+        let initResponse: AssetInitResponse;
+        try {
+          initResponse = await this.assetInit(sha256, fileSize, fileType);
+        } catch (error: any) {
+          throw new Error(`Failed to initialize upload for "${fileName}": ${error.message || 'Unknown error'}`);
+        }
 
-        // Try presigned URL first
+        // Try presigned URL first, fallback to direct upload
         try {
           await this.uploadToPresignedUrl(initResponse.uploadUrl, file, onProgress);
-        } catch (e) {
+        } catch (uploadError: any) {
           // Fallback: direct upload via API to avoid CORS issues
-          const fd = new FormData();
-          fd.append('file', file);
-          // Use httpService directly for FormData uploads (bypasses caching for special handling)
-          await this.getClient().request({
-            method: 'POST',
-            url: `/api/assets/${encodeURIComponent(initResponse.fileId)}/upload-direct`,
-            data: fd,
-            cache: false,
-          });
+          try {
+            const fd = new FormData();
+            fd.append('file', file);
+            await this.getClient().request({
+              method: 'POST',
+              url: `/api/assets/${encodeURIComponent(initResponse.fileId)}/upload-direct`,
+              data: fd,
+              cache: false,
+            });
+          } catch (directUploadError: any) {
+            throw new Error(
+              `Failed to upload file "${fileName}" (${(fileSize / 1024 / 1024).toFixed(2)}MB): ` +
+              `Presigned URL failed: ${uploadError.message || 'Unknown error'}. ` +
+              `Direct upload failed: ${directUploadError.message || 'Unknown error'}`
+            );
+          }
         }
 
         // Complete upload
-        return await this.assetComplete(
-          initResponse.fileId,
-          file.name,
-          file.size,
-          file.type,
-          visibility,
-          metadata
-        );
+        try {
+          return await this.assetComplete(
+            initResponse.fileId,
+            fileName,
+            fileSize,
+            fileType,
+            visibility,
+            metadata
+          );
+        } catch (error: any) {
+          throw new Error(`Failed to complete upload for "${fileName}": ${error.message || 'Unknown error'}`);
+        }
       } catch (error) {
-        throw this.handleError(error);
+        // Log the original error for debugging
+        console.error('File upload error:', error);
+        
+        // Preserve original error message before passing to handleError
+        // This ensures we don't lose the error details
+        let errorMessage = 'File upload failed';
+        
+        if (error instanceof Error) {
+          errorMessage = error.message || errorMessage;
+        } else if (error && typeof error === 'object') {
+          // Try to extract message from various error formats
+          if ('message' in error) {
+            errorMessage = String((error as any).message) || errorMessage;
+          } else if ('error' in error && typeof (error as any).error === 'string') {
+            errorMessage = (error as any).error;
+          } else if ('data' in error && (error as any).data?.message) {
+            errorMessage = String((error as any).data.message);
+          }
+        } else if (error) {
+          errorMessage = String(error) || errorMessage;
+        }
+        
+        // Add file context to error for better debugging
+        const contextError = error as Error & { fileContext?: Record<string, unknown> };
+        if (!contextError.fileContext) {
+          contextError.fileContext = {
+            fileName,
+            fileSize,
+            fileType,
+          };
+        }
+        
+        // If the error already has a message, preserve it
+        if (error instanceof Error && error.message) {
+          // Pass through handleError but ensure message is preserved
+          const handledError = this.handleError(contextError);
+          // If handleError stripped the message, restore it
+          if (!handledError.message || handledError.message.trim() === 'An unexpected error occurred') {
+            handledError.message = errorMessage;
+          }
+          throw handledError;
+        }
+        
+        // For non-Error objects, create a new Error with the message
+        const newError = new Error(errorMessage);
+        (newError as any).fileContext = contextError.fileContext;
+        throw this.handleError(newError);
       }
     }
 

package/src/core/mixins/OxyServices.auth.ts

@@ -1,29 +1,76 @@
 /**
  * Authentication Methods Mixin
+ * 
+ * Public key authentication using ECDSA signatures.
+ * No passwords required - authentication is done via challenge-response.
  */
 import type { User } from '../../models/interfaces';
 import type { SessionLoginResponse } from '../../models/session';
 import type { OxyServicesBase } from '../OxyServices.base';
 import { OxyAuthenticationError } from '../OxyServices.errors';
 
