@capgo/capacitor-social-login 8.2.7 → 8.2.8

package/dist/plugin.cjs.js

@@ -535,77 +535,124 @@ class GoogleSocialLogin extends BaseSocialLogin {
         const popup = window.open(url, 'Google Sign In', `width=${width},height=${height},left=${left},top=${top},popup=1`);
         let popupClosedInterval;
         let timeoutHandle;
+        // Use BroadcastChannel for cross-origin communication (works when postMessage doesn't)
+        const channelName = `google_oauth_${nonce || Date.now()}`;
+        let broadcastChannel = null;
+        try {
+            broadcastChannel = new BroadcastChannel(channelName);
+        }
+        catch (_b) {
+            // BroadcastChannel not supported, fall back to postMessage only
+        }
         // This may never return...
         return new Promise((resolve, reject) => {
             if (!popup) {
                 reject(new Error('Failed to open popup'));
                 return;
             }
-            const handleMessage = (event) => {
-                var _a, _b, _c, _d;
-                if (event.origin !== window.location.origin || ((_b = (_a = event.data) === null || _a === void 0 ? void 0 : _a.source) === null || _b === void 0 ? void 0 : _b.startsWith('angular')))
-                    return;
-                if (((_c = event.data) === null || _c === void 0 ? void 0 : _c.type) === 'oauth-response') {
-                    window.removeEventListener('message', handleMessage);
-                    clearInterval(popupClosedInterval);
-                    clearTimeout(timeoutHandle);
-                    if (this.loginType === 'online') {
-                        const { accessToken, idToken } = event.data;
-                        if (accessToken && idToken) {
-                            const profile = this.parseJwt(idToken);
-                            this.persistStateGoogle(accessToken.token, idToken);
-                            resolve({
-                                provider: 'google',
-                                result: {
-                                    accessToken: {
-                                        token: accessToken.token,
-                                    },
-                                    idToken,
-                                    profile: {
-                                        email: profile.email || null,
-                                        familyName: profile.family_name || null,
-                                        givenName: profile.given_name || null,
-                                        id: profile.sub || null,
-                                        name: profile.name || null,
-                                        imageUrl: profile.picture || null,
-                                    },
-                                    responseType: 'online',
-                                },
-                            });
-                        }
-                    }
-                    else {
-                        const { serverAuthCode } = event.data;
+            const cleanup = () => {
+                window.removeEventListener('message', handleMessage);
+                clearInterval(popupClosedInterval);
+                clearTimeout(timeoutHandle);
+                if (broadcastChannel) {
+                    broadcastChannel.close();
+                }
+            };
+            const processOAuthResponse = (data) => {
+                if (this.loginType === 'online') {
+                    const { accessToken, idToken } = data;
+                    if (accessToken && idToken) {
+                        const profile = this.parseJwt(idToken);
+                        this.persistStateGoogle(accessToken.token, idToken);
                         resolve({
                             provider: 'google',
                             result: {
-                                responseType: 'offline',
-                                serverAuthCode,
+                                accessToken: {
+                                    token: accessToken.token,
+                                },
+                                idToken,
+                                profile: {
+                                    email: profile.email || null,
+                                    familyName: profile.family_name || null,
+                                    givenName: profile.given_name || null,
+                                    id: profile.sub || null,
+                                    name: profile.name || null,
+                                    imageUrl: profile.picture || null,
+                                },
+                                responseType: 'online',
                             },
                         });
                     }
                 }
+                else {
+                    const { serverAuthCode } = data;
+                    resolve({
+                        provider: 'google',
+                        result: {
+                            responseType: 'offline',
+                            serverAuthCode,
+                        },
+                    });
+                }
+            };
+            const handleMessage = (event) => {
+                var _a, _b, _c, _d;
+                if (event.origin !== window.location.origin || ((_b = (_a = event.data) === null || _a === void 0 ? void 0 : _a.source) === null || _b === void 0 ? void 0 : _b.startsWith('angular')))
+                    return;
+                if (((_c = event.data) === null || _c === void 0 ? void 0 : _c.type) === 'oauth-response') {
+                    cleanup();
+                    processOAuthResponse(event.data);
+                }
                 else if (((_d = event.data) === null || _d === void 0 ? void 0 : _d.type) === 'oauth-error') {
-                    window.removeEventListener('message', handleMessage);
-                    clearInterval(popupClosedInterval);
-                    clearTimeout(timeoutHandle);
