From e6538d5d38c9b2d0f31c6392d257f0d9263170bd Mon Sep 17 00:00:00 2001
From: Dave Bouwman <dave@davebouwman.com>
Date: Wed, 1 Jul 2020 08:29:56 -0600
Subject: [PATCH] fix(arcgis-rest-auth): enable oAuth from within an IFrame

Adds a new check for oauth handler on window.opener, and cleans up previous handler checks.

AFFECTS PACKAGES:
@esri/arcgis-rest-auth

ISSUES CLOSED: #711
---
 packages/arcgis-rest-auth/src/UserSession.ts | 42 +++++++++-----------
 1 file changed, 18 insertions(+), 24 deletions(-)

diff --git a/packages/arcgis-rest-auth/src/UserSession.ts b/packages/arcgis-rest-auth/src/UserSession.ts
index 5b35b7ba1c..6a51d5f3f5 100644
--- a/packages/arcgis-rest-auth/src/UserSession.ts
+++ b/packages/arcgis-rest-auth/src/UserSession.ts
@@ -355,31 +355,25 @@ export class UserSession implements IAuthenticationManager {
 
     function completeSignIn(error: any, oauthInfo?: IFetchTokenResponse) {
       try {
-        if (
-          popup &&
-          win.opener &&
-          win.opener.parent &&
-          win.opener.parent[`__ESRI_REST_AUTH_HANDLER_${clientId}`]
-        ) {
-          const handlerFn =
-            win.opener.parent[`__ESRI_REST_AUTH_HANDLER_${clientId}`];
-          if (handlerFn) {
-            handlerFn(
-              error ? JSON.stringify(error) : undefined,
-              JSON.stringify(oauthInfo)
-            );
+        let handlerFn;
+        const handlerFnName = `__ESRI_REST_AUTH_HANDLER_${clientId}`;
+
+        if (popup) {
+          // Guard b/c IE does not support window.opener
+          if (win.opener) {
+            if (win.opener.parent && win.opener.parent[handlerFnName]) {
+              handlerFn = win.opener.parent[handlerFnName];
+            } else if (win.opener && win.opener[handlerFnName]) {
+              // support pop-out oauth from within an iframe
+              handlerFn = win.opener[handlerFnName];
+            }
+          } else {
+            // IE
+            if (win !== win.parent && win.parent && win.parent[handlerFnName]) {
+              handlerFn = win.parent[handlerFnName];
+            }
           }
-          win.close();
-          return undefined;
-        }
-
-        if (
-          popup &&
-          win !== win.parent &&
-          win.parent &&
-          win.parent[`__ESRI_REST_AUTH_HANDLER_${clientId}`]
-        ) {
-          const handlerFn = win.parent[`__ESRI_REST_AUTH_HANDLER_${clientId}`];
+          // if we have a handler fn, call it and close the window
           if (handlerFn) {
             handlerFn(
               error ? JSON.stringify(error) : undefined,