@owlmeans/web-client 0.1.18-rc.2 → 0.1.18-rc.20

package/build/main.js

@@ -21,5 +21,13 @@ export const render = (node, opts) => {
     };
     opts?.onReady ?? true ? window.addEventListener('DOMContentLoaded', _callback) : _callback();
 };
-export const renderApp = (context, opts) => render(_jsx(WebApp, { context: context }), opts);
+/**
+ * Mount the application.
+ *
+ * `children` are rendered inside the context provider and BEFORE the router, which makes them the
+ * app's global overlay slot: a consent dialog, a toast surface, anything that must exist on every
+ * route and outlive navigation. A component mounted inside a route instead is torn down and
+ * rebuilt on every navigation, which for a dialog means it closes itself.
+ */
+export const renderApp = (context, opts, children) => render(_jsx(WebApp, { context: context, children: children }), opts);
 //# sourceMappingURL=main.js.map

package/build/main.js.map

@@ -1 +1 @@
-{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.tsx"],"names":[],"mappings":";AAEA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAE9C,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,IAAe,EAAE,IAAoB,EAAE,EAAE;IAC9D,MAAM,SAAS,GAAG,GAAG,EAAE;QACrB,MAAM,GAAG,GAAG,IAAI,EAAE,KAAK,IAAI,YAAY,CAAA;QACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,CAAA;QACzC,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAA;QAC7C,CAAC;QACD,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,EAAE,CAAC,CAAA;QAC3D,CAAC;QACD,IAAI,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YAC3B,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACzB,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC/B,CAAC;IACH,CAAC,CAAA;IAED,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAA;AAC9F,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,CAA+C,OAAU,EAAE,IAAoB,EAAE,EAAE,CAC1G,MAAM,CAAC,KAAC,MAAM,IAAC,OAAO,EAAE,OAAO,GAAI,EAAE,IAAI,CAAC,CAAA"}
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.tsx"],"names":[],"mappings":";AAEA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAE9C,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,IAAe,EAAE,IAAoB,EAAE,EAAE;IAC9D,MAAM,SAAS,GAAG,GAAG,EAAE;QACrB,MAAM,GAAG,GAAG,IAAI,EAAE,KAAK,IAAI,YAAY,CAAA;QACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,CAAA;QACzC,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAA;QAC7C,CAAC;QACD,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,EAAE,CAAC,CAAA;QAC3D,CAAC;QACD,IAAI,IAAI,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YAC3B,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACzB,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC/B,CAAC;IACH,CAAC,CAAA;IAED,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAA;AAC9F,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,OAAU,EAAE,IAAoB,EAAE,QAAoB,EACtD,EAAE,CAAC,MAAM,CAAC,KAAC,MAAM,IAAC,OAAO,EAAE,OAAO,YAAG,QAAQ,GAAU,EAAE,IAAI,CAAC,CAAA"}

package/build/modules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"modules.d.ts","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,OAAO,uHAAO,CAAA"}
+{"version":3,"file":"modules.d.ts","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,OAAO,uHAAO,CAAA"}

package/build/modules.js

@@ -1,8 +1,18 @@
-import { DISPATCHER } from '@owlmeans/auth';
+import { DISPATCHER, DISPATCHER_SURROGATE } from '@owlmeans/auth';
 import { modules as list } from '@owlmeans/client-auth';
 import { elevate } from '@owlmeans/client-entrypoint';
 import { handler } from '@owlmeans/client';
 import { Dispatcher } from './components/dispatcher/component.js';
+import { SurrogateScreen } from './login/screen.js';
 elevate(list, DISPATCHER, handler(Dispatcher), { force: true });
+/**
+ * Elevated here rather than in a relying-party package on purpose.
+ *
+ * The surrogate mechanic is not OIDC-specific — it is "run the login route one window up and hand
+ * the result back" — and every web application already spreads this list. Putting the screen here
+ * means `web-panel`, `mui-panel` and every generated target gain a working login window with no
+ * edit of their own, which is the only way an application that is already deployed can get it.
+ */
+elevate(list, DISPATCHER_SURROGATE, handler(SurrogateScreen));
 export const modules = list;
 //# sourceMappingURL=modules.js.map

