Fix mobile OAuth resume hang and redirect loop after file pick.

AngryBrit · cursoragent · AngryBrit · commit eb7b625bb584 · 2026-06-15T17:39:50.000+01:00
StrictMode-safe resume claiming, safe return paths away from the callback URL, auto-reopen Effective Paths after OAuth, and stop hiding the desktop picker before it is visible.

Co-authored-by: Cursor &lt;cursoragent@cursor.com&gt;
diff --git a/src/components/EffectivePathsSyncDialog.tsx b/src/components/EffectivePathsSyncDialog.tsx
@@ -81,10 +81,12 @@ import {
   resumeMobileEffectivePathsGrant,
 } from '../effectivePaths/effectivePathsMobileGrantFlow'
 import {
+  beginEpMobileResumeRun,
+  claimEpMobileResume,
   consumeEpMobilePickerError,
-  peekEpMobileResume,
+  finishEpMobileResumeRun,
 } from '../effectivePaths/effectivePathsMobileGrantSession'
-import { mobilePickerRedirectPreferred, redirectToMobilePickerAuth } from '../effectivePaths/googleDrivePickerMobile'
+import { mobilePickerRedirectPreferred } from '../effectivePaths/googleDrivePickerMobile'
 import {
   getCachedGoogleSheetsAccessToken,
   googleSheetsOAuthConfigured,
@@ -248,7 +250,6 @@ export function EffectivePathsSyncDialog({
   const [workbookAccess, setWorkbookAccess] = useState<LinkedWorkbookAccess[] | null>(null)
   const [loadingSheets, setLoadingSheets] = useState(false)
   const [pickerUiHidden, setPickerUiHidden] = useState(false)
-  const mobileResumeStartedRef = useRef(false)
   const [loadProgress, setLoadProgress] = useState<EffectivePathsLoadProgress | null>(null)
   const [syncProgress, setSyncProgress] = useState<{
     direction: 'import' | 'export'
@@ -632,44 +633,27 @@ export function EffectivePathsSyncDialog({
         const deniedIds = collectDeniedLinkedSpreadsheetIds(result.workbookAccess)
         if (deniedIds.length > 0) {
           const linkedNames = linkedWorkbookNamesFromGateway(result)
-          if (mobilePickerRedirectPreferred()) {
-            await redirectToMobilePickerAuth({
-              phase: 'linked_workbooks',
-              masterSpreadsheetId: parsedMaster.spreadsheetId,
-              masterSheetGid: parsedMaster.sheetGid,
-              spreadsheetIds: collectSpreadsheetIdsFromGateway(result, parsedMaster.spreadsheetId),
-              multiselect: true,
-              requireMasterSpreadsheetId: parsedMaster.spreadsheetId,
-              titles: {
-                ...pickerTitles,
-                linkedWorkbooks:
+          if (!mobilePickerRedirectPreferred()) {
+            const retryGrant = await grantEffectivePathsSpreadsheetsAccess(
+              token,
+              collectSpreadsheetIdsFromGateway(result, parsedMaster.spreadsheetId),
+              {
+                title:
                   linkedNames.length > 0
                     ? `${t('ep_picker_linked_workbooks_title')} (${linkedNames.join(', ')})`
                     : t('ep_picker_linked_workbooks_title'),
+                multiselect: true,
+                requireMasterSpreadsheetId: parsedMaster.spreadsheetId,
+                onPickerUiActive: setPickerUiHidden,
               },
-            })
-            return
-          }
-
-          const retryGrant = await grantEffectivePathsSpreadsheetsAccess(
-            token,
-            collectSpreadsheetIdsFromGateway(result, parsedMaster.spreadsheetId),
-            {
-              title:
-                linkedNames.length > 0
-                  ? `${t('ep_picker_linked_workbooks_title')} (${linkedNames.join(', ')})`
-                  : t('ep_picker_linked_workbooks_title'),
-              multiselect: true,
-              requireMasterSpreadsheetId: parsedMaster.spreadsheetId,
-              onPickerUiActive: setPickerUiHidden,
-            },
-          )
-          if (!retryGrant.ok) {
-            reportMobilePickerError(retryGrant.reason)
-          } else {
-            result = await listWorkbooks()
-            if (result.ok) {
-              cacheLinkedSpreadsheetIdsFromGateway(parsedMaster.spreadsheetId, result)
+            )
+            if (!retryGrant.ok) {
+              reportMobilePickerError(retryGrant.reason)
+            } else {
+              result = await listWorkbooks()
+              if (result.ok) {
+                cacheLinkedSpreadsheetIdsFromGateway(parsedMaster.spreadsheetId, result)
+              }
             }
           }
         }
@@ -730,23 +714,25 @@ export function EffectivePathsSyncDialog({
         )
       }
     },
-    [formatExportError, parsedMaster, pickerTitles, reportMobilePickerError, showNotice, t],
+    [formatExportError, parsedMaster, reportMobilePickerError, showNotice, t],
   )
 