+export interface ChallengeResponse {
+  challenge: string;
+  expiresAt: string;
+}
+
+export interface RegistrationRequest {
+  publicKey: string;
+  username: string;
+  email?: string;
+  signature: string;
+  timestamp: number;
+}
+
+export interface ChallengeVerifyRequest {
+  publicKey: string;
+  challenge: string;
+  signature: string;
+  timestamp: number;
+  deviceName?: string;
+  deviceFingerprint?: string;
+}
+
+export interface PublicKeyCheckResponse {
+  registered: boolean;
+  message: string;
+}
+
 export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T) {
   return class extends Base {
     constructor(...args: any[]) {
       super(...(args as [any]));
     }
+
     /**
-     * Sign up a new user
+     * Register a new user with public key authentication
+     * 
+     * @param publicKey - The user's ECDSA public key (hex)
+     * @param username - Desired username
+     * @param email - Optional email address
+     * @param signature - Signature of the registration request
+     * @param timestamp - Timestamp when the signature was created
      */
-    async signUp(username: string, email: string, password: string): Promise<{ message: string; token: string; user: User }> {
+    async register(
+      publicKey: string,
+      username: string,
+      signature: string,
+      timestamp: number,
+      email?: string
+    ): Promise<{ message: string; user: User }> {
       try {
-        const res = await this.makeRequest<{ message: string; token: string; user: User }>('POST', '/api/auth/signup', {
+        const res = await this.makeRequest<{ message: string; user: User }>('POST', '/api/auth/register', {
+          publicKey,
           username,
           email,
-          password
+          signature,
+          timestamp,
         }, { cache: false });
+
         if (!res || (typeof res === 'object' && Object.keys(res).length === 0)) {
-          throw new OxyAuthenticationError('Sign up failed', 'SIGNUP_FAILED', 400);
+          throw new OxyAuthenticationError('Registration failed', 'REGISTER_FAILED', 400);
         }
+
         return res;
       } catch (error) {
         throw this.handleError(error);
@@ -31,92 +78,80 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
     }
 
     /**
-     * Request account recovery (send verification code)
+     * Request an authentication challenge
+     * The client must sign this challenge with their private key
+     * 
+     * @param publicKey - The user's public key
      */
-    async requestRecovery(identifier: string): Promise<{ delivery?: string; destination?: string }> {
+    async requestChallenge(publicKey: string): Promise<ChallengeResponse> {
       try {
-        return await this.makeRequest('POST', '/api/auth/recover/request', { identifier }, { cache: false });
-      } catch (error: any) {
-        throw this.handleError(error);
-      }
-    }
-
-    /**
-     * Verify recovery code
-     */
-    async verifyRecoveryCode(identifier: string, code: string): Promise<{ verified: boolean }> {
-      try {
-        return await this.makeRequest('POST', '/api/auth/recover/verify', { identifier, code }, { cache: false });
-      } catch (error: any) {
-        throw this.handleError(error);
-      }
-    }
-
-    /**
-     * Reset password using verified code
-     */
-    async resetPassword(identifier: string, code: string, newPassword: string): Promise<{ success: boolean }> {
-      try {
-        return await this.makeRequest('POST', '/api/auth/recover/reset', { identifier, code, newPassword }, { cache: false });
-      } catch (error: any) {
+        return await this.makeRequest<ChallengeResponse>('POST', '/api/auth/challenge', {
+          publicKey,
+        }, { cache: false });
+      } catch (error) {
         throw this.handleError(error);
       }
     }
 