+                    cleanup();
                     const errorMessage = event.data.error || 'User cancelled the OAuth flow';
                     reject(new Error(errorMessage));
                 }
                 // Don't reject for non-OAuth messages, just ignore them
             };
+            // Listen for BroadcastChannel messages
+            if (broadcastChannel) {
+                broadcastChannel.onmessage = (event) => {
+                    var _a;
+                    const data = event.data;
+                    if ((_a = data === null || data === void 0 ? void 0 : data.source) === null || _a === void 0 ? void 0 : _a.toString().startsWith('angular'))
+                        return;
+                    if ((data === null || data === void 0 ? void 0 : data.type) === 'oauth-response') {
+                        cleanup();
+                        processOAuthResponse(data);
+                    }
+                    else if ((data === null || data === void 0 ? void 0 : data.type) === 'oauth-error') {
+                        cleanup();
+                        const errorMessage = data.error || 'User cancelled the OAuth flow';
+                        reject(new Error(errorMessage));
+                    }
+                };
+            }
             window.addEventListener('message', handleMessage);
             // Timeout after 5 minutes
             timeoutHandle = setTimeout(() => {
-                clearTimeout(timeoutHandle);
-                window.removeEventListener('message', handleMessage);
-                popup.close();
+                cleanup();
+                try {
+                    popup.close();
+                }
+                catch (_a) {
+                    // Ignore cross-origin errors when closing
+                }
                 reject(new Error('OAuth timeout'));
             }, 300000);
             popupClosedInterval = setInterval(() => {
-                if (popup.closed) {
+                try {
+                    // Check if popup is closed - this may throw cross-origin errors for some providers
+                    if (popup.closed) {
+                        cleanup();
+                        reject(new Error('Popup closed'));
+                    }
+                }
+                catch (_a) {
+                    // Cross-origin error when checking popup.closed - this happens when the popup
+                    // navigates to a third-party OAuth provider with strict security settings.
+                    // We can't detect if the window was closed, so we rely on timeout and message handlers.
                     clearInterval(popupClosedInterval);
-                    reject(new Error('Popup closed'));
                 }
             }, 1000);
         });
@@ -725,52 +772,95 @@ class OAuth2SocialLogin extends BaseSocialLogin {
                 reject(new Error('Unable to open login window. Please allow popups.'));
                 return;
             }
+            // Use BroadcastChannel for cross-origin communication (works when postMessage doesn't)
+            const channelName = `oauth2_${state}`;
+            let broadcastChannel = null;
+            try {
+                broadcastChannel = new BroadcastChannel(channelName);
+            }
+            catch (_a) {
+                // BroadcastChannel not supported, fall back to postMessage only
+                if (config.logsEnabled) {
+                    console.log(`[OAuth2:${providerId}] BroadcastChannel not supported, using postMessage only`);
+                }
+            }
             const cleanup = (messageHandler, timeoutHandle, intervalHandle) => {
                 window.removeEventListener('message', messageHandler);
                 clearTimeout(timeoutHandle);
                 clearInterval(intervalHandle);
-            };
-            const messageHandler = (event) => {
-                var _a, _b, _c, _d, _e;
-                if (event.origin !== window.location.origin) {
-                    return;
+                if (broadcastChannel) {
+                    broadcastChannel.close();
                 }
-                if (((_a = event.data) === null || _a === void 0 ? void 0 : _a.type) === 'oauth-response') {
-                    if (((_b = event.data) === null || _b === void 0 ? void 0 : _b.provider) && event.data.provider !== 'oauth2') {
-                        return;
+            };
+            const handleOAuthMessage = (data) => {
+                if ((data === null || data === void 0 ? void 0 : data.type) === 'oauth-response') {
+                    if ((data === null || data === void 0 ? void 0 : data.provider) && data.provider !== 'oauth2') {
+                        return false;
                     }
                     // Check providerId matches if present
-                    if (((_c = event.data) === null || _c === void 0 ? void 0 : _c.providerId) && event.data.providerId !== providerId) {
-                        return;
+                    if ((data === null || data === void 0 ? void 0 : data.providerId) && data.providerId !== providerId) {
+                        return false;
                     }
                     cleanup(messageHandler, timeoutHandle, popupClosedInterval);
                     // eslint-disable-next-line @typescript-eslint/no-unused-vars
-                    const _f = event.data, { provider: _ignoredProvider, type: _ignoredType } = _f, payload = __rest$1(_f, ["provider", "type"]);
+                    const _a = data, { provider: _ignoredProvider, type: _ignoredType } = _a, payload = __rest$1(_a, ["provider", "type"]);
                     resolve({
                         provider: 'oauth2',
                         result: payload,
                     });
+                    return true;
                 }
-                else if (((_d = event.data) === null || _d === void 0 ? void 0 : _d.type) === 'oauth-error') {