package/build/modules.js.map

@@ -1 +1 @@
-{"version":3,"file":"modules.js","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,OAAO,IAAI,IAAI,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAA;AAEjE,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AAE/D,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,CAAA"}
+{"version":3,"file":"modules.js","sourceRoot":"","sources":["../src/modules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AACjE,OAAO,EAAE,OAAO,IAAI,IAAI,EAAE,MAAM,uBAAuB,CAAA;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAA;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAA;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AAE/D;;;;;;;GAOG;AACH,OAAO,CAAC,IAAI,EAAE,oBAAoB,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,CAAA;AAE7D,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,CAAA"}

package/build/types.d.ts

@@ -1,4 +1,5 @@
 import type { AuthServiceAppend } from '@owlmeans/client-auth';
+import type { LoginServiceAppend } from '@owlmeans/client-auth/login';
 import type { ClientConfig } from '@owlmeans/client-context';
 import type { ClientContext } from '@owlmeans/client';
 export interface RenderOptions {
@@ -9,6 +10,6 @@ export interface RenderOptions {
 }
 export interface AppConfig extends ClientConfig {
 }
-export interface AppContext<C extends AppConfig = AppConfig> extends ClientContext<C>, AuthServiceAppend {
+export interface AppContext<C extends AppConfig = AppConfig> extends ClientContext<C>, AuthServiceAppend, LoginServiceAppend {
 }
 //# sourceMappingURL=types.d.ts.map

package/build/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAErD,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,SAAU,SAAQ,YAAY;CAC9C;AAED,MAAM,WAAW,UAAU,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,CAAE,SAAQ,aAAa,CAAC,CAAC,CAAC,EACnF,iBAAiB;CAClB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAC9D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AACrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAErD,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,SAAU,SAAQ,YAAY;CAC9C;AAED,MAAM,WAAW,UAAU,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,CAAE,SAAQ,aAAa,CAAC,CAAC,CAAC,EACnF,iBAAiB,EAAE,kBAAkB;CACtC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/web-client",
-  "version": "0.1.18-rc.2",
+  "version": "0.1.18-rc.20",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -21,22 +21,22 @@
     }
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.2",
-    "@owlmeans/auth-common": "^0.1.18-rc.2",
-    "@owlmeans/client": "^0.1.18-rc.2",
-    "@owlmeans/client-auth": "^0.1.18-rc.2",
-    "@owlmeans/client-context": "^0.1.18-rc.2",
-    "@owlmeans/client-i18n": "^0.1.18-rc.2",
-    "@owlmeans/client-entrypoint": "^0.1.18-rc.2",
-    "@owlmeans/client-resource": "^0.1.18-rc.2",
-    "@owlmeans/client-route": "^0.1.18-rc.2",
-    "@owlmeans/config": "^0.1.18-rc.2",
-    "@owlmeans/context": "^0.1.18-rc.2",
-    "@owlmeans/error": "^0.1.18-rc.2",
-    "@owlmeans/i18n": "^0.1.18-rc.2",
-    "@owlmeans/route": "^0.1.18-rc.2",
-    "@owlmeans/web-db": "^0.1.18-rc.2",
-    "@owlmeans/web-router": "^0.1.18-rc.2",
+    "@owlmeans/auth": "^0.1.18-rc.7",
+    "@owlmeans/auth-common": "^0.1.18-rc.9",
+    "@owlmeans/client": "^0.1.18-rc.11",
+    "@owlmeans/client-auth": "^0.1.18-rc.13",
+    "@owlmeans/client-context": "^0.1.18-rc.9",
+    "@owlmeans/client-i18n": "^0.1.18-rc.10",
+    "@owlmeans/client-entrypoint": "^0.1.18-rc.9",
+    "@owlmeans/client-resource": "^0.1.18-rc.9",
+    "@owlmeans/client-route": "^0.1.18-rc.9",
+    "@owlmeans/config": "^0.1.18-rc.8",
+    "@owlmeans/context": "^0.1.18-rc.6",
+    "@owlmeans/error": "^0.1.18-rc.6",
+    "@owlmeans/i18n": "^0.1.18-rc.6",
+    "@owlmeans/route": "^0.1.18-rc.6",
+    "@owlmeans/web-db": "^0.1.18-rc.10",
+    "@owlmeans/web-router": "^0.1.18-rc.11",
     "react-dropzone": "^14.3.5"
   },
   "peerDependencies": {

