fix(auth): prevent concurrent token exchange in Logto callback during Strict Mode

src/hooks/useAuth.tsx

@@ -7,6 +7,7 @@ import React, {
   useEffect,
   useState,
   useCallback,
+  useRef,
   ReactNode,
 } from 'react';
 import { supabase } from '@/integrations/supabase/client';
@@ -56,11 +57,15 @@ export function AuthProvider({ children }: { children: ReactNode }) {
   const [loading, setLoading] = useState(true);
   const [authInitialized, setAuthInitialized] = useState(false);
   const [isRecoveryFlow, setIsRecoveryFlow] = useState(false);
+  const callbackHandled = useRef(false);
 
   // Detecta callback URL e processa
   useEffect(() => {
     const url = new URL(window.location.href);
     if (url.searchParams.has('code')) {
+      if (callbackHandled.current) return;
+      callbackHandled.current = true;
+      
       setLoading(true);
       handleCallback().then((ok) => {
         if (ok) {

src/lib/logto/client.ts

@@ -126,16 +126,20 @@ export async function handleCallback(): Promise<boolean> {
     const code = url.searchParams.get('code');
     const state = url.searchParams.get('state');
 
+    console.log('[Logto Callback] Recebido:', { hasCode: !!code, hasState: !!state });
+
     if (!code) return false;
 
     const expectedState = sessionStorage.getItem('logto_state');
+    const verifier = sessionStorage.getItem('logto_verifier') || '';
+
+    console.log('[Logto Callback] State match?', { received: state, expected: expectedState, hasVerifier: !!verifier });
+
     if (state !== expectedState) {
       console.error('Logto: state mismatch');
       return false;
     }
 
-    const verifier = sessionStorage.getItem('logto_verifier') || '';
-
     const body = new URLSearchParams({
       grant_type: 'authorization_code',
       client_id: APP_ID,

src/pages/Callback.tsx

@@ -24,7 +24,7 @@ const Callback = () => {
         } else {
           setStatus('error');
           setMessage('Falha no login. Tente novamente.');
-          setTimeout(() => navigate('/auth'), 2500);
+          // Não navega automaticamente - deixa o user ver o erro
         }
       } catch (err) {
         if (cancelled) return;