@bounded-sh/client 0.0.41 → 0.0.43

package/dist/index.native.mjs

@@ -4510,23 +4510,74 @@ async function completeLoginFromRedirect() {
 async function loginWithPopup(opts) {
     if (!hasDOM())
         throw new Error('loginWithPopup is web-only — on React Native use loginWithRedirect()');
-    const { url, pkce } = await buildAuthorize(opts);
-    sessionStorage.setItem(PKCE_STORE_KEY, JSON.stringify(pkce));
+    // Open synchronously, before PKCE/config awaits consume the click's user-
+    // activation window. Opening only after buildAuthorize() intermittently
+    // left Chrome with a real named window stranded at about:blank (or blocked
+    // it entirely), while callers waited forever for an OAuth message.
     const w = opts.width || 480, h = opts.height || 720;
     const left = window.screenX + (window.outerWidth - w) / 2;
     const top = window.screenY + (window.outerHeight - h) / 2;
-    const popup = window.open(url, 'bounded-oidc', `width=${w},height=${h},left=${left},top=${top}`);
+    const popup = window.open('', 'bounded-oidc', `width=${w},height=${h},left=${left},top=${top}`);
     if (!popup)
         throw new Error('Popup blocked — use loginWithRedirect() instead');
-    // Use the RESOLVED redirect_uri (buildAuthorize defaulted it to the current page on web),
-    // not opts.redirectUri which may be undefined.
-    const expectedOrigin = new URL(pkce.redirectUri).origin;
+    let authorization;
+    try {
+        authorization = await buildAuthorize(opts);
+    }
+    catch (error) {
+        try {
+            popup.close();
+        }
+        catch ( /* ignore */_a) { /* ignore */ }
+        throw error;
+    }
+    const { url, pkce } = authorization;
+    // Validate every remaining synchronous setup step before navigating. Both
+    // URL parsing and sessionStorage can throw (malformed caller input, blocked
+    // storage, quota/privacy mode); because the popup is already open to retain
+    // user activation, close it on either failure instead of orphaning a blank
+    // window with no listener or watchdog attached.
+    let expectedOrigin;
+    try {
+        expectedOrigin = new URL(pkce.redirectUri).origin;
+        sessionStorage.setItem(PKCE_STORE_KEY, JSON.stringify(pkce));
+    }
+    catch (error) {
+        try {
+            popup.close();
+        }
+        catch ( /* ignore */_b) { /* ignore */ }
+        throw error;
+    }
+    try {
+        popup.location.replace(url);
+    }
+    catch (_c) {
+        try {
+            popup.location.href = url;
+        }
+        catch (_d) {
+            try {
+                popup.close();
+            }
+            catch ( /* ignore */_e) { /* ignore */ }
+            throw new Error('Popup failed to navigate — use loginWithRedirect() instead');
+        }
+    }
+    // expectedOrigin came from the RESOLVED redirect_uri (buildAuthorize defaulted it to the
+    // current page on web), not opts.redirectUri which may be undefined.
     setAuthLoading(true); // reflect "signing in…" while the popup is open
     try {
         return await new Promise((resolve, reject) => {
             let settled = false;
             let timer;
-            const cleanup = () => { settled = true; clearInterval(timer); window.removeEventListener('message', onMsg); };
+            let navigationTimer;
+            const cleanup = () => {
+                settled = true;
+                clearInterval(timer);
+                clearTimeout(navigationTimer);
+                window.removeEventListener('message', onMsg);
+            };
             const onMsg = async (ev) => {
                 if (ev.origin !== expectedOrigin)
                     return; // only trust the redirect_uri origin
@@ -4554,6 +4605,27 @@ async function loginWithPopup(opts) {
                 }
             };
             window.addEventListener('message', onMsg);
+            // Some browser/extension combinations can return a real popup handle but
+            // strand the window at about:blank instead of navigating to the hosted
+            // authorize URL. The old code then waited forever because the popup was
+            // open and no message could ever arrive. Once the popup becomes
+            // cross-origin, reading location throws — that is positive evidence that
+            // navigation succeeded, so only a still-readable about:blank is rejected.
+            navigationTimer = setTimeout(() => {
+                if (settled || popup.closed)
+                    return;
+                try {
+                    if (popup.location.href === 'about:blank') {
+                        cleanup();
+                        try {
+                            popup.close();
+                        }
+                        catch ( /* ignore */_a) { /* ignore */ }
+                        reject(new Error('Popup stalled at about:blank — use loginWithRedirect() instead'));
+                    }
+                }
+                catch ( /* cross-origin hosted auth loaded normally */_b) { /* cross-origin hosted auth loaded normally */ }
+            }, 4000);
             // The popup posts its code and then closes ITSELF, so a naive "popup.closed -> reject"
             // races the just-posted message and would report a spurious "Login window closed" on a
             // SUCCESSFUL login. When we see it closed, wait a beat for that pending message to settle