-                    if (((_e = event.data) === null || _e === void 0 ? void 0 : _e.provider) && event.data.provider !== 'oauth2') {
-                        return;
+                else if ((data === null || data === void 0 ? void 0 : data.type) === 'oauth-error') {
+                    if ((data === null || data === void 0 ? void 0 : data.provider) && data.provider !== 'oauth2') {
+                        return false;
                     }
                     cleanup(messageHandler, timeoutHandle, popupClosedInterval);
-                    reject(new Error(event.data.error || 'OAuth2 login was cancelled.'));
+                    reject(new Error(data.error || 'OAuth2 login was cancelled.'));
+                    return true;
                 }
+                return false;
+            };
+            // Listen for BroadcastChannel messages
+            if (broadcastChannel) {
+                broadcastChannel.onmessage = (event) => {
+                    handleOAuthMessage(event.data);
+                };
+            }
+            const messageHandler = (event) => {
+                if (event.origin !== window.location.origin) {
+                    return;
+                }
+                handleOAuthMessage(event.data);
             };
             window.addEventListener('message', messageHandler);
             const timeoutHandle = window.setTimeout(() => {
-                window.removeEventListener('message', messageHandler);
-                popup.close();
+                cleanup(messageHandler, timeoutHandle, popupClosedInterval);
+                try {
+                    popup.close();
+                }
+                catch (_a) {
+                    // Ignore cross-origin errors when closing
+                }
                 reject(new Error('OAuth2 login timed out.'));
             }, 300000);
             const popupClosedInterval = window.setInterval(() => {
-                if (popup.closed) {
-                    window.removeEventListener('message', messageHandler);
+                try {
+                    // Check if popup is closed - this may throw cross-origin errors for some providers
+                    if (popup.closed) {
+                        cleanup(messageHandler, timeoutHandle, popupClosedInterval);
+                        reject(new Error('OAuth2 login window was closed.'));
+                    }
+                }
+                catch (_a) {
+                    // Cross-origin error when checking popup.closed - this happens when the popup
+                    // navigates to a third-party OAuth provider with strict security settings.
+                    // We can't detect if the window was closed, so we just rely on the timeout
+                    // and message handlers. Clear the interval to avoid repeated errors.
                     clearInterval(popupClosedInterval);
-                    clearTimeout(timeoutHandle);
-                    reject(new Error('OAuth2 login window was closed.'));
+                    if (config.logsEnabled) {
+                        console.log(`[OAuth2:${providerId}] Cannot check popup.closed due to cross-origin restrictions. ` +
+                            'Relying on message handlers and timeout.');
+                    }
                 }
             }, 1000);
         });
@@ -1127,48 +1217,83 @@ class TwitterSocialLogin extends BaseSocialLogin {
                 reject(new Error('Unable to open login window. Please allow popups.'));
                 return;
             }
+            // Use BroadcastChannel for cross-origin communication (works when postMessage doesn't)
+            const channelName = `twitter_oauth_${state}`;
+            let broadcastChannel = null;
+            try {
+                broadcastChannel = new BroadcastChannel(channelName);
+            }
+            catch (_a) {
+                // BroadcastChannel not supported, fall back to postMessage only
+            }
             const cleanup = (messageHandler, timeoutHandle, intervalHandle) => {
                 window.removeEventListener('message', messageHandler);
                 clearTimeout(timeoutHandle);
                 clearInterval(intervalHandle);
-            };
-            const messageHandler = (event) => {
-                var _a, _b, _c, _d;
-                if (event.origin !== window.location.origin) {
-                    return;
+                if (broadcastChannel) {
+                    broadcastChannel.close();
                 }
-                if (((_a = event.data) === null || _a === void 0 ? void 0 : _a.type) === 'oauth-response') {
-                    if (((_b = event.data) === null || _b === void 0 ? void 0 : _b.provider) && event.data.provider !== 'twitter') {
-                        return;
+            };
+            const handleOAuthMessage = (data) => {
+                if ((data === null || data === void 0 ? void 0 : data.type) === 'oauth-response') {
+                    if ((data === null || data === void 0 ? void 0 : data.provider) && data.provider !== 'twitter') {
+                        return false;
                     }
                     cleanup(messageHandler, timeoutHandle, popupClosedInterval);
                     // eslint-disable-next-line @typescript-eslint/no-unused-vars
-                    const _e = event.data, { provider: _ignoredProvider } = _e, payload = __rest(_e, ["provider"]);
+                    const _a = data, { provider: _ignoredProvider } = _a, payload = __rest(_a, ["provider"]);
                     resolve({
                         provider: 'twitter',
                         result: payload,
                     });
+                    return true;
                 }
-                else if (((_c = event.data) === null || _c === void 0 ? void 0 : _c.type) === 'oauth-error') {
-                    if (((_d = event.data) === null || _d === void 0 ? void 0 : _d.provider) && event.data.provider !== 'twitter') {
-                        return;
