@oxyhq/auth 2.0.6 → 2.0.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxyhq/auth",
-  "version": "2.0.6",
+  "version": "2.0.8",
   "description": "OxyHQ Web Authentication SDK — headless auth with React hooks for Next.js, Vite, and web apps",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",

package/src/WebOxyProvider.tsx

@@ -58,6 +58,39 @@ export interface WebOxyContextValue extends WebAuthState, WebAuthActions {
 
 const WebOxyContext = createContext<WebOxyContextValue | null>(null);
 
+/**
+ * Module-level run-once guard for the provider's silent sign-in step.
+ *
+ * The init effect runs again whenever the provider remounts (route change,
+ * StrictMode double-invoke, error-boundary recovery). The redirect-callback
+ * and local-session-restore steps are cheap and idempotent, but
+ * `crossDomainAuth.silentSignIn()` is NOT: it first tries FedCM silent
+ * mediation (`navigator.credentials.get`) and, if that yields nothing, falls
+ * back to an iframe-based silent auth against `/auth/silent`.
+ *
+ * The FedCM leg is now centrally memoized inside `@oxyhq/core`'s
+ * `silentSignInWithFedCM` (at-most-once `navigator.credentials.get` per page
+ * load). The iframe fallback, however, is a SEPARATE mechanism the core guard
+ * does not cover — without this guard a remount storm would create a hidden
+ * iframe per remount. So this guard is intentionally retained to keep the
+ * provider's WHOLE silent step run-once. Keyed on `origin + baseURL` to match
+ * the core guard's keying (so the two stay in lockstep) and to survive
+ * instance churn; never cleared because only a fresh page load can change the
+ * IdP/iframe session state.
+ */
+const silentSignInAttempted = new Set<string>();
+
+function silentSignInKey(oxyServices: OxyServices): string {
+  const origin = typeof window !== 'undefined' ? window.location.origin : 'no-origin';
+  let baseURL = '';
+  try {
+    baseURL = oxyServices.getBaseURL();
+  } catch {
+    baseURL = '';
+  }
+  return `${origin}|${baseURL}`;
+}
+
 export interface WebOxyProviderProps {
   children: ReactNode;
   baseURL: string;
@@ -191,14 +224,23 @@ export function WebOxyProvider({
           }
         }
 
-        try {
-          const session = await crossDomainAuth.silentSignIn();
-          if (mounted && session?.user) {
-            await handleAuthSuccess(session, 'fedcm');
-            return;
+        // Silent sign-in: run AT MOST ONCE per page load. A remount (route
+        // change / StrictMode / error recovery) must not re-trigger the
+        // browser credential request OR the iframe fallback. The FedCM leg is
+        // additionally memoized in core; this guard also covers the iframe
+        // fallback that core does not.
+        const ssoKey = silentSignInKey(oxyServices);
+        if (!silentSignInAttempted.has(ssoKey)) {
+          silentSignInAttempted.add(ssoKey);
+          try {
+            const session = await crossDomainAuth.silentSignIn();
+            if (mounted && session?.user) {
+              await handleAuthSuccess(session, 'fedcm');
+              return;
+            }
+          } catch {
+            // Silent sign-in failed — resolve to unauthenticated below.
           }
-        } catch {
-          // Silent sign-in failed
         }
 
         if (mounted) setIsLoading(false);

package/src/hooks/useWebSSO.ts

@@ -158,7 +158,14 @@ export function useWebSSO({
     }
   }, [oxyServices, onSessionFound, onError, fedCMSupported]);
 
-  // Auto-check SSO on mount (web only, FedCM only, not on auth domain)
+  // Auto-check SSO on mount (web only, FedCM only, not on auth domain).
+  //
+  // `hasCheckedRef` is a cheap per-instance fast-path so effect re-runs (from
+  // changing deps) within one mount never re-fire. The page-load run-once
+  // guarantee — silent SSO invoking `navigator.credentials.get` AT MOST ONCE
+  // per page load across remounts / StrictMode / multiple consumers — lives in
+  // `@oxyhq/core`'s `silentSignInWithFedCM`, which memoizes the first silent
+  // attempt's result for this origin + API. The hook therefore calls it freely.
   useEffect(() => {
     if (!enabled || !isWebBrowser() || hasCheckedRef.current || isIdentityProvider()) {
       if (isIdentityProvider()) {