@oxyhq/services 5.16.38 → 5.16.40

package/src/ui/context/hooks/useAuthOperations.ts

@@ -34,7 +34,7 @@ export interface UseAuthOperationsOptions {
 
 export interface UseAuthOperationsResult {
   /** Create a new identity locally (offline-first) and optionally sync with server */
-  createIdentity: () => Promise<{ synced: boolean }>;
+  createIdentity: (username?: string) => Promise<{ synced: boolean }>;
   /** Import an existing identity from backup file data */
   importIdentity: (backupData: BackupData, password: string) => Promise<{ synced: boolean }>;
   /** Sign in with existing identity on device */
@@ -50,7 +50,7 @@ export interface UseAuthOperationsResult {
   /** Check if identity is synced with server */
   isIdentitySynced: () => Promise<boolean>;
   /** Sync local identity with server (when online) */
-  syncIdentity: () => Promise<User>;
+  syncIdentity: (username?: string) => Promise<User>;
 }
 
 const LOGIN_ERROR_CODE = 'LOGIN_ERROR';
@@ -313,18 +313,27 @@ export const useAuthOperations = ({
   );
 
   /**
-   * Create a new identity (offline-first)
-   * Identity is purely cryptographic - no username or email required
+   * Create a new identity (offline-first).
+   * 
+   * Generates cryptographic keys locally without requiring server connection.
+   * Identity is based on the public/private key pair - no username or email required.
+   * 
+   * IMPORTANT: This function only clears session data if the identity actually changes
+   * (i.e., a new key pair is generated). Retrying registration with the same identity
+   * will NOT clear session data.
+   * 
+   * @param username - Optional username to set during registration (if online)
+   * @returns Object with synced status indicating if identity was registered with server
    */
   const createIdentity = useCallback(
-    async (): Promise<{ synced: boolean }> => {
+    async (username?: string): Promise<{ synced: boolean }> => {
       if (!storage) throw new Error('Storage not initialized');
 
       setAuthState({ isLoading: true, error: null });
 
       try {
-        // CRITICAL: Get old public key before creating new identity
-        // If identity changes, we must clear all session data to prevent data leakage
+        // Get old public key before creating new identity
+        // This is used to detect if identity actually changed
         const oldPublicKey = await KeyManager.getPublicKey().catch(() => null);
         
         if (__DEV__ && logger) {
@@ -339,39 +348,56 @@ export const useAuthOperations = ({
           logger('Identity keys generated', { publicKey: publicKey.substring(0, 16) + '...' });
         }
 
-        // Clear sessions if identity changed (prevents data leakage)
+        // Only clear sessions if identity actually changed
+        // This prevents clearing sessions on registration retries
         await clearSessionsIfIdentityChanged(oldPublicKey, publicKey);
 
-        // Mark as not synced
+        // Mark as not synced initially
         await storage.setItem('oxy_identity_synced', 'false');
         setIdentitySynced(false);
 
-        // Try to sync with server (will succeed if online)
-        try {
-          const { signature, timestamp } = await SignatureService.createRegistrationSignature();
-          await oxyServices.register(publicKey, signature, timestamp);
-          
-          // Mark as synced (Zustand store + storage)
-          await storage.setItem('oxy_identity_synced', 'true');
-          setIdentitySynced(true);
-          
-          if (__DEV__ && logger) {
-            logger('Identity synced with server successfully');
+        // If username provided, try to register immediately (online only)
+        if (username) {
+          // Validate username format before attempting registration
+          const trimmedUsername = username.trim();
+          if (trimmedUsername && /^[a-zA-Z0-9]{3,30}$/.test(trimmedUsername)) {
+            try {
+              const { signature, timestamp } = await SignatureService.createRegistrationSignature();
+              await oxyServices.register(publicKey, signature, timestamp, trimmedUsername);
+              
+              // Mark as synced (Zustand store + storage)
+              await storage.setItem('oxy_identity_synced', 'true');
+              setIdentitySynced(true);
+              
+              if (__DEV__ && logger) {
+                logger('Identity synced with server successfully with username');
+              }
+
+              return { synced: true };
+            } catch (syncError) {
+              // Offline or server error - identity created locally but not synced
+              if (__DEV__ && logger) {
+                logger('Identity created locally with username (offline), will sync when online', syncError);
+              }
+              
+              return { synced: false };
+            }
+          } else {
+            // Invalid username format - log the issue
+            if (__DEV__ && logger) {
+              logger('Invalid username format, identity created without username', {
+                providedUsername: username.substring(0, 20),
+              });
+            }
           }
+        }
 
-          return {
-            synced: true,
-          };
-        } catch (syncError) {
-          // Offline or server error - identity is created locally but not synced
-          if (__DEV__ && logger) {
-            logger('Identity created locally (offline), will sync when online', syncError);
-          }
-          
-          return {
-            synced: false,
-          };
+        // No username provided or invalid format - defer registration until later
+        if (__DEV__ && logger) {
+          logger('Identity created locally without username, will register during sync');
         }
+
+        return { synced: false };
       } catch (error) {
         // CRITICAL: Never delete identity on error - it may have been successfully created
         // Only log the error and let the user recover using their backup file
@@ -387,7 +413,7 @@ export const useAuthOperations = ({
           await storage.setItem('oxy_identity_synced', 'false').catch(() => {});
           setIdentitySynced(false);
           if (__DEV__ && logger) {
-            logger('Identity was created but sync failed - user can sync later using backup file');
+            logger('Identity was created but sync failed - user can sync later');
           }
         } else {
           // No identity exists - this was a generation failure, safe to clean up sync flag
@@ -423,11 +449,19 @@ export const useAuthOperations = ({
   }, [storage, setIdentitySynced]);
 
