@oxyhq/services 5.16.23 → 5.16.25

package/lib/typescript/utils/sessionUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionUtils.d.ts","sourceRoot":"","sources":["../../../src/utils/sessionUtils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,aAAa,CASvG;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,aAAa,GAAG,OAAO,CAEzE;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,aAAa,EAAE,CAWvE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,aAAa,EAAE,CAkB9E;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,aAAa,EAAE,EACzB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,GAC9B,aAAa,EAAE,CAiCjB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,aAAa,EAAE,EACzB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,EAC/B,mBAAmB,GAAE,OAAc,GAClC,aAAa,EAAE,CAgBjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,aAAa,EAAE,EACzB,QAAQ,EAAE,aAAa,EAAE,EACzB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,EAC/B,mBAAmB,GAAE,OAAc,GAClC,aAAa,EAAE,CAgCjB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,aAAa,EAAE,EAAE,CAAC,EAAE,aAAa,EAAE,GAAG,OAAO,CAWnF"}

package/lib/typescript/utils/validationUtils.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Validation utilities for common data validation patterns
+ */
+/**
+ * Email validation regex
+ */
+export declare const EMAIL_REGEX: RegExp;
+/**
+ * Username validation regex (alphanumeric, underscores, and hyphens, 3-30 chars)
+ */
+export declare const USERNAME_REGEX: RegExp;
+/**
+ * Password validation regex (at least 8 chars, 1 uppercase, 1 lowercase, 1 number)
+ */
+export declare const PASSWORD_REGEX: RegExp;
+/**
+ * Validate email format
+ */
+export declare function isValidEmail(email: string): boolean;
+/**
+ * Validate username format
+ */
+export declare function isValidUsername(username: string): boolean;
+/**
+ * Validate password strength
+ */
+export declare function isValidPassword(password: string): boolean;
+/**
+ * Validate required string
+ */
+export declare function isRequiredString(value: unknown): boolean;
+/**
+ * Validate required number
+ */
+export declare function isRequiredNumber(value: unknown): boolean;
+/**
+ * Validate required boolean
+ */
+export declare function isRequiredBoolean(value: unknown): boolean;
+/**
+ * Validate array
+ */
+export declare function isValidArray(value: unknown): boolean;
+/**
+ * Validate object
+ */
+export declare function isValidObject(value: unknown): boolean;
+/**
+ * Validate UUID format
+ */
+export declare function isValidUUID(uuid: string): boolean;
+/**
+ * Validate URL format
+ */
+export declare function isValidURL(url: string): boolean;
+/**
+ * Validate date string
+ */
+export declare function isValidDate(dateString: string): boolean;
+/**
+ * Validate file size (in bytes)
+ */
+export declare function isValidFileSize(size: number, maxSize: number): boolean;
+/**
+ * Validate file type
+ */
+export declare function isValidFileType(filename: string, allowedTypes: string[]): boolean;
+/**
+ * Sanitize string input
+ */
+export declare function sanitizeString(input: string): string;
+/**
+ * Sanitize HTML input
+ */
+export declare function sanitizeHTML(input: string): string;
+/**
+ * Validate MongoDB ObjectId format
+ * Note: This is a basic format check. For full validation, use mongoose.Types.ObjectId.isValid()
+ * This function works in environments where mongoose may not be available (e.g., client-side)
+ */
+export declare function isValidObjectId(id: string): boolean;
+/**
+ * Validate and sanitize user input
+ */
+export declare function validateAndSanitizeUserInput(input: unknown, type: 'string' | 'email' | 'username'): string | null;
+//# sourceMappingURL=validationUtils.d.ts.map

package/lib/typescript/utils/validationUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validationUtils.d.ts","sourceRoot":"","sources":["../../../src/utils/validationUtils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;GAEG;AACH,eAAO,MAAM,WAAW,QAA+B,CAAC;AAExD;;GAEG;AACH,eAAO,MAAM,cAAc,QAA0B,CAAC;AAEtD;;GAEG;AAEH,eAAO,MAAM,cAAc,QAAY,CAAC;AAExC;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAExD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAExD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEzD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEpD;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAErD;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGjD;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAO/C;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAGvD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAEtE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,OAAO,CAGjF;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGpD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOlD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAOnD;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,GAAG,IAAI,CAiBjH"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/services",
-  "version": "5.16.23",
+  "version": "5.16.25",
   "description": "Reusable OxyHQ module to handle authentication, user management, karma system, device-based session management and more 🚀",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",

package/src/core/mixins/OxyServices.user.ts

@@ -157,11 +157,16 @@ export function OxyServicesUserMixin<T extends typeof OxyServicesBase>(Base: T)
 