package/src/components/dispatcher/component.tsx

@@ -1,16 +1,33 @@
 import { DispatcherHOC } from '@owlmeans/client-auth'
-import { useEffect } from 'react'
+import { useEffect, useState } from 'react'
 import { useI18nLib } from '@owlmeans/client-i18n'
 import { AUTH_QUERY } from '@owlmeans/auth'
+import {
+  FallbackLoginScreen, LoginIntent, LoginOutcome, ResumeAction, resumeAction,
+} from '@owlmeans/client-auth/login'
+import { LoginSurrogateView, SurrogateStage } from '../../login/view.js'
 import { useContext } from '../../context.js'
 
-export const Dispatcher = DispatcherHOC(({ provideToken }) => {
+export const Dispatcher = DispatcherHOC(({ provideToken, navigate }) => {
   const context = useContext()
   const [query] = context.router().useSearchParams()
 
   const t = useI18nLib('auth', 'dispatcher')
+  const tAuth = useI18nLib('auth')
+
+  // Read in the component body, not in the effect: `window.name` is set by `window.open` before
+  // this document loads and `sessionStorage` carries the marker across the provider round trip, so
+  // the answer is already correct at first paint — and a first paint that showed the application
+  // before an effect corrected it is the defect this exists to prevent.
+  const [env] = useState(() => context.login().env())
+  const [outcome, setOutcome] = useState<LoginOutcome | null>(null)
+  // Nothing to return from and nobody signed in: offer the choice rather than starting a flow.
+  const [choose, setChoose] = useState(false)
 
   useEffect(() => {
+    // First statement of the effect on purpose: everything below can navigate this window away.
+    context.login().enter()
+
     const token = query.get(AUTH_QUERY)
     if (token != null) {
       const params: Record<string, string> = {}
@@ -21,15 +38,62 @@ export const Dispatcher = DispatcherHOC(({ provideToken }) => {
       })
 
       provideToken({ token }, params)
-    } else {
-      context.auth().authenticated().then(authzToken => {
-        if (authzToken == null) {
-          provideToken({ token: '' }, undefined)
-        }
-      })
+
+      return
     }
+
+    void context.auth().authenticated().then(async authzToken => {
+      if (authzToken == null || authzToken === '') {
+        setChoose(true)
+
+        return
+      }
+      // A session already exists in THIS document. Whether it is useful here, or belongs to the
+      // window that opened this one, is the plugin's call — the dispatcher reads no environment.
+      const settled = await context.login().resume(authzToken)
+      switch (resumeAction(settled)) {
+        case ResumeAction.Stop:
+          return
+        case ResumeAction.Render:
+          setOutcome(settled)
+
+          return
+        default:
+          await navigate()
+      }
+    })
   }, [])
 
