fix(ENG-950): don't cancel OAuth attempt on cross-origin popup false-close

[CameronCarlin]

Summary

Fixes the connect "second click" bug (ENG-950): under the openid-client (feat_oidc_client) auth path, clicking Connect on an OAuth2 provider returned the user to the form on the first attempt; a second click was needed to complete.

Root cause

src/modules/integration-picker/hooks/useIntegrationPicker.ts → startPopupWatcher polls connectWindow.current.closed every second. Its Cross-Origin-Opener-Policy (COOP) guard is first-tick only: if the popup reads closed at +1s it assumes COOP isolation, disables close-detection, and lets the poll loop drive.

But the OAuth popup opens same-origin (${baseUrl}/connect/oauth2/...) and only then 302-redirects to the provider. So at +1s it still reads open, the COOP guard doesn't trip, and a tick later — once it navigates cross-origin under COOP — window.closed flips to true even though the popup is open and the user is still on the consent screen. The watcher treats that as a user-close, polls once (still pending), and cancels the connection attempt → returns to the form.

Evidence (staging)

A real failing Contentful flow shows the attempt cancelled ~2s after the popup opened, ~4.5s before the provider even called back:

13:58:44.7  302 → Contentful (popup opens)
13:58:46.6  DELETE /hub/connection_attempts/9c663562 → 204   ← cancelled mid-auth
13:58:51.1  GET /connect/oauth2/contentful/callback?code=…   ← provider returns (too late)

Fix

In the close-detected branch, don't cancel a still-pending attempt — defer to the poll loop (authenticated / error / cancelled / expired / timeout), exactly as the first-tick COOP path already does. The success-catching final poll is kept, so an auth that completes right as the popup closes is still picked up immediately.

Tradeoff

A genuinely-abandoned popup now shows "loading" until the poll resolves or times out (the same behaviour COOP-isolated popups already have today), rather than bouncing back immediately. The explicit Cancel button still aborts instantly.

Verification

• npm run lint — clean
• npm run build — green; 'use client' banner intact on dist/index.esm.js and dist/index.js
• No test infrastructure in this repo (npm test is a stub); a vitest test for the watcher would be a good follow-up.

Note

This fixes the frontend "second click" only. Contentful & QuickBooks Online additionally fail at the backend token exchange (invalid_client) under the OC path — tracked separately in ENG-1045 — so those two won't fully link from this change alone.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This pull request adjusts the OAuth popup “close detection” logic in the integration picker to avoid incorrectly cancelling an in-progress OAuth attempt when the popup navigates cross-origin under Cross-Origin-Opener-Policy (COOP) and window.closed can falsely report true.

Changes:

• Stop cancelling the connection attempt when the popup reports closed while the attempt is still pending; instead, defer to the existing polling loop to resolve authenticated/error/cancelled/expired/timeout.
• Keep a “final poll” when the popup reports closed so a just-completed authentication is still detected immediately.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.