@glideidentity/web-client-sdk 4.4.8-beta.2 → 4.4.8

package/dist/esm/core/phone-auth/strategies/link.js

@@ -14,8 +14,9 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 export class LinkHandler {
     constructor() {
-        this.isPolling = false;
+        this.isPollingActive = false;
         this.isCancelled = false;
+        this.isPollingInProgress = false;
     }
     /**
      * Invoke link-based authentication
@@ -23,12 +24,20 @@ export class LinkHandler {
      */
     invoke(data, options) {
         return __awaiter(this, void 0, void 0, function* () {
+            console.log('[Link Auth] 🔗 invoke() called with data:', JSON.stringify(data, null, 2));
+            console.log('[Link Auth] Options:', options ? JSON.stringify({
+                pollingInterval: options.pollingInterval,
+                maxPollingAttempts: options.maxPollingAttempts,
+                pollingEndpoint: options.pollingEndpoint
+            }) : 'none');
             // Extract link data from prepare response
             const linkData = data.data;
             if (!linkData || !linkData.url) {
                 throw new Error('Invalid link data: missing URL');
             }
             const sessionKey = data.session.session_key;
+            console.log('[Link Auth] Session key:', sessionKey);
+            console.log('[Link Auth] Link URL:', linkData.url);
             // Open authentication app without navigating away from current page
             this.openAuthenticationLink(linkData.url);
             // Notify that link was opened
@@ -58,42 +67,97 @@ export class LinkHandler {
     startPolling(sessionKey, linkData, options) {
         return __awaiter(this, void 0, void 0, function* () {
             const interval = (options === null || options === void 0 ? void 0 : options.pollingInterval) || 2000; // Fixed 2 second interval
-            const maxAttempts = (options === null || options === void 0 ? void 0 : options.maxPollingAttempts) || 150; // 5 minutes with 2s interval
+            const maxAttempts = (options === null || options === void 0 ? void 0 : options.maxPollingAttempts) || 30; // 1 minute with 2s interval
             let attempts = 0;
+            console.log('[Link Auth] 🚀 Starting polling:', {
+                sessionKey,
+                interval: `${interval}ms`,
+                maxAttempts,
+                linkDataAvailable: !!linkData
+            });
             return new Promise((resolve, reject) => {
-                this.isPolling = true;
+                this.isPollingActive = true;
+                this.pollingReject = reject; // Store reject function for cancel()
                 const poll = () => __awaiter(this, void 0, void 0, function* () {
-                    if (!this.isPolling) {
+                    if (!this.isPollingActive) {
                         return; // Polling was stopped
                     }
+                    // Skip if another poll is already in progress
+                    if (this.isPollingInProgress) {
+                        return;
+                    }
+                    let statusUrl = ''; // Declare at function scope for catch block access
                     try {
-                        attempts++;
-                        // Check max attempts
+                        this.isPollingInProgress = true;
+                        // Check max attempts before making the request
                         if (attempts >= maxAttempts) {
                             this.stopPolling();
                             if (options === null || options === void 0 ? void 0 : options.onTimeout) {
                                 options.onTimeout();
                             }
+                            // Calculate actual timeout duration
+                            const timeoutSeconds = Math.round((maxAttempts * interval) / 1000);
+                            const timeoutMessage = timeoutSeconds >= 60
+                                ? `${Math.floor(timeoutSeconds / 60)} minute${Math.floor(timeoutSeconds / 60) > 1 ? 's' : ''}`
+                                : `${timeoutSeconds} seconds`;
                             if (options === null || options === void 0 ? void 0 : options.onStatusUpdate) {
                                 options.onStatusUpdate({
                                     status: 'expired',
-                                    message: 'Authentication timeout'
+                                    message: `Authentication timeout after ${timeoutMessage}`
                                 });
                             }
-                            reject(new Error('Authentication timeout after 5 minutes'));
+                            reject(new Error(`Authentication timeout after ${timeoutMessage}`));
                             return;
                         }
                         // Build public status endpoint URL
-                        let statusUrl;
-                        // First priority: use status_url from link data if provided
-                        if (linkData.status_url) {
-                            statusUrl = linkData.status_url;
-                            console.log('[Link Auth] Using status URL from link data:', statusUrl);
+                        // Use the same priority logic as Desktop strategy:
+                        // 1. options?.pollingEndpoint (already contains invoke options OR client config from client.ts)
+                        // 2. Backend-provided status_url from linkData
+                        // 3. Hardcoded fallback to API server
+                        let endpoint = options === null || options === void 0 ? void 0 : options.pollingEndpoint;
+                        let endpointSource = 'options';
+                        if (!endpoint && linkData.status_url) {
+                            endpoint = linkData.status_url;
+                            endpointSource = 'backend';
+                        }