     /**
      * Get privacy settings for a user
-     * @param userId - The user ID (defaults to current user)
+     * @param userId - The user ID (MongoDB ObjectId, defaults to current user)
      */
     async getPrivacySettings(userId?: string): Promise<any> {
       try {
-        const id = userId || (await this.getCurrentUser()).id;
+        // Use getCurrentUserId() which returns MongoDB ObjectId from JWT token
+        // Never use getCurrentUser().id as it may be set to publicKey
+        const id = userId || this.getCurrentUserId();
+        if (!id) {
+          throw new Error('User ID is required');
+        }
         return await this.makeRequest<any>('GET', `/api/privacy/${id}/privacy`, undefined, {
           cache: true,
           cacheTTL: 2 * 60 * 1000, // 2 minutes cache
@@ -174,11 +179,16 @@ export function OxyServicesUserMixin<T extends typeof OxyServicesBase>(Base: T)
     /**
      * Update privacy settings
      * @param settings - Partial privacy settings object
-     * @param userId - The user ID (defaults to current user)
+     * @param userId - The user ID (MongoDB ObjectId, defaults to current user)
      */
     async updatePrivacySettings(settings: Record<string, any>, userId?: string): Promise<any> {
       try {
-        const id = userId || (await this.getCurrentUser()).id;
+        // Use getCurrentUserId() which returns MongoDB ObjectId from JWT token
+        // Never use getCurrentUser().id as it may be set to publicKey
+        const id = userId || this.getCurrentUserId();
+        if (!id) {
+          throw new Error('User ID is required');
+        }
         return await this.makeRequest<any>('PATCH', `/api/privacy/${id}/privacy`, settings, {
           cache: false,
         });

package/src/ui/context/OxyContext.tsx

@@ -194,7 +194,11 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
 
   const logger = useCallback((message: string, err?: unknown) => {
     if (__DEV__) {
-      console.warn(`[OxyContext] ${message}`, err);
+      if (err !== undefined) {
+        console.warn(`[OxyContext] ${message}`, err);
+      } else {
+        console.warn(`[OxyContext] ${message}`);
+      }
     }
   }, []);
 
@@ -401,6 +405,8 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
 
     let wasOffline = false;
     let checkTimeout: NodeJS.Timeout | null = null;
+    let lastReconnectionLog = 0;
+    const RECONNECTION_LOG_DEBOUNCE_MS = 5000; // 5 seconds
 
     // Circuit breaker and exponential backoff state
     const stateRef = {
@@ -436,35 +442,42 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
 
