@oxyhq/services 6.10.8 → 7.0.0

package/src/ui/components/accountMenuRows.ts

@@ -0,0 +1,60 @@
+import type { User, ClientSession } from '@oxyhq/core';
+import { getAccountDisplayName, getAccountFallbackHandle } from '@oxyhq/core';
+
+export interface AccountRow {
+    sessionId: string;
+    isActive: boolean;
+    displayName: string;
+    secondary: string | null;
+    avatarUri?: string;
+    user: User | null;
+}
+
+export interface BuildAccountRowsInput {
+    sessions: ClientSession[] | null | undefined;
+    activeSessionId: string | null | undefined;
+    user: User | null | undefined;
+    locale: string;
+    getAvatarUrl: (avatarId: string) => string;
+}
+
+/**
+ * Pure builder for `AccountMenu` rows. Extracted so the multi-account display
+ * logic can be unit-tested without rendering React Native.
+ *
+ * Each `sessions[i]` becomes one row. Only the row matching `activeSessionId`
+ * carries the loaded `user` payload — the others are placeholders shown by
+ * fallback handle. This mirrors how `OxyContext` only hydrates one user at a
+ * time.
+ */
+export function buildAccountRows({
+    sessions,
+    activeSessionId,
+    user,
+    locale,
+    getAvatarUrl,
+}: BuildAccountRowsInput): AccountRow[] {
+    return (sessions ?? []).map((session: ClientSession) => {
+        const isActive = session.sessionId === activeSessionId;
+        const candidate: Partial<User> | null = isActive ? user ?? null : null;
+        const displayName = getAccountDisplayName(
+            candidate ?? { username: undefined },
+            locale,
+        );
+        const handle = getAccountFallbackHandle(candidate ?? { username: undefined });
+        const secondary = (candidate?.email)
+            ?? (handle && candidate?.username ? `@${handle}` : handle)
+            ?? null;
+        const avatarUri = candidate?.avatar
+            ? getAvatarUrl(candidate.avatar)
+            : undefined;
+        return {
+            sessionId: session.sessionId,
+            isActive,
+            displayName,
+            secondary,
+            avatarUri,
+            user: isActive ? user ?? null : null,
+        };
+    });
+}

package/src/ui/components/payment/PaymentDetailsStep.tsx

@@ -4,7 +4,7 @@ import { View, Text, Animated, TouchableOpacity, Clipboard, Linking } from 'reac
 import { Ionicons } from '@expo/vector-icons';
 import { Button } from '@oxyhq/bloom/button';
 import TextField from '../TextField';
-import { FAIRWalletIcon } from '../icon';
+import FAIRWalletIcon from '../icon/FAIRWalletIcon';
 import { createPaymentStyles } from './paymentStyles';
 import { toast } from '@oxyhq/bloom';
 import type { CardDetails, PaymentColors, PaymentStepAnimations } from './types';

package/src/ui/components/payment/PaymentMethodStep.tsx

@@ -4,7 +4,7 @@ import { View, Text, Animated } from 'react-native';
 import { Ionicons } from '@expo/vector-icons';
 import { SettingsListGroup, SettingsListItem } from '@oxyhq/bloom/settings-list';
 import { Button } from '@oxyhq/bloom/button';
-import { FAIRWalletIcon } from '../icon';
+import FAIRWalletIcon from '../icon/FAIRWalletIcon';
 import { createPaymentStyles } from './paymentStyles';
 import type { PaymentMethod, PaymentColors, PaymentStepAnimations } from './types';
 import { useI18n } from '../../hooks/useI18n';

package/src/ui/components/theming.tsx

@@ -1,5 +1,5 @@
 import { useTheme } from '@oxyhq/bloom/theme';
-import { getTheme } from '../styles';
+import { getTheme } from '../styles/theme';
 import type { InternalTheme } from './types';
 
 /**

package/src/ui/context/OxyContext.tsx

@@ -25,6 +25,7 @@ import { useAuthOperations } from './hooks/useAuthOperations';
 import { useDeviceManagement } from '../hooks/useDeviceManagement';
 import { getStorageKeys, createPlatformStorage, type StorageInterface } from '../utils/storageHelpers';
 import { isInvalidSessionError, isTimeoutOrNetworkError } from '../utils/errorHandlers';
+import { readActiveAuthuser, writeActiveAuthuser } from '../utils/activeAuthuser';
 import type { RouteName } from '../navigation/routes';
 import { showBottomSheet as globalShowBottomSheet } from '../navigation/bottomSheetManager';
 import { useQueryClient } from '@tanstack/react-query';
@@ -97,76 +98,9 @@ export interface OxyContextState {
 
 const OxyContext = createContext<OxyContextState | null>(null);
 