     /**
-     * Reset password using TOTP code (recommended recovery)
+     * Verify a signed challenge and create a session
+     * 
+     * @param publicKey - The user's public key
+     * @param challenge - The challenge string from requestChallenge
+     * @param signature - Signature of the auth message
+     * @param timestamp - Timestamp when the signature was created
+     * @param deviceName - Optional device name
+     * @param deviceFingerprint - Optional device fingerprint
      */
-    async resetPasswordWithTotp(identifier: string, code: string, newPassword: string): Promise<{ success: boolean }> {
-      try {
-        return await this.makeRequest('POST', '/api/auth/recover/totp/reset', { identifier, code, newPassword }, { cache: false });
-      } catch (error: any) {
-        throw this.handleError(error);
-      }
-    }
-
-    async resetPasswordWithBackupCode(identifier: string, backupCode: string, newPassword: string): Promise<{ success: boolean }> {
-      try {
-        return await this.makeRequest('POST', '/api/auth/recover/backup/reset', { identifier, backupCode, newPassword }, { cache: false });
-      } catch (error: any) {
-        throw this.handleError(error);
-      }
-    }
-
-    async resetPasswordWithRecoveryKey(identifier: string, recoveryKey: string, newPassword: string): Promise<{ success: boolean; nextRecoveryKey?: string }> {
+    async verifyChallenge(
+      publicKey: string,
+      challenge: string,
+      signature: string,
+      timestamp: number,
+      deviceName?: string,
+      deviceFingerprint?: string
+    ): Promise<SessionLoginResponse> {
       try {
-        return await this.makeRequest('POST', '/api/auth/recover/recovery-key/reset', { identifier, recoveryKey, newPassword }, { cache: false });
-      } catch (error: any) {
+        return await this.makeRequest<SessionLoginResponse>('POST', '/api/auth/verify', {
+          publicKey,
+          challenge,
+          signature,
+          timestamp,
+          deviceName,
+          deviceFingerprint,
+        }, { cache: false });
+      } catch (error) {
         throw this.handleError(error);
       }
     }
 
     /**
-     * Sign in with device management
+     * Check if a public key is already registered
      */
-    async signIn(
-      username: string,
-      password: string,
-      deviceName?: string,
-      deviceFingerprint?: any
-    ): Promise<SessionLoginResponse | { mfaRequired: true; mfaToken: string; expiresAt: string }> {
+    async checkPublicKeyRegistered(publicKey: string): Promise<PublicKeyCheckResponse> {
       try {
-        return await this.makeRequest<SessionLoginResponse | { mfaRequired: true; mfaToken: string; expiresAt: string }>('POST', '/api/auth/login', {
-          username,
-          password,
-          deviceName,
-          deviceFingerprint
-        }, { cache: false });
+        return await this.makeRequest<PublicKeyCheckResponse>(
+          'GET',
+          `/api/auth/check-publickey/${encodeURIComponent(publicKey)}`,
+          undefined,
+          { cache: false }
+        );
       } catch (error) {
         throw this.handleError(error);
       }
     }
 
     /**
-     * Complete login by verifying TOTP with MFA token
+     * Get user by public key
      */
-    async verifyTotpLogin(mfaToken: string, code: string): Promise<SessionLoginResponse> {
+    async getUserByPublicKey(publicKey: string): Promise<User> {
       try {
-        return await this.makeRequest<SessionLoginResponse>('POST', '/api/auth/totp/verify-login', { mfaToken, code }, { cache: false });
+        return await this.makeRequest<User>(
+          'GET',
+          `/api/auth/user/${encodeURIComponent(publicKey)}`,
+          undefined,
+          { cache: true, cacheTTL: 2 * 60 * 1000 }
+        );
       } catch (error) {
         throw this.handleError(error);
       }
@@ -129,7 +164,7 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
       try {
         return await this.makeRequest<User>('GET', `/api/session/user/${sessionId}`, undefined, {
           cache: true,
-          cacheTTL: 2 * 60 * 1000, // 2 minutes cache for user data
+          cacheTTL: 2 * 60 * 1000,
         });
       } catch (error) {
         throw this.handleError(error);
@@ -137,8 +172,7 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
     }
 
