@oxyhq/services 5.16.37 → 5.16.38

package/lib/typescript/ui/stores/transferStore.d.ts

@@ -23,6 +23,7 @@ export interface TransferState {
     markRestored: () => void;
     cleanupExpired: () => void;
     reset: () => void;
+    clearAll: () => void;
 }
 export declare const useTransferStore: import("zustand").UseBoundStore<import("zustand").StoreApi<TransferState>>;
 /**

package/lib/typescript/ui/stores/transferStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transferStore.d.ts","sourceRoot":"","sources":["../../../../src/ui/stores/transferStore.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;CAC3C;AAED,MAAM,WAAW,aAAa;IAE5B,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAGhD,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAGhC,UAAU,EAAE,OAAO,CAAC;IAGpB,iBAAiB,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAChH,eAAe,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,gBAAgB,GAAG,IAAI,CAAC;IACjE,iBAAiB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;IAChD,mBAAmB,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,KAAK,IAAI,CAAC;IAC7F,sBAAsB,EAAE,MAAM,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,gBAAgB,CAAA;KAAE,CAAC,CAAC;IACpF,mBAAmB,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACzC,mBAAmB,EAAE,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACzD,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAAE,gBAAgB,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACvG,YAAY,EAAE,MAAM,IAAI,CAAC;IACzB,cAAc,EAAE,MAAM,IAAI,CAAC;IAC3B,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB;AAUD,eAAO,MAAM,gBAAgB,4EAyI1B,CAAC;AAEJ;;GAEG;AACH,eAAO,MAAM,8BAA8B;;;CAO1C,CAAC"}
+{"version":3,"file":"transferStore.d.ts","sourceRoot":"","sources":["../../../../src/ui/stores/transferStore.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;CAC3C;AAED,MAAM,WAAW,aAAa;IAE5B,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAGhD,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAGhC,UAAU,EAAE,OAAO,CAAC;IAGpB,iBAAiB,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAChH,eAAe,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,gBAAgB,GAAG,IAAI,CAAC;IACjE,iBAAiB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,CAAC;IAChD,mBAAmB,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,KAAK,IAAI,CAAC;IAC7F,sBAAsB,EAAE,MAAM,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,gBAAgB,CAAA;KAAE,CAAC,CAAC;IACpF,mBAAmB,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IACzC,mBAAmB,EAAE,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACzD,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAAE,gBAAgB,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACvG,YAAY,EAAE,MAAM,IAAI,CAAC;IACzB,cAAc,EAAE,MAAM,IAAI,CAAC;IAC3B,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,QAAQ,EAAE,MAAM,IAAI,CAAC;CACtB;AAUD,eAAO,MAAM,gBAAgB,4EA8I1B,CAAC;AAEJ;;GAEG;AACH,eAAO,MAAM,8BAA8B;;;CAO1C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/services",
-  "version": "5.16.37",
+  "version": "5.16.38",
   "description": "Reusable OxyHQ module to handle authentication, user management, karma system, device-based session management and more 🚀",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",

package/src/ui/context/OxyContext.tsx

@@ -4,6 +4,7 @@ import {
   useCallback,
   useContext,
   useEffect,
+  useLayoutEffect,
   useMemo,
   useRef,
   useState,
@@ -211,6 +212,15 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
 
   const { storage, isReady: isStorageReady } = useStorage({ onError, logger });
 
+  // Invalidate KeyManager cache on mount to prevent stale cache issues
+  // useLayoutEffect runs synchronously after render but before paint, ensuring cache
+  // invalidation happens before any async operations start
+  useLayoutEffect(() => {
+    if (Platform.OS !== 'web') {
+      KeyManager.invalidateCache();
+    }
+  }, []);
+
   // Identity integrity check and auto-restore on startup
   // Skip on web platform - identity storage is only available on native platforms
   useEffect(() => {
@@ -219,9 +229,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
 
     const checkAndRestoreIdentity = async () => {
       try {
-        // CRITICAL: Invalidate cache on app startup to ensure fresh state check
-        // This prevents stale cache from previous session from showing incorrect state
-        KeyManager.invalidateCache();
+        // Cache was already invalidated synchronously above
         
         // Check if identity exists and verify integrity
         const hasIdentity = await KeyManager.hasIdentity();
@@ -352,9 +360,17 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     [importIdentityBase]
   );
 
+  // Storage keys for transfer codes
+  const TRANSFER_CODES_STORAGE_KEY = `${storageKeyPrefix}_transfer_codes`;
+  const ACTIVE_TRANSFER_STORAGE_KEY = `${storageKeyPrefix}_active_transfer_id`;
+
   // Clear all account data when identity is lost (for accounts app)
   // In accounts app, identity = account, so losing identity means losing everything
   const clearAllAccountData = useCallback(async (): Promise<void> => {
+    if (__DEV__) {
+      logger('Clearing all account data - identity changed or lost');
+    }
+
     // Clear TanStack Query cache (in-memory)
     queryClient.clear();
 
@@ -386,9 +402,30 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     // Reset account store
     useAccountStore.getState().reset();
 
