@orangecheck/auth-client 2.20.0 → 2.22.0

package/dist/index.mjs

@@ -31,6 +31,7 @@ function buildAddAccountUrl(cfg, returnTo) {
 // src/tab-session.ts
 var TAB_SESSION_HEADER = "x-oc-tab-session";
 var TAB_SESSION_STORAGE_KEY = "oc_tab_session";
+var TAB_ACCOUNT_HINT_KEY = "oc-as";
 var TAB_ADOPT_HASH = "#oc-adopt";
 function readTabSession() {
   if (typeof window === "undefined") return null;
@@ -112,6 +113,92 @@ function consumeTabAdoptMarker() {
   }
   return true;
 }
+var OC_AS_HINT_RE = /^oc-as=(did:oc:[0-9a-f]{32})$/;
+function familyApex(authOrigin) {
+  try {
+    return new URL(authOrigin).hostname.toLowerCase();
+  } catch {
+    return null;
+  }
+}
+function isFamilyUrl(u, authOrigin) {
+  if (u.protocol !== "http:" && u.protocol !== "https:") return false;
+  if (typeof window !== "undefined" && u.origin === window.location.origin) return true;
+  const apex = familyApex(authOrigin);
+  if (!apex) return false;
+  const host = u.hostname.toLowerCase();
+  return host === apex || host.endsWith(`.${apex}`);
+}
+function opensWithoutTabPin(e, anchor, dest) {
+  if (typeof window !== "undefined" && dest.origin !== window.location.origin) return true;
+  const target = (anchor.getAttribute("target") ?? "").toLowerCase();
+  return e.button === 1 || // middle-click
+  e.metaKey || e.ctrlKey || e.shiftKey || target === "_blank";
+}
+function installTabLinkDecorator(authOrigin) {
+  if (typeof window === "undefined" || typeof document === "undefined") return () => {
+  };
+  const onActivate = (e) => {
+    try {
+      const pin = readTabSession();
+      if (!pin) return;
+      const target = e.target;
+      if (!(target instanceof Element)) return;
+      const anchor = target.closest("a[href]");
+      if (!anchor || anchor.hasAttribute("download")) return;
+      const raw = anchor.getAttribute("href");
+      if (!raw || raw.includes(`${TAB_ACCOUNT_HINT_KEY}=`)) return;
+      let dest;
+      try {
+        dest = new URL(anchor.href);
+      } catch {
+        return;
+      }
+      if (dest.hash) return;
+      if (!isFamilyUrl(dest, authOrigin)) return;
+      if (!opensWithoutTabPin(e, anchor, dest)) return;
+      anchor.setAttribute("href", `${raw}#${TAB_ACCOUNT_HINT_KEY}=${pin.didOc}`);
+    } catch {
+    }
+  };
+  window.addEventListener("click", onActivate, true);
+  window.addEventListener("auxclick", onActivate, true);
+  return () => {
+    window.removeEventListener("click", onActivate, true);
+    window.removeEventListener("auxclick", onActivate, true);
+  };
+}
+async function consumeTabAccountHint(authOrigin) {
+  if (typeof window === "undefined") return null;
+  const frag = window.location.hash.replace(/^#/, "");
+  const m = OC_AS_HINT_RE.exec(frag);
+  if (!m) return null;
+  const did = m[1];
+  try {
+    const url = new URL(window.location.href);
+    url.hash = "";
+    window.history.replaceState(window.history.state, "", url.toString());
+  } catch {
+  }
+  const existing = readTabSession();
+  if (existing && existing.didOc === did) return did;
+  try {
+    const res = await fetch(`${authOrigin}/api/auth/tab`, {
+      method: "POST",
+      credentials: "include",
+      headers: { Accept: "application/json", "Content-Type": "application/json" },
+      body: JSON.stringify({ did_oc: did })
+    });
+    if (!res.ok) return null;
+    const body = await res.json();
+    if (body.ok && typeof body.token === "string" && body.account?.did_oc === did) {
+      writeTabSession({ token: body.token, didOc: did });
+      return did;
+    }
+  } catch {
+  }
+  return null;
+}
 var SessionContext = React3.createContext(null);
 function normalizeDisplayIdentity(raw, didOc) {
   const di = raw.display_identity ?? raw.displayIdentity;
@@ -255,10 +342,18 @@ function OcSessionProvider({
     }
   }, [cfg, pinThisTab]);
   React3.useEffect(() => {
+    let cancelled = false;
     consumeTabAdoptMarker();
-    void refresh();
-  }, [refresh]);
+    void (async () => {
+      await consumeTabAccountHint(cfg.authOrigin);
+      if (!cancelled) void refresh();
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, [refresh, cfg.authOrigin]);
   React3.useEffect(() => installTabFetchInterceptor(cfg.authOrigin), [cfg.authOrigin]);
+  React3.useEffect(() => installTabLinkDecorator(cfg.authOrigin), [cfg.authOrigin]);
   const signOut = React3.useCallback(
     async (opts) => {
       const scope = opts?.scope ?? "all";
@@ -1041,7 +1136,8 @@ var DEFAULT_AUTH_ORIGIN = "https://ochk.io";
 async function fetchOcLinkedIdentities(opts) {
   const authOrigin = opts?.authOrigin ?? DEFAULT_AUTH_ORIGIN;
   const r = await fetch(`${authOrigin}/api/auth/identities`, {
-    credentials: "include"
+    credentials: "include",
+    headers: { ...tabSessionHeader() }
   });
   if (r.status === 401) return [];
   if (!r.ok) throw new Error(`identities fetch failed: http_${r.status}`);
@@ -1061,7 +1157,8 @@ function OcLinkedIdentities({
     setError(null);
     try {
       const r = await fetch(`${authOrigin}/api/auth/identities`, {
-        credentials: "include"
+        credentials: "include",
+        headers: { ...tabSessionHeader() }
       });
       if (!r.ok) {
         if (r.status === 401) {
@@ -2991,6 +3088,6 @@ function handleSudoRequired(body, args = {}) {
   return false;
 }
 
-export { DEFAULT_CONFIG, DISPLAY_IDENTITY_KINDS, OcAccountChip, OcAccountPill, OcAddressInput, OcLinkedIdentities, OcSessionProvider, OcSignIn, OcSignInButton, TAB_ADOPT_HASH, TAB_SESSION_HEADER, TAB_SESSION_STORAGE_KEY, buildAddAccountUrl, buildSignInUrl, clearTabSession, consumeTabAdoptMarker, fetchOcLinkedIdentities, handleSudoRequired, installTabFetchInterceptor, readTabSession, redirectToSudo, tabSessionHeader, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister, writeTabSession };
+export { DEFAULT_CONFIG, DISPLAY_IDENTITY_KINDS, OcAccountChip, OcAccountPill, OcAddressInput, OcLinkedIdentities, OcSessionProvider, OcSignIn, OcSignInButton, TAB_ACCOUNT_HINT_KEY, TAB_ADOPT_HASH, TAB_SESSION_HEADER, TAB_SESSION_STORAGE_KEY, buildAddAccountUrl, buildSignInUrl, clearTabSession, consumeTabAccountHint, consumeTabAdoptMarker, fetchOcLinkedIdentities, handleSudoRequired, installTabFetchInterceptor, installTabLinkDecorator, readTabSession, redirectToSudo, tabSessionHeader, useOcAddressSuggestion, useOcSession, useOptionalOcSession, useStepUpAuth, useWebAuthnList, useWebAuthnRegister, writeTabSession };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map