@openkey/sdk 0.11.0 → 0.12.0-beta.1

package/dist/index.mjs

@@ -1,32 +1,32 @@
 // ../core/dist/index.js
-var u = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
-function g(e) {
-  let r = "", n = e.length;
-  for (let t = 0; t < n; t += 3) {
-    let c = e[t], d = t + 1 < n ? e[t + 1] : 0, i = t + 2 < n ? e[t + 2] : 0, o = c << 16 | d << 8 | i;
-    r += u[o >> 18 & 63], r += u[o >> 12 & 63], r += t + 1 < n ? u[o >> 6 & 63] : "", r += t + 2 < n ? u[o & 63] : "";
-  }
-  return r.replace(/\+/g, "-").replace(/\//g, "_");
+var y = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+function u(e) {
+  let n = "", t = e.length;
+  for (let r = 0; r < t; r += 3) {
+    let i = e[r], s = r + 1 < t ? e[r + 1] : 0, a = r + 2 < t ? e[r + 2] : 0, c = i << 16 | s << 8 | a;
+    n += y[c >> 18 & 63], n += y[c >> 12 & 63], n += r + 1 < t ? y[c >> 6 & 63] : "", n += r + 2 < t ? y[c & 63] : "";
+  }
+  return n.replace(/\+/g, "-").replace(/\//g, "_");
 }
-function y() {
+function B() {
   let e = new Uint8Array(32);
-  return crypto.getRandomValues(e), g(e);
+  return crypto.getRandomValues(e), u(e);
 }
-async function x(e) {
-  let n = new TextEncoder().encode(e), t = await crypto.subtle.digest("SHA-256", n);
-  return new Uint8Array(t);
+async function I(e) {
+  let t = new TextEncoder().encode(e), r = await crypto.subtle.digest("SHA-256", t);
+  return new Uint8Array(r);
 }
-async function k(e, r) {
-  let t = await (r ?? x)(e);
-  return g(t);
+async function W(e, n) {
+  let r = await (n ?? I)(e);
+  return u(r);
 }
-function m() {
+function j() {
   let e = new Uint8Array(16);
-  return crypto.getRandomValues(e), g(e);
+  return crypto.getRandomValues(e), u(e);
 }
-function T(e) {
-  let { host: r, clientId: n, redirectUri: t, codeChallenge: c, state: d, scopes: i, authorizePath: o = "/api/auth/oauth2/authorize" } = e, s = new URL(o, r);
-  return s.searchParams.set("client_id", n), s.searchParams.set("redirect_uri", t), s.searchParams.set("response_type", "code"), s.searchParams.set("scope", i.join(" ")), s.searchParams.set("state", d), s.searchParams.set("code_challenge", c), s.searchParams.set("code_challenge_method", "S256"), s.toString();
+function G(e) {
+  let { host: n, clientId: t, redirectUri: r, codeChallenge: i, state: s, scopes: a, authorizePath: c = "/api/auth/oauth2/authorize" } = e, d = new URL(c, n);
+  return d.searchParams.set("client_id", t), d.searchParams.set("redirect_uri", r), d.searchParams.set("response_type", "code"), d.searchParams.set("scope", a.join(" ")), d.searchParams.set("state", s), d.searchParams.set("code_challenge", i), d.searchParams.set("code_challenge_method", "S256"), d.toString();
 }
 
 // src/nostr.ts
@@ -230,6 +230,33 @@ var OpenKeyNostr = class {
   }
 };
 