+  // A surrogate window never renders the application, whatever else is true. Checked ahead of
+  // every other return for exactly that reason.
+  //
+  // `choose` is the one state this must NOT mask, and it is not an exception to the rule: the
+  // login chooser is not the application. A login window with nothing to return from and nobody
+  // signed in has exactly one thing left that can move it forward, and that is asking which
+  // provider. The surrogate URL normally carries `?method=` so the question is already settled,
+  // but a window opened from a bare "Log in" — the framed application's own header button — has no
+  // method to send. Returning the "working" panel there left the popup on "Signing you in…"
+  // permanently, because nothing was ever going to start.
+  if (env.surrogate && !choose) {
+    return <LoginSurrogateView
+      intent={LoginIntent.Login}
+      stage={
+        outcome === LoginOutcome.Orphaned ? SurrogateStage.Orphaned
+          : outcome === LoginOutcome.Failed ? SurrogateStage.Failed
+            : outcome === LoginOutcome.Gesture ? SurrogateStage.Gesture
+              : SurrogateStage.Working
+      }
+      onAction={() => window.close()}
+      translate={(key, defaultValue) => tAuth(key, { defaultValue })}
+    />
+  }
+
+  if (choose) {
+    const Screen = context.login().screen() ?? FallbackLoginScreen
+
+    return <Screen translate={(key, defaultValue) => tAuth(key, { defaultValue })} />
+  }
+
   return query.has(AUTH_QUERY) ? <div style={{
     width: '100%', // Makes the div occupy the full width
     display: 'flex', // Enables flexbox layout

package/src/context.ts

@@ -8,6 +8,7 @@ import { useContext as useCtx } from '@owlmeans/client'
 import { extractPrimaryHost } from './helper.js'
 import { appendWebAuthService } from './service.js'
 import { appendWebRouter } from '@owlmeans/web-router'
+import { appendWebLogin } from './login/service.js'
 
 export const makeContext = <C extends AppConfig = AppConfig, T extends AppContext<C> = AppContext<C>>(
   cfg: C
@@ -19,6 +20,7 @@ export const makeContext = <C extends AppConfig = AppConfig, T extends AppContex
   appendWebDbService<C, T>(context)
   appendClientResource<C, T>(context, AUTH_RESOURCE)
   appendWebRouter<C, T>(context)
+  appendWebLogin<C, T>(context)
 
   context.makeContext = makeContext as typeof context.makeContext
 

package/src/exports.ts

@@ -5,5 +5,6 @@ export { service } from '@owlmeans/config'
 export { AppType, HOME, ROOT, BASE, GUEST } from '@owlmeans/context'
 export { entrypoint, elevate, provideRequest, stab } from '@owlmeans/client-entrypoint'
 export { route, frontend } from '@owlmeans/route'
+export type { ClientEntrypoint } from '@owlmeans/client-entrypoint'
 export type { ClientEntrypoint as Module } from '@owlmeans/client-entrypoint'
 export type { ClientRoute as Route } from '@owlmeans/client-route'

package/src/i18n/auth-be.json

@@ -2,5 +2,37 @@
   "dispatcher": {
     "loading": "Загрузка...",
     "error": "Не ўдалося прайсці аўтэнтыфікацыю: {{error}}"
+  },
+  "surrogate": {
+    "login": {
+      "working": "Выконваем уваход…",
+      "gesture": {
+        "title": "Працягніце, каб увайсці.",
+        "action": "Увайсці"
+      },
+      "handing": "Гатова. Вяртаемся ў праграму…",
+      "orphaned": "Уваход выкананы. Можаце закрыць гэтае акно і вярнуцца ў праграму.",
+      "failed": "Не ўдалося завяршыць. Закрыйце гэтае акно і паспрабуйце зноў.",
+      "standalone": {
+        "title": "Гэтая старонка выкарыстоўваецца для ўваходу з іншага акна.",
+        "action": "Адкрыць праграму"
+      },
+      "close": "Закрыць"
+    },
+    "logout": {
+      "working": "Выконваем выхад…",
+      "gesture": {
+        "title": "Працягніце, каб выйсці.",
+        "action": "Выйсці"
+      },
+      "handing": "Выхад выкананы. Вяртаемся ў праграму…",
+      "orphaned": "Выхад выкананы. Можаце закрыць гэтае акно.",
+      "failed": "Выхад тут не завершаны. Можаце закрыць гэтае акно.",
+      "standalone": {
+        "title": "Гэтая старонка выкарыстоўваецца для выхаду з іншага акна.",
+        "action": "Адкрыць праграму"
+      },
+      "close": "Закрыць"
+    }
   }
 }

