Handshake

Highlights

The Fireguard window no longer gets stuck loading on the first try, and failures now reject with real, typed errors.

Fixes

• Fireguard stuck loading:
  • In iframe mode, Fireguard's first message could arrive before Firemitt listened.
  • A blocked popup left the promise pending forever.
  • App names with characters outside Latin-1 (emoji, Arabic, CJK…) prevented the configuration from being sent.
• Sessions: each auth() call runs its own session. A new call cancels the previous one (closing its popup or removing its iframe), and an invalid call no longer cancels the active session.
• Results:
  • A blocked popup rejects with PopupBlockedError.
  • A failure reported by Fireguard rejects with AuthFailedError, an Error keeping the remote type, name, message and code.
  • A success without a token now rejects.
  • A token sent right before the popup closes is no longer lost.
• Options:
  • Width and height must be numbers greater than zero.
  • Invalid positions fall back to the defaults.
  • The popup is centered on the current window.
  • Provider ids are normalized.
• CommonJS: require("@eoussama/firemitt") now works (firemitt.umd.cjs). Script tags and CDNs keep firemitt.umd.js.

Security

• Firemitt only accepts messages from its own Fireguard window, and sends the configuration to Fireguard's origin instead of "*".

Changes

• measurementId, storageBucket and messagingSenderId are now optional in TFirebaseConfig.
• New: PopupBlockedError, AuthFailedError, ErrorType.PopupBlocked and ErrorType.AuthFailed, and an optional code on errors.
• EventHelper: a source filter for on(), a target origin for send(), and dispose().
• Dependencies upgraded, including @eoussama/core 0.1.2, which no longer installs a linting toolchain in your project.

Compatibility

• Works with the deployed Fireguard (0.1.3) and the upcoming 0.1.4.
• Behaviour change: SAML providers return no OAuth token, so they now reject instead of resolving with an empty string.

Full Changelog: 0.1.8...v0.1.9