@oxyhq/services 6.10.7 → 6.10.8

package/src/ui/context/OxyContext.tsx

@@ -97,6 +97,77 @@ export interface OxyContextState {
 
 const OxyContext = createContext<OxyContextState | null>(null);
 
+/**
+ * Minimal, decode-only shape of the session access-token JWT claims the
+ * `POST /auth/refresh` endpoint returns. We only read `sessionId` (and `userId`
+ * as a fallback). The token is already signed and verified server-side; the
+ * client decodes the payload purely to recover the session id — it does NOT and
+ * MUST NOT verify the signature.
+ */
+interface RefreshAccessTokenClaims {
+  sessionId?: string;
+  userId?: string;
+  id?: string;
+}
+
+/**
+ * Decode the payload of a JWT WITHOUT verifying its signature.
+ *
+ * The server (`POST /auth/refresh`) has already minted and signed this access
+ * token; we only need to recover the `sessionId` claim from it on cold boot.
+ * Returns `null` for any malformed input rather than throwing, so a bad token
+ * simply falls through to the unauthenticated path.
+ *
+ * Implemented with manual base64url decoding (no `jwt-decode` dependency added
+ * to `@oxyhq/services`). Works on web (where this cold-boot path runs) via
+ * `atob`; if `atob` is unavailable (non-browser runtime) it is treated as
+ * undecodable and returns `null`.
+ */
+function decodeAccessTokenClaims(token: string): RefreshAccessTokenClaims | null {
+  if (!token || typeof token !== 'string') {
+    return null;
+  }
+  const segments = token.split('.');
+  if (segments.length !== 3) {
+    return null;
+  }
+  const payloadSegment = segments[1];
+  if (!payloadSegment) {
+    return null;
+  }
+  try {
+    const base64 = payloadSegment.replace(/-/g, '+').replace(/_/g, '/');
+    const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), '=');
+    if (typeof atob !== 'function') {
+      return null;
+    }
+    const json = decodeURIComponent(
+      atob(padded)
+        .split('')
+        .map((char) => `%${`00${char.charCodeAt(0).toString(16)}`.slice(-2)}`)
+        .join(''),
+    );
+    const parsed: unknown = JSON.parse(json);
+    if (parsed === null || typeof parsed !== 'object') {
+      return null;
+    }
+    const claims = parsed as Record<string, unknown>;
+    return {
+      sessionId: typeof claims.sessionId === 'string' ? claims.sessionId : undefined,
+      userId: typeof claims.userId === 'string' ? claims.userId : undefined,
+      id: typeof claims.id === 'string' ? claims.id : undefined,
+    };
+  } catch {
+    return null;
+  }
+}
+
+/** Server response shape of `POST /auth/refresh`. */
+interface RefreshCookieResponse {
+  accessToken?: string;
+  sessionId?: string;
+}
+
 export interface OxyContextProviderProps {
   children: ReactNode;
   oxyServices?: OxyServices;
@@ -235,16 +306,58 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
 
   const storageKeys = useMemo(() => getStorageKeys(storageKeyPrefix), [storageKeyPrefix]);
 
-  // Simple storage initialization - no complex hook needed
+  // Storage initialization.
+  //
+  // `storage` (state) drives render-time gating (`isStorageReady`) and the
+  // hooks below. But it is `null` for a brief window after mount while
+  // `createPlatformStorage()` resolves (a microtask on web; a dynamic
+  // `import()` on native). Any persistence path that fires during that window
+  // — e.g. an interactive FedCM sign-in the instant the screen mounts — would
+  // read `storage === null` and SILENTLY skip writing the session, leaving the
+  // user signed-in in-memory but with nothing to restore on reload.
+  //
+  // To make persistence robust regardless of timing we ALSO expose the storage
+  // as an awaitable promise (`getReadyStorage`). Persistence code awaits the
+  // ready instance instead of branching on the possibly-null state, so a write
+  // is never silently dropped just because it raced storage init.
   const storageRef = useRef<StorageInterface | null>(null);
   const [storage, setStorage] = useState<StorageInterface | null>(null);
 