-/**
- * Minimal, decode-only shape of the session access-token JWT claims the
- * `POST /auth/refresh` endpoint returns. We only read `sessionId` (and `userId`
- * as a fallback). The token is already signed and verified server-side; the
- * client decodes the payload purely to recover the session id — it does NOT and
- * MUST NOT verify the signature.
- */
-interface RefreshAccessTokenClaims {
-  sessionId?: string;
-  userId?: string;
-  id?: string;
-}
-
-/**
- * Decode the payload of a JWT WITHOUT verifying its signature.
- *
- * The server (`POST /auth/refresh`) has already minted and signed this access
- * token; we only need to recover the `sessionId` claim from it on cold boot.
- * Returns `null` for any malformed input rather than throwing, so a bad token
- * simply falls through to the unauthenticated path.
- *
- * Implemented with manual base64url decoding (no `jwt-decode` dependency added
- * to `@oxyhq/services`). Works on web (where this cold-boot path runs) via
- * `atob`; if `atob` is unavailable (non-browser runtime) it is treated as
- * undecodable and returns `null`.
- */
-function decodeAccessTokenClaims(token: string): RefreshAccessTokenClaims | null {
-  if (!token || typeof token !== 'string') {
-    return null;
-  }
-  const segments = token.split('.');
-  if (segments.length !== 3) {
-    return null;
-  }
-  const payloadSegment = segments[1];
-  if (!payloadSegment) {
-    return null;
-  }
-  try {
-    const base64 = payloadSegment.replace(/-/g, '+').replace(/_/g, '/');
-    const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), '=');
-    if (typeof atob !== 'function') {
-      return null;
-    }
-    const json = decodeURIComponent(
-      atob(padded)
-        .split('')
-        .map((char) => `%${`00${char.charCodeAt(0).toString(16)}`.slice(-2)}`)
-        .join(''),
-    );
-    const parsed: unknown = JSON.parse(json);
-    if (parsed === null || typeof parsed !== 'object') {
-      return null;
-    }
-    const claims = parsed as Record<string, unknown>;
-    return {
-      sessionId: typeof claims.sessionId === 'string' ? claims.sessionId : undefined,
-      userId: typeof claims.userId === 'string' ? claims.userId : undefined,
-      id: typeof claims.id === 'string' ? claims.id : undefined,
-    };
-  } catch {
-    return null;
-  }
-}
-
-/** Server response shape of `POST /auth/refresh`. */
-interface RefreshCookieResponse {
-  accessToken?: string;
-  sessionId?: string;
-}
+// Active-authuser persistence helpers (web localStorage; native no-op) live in
+// `../utils/activeAuthuser` so the session-management and auth-operations hooks
+// can share them without re-importing this 1k-line context file.
 
 export interface OxyContextProviderProps {
   children: ReactNode;
@@ -519,111 +453,93 @@ export const OxyProvider: React.FC<OxyContextProviderProps> = ({
   const onAuthStateChangeRef = useRef(onAuthStateChange);
   onAuthStateChangeRef.current = onAuthStateChange;
 
