@tollbooth-dpyc/web 2.0.0 → 2.0.1

package/dist/holder.js

@@ -26,8 +26,12 @@ function operator() {
 export function holderEnabled() {
     return Boolean(tollboothConfig().operatorUrl);
 }
+/**
+ * Back to the page the sign-in started on, since that page finishes it: a site
+ * whose `/` is not the sign-in page would otherwise drop the code on the floor.
+ */
 function redirectUri() {
-    return `${globalThis.location.origin}/`;
+    return `${globalThis.location.origin}${globalThis.location.pathname}`;
 }
 function readTokens() {
     try {
@@ -49,13 +53,13 @@ async function challengeFor(verifier) {
     const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier)));
     return btoa(String.fromCharCode(...digest)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
-async function register() {
+async function register(redirect) {
     const r = await fetch(`${operator()}/register`, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
             client_name: tollboothConfig().appName,
-            redirect_uris: [redirectUri()],
+            redirect_uris: [redirect],
             grant_types: ["authorization_code", "refresh_token"],
             response_types: ["code"],
             token_endpoint_auth_method: "none",
@@ -90,16 +94,17 @@ export function isHolder() {
  * sends it straight back. `resume` comes back from `completeHolderConnect`.
  */
 export async function connectAsHolder(resume) {
-    const clientId = readTokens()?.clientId || (await register());
+    const redirect = redirectUri();
+    const clientId = readTokens()?.clientId || (await register(redirect));
     const verifier = randomUrlSafe(48);
     const state = randomUrlSafe(16);
-    const pending = { clientId, verifier, state, resume };
+    const pending = { clientId, verifier, state, resume, redirectUri: redirect };
     globalThis.sessionStorage.setItem(PENDING, JSON.stringify(pending));
     const url = new URL(`${operator()}/authorize`);
     url.search = new URLSearchParams({
         response_type: "code",
         client_id: clientId,
-        redirect_uri: redirectUri(),
+        redirect_uri: redirect,
         state,
         code_challenge: await challengeFor(verifier),
         code_challenge_method: "S256",
@@ -123,7 +128,7 @@ export async function completeHolderConnect() {
     globalThis.history.replaceState(null, "", globalThis.location.pathname);
     if (params.get("state") !== pending.state)
         throw new Error("The service's reply did not match this sign-in.");
-    writeTokens(await token({ grant_type: "authorization_code", code, redirect_uri: redirectUri(), code_verifier: pending.verifier }, pending.clientId));
+    writeTokens(await token({ grant_type: "authorization_code", code, redirect_uri: pending.redirectUri, code_verifier: pending.verifier }, pending.clientId));
     return pending.resume;
 }
 /** The bearer for the next request, refreshed when it is about to lapse; null when not a holder. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tollbooth-dpyc/web",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "description": "Shared browser SDK for Tollbooth DPYC operator front ends: npub sign-in, proofs, MCP client, profile and wallet",
   "license": "Apache-2.0",
   "author": "Lonnie VanZandt",