+  // A single, stable deferred that resolves with the initialized storage. Built
+  // lazily via a ref initializer so the resolver is captured exactly once and
+  // the promise identity is stable across renders.
+  const buildStorageDeferred = () => {
+    let resolve: (storage: StorageInterface) => void = () => undefined;
+    const promise = new Promise<StorageInterface>((res) => {
+      resolve = res;
+    });
+    return { promise, resolve };
+  };
+  const storageReadyRef = useRef<ReturnType<typeof buildStorageDeferred> | null>(null);
+  if (storageReadyRef.current === null) {
+    storageReadyRef.current = buildStorageDeferred();
+  }
+  const storageReady = storageReadyRef.current;
+
+  // Resolve the storage instance that is guaranteed to be ready. Returns the
+  // already-initialized instance synchronously when available, otherwise awaits
+  // the init promise. Never resolves to `null`.
+  const getReadyStorage = useCallback((): Promise<StorageInterface> => {
+    if (storageRef.current) {
+      return Promise.resolve(storageRef.current);
+    }
+    return storageReady.promise;
+  }, [storageReady]);
+
   useEffect(() => {
     let mounted = true;
     createPlatformStorage()
       .then((storageInstance) => {
+        // Resolve the ready-promise even if the component unmounted: in-flight
+        // persistence awaiting it must still complete against a real store.
+        storageRef.current = storageInstance;
+        storageReady.resolve(storageInstance);
         if (mounted) {
-          storageRef.current = storageInstance;
           setStorage(storageInstance);
         }
       })
@@ -262,7 +375,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     return () => {
       mounted = false;
     };
-  }, [logger, onError]);
+  }, [logger, onError, storageReady]);
 
 
   // Offline queuing is now handled by TanStack Query mutations
@@ -375,6 +488,148 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
   const clearSessionStateRef = useRef(clearSessionState);
   clearSessionStateRef.current = clearSessionState;
 
