@zoreal/oauth2-react 0.2.15 → 0.2.17

package/README.md

@@ -251,7 +251,7 @@ What the modal does:
 
 | | |
 | --- | --- |
-| **Mobile** | No QR and no modal. The SDK creates the pairing and sends the tab to the pairing link, which the ZOREAL ID app claims; with no app installed the same link is the page that installs it. That is one round trip after the tap: `ZorealLogin` disables itself and runs a light round its edge for that gap; a site with its own button keeps that button and draws its own busy state from the tap until `onSuccess` or `onError` fires, or wraps it in `ZorealBusyRing` to get the same light (a wrapper: pass `block` for a full-width button, keep `overflow: hidden` off its ancestors, and expect `.parent > button` selectors to stop matching). Force one or the other with `display: 'qr'` / `'link'`. |
+| **Mobile** | No QR and no modal. The tap itself is a navigation: the SDK sends the tab to the provider's `/pair/start` with the pairing's parameters, synchronously from the click, and the provider answers with a redirect to the pairing's universal link, which the ZOREAL ID app claims while the page stays put and polls. A browser hands a link to an app only inside a navigation the person began, which is why nothing is fetched first. With no app installed the same redirect lands on the page that installs it. Call `login()` from the click handler itself: `ZorealLogin` does, disables itself and runs a light round its edge until the flow ends; a site with its own button keeps that button and draws its own busy state from the tap until `onSuccess` or `onError` fires, or wraps it in `ZorealBusyRing` to get the same light (a wrapper: pass `block` for a full-width button, keep `overflow: hidden` off its ancestors, and expect `.parent > button` selectors to stop matching). Force one or the other with `display: 'qr'` / `'link'`. |
 | **Live status** | The copy and the title follow the pairing: waiting for a scan, then waiting for approval once the holder has claimed the code (the spent QR blurs out behind a phone glyph). |
 | **Title** | Says what the scan is for, inferred from the request: "Scan to sign in" for `openid`, `email` and `profile.name`; "Scan to verify your identity" once a document attribute such as `zoreal.age` or `profile.birthdate` is requested; "Scan to prove you are a real human" for `openid` alone with `acr_values: 'zoreal.live'`. Override with `intent`, one of `'sign-in'`, `'identify'`, `'presence'`, when the scope does not say. |
 | **Countdown** | Counts down to expiry, turning amber under 20s. Reads the clock each tick rather than decrementing, so a backgrounded tab comes back honest. |

package/dist/index.cjs

@@ -41,7 +41,7 @@ var import_react2 = require("react");
 
 // src/wire.ts
 var WIRE_VERSION = 1;
-var SDK_VERSION = "0.2.15";
+var SDK_VERSION = "0.2.17";
 var DEFAULT_ISSUER = "https://id.zoreal.com";
 var POLL_INTERVAL_MS = 2e3;
 var POLL_INTERVAL_ENROLLING_MS = 5e3;
@@ -1370,10 +1370,15 @@ var CSS = `
    sides and lights two edges at once near the ends. So here the light is a
    dash on an SVG outline, which moves at one speed the whole way round
    whatever the shape, drawn with the well's tokens: its colour and head
-   tint, its line width, its halo, its four second lap. pathLength makes the
-   outline 100 units long, so every dash and offset is a percentage of the
-   way round; the three layers share one head at 30 and differ in length
-   and brightness, which is the comet's tail. Shown only while busy. */
+   tint, its line width, its halo, its four second lap. The outline's length
+   is measured by the component and set as --zrl-ring-len, and every dash
+   and offset is a fraction of it, because pathLength does not scale dash
+   values given from CSS. A stroke cannot fade along its length, so the tail
+   is a stack of dashes sharing one head, each shorter and more opaque than
+   the one under it, with opacities chosen so the stack composes to a