-  // Cold-boot session restore via the secure refresh cookie (web only).
+  // Cold-boot session restore via the secure refresh cookies (web only).
   //
-  // On a hard reload the in-app, bearer-protected token fetch
-  // (`getTokenBySession` → `/session/token/:id`) 401s because there is no token
-  // in memory yet, which previously cleared the session and bounced the user to
-  // sign-in. Instead we call `POST {apiBaseUrl}/auth/refresh` with
-  // `credentials: 'include'` and NO Authorization header: the browser
-  // automatically attaches the first-party httpOnly `oxy_rt` cookie (set at
-  // login/signup/fedcm-exchange), the server validates + rotates it and returns
-  // a fresh session access token. JS never sees the refresh cookie (httpOnly) —
-  // that is the security property.
+  // Calls `oxyServices.refreshAllSessions()` → `POST /auth/refresh-all` with
+  // `credentials: 'include'`. The server rotates every device-local
+  // `oxy_rt_${authuser}` cookie in parallel and returns one entry per valid
+  // account (Google-style multi-account). On an older server that lacks the
+  // multi-account endpoint, the SDK transparently falls back to the legacy
+  // `/auth/refresh` single-account path and wraps the result in the same
+  // shape, so this caller doesn't branch.
   //
-  // Returns `true` when the session was restored (caller short-circuits the
-  // bearer path); `false` on 401 / no durable cookie / any failure (caller
-  // proceeds unauthenticated through the existing flow — nothing is cleared).
+  // Active-account selection: the persisted `oxy_active_authuser` slot index
+  // wins when it matches a returned account; otherwise the lowest `authuser`
+  // is picked. JS never sees the refresh cookies (httpOnly).
+  //
+  // Returns `true` when at least one session was restored (caller short-
+  // circuits the bearer path); `false` on no signed-in accounts / any failure
+  // (caller proceeds unauthenticated through the existing flow — nothing is
+  // cleared).
   const restoreViaRefreshCookie = useCallback(async (): Promise<boolean> => {
     if (!isWebBrowser()) {
       return false;
     }
 
-    const apiBaseUrl = oxyServices.getBaseURL();
-    if (!apiBaseUrl) {
-      return false;
-    }
-
-    let response: Response;
+    let snapshot;
     try {
-      // Direct credentialed, no-auth POST. We deliberately bypass the SDK's
-      // HttpService here: it would attach the (absent) bearer and does not send
-      // cookies. The refresh cookie is scoped to `Path=/auth/refresh` and sent
-      // automatically same-site.
-      response = await fetch(`${apiBaseUrl.replace(/\/$/, '')}/auth/refresh`, {
-        method: 'POST',
-        credentials: 'include',
-        headers: { Accept: 'application/json' },
-      });
+      snapshot = await oxyServices.refreshAllSessions();
     } catch (fetchError) {
       // Offline / network error — fall through to the cached/stored-session flow.
       if (__DEV__) {
-        loggerUtil.debug('Refresh-cookie restore network error (expected when offline)', { component: 'OxyContext', method: 'restoreViaRefreshCookie' }, fetchError as unknown);
+        loggerUtil.debug('Refresh-all cookie restore network error (expected when offline)', { component: 'OxyContext', method: 'restoreViaRefreshCookie' }, fetchError as unknown);
       }
       return false;
     }
 
-    // 401 (no/expired/reused cookie) and any non-2xx → no durable session.
-    if (!response.ok) {
-      return false;
-    }
-
-    let payload: RefreshCookieResponse;
-    try {
-      payload = (await response.json()) as RefreshCookieResponse;
-    } catch {
-      return false;
-    }
-
-    const accessToken = payload.accessToken;
-    if (!accessToken) {
-      return false;
-    }
-
-    // Recover the session id from the (server-signed) access-token claims, or
-    // from the response body if the server included it. Decode-only; the server
-    // already verified the signature.
-    const claims = decodeAccessTokenClaims(accessToken);
-    const sessionId = payload.sessionId ?? claims?.sessionId;
-    if (!sessionId) {
-      // A token with no resolvable session id cannot drive multi-session state.
+    if (snapshot.accounts.length === 0) {
       return false;
     }
 
