@zoreal/oauth2-react 0.2.17 → 0.2.19

package/dist/index.js

@@ -5,7 +5,7 @@ import { createContext, useContext, useMemo, useState as useState2 } from "react
 
 // src/wire.ts
 var WIRE_VERSION = 1;
-var SDK_VERSION = "0.2.17";
+var SDK_VERSION = "0.2.19";
 var DEFAULT_ISSUER = "https://id.zoreal.com";
 var POLL_INTERVAL_MS = 2e3;
 var POLL_INTERVAL_ENROLLING_MS = 5e3;
@@ -1600,6 +1600,76 @@ import { useMemo as useMemo2, useState as useState4 } from "react";
 // src/useZorealLogin.ts
 import { useCallback, useEffect as useEffect2, useRef as useRef2, useState as useState3 } from "react";
 
+// src/return.ts
+var PREFIX2 = "zoreal:oauth2:return:";
+var DONE = "zoreal:oauth2:done:";
+var MAX_AGE_MS = 10 * 60 * 1e3;
+function storage() {
+  try {
+    return typeof localStorage === "undefined" ? null : localStorage;
+  } catch {
+    return null;
+  }
+}
+function saveReturnFlow(flow) {
+  try {
+    storage()?.setItem(PREFIX2 + flow.requestId, JSON.stringify(flow));
+  } catch {
+  }
+}
+function peekReturnFlow(requestId) {
+  const store = storage();
+  if (!store) return null;
+  const raw = store.getItem(PREFIX2 + requestId);
+  if (!raw) return null;
+  try {
+    const flow = JSON.parse(raw);
+    if (flow.v !== 1 || flow.requestId !== requestId) return null;
+    if (Date.now() - flow.createdAt > MAX_AGE_MS) return null;
+    return flow;
+  } catch {
+    return null;
+  }
+}
+function forgetReturnFlow(requestId) {
+  try {
+    storage()?.removeItem(PREFIX2 + requestId);
+  } catch {
+  }
+  if (pending === requestId) pending = null;
+}
+function markReturnDone(requestId) {
+  try {
+    const store = storage();
+    store?.setItem(DONE + requestId, String(Date.now()));
+    store?.removeItem(PREFIX2 + requestId);
+  } catch {
+  }
+}
+function isReturnDone(requestId) {
+  return storage()?.getItem(DONE + requestId) !== null && storage()?.getItem(DONE + requestId) !== void 0;
+}
+function returnToUrl() {
+  if (typeof window === "undefined") return void 0;
+  const { href } = window.location;
+  const hash = href.indexOf("#");
+  return hash === -1 ? href : href.slice(0, hash);
+}
+var RETURN_MARK = /(?:^|[#&])zoreal_return=([A-Za-z0-9]{32})(?:&|$)/;
+var pending = null;
+function pendingReturnId() {
+  if (pending) return pending;
+  if (typeof window === "undefined") return null;
+  const match = RETURN_MARK.exec(window.location.hash);
+  if (!match) return null;
+  pending = match[1];
+  try {
+    window.history.replaceState(window.history.state, "", returnToUrl());
+  } catch {
+  }
+  return pending;
+}
+
 // src/jwt.ts
 function unsafeClaims(idToken) {
   try {
@@ -1691,6 +1761,8 @@ var sleep = (ms, signal) => new Promise((resolve, reject) => {
   }, ms);
   signal?.addEventListener("abort", onAbort, { once: true });
 });
+var SETTLE_MS = 1500;
+var NETWORK_FAILURES_TOLERATED = 4;
 async function pollUntilApproved(issuer, requestId, onState, signal, options = {}) {
   let last = { status: "pending" };
   const emit = (state) => {
@@ -1719,11 +1791,27 @@ async function pollUntilApproved(issuer, requestId, onState, signal, options = {
     })().catch(() => {
     });
   };
+  const settlingUntil = options.tolerateUnknownUntil ?? 0;
+  let networkFailures = 0;
   try {
+    if (settlingUntil > Date.now()) await sleep(SETTLE_MS, signal);
     for (; ; ) {
-      const response = await fetch(`${issuer}/pair/${encodeURIComponent(requestId)}/status`, {
-        signal
-      });
+      let response;
+      try {
+        response = await fetch(`${issuer}/pair/${encodeURIComponent(requestId)}/status`, {
+          signal
+        });
+        networkFailures = 0;
+      } catch (e) {
+        if (e instanceof DOMException && e.name === "AbortError") throw e;
+        networkFailures += 1;
+        if (settlingUntil > Date.now() || networkFailures <= NETWORK_FAILURES_TOLERATED) {
+          emit({ ...last, status: last.status });
+          await sleep(POLL_INTERVAL_MS, signal);
+          continue;
+        }
+        throw e;
+      }
       const body = await parseJson(response);
       if (response.status === 404 && (options.tolerateUnknownUntil ?? 0) > Date.now()) {
         emit({ status: "pending" });
@@ -1961,6 +2049,7 @@ function generateRequestId() {
 }
 
