@bounded-sh/client 0.0.30 → 0.0.31

package/dist/index.mjs

@@ -4429,7 +4429,8 @@ async function completeLoginFromRedirect() {
     }
 }
 /** Popup variant: open the hosted login in a popup; resolves with the User once the popup's
- *  redirect_uri page posts the code back. The redirect_uri page must call completeLoginInPopup(). */
+ *  redirect_uri page posts the code back. The redirect_uri page just calls the usual
+ *  completeLoginFromRedirect() (which auto-detects the popup) — no separate call needed. */
 async function loginWithPopup(opts) {
     if (!hasDOM())
         throw new Error('loginWithPopup is web-only — on React Native use loginWithRedirect()');
@@ -4445,13 +4446,16 @@ async function loginWithPopup(opts) {
     // not opts.redirectUri which may be undefined.
     const expectedOrigin = new URL(pkce.redirectUri).origin;
     return await new Promise((resolve, reject) => {
+        let settled = false;
+        let timer;
+        const cleanup = () => { settled = true; clearInterval(timer); window.removeEventListener('message', onMsg); };
         const onMsg = async (ev) => {
             if (ev.origin !== expectedOrigin)
                 return; // only trust the redirect_uri origin
             const d = ev.data;
             if (!d || d.type !== 'bounded-oidc-code' || typeof d.code !== 'string')
                 return;
-            window.removeEventListener('message', onMsg);
+            cleanup();
             try {
                 const raw = sessionStorage.getItem(PKCE_STORE_KEY);
                 if (!raw)
@@ -4472,11 +4476,17 @@ async function loginWithPopup(opts) {
             }
         };
         window.addEventListener('message', onMsg);
-        const timer = setInterval(() => {
+        // The popup posts its code and then closes ITSELF, so a naive "popup.closed -> reject"
+        // races the just-posted message and would report a spurious "Login window closed" on a
+        // SUCCESSFUL login. When we see it closed, wait a beat for that pending message to settle
+        // before declaring the window closed.
+        timer = setInterval(() => {
             if (popup.closed) {
                 clearInterval(timer);
-                window.removeEventListener('message', onMsg);
-                reject(new Error('Login window closed'));
+                setTimeout(() => { if (!settled) {
+                    cleanup();
+                    reject(new Error('Login window closed'));
+                } }, 500);
             }
         }, 500);
     });