signet-login 0.9.11 → 0.9.14

package/dist/modal.js

@@ -11,7 +11,6 @@ import { loadOrCreatePersistentClientSk } from './storage.js';
 import { waitForAuthResponse } from 'signet-verify';
 import { schnorr } from '@noble/curves/secp256k1';
 import { bytesToHex } from '@noble/hashes/utils';
-import { startRedirect } from './redirect.js';
 import QRCode from 'qrcode';
 const QR_BUNKER_CONNECT_TIMEOUT_MS = 8000;
 function escapeHtml(str) {
@@ -256,9 +255,10 @@ async function runNip07Flow(refs, opts) {
         window.clearInterval(ticker);
     }
 }
-async function runRedirectFlow(refs, opts) {
+async function runRedirectFlow(refs, opts, flowOpts = {}) {
     const dark = isDarkMode(opts.theme);
     const muted = dark ? '#888' : '#666';
+    const sameDevice = flowOpts.sameDevice === true;
     // Generate session keypair for cross-device gift-wrap
     const sessionPrivKey = schnorr.utils.randomPrivateKey();
     const sessionPubkey = bytesToHex(schnorr.getPublicKey(sessionPrivKey));
@@ -274,13 +274,13 @@ async function runRedirectFlow(refs, opts) {
     });
     const authUrl = `${opts.signetAppOrigin}/?${params.toString()}`;
     refs.dialog.innerHTML = `
-    <h2 style="margin:0 0 8px;font-size:1.2rem;">Sign in with Signet</h2>
-    <p style="margin:0 0 16px;color:${muted};font-size:0.85rem;">Open the link on your phone, or scan the QR if rendered.</p>
+    <h2 style="margin:0 0 8px;font-size:1.2rem;">${sameDevice ? 'Open My Signet' : 'Sign in with Signet'}</h2>
+    <p style="margin:0 0 16px;color:${muted};font-size:0.85rem;">${sameDevice ? 'Approve in My Signet and keep that tab open so it can sign for this app.' : 'Open the link on your phone, or scan the QR if rendered.'}</p>
     <div style="background:${dark ? '#0f0f1f' : '#f5f5f8'};border-radius:8px;padding:16px;margin-bottom:16px;">
       <canvas id="signet-login-qr" width="200" height="200" style="display:block;width:200px;height:200px;margin:0 auto 12px;background:#ffffff;border-radius:6px;box-sizing:border-box;"></canvas>
-      <a href="${escapeHtml(authUrl)}" target="_blank" rel="noopener" style="display:block;color:#5b6dff;font-size:0.75rem;word-break:break-all;text-decoration:none;">${escapeHtml(authUrl.slice(0, 80))}…</a>
+      <a id="signet-login-open-signet" href="${escapeHtml(authUrl)}" target="_blank" rel="noopener" style="${sameDevice ? buttonStyle(dark, true) + 'justify-content:center;text-align:center;text-decoration:none;' : 'display:block;color:#5b6dff;font-size:0.75rem;word-break:break-all;text-decoration:none;'}">${sameDevice ? 'Open My Signet' : `${escapeHtml(authUrl.slice(0, 80))}…`}</a>
     </div>
-    <p id="signet-login-status" style="margin:0 0 12px;color:${muted};font-size:0.85rem;">Waiting for approval…</p>
+    <p id="signet-login-status" style="margin:0 0 12px;color:${muted};font-size:0.85rem;">${sameDevice ? 'Waiting for My Signet approval…' : 'Waiting for approval…'}</p>
     <div style="display:flex;gap:8px;justify-content:space-between;">
       <button data-action="back" style="${buttonStyle(dark)}width:auto;flex:0 0 auto;padding:8px 16px;">← Back</button>
       <button data-action="cancel" style="${buttonStyle(dark)}width:auto;flex:0 0 auto;padding:8px 16px;">Cancel</button>
@@ -301,6 +301,14 @@ async function runRedirectFlow(refs, opts) {
             // — the visible link below the canvas still gets the user across.
         });
     }
+    if (sameDevice && typeof window !== 'undefined') {
+        try {
+            window.open(authUrl, '_blank', 'noopener,noreferrer');
+        }
+        catch {
+            // Popup blocked or unavailable — the explicit link remains visible.
+        }
+    }
     return new Promise(resolve => {
         let settled = false;
         const settle = (v) => {
@@ -348,6 +356,65 @@ async function runRedirectFlow(refs, opts) {
         });
     });
 }
+async function buildSessionFromRedirectFlowResult(refs, result, _aborted) {
+    // Default: auth-only ephemeral signer (identity proof, no live signing).