+// src/popup-capability.ts
+function isEmbeddedAppWebView(env) {
+  const target = env ?? (typeof window === "undefined" ? void 0 : window);
+  if (!target) return false;
+  if (target.Capacitor?.isNativePlatform?.() === true) return true;
+  if (target.ReactNativeWebView) return true;
+  const userAgent = target.navigator?.userAgent ?? "";
+  if (/\bAndroid\b[^)]*;\s*wv\b/.test(userAgent)) return true;
+  if (/\b(iPhone|iPad|iPod)\b/.test(userAgent) && /AppleWebKit/.test(userAgent) && !/Safari\//.test(userAgent)) {
+    return true;
+  }
+  return false;
+}
+function isUsablePopup(popup) {
+  return !!popup && popup.closed !== true;
+}
+function popupUnavailableError(embeddedWebView) {
+  if (embeddedWebView) {
+    return {
+      code: "POPUP_BLOCKED",
+      message: "Popups are not available in this embedded app WebView. Make sure the OpenKey host is allowed by frame-src, or use native sign-in.",
+      reason: "embedded-webview"
+    };
+  }
+  return { code: "POPUP_BLOCKED", message: "Popup was blocked. Please allow popups for this site." };
+}
+
 // src/index.ts
 function passkeysQueryFlag(passkeysSupported) {
   return passkeysSupported ? "" : "&passkeys=false";
@@ -286,9 +313,9 @@ function resolveAuthorizeTinyCloudRouting(state) {
   const requestKeyId = rawRequestKeyId && rawRequestKeyId.length > 0 ? rawRequestKeyId : null;
   const knownKeys = state.knownKeys ?? [];
   const lookupType = (id) => {
-    for (const k2 of knownKeys) {
-      if (k2.id === id) return k2.keyType;
-      if (k2.address && k2.address.toLowerCase() === id.toLowerCase()) return k2.keyType;
+    for (const k of knownKeys) {
+      if (k.id === id) return k.keyType;
+      if (k.address && k.address.toLowerCase() === id.toLowerCase()) return k.keyType;
     }
     if (id.startsWith("external:")) return "EXTERNAL";
     return null;
@@ -651,6 +678,12 @@ var OpenKey = class {
    * the SDK never holds an OpenKey session token. Local SDK state is cleared
    * before opening the widget, including when remote revocation is
    * unavailable.
+   *
+   * Rejects without waiting for the timeout when the widget cannot be shown
+   * (code `POPUP_BLOCKED`): the iframe did not load and the popup fallback is
+   * blocked, or the app is an embedded WebView that cannot open popups.
+   * Remote revocation did not happen then, so clearing any app session is the
+   * caller's decision.
    */
   async signOut(opts) {
     const requestId = `ok-signout-${Date.now()}-${Math.random().toString(36).slice(2, 9)}`;
@@ -1045,14 +1078,14 @@ var OpenKey = class {
      * @returns Promise that resolves with authorization code after user consent
      */
     connect: async (config) => {
-      const verifier = y();
-      const challenge = await k(verifier);
-      const state = config.state || m();
+      const verifier = B();
+      const challenge = await W(verifier);
+      const state = config.state || j();
       sessionStorage.setItem(
         OAUTH_STORAGE_KEY,
         JSON.stringify({ verifier, state })
       );
-      const authUrl = T({
+      const authUrl = G({
         host: this.oauthHost,
         clientId: config.clientId,
         redirectUri: config.redirectUri,
@@ -1141,19 +1174,19 @@ var OpenKey = class {
   openOAuthPopup(url, state, redirectUri, resolve, reject) {
     const left = window.screenX + (window.outerWidth - POPUP_WIDTH) / 2;
     const top = window.screenY + (window.outerHeight - POPUP_HEIGHT) / 2;
-    this.popup = window.open(
+    const popup = window.open(
       url,
       "openkey-oauth",
       `width=${POPUP_WIDTH},height=${POPUP_HEIGHT},left=${left},top=${top},popup=true`
     );
-    if (!this.popup) {
-      showToast("Popup was blocked. Please allow popups for this site.", "error");
-      reject({
-        code: "POPUP_BLOCKED",
-        message: "Popup was blocked. Please allow popups or use redirect mode."
-      });
+    if (!isUsablePopup(popup)) {
+      this.popup = null;
+      const embedded = isEmbeddedAppWebView();
+      if (!embedded) showToast("Popup was blocked. Please allow popups for this site.", "error");
+      reject(embedded ? popupUnavailableError(true) : { code: "POPUP_BLOCKED", message: "Popup was blocked. Please allow popups or use redirect mode." });
       return;
     }
+    this.popup = popup;
     const redirectHost = new URL(redirectUri).origin;
     const pollInterval = setInterval(() => {
       try {
@@ -1337,6 +1370,11 @@ var OpenKey = class {
       const readyTimeout = setTimeout(() => {
         if (readyReceived || settled) return;
         cleanup();
+        if (isEmbeddedAppWebView()) {
+          console.warn("OpenKey: iframe did not load in an embedded app WebView, which cannot open a popup. Add frame-src https://openkey.so to your CSP.");
+          settle(() => reject(popupUnavailableError(true)));
+          return;
+        }
         console.warn("OpenKey: iframe blocked by CSP, falling back to popup. Add frame-src https://openkey.so to your CSP.");
         showToast();
         const popupUrl = `${this.host}/widget/${action}?origin=${origin}${passkeysQueryFlag(this.passkeysSupported)}`;
@@ -1435,15 +1473,14 @@ var OpenKey = class {
       `openkey-${action}-${Date.now()}-${Math.random().toString(36).slice(2, 9)}`,
       `width=${POPUP_WIDTH},height=${POPUP_HEIGHT},left=${left},top=${top},popup=true`
     );
-    this.popup = popup;
-    if (!popup) {
-      showToast("Popup was blocked. Please allow popups for this site.", "error");
-      reject({
-        code: "POPUP_BLOCKED",
-        message: "Popup was blocked. Please allow popups for this site."
-      });
+    if (!isUsablePopup(popup)) {
+      this.popup = null;
+      const embedded = isEmbeddedAppWebView();
+      if (!embedded) showToast("Popup was blocked. Please allow popups for this site.", "error");
+      reject(popupUnavailableError(embedded));
       return;
     }
+    this.popup = popup;
     let settled = false;
     let cancel;
     const cleanup = () => {