Desktop OIDC: non-blocking fetch + poll, don't leave webview

SPA fetches /oidc/open (returns session ID immediately), then polls
/oidc/result every 500ms. Go server opens browser in a goroutine.
Webview never leaves the Wails origin. Token is saved to keychain and
returned through the poll response.

web/src/lib/oidc.ts

@@ -102,9 +102,8 @@ export async function startLogin(): Promise<void> {
   })
 
   if (isDesktop) {
-    const apiUrl = getConfig().apiUrl || location.protocol + '//' + location.host
-    location.href = `http://127.0.0.1:18901/oidc/open?apiUrl=${encodeURIComponent(apiUrl)}`
-    throw new Error('Redirecting to login...')
+    const apiUrl = getConfig().apiUrl || ''
+    throw new Error('DESKTOP_OIDC:' + apiUrl)
   }
 
   location.href = `${cfg.authorization_endpoint.replace(/\/$/, '')}/?${params}`

web/src/main.ts

@@ -1,28 +1,10 @@
 import { mount } from 'svelte'
 import App from './App.svelte'
 import './app.css'
-import { initConfig, setConfig, getConfig } from '$lib/config'
-
-function handleDesktopToken() {
-  const params = new URLSearchParams(location.search)
-  const token = params.get('token')
-  if (token) {
-    const apiUrl = getConfig().apiUrl || params.get('apiUrl') || ''
-    setConfig({ apiUrl, token, isDesktop: true })
-    initConfig({ apiUrl, token, isDesktop: true })
-    // clean the URL
-    params.delete('token')
-    params.delete('apiUrl')
-    let q = params.toString()
-    history.replaceState(null, '', location.pathname + (q ? '?' + q : ''))
-    return true
-  }
-  return false
-}
+import { initConfig } from '$lib/config'
 
 function start() {
   initConfig()
-  handleDesktopToken()
 
   requestAnimationFrame(() => import('./lib/renderers'))
 

web/src/pages/Config.svelte

@@ -72,11 +72,43 @@
     try {
       await startLogin()
     } catch (e: any) {
-      error = e.message || 'OIDC login failed'
+      const msg = e?.message || e || ''
+      if (msg.startsWith('DESKTOP_OIDC:')) {
+        const url = msg.substring('DESKTOP_OIDC:'.length)
+        await desktopOIDC(url)
+        return
+      }
+      error = msg || 'OIDC login failed'
       oidcLoggingIn = false
     }
   }
 
+  async function desktopOIDC(apiUrl: string) {
+    try {
+      const resp = await fetch(`http://127.0.0.1:18901/oidc/open?apiUrl=${encodeURIComponent(apiUrl)}`)
+      const { id } = await resp.json()
+      if (!id) throw new Error('No session ID')
+
+      for (let i = 0; i < 600; i++) {
+        await new Promise(r => setTimeout(r, 500))
+        const r = await fetch(`http://127.0.0.1:18901/oidc/result?id=${id}`)
+        const data = await r.json()
+        if (data.token) {
+          setConfig({ apiUrl, token: data.token, isDesktop: true })
+          initConfig({ apiUrl, token: data.token, isDesktop: true })
+          oidcLoggingIn = false
+          onConnected()
+          return
+        }
+        if (!data.pending || data.pending === 'false') break
+      }
+      error = 'Login timed out'
+    } catch (e: any) {
+      error = e?.message || 'Could not reach login service'
+    }
+    oidcLoggingIn = false
+  }
+
   function logoutOIDC() {
     oidcLogout()
     oidcUser = null