+                        console.log('[Link Auth] Polling endpoint selection:');
+                        console.log('  - options?.pollingEndpoint:', options === null || options === void 0 ? void 0 : options.pollingEndpoint);
+                        console.log('  - linkData.status_url:', linkData.status_url);
+                        console.log('  - selected endpoint:', endpoint, 'from source:', endpointSource);
+                        // Build the status URL based on endpoint format (same as Desktop)
+                        if (endpoint && (endpoint.startsWith('http://') || endpoint.startsWith('https://'))) {
+                            // Full URL provided
+                            if (endpoint.includes('{{session_id}}')) {
+                                statusUrl = endpoint.replace('{{session_id}}', sessionKey);
+                            }
+                            else if (!endpoint.includes(sessionKey)) {
+                                // If it doesn't already contain the session ID, check if it's a base URL
+                                const url = new URL(endpoint);
+                                statusUrl = `${url.protocol}//${url.host}/public/public/status/${sessionKey}`;
+                            }
+                            else {
+                                statusUrl = endpoint;
+                            }
+                        }
+                        else if (endpoint && endpoint !== '') {
+                            // Relative path provided (e.g. '/api/phone-auth/status')
+                            const origin = typeof window !== 'undefined' ? window.location.origin : '';
+                            if (endpoint.includes('{{session_id}}')) {
+                                statusUrl = origin + endpoint.replace('{{session_id}}', sessionKey);
+                            }
+                            else {
+                                // Append session ID to the provided endpoint
+                                statusUrl = origin + endpoint + '/' + sessionKey;
+                            }
                         }
                         else {
+                            // No endpoint provided - use hardcoded fallback
                             statusUrl = `https://api.glideidentity.app/public/public/status/${sessionKey}`;
+                            endpointSource = 'fallback';
                         }
+                        console.log(`[Link Auth] Using ${endpointSource} endpoint: ${statusUrl}`);
                         // Poll public status endpoint - no authentication required
+                        console.log(`[Link Auth] Polling status (attempt ${attempts}/${maxAttempts}): ${statusUrl}`);
                         const response = yield fetch(statusUrl, {
                             method: 'GET',
                             headers: {
@@ -101,12 +165,16 @@ export class LinkHandler {
                                 // No Authorization header needed for public endpoint
                             }
                         });
+                        console.log(`[Link Auth] Poll response - Status: ${response.status}, OK: ${response.ok}`);
                         // Handle based on HTTP status code
                         if (response.status === 200) {
                             // Session is active (pending or completed)
                             const result = yield response.json();
+                            console.log('[Link Auth] Poll response data:', JSON.stringify(result, null, 2));
                             if (result.status === 'completed') {
                                 // Authentication completed successfully
+                                console.log('[Link Auth] ✅ Authentication COMPLETED! Session:', sessionKey);
+                                console.log('[Link Auth] Full completion result:', JSON.stringify(result, null, 2));
                                 this.stopPolling();
                                 // Authentication completed successfully
                                 if (options === null || options === void 0 ? void 0 : options.onStatusUpdate) {
@@ -117,6 +185,7 @@ export class LinkHandler {
                                     });
                                 }
                                 // Return the authentication result
+                                this.pollingReject = undefined; // Clear reject function on success
                                 resolve({
                                     authenticated: true,
                                     credential: result.credential || sessionKey,
@@ -131,6 +200,8 @@ export class LinkHandler {
                             }
                             else if (result.status === 'pending') {
                                 // Continue polling
+                                console.log('[Link Auth] Status still pending, continuing to poll...');
+                                attempts++; // Increment attempts after successful poll
                                 if (options === null || options === void 0 ? void 0 : options.onStatusUpdate) {
                                     options.onStatusUpdate({
                                         status: 'pending',
@@ -138,9 +209,15 @@ export class LinkHandler {
                                     });
                                 }
                             }
+                            else {
+                                // Unexpected status value
+                                console.log('[Link Auth] ⚠️ Unexpected status value:', result.status, 'Full result:', JSON.stringify(result, null, 2));
+                                attempts++; // Increment for unexpected status too
+                            }
                         }
                         else if (response.status === 410) {
                             // Session expired
+                            console.log('[Link Auth] ❌ Session expired (410)');