 // src/useZorealLogin.ts
+var resumedReturns = /* @__PURE__ */ new Set();
 function useZorealFlow(options) {
   const { clientId, issuer, locale } = useZorealOAuth();
   const [pairing, setPairing] = useState3(null);
@@ -1970,6 +2059,7 @@ function useZorealFlow(options) {
   const abortRef = useRef2(null);
   const optionsRef = useRef2(options);
   optionsRef.current = options;
+  const closedByPerson = useRef2(false);
   useEffect2(
     () => () => {
       abortRef.current?.abort();
@@ -1977,6 +2067,61 @@ function useZorealFlow(options) {
     },
     []
   );
+  useEffect2(() => {
+    const id = pendingReturnId();
+    if (!id || resumedReturns.has(id)) return;
+    const saved = peekReturnFlow(id);
+    if (!saved || saved.clientId !== clientId) return;
+    forgetReturnFlow(id);
+    resumedReturns.add(id);
+    const controller = new AbortController();
+    abortRef.current = controller;
+    void (async () => {
+      const opts = optionsRef.current;
+      try {
+        const code = await pollUntilApproved(issuer, id, void 0, controller.signal, {
+          tolerateUnknownUntil: Date.now() + 5e3
+        });
+        if (saved.flow === "auth-code") {
+          opts.onCode?.({
+            code,
+            scope: saved.scope,
+            app_state: saved.appState,
+            code_verifier: saved.verifier,
+            nonce: saved.nonce
+          });
+        } else {
+          const tokens = await exchangeCode(issuer, {
+            code,
+            code_verifier: saved.verifier,
+            client_id: clientId
+          });
+          const claims = unsafeClaims(tokens.id_token);
+          opts.onCredential?.({
+            credential: tokens.id_token,
+            clientId,
+            select_by: "app_link",
+            acr: claims.acr ?? "zoreal.device"
+          });
+        }
+        markReturnDone(id);
+      } catch (e) {
+        if (e instanceof DOMException && e.name === "AbortError") return;
+        if (e instanceof FlowAbandonedError) {
+          opts.onNonOAuthError?.(e.reason);
+          return;
+        }
+        if (e instanceof OAuthFlowError) {
+          opts.onError?.({ error: e.error, description: e.description });
+          return;
+        }
+        opts.onNonOAuthError?.({
+          type: "unknown",
+          description: e instanceof Error ? e.message : String(e)
+        });
+      }
+    })();
+  }, [clientId, issuer]);
   const login = useCallback(() => {
     const opts = optionsRef.current;
     const run = async () => {
@@ -1993,8 +2138,23 @@ function useZorealFlow(options) {
       try {
         let code;
         let selectBy = "device";
+        let returnId = null;
         if (useAppLink) {
           const requestId = generateRequestId();
+          saveReturnFlow({
+            v: 1,
+            issuer,
+            clientId,
+            flow,
+            verifier,
+            nonce,
+            state,
+            scope: opts.scope ?? "openid",
+            appState: opts.app_state,
+            requestId,
+            createdAt: Date.now()
+          });
+          returnId = requestId;
           const startUrl = sameDeviceStartUrl(issuer, {
             client_id: clientId,
             scope: opts.scope ?? "openid",
@@ -2007,10 +2167,12 @@ function useZorealFlow(options) {
             prompt: opts.prompt,
             locale,
             request_id: requestId,
-            origin: window.location.origin
+            origin: window.location.origin,
+            return_to: returnToUrl()
           });
           selectBy = "app_link";
           const cancel = () => {
+            closedByPerson.current = true;
             controller.abort();
             setPairing(null);
           };
@@ -2037,6 +2199,9 @@ function useZorealFlow(options) {
             controller.signal,
             { tolerateUnknownUntil: Date.now() + 15e3 }
           );
+          if (isReturnDone(requestId)) {
+            throw new DOMException("aborted", "AbortError");
+          }
         } else {
           const started = await startPairing(issuer, {
             client_id: clientId,
@@ -2058,6 +2223,7 @@ function useZorealFlow(options) {
             selectBy = "qr";
             const qrRefreshSeconds = qrRefreshSecondsOf(started);
             const cancel = () => {
+              closedByPerson.current = true;
               controller.abort();
               setPairing(null);
               publishRef.current?.(null);
@@ -2107,6 +2273,7 @@ function useZorealFlow(options) {
         }
         setPairing(null);
         publishRef.current?.(null);
+        if (returnId) markReturnDone(returnId);
         if (flow === "auth-code") {
           opts.onCode?.({
             code,
@@ -2133,7 +2300,16 @@ function useZorealFlow(options) {
       } catch (e) {
         setPairing(null);
         publishRef.current?.(null);
-        if (e instanceof DOMException && e.name === "AbortError") return;
+        if (e instanceof DOMException && e.name === "AbortError") {
+          if (closedByPerson.current) {
+            closedByPerson.current = false;
+            opts.onNonOAuthError?.({
+              type: "popup_closed",
+              description: "the sign-in dialog was closed before the holder approved"
+            });
+          }
+          return;
+        }
         if (e instanceof FlowAbandonedError) {
           opts.onNonOAuthError?.(e.reason);
           return;