Fixed the SPA authentication flow

src/auth/spa-page.js

@@ -0,0 +1,52 @@
+function createSpaPage() {
+  function start() {
+    if (location.origin !== "https://spa.oracle.com" || window.top !== window) return;
+    const runtime = (globalThis.browser || globalThis.chrome)?.runtime;
+    if (!runtime) return;
+    const documentId = `${performance.timeOrigin}:${location.pathname}`;
+    let identityRequest = null;
+
+    function inspect() {
+      const text = `${document.title}\n${document.body?.innerText || ""}`.trim();
+      let status = "loading";
+      if (/\b(?:401\s+(?:authorization required|unauthorized)|403\s+forbidden|access denied|authorization required|authentication failed|internal server error|service unavailable|bad gateway)\b/i.test(text)) status = "error";
+      else if (/^\/(?:cloudgate|login|signin|sso|oauth)(?:\/|$)/i.test(location.pathname)
+          || /\b(?:sign(?:ing)? in|log in|single sign.on|oracle access manager)\b/i.test(document.title)
+          || document.querySelector('input[name="SAMLResponse"], input[name="SAMLRequest"], input[type="password"], form[action*="/sso"], form[action*="/login"], meta[http-equiv="refresh" i]')) status = "login";
+      else if (document.readyState === "complete" && text
+          && document.querySelector('a[href], button, input, [role="main"], main, nav')) status = "ready";
+      return { status, documentId };
+    }
+
+    runtime.onMessage.addListener((message, sender, reply) => {
+      if (sender.id !== runtime.id) return false;
+      if (message?.type === "opportunitiesExtension.inspectSpaPage") {
+        reply(inspect());
+        return false;
+      }
+      if (message?.type !== "opportunitiesExtension.readSpaIdentity") return false;
+      const page = inspect();
+      if (page.status !== "ready" || page.documentId !== message.documentId) {
+        reply({ error: "SPA page is not ready or has navigated." });
+        return false;
+      }
+      // A document is probed at most once; failed identity reads require a fresh navigation.
+      if (!identityRequest) identityRequest = (async () => {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), 15000);
+        try {
+          const response = await fetch("https://spa.oracle.com/oalcrm/web/api/identity-management/users/current", {
+            method: "GET", credentials: "include", cache: "no-store", headers: { Accept: "application/json" }, signal: controller.signal
+          });
+          return { status: response.status, statusText: response.statusText, headers: Object.fromEntries(response.headers),
+            contentType: response.headers.get("content-type") || "", body: await response.text() };
+        } catch (error) {
+          return { error: error.message || "Unable to read SPA identity." };
+        } finally { clearTimeout(timer); }
+      })();
+      identityRequest.then(reply);
+      return true;
+    });
+  }
+  return { start };
+}