@bounded-sh/client 0.0.29 → 0.0.31

package/dist/index.mjs

@@ -4230,7 +4230,11 @@ async function buildAuthorize(opts, guestHint) {
     const cfg = await getConfig();
     if (!cfg.appId)
         throw new Error('appId is not configured (init the SDK with your appId)');
-    const redirectUri = opts.redirectUri;
+    // Web: default to the current page so callers don't have to pass redirectUri. Native has no
+    // window — it MUST pass an https universal link (the system auth session needs a real URL).
+    const redirectUri = opts.redirectUri || (hasDOM() ? window.location.origin + window.location.pathname : undefined);
+    if (!redirectUri)
+        throw new Error('redirectUri is required on React Native — pass the https universal link the app owner registered.');
     const { verifier, challenge } = await makePkce();
     const state = randomState();
     const base = await issuerBase();
@@ -4389,6 +4393,21 @@ async function completeLoginFromRedirect() {
     const returnedState = url.searchParams.get('state');
     if (!code)
         return null;
+    // POPUP path: if we're the redirect_uri page running INSIDE the loginWithPopup() window,
+    // hand the code to the opener and close — no separate completeLoginInPopup() call needed.
+    // The opener is the same app/origin, so post to our own origin (the opener's message
+    // handler checks ev.origin === redirect_uri origin). One call now finishes BOTH flows.
+    if (window.opener && window.opener !== window) {
+        try {
+            window.opener.postMessage({ type: 'bounded-oidc-code', code, state: returnedState }, window.location.origin);
+        }
+        catch ( /* ignore */_a) { /* ignore */ }
+        try {
+            window.close();
+        }
+        catch ( /* ignore */_b) { /* ignore */ }
+        return null;
+    }
     setAuthLoading(true);
     try {
         const raw = sessionStorage.getItem(PKCE_STORE_KEY);
@@ -4410,7 +4429,8 @@ async function completeLoginFromRedirect() {
     }
 }
 /** Popup variant: open the hosted login in a popup; resolves with the User once the popup's
- *  redirect_uri page posts the code back. The redirect_uri page must call completeLoginInPopup(). */
+ *  redirect_uri page posts the code back. The redirect_uri page just calls the usual
+ *  completeLoginFromRedirect() (which auto-detects the popup) — no separate call needed. */
 async function loginWithPopup(opts) {
     if (!hasDOM())
         throw new Error('loginWithPopup is web-only — on React Native use loginWithRedirect()');
@@ -4422,15 +4442,20 @@ async function loginWithPopup(opts) {
     const popup = window.open(url, 'bounded-oidc', `width=${w},height=${h},left=${left},top=${top}`);
     if (!popup)
         throw new Error('Popup blocked — use loginWithRedirect() instead');
-    const expectedOrigin = new URL(opts.redirectUri).origin;
+    // Use the RESOLVED redirect_uri (buildAuthorize defaulted it to the current page on web),
+    // not opts.redirectUri which may be undefined.
+    const expectedOrigin = new URL(pkce.redirectUri).origin;
     return await new Promise((resolve, reject) => {
+        let settled = false;
+        let timer;
+        const cleanup = () => { settled = true; clearInterval(timer); window.removeEventListener('message', onMsg); };
         const onMsg = async (ev) => {
             if (ev.origin !== expectedOrigin)
                 return; // only trust the redirect_uri origin
             const d = ev.data;
             if (!d || d.type !== 'bounded-oidc-code' || typeof d.code !== 'string')
                 return;
-            window.removeEventListener('message', onMsg);
+            cleanup();
             try {
                 const raw = sessionStorage.getItem(PKCE_STORE_KEY);
                 if (!raw)
@@ -4451,11 +4476,17 @@ async function loginWithPopup(opts) {
             }
         };
         window.addEventListener('message', onMsg);
-        const timer = setInterval(() => {
+        // The popup posts its code and then closes ITSELF, so a naive "popup.closed -> reject"
+        // races the just-posted message and would report a spurious "Login window closed" on a
+        // SUCCESSFUL login. When we see it closed, wait a beat for that pending message to settle
+        // before declaring the window closed.
+        timer = setInterval(() => {
             if (popup.closed) {
                 clearInterval(timer);
-                window.removeEventListener('message', onMsg);
-                reject(new Error('Login window closed'));
+                setTimeout(() => { if (!settled) {
+                    cleanup();
+                    reject(new Error('Login window closed'));
+                } }, 500);
             }
         }, 500);
     });