Function openOAuthPopup

packages/react/src/api/oauth-popup.ts:96–224

(input: OpenOAuthPopupInput<TAuth>)

 * `onOpenFailed` on the next microtask and returns a no-op teardown.
 */
export const openOAuthPopup = <TAuth>(input: OpenOAuthPopupInput<TAuth>): (() => void) => {
  if (!isHttpPopupUrl(input.url)) {
    queueMicrotask(() => input.onOpenFailed?.());
    return () => {};
  }

  let settled = false;
  let pollHandle: ReturnType<typeof setInterval> | null = null;
  const channel =
    typeof BroadcastChannel !== "undefined" ? new BroadcastChannel(input.channelName) : null;

  const onMessage = (event: MessageEvent) => {
    if (event.origin !== window.location.origin) return;
    handleResult(event.data);
  };

  // localStorage `storage` events are the reliable same-origin completion path:
  // they fire on the opener when the (same-origin) callback page writes, survive
  // the provider's COOP severing `window.opener`, and aren't lost to the popup's
  // auto-close (unlike a raced BroadcastChannel). The callback writes the result
  // under `channelName`; we read it, clean up, and settle.
  const onStorage = (event: StorageEvent) => {
    if (event.key !== input.channelName || event.newValue === null) return;
    // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: JSON.parse of a foreign storage value can throw
    try {
      // oxlint-disable-next-line executor/no-json-parse -- boundary: browser-only helper, no Effect runtime; parsing a same-origin localStorage signal
      const data: unknown = JSON.parse(event.newValue);
      // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: localStorage can throw (private mode / disabled)
      try {
        window.localStorage.removeItem(input.channelName);
      } catch {
        // best-effort cleanup
      }
      handleResult(data);
    } catch {
      // Malformed value — ignore; another channel may still deliver.
    }
  };

  const stopPolling = () => {
    if (pollHandle !== null) {
      clearInterval(pollHandle);
      pollHandle = null;
    }
  };

  /** Close the popup window if it's still open. Swallows cross-origin errors. */
  const closePopup = (popup: Window | null) => {
    if (!popup) return;
    // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: cross-origin popup state can throw and cleanup is best-effort
    try {
      if (!popup.closed) popup.close();
    } catch {
      // Cross-origin access can throw; safe to ignore.
    }
  };

  const settle = () => {