+                else if ((data === null || data === void 0 ? void 0 : data.type) === 'oauth-error') {
+                    if ((data === null || data === void 0 ? void 0 : data.provider) && data.provider !== 'twitter') {
+                        return false;
                     }
                     cleanup(messageHandler, timeoutHandle, popupClosedInterval);
-                    reject(new Error(event.data.error || 'Twitter login was cancelled.'));
+                    reject(new Error(data.error || 'Twitter login was cancelled.'));
+                    return true;
+                }
+                return false;
+            };
+            // Listen for BroadcastChannel messages
+            if (broadcastChannel) {
+                broadcastChannel.onmessage = (event) => {
+                    handleOAuthMessage(event.data);
+                };
+            }
+            const messageHandler = (event) => {
+                if (event.origin !== window.location.origin) {
+                    return;
                 }
+                handleOAuthMessage(event.data);
             };
             window.addEventListener('message', messageHandler);
             const timeoutHandle = window.setTimeout(() => {
-                window.removeEventListener('message', messageHandler);
-                popup.close();
+                cleanup(messageHandler, timeoutHandle, popupClosedInterval);
+                try {
+                    popup.close();
+                }
+                catch (_a) {
+                    // Ignore cross-origin errors when closing
+                }
                 reject(new Error('Twitter login timed out.'));
             }, 300000);
             const popupClosedInterval = window.setInterval(() => {
-                if (popup.closed) {
-                    window.removeEventListener('message', messageHandler);
+                try {
+                    // Check if popup is closed - this may throw cross-origin errors for some providers
+                    if (popup.closed) {
+                        cleanup(messageHandler, timeoutHandle, popupClosedInterval);
+                        reject(new Error('Twitter login window was closed.'));
+                    }
+                }
+                catch (_a) {
+                    // Cross-origin error when checking popup.closed - this happens when the popup
+                    // navigates to a third-party OAuth provider with strict security settings.
+                    // We can't detect if the window was closed, so we rely on timeout and message handlers.
                     clearInterval(popupClosedInterval);
-                    clearTimeout(timeoutHandle);
-                    reject(new Error('Twitter login window was closed.'));
                 }
             }, 1000);
         });
@@ -1419,7 +1544,7 @@ class SocialLoginWeb extends core.WebPlugin {
         }
     }
     async handleOAuthRedirect() {
-        var _a, _b, _c;
+        var _a;
         const url = new URL(window.location.href);
         const stateRaw = localStorage.getItem(SocialLoginWeb.OAUTH_STATE_KEY);
         let provider = null;
@@ -1430,7 +1555,7 @@ class SocialLoginWeb extends core.WebPlugin {
                 provider = (_a = parsed.provider) !== null && _a !== void 0 ? _a : null;
                 state = parsed.state;
             }
-            catch (_d) {
+            catch (_b) {
                 provider = stateRaw === 'true' ? 'google' : null;
             }
         }
@@ -1450,16 +1575,53 @@ class SocialLoginWeb extends core.WebPlugin {
         if (!result) {
             return;
         }
+        // Build the message to send
+        let message;
         if ('error' in result) {
             const resolvedProvider = provider !== null && provider !== void 0 ? provider : null;
-            (_b = window.opener) === null || _b === void 0 ? void 0 : _b.postMessage({
+            message = {
                 type: 'oauth-error',
                 provider: resolvedProvider,
                 error: result.error,
-            }, window.location.origin);
+            };
         }
         else {
-            (_c = window.opener) === null || _c === void 0 ? void 0 : _c.postMessage(Object.assign({ type: 'oauth-response', provider: result.provider }, result.result), window.location.origin);
+            message = Object.assign({ type: 'oauth-response', provider: result.provider }, result.result);
+        }
+        // Try postMessage first (works when window.opener is accessible)
+        try {
+            if (window.opener) {
+                window.opener.postMessage(message, window.location.origin);
+            }
+        }
+        catch (_c) {
+            // Cross-origin error - window.opener may not be accessible
+            console.log('postMessage to opener failed, using BroadcastChannel');
+        }
+        // Also use BroadcastChannel as a fallback (works across same-origin windows
+        // even when window.opener is not accessible due to cross-origin navigation)
+        try {
+            // Determine the channel name based on provider and state
+            let channelName = null;
+            if (provider === 'oauth2' && state) {
+                channelName = `oauth2_${state}`;
+            }
+            else if (provider === 'twitter' && state) {
+                channelName = `twitter_oauth_${state}`;
+            }
+            else if (provider === 'google') {
+                // Google uses nonce which we can't easily recover here, but try anyway
+                // The parent window will have created a channel with a nonce-based name
+            }
+            if (channelName) {
+                const channel = new BroadcastChannel(channelName);
+                channel.postMessage(message);
+                channel.close();
+            }
+        }
+        catch (_d) {
+            // BroadcastChannel not supported or other error
+            console.log('BroadcastChannel not available');
         }
         window.close();
     }