From 50d563c0fdd7c5dff682246df22d19eaf8c021e6 Mon Sep 17 00:00:00 2001
From: Marcos Reifonas <m.reifonas@gmail.com>
Date: Tue, 18 Aug 2026 11:05:59 +0000
Subject: [PATCH] fix(auth): dedup logto token exchange with Promise caching

---
 src/lib/logto/client.ts | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/src/lib/logto/client.ts b/src/lib/logto/client.ts
index 18a0c77..54da0a8 100644
--- a/src/lib/logto/client.ts
+++ b/src/lib/logto/client.ts
@@ -120,8 +120,13 @@ export async function signIn(): Promise<void> {
   window.location.assign(LOGTO_ENDPOINT + '/oidc/auth?' + params.toString());
 }
 
+let callbackPromise: Promise<boolean> | null = null;
+
 export async function handleCallback(): Promise<boolean> {
-  try {
+  if (callbackPromise) return callbackPromise;
+
+  callbackPromise = (async () => {
+    try {
     const url = new URL(window.location.href);
     const code = url.searchParams.get('code');
     const state = url.searchParams.get('state');
@@ -184,7 +189,15 @@ export async function handleCallback(): Promise<boolean> {
   } catch (err) {
     console.error('Callback error:', err);
     return false;
+  } finally {
+    // Limpa a promise depois de um tempo pra permitir novos logins futuros,
+    // mas bloqueia execuções duplas imediatas (React Strict Mode / uso duplo)
+    setTimeout(() => {
+      callbackPromise = null;
+    }, 2000);
   }
+})();
+  return callbackPromise;
 }
 
 export async function getUser(): Promise<LogtoUser | null> {