@embarkai/ui-kit 0.4.127 → 0.6.9

package/dist/iframe/oauth/telegram.html

@@ -3,7 +3,7 @@
   <head>
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>Telegram Login - EmbarkAI</title>
+    <title>Telegram Login - embarkAI</title>
 
     <style>
       * {

package/dist/iframe/oauth/telegram.js

@@ -6,6 +6,21 @@
 // Get bot username from URL parameter
 const urlParams = new URLSearchParams(window.location.search);
 const BOT_USERNAME = urlParams.get('bot');
+// The dApp page that opened this popup (tss-api #6): the payload is posted to this origin only. Older SDKs pass
+// none and get '*', as before (their payload gives a legacy session only).
+const TARGET_ORIGIN = boundOrigin(urlParams.get('origin')) || (urlParams.get('origin') ? null : '*');
+
+/** A bare http(s) origin, or null */
+function boundOrigin(value) {
+  if (!value) return null;
+  try {
+    const url = new URL(value);
+    if (url.protocol !== 'https:' && url.protocol !== 'http:') return null;
+    return url.origin === value.replace(/\/+$/, '') ? url.origin : null;
+  } catch {
+    return null;
+  }
+}
 
 console.log('[Telegram OAuth] Initializing with bot:', BOT_USERNAME);
 
@@ -14,13 +29,14 @@ window.onTelegramAuth = function(user) {
   console.log('[Telegram OAuth] Authentication successful:', user);
 
   try {
+    if (!TARGET_ORIGIN) throw new Error('Invalid origin parameter');
     // Send data to opener window
     if (window.opener) {
       window.opener.postMessage({
         type: 'TELEGRAM_AUTH_SUCCESS',
         provider: 'telegram',
         user: user
-      }, '*');
+      }, TARGET_ORIGIN);
 
       // Show success message
       const container = document.getElementById('telegram-widget-container');
@@ -103,10 +119,10 @@ if (document.readyState === 'loading') {
 
 // Handle popup closing without authentication
 window.addEventListener('beforeunload', () => {
-  if (window.opener) {
+  if (window.opener && TARGET_ORIGIN) {
     window.opener.postMessage({
       type: 'TELEGRAM_AUTH_CANCELLED',
       provider: 'telegram'
-    }, '*');
+    }, TARGET_ORIGIN);
   }
 });

package/dist/iframe/oauth/x.html

@@ -3,7 +3,7 @@
   <head>
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>X (Twitter) Login - EmbarkAI</title>
+    <title>X (Twitter) Login - embarkAI</title>
 
     <style>
       * {

package/dist/iframe/oauth/x.js

@@ -16,6 +16,25 @@ const STATE = urlParams.get('state');
 const CODE = urlParams.get('code');
 const ERROR_PARAM = urlParams.get('error');
 const SUCCESS = urlParams.get('success'); // Backend redirected with success=true
+// Iframe flow (tss-api #6): the page opened this popup with ?pending=1 and navigates it to X itself;
+// after the callback (flow=iframe) the code goes to the page, which hands it to the auth iframe
+const PENDING = urlParams.get('pending') === '1';
+const IFRAME_FLOW = urlParams.get('flow') === 'iframe';
+// Iframe flow: the dApp page origin TSS bound to the flow (an allowed domain of the project); the result is
+// posted to this origin only, never to '*'
+const BOUND_ORIGIN = boundOrigin(urlParams.get('origin'));
+
+/** A bare http(s) origin, or null */
+function boundOrigin(value) {
+  if (!value) return null;
+  try {
+    const url = new URL(value);
+    if (url.protocol !== 'https:' && url.protocol !== 'http:') return null;
+    return url.origin === value.replace(/\/+$/, '') ? url.origin : null;
+  } catch {
+    return null;
+  }
+}
 
 console.log('[X OAuth] Initializing with:', { TSS_URL, MODE, PROJECT_ID, STATE, CODE, ERROR_PARAM, SUCCESS });
 
@@ -156,7 +175,44 @@ async function startOAuthFlow() {
  * If authCode is present, exchanges it for tokens (Safari ITP fix)
  * Otherwise falls back to cookie-based verify (desktop browsers)
  */
+/**
+ * Iframe flow: the code is redeemable only with the auth iframe's flow secret, so it is not exchanged here.
+ * Linking started by the iframe session issues no code at all.
+ */
+function handleIframeFlowSuccess() {
+  const authCode = urlParams.get('authCode');
+  if (!window.opener) {
+    showError('No opener window found. Please close this window manually.', false);
+    return;
+  }
+  if (!BOUND_ORIGIN) {
+    // never hand an iframe flow result to an unknown page
+    showError('The sign-in page is unknown. Please close this window and try again.', false);
+    return;
+  }
+  window.opener.postMessage({
+    type: 'X_AUTH_SUCCESS',
+    provider: 'x',
+    mode: MODE,
+    flow: 'iframe',
+    ...(authCode ? { authCode } : {})
+  }, BOUND_ORIGIN);
+  authResultSent = true;
+  showSuccess(MODE === 'link' ? 'Account linked successfully!' : 'Authentication successful!');
+  localStorage.removeItem('x_oauth_state');
+  localStorage.removeItem('x_oauth_mode');
+  localStorage.removeItem('x_oauth_tssUrl');
+  localStorage.removeItem('x_oauth_projectId');
+  setTimeout(() => {
+    window.close();
+  }, 1500);
+}
+
 async function handleBackendSuccess() {
+  if (IFRAME_FLOW) {
+    handleIframeFlowSuccess();
+    return;
+  }
   try {
     showLoading('Completing authentication...');
 
@@ -387,6 +443,10 @@ if (ERROR_PARAM) {
     }, '*');
     authResultSent = true; // Mark that we've sent result
   }
+} else if (PENDING) {
+  // The page navigates this window to X once the auth iframe has started the flow
+  showLoading('Starting X OAuth flow...');
+  isRedirectingToProvider = true;
 } else if (SUCCESS === 'true') {
   // Backend redirected back after successful OAuth
   handleBackendSuccess();