From 59ee8f56a824ffdd679ffe8af5457f6f9d4a14ed Mon Sep 17 00:00:00 2001 From: Marcos Reifonas Date: Tue, 18 Aug 2026 10:43:36 +0000 Subject: [PATCH] fix(auth): limpar PKCE state no signIn e tratar invalid_grant MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - signIn agora limpa logto_state/nonce/verifier antes de começar - Evita mismatch quando user tenta logar de novo no mesmo browser - handleCallback limpa estado se /oidc/token retorna 400 invalid_grant - Resolve loop 'Falha no login' em modo anônimo re-login --- src/lib/logto/client.ts | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/src/lib/logto/client.ts b/src/lib/logto/client.ts index 6e90618..9c0b966 100644 --- a/src/lib/logto/client.ts +++ b/src/lib/logto/client.ts @@ -85,6 +85,15 @@ async function generatePkce(): Promise<{ verifier: string; challenge: string }> // === Auth flow === export async function signIn(): Promise { + // Limpa estado anterior pra evitar PKCE mismatch + try { + sessionStorage.removeItem('logto_state'); + sessionStorage.removeItem('logto_nonce'); + sessionStorage.removeItem('logto_verifier'); + } catch { + /* ignore */ + } + const state = generateRandomString(32); const nonce = generateRandomString(32); const pkce = await generatePkce(); @@ -142,7 +151,16 @@ export async function handleCallback(): Promise { }); if (!res.ok) { - console.error('Token exchange failed:', await res.text()); + const errorText = await res.text(); + console.error('Token exchange failed:', errorText); + // Limpa código da URL pra evitar retry com code inválido + try { + sessionStorage.removeItem('logto_state'); + sessionStorage.removeItem('logto_nonce'); + sessionStorage.removeItem('logto_verifier'); + } catch { + /* ignore */ + } return false; }