Function openOAuthSystemBrowser

packages/react/src/api/oauth-popup.ts:257–332

(
  input: OpenOAuthSystemBrowserInput<TAuth>,
)

const OAUTH_AWAIT_DEFAULT_TIMEOUT_MS = 10 * 60 * 1000;

export const openOAuthSystemBrowser = <TAuth>(
  input: OpenOAuthSystemBrowserInput<TAuth>,
): (() => void) => {
  let settled = false;
  let pollTimer: ReturnType<typeof setTimeout> | null = null;
  let timeoutHandle: ReturnType<typeof setTimeout> | null = null;
  const controller = new AbortController();

  const settle = () => {
    if (settled) return;
    settled = true;
    if (pollTimer !== null) clearTimeout(pollTimer);
    if (timeoutHandle !== null) clearTimeout(timeoutHandle);
    controller.abort();
  };

  const poll = async () => {
    if (settled) return;
    // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: fetch can reject for transient network errors during polling
    try {
      // The await poll is now gated like the rest of /api — carry the bearer
      // (standalone web). On desktop the connection has no client-side auth and
      // the main process injects the header instead.
      const authorization = getExecutorServerAuthorizationHeader();
      const response = await fetch(`/api/oauth/await/${encodeURIComponent(input.sessionId)}`, {
        signal: controller.signal,
        cache: "no-store",
        ...(authorization ? { headers: { authorization } } : {}),
      });
      if (!response.ok) return;
      const body = (await response.json()) as unknown;
      if (body === null || settled) return;
      if (!isOAuthPopupResult<TAuth>(body)) return;
      settle();
      input.onResult(body);
    } catch {
      // Transient — next tick will retry. AbortError after settle is also caught here.
    }
  };

  void (async () => {
    // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: openExternal is host-provided IPC, no Effect runtime in this browser-only helper
    try {
      await input.openExternal(input.url);
    } catch (cause: unknown) {
      if (settled) return;
      settle();
      input.onOpenFailed?.(cause);
    }
  })();

  // Sequential poll loop: one request at a time, reconnecting `pollMs` after
  // the previous one settles. A long-polling server may hold each request for
  // many seconds, so a fixed interval would stack overlapping requests.
  const scheduleReconnect = () => {
    if (settled) return;
    pollTimer = setTimeout(() => {
      pollTimer = null;