@polyguard/sdk 1.4.1 → 1.4.2

package/dist/sdk.esm.js

@@ -10984,6 +10984,7 @@ function handleWebSocketMessage(event, ctx) {
     const { sidebarUrl, link_uuid } = ctx;
     if (sidebarUrl && redirectUrl) {
       const hasMsftSession = document.cookie.includes("pg_msft_session");
+      ctx.markClosed();
       cleanup();
       ws.close();
       if (hasMsftSession) {
@@ -11145,7 +11146,10 @@ var PolyguardWebsocketClientImpl = class {
           reconnectionDelayGrowFactor: 1.5
         };
         ws = new reconnecting_websocket_mjs_default(wsUrl, [], options);
-        const ctx = { ws, qrDiv, isTargetMode, modal, cleanup, returnError, clearError, resolve, rawJwt, sidebarUrl: this.sidebarUrl, link_uuid: this.link_uuid };
+        const markClosed = () => {
+          closed = true;
+        };
+        const ctx = { ws, qrDiv, isTargetMode, modal, cleanup, markClosed, returnError, clearError, resolve, rawJwt, sidebarUrl: this.sidebarUrl, link_uuid: this.link_uuid };
         ws.addEventListener("message", (event) => handleWebSocketMessage(event, ctx));
         ws.addEventListener("error", () => {
           console.error("WebSocket error");

package/dist/sdk.js

@@ -11017,6 +11017,7 @@ var Polyguard = (() => {
       const { sidebarUrl, link_uuid } = ctx;
       if (sidebarUrl && redirectUrl) {
         const hasMsftSession = document.cookie.includes("pg_msft_session");
+        ctx.markClosed();
         cleanup();
         ws.close();
         if (hasMsftSession) {
@@ -11178,7 +11179,10 @@ var Polyguard = (() => {
             reconnectionDelayGrowFactor: 1.5
           };
           ws = new reconnecting_websocket_mjs_default(wsUrl, [], options);
-          const ctx = { ws, qrDiv, isTargetMode, modal, cleanup, returnError, clearError, resolve, rawJwt, sidebarUrl: this.sidebarUrl, link_uuid: this.link_uuid };
+          const markClosed = () => {
+            closed = true;
+          };
+          const ctx = { ws, qrDiv, isTargetMode, modal, cleanup, markClosed, returnError, clearError, resolve, rawJwt, sidebarUrl: this.sidebarUrl, link_uuid: this.link_uuid };
           ws.addEventListener("message", (event) => handleWebSocketMessage(event, ctx));
           ws.addEventListener("error", () => {
             console.error("WebSocket error");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@polyguard/sdk",
-  "version": "1.4.1",
+  "version": "1.4.2",
   "type": "module",
   "main": "dist/sdk.esm.js",
   "module": "dist/sdk.esm.js",

package/src/PolyguardWebsocketClientImpl.js

@@ -136,7 +136,8 @@ export class PolyguardWebsocketClientImpl {
         };
         ws = new ReconnectingWebSocket(wsUrl, [], options);
 
-        const ctx = { ws, qrDiv, isTargetMode, modal, cleanup, returnError, clearError, resolve, rawJwt, sidebarUrl: this.sidebarUrl, link_uuid: this.link_uuid };
+        const markClosed = () => { closed = true; };
+        const ctx = { ws, qrDiv, isTargetMode, modal, cleanup, markClosed, returnError, clearError, resolve, rawJwt, sidebarUrl: this.sidebarUrl, link_uuid: this.link_uuid };
         ws.addEventListener('message', (event) => handleWebSocketMessage(event, ctx));
 
         ws.addEventListener('error', () => {

package/src/__tests__/sidebar.test.js

@@ -243,6 +243,30 @@ describe('sidebarUrl feature', () => {
       await promise;
       expect(window.location.assign).toHaveBeenCalledWith('https://teams.microsoft.com/meet/123');
     });
+
+    it('button survives a late WebSocket close event (race regression)', async () => {
+      // Real browsers dispatch the 'close' event asynchronously after ws.close(),
+      // so it lands after the synchronous button append. If the close listener's
+      // cleanup() runs in that window, it wipes the qrDiv — and the button with it.
+      // markClosed() in the message handler must defuse the close listener.
+      clearCookies();
+      vi.stubGlobal('open', vi.fn().mockReturnValue({}));
+      const client = new PolyguardWebsocketClientImpl({
+        ...DEFAULT_PARAMS,
+        sidebarUrl: 'https://teams.polyguard.ai/ms-teams/sidebar-standalone',
+        link_uuid: 'link-abc',
+      });
+      document.body.innerHTML = '<div id="test-target"></div>';
+      const jwtClaims = { redirect_url: 'https://teams.microsoft.com/meet/123' };
+      const { promise, ws } = await startVerifyAndGetWs(client, 'test-target');
+      ws.simulateMessage({ jwt: jwtClaims });
+      expect(document.querySelector('#polyguard-join-meeting')).not.toBeNull();
+      // Mimic a real browser dispatching close on the next tick (after the message handler returned).
+      ws.simulateClose();
+      expect(document.querySelector('#polyguard-join-meeting')).not.toBeNull();
+      document.querySelector('#polyguard-join-meeting').click();
+      await promise;
+    });
   });
 
   describe('with sidebarUrl but no redirect_url in JWT (non-meeting links)', () => {

package/src/messageHandler.js

@@ -61,6 +61,11 @@ export function handleWebSocketMessage(event, ctx) {
     // the SDK handles the redirect (and optionally opens a sidebar popup).
     if (sidebarUrl && redirectUrl) {
       const hasMsftSession = document.cookie.includes('pg_msft_session');
+      // Mark the socket as intentionally closed BEFORE ws.close() so the
+      // 'close' event listener in verify() skips its own cleanup(). Otherwise
+      // the async close handler races with the synchronous button append below
+      // and wipes the qrDiv after we've put the button in it.
+      ctx.markClosed();
       cleanup();
       ws.close();