@benji-money/connect-sdk 1.1.4-beta.5 → 1.1.4-beta.6

package/dist/connect-sdk.umd.global.js

@@ -110,7 +110,7 @@ var ConnectSDK = (() => {
   // src/utils/config.ts
   var buildContext = () => ({
     namespace: "benji-connect-sdk" ? "benji-connect-sdk" : "benji-connect-sdk",
-    version: "1.1.4-beta.5" ? String("1.1.4-beta.5") : "0.0.0"
+    version: "1.1.4-beta.6" ? String("1.1.4-beta.6") : "0.0.0"
   });
   function isBenjiConnectEnvironment(environment) {
     return environment === "local" /* LOCAL */ || environment === "development" /* DEVELOPMENT */ || environment === "sandbox" /* SANDBOX */ || environment === "production" /* PRODUCTION */;
@@ -247,6 +247,150 @@ var ConnectSDK = (() => {
     return ensureAuthLinkStateNonce(url, nonce);
   }
 
+  // src/utils/verifyAppUrl.ts
+  var DEFAULT_LOCAL_VERIFY_ORIGIN = "http://localhost:3000";
+  var REMOTE_VERIFY_ORIGINS = [
+    "https://verifyapp-staging.withbenji.com",
+    "https://verifyapp-dev.withbenji.com",
+    "https://verifyapp.withbenji.com"
+  ];
+  function rewriteVerifyAppUrlForLocalConnect(partnerLoginLink, localOrigin = DEFAULT_LOCAL_VERIFY_ORIGIN) {
+    if (!partnerLoginLink) {
+      return partnerLoginLink;
+    }
+    let url = partnerLoginLink;
+    for (const remote of REMOTE_VERIFY_ORIGINS) {
+      url = url.replaceAll(remote, localOrigin);
+      url = url.replaceAll(
+        remote.replace(/^https:\/\//, "https%3A//"),
+        localOrigin.replace(/^http:\/\//, "http%3A//")
+      );
+      url = url.replaceAll(encodeURIComponent(remote), encodeURIComponent(localOrigin));
+    }
+    return url;
+  }
+
+  // src/utils/loginTransport.ts
+  var LOGIN_PENDING_STORAGE_KEY = "benji_login_pending";
+  var LOGIN_FORCE_REDIRECT_STORAGE_KEY = "benji_force_login_redirect";
+  var LOGIN_RESUME_QUERY_FLAG = "login_resume";
+  var LOGIN_RETURN_STATE_SEPARATOR = ".benji_return.";
+  function isIosSafari(userAgent, maxTouchPoints) {
+    const isIos = /iPhone|iPad|iPod/.test(userAgent) || userAgent.includes("Macintosh") && maxTouchPoints > 1;
+    const isSafari = /Safari/.test(userAgent) && !/CriOS|FxiOS|EdgiOS|OPiOS|Chrome/.test(userAgent);
+    return isIos && isSafari;
+  }
+  function shouldUseSameTabLogin(args) {
+    if (!args.isNonDummyLogin) return false;
+    if (args.forceRedirect) return true;
+    return isIosSafari(args.userAgent, args.maxTouchPoints);
+  }
+  function isNonDummyLogin(mode, authType) {
+    return mode === 5 /* LOGIN */ && authType != null && authType !== 0 /* DUMMY */;
+  }
+  function isLocalForceRedirectEnabled(environment, storage) {
+    if (environment !== "local" /* LOCAL */) return false;
+    if (!storage) return false;
+    return storage.getItem(LOGIN_FORCE_REDIRECT_STORAGE_KEY) === "1";
+  }
+  function canStampLoginReturnState(partnerAuthLink, configToken) {
+    try {
+      const state = new URL(partnerAuthLink).searchParams.get("state");
+      return !state || state === configToken;
+    } catch {
+      return false;
+    }
+  }
+  function writeLoginPending(storage, payload) {
+    storage.setItem(LOGIN_PENDING_STORAGE_KEY, JSON.stringify(payload));
+  }
+  function buildRequestCodeExchangeMessage(args) {
+    const { configToken } = decodeLoginReturnState(args.token);
+    return {
+      type: "request_code_exchange",
+      data: {
+        partnerId: args.partnerId,
+        code: args.code,
+        token: configToken,
+        redirect_uri: args.redirectUri
+      }
+    };
+  }
+  function toBase64Url(value) {
+    const bytes = new TextEncoder().encode(value);
+    let binary = "";
+    for (const byte of bytes) {
+      binary += String.fromCharCode(byte);
+    }
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+  }
+  function fromBase64Url(value) {
+    try {
+      const padded = value.replace(/-/g, "+").replace(/_/g, "/");
+      const pad = padded.length % 4 === 0 ? "" : "=".repeat(4 - padded.length % 4);
