@oxyhq/services 22.12.3 → 22.12.5

package/src/ui/utils/oauthReturn.ts

@@ -1,6 +1,7 @@
 import type { OxyServices } from '@oxyhq/core';
 import {
   clearOAuthHandshake,
+  consumeOAuthReturnPath,
   logger,
   normalizeOAuthRedirectUri,
   readOAuthHandshake,
@@ -53,8 +54,10 @@ export async function tryCompleteOAuthReturn(opts: {
     logger.warn('OAuth return ignored: missing or mismatched handshake', {
       component: 'oauthReturn',
     });
-    clearOAuthHandshake();
+    // Consume the return path before clearing the handshake — clearOAuthHandshake
+    // drops the persisted path along with the PKCE keys.
     stripOAuthParamsFromUrl();
+    clearOAuthHandshake();
     return false;
   }
 
@@ -70,8 +73,9 @@ export async function tryCompleteOAuthReturn(opts: {
       codeVerifier: handshake.codeVerifier,
     });
     // Strip OAuth params before commit so a stale `?code=` cannot re-enter the exchange loop.
-    clearOAuthHandshake();
+    // Read the return path first — clearOAuthHandshake drops it with the PKCE keys.
     stripOAuthParamsFromUrl();
+    clearOAuthHandshake();
     await opts.commitSession({
       sessionId: result.sessionId,
       accessToken: result.accessToken,
@@ -84,12 +88,55 @@ export async function tryCompleteOAuthReturn(opts: {
     return true;
   } catch (error) {
     logger.warn('OAuth return exchange failed', { component: 'oauthReturn' }, error);
-    clearOAuthHandshake();
     stripOAuthParamsFromUrl();
+    clearOAuthHandshake();
     return false;
   }
 }
 
+/**
+ * Rewrite the address bar after an authorize round trip, and tell the router.
+ *
+ * Prefers the page the visit started on (see `persistOAuthReturnPath`) over the
+ * bare origin the IdP redirected to, falling back to `fallbackUrl` when nothing
+ * was recorded.
+ *
+ * The `popstate` dispatch is the load-bearing part. `history.replaceState`
+ * fires no event, and cold boot runs *inside* the mounted app — by the time
+ * this executes, a history-based router (React Router, Vue Router, …) has
+ * already read `location` and rendered the route for `/`. Without a
+ * notification the address bar would show the restored deep link while the page
+ * still displayed the home page. `popstate` is the event the History API
+ * defines for exactly this, and it is what those routers subscribe to.
+ *
+ * Only dispatched when the URL actually changed, so the common no-op case does
+ * not push a spurious event at every listener on the page.
+ */
+export function replaceUrlAfterOAuthReturn(fallbackUrl: string): void {
+  const location = (globalThis as { location?: Location }).location;
+  const history = (globalThis as { history?: History }).history;
+  if (!location || !history?.replaceState) return;
+
+  const current = `${location.pathname}${location.search}${location.hash}`;
+  const target = consumeOAuthReturnPath() ?? fallbackUrl;
+  history.replaceState(history.state, '', target);
+  if (target === current) return;
+
+  const dispatch = (globalThis as { dispatchEvent?: (event: Event) => boolean }).dispatchEvent;
+  if (typeof dispatch !== 'function') return;
+  try {
+    // `PopStateEvent` is web-only; plain `Event` is a good enough carrier for
+    // any host that lacks it (routers read `location`, not `event.state`).
+    const event =
+      typeof PopStateEvent === 'function'
+        ? new PopStateEvent('popstate', { state: history.state })
+        : new Event('popstate');
+    dispatch.call(globalThis, event);
+  } catch (error) {
+    logger.warn('Could not notify router of restored URL', { component: 'oauthReturn' }, error);
+  }
+}
+
 function stripOAuthParamsFromUrl(): void {
   const location = (globalThis as { location?: Location; history?: History }).location;
   const history = (globalThis as { history?: History }).history;
@@ -100,7 +147,7 @@ function stripOAuthParamsFromUrl(): void {
   url.searchParams.delete('error');
   url.searchParams.delete('error_description');
   url.searchParams.delete('hub_sync');
-  history.replaceState(history.state, '', `${url.pathname}${url.search}${url.hash}`);
+  replaceUrlAfterOAuthReturn(`${url.pathname}${url.search}${url.hash}`);
 }
 
 /**