         // If we were offline and now we're online, sync identity if needed
         if (wasOffline) {
-          logger('Network reconnected, checking identity sync...');
-
-          // Sync identity first (if not synced)
-          try {
-            const hasIdentityValue = await hasIdentity();
-            if (hasIdentityValue) {
-              // Check sync status directly - sync if not explicitly 'true'
-              // undefined = not synced yet, 'false' = explicitly not synced, 'true' = synced
-              const syncStatus = await storage.getItem('oxy_identity_synced');
-              if (syncStatus !== 'true') {
-                await syncIdentity();
+          const now = Date.now();
+          const timeSinceLastLog = now - lastReconnectionLog;
+          
+          if (timeSinceLastLog >= RECONNECTION_LOG_DEBOUNCE_MS) {
+            logger('Network reconnected, checking identity sync...');
+            lastReconnectionLog = now;
+            
+            // Sync identity first (if not synced)
+            try {
+              const hasIdentityValue = await hasIdentity();
+              if (hasIdentityValue) {
+                // Check sync status directly - sync if not explicitly 'true'
+                // undefined = not synced yet, 'false' = explicitly not synced, 'true' = synced
+                const syncStatus = await storage.getItem('oxy_identity_synced');
+                if (syncStatus !== 'true') {
+                  await syncIdentity();
+                }
               }
-            }
-          } catch (syncError: any) {
-            // Skip sync silently if username is required (expected when offline onboarding)
-            if (syncError?.code === 'USERNAME_REQUIRED' || syncError?.message === 'USERNAME_REQUIRED') {
-              if (__DEV__) {
-                loggerUtil.debug('Sync skipped - username required', { component: 'OxyContext', method: 'checkNetworkAndSync' }, syncError as unknown);
+            } catch (syncError: any) {
+              // Skip sync silently if username is required (expected when offline onboarding)
+              if (syncError?.code === 'USERNAME_REQUIRED' || syncError?.message === 'USERNAME_REQUIRED') {
+                if (__DEV__) {
+                  loggerUtil.debug('Sync skipped - username required', { component: 'OxyContext', method: 'checkNetworkAndSync' }, syncError as unknown);
+                }
+                // Don't log or show error - username will be set later
+              } else if (!isTimeoutOrNetworkError(syncError)) {
+                // Only log unexpected errors - timeouts/network issues are expected when offline
+                logger('Error syncing identity on reconnect', syncError);
+              } else if (__DEV__) {
+                loggerUtil.debug('Identity sync timeout (expected when offline)', { component: 'OxyContext', method: 'checkNetworkAndSync' }, syncError as unknown);
               }
-              // Don't log or show error - username will be set later
-            } else if (!isTimeoutOrNetworkError(syncError)) {
-              // Only log unexpected errors - timeouts/network issues are expected when offline
-              logger('Error syncing identity on reconnect', syncError);
-            } else if (__DEV__) {
-              loggerUtil.debug('Identity sync timeout (expected when offline)', { component: 'OxyContext', method: 'checkNetworkAndSync' }, syncError as unknown);
             }
           }
-
+          
           // TanStack Query will automatically retry pending mutations
+          // Reset flag immediately after processing (whether logged or not)
           wasOffline = false;
         }
       } catch (error) {
@@ -686,15 +699,6 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
 
   const handleIdentityTransferComplete = useCallback(
     async (data: { transferId: string; sourceDeviceId: string; publicKey: string; transferCode?: string; completedAt: string }) => {
-      if (__DEV__) {
-        console.log('[OxyContext] handleIdentityTransferComplete called', {
-          transferId: data.transferId,
-          sourceDeviceId: data.sourceDeviceId,
-          currentDeviceId,
-          hasActiveSession: activeSessionId !== null,
-        });
-      }
-      
       try {
         logger('Received identity transfer complete notification', {
           transferId: data.transferId,
@@ -704,15 +708,9 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
           publicKey: data.publicKey.substring(0, 16) + '...',
         });
 
-        // Get stored transfer code for verification
         const storedTransfer = getTransferCode(data.transferId);
 
         if (!storedTransfer) {
-          if (__DEV__) {
-            console.warn('[OxyContext] Transfer code not found for transferId', {
-              transferId: data.transferId,
-            });
-          }
           logger('Transfer code not found for transferId', { 
             transferId: data.transferId,
           });
@@ -720,15 +718,6 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
           return;
         }
 
-        if (__DEV__) {
-          console.log('[OxyContext] Found stored transfer code', {
-            transferId: data.transferId,
-            storedSourceDeviceId: storedTransfer.sourceDeviceId,
-            receivedSourceDeviceId: data.sourceDeviceId,
-            currentDeviceId,
-          });
-        }
-
         // Verify publicKey matches first (most important check)
         const publicKeyMatches = data.publicKey === storedTransfer.publicKey;
         if (!publicKeyMatches) {
@@ -784,13 +773,6 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
             // Don't block - publicKey match is sufficient, code mismatch might be due to user error
             // Log warning but proceed
           }
-        } else {
-          // If transfer code is not provided, log info but proceed
-          if (__DEV__) {
-            logger('Transfer code not provided in completion notification, but publicKey matches - proceeding', { 
-              transferId: data.transferId 
-            });
-          }
         }
 
         // Check if transfer is too old (safety timeout - 10 minutes)
@@ -807,15 +789,6 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
           return;
         }
 
