@bounded-sh/client 0.0.30 → 0.0.31

package/dist/auth/oidc-auth.d.ts

@@ -68,7 +68,8 @@ export declare function linkWithRedirect(opts: OidcLoginOptions): Promise<User |
  *  separate redirect page to finish from. Calling it on RN is harmless. */
 export declare function completeLoginFromRedirect(): Promise<User | null>;
 /** Popup variant: open the hosted login in a popup; resolves with the User once the popup's
- *  redirect_uri page posts the code back. The redirect_uri page must call completeLoginInPopup(). */
+ *  redirect_uri page posts the code back. The redirect_uri page just calls the usual
+ *  completeLoginFromRedirect() (which auto-detects the popup) — no separate call needed. */
 export declare function loginWithPopup(opts: PopupLoginOptions): Promise<User>;
 /** Call this on the redirect_uri page when login was opened via loginWithPopup(): posts the
  *  code back to the opener and closes. (For the redirect variant use completeLoginFromRedirect.) */

package/dist/index.js

@@ -4449,7 +4449,8 @@ async function completeLoginFromRedirect() {
     }
 }
 /** Popup variant: open the hosted login in a popup; resolves with the User once the popup's
- *  redirect_uri page posts the code back. The redirect_uri page must call completeLoginInPopup(). */
+ *  redirect_uri page posts the code back. The redirect_uri page just calls the usual
+ *  completeLoginFromRedirect() (which auto-detects the popup) — no separate call needed. */
 async function loginWithPopup(opts) {
     if (!hasDOM())
         throw new Error('loginWithPopup is web-only — on React Native use loginWithRedirect()');
@@ -4465,13 +4466,16 @@ async function loginWithPopup(opts) {
     // not opts.redirectUri which may be undefined.
     const expectedOrigin = new URL(pkce.redirectUri).origin;
     return await new Promise((resolve, reject) => {
+        let settled = false;
+        let timer;
+        const cleanup = () => { settled = true; clearInterval(timer); window.removeEventListener('message', onMsg); };
         const onMsg = async (ev) => {
             if (ev.origin !== expectedOrigin)
                 return; // only trust the redirect_uri origin
             const d = ev.data;
             if (!d || d.type !== 'bounded-oidc-code' || typeof d.code !== 'string')
                 return;
-            window.removeEventListener('message', onMsg);
+            cleanup();
             try {
                 const raw = sessionStorage.getItem(PKCE_STORE_KEY);
                 if (!raw)
@@ -4492,11 +4496,17 @@ async function loginWithPopup(opts) {
             }
         };
         window.addEventListener('message', onMsg);
-        const timer = setInterval(() => {
+        // The popup posts its code and then closes ITSELF, so a naive "popup.closed -> reject"
+        // races the just-posted message and would report a spurious "Login window closed" on a
+        // SUCCESSFUL login. When we see it closed, wait a beat for that pending message to settle
+        // before declaring the window closed.
+        timer = setInterval(() => {
             if (popup.closed) {
                 clearInterval(timer);
-                window.removeEventListener('message', onMsg);
-                reject(new Error('Login window closed'));
+                setTimeout(() => { if (!settled) {
+                    cleanup();
+                    reject(new Error('Login window closed'));
+                } }, 500);
             }
         }, 500);
     });