@lumiapassport/ui-kit 1.16.1 → 1.16.2

package/dist/iframe/index.html

@@ -15,7 +15,7 @@
     <meta http-equiv="X-Content-Type-Options" content="nosniff" />
     <meta http-equiv="Referrer-Policy" content="strict-origin-when-cross-origin" />
 
-    <title>Lumia Passport Secure Wallet - iframe version 1.16.1</title>
+    <title>Lumia Passport Secure Wallet - iframe version 1.16.2</title>
 
     <!-- Styles will be injected by build process -->
     <style>

package/dist/iframe/main.js

@@ -4411,7 +4411,7 @@ var SigningManager = class extends TokenRefreshApiClient {
 };
 
 // src/iframe/main.ts
-var IFRAME_VERSION = "1.16.1";
+var IFRAME_VERSION = "1.16.2";
 var IframeWallet = class {
   constructor() {
     console.log("=".repeat(60));

package/dist/iframe/oauth/x.js

@@ -153,6 +153,8 @@ async function startOAuthFlow() {
 /**
  * Handle successful OAuth after backend redirect
  * Backend processes callback and redirects back with success=true
+ * If authCode is present, exchanges it for tokens (Safari ITP fix)
+ * Otherwise falls back to cookie-based verify (desktop browsers)
  */
 async function handleBackendSuccess() {
   try {
@@ -166,32 +168,88 @@ async function handleBackendSuccess() {
       throw new Error('Missing TSS URL. Check build-time configuration.');
     }
 
-    // Verify the session was created by checking auth endpoint
-    const verifyEndpoint = PROJECT_ID
-      ? `${TSS_URL}/api/auth/verify?projectId=${encodeURIComponent(PROJECT_ID)}`
-      : `${TSS_URL}/api/auth/verify`;
+    // Check for auth code (new flow for Safari ITP compatibility)
+    const authCode = urlParams.get('authCode');
+    let userData;
+    let tokens = null;
 
-    const verifyResponse = await fetch(verifyEndpoint, {
-      method: 'GET',
-      credentials: 'include',
-    });
+    if (authCode) {
+      // New flow: Exchange auth code for tokens (fixes Safari ITP issues)
+      console.log('[X OAuth] Auth code present, exchanging for tokens...');
+
+      const exchangeEndpoint = PROJECT_ID
+        ? `${TSS_URL}/api/auth/exchange-code?projectId=${encodeURIComponent(PROJECT_ID)}`
+        : `${TSS_URL}/api/auth/exchange-code`;
+
+      const exchangeResponse = await fetch(exchangeEndpoint, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ code: authCode })
+      });
+
+      if (!exchangeResponse.ok) {
+        const errorData = await exchangeResponse.json().catch(() => ({}));
+        console.error('[X OAuth] Code exchange failed:', exchangeResponse.status, errorData);
+        throw new Error(errorData.error || 'Failed to exchange auth code');
+      }
+
+      const exchangeData = await exchangeResponse.json();
+      console.log('[X OAuth] Code exchange successful:', { userId: exchangeData.userId, hasKeyshare: exchangeData.hasKeyshare });
+
+      // Extract tokens for postMessage
+      tokens = {
+        accessToken: exchangeData.accessToken,
+        refreshToken: exchangeData.refreshToken
+      };
+
+      // Build userData in the same format as verify endpoint
+      userData = {
+        valid: true,
+        userId: exchangeData.userId,
+        sessionId: exchangeData.sessionId,
+        expiresIn: exchangeData.expiresIn,
+        hasKeyshare: exchangeData.hasKeyshare,
+        displayName: exchangeData.displayName,
+        providers: exchangeData.providers
+      };
+    } else {
+      // Legacy flow: Use cookies (works on desktop browsers)
+      console.log('[X OAuth] No auth code, falling back to cookie-based verify...');
 
-    if (!verifyResponse.ok) {
-      console.error('[X OAuth] Verify failed:', verifyResponse.status);
-      throw new Error('Failed to verify authentication. Session may not be created.');
+      const verifyEndpoint = PROJECT_ID
+        ? `${TSS_URL}/api/auth/verify?projectId=${encodeURIComponent(PROJECT_ID)}`
+        : `${TSS_URL}/api/auth/verify`;
+
+      const verifyResponse = await fetch(verifyEndpoint, {
+        method: 'GET',
+        credentials: 'include',
+      });
+
+      if (!verifyResponse.ok) {
+        console.error('[X OAuth] Verify failed:', verifyResponse.status);
+        throw new Error('Failed to verify authentication. Session may not be created.');
+      }
+
+      userData = await verifyResponse.json();
     }
 
-    const userData = await verifyResponse.json();
     console.log('[X OAuth] Authentication verified:', userData);
 
     // Send success to opener
     if (window.opener) {
-      window.opener.postMessage({
+      const message = {
         type: 'X_AUTH_SUCCESS',
         provider: 'x',
         user: userData,
         mode: MODE
-      }, '*');
+      };
+
+      // Include tokens if we have them (new flow)
+      if (tokens) {
+        message.tokens = tokens;
+      }
+
+      window.opener.postMessage(message, '*');
 
       // Mark that we've sent the auth result
       authResultSent = true;

package/dist/index.cjs

@@ -3380,6 +3380,24 @@ var init_iframe_manager = __esm({
               });
             } else if (event.data.type === "X_AUTH_SUCCESS" && eventProvider === "x" && providerKey === "x") {
               this.log("[IframeManager] X auth successful from popup:", event.data);
+              if (event.data.tokens) {
+                this.log("[IframeManager] Tokens received in postMessage, storing via jwtTokenManager");
+                Promise.resolve().then(() => (init_auth(), auth_exports)).then(({ jwtTokenManager: jwtTokenManager4 }) => {
+                  return jwtTokenManager4.setTokens({
+                    accessToken: event.data.tokens.accessToken,
+                    refreshToken: event.data.tokens.refreshToken,
+                    userId: event.data.user.userId,
+                    expiresIn: event.data.user.expiresIn || 3600,
+                    hasKeyshare: event.data.user.hasKeyshare || false,
+                    displayName: event.data.user.displayName || null,
+                    providers: event.data.user.providers || ["x"]
+                  });
+                }).then(() => {
+                  this.log("[IframeManager] Tokens stored successfully");
+                }).catch((tokenError) => {
+                  this.log("[IframeManager] Warning: Failed to store tokens:", tokenError);
+                });
+              }
               finalize({
                 success: true,
                 user: event.data.user,
@@ -5672,7 +5690,7 @@ function Header() {
 // package.json
 var package_default = {
   name: "@lumiapassport/ui-kit",
-  version: "1.16.1",
+  version: "1.16.2",
   description: "React UI components and hooks for Lumia Passport authentication and Account Abstraction",
   type: "module",
   main: "./dist/index.cjs",