-        // All verifications passed - automatically delete identity
-        if (__DEV__) {
-          console.log('[OxyContext] All verifications passed, deleting identity', {
-            transferId: data.transferId,
-            sourceDeviceId: data.sourceDeviceId,
-            currentDeviceId,
-          });
-        }
-        
         logger('All transfer verifications passed, deleting identity from source device', {
           transferId: data.transferId,
           sourceDeviceId: data.sourceDeviceId,
@@ -824,12 +797,6 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
 
         try {
           await deleteIdentityAndClearAccount(false, false, true);
-          
-          if (__DEV__) {
-            console.log('[OxyContext] Identity deleted successfully');
-          }
-
-          // Clear the transfer code after successful deletion
           clearTransferCode(data.transferId);
 
           logger('Identity successfully deleted and transfer code cleared', {
@@ -838,11 +805,8 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
 
           toast.success('Identity successfully transferred and removed from this device');
         } catch (deleteError: any) {
-          if (__DEV__) {
-            console.error('[OxyContext] Error deleting identity', deleteError);
-          }
           logger('Error during identity deletion', deleteError);
-          throw deleteError; // Re-throw to be caught by outer catch
+          throw deleteError;
         }
       } catch (error: any) {
         logger('Failed to delete identity after transfer', error);
@@ -861,6 +825,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     clearSessionState,
     baseURL: oxyServices.getBaseURL(),
     getAccessToken: () => oxyServices.getAccessToken(),
+    getTransferCode: getTransferCode,
     onRemoteSignOut: handleRemoteSignOut,
     onSessionRemoved: handleSessionRemoved,
     onIdentityTransferComplete: handleIdentityTransferComplete,

package/src/ui/hooks/mutations/useAccountMutations.ts

@@ -292,12 +292,14 @@ export const useUpdateAccountSettings = () => {
  * Update privacy settings with optimistic updates and authentication handling
  */
 export const useUpdatePrivacySettings = () => {
-  const { oxyServices, activeSessionId, user, syncIdentity } = useOxy();
+  const { oxyServices, activeSessionId, syncIdentity } = useOxy();
   const queryClient = useQueryClient();
 
   return useMutation({
     mutationFn: async ({ settings, userId }: { settings: Record<string, any>; userId?: string }) => {
-      const targetUserId = userId || user?.id;
+      // Use getCurrentUserId() which returns MongoDB ObjectId from JWT token
+      // Never use user?.id as it may be set to publicKey
+      const targetUserId = userId || oxyServices.getCurrentUserId();
       if (!targetUserId) {
         throw new Error('User ID is required');
       }
@@ -353,7 +355,7 @@ export const useUpdatePrivacySettings = () => {
     },
     // Optimistic update
     onMutate: async ({ settings, userId }) => {
-      const targetUserId = userId || user?.id;
+      const targetUserId = userId || oxyServices.getCurrentUserId();
       if (!targetUserId) return;
 
       // Cancel outgoing refetches
@@ -387,7 +389,7 @@ export const useUpdatePrivacySettings = () => {
     },
     // On error, rollback
     onError: (error, { userId }, context) => {
-      const targetUserId = userId || user?.id;
+      const targetUserId = userId || oxyServices.getCurrentUserId();
       if (context?.previousPrivacySettings && targetUserId) {
         queryClient.setQueryData(queryKeys.privacy.settings(targetUserId), context.previousPrivacySettings);
       }
@@ -398,7 +400,7 @@ export const useUpdatePrivacySettings = () => {
     },
     // On success, invalidate and refetch
     onSuccess: (data, { userId }) => {
-      const targetUserId = userId || user?.id;
+      const targetUserId = userId || oxyServices.getCurrentUserId();
       if (targetUserId) {
         queryClient.setQueryData(queryKeys.privacy.settings(targetUserId), data);
       }
@@ -418,7 +420,7 @@ export const useUpdatePrivacySettings = () => {
     },
     // Always refetch after error or success
     onSettled: (data, error, { userId }) => {
-      const targetUserId = userId || user?.id;
+      const targetUserId = userId || oxyServices.getCurrentUserId();
       if (targetUserId) {
         queryClient.invalidateQueries({ queryKey: queryKeys.privacy.settings(targetUserId) });
       }

package/src/ui/hooks/queries/useAccountQueries.ts

@@ -128,8 +128,10 @@ export const useUsersBySessions = (sessionIds: string[], options?: { enabled?: b
  * Get privacy settings for a user
  */
 export const usePrivacySettings = (userId?: string, options?: { enabled?: boolean }) => {
-  const { oxyServices, activeSessionId, syncIdentity, user } = useOxy();
-  const targetUserId = userId || user?.id;
+  const { oxyServices, activeSessionId, syncIdentity } = useOxy();
+  // Use getCurrentUserId() which returns MongoDB ObjectId from JWT token
+  // Never use user?.id as it may be set to publicKey
+  const targetUserId = userId || oxyServices.getCurrentUserId() || undefined;
 
   return useQuery({
     queryKey: queryKeys.privacy.settings(targetUserId),