                             this.stopPolling();
                             const errorData = yield response.json().catch(() => ({ message: 'Session expired' }));
                             if (options === null || options === void 0 ? void 0 : options.onTimeout) {
@@ -156,8 +233,10 @@ export class LinkHandler {
                         }
                         else if (response.status === 422) {
                             // Authentication failed
+                            console.log('[Link Auth] ❌ Authentication failed (422)');
                             this.stopPolling();
                             const errorData = yield response.json().catch(() => ({ message: 'Authentication failed' }));
+                            console.log('[Link Auth] Error data:', JSON.stringify(errorData, null, 2));
                             const isUserCancelled = errorData.code === 'USER_CANCELLED';
                             const errorMsg = isUserCancelled
                                 ? 'User cancelled authentication'
@@ -173,6 +252,7 @@ export class LinkHandler {
                         }
                         else if (response.status === 404) {
                             // Session not found
+                            console.log('[Link Auth] ❌ Session not found (404)');
                             this.stopPolling();
                             if (options === null || options === void 0 ? void 0 : options.onStatusUpdate) {
                                 options.onStatusUpdate({
@@ -184,16 +264,42 @@ export class LinkHandler {
                         }
                         else if (response.status === 400) {
                             // Invalid session key
+                            console.log('[Link Auth] ❌ Invalid session key (400)');
                             this.stopPolling();
                             const errorData = yield response.json().catch(() => ({ message: 'Invalid session key' }));
+                            console.log('[Link Auth] Error data:', JSON.stringify(errorData, null, 2));
                             reject(new Error(errorData.message || 'Invalid session key'));
                         }
                         else {
                             // Unexpected status - continue polling
+                            console.log('[Link Auth] ⚠️ Unexpected HTTP status:', response.status, 'continuing to poll...');
+                            attempts++; // Increment for unexpected HTTP status
+                            try {
+                                const body = yield response.text();
+                                console.log('[Link Auth] Response body:', body);
+                            }
+                            catch (e) {
+                                console.log('[Link Auth] Could not read response body');
+                            }
                         }
                     }
                     catch (error) {
                         // Network or other error - continue polling
+                        console.error('[Link Auth] 🔴 Polling error:', error.message || error);
+                        attempts++; // Increment for error case
+                        console.error('[Link Auth] Error details:', {
+                            name: error.name,
+                            message: error.message,
+                            stack: error.stack,
+                            statusUrl: statusUrl,
+                            attempt: attempts,
+                            error: error
+                        });
+                        // Check if it's a CORS error (common on mobile)
+                        if (error.message && error.message.toLowerCase().includes('failed')) {
+                            console.error('[Link Auth] ⚠️ Possible CORS issue. Status URL:', statusUrl);
+                            console.error('[Link Auth] Make sure the API endpoint allows CORS from your ngrok domain');
+                        }
                         if (options === null || options === void 0 ? void 0 : options.onStatusUpdate) {
                             options.onStatusUpdate({
                                 status: 'pending',
@@ -201,6 +307,10 @@ export class LinkHandler {
                             });
                         }
                     }
+                    finally {
+                        // Always clear the polling flag when done
+                        this.isPollingInProgress = false;
+                    }
                 });
                 // Start initial poll immediately
                 poll();
@@ -213,7 +323,9 @@ export class LinkHandler {
      * Stop polling
      */
     stopPolling() {
-        this.isPolling = false;
+        console.log('[Link Auth] 🏁 Stopping polling');
+        this.isPollingActive = false;
+        this.isPollingInProgress = false;
         if (this.pollingInterval) {
             clearInterval(this.pollingInterval);
             this.pollingInterval = undefined;
@@ -248,14 +360,30 @@ export class LinkHandler {
         this.stopPolling();
         this.isCancelled = false;
         this.onCancel = undefined;
+        this.pollingReject = undefined;
+    }
+    /**
+     * Check if polling is currently active
+     */
+    isPolling() {
+        return this.pollingInterval !== undefined;
     }
     /**
      * Cancel the ongoing authentication
      */
     cancel() {
         var _a;
+        console.log('[Link Auth] Cancelling authentication');
         this.isCancelled = true;
         this.stopPolling();
         (_a = this.onCancel) === null || _a === void 0 ? void 0 : _a.call(this);
+        // Immediately reject the polling promise
+        if (this.pollingReject) {
+            this.pollingReject({
+                code: 'USER_DENIED',
+                message: 'Authentication cancelled by user'
+            });
+            this.pollingReject = undefined;
+        }
     }
 }

