@nebulr-group/bridge-svelte 0.8.0 → 0.8.2

package/dist/client/components/sdk-auth/MagicLink.svelte

@@ -1,4 +1,5 @@
 <script lang="ts">
+  import { onMount } from 'svelte';
   import type { HTMLAttributes } from 'svelte/elements';
   import type { MessageOverrides } from '@nebulr-group/bridge-auth-core';
   import { getBridgeAuth } from '../../../core/bridge-instance.js';
@@ -65,6 +66,37 @@
     }
   }
 
+  // TBP-682: the emailed link returns to the page the request was made from,
+  // so this component must redeem it as well as send it. Without this branch a
+  // link requested here lands back here and does nothing — the token sits in
+  // the address bar and the user stays signed out. Mirrors LoginForm, which
+  // has always redeemed on mount.
+  onMount(async () => {
+    if (typeof window === 'undefined') return;
+
+    const params = new URLSearchParams(window.location.search);
+    const magicToken = params.get('bridge_magic_link_token');
+    if (!magicToken) return;
+
+    // Drop the token from the URL before redeeming, so a reload or a shared
+    // link cannot replay it.
+    params.delete('bridge_magic_link_token');
+    const newSearch = params.toString();
+    window.history.replaceState({}, '', window.location.pathname + (newSearch ? `?${newSearch}` : ''));
+
+    loading = true;
+    error = null;
+    try {
+      await getBridgeAuth().authenticateWithMagicLinkToken(magicToken);
+      // Auth state drives what the host app renders next, as with LoginForm.
+    } catch (err: any) {
+      error = authErrorMessage(err, t, 'magicLink.error.auth');
+      onError?.(err);
+    } finally {
+      loading = false;
+    }
+  });
+
   function formatExpiry(seconds: number): string {
     if (seconds >= 60) {
       const count = Math.floor(seconds / 60);

package/dist/core/bridge-runtime.js

@@ -303,8 +303,16 @@ export function startBridgeRuntime(options = {}) {
         // TBP-660 — the TOKEN refresh above is skipped for a self-induced
         // reconnect; the STATE catch-up is not. Losing pushes is a property of
         // the socket swap, whoever caused it, and the catch-up cannot loop.
-        if (_connectedOnce)
-            requestCatchUp();
+        //
+        // TBP-686 — and it runs on the FIRST connect too. It used to be gated on
+        // `_connectedOnce`, which read as "only repair a reconnect" — but the
+        // first connect is exactly where the snapshot goes missing: the server
+        // publishes it fire-and-forget during authorize, before the subscription
+        // is live, so it loses the race and there is nothing to replay. The result
+        // was a signed-in page with a null workspace id, name and branding for the
+        // whole session. `requestCatchUp` already returns early when signed out
+        // and coalesces concurrent calls, so this costs one request per session.
+        requestCatchUp();
         _connectedOnce = true;
         for (const fn of _onOpenSubs) {
             try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nebulr-group/bridge-svelte",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "description": "Bridge Svelte library, This library helps you to add bridge authentication and feature flags, and payments to your svelte application.",
   "author": "Iman Pouya",
   "license": "MIT",
@@ -58,7 +58,7 @@
     "svelte": "^5.0.0",
     "@sveltejs/kit": "^2.0.0",
     "@stripe/stripe-js": ">=4.0.0",
-    "@nebulr-group/bridge-auth-core": ">=0.7.0-beta.0 <1.0.0"
+    "@nebulr-group/bridge-auth-core": ">=0.7.1 <1.0.0"
   },
   "peerDependenciesMeta": {
     "@stripe/stripe-js": {
@@ -79,7 +79,7 @@
     "typescript": "^6.0.0",
     "vite": "^6.2.6",
     "vitest": "^4.1.4",
-    "@nebulr-group/bridge-auth-core": "0.7.0"
+    "@nebulr-group/bridge-auth-core": "0.7.2"
   },
   "keywords": [
     "svelte",