+  // Durable, navigation-safe session persistence.
+  //
+  // Writes the active-session id and appends the session id to the durable
+  // `session_ids` list, awaiting the READY storage instance (never the possibly
+  // -null `storage` state) so a write is never dropped because it raced storage
+  // init. Callers MUST invoke this BEFORE any work that can trigger a route
+  // navigation (`onAuthStateChange`) — navigation can interrupt a still-pending
+  // async write, which is exactly what once left `session_ids` empty after a
+  // successful sign-in. Shared by the FedCM/popup path and the cold-boot
+  // refresh-cookie restore so both land the same durable record.
+  const persistSessionDurably = useCallback(async (sessionId: string): Promise<void> => {
+    const readyStorage = await getReadyStorage();
+    await readyStorage.setItem(storageKeys.activeSessionId, sessionId);
+    const existingIds = await readyStorage.getItem(storageKeys.sessionIds);
+    let sessionIds: string[] = [];
+    try { sessionIds = existingIds ? JSON.parse(existingIds) : []; } catch { /* corrupted storage */ }
+    if (!sessionIds.includes(sessionId)) {
+      sessionIds.push(sessionId);
+      await readyStorage.setItem(storageKeys.sessionIds, JSON.stringify(sessionIds));
+    }
+  }, [getReadyStorage, storageKeys.activeSessionId, storageKeys.sessionIds]);
+
+  // Refs so the cold-boot restore can plant session state without widening its
+  // dependency array (mirrors the existing ref pattern above).
+  const setActiveSessionIdRef = useRef(setActiveSessionId);
+  setActiveSessionIdRef.current = setActiveSessionId;
+  const loginSuccessRef = useRef(loginSuccess);
+  loginSuccessRef.current = loginSuccess;
+  const onAuthStateChangeRef = useRef(onAuthStateChange);
+  onAuthStateChangeRef.current = onAuthStateChange;
+
+  // Cold-boot session restore via the secure refresh cookie (web only).
+  //
+  // On a hard reload the in-app, bearer-protected token fetch
+  // (`getTokenBySession` → `/session/token/:id`) 401s because there is no token
+  // in memory yet, which previously cleared the session and bounced the user to
+  // sign-in. Instead we call `POST {apiBaseUrl}/auth/refresh` with
+  // `credentials: 'include'` and NO Authorization header: the browser
+  // automatically attaches the first-party httpOnly `oxy_rt` cookie (set at
+  // login/signup/fedcm-exchange), the server validates + rotates it and returns
+  // a fresh session access token. JS never sees the refresh cookie (httpOnly) —
+  // that is the security property.
+  //
+  // Returns `true` when the session was restored (caller short-circuits the
+  // bearer path); `false` on 401 / no durable cookie / any failure (caller
+  // proceeds unauthenticated through the existing flow — nothing is cleared).
+  const restoreViaRefreshCookie = useCallback(async (): Promise<boolean> => {
+    if (!isWebBrowser()) {
+      return false;
+    }
+
+    const apiBaseUrl = oxyServices.getBaseURL();
+    if (!apiBaseUrl) {
+      return false;
+    }
+
+    let response: Response;
+    try {
+      // Direct credentialed, no-auth POST. We deliberately bypass the SDK's
+      // HttpService here: it would attach the (absent) bearer and does not send
+      // cookies. The refresh cookie is scoped to `Path=/auth/refresh` and sent
+      // automatically same-site.
+      response = await fetch(`${apiBaseUrl.replace(/\/$/, '')}/auth/refresh`, {
+        method: 'POST',
+        credentials: 'include',
+        headers: { Accept: 'application/json' },
+      });
+    } catch (fetchError) {
+      // Offline / network error — fall through to the cached/stored-session flow.
+      if (__DEV__) {
+        loggerUtil.debug('Refresh-cookie restore network error (expected when offline)', { component: 'OxyContext', method: 'restoreViaRefreshCookie' }, fetchError as unknown);
+      }
+      return false;
+    }
+
+    // 401 (no/expired/reused cookie) and any non-2xx → no durable session.
+    if (!response.ok) {
+      return false;
+    }
+
+    let payload: RefreshCookieResponse;
+    try {
+      payload = (await response.json()) as RefreshCookieResponse;
+    } catch {
+      return false;
+    }
+
+    const accessToken = payload.accessToken;
+    if (!accessToken) {
+      return false;
+    }
+
+    // Recover the session id from the (server-signed) access-token claims, or
+    // from the response body if the server included it. Decode-only; the server
+    // already verified the signature.
+    const claims = decodeAccessTokenClaims(accessToken);
+    const sessionId = payload.sessionId ?? claims?.sessionId;
+    if (!sessionId) {
+      // A token with no resolvable session id cannot drive multi-session state.
+      return false;
+    }
+
+    // Plant the fresh access token. The refresh token stays in the httpOnly
+    // cookie and is never touched by JS.
+    oxyServices.httpService.setTokens(accessToken);
+
+    // Fetch the full user with the freshly planted token.
+    let fullUser: User;
+    try {
+      fullUser = await oxyServices.getCurrentUser();
+    } catch (userError) {
+      // Token planted but profile fetch failed (e.g. transient network). Do not
+      // claim a restored session; fall through so the stored-session flow can
+      // retry. Leave the planted token in place — it is valid and harmless.
+      if (__DEV__) {
+        loggerUtil.debug('Refresh-cookie restore: getCurrentUser failed', { component: 'OxyContext', method: 'restoreViaRefreshCookie' }, userError as unknown);
+      }
+      return false;
+    }
+
+    const userId = fullUser.id?.toString() ?? claims?.userId ?? '';
+    const now = new Date();
+    const clientSession: ClientSession = {
+      sessionId,
+      deviceId: '',
+      expiresAt: new Date(now.getTime() + 7 * 24 * 60 * 60 * 1000).toISOString(),
+      lastActive: now.toISOString(),
+      userId,
+      isCurrent: true,
+    };
+
+    // Restore the active session into the multi-session store (merge: keep any
+    // other sessions intact) and durably persist BEFORE notifying listeners.
+    updateSessionsRef.current([clientSession], { merge: true });
+    setActiveSessionIdRef.current(sessionId);
+    await persistSessionDurably(sessionId);
+
+    loginSuccessRef.current(fullUser);
+    onAuthStateChangeRef.current?.(fullUser);
+    return true;
+  }, [oxyServices, persistSessionDurably]);
+
   const restoreSessionsFromStorage = useCallback(async (): Promise<void> => {
     if (!storage) {
       return;
@@ -383,6 +638,15 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     setTokenReady(false);
 