+      const binary = atob(padded + pad);
+      const bytes = Uint8Array.from(binary, (ch) => ch.charCodeAt(0));
+      return new TextDecoder().decode(bytes);
+    } catch {
+      return null;
+    }
+  }
+  function encodeLoginReturnState(configToken, returnOrigin) {
+    return `${configToken}${LOGIN_RETURN_STATE_SEPARATOR}${toBase64Url(returnOrigin)}`;
+  }
+  function decodeLoginReturnState(state) {
+    const separatorIndex = state.indexOf(LOGIN_RETURN_STATE_SEPARATOR);
+    if (separatorIndex <= 0) {
+      return { configToken: state };
+    }
+    const configToken = state.slice(0, separatorIndex);
+    const encodedOrigin = state.slice(
+      separatorIndex + LOGIN_RETURN_STATE_SEPARATOR.length
+    );
+    if (!configToken || !encodedOrigin) {
+      return { configToken: state };
+    }
+    const returnOrigin = fromBase64Url(encodedOrigin);
+    if (!returnOrigin) {
+      return { configToken: state };
+    }
+    return { configToken, returnOrigin };
+  }
+  function stampLoginReturnState(url, configToken, returnOrigin) {
+    if (!canStampLoginReturnState(url, configToken)) {
+      throw new Error("Partner sign-in URL contains incompatible OAuth state.");
+    }
+    const state = encodeLoginReturnState(configToken, returnOrigin);
+    try {
+      const parsed = new URL(url);
+      parsed.searchParams.set("state", state);
+      return parsed.toString();
+    } catch {
+      if (url.includes("state=")) {
+        return url.replace(
+          /([?&]state=)[^&]*/,
+          `$1${encodeURIComponent(state)}`
+        );
+      }
+      const separator = url.includes("?") ? "&" : "?";
+      return `${url}${separator}state=${encodeURIComponent(state)}`;
+    }
+  }
+  function buildSameTabPartnerAuthUrl(args) {
+    let prepared = args.configToken ? preparePartnerAuthUrl(args.partnerAuthLink, args.configToken) : args.partnerAuthLink;
+    if (args.configToken && args.returnOrigin) {
+      prepared = stampLoginReturnState(
+        prepared,
+        args.configToken,
+        args.returnOrigin
+      );
+    }
+    if (!args.rewriteForLocalConnect) {
+      return prepared;
+    }
+    return rewriteVerifyAppUrlForLocalConnect(prepared);
+  }
+
   // src/utils/placement.ts
   var IFRAME_WIDTH = 400;
   var IFRAME_HEIGHT = 645;
@@ -918,6 +1062,7 @@ var ConnectSDK = (() => {
 
   // src/router/message.ts
   var IFRAME_DELIVERABILITY_POLL_MS = 100;
+  var HOST_AUTH_REDELIVERY_MS = 500;
   var _MessageRouter = class _MessageRouter {
     static configureMessageRouter(config) {
       this.onSuccess = config.onSuccess;
@@ -934,6 +1079,7 @@ var ConnectSDK = (() => {
       this.mode = context.mode;
       this.connectOrigin = new URL(Endpoints.benji_connect_auth_url).origin;
       if (this.canDeliverToConnectIframe()) {
+        this.flushPendingHostAuth();
         this.flushPendingPopupAuth();
       } else {
         this.startIframeDeliverabilityPoll();
@@ -960,6 +1106,7 @@ var ConnectSDK = (() => {
       window.removeEventListener("unhandledrejection", this.errorEventHandler);
       window.removeEventListener("message", this.messageEventHandler);
       this.stopIframeDeliverabilityPoll();
+      this.stopHostAuthRedelivery();
       this.configuredListeners = false;
       this.iframe = null;
       this.loginPopup = null;
@@ -967,6 +1114,7 @@ var ConnectSDK = (() => {
       this.connectOrigin = "";
       this.isIframeReady = false;
       this.pendingPopupAuth = [];
+      this.pendingHostAuth = [];
       this.lastVerifiedPopupSource = null;
     }
     static handleErrorMessage(event) {
@@ -1039,10 +1187,64 @@ var ConnectSDK = (() => {
         deliverable
       });
     }
+    /**
+     * Same-tab LOGIN resume: post immediately, then re-post on an interval until
+     * FLOW_SUCCESS / onError / close stops redelivery. Connect dedupes repeats.