     /**
-     * Batch get multiple user profiles by session IDs (optimized for account switching)
-     * Returns array of { sessionId, user } objects
+     * Batch get multiple user profiles by session IDs
      */
     async getUsersBySessions(sessionIds: string[]): Promise<Array<{ sessionId: string; user: User | null }>> {
       try {
@@ -146,7 +180,6 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
           return [];
         }
         
-        // Deduplicate and sort sessionIds for consistent cache keys
         const uniqueSessionIds = Array.from(new Set(sessionIds)).sort();
         
         return await this.makeRequest<Array<{ sessionId: string; user: User | null }>>(
@@ -155,8 +188,8 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
           { sessionIds: uniqueSessionIds },
           {
             cache: true,
-            cacheTTL: 2 * 60 * 1000, // 2 minutes cache
-            deduplicate: true, // Important for batch requests
+            cacheTTL: 2 * 60 * 1000,
+            deduplicate: true,
           }
         );
       } catch (error) {
@@ -165,16 +198,17 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
     }
 
     /**
-     * Get access token by session ID and set it in the token store
+     * Get access token by session ID
      */
     async getTokenBySession(sessionId: string): Promise<{ accessToken: string; expiresAt: string }> {
       try {
-        const res = await this.makeRequest<{ accessToken: string; expiresAt: string }>('GET', `/api/session/token/${sessionId}`, undefined, {
-          cache: false,
-          retry: false,
-        });
+        const res = await this.makeRequest<{ accessToken: string; expiresAt: string }>(
+          'GET',
+          `/api/session/token/${sessionId}`,
+          undefined,
+          { cache: false, retry: false }
+        );
         
-        // Set the token in the centralized token store
         this.setTokens(res.accessToken);
         
         return res;
@@ -270,6 +304,36 @@ export function OxyServicesAuthMixin<T extends typeof OxyServicesBase>(Base: T)
         throw this.handleError(error);
       }
     }
+
+    // ==========================================
+    // Deprecated methods - kept for reference
+    // ==========================================
+
+    /**
+     * @deprecated Use register() with public key authentication instead
+     */
+    async signUp(username: string, email: string, password: string): Promise<{ message: string; token: string; user: User }> {
+      throw new OxyAuthenticationError(
+        'Password-based signup is no longer supported. Use register() with public key.',
+        'DEPRECATED',
+        410
+      );
+    }
+
+    /**
+     * @deprecated Use requestChallenge() and verifyChallenge() instead
+     */
+    async signIn(
+      username: string,
+      password: string,
+      deviceName?: string,
+      deviceFingerprint?: any
+    ): Promise<SessionLoginResponse | { mfaRequired: true; mfaToken: string; expiresAt: string }> {
+      throw new OxyAuthenticationError(
+        'Password-based login is no longer supported. Use challenge-response authentication.',
+        'DEPRECATED',
+        410
+      );
+    }
   };
 }
-

package/src/crypto/index.ts

@@ -0,0 +1,21 @@
+/**
+ * Oxy Crypto Module
+ * 
+ * Provides cryptographic identity management for the Oxy ecosystem.
+ * Handles key generation, secure storage, digital signatures, and recovery phrases.
+ */
+
+export { KeyManager, type KeyPair } from './keyManager';
+export { 
+  SignatureService, 
+  type SignedMessage, 
+  type AuthChallenge 
+} from './signatureService';
+export { 
+  RecoveryPhraseService, 
+  type RecoveryPhraseResult 
+} from './recoveryPhrase';
+
+// Re-export for convenience
+export { KeyManager as default } from './keyManager';
+