import { useEffect, useState } from "react"; import { CircleCheck, Loader2 } from "lucide-react"; import { apiUrl, type MeResponse } from "../../shared/api/client"; /** * Popup OAuth completion page: after GitHub redirect, this page runs in the * popup window (top-level, not iframe). It fetches /api/me from the API origin * (cookie works here since it's a top-level request), then postMessages the * result to the opener (iframe on huggingface.co where third-party cookies * are blocked). */ export function PopupCallbackPage() { const [status, setStatus] = useState<"loading" | "done" | "error">("loading"); useEffect(() => { let closed = false; async function complete() { try { // This is a top-level window request — SameSite=None cookie IS sent const res = await fetch(apiUrl("/api/me"), { credentials: "include" }); const data: MeResponse = await res.json(); if (!closed && window.opener) { window.opener.postMessage( { type: "ov-oauth-complete", user: data }, "*", ); } setStatus("done"); } catch { setStatus("error"); // Still signal opener to try polling as fallback if (!closed && window.opener) { window.opener.postMessage({ type: "ov-oauth-complete" }, "*"); } } // Auto-close after showing success window.setTimeout(() => { if (!closed) { try { window.close(); } catch { /* noop */ } } }, 2000); } complete(); return () => { closed = true; }; }, []); if (status === "loading") { return (

Completing sign-in…

); } if (status === "error") { return (

Sign-in may not have completed. You can close this tab.

); } return (

Sign-in complete

You can close this tab and return to OpenVuln.

); }