+     */
+    static startHostAuthRedelivery(payload, intervalMs = HOST_AUTH_REDELIVERY_MS) {
+      this.stopHostAuthRedelivery();
+      this.upsertPendingHostAuth(payload);
+      this.flushPendingHostAuth();
+      this.hostAuthRedeliveryId = window.setInterval(() => {
+        if (!this.pendingHostAuth.length) {
+          this.stopHostAuthRedelivery();
+          return;
+        }
+        this.flushPendingHostAuth();
+      }, intervalMs);
+    }
+    static stopHostAuthRedelivery() {
+      if (this.hostAuthRedeliveryId !== null) {
+        window.clearInterval(this.hostAuthRedeliveryId);
+        this.hostAuthRedeliveryId = null;
+      }
+      this.pendingHostAuth = [];
+    }
+    static upsertPendingHostAuth(payload) {
+      const type = authMessageType(payload);
+      if (!type) {
+        this.pendingHostAuth.push(payload);
+        return;
+      }
+      const existingIndex = this.pendingHostAuth.findIndex(
+        (item) => authMessageType(item) === type
+      );
+      if (existingIndex >= 0) {
+        this.pendingHostAuth[existingIndex] = payload;
+      } else {
+        this.pendingHostAuth.push(payload);
+      }
+    }
+    static flushPendingHostAuth() {
+      var _a, _b;
+      if (!this.pendingHostAuth.length) return;
+      const iframeWindow = (_b = (_a = this.iframe) == null ? void 0 : _a.contentWindow) != null ? _b : null;
+      if (!iframeWindow || !this.canDeliverToConnectIframe()) {
+        return;
+      }
+      const queued = [...this.pendingHostAuth];
+      for (const payload of queued) {
+        iframeWindow.postMessage(payload, this.connectOrigin);
+      }
+      console.debug("[Benji Connect SDK] LOGIN flushPendingHostAuth", {
+        flushedCount: queued.length
+      });
+    }
     static markIframeReady(iframe) {
       if (this.iframe !== iframe) return;
       this.isIframeReady = true;
       console.debug("[Benji Connect SDK] LOGIN iframe_load");
+      this.flushPendingHostAuth();
       this.flushPendingPopupAuth();
     }
     static flushPendingPopupAuth() {
@@ -1248,6 +1450,16 @@ var ConnectSDK = (() => {
   _MessageRouter.connectOrigin = "";
   _MessageRouter.isIframeReady = false;
   _MessageRouter.pendingPopupAuth = [];
+  /**
+   * Sticky host→iframe auth (same-tab LOGIN resume). Kept after each post so
+   * redelivery can cover the window where the iframe is "deliverable" but
+   * Connect has not installed its message listener yet.
+   * Invariant: only `startHostAuthRedelivery` writes this queue, and it always
+   * owns a timer while the queue is non-empty. The deliverability poll is
+   * popup-only so it cannot double-post this payload.
+   */
+  _MessageRouter.pendingHostAuth = [];
+  _MessageRouter.hostAuthRedeliveryId = null;
   _MessageRouter.lastVerifiedPopupSource = null;
   _MessageRouter.iframeDeliverabilityPoll = null;
   _MessageRouter.errorEventHandler = (event) => {
@@ -1260,6 +1472,7 @@ var ConnectSDK = (() => {
 
   // src/connect-sdk.ts
   var POPUP_CLOSED_POLL_MS = 500;
+  var SAME_TAB_RESUME_TIMEOUT_MS = 45e3;
   var ConnectSDK = class {
     constructor(config) {
       this.iframe = null;
@@ -1289,6 +1502,9 @@ var ConnectSDK = (() => {
        * while the in-flight open() still mounts the iframe.