+    let signer = new EphemeralSigner(result.pubkey, result.authEvent);
+    let method = 'redirect';
+    // Cross-device / same-device bunker passthrough: when the signer device hands
+    // back a `bunker://` URI (its own NIP-46 server, or an upstream hardware
+    // bunker), connect before resolving the flow. Consumers such as Pallasite
+    // reject auth-only at their auth boundary; returning a cold
+    // DeferredBunkerSigner makes them classify the session as non-signing before
+    // the relay handshake can finish.
+    if (result.bunkerUri) {
+        const clientSecretKey = loadOrCreatePersistentClientSk();
+        const expected = result.pubkey;
+        const status = refs.dialog.querySelector('#signet-login-status');
+        if (status)
+            status.textContent = 'Connecting signer...';
+        try {
+            const bunkerSigner = await createBunkerSigner({
+                uri: result.bunkerUri,
+                clientSecretKey,
+                timeoutMs: QR_BUNKER_CONNECT_TIMEOUT_MS,
+            });
+            if (bunkerSigner.pubkey.toLowerCase() !== expected.toLowerCase()) {
+                // Bunker came back as a different key than the identity we proved.
+                // Discard it and keep the auth-only identity (result.pubkey) rather than
+                // signing as the wrong key — the consumer can prompt for a proper signer
+                // if it needs one.
+                console.warn('[signet-login] Signet relay upgrade: bunker pubkey mismatch — continuing identity-only', { connected: bunkerSigner.pubkey, expected });
+                void bunkerSigner.close().catch(() => { });
+            }
+            else {
+                signer = bunkerSigner;
+                method = 'bunker';
+            }
+        }
+        catch (err) {
+            // Bunker connect failed or timed out — signer offline, or a stale handoff
+            // URI (the common cross-device failure: the producer re-handed a dead
+            // connect string). Do NOT fail the whole sign-in: fall back to the
+            // auth-only identity we already hold (the kind-21236 authEvent proves
+            // result.pubkey). The consumer decides whether identity-only is enough —
+            // one that needs a live signer can prompt for an upgrade rather than being
+            // handed null and stranding the user at "couldn't sign in".
+            console.warn('[signet-login] Signet relay upgrade: createBunkerSigner failed — continuing identity-only (auth-only).', err);
+        }
+    }
+    else {
+        console.warn('[signet-login] Signet relay login carried no bunkerUri — auth-only ephemeral (cannot sign). The signer device must have its NIP-46 server enabled to hand back a bunker:// URI.');
+    }
+    const session = {
+        pubkey: result.pubkey,
+        method,
+        signer,
+        authEvent: result.authEvent,
+    };
+    if (result.displayName)
+        session.displayName = result.displayName;
+    return session;
+}
 // ── Paste bunker URI ──────────────────────────────────────────────────────────
 async function runBunkerFlow(refs, opts) {
     const dark = isDarkMode(opts.theme);
@@ -564,12 +631,25 @@ function resolveOptions(opts) {
         result.redirectCallback = opts.redirectCallback;
     return result;
 }
+let modalQueue = Promise.resolve();
 /**
  * Entry point — show the modal, route to the chosen method, return a session.
  *
  * Returns null when the user cancels or the flow times out.
  */
 export async function showLoginModal(opts) {
+    const previous = modalQueue;
+    let release;
+    modalQueue = new Promise(resolve => { release = resolve; });
+    await previous;
+    try {
+        return await runLoginModal(opts);
+    }
+    finally {
+        release();
+    }
+}
+async function runLoginModal(opts) {
     if (!opts.appName || opts.appName.length === 0)
         throw new Error('appName-required');
     if (opts.appName.length > 64)
@@ -615,21 +695,27 @@ export async function showLoginModal(opts) {
                 };
             }
             if (choice === 'redirect') {
-                // Same-tab navigation. Reuses the same pending-state and callback
-                // machinery as `Signet.login({ mode: 'redirect' })`, so this picker
-                // path lands the user on signet-app and the consumer's next page
-                // load picks up the round-trip via `Signet.handleRedirectCallback`.
-                // The promise from `startRedirect` never resolves — the page is gone
-                // before the await completes — so the dialog teardown in the finally
-                // block is also a no-op for this branch.
