@openkey/sdk 0.12.0-beta.0 → 0.12.0-beta.2

package/dist/index.d.mts

@@ -126,6 +126,8 @@ interface SignOutAcknowledgement {
 interface OpenKeyError {
     code: 'USER_CANCELLED' | 'POPUP_BLOCKED' | 'TIMEOUT' | 'NO_KEY' | 'UNAUTHORIZED' | 'UNKNOWN' | 'STATE_MISMATCH';
     message: string;
+    /** On `POPUP_BLOCKED`: `'embedded-webview'` when the page runs in an app WebView that cannot open popups. */
+    reason?: 'embedded-webview';
 }
 /** OAuth configuration for third-party apps */
 interface OAuthConfig {
@@ -388,6 +390,12 @@ declare class OpenKey {
      * the SDK never holds an OpenKey session token. Local SDK state is cleared
      * before opening the widget, including when remote revocation is
      * unavailable.
+     *
+     * Rejects without waiting for the timeout when the widget cannot be shown
+     * (code `POPUP_BLOCKED`): the iframe did not load and the popup fallback is
+     * blocked, or the app is an embedded WebView that cannot open popups.
+     * Remote revocation did not happen then, so clearing any app session is the
+     * caller's decision.
      */
     signOut(opts?: {
         mode?: OpenKeyMode;

package/dist/index.d.ts

@@ -126,6 +126,8 @@ interface SignOutAcknowledgement {
 interface OpenKeyError {
     code: 'USER_CANCELLED' | 'POPUP_BLOCKED' | 'TIMEOUT' | 'NO_KEY' | 'UNAUTHORIZED' | 'UNKNOWN' | 'STATE_MISMATCH';
     message: string;
+    /** On `POPUP_BLOCKED`: `'embedded-webview'` when the page runs in an app WebView that cannot open popups. */
+    reason?: 'embedded-webview';
 }
 /** OAuth configuration for third-party apps */
 interface OAuthConfig {
@@ -388,6 +390,12 @@ declare class OpenKey {
      * the SDK never holds an OpenKey session token. Local SDK state is cleared
      * before opening the widget, including when remote revocation is
      * unavailable.
+     *
+     * Rejects without waiting for the timeout when the widget cannot be shown
+     * (code `POPUP_BLOCKED`): the iframe did not load and the popup fallback is
+     * blocked, or the app is an embedded WebView that cannot open popups.
+     * Remote revocation did not happen then, so clearing any app session is the
+     * caller's decision.
      */
     signOut(opts?: {
         mode?: OpenKeyMode;

package/dist/index.js

@@ -37,9 +37,9 @@ module.exports = __toCommonJS(index_exports);
 var y = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
 function u(e) {
   let n = "", t = e.length;
-  for (let r = 0; r < t; r += 3) {
-    let i = e[r], s = r + 1 < t ? e[r + 1] : 0, a = r + 2 < t ? e[r + 2] : 0, c = i << 16 | s << 8 | a;
-    n += y[c >> 18 & 63], n += y[c >> 12 & 63], n += r + 1 < t ? y[c >> 6 & 63] : "", n += r + 2 < t ? y[c & 63] : "";
+  for (let i = 0; i < t; i += 3) {
+    let r = e[i], s = i + 1 < t ? e[i + 1] : 0, a = i + 2 < t ? e[i + 2] : 0, c = r << 16 | s << 8 | a;
+    n += y[c >> 18 & 63], n += y[c >> 12 & 63], n += i + 1 < t ? y[c >> 6 & 63] : "", n += i + 2 < t ? y[c & 63] : "";
   }
   return n.replace(/\+/g, "-").replace(/\//g, "_");
 }
@@ -48,20 +48,20 @@ function B() {
   return crypto.getRandomValues(e), u(e);
 }
 async function I(e) {
-  let t = new TextEncoder().encode(e), r = await crypto.subtle.digest("SHA-256", t);
-  return new Uint8Array(r);
+  let t = new TextEncoder().encode(e), i = await crypto.subtle.digest("SHA-256", t);
+  return new Uint8Array(i);
 }
 async function W(e, n) {
-  let r = await (n ?? I)(e);
-  return u(r);
+  let i = await (n ?? I)(e);
+  return u(i);
 }
 function j() {
   let e = new Uint8Array(16);
   return crypto.getRandomValues(e), u(e);
 }
 function G(e) {
-  let { host: n, clientId: t, redirectUri: r, codeChallenge: i, state: s, scopes: a, authorizePath: c = "/api/auth/oauth2/authorize" } = e, d = new URL(c, n);
-  return d.searchParams.set("client_id", t), d.searchParams.set("redirect_uri", r), d.searchParams.set("response_type", "code"), d.searchParams.set("scope", a.join(" ")), d.searchParams.set("state", s), d.searchParams.set("code_challenge", i), d.searchParams.set("code_challenge_method", "S256"), d.toString();
+  let { host: n, clientId: t, redirectUri: i, codeChallenge: r, state: s, scopes: a, authorizePath: c = "/api/auth/oauth2/authorize" } = e, d = new URL(c, n);
+  return d.searchParams.set("client_id", t), d.searchParams.set("redirect_uri", i), d.searchParams.set("response_type", "code"), d.searchParams.set("scope", a.join(" ")), d.searchParams.set("state", s), d.searchParams.set("code_challenge", r), d.searchParams.set("code_challenge_method", "S256"), d.toString();
 }
 
