@runappsai/sdk 0.7.7 → 0.7.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runappsai/sdk",
-  "version": "0.7.7",
+  "version": "0.7.9",
   "description": "JavaScript / TypeScript client for the RunApps AI Gateway",
   "license": "MIT",
   "author": "RunApps",

package/src/browser-auth.ts

@@ -115,8 +115,17 @@ const TOKEN_REFRESH_MARGIN_S = 60;
 // unsuffixed key, which preserves back-compat for already-persisted
 // tokens after upgrade.
 const STORAGE_KEY_BASE = "__runapps_auth_v1__";
-/** window.name of the sign-in popup; the page loaded in it closes itself. */
+/** window.name of the sign-in popup. */
 const POPUP_NAME = "runapps-signin";
+/** Query parameter marking the app URL the popup lands on when the host
+ *  has no callback page (window.name is reset by a COOP swap, so it
+ *  cannot carry the mark). */
+const POPUP_PARAM = "runapps_popup";
+/** The callback page every app host on the platform serves: it stores the
+ *  token for the app and closes, without loading the app. */
+const POPUP_CALLBACK_PATH = "/__runapps/signin.html";
+/** Hosts whose backend serves POPUP_CALLBACK_PATH. */
+const hasCallbackPage = (hostname: string) => /\.runapps\.dev$/i.test(hostname) || /\.localhost$/i.test(hostname);
 // Written by SDK 0.3 and earlier; read once and migrated, so an upgrade
 // keeps the user signed in.
 const LEGACY_STORAGE_KEY_BASE = "__runjobs_auth_v1__";
@@ -182,6 +191,7 @@ export class BrowserAuth {
   private expiresAt = 0;
   private signInMode: "redirect" | "popup";
   private popupWait: Promise<void> | null = null;
+  private popupOpenedAt = 0;
   private userInfo: BrowserUser | null = null;
   private listeners: Array<(token: string) => void> = [];
   private parentHandshake: Promise<void> | null = null;
@@ -216,8 +226,9 @@ export class BrowserAuth {
     // sticky flag — the user explicitly signed in again.
     if (this.consumeFragment()) {
       this.clearSignedOut();
-      if (window.name === POPUP_NAME) {
-        // We are the sign-in popup: the token is in localStorage, which
+      if (new URLSearchParams(location.search).has(POPUP_PARAM)) {
+        // We are the sign-in popup, landed on the app itself (no callback
+        // page on this host): the token is already in localStorage, which
         // the opener (same origin) sees through its `storage` event.
         this.finishPopup();
         return;
@@ -250,7 +261,10 @@ export class BrowserAuth {
     // user to click signIn.  Without this guard, the backend's
     // auto-grant flow would re-issue a token on every page reload
     // (the cookie on the gateway domain is still valid).
-    if (this.isSignedOut()) {
+    // In popup mode a signed-out user is simply asked to sign in again:
+    // the popup only ever opens on the user's own action, so there is no
+    // page to lose and no reason to refuse the call.
+    if (this.isSignedOut() && !(this.signInMode === "popup" && !this.inIframe())) {
       throw new Error("RunApps: signed out — call client.signIn() to authenticate");
     }
 