   useEffect(() => {
-    if (!open || mobileResumeStartedRef.current) return
+    if (!open) return
 
     const mobileError = consumeEpMobilePickerError()
     if (mobileError) {
       queueMicrotask(() => reportMobilePickerError(mobileError))
       return
     }
 
-    if (!peekEpMobileResume()) return
-    mobileResumeStartedRef.current = true
+    const resume = claimEpMobileResume()
+    if (!resume) return
+    if (!beginEpMobileResumeRun()) return
 
     void (async () => {
       setLoadingSheets(true)
+      setPickerUiHidden(false)
       resetEffectivePathsWorkbookLoadState({
         setWorkbooks,
         setIdsTabTitle,
@@ -773,11 +759,11 @@ export function EffectivePathsSyncDialog({
       setLoadProgress(null)
       setNotice(null)
       try {
-        const accessResult = await resumeMobileEffectivePathsGrant()
+        const accessResult = await resumeMobileEffectivePathsGrant(resume)
         if (!accessResult.ok) {
           if (accessResult.reason === 'gateway_failed') {
             showNotice(formatExportError(accessResult.error, accessResult.message), 'error')
-          } else if (accessResult.reason !== 'mobile_resume_missing') {
+          } else {
             reportMobilePickerError(accessResult.reason)
           }
           return
@@ -796,16 +782,12 @@ export function EffectivePathsSyncDialog({
       } finally {
         setLoadingSheets(false)
         setLoadProgress(null)
+        setPickerUiHidden(false)
+        finishEpMobileResumeRun(true)
       }
     })()
   }, [formatExportError, loadLinkedWorkbooks, open, reportMobilePickerError, showNotice, t])
 