     try {
+      // Web cold-boot fast path: restore the active session from the secure
+      // httpOnly refresh cookie before the bearer-protected stored-session
+      // validation (which 401s on a hard reload). On success we are signed in
+      // from the cookie alone — no FedCM needed. On failure we fall through to
+      // the existing stored-session flow below; nothing is cleared.
+      if (await restoreViaRefreshCookie()) {
+        return;
+      }
+
       const storedSessionIdsJson = await storage.getItem(storageKeys.sessionIds);
       const storedSessionIds: string[] = storedSessionIdsJson ? JSON.parse(storedSessionIdsJson) : [];
       const storedActiveSessionId = await storage.getItem(storageKeys.activeSessionId);
@@ -473,6 +737,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     storage,
     storageKeys.activeSessionId,
     storageKeys.sessionIds,
+    restoreViaRefreshCookie,
   ]);
 
   useEffect(() => {
@@ -517,8 +782,25 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     updateSessions([clientSession], { merge: true });
     setActiveSessionId(session.sessionId);
 
-    // Fetch the full user profile now that we have a valid access token.
-    // The session only carries MinimalUserData; the store and callbacks expect a full User.
+    // Persist to storage BEFORE fetching the profile and BEFORE notifying the
+    // auth-state-change callback. The token is planted and the in-memory store
+    // is updated above; durably committing the session id here — ahead of
+    // `getCurrentUser()` / `loginSuccess` / `onAuthStateChange` — is critical
+    // because `onAuthStateChange` triggers a route navigation that can
+    // interrupt/supersede a still-pending async write. Persisting first
+    // guarantees the durable record lands; that is exactly what was missing
+    // when `oxy_session_session_ids` came back empty after a successful FedCM
+    // sign-in (the user appeared logged in until reload, then had no session to
+    // restore). `persistSessionDurably` awaits the READY storage instance rather
+    // than reading the possibly-null `storage` state, so a sign-in fired the
+    // instant the screen mounts (before storage-init populates state) is not
+    // silently dropped.
+    await persistSessionDurably(session.sessionId);
+
+    // Fetch the full user profile now that we have a valid access token and the
+    // session is durably persisted. The session only carries MinimalUserData;
+    // the store and callbacks expect a full User. The navigation kicked off by
+    // `onAuthStateChange` now happens only after the durable write is committed.
     let fullUser: User;
     try {
       fullUser = await oxyServices.getCurrentUser();
@@ -529,19 +811,7 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
     }
     loginSuccess(fullUser);
     onAuthStateChange?.(fullUser);
-
-    // Persist to storage
-    if (storage) {
-      await storage.setItem(storageKeys.activeSessionId, session.sessionId);
-      const existingIds = await storage.getItem(storageKeys.sessionIds);
-      let sessionIds: string[] = [];
-      try { sessionIds = existingIds ? JSON.parse(existingIds) : []; } catch { /* corrupted storage */ }
-      if (!sessionIds.includes(session.sessionId)) {
-        sessionIds.push(session.sessionId);
-        await storage.setItem(storageKeys.sessionIds, JSON.stringify(sessionIds));
-      }
-    }
-  }, [oxyServices, updateSessions, setActiveSessionId, loginSuccess, onAuthStateChange, storage, storageKeys]);
+  }, [oxyServices, updateSessions, setActiveSessionId, loginSuccess, onAuthStateChange, persistSessionDurably]);
 
   // Enable web SSO only after local storage check completes and no user found
   const shouldTryWebSSO = isWebBrowser() && tokenReady && !user && initialized;