-    // Plant the fresh access token. The refresh token stays in the httpOnly
-    // cookie and is never touched by JS.
-    oxyServices.httpService.setTokens(accessToken);
-
-    // Fetch the full user with the freshly planted token.
+    // Pick the active account: persisted authuser if it still matches a returned
+    // account, otherwise the lowest authuser (deterministic). The server has
+    // already sorted ascending so [0] is the lowest.
+    const persistedAuthuser = readActiveAuthuser();
+    const matched = persistedAuthuser !== null
+      ? snapshot.accounts.find((a) => a.authuser === persistedAuthuser)
+      : undefined;
+    const activeAccount = matched ?? snapshot.accounts[0];
+
+    // Plant the active access token. Sibling accounts' access tokens stay in
+    // the snapshot (the chooser can drive a per-account refresh via
+    // `refreshTokenViaCookie({authuser})` on switch).
+    oxyServices.httpService.setTokens(activeAccount.accessToken);
+
+    // Fetch the full user with the freshly planted token. The refresh-all
+    // payload includes a minimal user shape (id, username, name, avatar,
+    // email, color) — sufficient for the chooser but the auth store wants the
+    // canonical User document for downstream rendering.
     let fullUser: User;
     try {
       fullUser = await oxyServices.getCurrentUser();
     } catch (userError) {
-      // Token planted but profile fetch failed (e.g. transient network). Do not
-      // claim a restored session; fall through so the stored-session flow can
-      // retry. Leave the planted token in place — it is valid and harmless.
+      // Token planted but profile fetch failed (e.g. transient network). Do
+      // not claim a restored session; fall through so the stored-session flow
+      // can retry. Leave the planted token in place — it is valid and harmless.
       if (__DEV__) {
-        loggerUtil.debug('Refresh-cookie restore: getCurrentUser failed', { component: 'OxyContext', method: 'restoreViaRefreshCookie' }, userError as unknown);
+        loggerUtil.debug('Refresh-all cookie restore: getCurrentUser failed', { component: 'OxyContext', method: 'restoreViaRefreshCookie' }, userError as unknown);
       }
       return false;
     }
 
-    const userId = fullUser.id?.toString() ?? claims?.userId ?? '';
+    // Build a ClientSession per returned account so the multi-session store
+    // reflects every device-local slot, not just the active one. The active
+    // account is flagged `isCurrent: true`.
     const now = new Date();
-    const clientSession: ClientSession = {
-      sessionId,
+    const clientSessions: ClientSession[] = snapshot.accounts.map((account) => ({
+      sessionId: account.sessionId,
       deviceId: '',
-      expiresAt: new Date(now.getTime() + 7 * 24 * 60 * 60 * 1000).toISOString(),
+      expiresAt: account.expiresAt || new Date(now.getTime() + 7 * 24 * 60 * 60 * 1000).toISOString(),
       lastActive: now.toISOString(),
-      userId,
-      isCurrent: true,
-    };
-
-    // Restore the active session into the multi-session store (merge: keep any
-    // other sessions intact) and durably persist BEFORE notifying listeners.
-    updateSessionsRef.current([clientSession], { merge: true });
-    setActiveSessionIdRef.current(sessionId);
-    await persistSessionDurably(sessionId);
+      userId: account.user?.id,
+      isCurrent: account.sessionId === activeAccount.sessionId,
+      authuser: account.authuser,
+    }));
+
+    updateSessionsRef.current(clientSessions, { merge: true });
+    setActiveSessionIdRef.current(activeAccount.sessionId);
+    writeActiveAuthuser(activeAccount.authuser);
+    await persistSessionDurably(activeAccount.sessionId);
 
     loginSuccessRef.current(fullUser);
     onAuthStateChangeRef.current?.(fullUser);

package/src/ui/context/hooks/useAuthOperations.ts

@@ -8,6 +8,8 @@ import { handleAuthError, isInvalidSessionError } from '../../utils/errorHandler
 import type { StorageInterface } from '../../utils/storageHelpers';
 import type { OxyServices } from '@oxyhq/core';
 import { SignatureService } from '@oxyhq/core';
+import { isWebBrowser } from '../../hooks/useWebSSO';
+import { clearActiveAuthuser } from '../../utils/activeAuthuser';
 
 /** Type guard for error objects with optional code and status properties */
 function isErrorWithCodeOrStatus(error: unknown): error is { code?: string; status?: number; message?: string } {
@@ -300,7 +302,19 @@ export const useAuthOperations = ({
 
       try {
         const sessionToLogout = targetSessionId || activeSessionId;
-        await oxyServices.logoutSession(activeSessionId, sessionToLogout);
+        // Web multi-account: when the target session carries an `authuser`
+        // slot index it is backed by an httpOnly `oxy_rt_${n}` cookie. Use
+        // the cookie-cleared logout endpoint so the server can `Set-Cookie`
+        // an immediate expiry alongside revoking the family. Native and
+        // legacy sessions (no `authuser` plumbed yet) fall through to the
+        // bearer-protected endpoint.
+        const targetSession = sessionsRef.current.find((s) => s.sessionId === sessionToLogout);
+        const targetAuthuser = targetSession?.authuser;
+        if (isWebBrowser() && typeof targetAuthuser === 'number') {
+          await oxyServices.logoutSessionByAuthuser(targetAuthuser);
+        } else {
+          await oxyServices.logoutSession(activeSessionId, sessionToLogout);
+        }
 
