@microsoft/rayfin-auth-provider-fabric 1.34.0-beta.0 → 1.34.0

package/dist/brokerUrl.d.ts

@@ -1,14 +1,16 @@
 import type { FabricAuthOptions } from './types.js';
 /**
- * Constructs the broker launch URL with PKCE and state parameters.
+ * Constructs the broker launch URL for the chromeless SecureItemEmbed view.
  *
- * Preserves any existing path and query parameters on `fabricPortalUrl`,
- * appends the artifact deep-link path, and adds PKCE query parameters.
+ * Uses the SecureItemEmbed path so the popup renders without Fabric portal
+ * chrome (navigation, ribbon).  Preserves any existing query parameters on
+ * `fabricPortalUrl` and adds artifact identification + extensionPath.
+ *
+ * PKCE parameters are no longer included in the URL — they are delivered to
+ * the extension via the postMessage challenge flow (`brokeredAuth.challenge`).
  *
  * @param options - Auth options (workspace/project IDs, portal URL).
- * @param codeChallenge - PKCE S256 code challenge.
- * @param state - CSRF/correlation state nonce.
  * @returns Fully constructed broker URL.
  */
-export declare function buildBrokerUrl(options: FabricAuthOptions, codeChallenge: string, state: string): string;
+export declare function buildBrokerUrl(options: FabricAuthOptions): string;
 //# sourceMappingURL=brokerUrl.d.ts.map

package/dist/brokerUrl.js

@@ -1,31 +1,30 @@
 /**
- * Constructs the broker launch URL with PKCE and state parameters.
+ * Constructs the broker launch URL for the chromeless SecureItemEmbed view.
  *
- * Preserves any existing path and query parameters on `fabricPortalUrl`,
- * appends the artifact deep-link path, and adds PKCE query parameters.
+ * Uses the SecureItemEmbed path so the popup renders without Fabric portal
+ * chrome (navigation, ribbon).  Preserves any existing query parameters on
+ * `fabricPortalUrl` and adds artifact identification + extensionPath.
+ *
+ * PKCE parameters are no longer included in the URL — they are delivered to
+ * the extension via the postMessage challenge flow (`brokeredAuth.challenge`).
  *
  * @param options - Auth options (workspace/project IDs, portal URL).
- * @param codeChallenge - PKCE S256 code challenge.
- * @param state - CSRF/correlation state nonce.
  * @returns Fully constructed broker URL.
  */
-export function buildBrokerUrl(options, codeChallenge, state) {
+export function buildBrokerUrl(options) {
     const portalUrl = new URL(options.fabricPortalUrl);
-    // Append artifact deep-link path with /BrokeredAuth route segment.
-    // Query params are preserved for backward compatibility with older
-    // AppBackend versions that detect broker mode via parseBrokerParams.
+    // Use the chromeless SecureItemEmbed path instead of the full portal
+    // deep-link so the popup renders without Fabric navigation chrome.
     const basePath = portalUrl.pathname.replace(/\/$/, '');
-    const artifactPath = `/groups/${encodeURIComponent(options.workspaceId)}/appbackends/${encodeURIComponent(options.projectId)}/brokeredauth`;
-    portalUrl.pathname = `${basePath}${artifactPath}`;
-    // `returnOrigin` must be a bare origin (scheme + host + port) — used as
-    // the postMessage targetOrigin and the redirect target for legacy brokers.
-    portalUrl.searchParams.set('returnOrigin', options.returnOrigin);
-    // Fallback redirect URL for legacy brokers that don't use postMessage.
-    const callbackUrl = options.callbackUrl || `${options.returnOrigin}/auth/callback`;
-    portalUrl.searchParams.set('callbackUrl', callbackUrl);
-    portalUrl.searchParams.set('code_challenge', codeChallenge);
-    portalUrl.searchParams.set('code_challenge_method', 'S256');
-    portalUrl.searchParams.set('state', state);
+    portalUrl.pathname = `${basePath}/secureItemEmbed`;
+    // Artifact identification for SecureItemEmbed
+    portalUrl.searchParams.set('workspaceId', options.workspaceId);
+    portalUrl.searchParams.set('itemType', 'AppBackend');
+    portalUrl.searchParams.set('itemId', options.projectId);
+    // Route the extension to the dedicated BrokeredAuthPage.
+    // PKCE parameters are delivered via postMessage (brokeredAuth.challenge),
+    // not through the URL, so only the path is needed here.
+    portalUrl.searchParams.set('extensionPath', '/brokeredauth');
     return portalUrl.toString();
 }
 //# sourceMappingURL=brokerUrl.js.map