 // src/nostr.ts
@@ -265,6 +265,33 @@ var OpenKeyNostr = class {
   }
 };
 
+// src/popup-capability.ts
+function isEmbeddedAppWebView(env) {
+  const target = env ?? (typeof window === "undefined" ? void 0 : window);
+  if (!target) return false;
+  if (target.Capacitor?.isNativePlatform?.() === true) return true;
+  if (target.ReactNativeWebView) return true;
+  const userAgent = target.navigator?.userAgent ?? "";
+  if (/\bAndroid\b[^)]*;\s*wv\b/.test(userAgent)) return true;
+  if (/\b(iPhone|iPad|iPod)\b/.test(userAgent) && /AppleWebKit/.test(userAgent) && !/Safari\//.test(userAgent)) {
+    return true;
+  }
+  return false;
+}
+function isUsablePopup(popup) {
+  return !!popup && popup.closed !== true;
+}
+function popupUnavailableError(embeddedWebView) {
+  if (embeddedWebView) {
+    return {
+      code: "POPUP_BLOCKED",
+      message: "Popups are not available in this embedded app WebView. Make sure the OpenKey host is allowed by frame-src, or use native sign-in.",
+      reason: "embedded-webview"
+    };
+  }
+  return { code: "POPUP_BLOCKED", message: "Popup was blocked. Please allow popups for this site." };
+}
+
 // src/index.ts
 function passkeysQueryFlag(passkeysSupported) {
   return passkeysSupported ? "" : "&passkeys=false";
@@ -686,6 +713,12 @@ var OpenKey = class {
    * the SDK never holds an OpenKey session token. Local SDK state is cleared
    * before opening the widget, including when remote revocation is
    * unavailable.
+   *
+   * Rejects without waiting for the timeout when the widget cannot be shown
+   * (code `POPUP_BLOCKED`): the iframe did not load and the popup fallback is
+   * blocked, or the app is an embedded WebView that cannot open popups.
+   * Remote revocation did not happen then, so clearing any app session is the
+   * caller's decision.
    */
   async signOut(opts) {
     const requestId = `ok-signout-${Date.now()}-${Math.random().toString(36).slice(2, 9)}`;
@@ -1176,19 +1209,19 @@ var OpenKey = class {
   openOAuthPopup(url, state, redirectUri, resolve, reject) {
     const left = window.screenX + (window.outerWidth - POPUP_WIDTH) / 2;
     const top = window.screenY + (window.outerHeight - POPUP_HEIGHT) / 2;
-    this.popup = window.open(
+    const popup = window.open(
       url,
       "openkey-oauth",
       `width=${POPUP_WIDTH},height=${POPUP_HEIGHT},left=${left},top=${top},popup=true`
     );
-    if (!this.popup) {
-      showToast("Popup was blocked. Please allow popups for this site.", "error");
-      reject({
-        code: "POPUP_BLOCKED",
-        message: "Popup was blocked. Please allow popups or use redirect mode."
-      });
+    if (!isUsablePopup(popup)) {
+      this.popup = null;
+      const embedded = isEmbeddedAppWebView();
+      if (!embedded) showToast("Popup was blocked. Please allow popups for this site.", "error");
+      reject(embedded ? popupUnavailableError(true) : { code: "POPUP_BLOCKED", message: "Popup was blocked. Please allow popups or use redirect mode." });
       return;
     }
+    this.popup = popup;
     const redirectHost = new URL(redirectUri).origin;
     const pollInterval = setInterval(() => {
       try {
@@ -1372,6 +1405,11 @@ var OpenKey = class {
       const readyTimeout = setTimeout(() => {
         if (readyReceived || settled) return;
         cleanup();
+        if (isEmbeddedAppWebView()) {
+          console.warn("OpenKey: iframe did not load in an embedded app WebView, which cannot open a popup. Add frame-src https://openkey.so to your CSP.");
+          settle(() => reject(popupUnavailableError(true)));
+          return;
+        }
         console.warn("OpenKey: iframe blocked by CSP, falling back to popup. Add frame-src https://openkey.so to your CSP.");
         showToast();
         const popupUrl = `${this.host}/widget/${action}?origin=${origin}${passkeysQueryFlag(this.passkeysSupported)}`;
@@ -1470,15 +1508,14 @@ var OpenKey = class {
       `openkey-${action}-${Date.now()}-${Math.random().toString(36).slice(2, 9)}`,
       `width=${POPUP_WIDTH},height=${POPUP_HEIGHT},left=${left},top=${top},popup=true`
     );
-    this.popup = popup;
-    if (!popup) {
-      showToast("Popup was blocked. Please allow popups for this site.", "error");
-      reject({
-        code: "POPUP_BLOCKED",
-        message: "Popup was blocked. Please allow popups for this site."
-      });
+    if (!isUsablePopup(popup)) {
+      this.popup = null;
+      const embedded = isEmbeddedAppWebView();
+      if (!embedded) showToast("Popup was blocked. Please allow popups for this site.", "error");
+      reject(popupUnavailableError(embedded));
       return;
     }
+    this.popup = popup;
     let settled = false;
     let cancel;
     const cleanup = () => {