         const filteredSessions = sessionsRef.current.filter((session) => session.sessionId !== sessionToLogout);
         updateSessions(filteredSessions, { merge: false });
@@ -355,7 +369,27 @@ export const useAuthOperations = ({
     }
 
     try {
-      await oxyServices.logoutAllSessions(activeSessionId);
+      // Semantics intentionally diverge by platform to match user expectation:
+      //   - Web: "Sign out of all accounts" = sign out every device-local
+      //     account on THIS device. The cookie endpoint is the only path
+      //     that can `Set-Cookie` an immediate expiry on every
+      //     `oxy_rt_${n}` slot (plus legacy `oxy_rt`) AND revoke every
+      //     presented family server-side. The bearer-protected
+      //     `logoutAllSessions(activeSessionId)` would only revoke the
+      //     active user's sessions across devices and leave sibling
+      //     accounts' cookies sitting on this device — wrong UX for the
+      //     chooser's "Sign out of all accounts".
+      //   - Native: there are no per-account cookies; "Sign out of all"
+      //     keeps its long-standing "revoke every session of THIS user"
+      //     meaning via the bearer endpoint.
+      // After clearing on web, also drop the persisted active-authuser so
+      // the next cold boot starts from a clean slate.
+      if (isWebBrowser()) {
+        await oxyServices.logoutAllSessionsViaCookie();
+        clearActiveAuthuser();
+      } else {
+        await oxyServices.logoutAllSessions(activeSessionId);
+      }
       await clearSessionState();
     } catch (error) {
       handleAuthError(error, {

package/src/ui/hooks/mutations/mutationKeys.ts

@@ -14,6 +14,12 @@ export const mutationKeys = {
     uploadAvatar: ['mutation', 'account', 'uploadAvatar'] as const,
     updateSettings: ['mutation', 'account', 'updateSettings'] as const,
     updatePrivacySettings: ['mutation', 'account', 'updatePrivacySettings'] as const,
+    updateNotificationPreferences: [
+      'mutation',
+      'account',
+      'updateNotificationPreferences',
+    ] as const,
+    updateUserPreferences: ['mutation', 'account', 'updateUserPreferences'] as const,
     uploadFile: ['mutation', 'account', 'uploadFile'] as const,
   },
 
@@ -25,4 +31,9 @@ export const mutationKeys = {
     updateDeviceName: ['mutation', 'session', 'updateDeviceName'] as const,
     removeDevice: ['mutation', 'session', 'removeDevice'] as const,
   },
+
+  // Connected apps (FedCM grants)
+  connectedApps: {
+    revoke: ['mutation', 'connectedApps', 'revoke'] as const,
+  },
 } as const;

package/src/ui/hooks/mutations/useAccountMutations.ts

@@ -1,7 +1,19 @@
 import { useMutation, useQueryClient } from '@tanstack/react-query';
 import { authenticatedApiCall } from '@oxyhq/core';
-import type { AssetUploadInput, PrivacySettings, User } from '@oxyhq/core';
-import { queryKeys, invalidateAccountQueries, invalidateUserQueries, invalidateSessionQueries } from '../queries/queryKeys';
+import type {
+  AssetUploadInput,
+  NotificationPreferences,
+  PrivacySettings,
+  User,
+  UserPreferences,
+} from '@oxyhq/core';
+import {
+  queryKeys,
+  invalidateAccountQueries,
+  invalidateConnectedAppsQueries,
+  invalidateUserQueries,
+  invalidateSessionQueries,
+} from '../queries/queryKeys';
 import { mutationKeys } from './mutationKeys';
 import { useOxy } from '../../context/OxyContext';
 import { toast } from '@oxyhq/bloom';
@@ -505,6 +517,146 @@ interface UploadResult {
   id?: string;
 }
 
