@helloleo/plugins 0.2.8 → 0.2.9

package/dist/index.js

@@ -25568,28 +25568,51 @@ export function signInWithNetSuite(returnTo: string = window.location.href) {
       'VITE_WORKER_URL is not set. HelloLeo Cloud must be provisioned before sign-in works.',
     );
   }
+  const workerOrigin = new URL(WORKER_URL).origin;
   const url = new URL(\`\${WORKER_URL.replace(/\\/$/, '')}/auth/netsuite/start\`);
   url.searchParams.set('return_to', returnTo);
-  // The app usually renders inside the HelloLeo preview iframe. NetSuite's
-  // OAuth page sets X-Frame-Options: DENY, so navigating the iframe to the
-  // Worker (which 302s to NetSuite) ends up loading a page the browser
-  // refuses to render -- looks like "nothing happens" to the user. Navigate
-  // the top frame instead so the OAuth flow runs at the top level and the
-  // callback redirect lands on the same top frame, which then reads the
-  // #nssid= fragment. Use \`location.href =\` (NOT \`location.assign()\`):
-  // reading the \`.assign\` method off a cross-origin \`window.top.location\`
-  // throws a SecurityError, which would drop us into the same-frame fallback
-  // and load NetSuite inside the iframe (X-Frame-Options: DENY -> "refused to
-  // connect"). Assigning \`.href\` is a navigation, allowed cross-origin.
-  try {
-    if (window.top && window.top !== window) {
-      window.top.location.href = url.toString();
-      return;
+  // popup=1 tells the Worker callback to postMessage the session id back to
+  // THIS window (then close) instead of a #nssid= redirect.
+  url.searchParams.set('popup', '1');
+
+  // Open OAuth in a POPUP -- not the iframe, not the top frame. NetSuite's OAuth
+  // page is X-Frame-Options: DENY (can't load in an iframe), and navigating the
+  // TOP frame replaces the HelloLeo preview and lands the session in a DIFFERENT
+  // browsing context -- so back in the preview iframe (its own partitioned
+  // sessionStorage) you still see the login even after signing in. A popup keeps
+  // the app + preview intact and hands the token back to this exact context.
+  const popup = window.open(
+    url.toString(),
+    'netsuite-oauth',
+    'width=600,height=760,menubar=no,toolbar=no',
+  );
+
+  if (!popup) {
+    // Popup blocked -> fall back to top-frame navigation (works first-party / in
+    // a standalone tab; the callback then uses the #nssid= redirect).
+    try {
+      if (window.top && window.top !== window) {
+        window.top.location.href = url.toString();
+        return;
+      }
+    } catch {
+      /* top window not accessible */
     }
-  } catch {
-    /* top window not accessible \u2014 fall through to same-frame navigation */
+    window.location.href = url.toString();
+    return;
   }
-  window.location.href = url.toString();
+
+  const onMessage = (event: MessageEvent) => {
+    if (event.origin !== workerOrigin) return;
+    const data = event.data as { type?: string; nssid?: string } | null;
+    if (!data || data.type !== 'netsuite-auth' || !data.nssid) return;
+    try { sessionStorage.setItem(TOKEN_KEY, data.nssid); } catch {}
+    window.removeEventListener('message', onMessage);
+    try { popup.close(); } catch {}
+    // Re-render as signed-in -- the auth provider re-checks /api/me on load.
+    window.location.reload();
+  };
+  window.addEventListener('message', onMessage);
 }
 
 export interface NetSuiteSession {
@@ -25868,6 +25891,7 @@ var setupNetsuite = tool({
       "- Read the session anywhere with useNetSuiteAuth() from src/lib/auth.tsx.",
       "- Never replace AuthLayout with a password gate. Real OAuth is the only supported login.",
       "- The auth worker (deployed via the cloudflare-backend MCP) serves /auth/netsuite/start, /auth/netsuite/callback, /api/me and /auth/netsuite/logout. It reads env.NETSUITE_ACCOUNT_ID, _CLIENT_ID and _CLIENT_SECRET. VITE_WORKER_URL must be set (HelloLeo Cloud seeds it).",
+      "- POPUP FLOW (required so login works inside the HelloLeo preview iframe): the client opens /auth/netsuite/start in a popup with ?popup=1. The worker MUST carry that flag through OAuth (persist it on the flow row in /start, read it back in /callback via state). In /auth/netsuite/callback, when the flow was popup, DO NOT redirect to return_to#nssid \u2014 instead return an HTML page whose script does: window.opener.postMessage({ type: 'netsuite-auth', nssid: SID }, '*'); window.close(); (fall back to the return_to#nssid redirect only when there is no opener / not a popup). Without this, the preview iframe (partitioned sessionStorage) keeps showing the login after sign-in.",
       "",
       "Next: in src/routes/__root.tsx, import AuthLayout and wrap <Outlet /> with it. Keep any existing providers.",
       "",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helloleo/plugins",
-  "version": "0.2.8",
+  "version": "0.2.9",
   "description": "OpenCode plugins for HelloLeo",
   "license": "UNLICENSED",
   "type": "module",

