@oxyhq/services 5.20.3 → 5.21.2

package/src/ui/hooks/useAuth.ts

@@ -108,10 +108,9 @@ export function useAuth(): UseAuthReturn {
       window.location.hostname === 'auth.oxy.so';
 
     // Web (not on IdP): Use popup-based authentication
-    // We skip FedCM here because:
-    // 1. Silent FedCM already ran on page load (via useWebSSO)
-    // 2. If user is clicking "Sign In", they need interactive auth
-    // 3. Doing FedCM first loses the "user gesture" needed for popups
+    // We go straight to popup to preserve the "user gesture" (click event)
+    // FedCM silent SSO already runs on page load via useWebSSO
+    // If user is clicking "Sign In", they need interactive auth NOW
     if (isWebBrowser() && !publicKey && !isIdentityProvider) {
       try {
         const popupSession = await (oxyServices as any).signInWithPopup?.();

package/src/ui/hooks/useWebSSO.ts

@@ -30,6 +30,8 @@ interface UseWebSSOOptions {
 interface UseWebSSOResult {
   /** Manually trigger SSO check */
   checkSSO: () => Promise<SessionLoginResponse | null>;
+  /** Trigger interactive FedCM sign-in (shows browser UI) */
+  signInWithFedCM: () => Promise<SessionLoginResponse | null>;
   /** Whether SSO check is in progress */
   isChecking: boolean;
   /** Whether FedCM is supported in this browser */
@@ -85,12 +87,20 @@ export function useWebSSO({
   const fedCMSupported = isWebBrowser() && (oxyServices as any).isFedCMSupported?.();
 
   const checkSSO = useCallback(async (): Promise<SessionLoginResponse | null> => {
+    console.log('[useWebSSO] checkSSO called', {
+      isWebBrowser: isWebBrowser(),
+      isChecking: isCheckingRef.current,
+      isIdP: isIdentityProvider(),
+      fedCMSupported,
+    });
+
     if (!isWebBrowser() || isCheckingRef.current) {
       return null;
     }
 
     // Don't use FedCM on the auth domain itself - it would authenticate against itself
     if (isIdentityProvider()) {
+      console.log('[useWebSSO] Skipping - on identity provider domain');
       onSSOUnavailable?.();
       return null;
     }
@@ -98,27 +108,39 @@ export function useWebSSO({
     // FedCM is the only reliable cross-domain SSO mechanism
     // Third-party cookies are deprecated and unreliable
     if (!fedCMSupported) {
+      console.log('[useWebSSO] Skipping - FedCM not supported');
       onSSOUnavailable?.();
       return null;
     }
 
     isCheckingRef.current = true;
+    console.log('[useWebSSO] Starting FedCM silent sign-in...');
 
     try {
       // Use FedCM for cross-domain SSO
       // This works because browser treats IdP requests as first-party
       const session = await (oxyServices as any).silentSignInWithFedCM?.();
 
+      console.log('[useWebSSO] FedCM result:', {
+        hasSession: !!session,
+        hasUser: !!session?.user,
+        hasSessionId: !!session?.sessionId,
+      });
+
       if (session) {
+        console.log('[useWebSSO] Session found, calling onSessionFound...');
         await onSessionFound(session);
+        console.log('[useWebSSO] onSessionFound completed');
         return session;
       }
 
       // No session found - user needs to sign in
+      console.log('[useWebSSO] No session returned from FedCM');
       onSSOUnavailable?.();
       return null;
     } catch (error) {
       // FedCM failed - could be network error, user not signed in, etc.
+      console.error('[useWebSSO] FedCM error:', error);
       onSSOUnavailable?.();
       onError?.(error instanceof Error ? error : new Error(String(error)));
       return null;
@@ -127,9 +149,69 @@ export function useWebSSO({
     }
   }, [oxyServices, onSessionFound, onSSOUnavailable, onError, fedCMSupported]);
 
+  /**
+   * Trigger interactive FedCM sign-in
+   * This shows the browser's native "Sign in with Oxy" prompt.
+   * Use this when silent mediation fails (user hasn't previously consented).
+   */
+  const signInWithFedCM = useCallback(async (): Promise<SessionLoginResponse | null> => {
+    console.log('[useWebSSO] signInWithFedCM called');
+
+    if (!isWebBrowser() || isCheckingRef.current) {
+      return null;
+    }
+
+    if (!fedCMSupported) {
+      console.log('[useWebSSO] FedCM not supported for interactive sign-in');
+      onError?.(new Error('FedCM is not supported in this browser'));
+      return null;
+    }
+
+    isCheckingRef.current = true;
+    console.log('[useWebSSO] Starting interactive FedCM sign-in...');
+
+    try {
+      // Use interactive sign-in (shows browser UI)
+      const session = await (oxyServices as any).signInWithFedCM?.();
+
+      console.log('[useWebSSO] Interactive FedCM result:', {
+        hasSession: !!session,
+        hasUser: !!session?.user,
+        hasSessionId: !!session?.sessionId,
+      });
+
+      if (session) {
+        console.log('[useWebSSO] Interactive session found, calling onSessionFound...');
+        await onSessionFound(session);
+        console.log('[useWebSSO] onSessionFound completed');
+        return session;
+      }
+
+      return null;
+    } catch (error) {
+      console.error('[useWebSSO] Interactive FedCM error:', error);
+      onError?.(error instanceof Error ? error : new Error(String(error)));
+      return null;
+    } finally {
+      isCheckingRef.current = false;
+    }
+  }, [oxyServices, onSessionFound, onError, fedCMSupported]);
+
   // Auto-check SSO on mount (web only, FedCM only, not on auth domain)
   useEffect(() => {
+    console.log('[useWebSSO] Effect running:', {
+      enabled,
+      isWeb: isWebBrowser(),
+      hasChecked: hasCheckedRef.current,
+      isIdP: isIdentityProvider(),
+      fedCMSupported,
+      hostname: typeof window !== 'undefined' ? window.location.hostname : 'unknown',
+    });
+
     if (!enabled || !isWebBrowser() || hasCheckedRef.current || isIdentityProvider()) {
+      console.log('[useWebSSO] Skipping SSO check:', {
+        reason: !enabled ? 'not enabled' : !isWebBrowser() ? 'not web' : hasCheckedRef.current ? 'already checked' : 'is IdP',
+      });
       if (isIdentityProvider()) {
         onSSOUnavailable?.();
       }
@@ -142,12 +224,14 @@ export function useWebSSO({
       checkSSO();
     } else {
       // Browser doesn't support FedCM - notify caller
+      console.log('[useWebSSO] FedCM not supported');
       onSSOUnavailable?.();
     }
   }, [enabled, checkSSO, fedCMSupported, onSSOUnavailable]);
 
   return {
     checkSSO,
+    signInWithFedCM,
     isChecking: isCheckingRef.current,
     isFedCMSupported: fedCMSupported,
   };