pocketbase / dart-sdk

PocketBase Dart SDK
https://pub.dev/packages/pocketbase
MIT License
511 stars 51 forks source link

How to close browser with successful oauth using authWithOAuth2? #39

Closed NomadicDeveloper22 closed 1 year ago

NomadicDeveloper22 commented 1 year ago

Using the following:

final userData = await pb .collection('users').authWithOAuth2('google', (url) async {
      await launchUrl(url, mode: LaunchMode.externalApplication); // url_launcher
});

A browser is opened and authentication succeeds. But how can I close the browser once the user is authenticated?

I also tried flutter_custom_tabs but that seems to be no longer maintained and does't have a way to close the tab as far as I can tell

I thought authWithOAuth2 was supposed to close the broswer automatically

ganigeorgiev commented 1 year ago

I'm not able to reproduce it locally using flutter desktop (linux) and the url_launcher package.

It works as expected for me - the browser tab/window is closed after completing the OAuth2 sign-in/sign-up flow.

If flutter_custom_tabs doesn't work, you can try for example flutter_inappwebview package or any other package that has support for chrome custom tab (for ios I'm not sure what are the options).

Alternatively, if you want to have full control over the OAuth2 flow, you can try the more traditional approach with the manual code exchange flow and a deeplink redirect similar to the web example shown in the "Manual code exchange" example.

ganigeorgiev commented 1 year ago

Alternatively, since I haven't tested it on actual mobile device to see how it behave, if the opened chrome custom tab is not closed with the window.close() call that we fire on successful redirect, we may show a "5s count down page" with a message for the user to go back to the app.

Otherwise I can't think of other solution without deeplinks.

ganigeorgiev commented 1 year ago

@TheRedSpy15 Could you try with the ChromeSafariBrowser inappwebview class and setting the noHistory: true?

From the MDN docs of window.close():

This method can only be called on windows that were opened by a script using the Window.open() method, or on top-level windows that have a single history entry.

I rarely use my phone and have a very old rooted galaxy s3, but I'll try to test it sometime later today to explore the available options.

ganigeorgiev commented 1 year ago

@TheRedSpy15 I've tested it on my device and the auto close works with the noHistory option but only if you already have OAuth2 session with the provider (aka. when there is only 1 navigation step).

There is also an open issue for autoclosing a chrome custom tab when sent to background that is kindof related - https://bugs.chromium.org/p/chromium/issues/detail?id=543542.

In any case, I don't think there is much we can do in the SDK without a deeplink. The most universal approach would be to show a generic message to the user that the auth flow has been completed and they can go back to the app manually. Something like: message_screenshot.

The UX in my opinion is not that bad in this case and it will work practically with all cases even in the rare scenarios where a chrome based browser is not installed on the device.

The generic message will be available with the next minor PocketBase v0.15.2 update sometime later this week.