@fastshot/auth 1.0.2 → 1.0.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fastshot/auth",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "OAuth authentication SDK for Expo React Native applications with Supabase",
   "main": "src/index.ts",
   "repository": {

package/src/auth.ts

@@ -95,6 +95,7 @@ async function signInWithProvider(
   options: SignInOptions
 ): Promise<void> {
   const {
+    supabaseClient,
     returnTo = getDefaultCallbackUrl(),
     mode = 'browser',
     loginHint,
@@ -116,8 +117,19 @@ async function signInWithProvider(
     throw createAuthError('BROWSER_DISMISSED', 'Authentication was cancelled');
   }
 
-  // Note: The actual session restoration happens in handleAuthCallback
-  // which should be called when the deep link is received
+  // Handle successful auth callback and restore session
+  if (result.type === 'success' && result.url) {
+    const callbackResult = await handleAuthCallback(result.url, supabaseClient);
+    if (!callbackResult.success) {
+      throw createAuthError('UNKNOWN_ERROR', callbackResult.error || 'Failed to complete authentication');
+    }
+  } else {
+    // Handle unexpected browser result (e.g., success without URL)
+    throw createAuthError(
+      'UNKNOWN_ERROR',
+      `Unexpected auth result: type=${result.type}, hasUrl=${!!(result as any).url}`
+    );
+  }
 }
 
 /**

package/src/hooks/useAppleSignIn.ts

@@ -74,6 +74,8 @@ export function useAppleSignIn(config: UseAppleSignInConfig): UseAppleSignInResu
 
       setError(authError);
       config.onError?.(authError);
+      // Re-throw so caller can also handle the error
+      throw authError;
     } finally {
       setIsLoading(false);
     }

package/src/hooks/useGoogleSignIn.ts

@@ -77,6 +77,8 @@ export function useGoogleSignIn(config: UseGoogleSignInConfig): UseGoogleSignInR
 
       setError(authError);
       config.onError?.(authError);
+      // Re-throw so caller can also handle the error
+      throw authError;
     } finally {
       setIsLoading(false);
     }

package/src/utils/deepLink.ts

@@ -1,9 +1,19 @@
+import { Platform } from 'react-native';
 import { AUTH_CONFIG } from '../constants';
 
 /**
  * Get the default callback URL for OAuth
+ * Returns platform-appropriate URL:
+ * - Native (iOS/Android): fastshot://auth/callback
+ * - Web: https://current-origin/auth/callback
  */
 export function getDefaultCallbackUrl(): string {
+  if (Platform.OS === 'web') {
+    // Use HTTP URL for web browsers
+    const origin = (globalThis as any).location?.origin ?? '';
+    return `${origin}/${AUTH_CONFIG.CALLBACK_PATH}`;
+  }
+  // Use deep link scheme for native
   return `${AUTH_CONFIG.DEEP_LINK_SCHEME}://${AUTH_CONFIG.CALLBACK_PATH}`;
 }
 
@@ -26,7 +36,14 @@ export function parseCallbackUrl(url: string): {
       return {};
     }
 
-    const queryString = url.substring(queryStart + 1);
+    // Get query string and strip any URL fragment (#)
+    // iOS often appends a trailing # to callback URLs
+    let queryString = url.substring(queryStart + 1);
+    const hashIndex = queryString.indexOf('#');
+    if (hashIndex !== -1) {
+      queryString = queryString.substring(0, hashIndex);
+    }
+
     const params = new URLSearchParams(queryString);
 
     return {
@@ -41,12 +58,26 @@ export function parseCallbackUrl(url: string): {
 
 /**
  * Check if a URL is a valid auth callback URL
+ * Supports both native deep links and web HTTP URLs
  */
 export function isAuthCallbackUrl(url: string): boolean {
   if (!url) return false;
 
-  const expectedPrefix = `${AUTH_CONFIG.DEEP_LINK_SCHEME}://${AUTH_CONFIG.CALLBACK_PATH}`;
-  return url.startsWith(expectedPrefix);
+  // Check native deep link format: fastshot://auth/callback
+  const nativePrefix = `${AUTH_CONFIG.DEEP_LINK_SCHEME}://${AUTH_CONFIG.CALLBACK_PATH}`;
+  if (url.startsWith(nativePrefix)) {
+    return true;
+  }
+
+  // Check web URL format: https://*/auth/callback or http://*/auth/callback
+  try {
+    const parsedUrl = new URL(url);
+    const isHttpProtocol = parsedUrl.protocol === 'http:' || parsedUrl.protocol === 'https:';
+    const hasCallbackPath = parsedUrl.pathname === `/${AUTH_CONFIG.CALLBACK_PATH}`;
+    return isHttpProtocol && hasCallbackPath;
+  } catch {
+    return false;
+  }
 }
 
 /**