@oxyhq/services 5.16.23 → 5.16.24

package/lib/typescript/utils/sessionUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionUtils.d.ts","sourceRoot":"","sources":["../../../src/utils/sessionUtils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,aAAa,CASvG;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,aAAa,GAAG,OAAO,CAEzE;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,aAAa,EAAE,CAWvE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,aAAa,EAAE,CAkB9E;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,aAAa,EAAE,EACzB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,GAC9B,aAAa,EAAE,CAiCjB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,aAAa,EAAE,EACzB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,EAC/B,mBAAmB,GAAE,OAAc,GAClC,aAAa,EAAE,CAgBjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,aAAa,EAAE,EACzB,QAAQ,EAAE,aAAa,EAAE,EACzB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,EAC/B,mBAAmB,GAAE,OAAc,GAClC,aAAa,EAAE,CAgCjB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,aAAa,EAAE,EAAE,CAAC,EAAE,aAAa,EAAE,GAAG,OAAO,CAWnF"}

package/lib/typescript/utils/validationUtils.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Validation utilities for common data validation patterns
+ */
+/**
+ * Email validation regex
+ */
+export declare const EMAIL_REGEX: RegExp;
+/**
+ * Username validation regex (alphanumeric, underscores, and hyphens, 3-30 chars)
+ */
+export declare const USERNAME_REGEX: RegExp;
+/**
+ * Password validation regex (at least 8 chars, 1 uppercase, 1 lowercase, 1 number)
+ */
+export declare const PASSWORD_REGEX: RegExp;
+/**
+ * Validate email format
+ */
+export declare function isValidEmail(email: string): boolean;
+/**
+ * Validate username format
+ */
+export declare function isValidUsername(username: string): boolean;
+/**
+ * Validate password strength
+ */
+export declare function isValidPassword(password: string): boolean;
+/**
+ * Validate required string
+ */
+export declare function isRequiredString(value: unknown): boolean;
+/**
+ * Validate required number
+ */
+export declare function isRequiredNumber(value: unknown): boolean;
+/**
+ * Validate required boolean
+ */
+export declare function isRequiredBoolean(value: unknown): boolean;
+/**
+ * Validate array
+ */
+export declare function isValidArray(value: unknown): boolean;
+/**
+ * Validate object
+ */
+export declare function isValidObject(value: unknown): boolean;
+/**
+ * Validate UUID format
+ */
+export declare function isValidUUID(uuid: string): boolean;
+/**
+ * Validate URL format
+ */
+export declare function isValidURL(url: string): boolean;
+/**
+ * Validate date string
+ */
+export declare function isValidDate(dateString: string): boolean;
+/**
+ * Validate file size (in bytes)
+ */
+export declare function isValidFileSize(size: number, maxSize: number): boolean;
+/**
+ * Validate file type
+ */
+export declare function isValidFileType(filename: string, allowedTypes: string[]): boolean;
+/**
+ * Sanitize string input
+ */
+export declare function sanitizeString(input: string): string;
+/**
+ * Sanitize HTML input
+ */
+export declare function sanitizeHTML(input: string): string;
+/**
+ * Validate MongoDB ObjectId format
+ * Note: This is a basic format check. For full validation, use mongoose.Types.ObjectId.isValid()
+ * This function works in environments where mongoose may not be available (e.g., client-side)
+ */
+export declare function isValidObjectId(id: string): boolean;
+/**
+ * Validate and sanitize user input
+ */
+export declare function validateAndSanitizeUserInput(input: unknown, type: 'string' | 'email' | 'username'): string | null;
+//# sourceMappingURL=validationUtils.d.ts.map