package/dist/initiateFabricLogin.d.ts

@@ -5,14 +5,17 @@ import type { FabricAuthOptions } from './types.js';
  *
  * **Must be called inside a user click handler** to avoid popup blockers.
  *
- * Generates PKCE params, opens the broker URL, and listens for a
- * `brokeredAuth.handoff` postMessage. On handoff, exchanges the code for
- * tokens and creates a session. The `code_verifier` is kept in closure only.
+ * Opens the popup synchronously in the gesture (Safari/iOS block `window.open`
+ * after an `await`) and delivers the PKCE challenge via the
+ * `brokeredAuth.challenge` postMessage. On `brokeredAuth.handoff`, exchanges
+ * the code for tokens and creates a session. `code_verifier` stays in closure.
  *
  * @param auth - Auth instance for token exchange.
  * @param options - Broker auth options (`returnOrigin` required).
  * @returns Resolves when the session is established.
- * @throws `AuthError` - On missing options, blocked popup, or auth failure.
+ * @throws `AuthError` - On missing options, blocked popup, PKCE preparation or
+ *   delivery failure (`PKCE_CHALLENGE_FAILED`, `CHALLENGE_DELIVERY_FAILED`), or
+ *   auth failure.
  */
 export declare function initiateFabricLogin(auth: Auth, options: FabricAuthOptions): Promise<void>;
 //# sourceMappingURL=initiateFabricLogin.d.ts.map