-  useEffect(() => {
-    if (!open) {
-      mobileResumeStartedRef.current = false
-    }
-  }, [open])
-
   const handleLoadSheets = useCallback(async () => {
     if (!parsedMaster) {
       showNotice(
diff --git a/src/components/lab/LabImportExportPanel.tsx b/src/components/lab/LabImportExportPanel.tsx
@@ -1,4 +1,4 @@
-import { useRef, useState, type ChangeEvent } from 'react'
+import { useEffect, useRef, useState, type ChangeEvent } from 'react'
 import type { BotsEpSyncState } from '../../effectivePaths/botsEpStateFromPersisted'
 import type { ModulesEpSyncState } from '../../effectivePaths/modulesEpStateFromPersisted'
 import type { GuardiansEpSyncState } from '../../effectivePaths/guardiansEpStateFromPersisted'
@@ -109,6 +109,17 @@ export function LabImportExportPanel({
       peekEpMobileResume() != null ||
       peekEpMobilePickerError() != null,
   )
+
+  useEffect(() => {
+    if (
+      !hasEpResumeQuery() &&
+      peekEpMobileResume() == null &&
+      peekEpMobilePickerError() == null
+    ) {
+      return
+    }
+    queueMicrotask(() => setEffectivePathsSyncOpen(true))
+  }, [])
   const effectivePathsAvailable = googleSheetsOAuthConfigured()
   const importLabCsvFileInputRef = useRef<HTMLInputElement>(null)
   const importPlayerInfoFileInputRef = useRef<HTMLInputElement>(null)
diff --git a/src/effectivePaths/effectivePathsMobileGrantFlow.ts b/src/effectivePaths/effectivePathsMobileGrantFlow.ts
@@ -1,5 +1,5 @@
 import type { EffectivePathsIdsGateway } from './assembleEffectivePathsListResult'
-import { consumeEpMobileResume } from './effectivePathsMobileGrantSession'
+import type { EpMobileResumePayload } from './effectivePathsMobileGrantSession'
 import { readCachedLinkedSpreadsheetIds } from './effectivePathsLinkedSpreadsheetCache'
 import { fetchEffectivePathsIdsGateway } from './exportEffectivePathsApi'
 import { redirectToMobilePickerAuth } from './googleDrivePickerMobile'
@@ -81,12 +81,9 @@ export type ResumeMobileEffectivePathsGrantResult =
 /**
  * Continue grant after Google redirects back. May start another redirect for linked workbooks.
  */
-export async function resumeMobileEffectivePathsGrant(): Promise<ResumeMobileEffectivePathsGrantResult> {
-  const resume = consumeEpMobileResume()
-  if (!resume) {
-    return { ok: false, reason: 'mobile_resume_missing' }
-  }
-
+export async function resumeMobileEffectivePathsGrant(
+  resume: EpMobileResumePayload,
+): Promise<ResumeMobileEffectivePathsGrantResult> {
   const {
     accessToken,
     pickedSpreadsheetIds,
diff --git a/src/effectivePaths/effectivePathsMobileGrantSession.test.ts b/src/effectivePaths/effectivePathsMobileGrantSession.test.ts
@@ -0,0 +1,57 @@
+/**
+ * @vitest-environment jsdom
+ */
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import {
+  beginEpMobileResumeRun,
+  claimEpMobileResume,
+  finishEpMobileResumeRun,
+  peekEpMobileResume,
+  resetEpMobileResumeRunStateForTests,
+  stashEpMobileResume,
+} from './effectivePathsMobileGrantSession'
+
+const sampleResume = {
+  accessToken: 'token-abc',
+  pickedSpreadsheetIds: ['sheet-1'],
+  phase: 'master' as const,
+  masterSpreadsheetId: 'sheet-1',
+  masterSheetGid: null,
+  titles: {
+    idsMaster: 'IDS',
+    allWorkbooks: 'All',
+    linkedWorkbooks: 'Linked',
+  },
+}
+
+describe('ep mobile resume run guard', () => {
+  beforeEach(() => {
+    sessionStorage.clear()
+    resetEpMobileResumeRunStateForTests()
+  })
+
+  afterEach(() => {
+    sessionStorage.clear()
+    resetEpMobileResumeRunStateForTests()
+  })
+
+  it('claims without consuming until finish', () => {
+    stashEpMobileResume(sampleResume)
+
+    const claimed = claimEpMobileResume()
+    expect(claimed).toEqual(sampleResume)
+    expect(peekEpMobileResume()).toEqual(sampleResume)
+
+    finishEpMobileResumeRun(true)
+    expect(peekEpMobileResume()).toBeNull()
+  })
+
+  it('prevents a second in-flight run (StrictMode remount)', () => {
+    stashEpMobileResume(sampleResume)
+
+    expect(claimEpMobileResume()).toEqual(sampleResume)
+    expect(beginEpMobileResumeRun()).toBe(true)
+    expect(beginEpMobileResumeRun()).toBe(false)
+    expect(claimEpMobileResume()).toBeNull()
+  })
+})
diff --git a/src/effectivePaths/effectivePathsMobileGrantSession.ts b/src/effectivePaths/effectivePathsMobileGrantSession.ts
@@ -1,4 +1,5 @@
 import type { EnsureEffectivePathsSpreadsheetAccessTitles } from './grantEffectivePathsSpreadsheetAccess'
+import { publicAppOrigin } from '../devOrigin'
 
 const PKCE_SESSION_KEY = 'towersmith_ep_mobile_pkce'
 const FLOW_SESSION_KEY = 'towersmith_ep_mobile_grant_flow'
@@ -117,13 +118,45 @@ export function peekEpMobileResume(): EpMobileResumePayload | null {
   return readJson<EpMobileResumePayload>(RESUME_SESSION_KEY)
 }
 
+let activeEpMobileResume: EpMobileResumePayload | null = null
+let epMobileResumeInFlight = false
+
+/** Peek the pending resume payload (StrictMode-safe; does not consume sessionStorage). */
+export function claimEpMobileResume(): EpMobileResumePayload | null {
+  if (epMobileResumeInFlight) return null
+  if (activeEpMobileResume) return activeEpMobileResume
+  const resume = peekEpMobileResume()
+  if (!resume) return null
+  activeEpMobileResume = resume
+  return resume
+}
+
+/** Mark the resume runner as started so a StrictMode remount does not start a second run. */
+export function beginEpMobileResumeRun(): boolean {
+  if (epMobileResumeInFlight) return false
+  epMobileResumeInFlight = true
+  return true
+}
+
+/** End the resume runner and optionally remove the payload from sessionStorage. */
+export function finishEpMobileResumeRun(commit = true): void {
+  if (commit) {
+    consumeEpMobileResume()
+  }
+  activeEpMobileResume = null
+  epMobileResumeInFlight = false
+}
+
+/** @internal Test helper */
+export function resetEpMobileResumeRunStateForTests(): void {
+  activeEpMobileResume = null
+  epMobileResumeInFlight = false
+}
+
 export const EP_RESUME_QUERY_PARAM = 'ep_resume'
 