+    // CRITICAL: Clear ALL transfer codes and active transfer state
+    // This prevents transfer state from previous identity from lingering
+    if (storage) {
+      try {
+        await storage.removeItem(TRANSFER_CODES_STORAGE_KEY);
+        await storage.removeItem(ACTIVE_TRANSFER_STORAGE_KEY);
+        
+        // Also clear Zustand transfer store
+        useTransferStore.getState().clearAll();
+        
+        if (__DEV__) {
+          logger('Cleared all transfer state');
+        }
+      } catch (error) {
+        logger('Failed to clear transfer state', error);
+      }
+    }
+
     // Clear HTTP service cache
     oxyServices.clearCache();
-  }, [queryClient, storage, clearSessionState, logger, oxyServices]);
+    
+    // Force KeyManager cache invalidation
+    KeyManager.invalidateCache();
+  }, [queryClient, storage, clearSessionState, logger, oxyServices, TRANSFER_CODES_STORAGE_KEY, ACTIVE_TRANSFER_STORAGE_KEY]);
 
   // Extract Zustand store functions early (before they're used in callbacks)
   const getAllPendingTransfersStore = useTransferStore((state) => state.getAllPendingTransfers);
@@ -582,6 +619,8 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     try {
       // CRITICAL: Get current identity's public key first
       // Only restore sessions that belong to this identity
+      // Force cache invalidation to ensure we get the actual current identity
+      KeyManager.invalidateCache();
       const currentPublicKey = await KeyManager.getPublicKey().catch(() => null);
       
       const storedSessionIdsJson = await storage.getItem(storageKeys.sessionIds);
@@ -591,13 +630,21 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
       // If no identity exists, clear all sessions and return
       if (!currentPublicKey) {
         if (storedSessionIds.length > 0 || storedActiveSessionId) {
+          if (__DEV__) {
+            logger('No identity found - clearing all stored sessions to prevent cross-identity data leak');
+          }
           await clearSessionState();
         }
         setTokenReady(true);
         return;
       }
 
+      if (__DEV__) {
+        logger('Restoring sessions for identity', { publicKey: currentPublicKey.substring(0, 16) + '...', sessionCount: storedSessionIds.length });
+      }
+
       const validSessions: ClientSession[] = [];
+      const invalidSessionIds: string[] = []; // Track invalid sessions for batch removal
 
       if (storedSessionIds.length > 0) {
         for (const sessionId of storedSessionIds) {
@@ -605,14 +652,18 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
             const validation = await oxyServices.validateSession(sessionId, { useHeaderValidation: true });
             if (validation?.valid && validation.user) {
               // CRITICAL: Verify session belongs to current identity
-              // IMPORTANT: In OxyAccounts, user.id is set to the publicKey (as confirmed by line 754 comment below)
-              // This is different from the JWT's userId field which contains MongoDB ObjectId
-              // We compare user.id (publicKey) to currentPublicKey to ensure session ownership
-              if (validation.user.id !== currentPublicKey) {
-                // Session belongs to different identity - skip it
+              // Compare session's publicKey to current identity's publicKey
+              if (validation.user.publicKey !== currentPublicKey) {
+                // Session belongs to different identity - skip it and log warning
                 if (__DEV__) {
-                  logger('Skipping session from different identity during restoration');
+                  logger('CRITICAL: Skipping session from different identity during restoration', {
+                    sessionPublicKey: validation.user.publicKey?.substring(0, 16) + '...',
+                    currentPublicKey: currentPublicKey.substring(0, 16) + '...',
+                    sessionId: sessionId.substring(0, 16) + '...',
+                  });
                 }
+                // Mark for batch removal
+                invalidSessionIds.push(sessionId);
                 continue;
               }
               
@@ -638,6 +689,24 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
           }
         }
 
+        // Batch remove invalid sessions from storage (performance optimization)
+        if (invalidSessionIds.length > 0) {
+          try {
+            // Use Set for O(n) lookup instead of O(n²) with includes()
+            const invalidSessionSet = new Set(invalidSessionIds);
+            const updatedIds = storedSessionIds.filter(id => !invalidSessionSet.has(id));
+            await storage.setItem(storageKeys.sessionIds, JSON.stringify(updatedIds));
+            if (__DEV__) {
+              logger('Removed invalid sessions from storage', { count: invalidSessionIds.length });
+            }
+          } catch (cleanupError) {
+            // Ignore cleanup errors - will be cleaned on next restart
+            if (__DEV__) {
+              logger('Failed to remove invalid sessions from storage', cleanupError);
+            }
+          }
+        }
+
         if (validSessions.length > 0) {
           updateSessions(validSessions, { merge: false });
         }
@@ -752,13 +821,11 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
   }, [isAuthenticatedFromStore, isAuthenticatedFromSessions]);
 
   // Get userId from JWT token (MongoDB ObjectId) for socket room matching
-  // user.id is set to publicKey for compatibility, but socket rooms use MongoDB ObjectId
-  // The JWT token's userId field contains the MongoDB ObjectId
+  // user.id contains the MongoDB ObjectId, user.publicKey contains the cryptographic public key
   const userId = oxyServices.getCurrentUserId() || user?.id;
 
