mm-math 0.0.4 → 0.0.6

package/index.html

@@ -519,7 +519,69 @@ document.getElementById('fUser').addEventListener('keydown', e => {
 });
 
 // ── Login ─────────────────────────────────────────────────────────────────────
-const API_BASE = window.location.hostname === 'calc.moshelab.com' ? '' : 'https://calc.moshelab.com';
+const _onCalc = window.location.hostname === 'calc.moshelab.com';
+const BRIDGE_ORIGIN = 'https://calc.moshelab.com';
+
+// Preload invisible auth-bridge iframe. The iframe is on calc.moshelab.com so its
+// fetch to /api/login is same-origin — no CORS, no Cloudflare cross-origin checks.
+let _bridge = null;
+let _bridgeReadyResolve = null;
+const _bridgeReady = new Promise(function(resolve) { _bridgeReadyResolve = resolve; });
+
+if (!_onCalc) {
+  _bridge = document.createElement('iframe');
+  _bridge.src = BRIDGE_ORIGIN + '/login-frame.html';
+  _bridge.style.cssText = 'display:none;width:0;height:0;border:0;position:absolute;left:-9999px;top:-9999px;';
+  _bridge.setAttribute('aria-hidden', 'true');
+  document.body.appendChild(_bridge);
+} else {
+  // On calc.moshelab.com, bridge isn't used — resolve immediately
+  _bridgeReadyResolve();
+}
+
+// Shared message handler — resolves the ready promise and dispatches login results
+const _pendingLogins = {};
+window.addEventListener('message', function(event) {
+  if (event.origin !== BRIDGE_ORIGIN) return;
+  const d = event.data;
+  if (!d) return;
+  if (d.type === 'bridge_ready') { _bridgeReadyResolve(); return; }
+  if (d.type === 'login_result' && d.nonce && _pendingLogins[d.nonce]) {
+    _pendingLogins[d.nonce](d);
+    delete _pendingLogins[d.nonce];
+  }
+});
+
+function _loginDirect(username, password) {
+  return fetch('/api/login', {
+    method:  'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body:    JSON.stringify({ username, password }),
+  }).then(function(res) {
+    return res.json().then(function(data) {
+      data.ok = res.ok; data.status = res.status; return data;
+    });
+  });
+}
+
+function _loginViaBridge(username, password) {
+  return _bridgeReady.then(function() {
+    return new Promise(function(resolve, reject) {
+      if (!_bridge || !_bridge.contentWindow) {
+        return reject(new Error('Auth bridge unavailable'));
+      }
+      const nonce = Math.random().toString(36).slice(2, 10);
+      const timer = setTimeout(function() {
+        delete _pendingLogins[nonce];
+        reject(new Error('Sign-in timed out. Try again.'));
+      }, 15000);
+
+      _pendingLogins[nonce] = function(d) { clearTimeout(timer); resolve(d); };
+      _bridge.contentWindow.postMessage({ type: 'login', username: username, password: password, nonce: nonce }, BRIDGE_ORIGIN);
+    });
+  });
+}
+
 async function doLogin() {
   const username = document.getElementById('fUser').value.trim();
   const password = document.getElementById('fPass').value;
@@ -536,15 +598,10 @@ async function doLogin() {
   errEl.textContent = '';
 
   try {
-    const res  = await fetch(API_BASE + '/api/login', {
-      method:  'POST',
-      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-      body:    new URLSearchParams({ username, password }),
-    });
-    const data = await res.json();
+    const data = await (_onCalc ? _loginDirect(username, password) : _loginViaBridge(username, password));
 
-    if (!res.ok || !data.success) {
-      errEl.textContent = res.status === 429
+    if (!data.ok || !data.success) {
+      errEl.textContent = data.status === 429 || (data.error || '').includes('Too many')
         ? 'Too many attempts. Wait 60 seconds.'
         : 'Invalid username or password.';
       btn.disabled = false;
@@ -568,7 +625,7 @@ async function doLogin() {
       window.location.href = './browse.html';
     }
   } catch (err) {
-    errEl.textContent = 'Error: ' + (err && err.message ? err.message : err);
+    errEl.textContent = err && err.message ? err.message : String(err);
     btn.disabled = false;
     btn.textContent = 'Sign In';
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mm-math",
-  "version": "0.0.4",
+  "version": "0.0.6",
   "description": "STEM educational toolkit",
   "main": "index.html",
   "files": [