@@ -399,8 +413,18 @@ export class BrowserAuth {
     this.signingIn = true;
     location.href = this.grantUrlForThisPage();
   }
-  private grantUrlForThisPage(): string {
-    const ret = location.href.split("#")[0] ?? location.href;
+  private grantUrlForThisPage(popup = false): string {
+    let ret = location.href.split("#")[0] ?? location.href;
+    if (popup) {
+      if (hasCallbackPage(location.hostname)) {
+        const q = new URLSearchParams({ key: storageKey(this.project), origin: this.origin });
+        ret = location.origin + POPUP_CALLBACK_PATH + "?" + q.toString();
+      } else {
+        const u = new URL(ret);
+        u.searchParams.set(POPUP_PARAM, "1");
+        ret = u.toString();
+      }
+    }
     const scheme = window.matchMedia?.("(prefers-color-scheme: dark)")
       .matches
       ? "dark"
@@ -414,55 +438,89 @@ export class BrowserAuth {
   }
   /** Popup grant flow. One popup at a time; concurrent callers share it. */
   private signInPopup(): Promise<void> {
-    if (this.popupWait) return this.popupWait;
+    // One popup at a time; a click a few seconds later (the user closed
+    // the first one, say) opens a fresh one and joins the same wait.
+    const now = Date.now();
+    if (this.popupWait && now - this.popupOpenedAt < 3000) return this.popupWait;
     this.clearSignedOut();
     const key = storageKey(this.project);
-    const win = window.open(this.grantUrlForThisPage(), POPUP_NAME, "popup=yes,width=520,height=700");
+    const open = () => window.open(this.grantUrlForThisPage(true), POPUP_NAME, "popup=yes,width=520,height=700");
+    let win = open();
     if (!win) {
-      // Popup blocked: the redirect is the only way left.
-      this.signingIn = true;
-      location.href = this.grantUrlForThisPage();
-      return new Promise(() => {});
-    }
-    this.popupWait = new Promise<void>((resolve, reject) => {
-      let timer = 0;
-      const done = (err?: Error) => {
-        window.removeEventListener("storage", onStorage);
-        window.clearInterval(timer);
+      // Blocked — usually because no user gesture is active (a call made
+      // at load, or after a long await). Open it on the user's next click
+      // or key press instead; only a popup blocked on a real gesture falls
+      // back to the redirect.
+      if (this.popupWait) return this.popupWait;
+      this.popupWait = this.waitForUserGesture().then(() => {
         this.popupWait = null;
-        if (err) reject(err); else resolve();
+        win = open();
+        if (!win) {
+          this.signingIn = true;
+          location.href = this.grantUrlForThisPage();
+          return new Promise<void>(() => {});
+        }
+        return this.waitForPopupToken(key, Date.now());
+      });
+      return this.popupWait;
+    }
+    if (this.popupWait) { this.popupOpenedAt = now; return this.popupWait; }
+    return this.waitForPopupToken(key, now);
+  }
+  /** Resolves on the next click, tap or key press anywhere in the page. */
+  private waitForUserGesture(): Promise<void> {
+    return new Promise((resolve) => {
+      const types = ["pointerdown", "keydown", "touchend"];
+      const handler = () => {
+        for (const t of types) window.removeEventListener(t, handler, true);
+        resolve();
       };
+      for (const t of types) window.addEventListener(t, handler, true);
+    });
+  }
+  private waitForPopupToken(key: string, openedAt: number): Promise<void> {
+    this.popupOpenedAt = openedAt;
+    // Under COOP the popup's handle is cut off as soon as it leaves this
+    // origin (`win.closed` reads true), so a closed popup cannot be told
+    // from one still signing in: the promise stays pending until a token
+    // arrives, like Puter's own sign-in.
+    this.popupWait = new Promise<void>((resolve) => {
+      let timer = 0;
       const adopt = (): boolean => {
         const before = this.token;
         this.loadPersisted();
         if (!this.tokenIsFresh()) return false;
         if (this.token !== before) this.setToken(this.token as string, this.expiresAt, this.userInfo ?? undefined);
         else if (this.userInfo && !this.hideBadge) this.renderBadge();
-        try { win.close(); } catch { /* already gone */ }
-        done();
+        window.removeEventListener("storage", onStorage);
+        window.clearInterval(timer);
+        this.popupWait = null;
+        resolve();
         return true;
       };
       const onStorage = (e: StorageEvent) => {
         if (e.key === key && e.newValue) adopt();
       };
       window.addEventListener("storage", onStorage);
-      timer = window.setInterval(() => {
-        if (adopt()) return;
-        if (win.closed) done(new Error("RunApps: sign-in was cancelled"));
-      }, 500);
+      timer = window.setInterval(adopt, 1000);
     });
     return this.popupWait;
   }
   /** Inside the popup, after the token landed: close, or say so. */
   private finishPopup() {
     try { window.close(); } catch { /* not script-closable */ }
-    window.setTimeout(() => {
-      if (window.closed) return;
-      document.documentElement.innerHTML =
-        '<head><meta charset="utf-8"><title>Signed in</title></head>' +
-        '<body style="margin:0;display:flex;align-items:center;justify-content:center;height:100vh;font:15px/1.5 -apple-system,BlinkMacSystemFont,Segoe UI,Roboto,sans-serif;color:#333;background:#fafafa">' +
-        "<p>Signed in. You can close this window and go back to the app.</p></body>";
-    }, 400);
+    if (window.closed) return;
+    // Still open: stop the app from loading and show a plain page instead.
+    try { window.stop(); } catch { /* ignore */ }
+    try {
+      document.open();
+      document.write(
+        '<!doctype html><html><head><meta charset="utf-8"><title>Signed in</title></head>' +
+        '<body style="margin:0;display:flex;align-items:center;justify-content:center;height:100vh;font:15px/1.5 -apple-system,BlinkMacSystemFont,Segoe UI,Roboto,sans-serif;color:#333;background:#fafafa;text-align:center">' +
+        '<div><p>Signed in. You can go back to the app.</p><button onclick="window.close()" style="padding:8px 16px;font:inherit;border:1px solid #ccc;border-radius:8px;background:#fff;cursor:pointer">Close this window</button></div></body></html>',
+      );
+      document.close();
+    } catch { /* ignore */ }
   }
 
   /**