        */
       this.openAbortController = null;
+      /** Same-tab LOGIN resume mounts the iframe headless without partner auth type. */
+      this.isResumingSameTabLogin = false;
+      this.sameTabResumeTimeoutId = null;
       this.onIframeLoad = () => {
         if (this.isClosing || !this.iframe) return;
         MessageRouter.markIframeReady(this.iframe);
@@ -1306,9 +1522,64 @@ var ConnectSDK = (() => {
     }
     isLoginPopupOnly() {
       var _a;
-      const mode = (_a = this.sdkConfig.mode) != null ? _a : 1 /* CONNECT */;
-      const authType = this.resolveAuthType();
-      return mode === 5 /* LOGIN */ && authType != null && authType !== 0 /* DUMMY */;
+      return isNonDummyLogin(
+        (_a = this.sdkConfig.mode) != null ? _a : 1 /* CONNECT */,
+        this.resolveAuthType()
+      );
+    }
+    shouldOpenSameTabLogin() {
+      var _a, _b, _c;
+      if (!this.isLoginPopupOnly()) return false;
+      const partnerAuthLink = (_a = this.sdkConfig.tokenData) == null ? void 0 : _a.partnerAuthLink;
+      const configToken = (_b = this.sdkConfig.tokenData) == null ? void 0 : _b.configToken;
+      if (!partnerAuthLink || !configToken || !canStampLoginReturnState(partnerAuthLink, configToken)) {
+        return false;
+      }
+      const storage = typeof sessionStorage === "undefined" ? null : sessionStorage;
+      return shouldUseSameTabLogin({
+        isNonDummyLogin: true,
+        userAgent: typeof navigator === "undefined" ? "" : navigator.userAgent,
+        maxTouchPoints: typeof navigator === "undefined" ? 0 : (_c = navigator.maxTouchPoints) != null ? _c : 0,
+        forceRedirect: isLocalForceRedirectEnabled(Environment, storage)
+      });
+    }
+    openSameTabLogin() {
+      var _a, _b, _c, _d, _e, _f;
+      const partnerAuthLink = (_a = this.sdkConfig.tokenData) == null ? void 0 : _a.partnerAuthLink;
+      if (!partnerAuthLink) {
+        console.warn("[Connect SDK] Same-tab LOGIN missing partnerAuthLink");
+        (_c = (_b = this.sdkConfig).onError) == null ? void 0 : _c.call(
+          _b,
+          new Error("Partner sign-in URL is missing."),
+          "400",
+          { context: buildContext() }
+        );
+        return;
+      }
+      const rewriteForLocalConnect = Environment === "local" /* LOCAL */;
+      const returnOrigin = window.location.origin;
+      const url = buildSameTabPartnerAuthUrl({
+        partnerAuthLink,
+        configToken: (_d = this.sdkConfig.tokenData) == null ? void 0 : _d.configToken,
+        rewriteForLocalConnect,
+        returnOrigin
+      });
+      try {
+        writeLoginPending(sessionStorage, {
+          connectToken: this.sdkConfig.token,
+          path: `${window.location.pathname}${window.location.search}`
+        });
+      } catch (error) {
+        console.warn("[Connect SDK] Failed to persist LOGIN pending state", error);
+        (_f = (_e = this.sdkConfig).onError) == null ? void 0 : _f.call(
+          _e,
+          new Error("Sign-in could not be started."),
+          "400",
+          { context: buildContext() }
+        );
+        return;
+      }
+      window.location.assign(url);
     }
     isSessionActive() {
       return this.iframe != null || this.loginPopup != null;
@@ -1321,8 +1592,22 @@ var ConnectSDK = (() => {
     }
     initialize() {
       MessageRouter.configureMessageRouter({
-        onSuccess: this.sdkConfig.onSuccess,
-        onError: this.sdkConfig.onError,
+        onSuccess: (token, metadata) => {
+          var _a, _b;
+          this.clearSameTabResumeTimeout();
+          MessageRouter.stopHostAuthRedelivery();
+          (_b = (_a = this.sdkConfig).onSuccess) == null ? void 0 : _b.call(_a, token, metadata);
+        },
+        onError: (error, errorId, metadata) => {
+          var _a, _b;
+          if (this.isResumingSameTabLogin) {
+            this.close();
+          } else {
+            this.clearSameTabResumeTimeout();
+            MessageRouter.stopHostAuthRedelivery();
+          }
+          (_b = (_a = this.sdkConfig).onError) == null ? void 0 : _b.call(_a, error, errorId, metadata);
+        },
         onExit: this.sdkConfig.onExit,
         onEvent: this.sdkConfig.onEvent,
         close: () => this.close(),
@@ -1416,6 +1701,11 @@ var ConnectSDK = (() => {
       const abortController = new AbortController();
       this.openAbortController = abortController;
       const { signal } = abortController;
+      if (this.shouldOpenSameTabLogin()) {
+        this.openSameTabLogin();
+        this.abortInflightOpen();
+        return;
+      }
       this.initialize();
       if (signal.aborted) return;
       MessageRouter.setMode(mode);
@@ -1436,6 +1726,55 @@ var ConnectSDK = (() => {
       this.openUI();
       this.syncLoginContext(mode);
     }
+    /**
+     * Finishes a same-tab LOGIN after the partner redirect returns to the host.