package/src/i18n/auth-de.json

@@ -2,5 +2,37 @@
   "dispatcher": {
     "loading": "Wird geladen...",
     "error": "Authentifizierung fehlgeschlagen: {{error}}"
+  },
+  "surrogate": {
+    "login": {
+      "working": "Anmeldung läuft…",
+      "gesture": {
+        "title": "Fortfahren, um sich anzumelden.",
+        "action": "Anmelden"
+      },
+      "handing": "Fertig. Zurück zur Anwendung…",
+      "orphaned": "Angemeldet. Sie können dieses Fenster schließen und in der Anwendung fortfahren.",
+      "failed": "Das wurde nicht abgeschlossen. Schließen Sie dieses Fenster und versuchen Sie es erneut.",
+      "standalone": {
+        "title": "Diese Seite dient der Anmeldung aus einem anderen Fenster.",
+        "action": "Anwendung öffnen"
+      },
+      "close": "Schließen"
+    },
+    "logout": {
+      "working": "Abmeldung läuft…",
+      "gesture": {
+        "title": "Fortfahren, um sich abzumelden.",
+        "action": "Abmelden"
+      },
+      "handing": "Abgemeldet. Zurück zur Anwendung…",
+      "orphaned": "Abgemeldet. Sie können dieses Fenster schließen.",
+      "failed": "Die Abmeldung wurde hier nicht abgeschlossen. Sie können dieses Fenster schließen.",
+      "standalone": {
+        "title": "Diese Seite dient der Abmeldung aus einem anderen Fenster.",
+        "action": "Anwendung öffnen"
+      },
+      "close": "Schließen"
+    }
   }
 }

package/src/i18n/auth-en.json

@@ -2,5 +2,37 @@
   "dispatcher": {
     "loading": "Loading...",
     "error": "Authentication failed: {{error}}"
+  },
+  "surrogate": {
+    "login": {
+      "working": "Signing you in…",
+      "gesture": {
+        "title": "Continue to sign in.",
+        "action": "Sign in"
+      },
+      "handing": "Done. Returning to the application…",
+      "orphaned": "Signed in. You can close this window and continue in the application.",
+      "failed": "That did not complete. You can close this window and try again.",
+      "standalone": {
+        "title": "This page is used to sign in from another window.",
+        "action": "Open the application"
+      },
+      "close": "Close"
+    },
+    "logout": {
+      "working": "Signing you out…",
+      "gesture": {
+        "title": "Continue to sign out.",
+        "action": "Sign out"
+      },
+      "handing": "Signed out. Returning to the application…",
+      "orphaned": "Signed out. You can close this window.",
+      "failed": "Sign-out did not complete here. You can close this window.",
+      "standalone": {
+        "title": "This page is used to sign out from another window.",
+        "action": "Open the application"
+      },
+      "close": "Close"
+    }
   }
 }

package/src/i18n/auth-es.json

@@ -2,5 +2,37 @@
   "dispatcher": {
     "loading": "Cargando...",
     "error": "Error de autenticación: {{error}}"
+  },
+  "surrogate": {
+    "login": {
+      "working": "Iniciando sesión…",
+      "gesture": {
+        "title": "Continúa para iniciar sesión.",
+        "action": "Iniciar sesión"
+      },
+      "handing": "Listo. Volviendo a la aplicación…",
+      "orphaned": "Sesión iniciada. Puedes cerrar esta ventana y continuar en la aplicación.",
+      "failed": "No se completó. Cierra esta ventana e inténtalo de nuevo.",
+      "standalone": {
+        "title": "Esta página se usa para iniciar sesión desde otra ventana.",
+        "action": "Abrir la aplicación"
+      },
+      "close": "Cerrar"
+    },
+    "logout": {
+      "working": "Cerrando sesión…",
+      "gesture": {
+        "title": "Continúa para cerrar sesión.",
+        "action": "Cerrar sesión"
+      },
+      "handing": "Sesión cerrada. Volviendo a la aplicación…",
+      "orphaned": "Sesión cerrada. Puedes cerrar esta ventana.",
+      "failed": "El cierre de sesión no se completó aquí. Puedes cerrar esta ventana.",
+      "standalone": {
+        "title": "Esta página se usa para cerrar sesión desde otra ventana.",
+        "action": "Abrir la aplicación"
+      },
+      "close": "Cerrar"
+    }
   }
 }