package/dist/esm/core/phone-auth/types.d.ts

@@ -72,7 +72,7 @@ export interface AuthConfig extends PhoneAuthCallbacks {
     pollingInterval?: number;
     /**
      * Maximum polling attempts before timeout
-     * @default 150 (5 minutes with 2s interval)
+     * @default 30 (1 minute with 2s interval)
      */
     maxPollingAttempts?: number;
     /**

package/dist/esm/core/phone-auth/ui/modal.d.ts

@@ -26,6 +26,10 @@ export declare class AuthModal {
     private closeCallback?;
     constructor(options?: InvokeOptions['modalOptions'], callbacks?: InvokeOptions['callbacks']);
     private handleEscapeKey;
+    /**
+     * Escape HTML to prevent XSS attacks
+     */
+    private escapeHtml;
     /**
      * Shows the modal with a QR code for desktop authentication
      * Supports both single QR code (legacy) and dual-platform QR codes (iOS + Android)

package/dist/esm/core/phone-auth/ui/modal.js

@@ -44,6 +44,17 @@ export class AuthModal {
             }
         }
     }
+    /**
+     * Escape HTML to prevent XSS attacks
+     */
+    escapeHtml(unsafe) {
+        return unsafe
+            .replace(/&/g, "&")
+            .replace(/</g, "&lt;")
+            .replace(/>/g, "&gt;")
+            .replace(/"/g, "&quot;")
+            .replace(/'/g, "&#039;");
+    }
     /**
      * Shows the modal with a QR code for desktop authentication
      * Supports both single QR code (legacy) and dual-platform QR codes (iOS + Android)
@@ -72,7 +83,7 @@ export class AuthModal {
                 // Only iOS QR code available - show single QR
                 this.createModal(`
           <div class="glide-auth-qr-container">
-            <img src="${qrCodeData.iosQRCode}" alt="QR Code" class="glide-auth-qr-code" />
+            <img src="${this.escapeHtml(qrCodeData.iosQRCode)}" alt="QR Code" class="glide-auth-qr-code" />
             <p class="glide-auth-status">Scan with your iPhone to authenticate</p>
           </div>
         `);
@@ -83,8 +94,8 @@ export class AuthModal {
             // Legacy single QR code
             this.createModal(`
         <div class="glide-auth-qr-container">
-          <img src="${qrCodeData}" alt="QR Code" class="glide-auth-qr-code" />
-          <p class="glide-auth-status">${statusMessage}</p>
+          <img src="${this.escapeHtml(qrCodeData)}" alt="QR Code" class="glide-auth-qr-code" />
+          <p class="glide-auth-status">${this.escapeHtml(statusMessage)}</p>
         </div>
       `);
         }
@@ -115,11 +126,11 @@ export class AuthModal {
         <!-- QR Code Image -->
         <img 
           id="glide-qr-code-img" 
-          src="${qrCodeData.iosQRCode}" 
+          src="${this.escapeHtml(qrCodeData.iosQRCode)}" 
           alt="QR Code" 
           class="glide-auth-qr-code" 
-          data-ios="${qrCodeData.iosQRCode}"
-          data-android="${qrCodeData.androidQRCode}"
+          data-ios="${this.escapeHtml(qrCodeData.iosQRCode)}"
+          data-android="${this.escapeHtml(qrCodeData.androidQRCode || '')}"
         />
         
