From 6eab31f8dc7ae42f7ee53face0ec8c5b2b2ada17 Mon Sep 17 00:00:00 2001 From: Saumyaranjan Nayak Date: Sat, 1 Aug 2026 17:09:34 +0530 Subject: [PATCH] fix(browser/react/vue): pass url.search to hasAuthParamsInUrl instead of falling back to window.location.search hasAuthParams(url, afterSignInUrl) accepted a URL argument but called hasAuthParamsInUrl() with no argument, silently ignoring url.search and always checking window.location.search instead. This makes the helpers untestable in isolation and incorrect whenever the provided URL differs from the current window location. Fix all call sites to pass url.search explicitly. Also correct the JSDoc on hasAuthParamsInUrl: the function only checks for 'code', not both 'code' and 'session_state' as the old description claimed. --- packages/browser/src/utils/hasAuthParamsInUrl.ts | 4 ++-- packages/react/src/hooks/useBrowserUrl.ts | 2 +- packages/vue/src/providers/ThunderIDProvider.ts | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/packages/browser/src/utils/hasAuthParamsInUrl.ts b/packages/browser/src/utils/hasAuthParamsInUrl.ts index 7d2e317b..704a4800 100644 --- a/packages/browser/src/utils/hasAuthParamsInUrl.ts +++ b/packages/browser/src/utils/hasAuthParamsInUrl.ts @@ -17,10 +17,10 @@ */ /** - * Utility to check if `code` and `session_state` are available in the URL as search params. + * Utility to check if `code` is available in the URL as a search param. * * @param params - The URL search params to check. Defaults to `window.location.search`. - * @return `true` if the URL contains `code` and `session_state` search params, otherwise `false`. + * @return `true` if the URL contains a `code` search param, otherwise `false`. */ const hasAuthParamsInUrl = (params: string = window.location.search): boolean => { const MATCHER = /[?&]code=[^&]+/; diff --git a/packages/react/src/hooks/useBrowserUrl.ts b/packages/react/src/hooks/useBrowserUrl.ts index 58495333..576dea95 100644 --- a/packages/react/src/hooks/useBrowserUrl.ts +++ b/packages/react/src/hooks/useBrowserUrl.ts @@ -58,7 +58,7 @@ export interface UseBrowserUrl { */ const useBrowserUrl = (): UseBrowserUrl => { const hasAuthParams = (url: URL, afterSignInUrl: string): boolean => - (hasAuthParamsInUrl() && new URL(url.origin + url.pathname).toString() === new URL(afterSignInUrl).toString()) || + (hasAuthParamsInUrl(url.search) && new URL(url.origin + url.pathname).toString() === new URL(afterSignInUrl).toString()) || // authParams?.authorizationCode || // FIXME: These are sent externally. Need to see what we can do about this. url.searchParams.get('error') !== null; diff --git a/packages/vue/src/providers/ThunderIDProvider.ts b/packages/vue/src/providers/ThunderIDProvider.ts index 32f265a6..99ad18ac 100644 --- a/packages/vue/src/providers/ThunderIDProvider.ts +++ b/packages/vue/src/providers/ThunderIDProvider.ts @@ -77,7 +77,7 @@ interface ThunderIDProviderProps { */ function hasAuthParams(url: URL, afterSignInUrl: string | undefined): boolean { return ( - (hasAuthParamsInUrl() && + (hasAuthParamsInUrl(url.search) && !!afterSignInUrl && new URL(url.origin + url.pathname).toString() === new URL(afterSignInUrl).toString()) || url.searchParams.get('error') !== null