   // Use Zustand store for transfer state management
-  const TRANSFER_CODES_STORAGE_KEY = `${storageKeyPrefix}_transfer_codes`;
-  const ACTIVE_TRANSFER_STORAGE_KEY = `${storageKeyPrefix}_active_transfer_id`;
+  // Storage keys are defined above (TRANSFER_CODES_STORAGE_KEY, ACTIVE_TRANSFER_STORAGE_KEY)
   const isRestored = useTransferStore((state) => state.isRestored);
   const restoreFromStorage = useTransferStore((state) => state.restoreFromStorage);
   const markRestored = useTransferStore((state) => state.markRestored);

package/src/ui/context/hooks/useAuthOperations.ts

@@ -91,13 +91,28 @@ export const useAuthOperations = ({
   const clearSessionsIfIdentityChanged = useCallback(
     async (oldPublicKey: string | null, newPublicKey: string): Promise<void> => {
       if (oldPublicKey && oldPublicKey !== newPublicKey) {
+        if (__DEV__ && logger) {
+          logger('CRITICAL: Identity changed - clearing all session data', {
+            oldPublicKey: oldPublicKey.substring(0, 16) + '...',
+            newPublicKey: newPublicKey.substring(0, 16) + '...',
+          });
+        }
+        
         // Clear all session state to prevent old identity's data from showing up
         await clearSessionState();
-        // Logout from auth store
+        
+        // Logout from auth store (clears user, isAuthenticated, etc.)
         logoutStore();
+        
+        // Force KeyManager cache invalidation
+        KeyManager.invalidateCache();
+        
+        if (__DEV__ && logger) {
+          logger('Session state cleared for new identity');
+        }
       }
     },
-    [clearSessionState, logoutStore]
+    [clearSessionState, logoutStore, logger]
   );
   
   /**
@@ -311,10 +326,18 @@ export const useAuthOperations = ({
         // CRITICAL: Get old public key before creating new identity
         // If identity changes, we must clear all session data to prevent data leakage
         const oldPublicKey = await KeyManager.getPublicKey().catch(() => null);
+        
+        if (__DEV__ && logger) {
+          logger('Creating new identity', { hadPreviousIdentity: !!oldPublicKey });
+        }
 
         // Generate new key pair directly (works offline)
         const { publicKey, privateKey } = await KeyManager.generateKeyPair();
         await KeyManager.importKeyPair(privateKey);
+        
+        if (__DEV__ && logger) {
+          logger('Identity keys generated', { publicKey: publicKey.substring(0, 16) + '...' });
+        }
 
         // Clear sessions if identity changed (prevents data leakage)
         await clearSessionsIfIdentityChanged(oldPublicKey, publicKey);
@@ -331,14 +354,18 @@ export const useAuthOperations = ({
           // Mark as synced (Zustand store + storage)
           await storage.setItem('oxy_identity_synced', 'true');
           setIdentitySynced(true);
+          
+          if (__DEV__ && logger) {
+            logger('Identity synced with server successfully');
+          }
 
           return {
             synced: true,
           };
         } catch (syncError) {
           // Offline or server error - identity is created locally but not synced
-          if (__DEV__) {
-            console.log('[Auth] Identity created locally, will sync when online:', syncError);
+          if (__DEV__ && logger) {
+            logger('Identity created locally (offline), will sync when online', syncError);
           }
           
           return {
@@ -489,6 +516,13 @@ export const useAuthOperations = ({
         // CRITICAL: Get old public key before importing new identity
         // If identity changes, we must clear all session data to prevent data leakage
         const oldPublicKey = await KeyManager.getPublicKey().catch(() => null);
+        
+        if (__DEV__ && logger) {
+          logger('Importing identity from backup', { 
+            hadPreviousIdentity: !!oldPublicKey,
+            backupPublicKey: backupData.publicKey.substring(0, 16) + '...'
+          });
+        }
 
         // Decrypt private key from backup data
         const Crypto = await import('expo-crypto');
@@ -525,6 +559,10 @@ export const useAuthOperations = ({
 
         // Import the key pair
         const publicKey = await KeyManager.importKeyPair(privateKey);
+        
+        if (__DEV__ && logger) {
+          logger('Identity keys imported', { publicKey: publicKey.substring(0, 16) + '...' });
+        }
 
         // Verify public key matches
         if (publicKey !== backupData.publicKey) {

package/src/ui/stores/transferStore.ts

@@ -31,6 +31,7 @@ export interface TransferState {
   markRestored: () => void;
   cleanupExpired: () => void;
   reset: () => void;
+  clearAll: () => void; // Alias for reset - use when clearing on identity change for semantic clarity
 }
 
 const FIFTEEN_MINUTES = 15 * 60 * 1000;
@@ -178,6 +179,11 @@ export const useTransferStore = create<TransferState>((set, get) => ({
   reset: () => {
     set(initialState);
   },
+  
+  clearAll: () => {
+    // Delegate to reset to maintain single source of truth
+    get().reset();
+  },
 }));
 
 /**