+   straight fade from the head to nothing three tenths of the way back; the
+   component sets each layer's length, offset and opacity. Shown only while
+   busy. */
 .${PREFIX}-ring {
   position: relative;
   display: inline-flex;
@@ -1392,6 +1397,7 @@ var CSS = `
 }
 .${PREFIX}-ring[data-busy="true"] > .${PREFIX}-ring-svg { opacity: 1; }
 .${PREFIX}-ring-svg rect {
+  --zrl-l: var(--zrl-ring-len, 600px);
   x: 2px;
   y: 2px;
   width: calc(100% - 4px);
@@ -1400,23 +1406,18 @@ var CSS = `
   stroke: var(--zrl-beam);
   stroke-width: var(--zrl-beam-line);
   stroke-linecap: round;
+  stroke-dashoffset: var(--zrl-s, 0px);
   animation: ${PREFIX}-dash var(--zrl-beam-time) linear infinite;
 }
-.${PREFIX}-ring-tail { stroke-dasharray: 30 70; stroke-dashoffset: 0; opacity: 0.35; }
-.${PREFIX}-ring-body { stroke-dasharray: 16 84; stroke-dashoffset: -14; opacity: 0.8; }
-.${PREFIX}-ring-head { stroke-dasharray: 5 95; stroke-dashoffset: -25; stroke: var(--zrl-beam-head); }
+.${PREFIX}-ring-head { stroke: var(--zrl-beam-head); }
 .${PREFIX}-ring-halo {
-  stroke-dasharray: 30 70;
-  stroke-dashoffset: 0;
   stroke-width: calc(var(--zrl-glow-core) * 2 + var(--zrl-beam-line));
-  opacity: calc(var(--zrl-glow-opacity) * 0.5);
   filter: blur(var(--zrl-glow-blur));
 }
 @keyframes ${PREFIX}-dash {
-  to { stroke-dashoffset: calc(var(--zrl-dash-start, 0) - 100); }
+  from { stroke-dashoffset: var(--zrl-s, 0px); }
+  to { stroke-dashoffset: calc(var(--zrl-s, 0px) - var(--zrl-l)); }
 }
-.${PREFIX}-ring-body { --zrl-dash-start: -14; }
-.${PREFIX}-ring-head { --zrl-dash-start: -25; }
 @media (prefers-reduced-motion: reduce) {
   .${PREFIX}-ring-svg rect { animation: none; stroke-dasharray: none; opacity: 0.45; }
   .${PREFIX}-ring-halo, .${PREFIX}-ring-head { display: none; }
@@ -1690,6 +1691,20 @@ async function startPairing(issuer, params) {
   }
   return body;
 }
+function sameDeviceStartUrl(issuer, params) {
+  const query = new URLSearchParams();
+  const all = {
+    ...params,
+    code_challenge_method: "S256",
+    wire_version: WIRE_VERSION,
+    sdk: `@zoreal/oauth2-react/${SDK_VERSION}`
+  };
+  for (const [key, value] of Object.entries(all)) {
+    if (value === void 0 || value === null || value === "") continue;
+    query.set(key, String(value));
+  }
+  return `${issuer}/pair/start?${query.toString()}`;
+}
 function qrRefreshSecondsOf(started) {
   const seconds = started.qr_refresh_seconds;
   return typeof seconds === "number" && seconds > 0 ? seconds : DEFAULT_QR_REFRESH_SECONDS;
@@ -1746,6 +1761,11 @@ async function pollUntilApproved(issuer, requestId, onState, signal, options = {
         signal
       });
       const body = await parseJson(response);
+      if (response.status === 404 && (options.tolerateUnknownUntil ?? 0) > Date.now()) {
+        emit({ status: "pending" });
+        await sleep(POLL_INTERVAL_MS, signal);
+        continue;
+      }
       if (!response.ok) {
         throw new OAuthFlowError(
           body.error ?? "server_error",
@@ -1827,11 +1847,154 @@ async function challengeS256(verifier) {
   const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
   return base64url(new Uint8Array(digest));
 }
+function challengeS256Sync(verifier) {
+  return base64url(sha256(new TextEncoder().encode(verifier)));
+}
+var K = new Uint32Array([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+]);
+var rotr = (x, n) => x >>> n | x << 32 - n;
+function sha256(message) {
+  const H = new Uint32Array([
+    1779033703,
+    3144134277,
+    1013904242,
+    2773480762,
+    1359893119,
+    2600822924,
+    528734635,
+    1541459225
+  ]);
+  const length = message.length;
+  const padded = new Uint8Array(length + 9 + 63 >> 6 << 6);
+  padded.set(message);
+  padded[length] = 128;
+  const view = new DataView(padded.buffer);
+  const bits = length * 8;
+  view.setUint32(padded.length - 8, Math.floor(bits / 4294967296));
+  view.setUint32(padded.length - 4, bits >>> 0);
+  const W = new Uint32Array(64);