 export function urlWithEpResumeFlag(target: string): string {
-  const url = new URL(
-    target,
-    typeof window !== 'undefined' ? window.location.origin : 'https://www.towersmith.com',
-  )
+  const url = new URL(target, publicAppOrigin())
   url.searchParams.set(EP_RESUME_QUERY_PARAM, '1')
   return url.toString()
 }
diff --git a/src/effectivePaths/epMobileOAuthReturn.test.ts b/src/effectivePaths/epMobileOAuthReturn.test.ts
@@ -0,0 +1,22 @@
+import { describe, expect, it } from 'vitest'
+import { safeAppReturnPath } from './epMobileOAuthReturn'
+
+describe('safeAppReturnPath', () => {
+  it('returns site root when preferred path is the OAuth callback', () => {
+    expect(
+      safeAppReturnPath('https://www.towersmith.com/oauth/google-drive-picker?code=abc'),
+    ).toBe('https://www.towersmith.com/')
+  })
+
+  it('strips OAuth query params from a normal return URL', () => {
+    expect(safeAppReturnPath('https://www.towersmith.com/?code=abc&state=xyz')).toBe(
+      'https://www.towersmith.com/',
+    )
+  })
+
+  it('keeps a normal lab return URL', () => {
+    expect(safeAppReturnPath('https://www.towersmith.com/?panel=lab')).toBe(
+      'https://www.towersmith.com/?panel=lab',
+    )
+  })
+})
diff --git a/src/effectivePaths/epMobileOAuthReturn.ts b/src/effectivePaths/epMobileOAuthReturn.ts
@@ -0,0 +1,34 @@
+import { publicAppOrigin } from '../devOrigin'
+import { isGooglePickerOAuthCallbackPath } from './googleDrivePickerEnvironment'
+
+const OAUTH_QUERY_PARAMS = ['code', 'state', 'error', 'scope', 'authuser', 'prompt', 'picked_file_ids']
+
+/** Never send the user back to the OAuth callback URL (that causes a redirect loop). */
+export function safeAppReturnPath(preferred?: string | null): string {
+  if (preferred) {
+    try {
+      const url = new URL(preferred)
+      if (isGooglePickerOAuthCallbackPath(url.pathname)) {
+        return `${url.origin}/`
+      }
+      for (const key of OAUTH_QUERY_PARAMS) {
+        url.searchParams.delete(key)
+      }
+      return url.toString()
+    } catch {
+      /* ignore malformed URLs */
+    }
+  }
+  return `${publicAppOrigin()}/`
+}
+
+/** When VITE_PUBLIC_APP_ORIGIN is set, start OAuth from that host so sessionStorage matches the callback. */
+export function redirectToCanonicalOriginIfNeeded(): boolean {
+  if (typeof window === 'undefined') return false
+  const canonical = publicAppOrigin()
+  if (window.location.origin === canonical) return false
+  window.location.assign(
+    `${canonical}${window.location.pathname}${window.location.search}${window.location.hash}`,
+  )
+  return true
+}
diff --git a/src/effectivePaths/googleDrivePicker.ts b/src/effectivePaths/googleDrivePicker.ts
@@ -259,8 +259,8 @@ export async function pickGoogleSpreadsheets(
     }
 
     try {
-      options.onPickerUiActive?.(true)
       builder.build().setVisible(true)
+      options.onPickerUiActive?.(true)
     } catch {
       finish({ ok: false, reason: 'picker_failed' })
     }
diff --git a/src/effectivePaths/googleDrivePickerMobile.ts b/src/effectivePaths/googleDrivePickerMobile.ts
diff --git a/src/main.tsx b/src/main.tsx

Original file line number	Diff line number	Diff line change
`@@ -259,8 +259,8 @@ export async function pickGoogleSpreadsheets(`
`259`	`259`	`}`
`260`	`260`
`261`	`261`	`try {`
`262`		`- options.onPickerUiActive?.(true)`
`263`	`262`	`builder.build().setVisible(true)`
	`263`	`+ options.onPickerUiActive?.(true)`
`264`	`264`	`} catch {`
`265`	`265`	`finish({ ok: false, reason: 'picker_failed' })`
`266`	`266`	`}`