         <!-- Status Message -->

package/dist/esm/core/version.js

@@ -1,2 +1,2 @@
 // SDK version - injected at build time
-export const SDK_VERSION = '4.4.8-beta.2';
+export const SDK_VERSION = '4.4.8';

package/dist/esm/index.d.ts

@@ -4,7 +4,7 @@ export { PhoneAuthErrorCode, isPhoneAuthError, isUserError, getUserMessage, isEr
 export { isExtendedResponse, isCredential, isAuthCredential, isLinkStrategy, isTS43Strategy, isDesktopStrategy, getStrategy, hasPollingControls, hasTrigger, isHeadlessResult, requiresPolling, requiresUserAction } from './core/phone-auth';
 export type { PhoneAuthCallbacks, PLMN, SessionInfo, InvokeOptions, ExecutionMode, AuthCredential, AnyExtendedResponse, DesktopExtendedResponse, LinkExtendedResponse, TS43ExtendedResponse, PrepareRequest, PrepareResponse, GetPhoneNumberRequest, GetPhoneNumberResponse, VerifyPhoneNumberRequest, VerifyPhoneNumberResponse, SecureCredentialRequest, SecureCredentialResponse, DigitalCredential, TS43Data, LinkData, DesktopData, ClientInfo, ConsentData, BrowserErrorType, BrowserErrorCodeType, BrowserNameType } from './core/phone-auth/types';
 export { USE_CASE as UseCase, AUTHENTICATION_STRATEGY as AuthenticationStrategy, BrowserError, BrowserErrorCode, BrowserName } from './core/phone-auth/types';
-export { DesktopHandler, showQRCodeModal, createQRCodeDisplay } from './core/phone-auth/strategies/desktop';
+export { DesktopHandler } from './core/phone-auth/strategies/desktop';
 export type { DesktopAuthOptions, DesktopAuthResult, PollingStatus, QRCodeData } from './core/phone-auth/strategies/desktop';
 export { useClient, usePhoneAuth } from './adapters/react';
 export { useClient as useVueClient, usePhoneAuth as useVuePhoneAuth } from './adapters/vue';

package/dist/esm/index.js

@@ -9,7 +9,7 @@ isHeadlessResult, requiresPolling, requiresUserAction } from './core/phone-auth'
 // Export constants for use case and strategy
 export { USE_CASE as UseCase, AUTHENTICATION_STRATEGY as AuthenticationStrategy, BrowserError, BrowserErrorCode, BrowserName } from './core/phone-auth/types';
 // Desktop Strategy Exports
-export { DesktopHandler, showQRCodeModal, createQRCodeDisplay } from './core/phone-auth/strategies/desktop';
+export { DesktopHandler } from './core/phone-auth/strategies/desktop';
 // Adapters
 export { useClient, usePhoneAuth } from './adapters/react';
 export { useClient as useVueClient, usePhoneAuth as useVuePhoneAuth } from './adapters/vue';

package/dist/index.d.ts

@@ -4,7 +4,7 @@ export { PhoneAuthErrorCode, isPhoneAuthError, isUserError, getUserMessage, isEr
 export { isExtendedResponse, isCredential, isAuthCredential, isLinkStrategy, isTS43Strategy, isDesktopStrategy, getStrategy, hasPollingControls, hasTrigger, isHeadlessResult, requiresPolling, requiresUserAction } from './core/phone-auth';
 export type { PhoneAuthCallbacks, PLMN, SessionInfo, InvokeOptions, ExecutionMode, AuthCredential, AnyExtendedResponse, DesktopExtendedResponse, LinkExtendedResponse, TS43ExtendedResponse, PrepareRequest, PrepareResponse, GetPhoneNumberRequest, GetPhoneNumberResponse, VerifyPhoneNumberRequest, VerifyPhoneNumberResponse, SecureCredentialRequest, SecureCredentialResponse, DigitalCredential, TS43Data, LinkData, DesktopData, ClientInfo, ConsentData, BrowserErrorType, BrowserErrorCodeType, BrowserNameType } from './core/phone-auth/types';
 export { USE_CASE as UseCase, AUTHENTICATION_STRATEGY as AuthenticationStrategy, BrowserError, BrowserErrorCode, BrowserName } from './core/phone-auth/types';
-export { DesktopHandler, showQRCodeModal, createQRCodeDisplay } from './core/phone-auth/strategies/desktop';
+export { DesktopHandler } from './core/phone-auth/strategies/desktop';
 export type { DesktopAuthOptions, DesktopAuthResult, PollingStatus, QRCodeData } from './core/phone-auth/strategies/desktop';
 export { useClient, usePhoneAuth } from './adapters/react';
 export { useClient as useVueClient, usePhoneAuth as useVuePhoneAuth } from './adapters/vue';

