Desktop OIDC: non-blocking fetch + poll, don't leave webview

SPA fetches /oidc/open (returns session ID immediately), then polls /oidc/result every 500ms. Go server opens browser in a goroutine. Webview never leaves the Wails origin. Token is saved to keychain and returned through the poll response.
2026-07-14 00:09:46 +02:00
parent c8ef3793d7
commit 8b3fe02a10
4 changed files with 99 additions and 62 deletions
--- a/cmd/desktop/main.go
+++ b/cmd/desktop/main.go
@@ -149,49 +149,73 @@ func startOIDCServer() *http.Server {
 			return
 		}

-		oidcCfg, err := fetchOIDCConfig(apiUrl)
-		if err != nil {
-			http.Error(w, err.Error(), http.StatusServiceUnavailable)
-			return
-		}
-
-		verifier, challenge, _ := pkceParams()
-		state := randomString(32)
-		redirectURI := fmt.Sprintf("http://127.0.0.1:%d/oidc/callback", oidcCallbackPort)
-
 		sessionID := randomString(16)
-		ch := make(chan string, 1)
+
+		go func() {
+			oidcCfg, err := fetchOIDCConfig(apiUrl)
+			if err != nil {
+				return
+			}
+
+			verifier, challenge, _ := pkceParams()
+			state := randomString(32)
+			redirectURI := fmt.Sprintf("http://127.0.0.1:%d/oidc/callback", oidcCallbackPort)
+
+			ch := make(chan string, 1)
+			oidcSessionsMu.Lock()
+			oidcSessions[sessionID] = &oidcSession{apiUrl: apiUrl, verifier: verifier, state: state, ch: ch}
+			oidcSessionsMu.Unlock()
+
+			authURL := fmt.Sprintf("%s?%s",
+				oidcCfg.AuthorizationEndpoint,
+				url.Values{
+					"response_type":         {"code"},
+					"client_id":             {oidcCfg.ClientID},
+					"redirect_uri":          {redirectURI},
+					"code_challenge":        {challenge},
+					"code_challenge_method": {"S256"},
+					"state":                 {state},
+					"scope":                 {"openid profile email"},
+				}.Encode(),
+			)
+
+			exec.Command("open", authURL).Start()
+
+			select {
+			case token := <-ch:
+				if token != "" {
+					c := &ConfigService{}
+					c.SaveConfig(apiUrl, token)
+				}
+			case <-time.After(5 * time.Minute):
+			}
+		}()
+
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(map[string]string{"id": sessionID})
+	})
+
+	h("/oidc/result", func(w http.ResponseWriter, r *http.Request) {
+		sessionID := r.URL.Query().Get("id")
+		var token string
+
 		oidcSessionsMu.Lock()
-		oidcSessions[sessionID] = &oidcSession{apiUrl: apiUrl, verifier: verifier, state: state, ch: ch}
+		session, ok := oidcSessions[sessionID]
+		if ok {
+			select {
+			case t := <-session.ch:
+				token = t
+				session.ch <- t // put it back for other pollers
+			default:
+			}
+		}
 		oidcSessionsMu.Unlock()

-		authURL := fmt.Sprintf("%s?%s",
-			oidcCfg.AuthorizationEndpoint,
-			url.Values{
-				"response_type":         {"code"},
-				"client_id":             {oidcCfg.ClientID},
-				"redirect_uri":          {redirectURI},
-				"code_challenge":        {challenge},
-				"code_challenge_method": {"S256"},
-				"state":                 {state},
-				"scope":                 {"openid profile email"},
-			}.Encode(),
-		)
-
-		exec.Command("open", authURL).Start()
-
-		select {
-		case token := <-ch:
-			if token != "" {
-				c := &ConfigService{}
-				c.SaveConfig(apiUrl, token)
-				http.Redirect(w, r, "/?desktop=1&token="+url.QueryEscape(token), http.StatusFound)
-			} else {
-				http.Redirect(w, r, "/?desktop=1&error=login_failed", http.StatusFound)
-			}
-		case <-time.After(5 * time.Minute):
-			http.Redirect(w, r, "/?desktop=1&error=timeout", http.StatusFound)
-		}
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(map[string]string{
+			"token":   token,
+			"pending": fmt.Sprintf("%t", !ok || (ok && token == "")),
+		})
 	})

 	h("/oidc/callback", func(w http.ResponseWriter, r *http.Request) {