+     * The Connect callback page has no session of its own, so the code exchange
+     * runs in the headless Connect iframe, which authenticates with the connect
+     * token. Completion arrives through the usual FLOW_SUCCESS → onSuccess path.
+     */
+    async resumeSameTabLogin(params) {
+      var _a;
+      if (this.isSessionActive()) return;
+      this.sdkConfig.mode = 5 /* LOGIN */;
+      this.isResumingSameTabLogin = true;
+      this.initialize();
+      MessageRouter.setMode(5 /* LOGIN */);
+      MessageRouter.addEventListeners();
+      this.openUI();
+      this.syncLoginContext(5 /* LOGIN */);
+      const payload = buildRequestCodeExchangeMessage({
+        partnerId: params.partnerId,
+        code: params.code,
+        token: params.state,
+        redirectUri: (_a = params.redirectUri) != null ? _a : this.buildCallbackUrl(params.partnerId)
+      });
+      MessageRouter.startHostAuthRedelivery(payload);
+      this.startSameTabResumeTimeout();
+    }
+    buildCallbackUrl(partnerId) {
+      const origin = new URL(Endpoints.benji_connect_auth_url).origin;
+      return `${origin}/auth/${partnerId}/callback`;
+    }
+    startSameTabResumeTimeout() {
+      this.clearSameTabResumeTimeout();
+      this.sameTabResumeTimeoutId = setTimeout(() => {
+        var _a, _b;
+        this.sameTabResumeTimeoutId = null;
+        console.warn("[Connect SDK] Same-tab LOGIN resume timed out");
+        (_b = (_a = this.sdkConfig).onError) == null ? void 0 : _b.call(
+          _a,
+          new Error("Sign-in could not be completed. Please try again."),
+          "408",
+          { context: buildContext() }
+        );
+        this.close();
+      }, SAME_TAB_RESUME_TIMEOUT_MS);
+    }
+    clearSameTabResumeTimeout() {
+      if (this.sameTabResumeTimeoutId === null) return;
+      clearTimeout(this.sameTabResumeTimeoutId);
+      this.sameTabResumeTimeoutId = null;
+    }
     syncLoginContext(mode) {
       MessageRouter.setLoginContext({
         iframe: this.iframe,
@@ -1447,7 +1786,7 @@ var ConnectSDK = (() => {
       var _a, _b;
       if (this.iframe) return;
       MessageRouter.resetIframeReady();
-      const headless = this.isLoginPopupOnly();
+      const headless = this.isResumingSameTabLogin || this.isLoginPopupOnly();
       this.container = document.createElement("div");
       if (headless) {
         applyHeadlessContainerStyle(this.container);
@@ -1463,6 +1802,9 @@ var ConnectSDK = (() => {
       if (this.sdkConfig.mode != null) {
         url.searchParams.set("mode", String(this.sdkConfig.mode));
       }
+      if (this.isResumingSameTabLogin) {
+        url.searchParams.set(LOGIN_RESUME_QUERY_FLAG, "1");
+      }
       this.iframe = document.createElement("iframe");
       this.syncLoginContext((_a = this.sdkConfig.mode) != null ? _a : 1 /* CONNECT */);
       this.iframe.addEventListener("load", this.onIframeLoad);
@@ -1509,6 +1851,10 @@ var ConnectSDK = (() => {
       this.syncLoginContext((_b = this.sdkConfig.mode) != null ? _b : 1 /* CONNECT */);
     }
     navigateLoginPopup(url) {
+      if (this.isResumingSameTabLogin) {
+        console.debug("[Connect SDK] Ignoring PARTNER_LOGIN_OPEN during same-tab resume");
+        return;
+      }
       if (this.hasLoginPopupUrl) return;
       if (!this.loginPopup || this.loginPopup.closed) {
         console.warn("[Connect SDK] Cannot navigate LOGIN popup \u2014 window unavailable");
@@ -1537,6 +1883,9 @@ var ConnectSDK = (() => {
     close() {
       var _a, _b;
       this.abortInflightOpen();
+      this.clearSameTabResumeTimeout();
+      MessageRouter.stopHostAuthRedelivery();
+      this.isResumingSameTabLogin = false;
       this.isClosing = true;
       this.stopPopupClosedPoll();
       this.closeLoginPopup();