From 6eab31f8dc7ae42f7ee53face0ec8c5b2b2ada17 Mon Sep 17 00:00:00 2001 From: Saumyaranjan Nayak Date: Sat, 1 Aug 2026 17:09:34 +0530 Subject: [PATCH] fix(browser/react/vue): pass url.search to hasAuthParamsInUrl instead of falling back to window.location.search hasAuthParams(url, afterSignInUrl) accepted a URL argument but called hasAuthParamsInUrl() with no argument, silently ignoring url.search and always checking window.location.search instead. This makes the helpers untestable in isolation and incorrect whenever the provided URL differs from the current window location. Fix all call sites to pass url.search explicitly. Also correct the JSDoc on hasAuthParamsInUrl: the function only checks for 'code', not both 'code' and 'session_state' as the old description claimed. --- packages/browser/src/utils/hasAuthParamsInUrl.ts | 4 ++-- packages/react/src/hooks/useBrowserUrl.ts | 2 +- packages/vue/src/providers/ThunderIDProvider.ts | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/packages/browser/src/utils/hasAuthParamsInUrl.ts b/packages/browser/src/utils/hasAuthParamsInUrl.ts index 7d2e317..704a480 100644 --- a/packages/browser/src/utils/hasAuthParamsInUrl.ts +++ b/packages/browser/src/utils/hasAuthParamsInUrl.ts @@ -17,10 +17,10 @@ */ /** - * Utility to check if `code` and `session_state` are available in the URL as search params. + * Utility to check if `code` is available in the URL as a search param. * * @param params - The URL search params to check. Defaults to `window.location.search`. - * @return `true` if the URL contains `code` and `session_state` search params, otherwise `false`. + * @return `true` if the URL contains a `code` search param, otherwise `false`. */ const hasAuthParamsInUrl = (params: string = window.location.search): boolean => { const MATCHER = /[?&]code=[^&]+/; diff --git a/packages/react/src/hooks/useBrowserUrl.ts b/packages/react/src/hooks/useBrowserUrl.ts index 5849533..576dea9 100644 --- a/packages/react/src/hooks/useBrowserUrl.ts +++ b/packages/react/src/hooks/useBrowserUrl.ts @@ -58,7 +58,7 @@ export interface UseBrowserUrl { */ const useBrowserUrl = (): UseBrowserUrl => { const hasAuthParams = (url: URL, afterSignInUrl: string): boolean => - (hasAuthParamsInUrl() && new URL(url.origin + url.pathname).toString() === new URL(afterSignInUrl).toString()) || + (hasAuthParamsInUrl(url.search) && new URL(url.origin + url.pathname).toString() === new URL(afterSignInUrl).toString()) || // authParams?.authorizationCode || // FIXME: These are sent externally. Need to see what we can do about this. url.searchParams.get('error') !== null; diff --git a/packages/vue/src/providers/ThunderIDProvider.ts b/packages/vue/src/providers/ThunderIDProvider.ts index 32f265a..99ad18a 100644 --- a/packages/vue/src/providers/ThunderIDProvider.ts +++ b/packages/vue/src/providers/ThunderIDProvider.ts @@ -77,7 +77,7 @@ interface ThunderIDProviderProps { */ function hasAuthParams(url: URL, afterSignInUrl: string | undefined): boolean { return ( - (hasAuthParamsInUrl() && + (hasAuthParamsInUrl(url.search) && !!afterSignInUrl && new URL(url.origin + url.pathname).toString() === new URL(afterSignInUrl).toString()) || url.searchParams.get('error') !== null