@oxyhq/core 2.2.0 → 2.2.1

package/dist/cjs/mixins/OxyServices.popup.js

@@ -191,17 +191,25 @@ function OxyServicesPopupAuthMixin(Base) {
                 const timeout = options.timeout || this.constructor.SILENT_TIMEOUT;
                 const nonce = this.generateNonce();
                 const clientId = window.location.origin;
+                // Resolve the IdP origin for the iframe. An explicit per-apex override (the
+                // durable cross-domain reload path — see `SilentAuthOptions.authWebUrlOverride`)
+                // wins over the instance's configured central auth URL. The SAME origin is
+                // handed to `waitForIframeAuth` so the postMessage origin check matches the
+                // exact host the iframe was loaded from.
+                const authOrigin = options.authWebUrlOverride && options.authWebUrlOverride.length > 0
+                    ? options.authWebUrlOverride
+                    : this.resolveAuthUrl();
                 const iframe = document.createElement('iframe');
                 iframe.style.display = 'none';
                 iframe.style.position = 'absolute';
                 iframe.style.width = '0';
                 iframe.style.height = '0';
                 iframe.style.border = 'none';
-                const silentUrl = `${this.resolveAuthUrl()}/auth/silent?` + `client_id=${encodeURIComponent(clientId)}&` + `nonce=${nonce}`;
+                const silentUrl = `${authOrigin}/auth/silent?` + `client_id=${encodeURIComponent(clientId)}&` + `nonce=${nonce}`;
                 iframe.src = silentUrl;
                 document.body.appendChild(iframe);
                 try {
-                    const session = await this.waitForIframeAuth(iframe, timeout, clientId);
+                    const session = await this.waitForIframeAuth(iframe, timeout, authOrigin);
                     // Bail early on incomplete responses. The iframe contract requires
                     // both an access token and a session id; anything less is unusable.
                     // Returning `null` here (without installing the token) prevents a
@@ -389,8 +397,11 @@ function OxyServicesPopupAuthMixin(Base) {
                         resolve(null); // Silent failure - don't throw
                     }, timeout);
                     const messageHandler = (event) => {
-                        // Verify origin
-                        if (event.origin !== this.resolveAuthUrl()) {
+                        // Verify origin against the EXACT host the iframe was loaded from
+                        // (`expectedOrigin`). For the per-apex durable-restore path this is
+                        // `auth.<rp-apex>`, not the instance's central `resolveAuthUrl()` — so
+                        // we must honour the caller-supplied origin, never re-derive it here.
+                        if (event.origin !== expectedOrigin) {
                             return;
                         }
                         const { type, session } = event.data;