package/src/i18n/auth-pl.json

@@ -2,5 +2,37 @@
   "dispatcher": {
     "loading": "Ładowanie...",
     "error": "Uwierzytelnianie nie powiodło się: {{error}}"
+  },
+  "surrogate": {
+    "login": {
+      "working": "Trwa logowanie…",
+      "gesture": {
+        "title": "Kontynuuj, aby się zalogować.",
+        "action": "Zaloguj się"
+      },
+      "handing": "Gotowe. Wracamy do aplikacji…",
+      "orphaned": "Zalogowano. Możesz zamknąć to okno i kontynuować w aplikacji.",
+      "failed": "Nie udało się ukończyć. Zamknij to okno i spróbuj ponownie.",
+      "standalone": {
+        "title": "Ta strona służy do logowania z innego okna.",
+        "action": "Otwórz aplikację"
+      },
+      "close": "Zamknij"
+    },
+    "logout": {
+      "working": "Trwa wylogowywanie…",
+      "gesture": {
+        "title": "Kontynuuj, aby się wylogować.",
+        "action": "Wyloguj się"
+      },
+      "handing": "Wylogowano. Wracamy do aplikacji…",
+      "orphaned": "Wylogowano. Możesz zamknąć to okno.",
+      "failed": "Wylogowanie nie zostało tu ukończone. Możesz zamknąć to okno.",
+      "standalone": {
+        "title": "Ta strona służy do wylogowania z innego okna.",
+        "action": "Otwórz aplikację"
+      },
+      "close": "Zamknij"
+    }
   }
 }

package/src/i18n/auth-ru.json

@@ -2,5 +2,37 @@
   "dispatcher": {
     "loading": "Загрузка...",
     "error": "Не удалось выполнить аутентификацию: {{error}}"
+  },
+  "surrogate": {
+    "login": {
+      "working": "Выполняем вход…",
+      "gesture": {
+        "title": "Продолжите, чтобы войти.",
+        "action": "Войти"
+      },
+      "handing": "Готово. Возвращаемся в приложение…",
+      "orphaned": "Вход выполнен. Можете закрыть это окно и вернуться в приложение.",
+      "failed": "Не удалось завершить. Закройте это окно и попробуйте снова.",
+      "standalone": {
+        "title": "Эта страница используется для входа из другого окна.",
+        "action": "Открыть приложение"
+      },
+      "close": "Закрыть"
+    },
+    "logout": {
+      "working": "Выполняем выход…",
+      "gesture": {
+        "title": "Продолжите, чтобы выйти.",
+        "action": "Выйти"
+      },
+      "handing": "Выход выполнен. Возвращаемся в приложение…",
+      "orphaned": "Выход выполнен. Можете закрыть это окно.",
+      "failed": "Выход здесь не завершён. Можете закрыть это окно.",
+      "standalone": {
+        "title": "Эта страница используется для выхода из другого окна.",
+        "action": "Открыть приложение"
+      },
+      "close": "Закрыть"
+    }
   }
 }