+  for (let offset = 0; offset < padded.length; offset += 64) {
+    for (let i = 0; i < 16; i++) W[i] = view.getUint32(offset + i * 4);
+    for (let i = 16; i < 64; i++) {
+      const w15 = W[i - 15];
+      const w2 = W[i - 2];
+      const s0 = rotr(w15, 7) ^ rotr(w15, 18) ^ w15 >>> 3;
+      const s1 = rotr(w2, 17) ^ rotr(w2, 19) ^ w2 >>> 10;
+      W[i] = W[i - 16] + s0 + W[i - 7] + s1 >>> 0;
+    }
+    let [a, b, c, d, e, f, g, h] = H;
+    for (let i = 0; i < 64; i++) {
+      const S1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
+      const ch = e & f ^ ~e & g;
+      const t1 = h + S1 + ch + K[i] + W[i] >>> 0;
+      const S0 = rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22);
+      const maj = a & b ^ a & c ^ b & c;
+      const t2 = S0 + maj >>> 0;
+      h = g;
+      g = f;
+      f = e;
+      e = d + t1 >>> 0;
+      d = c;
+      c = b;
+      b = a;
+      a = t1 + t2 >>> 0;
+    }
+    H[0] = H[0] + a >>> 0;
+    H[1] = H[1] + b >>> 0;
+    H[2] = H[2] + c >>> 0;
+    H[3] = H[3] + d >>> 0;
+    H[4] = H[4] + e >>> 0;
+    H[5] = H[5] + f >>> 0;
+    H[6] = H[6] + g >>> 0;
+    H[7] = H[7] + h >>> 0;
+  }
+  const out = new Uint8Array(32);
+  const outView = new DataView(out.buffer);
+  for (let i = 0; i < 8; i++) outView.setUint32(i * 4, H[i]);
+  return out;
+}
 function generateState() {
   const bytes = new Uint8Array(16);
   crypto.getRandomValues(bytes);
   return base64url(bytes);
 }
+var TOKEN_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+function generateRequestId() {
+  let out = "";
+  const bytes = new Uint8Array(64);
+  while (out.length < 32) {
+    crypto.getRandomValues(bytes);
+    for (const byte of bytes) {
+      if (byte >= 248 || out.length === 32) continue;
+      out += TOKEN_ALPHABET[byte % 62];
+    }
+  }
+  return out;
+}
 
 // src/useZorealLogin.ts
 function useZorealFlow(options) {
@@ -1864,76 +2027,119 @@ function useZorealFlow(options) {
       const useAppLink = display === "link";
       const intent = resolveIntent(opts.intent, opts.scope, opts.acr_values);
       try {
-        const started = await startPairing(issuer, {
-          client_id: clientId,
-          scope: opts.scope ?? "openid",
-          state,
-          nonce,
-          code_challenge: await challengeS256(verifier),
-          redirect_uri: flow === "auth-code" ? opts.redirect_uri : void 0,
-          acr_values: Array.isArray(opts.acr_values) ? opts.acr_values.join(" ") : opts.acr_values,
-          max_age: opts.max_age,
-          prompt: opts.prompt,
-          locale,
-          display
-        });
         let code;
         let selectBy = "device";
-        if ("code" in started) {
-          code = started.code;
-          selectBy = "session";
-        } else {
-          selectBy = useAppLink ? "app_link" : "qr";
-          const qrRefreshSeconds = qrRefreshSecondsOf(started);
+        if (useAppLink) {
+          const requestId = generateRequestId();
+          const startUrl = sameDeviceStartUrl(issuer, {
+            client_id: clientId,
+            scope: opts.scope ?? "openid",
+            state,
+            nonce,
+            code_challenge: challengeS256Sync(verifier),
+            redirect_uri: flow === "auth-code" ? opts.redirect_uri : void 0,
+            acr_values: Array.isArray(opts.acr_values) ? opts.acr_values.join(" ") : opts.acr_values,
+            max_age: opts.max_age,
+            prompt: opts.prompt,
+            locale,
+            request_id: requestId,
+            origin: window.location.origin
+          });
+          selectBy = "app_link";
           const cancel = () => {
             controller.abort();
             setPairing(null);
-            publishRef.current?.(null);
           };
-          const surface = {
-            pairUrl: started.pair_url,
-            appLink: useAppLink,
-            intent,
-            cancel,
-            // The app link has no QR and therefore no cadence to report.