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PhoneAuthManager = exports.ClientManager = exports.PhoneAuthService = exports.ClientService = exports.useVuePhoneAuth = exports.useVueClient = exports.usePhoneAuth = exports.useClient = exports.createQRCodeDisplay = exports.showQRCodeModal = exports.DesktopHandler = exports.BrowserName = exports.BrowserErrorCode = exports.BrowserError = exports.AuthenticationStrategy = exports.UseCase = exports.requiresUserAction = exports.requiresPolling = exports.isHeadlessResult = exports.hasTrigger = exports.hasPollingControls = exports.getStrategy = exports.isDesktopStrategy = exports.isTS43Strategy = exports.isLinkStrategy = exports.isAuthCredential = exports.isCredential = exports.isExtendedResponse = exports.createErrorBreadcrumb = exports.serializeError = exports.isRetryableError = exports.getRetryDelay = exports.isErrorCode = exports.getUserMessage = exports.isUserError = exports.isPhoneAuthError = exports.PhoneAuthErrorCode = exports.PhoneAuthClient = void 0;
+exports.PhoneAuthManager = exports.ClientManager = exports.PhoneAuthService = exports.ClientService = exports.useVuePhoneAuth = exports.useVueClient = exports.usePhoneAuth = exports.useClient = exports.DesktopHandler = exports.BrowserName = exports.BrowserErrorCode = exports.BrowserError = exports.AuthenticationStrategy = exports.UseCase = exports.requiresUserAction = exports.requiresPolling = exports.isHeadlessResult = exports.hasTrigger = exports.hasPollingControls = exports.getStrategy = exports.isDesktopStrategy = exports.isTS43Strategy = exports.isLinkStrategy = exports.isAuthCredential = exports.isCredential = exports.isExtendedResponse = exports.createErrorBreadcrumb = exports.serializeError = exports.isRetryableError = exports.getRetryDelay = exports.isErrorCode = exports.getUserMessage = exports.isUserError = exports.isPhoneAuthError = exports.PhoneAuthErrorCode = exports.PhoneAuthClient = void 0;
 // Phone Authentication
 var phone_auth_1 = require("./core/phone-auth");
 Object.defineProperty(exports, "PhoneAuthClient", { enumerable: true, get: function () { return phone_auth_1.PhoneAuthClient; } });
@@ -40,8 +40,6 @@ Object.defineProperty(exports, "BrowserName", { enumerable: true, get: function
 // Desktop Strategy Exports
 var desktop_1 = require("./core/phone-auth/strategies/desktop");
 Object.defineProperty(exports, "DesktopHandler", { enumerable: true, get: function () { return desktop_1.DesktopHandler; } });
-Object.defineProperty(exports, "showQRCodeModal", { enumerable: true, get: function () { return desktop_1.showQRCodeModal; } });
-Object.defineProperty(exports, "createQRCodeDisplay", { enumerable: true, get: function () { return desktop_1.createQRCodeDisplay; } });
 // Adapters
 var react_1 = require("./adapters/react");
 Object.defineProperty(exports, "useClient", { enumerable: true, get: function () { return react_1.useClient; } });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@glideidentity/web-client-sdk",
-  "version": "4.4.8-beta.2",
+  "version": "4.4.8",
   "main": "./dist/index.js",
   "module": "./dist/esm/index.js",
   "types": "./dist/index.d.ts",