mm-math 0.0.5 → 0.0.6

package/index.html

@@ -522,17 +522,35 @@ document.getElementById('fUser').addEventListener('keydown', e => {
 const _onCalc = window.location.hostname === 'calc.moshelab.com';
 const BRIDGE_ORIGIN = 'https://calc.moshelab.com';
 
-// Preload invisible auth-bridge iframe when running outside calc.moshelab.com.
-// The iframe makes a same-origin fetch to the API (no CORS), then postMessages
-// the result back. This bypasses Cloudflare's cross-origin fetch restrictions.
+// Preload invisible auth-bridge iframe. The iframe is on calc.moshelab.com so its
+// fetch to /api/login is same-origin — no CORS, no Cloudflare cross-origin checks.
 let _bridge = null;
+let _bridgeReadyResolve = null;
+const _bridgeReady = new Promise(function(resolve) { _bridgeReadyResolve = resolve; });
+
 if (!_onCalc) {
   _bridge = document.createElement('iframe');
   _bridge.src = BRIDGE_ORIGIN + '/login-frame.html';
   _bridge.style.cssText = 'display:none;width:0;height:0;border:0;position:absolute;left:-9999px;top:-9999px;';
   _bridge.setAttribute('aria-hidden', 'true');
   document.body.appendChild(_bridge);
-}
+} else {
+  // On calc.moshelab.com, bridge isn't used — resolve immediately
+  _bridgeReadyResolve();
+}
+
+// Shared message handler — resolves the ready promise and dispatches login results
+const _pendingLogins = {};
+window.addEventListener('message', function(event) {
+  if (event.origin !== BRIDGE_ORIGIN) return;
+  const d = event.data;
+  if (!d) return;
+  if (d.type === 'bridge_ready') { _bridgeReadyResolve(); return; }
+  if (d.type === 'login_result' && d.nonce && _pendingLogins[d.nonce]) {
+    _pendingLogins[d.nonce](d);
+    delete _pendingLogins[d.nonce];
+  }
+});
 
 function _loginDirect(username, password) {
   return fetch('/api/login', {
@@ -547,28 +565,20 @@ function _loginDirect(username, password) {
 }
 
 function _loginViaBridge(username, password) {
-  return new Promise(function(resolve, reject) {
-    const nonce = Math.random().toString(36).slice(2, 10);
-    const timer = setTimeout(function() {
-      window.removeEventListener('message', handler);
-      reject(new Error('Request timed out. Try again.'));
-    }, 15000);
-
-    function handler(event) {
-      if (event.origin !== BRIDGE_ORIGIN) return;
-      const d = event.data;
-      if (!d || d.type !== 'login_result' || d.nonce !== nonce) return;
-      clearTimeout(timer);
-      window.removeEventListener('message', handler);
-      resolve(d);
-    }
-    window.addEventListener('message', handler);
-
-    if (!_bridge || !_bridge.contentWindow) {
-      clearTimeout(timer);
-      return reject(new Error('Auth bridge unavailable'));
-    }
-    _bridge.contentWindow.postMessage({ type: 'login', username, password, nonce }, BRIDGE_ORIGIN);
+  return _bridgeReady.then(function() {
+    return new Promise(function(resolve, reject) {
+      if (!_bridge || !_bridge.contentWindow) {
+        return reject(new Error('Auth bridge unavailable'));
+      }
+      const nonce = Math.random().toString(36).slice(2, 10);
+      const timer = setTimeout(function() {
+        delete _pendingLogins[nonce];
+        reject(new Error('Sign-in timed out. Try again.'));
+      }, 15000);
+
+      _pendingLogins[nonce] = function(d) { clearTimeout(timer); resolve(d); };
+      _bridge.contentWindow.postMessage({ type: 'login', username: username, password: password, nonce: nonce }, BRIDGE_ORIGIN);
+    });
   });
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mm-math",
-  "version": "0.0.5",
+  "version": "0.0.6",
   "description": "STEM educational toolkit",
   "main": "index.html",
   "files": [