@oxyhq/auth 2.0.6 → 2.0.8

package/dist/esm/WebOxyProvider.js

@@ -11,6 +11,38 @@ import { OxyServices, CrossDomainAuth, createAuthManager, } from '@oxyhq/core';
 import { QueryClientProvider } from '@tanstack/react-query';
 import { attachQueryPersistence, createQueryClient } from './hooks/queryClient';
 const WebOxyContext = createContext(null);
+/**
+ * Module-level run-once guard for the provider's silent sign-in step.
+ *
+ * The init effect runs again whenever the provider remounts (route change,
+ * StrictMode double-invoke, error-boundary recovery). The redirect-callback
+ * and local-session-restore steps are cheap and idempotent, but
+ * `crossDomainAuth.silentSignIn()` is NOT: it first tries FedCM silent
+ * mediation (`navigator.credentials.get`) and, if that yields nothing, falls
+ * back to an iframe-based silent auth against `/auth/silent`.
+ *
+ * The FedCM leg is now centrally memoized inside `@oxyhq/core`'s
+ * `silentSignInWithFedCM` (at-most-once `navigator.credentials.get` per page
+ * load). The iframe fallback, however, is a SEPARATE mechanism the core guard
+ * does not cover — without this guard a remount storm would create a hidden
+ * iframe per remount. So this guard is intentionally retained to keep the
+ * provider's WHOLE silent step run-once. Keyed on `origin + baseURL` to match
+ * the core guard's keying (so the two stay in lockstep) and to survive
+ * instance churn; never cleared because only a fresh page load can change the
+ * IdP/iframe session state.
+ */
+const silentSignInAttempted = new Set();
+function silentSignInKey(oxyServices) {
+    const origin = typeof window !== 'undefined' ? window.location.origin : 'no-origin';
+    let baseURL = '';
+    try {
+        baseURL = oxyServices.getBaseURL();
+    }
+    catch {
+        baseURL = '';
+    }
+    return `${origin}|${baseURL}`;
+}
 /**
  * Web-only Oxy Provider
  *
@@ -112,15 +144,24 @@ export function WebOxyProvider({ children, baseURL, authWebUrl, onAuthStateChang
                         await authManager.signOut();
                     }
                 }
-                try {
-                    const session = await crossDomainAuth.silentSignIn();
-                    if (mounted && session?.user) {
-                        await handleAuthSuccess(session, 'fedcm');
-                        return;
+                // Silent sign-in: run AT MOST ONCE per page load. A remount (route
+                // change / StrictMode / error recovery) must not re-trigger the
+                // browser credential request OR the iframe fallback. The FedCM leg is
+                // additionally memoized in core; this guard also covers the iframe
+                // fallback that core does not.
+                const ssoKey = silentSignInKey(oxyServices);
+                if (!silentSignInAttempted.has(ssoKey)) {
+                    silentSignInAttempted.add(ssoKey);
+                    try {
+                        const session = await crossDomainAuth.silentSignIn();
+                        if (mounted && session?.user) {
+                            await handleAuthSuccess(session, 'fedcm');
+                            return;
+                        }
+                    }
+                    catch {
+                        // Silent sign-in failed — resolve to unauthenticated below.
                     }
-                }
-                catch {
-                    // Silent sign-in failed
                 }
                 if (mounted)
                     setIsLoading(false);

package/dist/esm/hooks/useWebSSO.js

@@ -117,7 +117,14 @@ export function useWebSSO({ oxyServices, onSessionFound, onSSOUnavailable, onErr
             isCheckingRef.current = false;
         }
     }, [oxyServices, onSessionFound, onError, fedCMSupported]);
-    // Auto-check SSO on mount (web only, FedCM only, not on auth domain)
+    // Auto-check SSO on mount (web only, FedCM only, not on auth domain).
+    //
+    // `hasCheckedRef` is a cheap per-instance fast-path so effect re-runs (from
+    // changing deps) within one mount never re-fire. The page-load run-once
+    // guarantee — silent SSO invoking `navigator.credentials.get` AT MOST ONCE
+    // per page load across remounts / StrictMode / multiple consumers — lives in
+    // `@oxyhq/core`'s `silentSignInWithFedCM`, which memoizes the first silent
+    // attempt's result for this origin + API. The hook therefore calls it freely.
     useEffect(() => {
         if (!enabled || !isWebBrowser() || hasCheckedRef.current || isIdentityProvider()) {
             if (isIdentityProvider()) {