package/dist/initiateFabricLogin.js

@@ -8,14 +8,17 @@ import { buildBrokerUrl } from './brokerUrl.js';
  *
  * **Must be called inside a user click handler** to avoid popup blockers.
  *
- * Generates PKCE params, opens the broker URL, and listens for a
- * `brokeredAuth.handoff` postMessage. On handoff, exchanges the code for
- * tokens and creates a session. The `code_verifier` is kept in closure only.
+ * Opens the popup synchronously in the gesture (Safari/iOS block `window.open`
+ * after an `await`) and delivers the PKCE challenge via the
+ * `brokeredAuth.challenge` postMessage. On `brokeredAuth.handoff`, exchanges
+ * the code for tokens and creates a session. `code_verifier` stays in closure.
  *
  * @param auth - Auth instance for token exchange.
  * @param options - Broker auth options (`returnOrigin` required).
  * @returns Resolves when the session is established.
- * @throws `AuthError` - On missing options, blocked popup, or auth failure.
+ * @throws `AuthError` - On missing options, blocked popup, PKCE preparation or
+ *   delivery failure (`PKCE_CHALLENGE_FAILED`, `CHALLENGE_DELIVERY_FAILED`), or
+ *   auth failure.
  */
 export async function initiateFabricLogin(auth, options) {
     assertBrowser('initiateFabricLogin');
@@ -32,12 +35,17 @@ export async function initiateFabricLogin(auth, options) {
     if (!options.fabricPortalUrl) {
         throw new AuthError('fabricPortalUrl is required for Fabric authentication.', 'MISSING_FABRIC_PORTAL_URL');
     }
-    // PKCE + state
+    // Generate verifier + state synchronously so the popup can open in the user
+    // gesture below. The S256 challenge is computed async (off the click path)
+    // and delivered later via the `brokeredAuth.challenge` postMessage —
+    // awaiting before `window.open` would trip Safari/iOS popup blocking.
     const codeVerifier = generateCodeVerifier();
-    const codeChallenge = await generateCodeChallenge(codeVerifier);
     const state = generateState();
+    const codeChallengePromise = generateCodeChallenge(codeVerifier);
+    // Mark rejection handled for paths that skip handleReady; real handling is there.
+    codeChallengePromise.catch(() => { });
     const expectedBrokerOrigin = new URL(options.fabricPortalUrl).origin;
-    const brokerUrl = buildBrokerUrl(options, codeChallenge, state);
+    const brokerUrl = buildBrokerUrl(options);
     return new Promise((resolve, reject) => {
         let fabricWindow = null;
         let channel = null;
@@ -118,7 +126,7 @@ export async function initiateFabricLogin(auth, options) {
          * cross-origin iframe inside the popup — `postMessage` sent to the
          * popup's top-level window does not propagate to child iframes.
          */
-        function handleReady(event) {
+        async function handleReady(event) {
             if (readyHandled)
                 return;
             if (!event.data || typeof event.data !== 'object')
@@ -132,6 +140,18 @@ export async function initiateFabricLogin(auth, options) {
             }
             readyHandled = true;
             window.removeEventListener('message', handleReady);
+            // Challenge computed off the click path; await it here (almost always
+            // already resolved by the time the broker signals ready).
+            let codeChallenge;
+            try {
+                codeChallenge = await codeChallengePromise;
+            }
+            catch (err) {
+                console.warn('[FabricAuth] Failed to compute PKCE code challenge', err);
+                cleanup();
+                reject(new AuthError('Failed to prepare Fabric authentication.', 'PKCE_CHALLENGE_FAILED'));
+                return;
+            }
             const challengePayload = {
                 type: 'brokeredAuth.challenge',
                 returnOrigin: options.returnOrigin,
@@ -139,16 +159,29 @@ export async function initiateFabricLogin(auth, options) {
                 codeChallengeMethod: 'S256',
                 state,
             };
-            // Reply to the window that sent the ready signal (the extension iframe).
-            const source = event.source;
-            if (source) {
-                source.postMessage(challengePayload, event.origin || '*');
-                console.debug(`[FabricAuth] Sent brokeredAuth.challenge to event.source (origin=${event.origin || '*'})`);
+            // Deliver the challenge. Guard postMessage: an opaque/sandboxed sender
+            // reports event.origin === 'null' (an invalid targetOrigin that throws),
+            // and this listener is async so a throw is swallowed by the DOM rather
+            // than rejecting the outer promise — the flow would hang until timeout.
+            try {
+                // Normalize 'null'/empty origin to '*'; valid origins pass through.
+                const targetOrigin = event.origin && event.origin !== 'null' ? event.origin : '*';
+                // Reply to the window that sent the ready signal (the extension iframe).
+                const source = event.source;
+                if (source) {
+                    source.postMessage(challengePayload, targetOrigin);
+                    console.debug(`[FabricAuth] Sent brokeredAuth.challenge to event.source (origin=${targetOrigin})`);
+                }
+                else if (fabricWindow && !fabricWindow.closed) {
+                    // Fallback when event.source is unavailable: post to the popup.
+                    fabricWindow.postMessage(challengePayload, expectedBrokerOrigin);
+                    console.debug('[FabricAuth] Sent brokeredAuth.challenge to fabricWindow (event.source unavailable)');
+                }
             }
-            else if (fabricWindow && !fabricWindow.closed) {
-                // Fallback: if event.source is unavailable, try the popup directly.
-                fabricWindow.postMessage(challengePayload, expectedBrokerOrigin);
-                console.debug('[FabricAuth] Sent brokeredAuth.challenge to fabricWindow (event.source unavailable)');
+            catch (err) {
+                console.warn('[FabricAuth] Failed to deliver PKCE challenge', err);
+                cleanup();
+                reject(new AuthError('Failed to deliver Fabric authentication challenge.', 'CHALLENGE_DELIVERY_FAILED'));
             }
         }
         // Listen for brokeredAuth.ready from the popup (postMessage PKCE).
@@ -164,7 +197,7 @@ export async function initiateFabricLogin(auth, options) {
         catch {
             console.debug('[FabricAuth] BroadcastChannel not available — relying on postMessage only');
         }
-        // Open broker portal in a centered popup
+        // Open the chromeless SecureItemEmbed broker URL in a centered popup.
         const popupWidth = 600;
         const popupHeight = 700;
         const left = Math.round(window.screenX + (window.outerWidth - popupWidth) / 2);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@microsoft/rayfin-auth-provider-fabric",
-  "version": "1.34.0-beta.0",
+  "version": "1.34.0",
   "description": "Fabric brokered authentication provider for Rayfin SDK",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -13,9 +13,9 @@
   ],
   "type": "module",
   "dependencies": {
-    "@microsoft/rayfin-auth": "1.34.0-beta.0",
-    "@microsoft/fabric-embedded-host": "1.34.0-beta.0",
-    "@microsoft/rayfin-lib": "1.34.0-beta.0"
+    "@microsoft/rayfin-auth": "1.34.0",
+    "@microsoft/fabric-embedded-host": "1.34.0",
+    "@microsoft/rayfin-lib": "1.34.0"
   },
   "devDependencies": {
     "typescript": "^5.8.3",