+/**
+ * Update the authenticated user's notification preferences with optimistic
+ * updates. Persisted on the User document via `PUT /users/me` — same cache-
+ * invalidation behaviour as `useUpdateProfile`.
+ */
+export const useUpdateNotificationPreferences = () => {
+  const { oxyServices, activeSessionId } = useOxy();
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationKey: [...mutationKeys.account.updateNotificationPreferences],
+    mutationFn: async (preferences: Partial<NotificationPreferences>) => {
+      return authenticatedApiCall<User>(
+        oxyServices,
+        activeSessionId,
+        () => oxyServices.updateNotificationPreferences(preferences)
+      );
+    },
+    onMutate: async (preferences) => {
+      await queryClient.cancelQueries({ queryKey: queryKeys.accounts.current() });
+      const previousUser = queryClient.getQueryData<User>(queryKeys.accounts.current());
+
+      if (previousUser) {
+        queryClient.setQueryData<User>(queryKeys.accounts.current(), {
+          ...previousUser,
+          notificationPreferences: {
+            ...previousUser.notificationPreferences,
+            ...preferences,
+          },
+        });
+      }
+
+      return { previousUser };
+    },
+    onError: (error, _preferences, context) => {
+      if (context?.previousUser) {
+        const current = queryClient.getQueryData<User>(queryKeys.accounts.current());
+        if (current) {
+          queryClient.setQueryData<User>(queryKeys.accounts.current(), {
+            ...current,
+            notificationPreferences: context.previousUser.notificationPreferences,
+          });
+        }
+      }
+      toast.error(
+        error instanceof Error
+          ? error.message
+          : 'Failed to update notification preferences'
+      );
+    },
+    onSuccess: (data) => {
+      queryClient.setQueryData(queryKeys.accounts.current(), data);
+      useAuthStore.getState().setUser(data);
+      invalidateAccountQueries(queryClient);
+    },
+  });
+};
+
+/**
+ * Update the authenticated user's general preferences (language, theme,
+ * reduce-motion, timezone). Persisted on the User document via
+ * `PUT /users/me`.
+ */
+export const useUpdateUserPreferences = () => {
+  const { oxyServices, activeSessionId } = useOxy();
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationKey: [...mutationKeys.account.updateUserPreferences],
+    mutationFn: async (preferences: Partial<UserPreferences>) => {
+      return authenticatedApiCall<User>(
+        oxyServices,
+        activeSessionId,
+        () => oxyServices.updateUserPreferences(preferences)
+      );
+    },
+    onMutate: async (preferences) => {
+      await queryClient.cancelQueries({ queryKey: queryKeys.accounts.current() });
+      const previousUser = queryClient.getQueryData<User>(queryKeys.accounts.current());
+
+      if (previousUser) {
+        queryClient.setQueryData<User>(queryKeys.accounts.current(), {
+          ...previousUser,
+          userPreferences: {
+            ...previousUser.userPreferences,
+            ...preferences,
+          },
+        });
+      }
+
+      return { previousUser };
+    },
+    onError: (error, _preferences, context) => {
+      if (context?.previousUser) {
+        const current = queryClient.getQueryData<User>(queryKeys.accounts.current());
+        if (current) {
+          queryClient.setQueryData<User>(queryKeys.accounts.current(), {
+            ...current,
+            userPreferences: context.previousUser.userPreferences,
+          });
+        }
+      }
+      toast.error(error instanceof Error ? error.message : 'Failed to update preferences');
+    },
+    onSuccess: (data) => {
+      queryClient.setQueryData(queryKeys.accounts.current(), data);
+      useAuthStore.getState().setUser(data);
+      invalidateAccountQueries(queryClient);
+    },
+  });
+};
+
+/**
+ * Revoke the authenticated user's authorization for a specific RP origin.
+ * Removes the FedCM grant so the origin no longer appears in the user's
+ * "Connected apps" list — next sign-in from that origin will require explicit
+ * re-consent.
+ */
+export const useRevokeAuthorizedApp = () => {
+  const { oxyServices, activeSessionId } = useOxy();
+  const queryClient = useQueryClient();
+
+  return useMutation({
+    mutationKey: [...mutationKeys.connectedApps.revoke],
+    mutationFn: async (origin: string) => {
+      return authenticatedApiCall<void>(oxyServices, activeSessionId, () =>
+        oxyServices.revokeAuthorizedApp(origin)
+      );
+    },
+    onSuccess: () => {
+      invalidateConnectedAppsQueries(queryClient);
+    },
+    onError: (error) => {
+      toast.error(
+        error instanceof Error ? error.message : 'Failed to revoke authorized app'
+      );
+    },
+  });
+};
+
 /**
  * Upload file with authentication handling and progress tracking
  */