package/lib/typescript/utils/validationUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validationUtils.d.ts","sourceRoot":"","sources":["../../../src/utils/validationUtils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;GAEG;AACH,eAAO,MAAM,WAAW,QAA+B,CAAC;AAExD;;GAEG;AACH,eAAO,MAAM,cAAc,QAA0B,CAAC;AAEtD;;GAEG;AAEH,eAAO,MAAM,cAAc,QAAY,CAAC;AAExC;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAExD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAExD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEzD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEpD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAErD;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGjD;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAO/C;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAGvD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAEtE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,OAAO,CAGjF;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGpD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOlD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAOnD;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,GAAG,IAAI,CAiBjH"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/services",
-  "version": "5.16.23",
+  "version": "5.16.24",
   "description": "Reusable OxyHQ module to handle authentication, user management, karma system, device-based session management and more 🚀",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",

package/src/ui/context/OxyContext.tsx

@@ -861,6 +861,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     clearSessionState,
     baseURL: oxyServices.getBaseURL(),
     getAccessToken: () => oxyServices.getAccessToken(),
+    getTransferCode: getTransferCode,
     onRemoteSignOut: handleRemoteSignOut,
     onSessionRemoved: handleSessionRemoved,
     onIdentityTransferComplete: handleIdentityTransferComplete,

package/src/ui/hooks/useSessionSocket.ts

@@ -12,12 +12,13 @@ interface UseSessionSocketProps {
   clearSessionState: () => Promise<void>;
   baseURL: string;
   getAccessToken: () => string | null;
+  getTransferCode?: (transferId: string) => { code: string; sourceDeviceId: string | null; publicKey: string; timestamp: number } | null;
   onRemoteSignOut?: () => void;
   onSessionRemoved?: (sessionId: string) => void;
   onIdentityTransferComplete?: (data: { transferId: string; sourceDeviceId: string; publicKey: string; transferCode?: string; completedAt: string }) => void;
 }
 
-export function useSessionSocket({ userId, activeSessionId, currentDeviceId, refreshSessions, logout, clearSessionState, baseURL, getAccessToken, onRemoteSignOut, onSessionRemoved, onIdentityTransferComplete }: UseSessionSocketProps) {
+export function useSessionSocket({ userId, activeSessionId, currentDeviceId, refreshSessions, logout, clearSessionState, baseURL, getAccessToken, getTransferCode, onRemoteSignOut, onSessionRemoved, onIdentityTransferComplete }: UseSessionSocketProps) {
   const socketRef = useRef<any>(null);
   const joinedRoomRef = useRef<string | null>(null);
   const accessTokenRef = useRef<string | null>(null);
@@ -292,15 +293,19 @@ export function useSessionSocket({ userId, activeSessionId, currentDeviceId, ref
           publicKey: transferData.publicKey.substring(0, 16) + '...',
         });
         
-        // Very lenient matching: if we have a transferId, always call the handler
-        // The handler has access to stored transfer codes and will verify everything
-        // This ensures we don't miss valid transfers - handler will reject if not valid
+        // Only call handler on the SOURCE device (the one that initiated the transfer)
+        // The source device is identified by:
+        // 1. Matching deviceId with sourceDeviceId, OR
+        // 2. Having a stored transfer code for this transferId (most reliable check)
         const deviceIdMatches = transferData.sourceDeviceId && transferData.sourceDeviceId === currentDeviceId;
         
-        // Always call handler if we have a transferId - handler will verify using stored codes
-        // This is safe because handler will verify publicKey, transferCode, deviceId, and timestamp
-        // If verification fails, handler will just return early without deleting
-        const shouldCallHandler = !!transferData.transferId;
+        // Check if this device has a stored transfer code (meaning it's the source device)
+        const hasStoredTransferCode = getTransferCode && !!getTransferCode(transferData.transferId);
+        
+        // Only call handler if this is the source device
+        // We check both deviceId match AND stored transfer code to handle cases where
+        // deviceId might be null (logged out device) but transfer code still exists
+        const shouldCallHandler = !!transferData.transferId && (deviceIdMatches || hasStoredTransferCode);
         
         if (shouldCallHandler) {
           const matchReason = deviceIdMatches