   /**
-   * Sync local identity with server (call when online)
-   * TanStack Query handles offline mutations automatically
+   * Sync local identity with server.
+   * 
+   * Registers the identity with the server if not already registered.
+   * This function is idempotent - calling it multiple times is safe.
+   * 
+   * TanStack Query handles offline mutations automatically, so this will
+   * retry automatically when connection is restored.
+   * 
+   * @param username - Optional username to set during sync/registration
+   * @returns User object after successful sync and sign-in
    */
   const syncIdentity = useCallback(
-    async (): Promise<User> => {
+    async (username?: string): Promise<User> => {
       if (!storage) throw new Error('Storage not initialized');
 
       setAuthState({ isLoading: true, error: null });
@@ -443,6 +477,7 @@ export const useAuthOperations = ({
         const alreadySynced = await storage.getItem('oxy_identity_synced');
         if (alreadySynced === 'true') {
           setIdentitySynced(true);
+          // Identity is already synced, just sign in
           return await performSignIn(publicKey);
         }
 
@@ -452,7 +487,7 @@ export const useAuthOperations = ({
         if (!registered) {
           // Register with server (identity is just the publicKey)
           const { signature, timestamp } = await SignatureService.createRegistrationSignature();
-          await oxyServices.register(publicKey, signature, timestamp);
+          await oxyServices.register(publicKey, signature, timestamp, username);
         }
 
         // Mark as synced (Zustand store + storage)
@@ -462,13 +497,6 @@ export const useAuthOperations = ({
         // Sign in
         const user = await performSignIn(publicKey);
 
-        // Check if user has username - required for syncing
-        if (!user.username) {
-          const usernameError = new Error('USERNAME_REQUIRED');
-          (usernameError as any).code = 'USERNAME_REQUIRED';
-          throw usernameError;
-        }
-
         // TanStack Query will automatically retry any pending mutations
 
         return user;
@@ -491,10 +519,22 @@ export const useAuthOperations = ({
   );
 
   /**
-   * Import identity from backup file data (offline-first)
+   * Import identity from encrypted backup file.
+   * 
+   * Restores a previously created identity from an encrypted backup.
+   * The backup is decrypted using the provided password.
+   * 
+   * IMPORTANT: This function clears session data only if importing a different
+   * identity than the one currently stored. Re-importing the same identity
+   * will NOT clear session data.
+   * 
+   * @param backupData - The encrypted backup data object
+   * @param password - Password to decrypt the backup
+   * @param username - Optional username to set during registration if not yet registered
+   * @returns Object with synced status indicating if identity was registered with server
    */
   const importIdentity = useCallback(
-    async (backupData: BackupData, password: string): Promise<{ synced: boolean }> => {
+    async (backupData: BackupData, password: string, username?: string): Promise<{ synced: boolean }> => {
       if (!storage) throw new Error('Storage not initialized');
 
       // Validate arguments - ensure backupData is an object, not a string (old signature)
@@ -513,8 +553,8 @@ export const useAuthOperations = ({
       setAuthState({ isLoading: true, error: null });
 
       try {
-        // CRITICAL: Get old public key before importing new identity
-        // If identity changes, we must clear all session data to prevent data leakage
+        // Get old public key before importing identity
+        // This is used to detect if identity actually changed
         const oldPublicKey = await KeyManager.getPublicKey().catch(() => null);
         
         if (__DEV__ && logger) {
@@ -569,10 +609,11 @@ export const useAuthOperations = ({
           throw new Error('Backup file is corrupted or password is incorrect');
         }
 
-        // Clear sessions if identity changed (prevents data leakage)
+        // Only clear sessions if identity actually changed
+        // This prevents clearing sessions when re-importing the same identity
         await clearSessionsIfIdentityChanged(oldPublicKey, publicKey);
 
-        // Mark as not synced
+        // Mark as not synced initially (will check server status below)
         await storage.setItem('oxy_identity_synced', 'false');
         setIdentitySynced(false);
 
@@ -582,21 +623,21 @@ export const useAuthOperations = ({
           const { registered } = await oxyServices.checkPublicKeyRegistered(publicKey);
 
           if (registered) {
-            // Identity exists, mark as synced
+            // Identity exists on server, mark as synced
             await storage.setItem('oxy_identity_synced', 'true');
             setIdentitySynced(true);
             return { synced: true };
           } else {
-            // Need to register this identity (identity is just the publicKey)
+            // Need to register this identity
             const { signature, timestamp } = await SignatureService.createRegistrationSignature();
-            await oxyServices.register(publicKey, signature, timestamp);
+            await oxyServices.register(publicKey, signature, timestamp, username);
             
             await storage.setItem('oxy_identity_synced', 'true');
             setIdentitySynced(true);
             return { synced: true };
           }
         } catch (syncError) {
-          // Offline - identity restored locally but not synced
+          // Offline or server error - identity restored locally but not synced
           if (__DEV__) {
             console.log('[Auth] Identity imported locally, will sync when online:', syncError);
           }