@ikonai/sdk-react-ui 1.3.1 → 1.3.3

package/auth/auth-service.d.ts

@@ -154,22 +154,3 @@ export declare function verifyPasskeyAuthentication(authUrl: string, response: A
  * existed, which is also where app bundles shipping an older SDK copy stay.
  */
 export declare function revokeSessionOnServer(token: string, authUrlOverride?: string): Promise<void>;
-/**
- * True when this document is nested in another. A sign-in cannot be a same-tab redirect here: the
- * provider's consent screen sets X-Frame-Options and would simply refuse to paint.
- *
- * A cross-origin parent makes the property access itself throw, which is the embedded case too.
- */
-export declare function isEmbedded(): boolean;
-/**
- * Run the OAuth sign-in in a popup and resolve with the code it comes back with.
- *
- * The popup goes to the auth host directly rather than through an app's same-origin auth proxy: it
- * is a top-level window, so there is no CORS to avoid, and the return has to land on the auth
- * origin — the one origin that is allowed for every app, whatever address the app itself is on.
- * The verifier for the code stays in THIS document, so the exchange must also happen here.
- */
-export declare function runOAuthPopup(provider: LoginMethod, spaceId: string): Promise<{
-    code: string;
-    provider: LoginMethod;
-}>;

package/auth/oauth-continuation.d.ts

@@ -8,16 +8,30 @@ export declare const OAUTH_CONTINUE_PARAM = "ikon-oauth";
  * be looking at while they decide. So it parks the request and bounces the browser back here with a
  * pointer to it; the SDK raises the login prompt it already has; and a completed sign-in reports back.
  *
- * The pointer is stashed in sessionStorage rather than left in the URL because signing in with an
- * external provider navigates away and back, which is the same reason the pending-call handoff exists.
- * It is not a credential: it names a parked authorization, and the user binding is made server-side from
- * the token sent below, so a leaked pointer authorizes nobody.
+ * The pointer is kept in BOTH the URL and sessionStorage until the flow ends, and that redundancy is
+ * the point. Signing in with an external provider hands the browser to another origin and back, and
+ * what comes back is not always the same browsing context — a popup, a reopened tab, a session-storage
+ * partition we did not choose. Storage alone lost the pointer in exactly that case, and because the
+ * param had already been stripped there was nothing left to recover it from: the authorization sat
+ * parked, the client waited for a code forever, and the user saw an ordinary app with no sign of it.
+ *
+ * The URL copy is what survives, because the sign-in return URL is built from the current location.
+ * That is safe here for a reason this flow states explicitly elsewhere: the pointer is NOT a
+ * credential. It names a parked authorization, and the user binding is made server-side from the
+ * session token posted below, so a copied or referrer-leaked pointer authorizes nobody. It is cleared
+ * from both places the moment the flow finishes or fails.
  */
 export declare function captureOAuthContinuation(): boolean;
 export declare function hasPendingOAuthContinuation(): boolean;
 /**
  * Report the completed sign-in and hand the browser to the consent screen.
  *
+ * The token is passed in rather than read from storage. A signed-in browser does not necessarily have
+ * one there: a session backed by a refresh cookie is held in memory and its localStorage record is
+ * deliberately REMOVED, so reading storage returned null for a fully signed-in user and the handoff
+ * waited for a session that was never going to appear. The auth context holds the live token either
+ * way, so it is the only source that is right for both.
+ *
  * Only ever called after a REAL sign-in — `useAuthGuard` treats an anonymous session as not satisfying a
  * prompt, which is the guest/global exclusion this flow needs and already had. A `global` visitor is one
  * shared space-wide user, so authorizing as one would hand every client the same identity.
@@ -25,4 +39,4 @@ export declare function hasPendingOAuthContinuation(): boolean;
  * Failure clears the pointer and returns false: the app then carries on as a normally signed-in session
  * rather than trapping the user in a flow that cannot finish.
  */
-export declare function completeOAuthContinuation(): Promise<boolean>;
+export declare function completeOAuthContinuation(token: string | null): Promise<boolean>;

package/auth/use-auth-guard.d.ts

@@ -37,6 +37,13 @@ export interface UseAuthGuardResult {
      * Dismiss an on-demand login prompt and return to the app. No effect on a hard sign-in wall.
      */
     dismissLoginPrompt: () => void;
+    /**
+     * Why the prompt was raised, when whoever raised it said. Render it: a sign-in screen that appears
+     * without explanation is one a person cannot judge. Someone sent here by an application asking to
+     * act on their behalf needs to know that is what they are agreeing to before they choose an account,
+     * not after.
+     */
+    loginPromptReason: string | null;
 }
 /**
  * Headless hook for route protection logic.