Desktop OIDC: non-blocking fetch + poll, don't leave webview

SPA fetches /oidc/open (returns session ID immediately), then polls
/oidc/result every 500ms. Go server opens browser in a goroutine.
Webview never leaves the Wails origin. Token is saved to keychain and
returned through the poll response.

cmd/desktop/main.go

@@ -149,9 +149,11 @@ func startOIDCServer() *http.Server {
 			return
 		}
 
+		sessionID := randomString(16)
+
+		go func() {
 			oidcCfg, err := fetchOIDCConfig(apiUrl)
 			if err != nil {
-			http.Error(w, err.Error(), http.StatusServiceUnavailable)
 				return
 			}
 
@@ -159,7 +161,6 @@ func startOIDCServer() *http.Server {
 			state := randomString(32)
 			redirectURI := fmt.Sprintf("http://127.0.0.1:%d/oidc/callback", oidcCallbackPort)
 
-		sessionID := randomString(16)
 			ch := make(chan string, 1)
 			oidcSessionsMu.Lock()
 			oidcSessions[sessionID] = &oidcSession{apiUrl: apiUrl, verifier: verifier, state: state, ch: ch}
@@ -185,13 +186,36 @@ func startOIDCServer() *http.Server {
 				if token != "" {
 					c := &ConfigService{}
 					c.SaveConfig(apiUrl, token)
-				http.Redirect(w, r, "/?desktop=1&token="+url.QueryEscape(token), http.StatusFound)
-			} else {
-				http.Redirect(w, r, "/?desktop=1&error=login_failed", http.StatusFound)
 				}
 			case <-time.After(5 * time.Minute):
-			http.Redirect(w, r, "/?desktop=1&error=timeout", http.StatusFound)
 			}
+		}()
+
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(map[string]string{"id": sessionID})
+	})
+
+	h("/oidc/result", func(w http.ResponseWriter, r *http.Request) {
+		sessionID := r.URL.Query().Get("id")
+		var token string
+
+		oidcSessionsMu.Lock()
+		session, ok := oidcSessions[sessionID]
+		if ok {
+			select {
+			case t := <-session.ch:
+				token = t
+				session.ch <- t // put it back for other pollers
+			default:
+			}
+		}
+		oidcSessionsMu.Unlock()
+
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(map[string]string{
+			"token":   token,
+			"pending": fmt.Sprintf("%t", !ok || (ok && token == "")),
+		})
 	})
 
 	h("/oidc/callback", func(w http.ResponseWriter, r *http.Request) {

web/src/lib/oidc.ts

@@ -102,9 +102,8 @@ export async function startLogin(): Promise<void> {
   })
 
   if (isDesktop) {
-    const apiUrl = getConfig().apiUrl || location.protocol + '//' + location.host
+    const apiUrl = getConfig().apiUrl || ''
-    location.href = `http://127.0.0.1:18901/oidc/open?apiUrl=${encodeURIComponent(apiUrl)}`
+    throw new Error('DESKTOP_OIDC:' + apiUrl)
-    throw new Error('Redirecting to login...')
   }
 
   location.href = `${cfg.authorization_endpoint.replace(/\/$/, '')}/?${params}`

web/src/main.ts

@@ -1,28 +1,10 @@
 import { mount } from 'svelte'
 import App from './App.svelte'
 import './app.css'
-import { initConfig, setConfig, getConfig } from '$lib/config'
+import { initConfig } from '$lib/config'
-
-function handleDesktopToken() {
-  const params = new URLSearchParams(location.search)
-  const token = params.get('token')
-  if (token) {
-    const apiUrl = getConfig().apiUrl || params.get('apiUrl') || ''
-    setConfig({ apiUrl, token, isDesktop: true })
-    initConfig({ apiUrl, token, isDesktop: true })
-    // clean the URL
-    params.delete('token')
-    params.delete('apiUrl')
-    let q = params.toString()
-    history.replaceState(null, '', location.pathname + (q ? '?' + q : ''))
-    return true
-  }
-  return false
-}
 
 function start() {
   initConfig()
-  handleDesktopToken()
 
   requestAnimationFrame(() => import('./lib/renderers'))
 

web/src/pages/Config.svelte

@@ -72,11 +72,43 @@
     try {
       await startLogin()
     } catch (e: any) {
-      error = e.message || 'OIDC login failed'
+      const msg = e?.message || e || ''
+      if (msg.startsWith('DESKTOP_OIDC:')) {
+        const url = msg.substring('DESKTOP_OIDC:'.length)
+        await desktopOIDC(url)
+        return
+      }
+      error = msg || 'OIDC login failed'
       oidcLoggingIn = false
     }
   }
 
+  async function desktopOIDC(apiUrl: string) {
+    try {
+      const resp = await fetch(`http://127.0.0.1:18901/oidc/open?apiUrl=${encodeURIComponent(apiUrl)}`)
+      const { id } = await resp.json()
+      if (!id) throw new Error('No session ID')
+
+      for (let i = 0; i < 600; i++) {
+        await new Promise(r => setTimeout(r, 500))
+        const r = await fetch(`http://127.0.0.1:18901/oidc/result?id=${id}`)
+        const data = await r.json()
+        if (data.token) {
+          setConfig({ apiUrl, token: data.token, isDesktop: true })
+          initConfig({ apiUrl, token: data.token, isDesktop: true })
+          oidcLoggingIn = false
+          onConnected()
+          return
+        }
+        if (!data.pending || data.pending === 'false') break
+      }
+      error = 'Login timed out'
+    } catch (e: any) {
+      error = e?.message || 'Could not reach login service'
+    }
+    oidcLoggingIn = false
+  }
+
   function logoutOIDC() {
     oidcLogout()
     oidcUser = null