@ikonai/sdk-react-ui 1.3.1 → 1.3.2

package/auth/auth-service.d.ts

@@ -154,22 +154,3 @@ export declare function verifyPasskeyAuthentication(authUrl: string, response: A
  * existed, which is also where app bundles shipping an older SDK copy stay.
  */
 export declare function revokeSessionOnServer(token: string, authUrlOverride?: string): Promise<void>;
-/**
- * True when this document is nested in another. A sign-in cannot be a same-tab redirect here: the
- * provider's consent screen sets X-Frame-Options and would simply refuse to paint.
- *
- * A cross-origin parent makes the property access itself throw, which is the embedded case too.
- */
-export declare function isEmbedded(): boolean;
-/**
- * Run the OAuth sign-in in a popup and resolve with the code it comes back with.
- *
- * The popup goes to the auth host directly rather than through an app's same-origin auth proxy: it
- * is a top-level window, so there is no CORS to avoid, and the return has to land on the auth
- * origin — the one origin that is allowed for every app, whatever address the app itself is on.
- * The verifier for the code stays in THIS document, so the exchange must also happen here.
- */
-export declare function runOAuthPopup(provider: LoginMethod, spaceId: string): Promise<{
-    code: string;
-    provider: LoginMethod;
-}>;

package/auth/oauth-continuation.d.ts

@@ -8,10 +8,18 @@ export declare const OAUTH_CONTINUE_PARAM = "ikon-oauth";
  * be looking at while they decide. So it parks the request and bounces the browser back here with a
  * pointer to it; the SDK raises the login prompt it already has; and a completed sign-in reports back.
  *
- * The pointer is stashed in sessionStorage rather than left in the URL because signing in with an
- * external provider navigates away and back, which is the same reason the pending-call handoff exists.
- * It is not a credential: it names a parked authorization, and the user binding is made server-side from
- * the token sent below, so a leaked pointer authorizes nobody.
+ * The pointer is kept in BOTH the URL and sessionStorage until the flow ends, and that redundancy is
+ * the point. Signing in with an external provider hands the browser to another origin and back, and
+ * what comes back is not always the same browsing context — a popup, a reopened tab, a session-storage
+ * partition we did not choose. Storage alone lost the pointer in exactly that case, and because the
+ * param had already been stripped there was nothing left to recover it from: the authorization sat
+ * parked, the client waited for a code forever, and the user saw an ordinary app with no sign of it.
+ *
+ * The URL copy is what survives, because the sign-in return URL is built from the current location.
+ * That is safe here for a reason this flow states explicitly elsewhere: the pointer is NOT a
+ * credential. It names a parked authorization, and the user binding is made server-side from the
+ * session token posted below, so a copied or referrer-leaked pointer authorizes nobody. It is cleared
+ * from both places the moment the flow finishes or fails.
  */
 export declare function captureOAuthContinuation(): boolean;
 export declare function hasPendingOAuthContinuation(): boolean;

package/auth/use-auth-guard.d.ts

@@ -37,6 +37,13 @@ export interface UseAuthGuardResult {
      * Dismiss an on-demand login prompt and return to the app. No effect on a hard sign-in wall.
      */
     dismissLoginPrompt: () => void;
+    /**
+     * Why the prompt was raised, when whoever raised it said. Render it: a sign-in screen that appears
+     * without explanation is one a person cannot judge. Someone sent here by an application asking to
+     * act on their behalf needs to know that is what they are agreeing to before they choose an account,
+     * not after.
+     */
+    loginPromptReason: string | null;
 }
 /**
  * Headless hook for route protection logic.