@bounded-sh/client 0.0.29 → 0.0.30

package/dist/index.native.mjs

@@ -4230,7 +4230,11 @@ async function buildAuthorize(opts, guestHint) {
     const cfg = await getConfig();
     if (!cfg.appId)
         throw new Error('appId is not configured (init the SDK with your appId)');
-    const redirectUri = opts.redirectUri;
+    // Web: default to the current page so callers don't have to pass redirectUri. Native has no
+    // window — it MUST pass an https universal link (the system auth session needs a real URL).
+    const redirectUri = opts.redirectUri || (hasDOM() ? window.location.origin + window.location.pathname : undefined);
+    if (!redirectUri)
+        throw new Error('redirectUri is required on React Native — pass the https universal link the app owner registered.');
     const { verifier, challenge } = await makePkce();
     const state = randomState();
     const base = await issuerBase();
@@ -4389,6 +4393,21 @@ async function completeLoginFromRedirect() {
     const returnedState = url.searchParams.get('state');
     if (!code)
         return null;
+    // POPUP path: if we're the redirect_uri page running INSIDE the loginWithPopup() window,
+    // hand the code to the opener and close — no separate completeLoginInPopup() call needed.
+    // The opener is the same app/origin, so post to our own origin (the opener's message
+    // handler checks ev.origin === redirect_uri origin). One call now finishes BOTH flows.
+    if (window.opener && window.opener !== window) {
+        try {
+            window.opener.postMessage({ type: 'bounded-oidc-code', code, state: returnedState }, window.location.origin);
+        }
+        catch ( /* ignore */_a) { /* ignore */ }
+        try {
+            window.close();
+        }
+        catch ( /* ignore */_b) { /* ignore */ }
+        return null;
+    }
     setAuthLoading(true);
     try {
         const raw = sessionStorage.getItem(PKCE_STORE_KEY);
@@ -4422,7 +4441,9 @@ async function loginWithPopup(opts) {
     const popup = window.open(url, 'bounded-oidc', `width=${w},height=${h},left=${left},top=${top}`);
     if (!popup)
         throw new Error('Popup blocked — use loginWithRedirect() instead');
-    const expectedOrigin = new URL(opts.redirectUri).origin;
+    // Use the RESOLVED redirect_uri (buildAuthorize defaulted it to the current page on web),
+    // not opts.redirectUri which may be undefined.
+    const expectedOrigin = new URL(pkce.redirectUri).origin;
     return await new Promise((resolve, reject) => {
         const onMsg = async (ev) => {
             if (ev.origin !== expectedOrigin)