@rhinestone/1auth 0.7.2 → 0.7.4

package/dist/index.mjs

@@ -2984,7 +2984,7 @@ var OneAuthClient = class {
    * @param cleanup - Idempotent teardown function that closes and removes the dialog.
    * @returns A `SigningResult` discriminated union.
    */
-  waitForIntentSigningResponse(requestId, dialog, _iframe, cleanup) {
+  waitForIntentSigningResponse(requestId, dialog, iframe, cleanup) {
     const dialogOrigin = this.getDialogOrigin();
     return new Promise((resolve) => {
       const handleMessage = (event) => {
@@ -3010,7 +3010,7 @@ var OneAuthClient = class {
               }
             });
           }
-        } else if (message?.type === "PASSKEY_CLOSE") {
+        } else if (message?.type === "PASSKEY_CLOSE" && event.source === iframe.contentWindow) {
           window.removeEventListener("message", handleMessage);
           cleanup();
           resolve({
@@ -3041,12 +3041,13 @@ var OneAuthClient = class {
    *     forward to the execute endpoint.
    *
    * @param dialog - The `<dialog>` element wrapping the signing iframe.
-   * @param _iframe - Unused; kept for signature consistency with other wait helpers.
+   * @param iframe - The signing iframe; used to authenticate the source of
+   *   `PASSKEY_CLOSE` so a sibling same-origin dialog can't forge a rejection.
    * @param cleanup - Idempotent teardown that closes and removes the dialog.
    * @returns A `SigningResult` extended with an optional `signedHash` field
    *   populated when the dialog performs message signing.
    */
-  waitForSigningResponse(dialog, _iframe, cleanup) {
+  waitForSigningResponse(dialog, iframe, cleanup) {
     const dialogOrigin = this.getDialogOrigin();
     return new Promise((resolve) => {
       const handleMessage = (event) => {
@@ -3077,7 +3078,7 @@ var OneAuthClient = class {
               }
             });
           }
-        } else if (message?.type === "PASSKEY_CLOSE") {
+        } else if (message?.type === "PASSKEY_CLOSE" && event.source === iframe.contentWindow) {
           window.removeEventListener("message", handleMessage);
           cleanup();
           resolve({
@@ -3160,7 +3161,7 @@ var OneAuthClient = class {
               }
             });
           }
-        } else if (message?.type === "PASSKEY_CLOSE") {
+        } else if (message?.type === "PASSKEY_CLOSE" && event.source === iframe.contentWindow) {
           window.removeEventListener("message", handleMessage);
           cleanup();
           resolve({
@@ -3410,7 +3411,7 @@ var OneAuthClient = class {
               );
             }
           });
-        } else if (event.data?.type === "PASSKEY_CLOSE") {
+        } else if (event.data?.type === "PASSKEY_CLOSE" && event.source === iframe.contentWindow) {
           teardown();
           cleanup();
           resolve({ ready: false });
@@ -4433,7 +4434,7 @@ var OneAuthClient = class {
             blindSigning
           }, dialogOrigin);
           resolve(true);
-        } else if (event.data?.type === "PASSKEY_CLOSE") {
+        } else if (event.data?.type === "PASSKEY_CLOSE" && event.source === iframe.contentWindow) {
           teardown();
           cleanup();
           resolve(false);
@@ -5076,7 +5077,7 @@ var OneAuthClient = class {
               message: "Permission grant failed"
             }
           });
-        } else if (data?.type === "PASSKEY_CLOSE") {
+        } else if (data?.type === "PASSKEY_CLOSE" && event.source === iframe.contentWindow) {
           teardown();
           cleanup();
           resolve({