@oxyhq/core 1.11.18 → 1.11.19

package/dist/esm/mixins/OxyServices.fedcm.js

@@ -1,6 +1,38 @@
 import { OxyAuthenticationError } from '../OxyServices.errors.js';
 import { createDebugLogger } from '../shared/utils/debugUtils.js';
 const debug = createDebugLogger('FedCM');
+// Modern (W3C spec) → legacy (Chrome 125–131) mode value mapping. Used to
+// retry a credential request when an older browser rejects the modern enum.
+const MODERN_TO_LEGACY_MODE = {
+    active: 'button',
+    passive: 'widget',
+};
+// Legacy → modern mapping so callers may pass either spelling.
+const LEGACY_TO_MODERN_MODE = {
+    button: 'active',
+    widget: 'passive',
+};
+/**
+ * Normalise any accepted mode value to the modern W3C spelling
+ * (`'active'`/`'passive'`), which is what is sent to the browser first.
+ */
+function toModernMode(mode) {
+    return mode === 'button' || mode === 'widget' ? LEGACY_TO_MODERN_MODE[mode] : mode;
+}
+/**
+ * Detect the synchronous `TypeError` a pre-spec browser throws when it does not
+ * recognise a modern `mode` enum value (e.g. Chrome 125–131 rejecting
+ * `'active'`/`'passive'`). Such a browser only understands the legacy
+ * `'button'`/`'widget'` values, so the caller can retry with those.
+ */
+function isUnknownModeEnumError(error) {
+    if (!(error instanceof TypeError))
+        return false;
+    const message = error.message.toLowerCase();
+    return (message.includes('identitycredentialrequestoptionsmode') ||
+        ((message.includes('active') || message.includes('passive')) &&
+            (message.includes('enum') || message.includes('not a valid'))));
+}
 const FEDCM_LOGIN_HINT_KEY = 'oxy_fedcm_login_hint';
 // Global lock to prevent concurrent FedCM requests
 // FedCM only allows one navigator.credentials.get request at a time
@@ -90,15 +122,17 @@ export function OxyServicesFedCMMixin(Base) {
                     // Use provided loginHint, or fall back to stored last-used account ID
                     const loginHint = options.loginHint || this.getStoredLoginHint();
                     debug.log('Interactive sign-in: Requesting credential for', clientId, loginHint ? `(hint: ${loginHint})` : '');
-                    // Request credential from browser's native identity flow
-                    // mode: 'button' signals this is a user-gesture-initiated flow (Chrome 125+)
+                    // Request credential from browser's native identity flow.
+                    // mode: 'active' signals this is a user-gesture-initiated (button) flow.
+                    // 'active' is the current W3C spec value; requestIdentityCredential
+                    // transparently retries with the legacy 'button' value for Chrome 125–131.
                     const credential = await this.requestIdentityCredential({
                         configURL: this.resolveFedcmConfigUrl(),
                         clientId,
                         nonce,
                         context: options.context,
                         loginHint,
-                        mode: 'button',
+                        mode: 'active',
                     });
                     if (!credential || !credential.token) {
                         throw new OxyAuthenticationError('No credential received from browser');
@@ -306,37 +340,63 @@ export function OxyServicesFedCMMixin(Base) {
                     debug.log('Request timed out after', timeoutMs, 'ms (mediation:', requestedMediation + ')');
                     controller.abort();
                 }, timeoutMs);
+                // Normalise the caller's mode to the modern W3C value first. A modern
+                // browser accepts it; an older one (Chrome 125–131) rejects it with a
+                // synchronous TypeError, in which case we retry with the legacy value.
+                const modernMode = options.mode ? toModernMode(options.mode) : undefined;
+                // Build the identity request for a specific mode value. The `mode` field
+                // lives on the `identity` object (sibling of `providers`), separate from
+                // the top-level `mediation` field.
+                const buildCredentialOptions = (modeValue) => ({
+                    identity: {
+                        providers: [
+                            {
+                                configURL: options.configURL,
+                                clientId: options.clientId,
+                                // Older browsers read `nonce` at the top level; Chrome 145+
+                                // expects it inside `params`. Send both for full coverage.
+                                nonce: options.nonce,
+                                params: {
+                                    nonce: options.nonce,
+                                },
+                                ...(options.loginHint && { loginHint: options.loginHint }),
+                            },
+                        ],
+                        ...(modeValue && { mode: modeValue }),
+                    },
+                    mediation: requestedMediation,
+                    signal: controller.signal,
+                });
+                // The DOM lib's `CredentialsContainer` does not declare the FedCM `identity`
+                // request in every TypeScript version we build against. Re-type through the
+                // minimal structural interface above (not `any`) to keep this typed.
+                const credentials = navigator.credentials;
                 fedCMRequestPromise = (async () => {
                     try {
-                        debug.log('Calling navigator.credentials.get with mediation:', requestedMediation);
-                        // Type assertion needed as FedCM types may not be in all TypeScript versions
-                        const credentialOptions = {
-                            identity: {
-                                providers: [
-                                    {
-                                        configURL: options.configURL,
-                                        clientId: options.clientId,
-                                        // Older browsers read `nonce` at the top level; Chrome 145+
-                                        // expects it inside `params`. Send both for full coverage.
-                                        nonce: options.nonce,
-                                        params: {
-                                            nonce: options.nonce,
-                                        },
-                                        ...(options.loginHint && { loginHint: options.loginHint }),
-                                    },
-                                ],
-                                ...(options.mode && { mode: options.mode }),
-                            },
-                            mediation: requestedMediation,
-                            signal: controller.signal,
-                        };
-                        const credential = (await navigator.credentials.get(credentialOptions));
+                        debug.log('Calling navigator.credentials.get with mediation:', requestedMediation, modernMode ? `mode: ${modernMode}` : '');
+                        let credential;
+                        try {
+                            credential = await credentials.get(buildCredentialOptions(modernMode));
+                        }
+                        catch (modeError) {
+                            // Chrome 125–131 only knows the legacy 'button'/'widget' enum and
+                            // throws a synchronous TypeError for the modern 'active'/'passive'
+                            // values. Retry once with the legacy value so older browsers work.
+                            if (modernMode && isUnknownModeEnumError(modeError)) {
+                                const legacyMode = MODERN_TO_LEGACY_MODE[modernMode];
+                                debug.log(`Browser rejected modern mode '${modernMode}'; retrying with legacy mode '${legacyMode}'`);
+                                credential = await credentials.get(buildCredentialOptions(legacyMode));
+                            }
+                            else {
+                                throw modeError;
+                            }
+                        }
                         debug.log('navigator.credentials.get returned:', {
                             hasCredential: !!credential,
                             type: credential?.type,
                             hasToken: !!credential?.token,
                         });
-                        if (!credential || credential.type !== 'identity') {
+                        if (!credential || credential.type !== 'identity' || !credential.token) {
                             debug.log('No valid identity credential returned');
                             return null;
                         }