-                await startRedirect({
-                    appName: resolved.appName,
-                    challenge: resolved.challenge,
-                    origin: resolved.origin,
-                    signetAppOrigin: resolved.signetAppOrigin,
-                    ...(resolved.redirectCallback !== undefined ? { redirectCallback: resolved.redirectCallback } : {}),
-                });
-                return null; // unreachable
+                // Same-device Signet in the modal must keep this app tab alive and keep
+                // the My Signet tab alive as the ongoing bunker. Use the relay-backed
+                // auth response path here; explicit `login({ mode: 'redirect' })`
+                // remains the same-tab redirect API for mobile/single-device callers.
+                const result = await Promise.race([runRedirectFlow(refs, resolved, { sameDevice: true }), aborted]);
+                if (userAborted)
+                    return null;
+                if (!result) {
+                    if (resolved.preferredMethod)
+                        return null;
+                    continue;
+                }
+                const session = await buildSessionFromRedirectFlowResult(refs, result, aborted);
+                if (userAborted)
+                    return null;
+                if (!session) {
+                    if (resolved.preferredMethod)
+                        return null;
+                    continue;
+                }
+                return session;
             }
             if (choice === 'amber') {
                 // Same-tab navigation to a `nostrsigner:` URL. Android dispatches
@@ -652,66 +738,14 @@ export async function showLoginModal(opts) {
                         return null;
                     continue;
                 }
-                // Default: auth-only ephemeral signer (identity proof, no live signing).
-                let signer = new EphemeralSigner(result.pubkey, result.authEvent);
-                let method = 'redirect';
-                // Cross-device bunker passthrough: when the signer device hands back a
-                // `bunker://` URI (its own NIP-46 server, or an upstream hardware
-                // bunker), connect before resolving the QR flow. QR is already an
-                // in-place modal, and consumers such as Pallasite reject auth-only at
-                // their auth boundary; returning a cold DeferredBunkerSigner makes them
-                // classify the session as non-signing before the relay handshake can
-                // finish.
-                if (result.bunkerUri) {
-                    const clientSecretKey = loadOrCreatePersistentClientSk();
-                    const expected = result.pubkey;
-                    const status = refs.dialog.querySelector('#signet-login-status');
-                    if (status)
-                        status.textContent = 'Connecting signer...';
-                    try {
-                        const bunkerSigner = await createBunkerSigner({
-                            uri: result.bunkerUri,
-                            clientSecretKey,
-                            timeoutMs: QR_BUNKER_CONNECT_TIMEOUT_MS,
-                        });
-                        if (bunkerSigner.pubkey.toLowerCase() !== expected.toLowerCase()) {
-                            console.warn('[signet-login] QR upgrade: bunker pubkey mismatch — cannot sign', { connected: bunkerSigner.pubkey, expected });
-                            void bunkerSigner.close().catch(() => { });
-                            if (status) {
-                                status.textContent = 'Signer connected with the wrong public key.';
-                                status.style.color = '#d04848';
-                            }
-                            await Promise.race([new Promise(resolve => setTimeout(resolve, 2500)), aborted]);
-                            if (userAborted || resolved.preferredMethod)
-                                return null;
-                            continue;
-                        }
-                        signer = bunkerSigner;
-                    }
-                    catch (err) {
-                        console.warn('[signet-login] QR upgrade: createBunkerSigner failed — signer did not become live.', err);
-                        if (status) {
-                            status.textContent = `Signer connection failed: ${err instanceof Error ? err.message : String(err)}`;
-                            status.style.color = '#d04848';
-                        }
-                        await Promise.race([new Promise(resolve => setTimeout(resolve, 2500)), aborted]);
-                        if (userAborted || resolved.preferredMethod)
-                            return null;
-                        continue;
-                    }
-                    method = 'bunker';
-                }
-                else {
-                    console.warn('[signet-login] QR login carried no bunkerUri — auth-only ephemeral (cannot sign). The signer device must have its NIP-46 server enabled to hand back a bunker:// URI.');
+                const session = await buildSessionFromRedirectFlowResult(refs, result, aborted);
+                if (userAborted)
+                    return null;
+                if (!session) {
+                    if (resolved.preferredMethod)
+                        return null;
+                    continue;
                 }
-                const session = {
-                    pubkey: result.pubkey,
-                    method,
-                    signer,
-                    authEvent: result.authEvent,
-                };
-                if (result.displayName)
-                    session.displayName = result.displayName;
                 return session;
             }
             if (choice === 'bunker') {