-            ...useAppLink ? null : { qrRefreshSeconds }
-          };
-          let qrUrl = `${issuer}/pair/${encodeURIComponent(started.request_id)}/qr.svg`;
+          const surface = { pairUrl: startUrl, appLink: true, intent, cancel };
           const active = {
-            requestId: started.request_id,
-            pairUrl: surface.pairUrl,
-            qrUrl,
-            state: { status: "pending", expiresIn: started.expires_in, qrUrl, ...surface },
-            appLink: useAppLink,
+            requestId,
+            pairUrl: startUrl,
+            qrUrl: "",
+            state: { status: "pending", ...surface },
+            appLink: true,
             cancel
           };
           setPairing(active);
-          if (!useAppLink) {
-            publishRef.current?.({ state: active.state, qrUrl, intent, cancel });
-          }
           opts.onPairingStateChange?.(active.state);
-          if (useAppLink) {
-            window.location.assign(started.pair_url);
-          }
+          window.location.assign(startUrl);
           code = await pollUntilApproved(
             issuer,
-            started.request_id,
+            requestId,
             (s) => {
-              if (s.qrUrl) qrUrl = s.qrUrl;
-              const enriched = { ...s, ...surface, qrUrl };
-              setPairing(
-                (p) => p && p.requestId === started.request_id ? { ...p, qrUrl, state: enriched } : p
-              );
-              if (!useAppLink) {
-                publishRef.current?.({ state: enriched, qrUrl, intent, cancel });
-              }
+              const enriched = { ...s, ...surface };
+              setPairing((p) => p && p.requestId === requestId ? { ...p, state: enriched } : p);
               opts.onPairingStateChange?.(enriched);
             },
             controller.signal,
-            // The app link has no QR to animate, and the provider answers 404
-            // for one, so the frames are asked for only on the QR surface.
-            { qrRefreshSeconds: useAppLink ? void 0 : qrRefreshSeconds }
+            { tolerateUnknownUntil: Date.now() + 15e3 }
           );
+        } else {
+          const started = await startPairing(issuer, {
+            client_id: clientId,
+            scope: opts.scope ?? "openid",
+            state,
+            nonce,
+            code_challenge: await challengeS256(verifier),
+            redirect_uri: flow === "auth-code" ? opts.redirect_uri : void 0,
+            acr_values: Array.isArray(opts.acr_values) ? opts.acr_values.join(" ") : opts.acr_values,
+            max_age: opts.max_age,
+            prompt: opts.prompt,
+            locale,
+            display: "qr"
+          });
+          if ("code" in started) {
+            code = started.code;
+            selectBy = "session";
+          } else {
+            selectBy = "qr";
+            const qrRefreshSeconds = qrRefreshSecondsOf(started);
+            const cancel = () => {
+              controller.abort();
+              setPairing(null);
+              publishRef.current?.(null);
+            };
+            const surface = {
+              pairUrl: started.pair_url,
+              appLink: false,
+              intent,
+              cancel,
+              qrRefreshSeconds
+            };
+            let qrUrl = `${issuer}/pair/${encodeURIComponent(started.request_id)}/qr.svg`;
+            const active = {
+              requestId: started.request_id,
+              pairUrl: surface.pairUrl,
+              qrUrl,
+              state: { status: "pending", expiresIn: started.expires_in, qrUrl, ...surface },
+              appLink: false,
+              cancel
+            };
