@bagelink/auth 1.15.110 → 1.15.114

package/dist/index.cjs

@@ -892,6 +892,26 @@ function getAllSSOProviders() {
 function isSupportedProvider(provider) {
   return provider in ssoProviders;
 }
+function handleSsoPopup() {
+  if (typeof window === "undefined" || !window.opener || window.opener === window) {
+    return false;
+  }
+  const { code, state, error } = queryParams();
+  if (!code && !error) return false;
+  const provider = state && typeof sessionStorage !== "undefined" ? sessionStorage.getItem(`oauth_provider:${state}`) ?? void 0 : void 0;
+  try {
+    window.opener.postMessage(
+      { type: "auth:complete", provider, code: code || void 0, state, error: error || void 0 },
+      window.location.origin
+    );
+  } catch {
+  }
+  try {
+    window.close();
+  } catch {
+  }
+  return true;
+}
 function handleOAuthCallback() {
   const { code, state } = queryParams();
   if (!code || !state) {
@@ -1618,6 +1638,7 @@ exports.getAllSSOProviders = getAllSSOProviders;
 exports.getRedirectConfig = getRedirectConfig;
 exports.getRedirectUrl = getRedirectUrl;
 exports.getSSOProvider = getSSOProvider;
+exports.handleSsoPopup = handleSsoPopup;
 exports.isSupportedProvider = isSupportedProvider;
 exports.isValidRedirect = isValidRedirect;
 exports.normalizeRedirectConfig = normalizeRedirectConfig;

package/dist/index.mjs

@@ -890,6 +890,26 @@ function getAllSSOProviders() {
 function isSupportedProvider(provider) {
   return provider in ssoProviders;
 }
+function handleSsoPopup() {
+  if (typeof window === "undefined" || !window.opener || window.opener === window) {
+    return false;
+  }
+  const { code, state, error } = queryParams();
+  if (!code && !error) return false;
+  const provider = state && typeof sessionStorage !== "undefined" ? sessionStorage.getItem(`oauth_provider:${state}`) ?? void 0 : void 0;
+  try {
+    window.opener.postMessage(
+      { type: "auth:complete", provider, code: code || void 0, state, error: error || void 0 },
+      window.location.origin
+    );
+  } catch {
+  }
+  try {
+    window.close();
+  } catch {
+  }
+  return true;
+}
 function handleOAuthCallback() {
   const { code, state } = queryParams();
   if (!code || !state) {
@@ -1617,6 +1637,7 @@ export {
   getRedirectConfig,
   getRedirectUrl,
   getSSOProvider,
+  handleSsoPopup,
   isSupportedProvider,
   isValidRedirect,
   normalizeRedirectConfig,

package/dist/sso.d.ts

@@ -143,3 +143,27 @@ export declare function getAllSSOProviders(): readonly SSOProviderInstance[];
  * Check if a provider is supported
  */
 export declare function isSupportedProvider(provider: string): provider is SSOProvider;
+/**
+ * Popup-mode OAuth landing handler.
+ *
+ * Call this **once at app startup, before the router mounts**. When the current
+ * page was opened as an OAuth popup (it has `?code`/`?state` — or `?error` — and
+ * a `window.opener`), it posts an `auth:complete` message back to the opener
+ * (which `sso.<provider>.popup()` is waiting for) and closes the popup.
+ *
+ * This lets a host app support popup SSO **without** a dedicated `/auth/callback`
+ * route or component — the whole flow stays on the original page.
+ *
+ * @returns `true` if it handled a popup callback (caller should stop bootstrapping
+ *   the app — the window is closing), otherwise `false`.
+ *
+ * @example
+ * ```ts
+ * import { handleSsoPopup } from '@bagelink/auth'
+ * if (handleSsoPopup()) { // we're the popup; do nothing else
+ * } else {
+ *   app.mount('#app')
+ * }
+ * ```
+ */
+export declare function handleSsoPopup(): boolean;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@bagelink/auth",
   "type": "module",
-  "version": "1.15.110",
+  "version": "1.15.114",
   "description": "Bagelink auth package",
   "author": {
     "name": "Bagel Studio",

package/src/sso.ts

@@ -623,6 +623,59 @@ export function isSupportedProvider(provider: string): provider is SSOProvider {
 	return provider in ssoProviders
 }
 
+/**
+ * Popup-mode OAuth landing handler.
+ *
+ * Call this **once at app startup, before the router mounts**. When the current
+ * page was opened as an OAuth popup (it has `?code`/`?state` — or `?error` — and
+ * a `window.opener`), it posts an `auth:complete` message back to the opener
+ * (which `sso.<provider>.popup()` is waiting for) and closes the popup.
+ *
+ * This lets a host app support popup SSO **without** a dedicated `/auth/callback`
+ * route or component — the whole flow stays on the original page.
+ *
+ * @returns `true` if it handled a popup callback (caller should stop bootstrapping
+ *   the app — the window is closing), otherwise `false`.
+ *
+ * @example
+ * ```ts
+ * import { handleSsoPopup } from '@bagelink/auth'
+ * if (handleSsoPopup()) { // we're the popup; do nothing else
+ * } else {
+ *   app.mount('#app')
+ * }
+ * ```
+ */
+export function handleSsoPopup(): boolean {
+	if (typeof window === 'undefined' || !window.opener || window.opener === window) {
+		return false
+	}
+
+	const { code, state, error } = queryParams()
+	if (!code && !error) return false
+
+	const provider = state && typeof sessionStorage !== 'undefined'
+		? sessionStorage.getItem(`oauth_provider:${state}`) ?? undefined
+		: undefined
+
+	try {
+		window.opener.postMessage(
+			{ type: 'auth:complete', provider, code: code || undefined, state, error: error || undefined },
+			window.location.origin,
+		)
+	} catch {
+		// Opener gone or cross-origin — the opener's polling fallback still works.
+	}
+
+	// Close the popup; the opener resolves via the message (or its poll).
+	try {
+		window.close()
+	} catch {
+		/* ignore */
+	}
+	return true
+}
+
 /**
  * Handle OAuth callback from URL
  * Internal helper - use sso.handleCallback() instead