package/src/tools/setup-netsuite.ts

@@ -74,28 +74,51 @@ export function signInWithNetSuite(returnTo: string = window.location.href) {
       'VITE_WORKER_URL is not set. HelloLeo Cloud must be provisioned before sign-in works.',
     );
   }
+  const workerOrigin = new URL(WORKER_URL).origin;
   const url = new URL(\`\${WORKER_URL.replace(/\\/$/, '')}/auth/netsuite/start\`);
   url.searchParams.set('return_to', returnTo);
-  // The app usually renders inside the HelloLeo preview iframe. NetSuite's
-  // OAuth page sets X-Frame-Options: DENY, so navigating the iframe to the
-  // Worker (which 302s to NetSuite) ends up loading a page the browser
-  // refuses to render -- looks like "nothing happens" to the user. Navigate
-  // the top frame instead so the OAuth flow runs at the top level and the
-  // callback redirect lands on the same top frame, which then reads the
-  // #nssid= fragment. Use \`location.href =\` (NOT \`location.assign()\`):
-  // reading the \`.assign\` method off a cross-origin \`window.top.location\`
-  // throws a SecurityError, which would drop us into the same-frame fallback
-  // and load NetSuite inside the iframe (X-Frame-Options: DENY -> "refused to
-  // connect"). Assigning \`.href\` is a navigation, allowed cross-origin.
-  try {
-    if (window.top && window.top !== window) {
-      window.top.location.href = url.toString();
-      return;
+  // popup=1 tells the Worker callback to postMessage the session id back to
+  // THIS window (then close) instead of a #nssid= redirect.
+  url.searchParams.set('popup', '1');
+
+  // Open OAuth in a POPUP -- not the iframe, not the top frame. NetSuite's OAuth
+  // page is X-Frame-Options: DENY (can't load in an iframe), and navigating the
+  // TOP frame replaces the HelloLeo preview and lands the session in a DIFFERENT
+  // browsing context -- so back in the preview iframe (its own partitioned
+  // sessionStorage) you still see the login even after signing in. A popup keeps
+  // the app + preview intact and hands the token back to this exact context.
+  const popup = window.open(
+    url.toString(),
+    'netsuite-oauth',
+    'width=600,height=760,menubar=no,toolbar=no',
+  );
+
+  if (!popup) {
+    // Popup blocked -> fall back to top-frame navigation (works first-party / in
+    // a standalone tab; the callback then uses the #nssid= redirect).
+    try {
+      if (window.top && window.top !== window) {
+        window.top.location.href = url.toString();
+        return;
+      }
+    } catch {
+      /* top window not accessible */
     }
-  } catch {
-    /* top window not accessible — fall through to same-frame navigation */
+    window.location.href = url.toString();
+    return;
   }
-  window.location.href = url.toString();
+
+  const onMessage = (event: MessageEvent) => {
+    if (event.origin !== workerOrigin) return;
+    const data = event.data as { type?: string; nssid?: string } | null;
+    if (!data || data.type !== 'netsuite-auth' || !data.nssid) return;
+    try { sessionStorage.setItem(TOKEN_KEY, data.nssid); } catch {}
+    window.removeEventListener('message', onMessage);
+    try { popup.close(); } catch {}
+    // Re-render as signed-in -- the auth provider re-checks /api/me on load.
+    window.location.reload();
+  };
+  window.addEventListener('message', onMessage);
 }
 
 export interface NetSuiteSession {
@@ -388,6 +411,7 @@ export const setupNetsuite = tool({
 			"- Read the session anywhere with useNetSuiteAuth() from src/lib/auth.tsx.",
 			"- Never replace AuthLayout with a password gate. Real OAuth is the only supported login.",
 			"- The auth worker (deployed via the cloudflare-backend MCP) serves /auth/netsuite/start, /auth/netsuite/callback, /api/me and /auth/netsuite/logout. It reads env.NETSUITE_ACCOUNT_ID, _CLIENT_ID and _CLIENT_SECRET. VITE_WORKER_URL must be set (HelloLeo Cloud seeds it).",
+			"- POPUP FLOW (required so login works inside the HelloLeo preview iframe): the client opens /auth/netsuite/start in a popup with ?popup=1. The worker MUST carry that flag through OAuth (persist it on the flow row in /start, read it back in /callback via state). In /auth/netsuite/callback, when the flow was popup, DO NOT redirect to return_to#nssid — instead return an HTML page whose script does: window.opener.postMessage({ type: 'netsuite-auth', nssid: SID }, '*'); window.close(); (fall back to the return_to#nssid redirect only when there is no opener / not a popup). Without this, the preview iframe (partitioned sessionStorage) keeps showing the login after sign-in.",
 			"",
 			"Next: in src/routes/__root.tsx, import AuthLayout and wrap <Outlet /> with it. Keep any existing providers.",
 			"",