+            setPairing(active);
+            if (!useAppLink) {
+              publishRef.current?.({ state: active.state, qrUrl, intent, cancel });
+            }
+            opts.onPairingStateChange?.(active.state);
+            if (useAppLink) {
+              window.location.assign(started.pair_url);
+            }
+            code = await pollUntilApproved(
+              issuer,
+              started.request_id,
+              (s) => {
+                if (s.qrUrl) qrUrl = s.qrUrl;
+                const enriched = { ...s, ...surface, qrUrl };
+                setPairing(
+                  (p) => p && p.requestId === started.request_id ? { ...p, qrUrl, state: enriched } : p
+                );
+                if (!useAppLink) {
+                  publishRef.current?.({ state: enriched, qrUrl, intent, cancel });
+                }
+                opts.onPairingStateChange?.(enriched);
+              },
+              controller.signal,
+              { qrRefreshSeconds }
+            );
+          }
         }
         setPairing(null);
         publishRef.current?.(null);
@@ -2000,6 +2206,9 @@ function useZorealLogin(options) {
 // src/ring.tsx
 var import_react4 = require("react");
 var import_jsx_runtime5 = require("react/jsx-runtime");
+var TAIL = 0.3;
+var STACK = Array.from({ length: 12 }, (_, i) => 12 - i);
+var HALO = [3, 2, 1];
 function ZorealBusyRing({
   busy,
   radius = 8,
@@ -2012,11 +2221,42 @@ function ZorealBusyRing({
   (0, import_react4.useEffect)(() => {
     ensureStyles();
   }, []);
+  const wrapRef = (0, import_react4.useRef)(null);
+  const measureRef = (0, import_react4.useRef)(null);
+  (0, import_react4.useLayoutEffect)(() => {
+    const wrap = wrapRef.current;
+    const rect = measureRef.current;
+    if (!wrap || !rect) return;
+    const measure = () => {
+      const length = rect.getTotalLength();
+      if (length > 0) wrap.style.setProperty("--zrl-ring-len", `${length}px`);
+    };
+    measure();
+    if (typeof ResizeObserver === "undefined") return;
+    const observer = new ResizeObserver(measure);
+    observer.observe(wrap);
+    return () => observer.disconnect();
+  }, [radius]);
   const rx = radius + 2;
-  const layer = (name) => /* @__PURE__ */ (0, import_jsx_runtime5.jsx)("rect", { className: cx(name), rx, ry: rx, pathLength: 100 });
+  const layer = (key, name, len, alpha, ref) => /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(
+    "rect",
+    {
+      ref,
+      className: cx(name),
+      rx,
+      ry: rx,
+      style: {
+        strokeDasharray: `calc(var(--zrl-l) * ${len}) calc(var(--zrl-l) * ${1 - len})`,
+        "--zrl-s": `calc(var(--zrl-l) * ${-(TAIL - len)})`,
+        opacity: alpha
+      }
+    },
+    key
+  );
   return /* @__PURE__ */ (0, import_jsx_runtime5.jsxs)(
     "span",
     {
+      ref: wrapRef,
       className: className ? `${cx("root")} ${cx("ring")} ${className}` : `${cx("root")} ${cx("ring")}`,
       "data-theme": theme,
       "data-busy": busy,
@@ -2024,10 +2264,10 @@ function ZorealBusyRing({
       children: [
         children,
         /* @__PURE__ */ (0, import_jsx_runtime5.jsxs)("svg", { className: cx("ring-svg"), "aria-hidden": "true", children: [
-          layer("ring-halo"),
-          layer("ring-tail"),
-          layer("ring-body"),
-          layer("ring-head")
+          HALO.map(
+            (n, i) => layer(`h${n}`, "ring-halo", TAIL * n / HALO.length, `calc(var(--zrl-glow-opacity) * 0.6 / ${n})`, i === 0 ? measureRef : void 0)
+          ),
+          STACK.map((n) => layer(`t${n}`, n <= 2 ? "ring-head" : "ring-tail", TAIL * n / STACK.length, String(1 / n)))
         ] })
       ]
     }