package/src/i18n/auth-uk.json

@@ -2,5 +2,37 @@
   "dispatcher": {
     "loading": "Завантаження...",
     "error": "Не вдалося пройти автентифікацію: {{error}}"
+  },
+  "surrogate": {
+    "login": {
+      "working": "Виконуємо вхід…",
+      "gesture": {
+        "title": "Продовжте, щоб увійти.",
+        "action": "Увійти"
+      },
+      "handing": "Готово. Повертаємось до застосунку…",
+      "orphaned": "Вхід виконано. Можете закрити це вікно й повернутися до застосунку.",
+      "failed": "Не вдалося завершити. Закрийте це вікно та спробуйте ще раз.",
+      "standalone": {
+        "title": "Ця сторінка використовується для входу з іншого вікна.",
+        "action": "Відкрити застосунок"
+      },
+      "close": "Закрити"
+    },
+    "logout": {
+      "working": "Виконуємо вихід…",
+      "gesture": {
+        "title": "Продовжте, щоб вийти.",
+        "action": "Вийти"
+      },
+      "handing": "Вихід виконано. Повертаємось до застосунку…",
+      "orphaned": "Вихід виконано. Можете закрити це вікно.",
+      "failed": "Вихід тут не завершено. Можете закрити це вікно.",
+      "standalone": {
+        "title": "Ця сторінка використовується для виходу з іншого вікна.",
+        "action": "Відкрити застосунок"
+      },
+      "close": "Закрити"
+    }
   }
 }

package/src/index.ts

@@ -11,3 +11,4 @@ export * from './helper.js'
 export * from './i18n.js'
 export * from './service.js'
 export * from './errors.js'
+export * from './login/index.js'

package/src/login/consts.ts

@@ -0,0 +1,12 @@
+/** The ordinary flow: leave for the provider and come back. */
+export const REDIRECT_LOGIN = 'owlmeans-redirect-login'
+
+/** The flow that runs one window up, for a document that cannot redirect where it is. */
+export const SURROGATE_LOGIN = 'owlmeans-surrogate-login'
+
+/**
+ * Registered above the default so it wins the cascade wherever it applies. It applies narrowly —
+ * only in a frame, or in the surrogate window itself — so the default still serves every
+ * ordinary tab.
+ */
+export const SURROGATE_LOGIN_PRIORITY = 100

package/src/login/index.ts

@@ -0,0 +1,7 @@
+export * from './consts.js'
+export * from './pump.js'
+export * from './redirect.js'
+export * from './surrogate.js'
+export * from './view.js'
+export * from './screen.js'
+export * from './service.js'

package/src/login/pump.ts

@@ -0,0 +1,53 @@
+import { LOGIN_WATCH_INTERVAL, LoginOutcome } from '@owlmeans/client-auth/login'
+
+/**
+ * Wait on a surrogate window until it says something, or goes away.
+ *
+ * Extracted so login and logout share one implementation rather than two that agree until one of
+ * them is changed. Every guard here was a real failure at some point:
+ *
+ * - the **origin pin** is not decoration — the message carries a bearer token, and a listener that
+ *   accepted any origin would take one from any page that could reach this window;
+ * - the **`settled` latch** stops a second message, or a close racing a message, resolving twice;
+ * - the **`closed` poll** is the only exit when the user simply closes the window, because a window
+ *   the user closes announces nothing at all;
+ * - the listener and the interval are removed on every path, including the ones that resolve.
+ */
+export const awaitSurrogate = async (
+  surrogate: Window,
+  messageType: string,
+  onMessage: (data: { type?: string, token?: string, ok?: boolean }) => Promise<LoginOutcome>
+): Promise<LoginOutcome> => await new Promise<LoginOutcome>(resolve => {
+  let settled = false
+  let watch: ReturnType<typeof setInterval> | undefined
+
+  const finish = (result: LoginOutcome): void => {
+    if (settled) {
+      return
+    }
+    settled = true
+    window.removeEventListener('message', handler)
+    if (watch != null) {
+      clearInterval(watch)
+    }
+    resolve(result)
+  }
+
+  function handler(event: MessageEvent): void {
+    if (event.origin !== window.location.origin) {
+      return
+    }
+    const data = event.data as { type?: string, token?: string, ok?: boolean } | null
+    if (data?.type !== messageType) {
+      return
+    }
+    void onMessage(data).then(finish).catch(() => finish(LoginOutcome.Failed))
+  }
+
+  window.addEventListener('message', handler)
+  watch = setInterval(() => {
+    if (surrogate.closed) {
+      finish(LoginOutcome.Failed)
+    }
+  }, LOGIN_WATCH_INTERVAL)
+})