..

app/auth.py

@@ -34,16 +34,47 @@ def auth_view():
 
         # --- Password recovery handler (Supabase redirect) ---
         # 1) Move hash params to query params on first load, then reload once
-        components.html(
+        # Try in main document first (no iframe), so it can read the top-level hash reliably
+        st.markdown(
             """
             <script>
             (function () {
               try {
                 var hash = window.location.hash;
-                // Only act if hash contains params and we haven't migrated
                 if (hash && hash.length > 1 && !sessionStorage.getItem('hash_migrated')) {
                   var hashParams = new URLSearchParams(hash.substring(1));
                   var queryParams = new URLSearchParams(window.location.search);
+                  var hasParams = false;
+                  hashParams.forEach(function (value, key) {
+                    queryParams.set(key, value);
+                    hasParams = true;
+                  });
+                  if (hasParams) {
+                    sessionStorage.setItem('hash_migrated', 'true');
+                    var newUrl = window.location.origin + window.location.pathname + '?' + queryParams.toString();
+                    window.location.replace(newUrl);
+                  }
+                }
+              } catch (e) {
+                console && console.warn && console.warn('main-doc hash->query failed', e);
+              }
+            })();
+            </script>
+            """,
+            unsafe_allow_html=True,
+        )
+        components.html(
+            """
+            <script>
+            (function () {
+              try {
+                // In iframe context, read and write via parent to ensure access to top-level URL
+                var w = window.parent || window;
+                var hash = w.location.hash;
+                // Only act if hash contains params and we haven't migrated
+                if (hash && hash.length > 1 && !w.sessionStorage.getItem('hash_migrated')) {
+                  var hashParams = new URLSearchParams(hash.substring(1));
+                  var queryParams = new URLSearchParams(w.location.search);
 
                   var hasParams = false;
                   hashParams.forEach(function (value, key) {
@@ -53,19 +84,25 @@ def auth_view():
 
                   if (hasParams) {
                     // Mark as migrated to avoid loops
-                    sessionStorage.setItem('hash_migrated', 'true');
+                    w.sessionStorage.setItem('hash_migrated', 'true');
                     // Build absolute URL (preserve origin + path), clear hash, and REPLACE (no extra reloads)
-                    var newUrl = window.location.origin + window.location.pathname + '?' + queryParams.toString();
-                    window.location.replace(newUrl);
+                    var newUrl = w.location.origin + w.location.pathname + '?' + queryParams.toString();
+                    w.location.replace(newUrl);
+                    // Fallback after a short delay in case replace is ignored
+                    setTimeout(function(){
+                      if (w.location.hash) {
+                        w.location.href = newUrl;
+                      }
+                    }, 250);
                   }
                 }
               } catch (e) {
-                console.error('hash->query migration failed', e);
+                console.error('iframe hash->query migration failed', e);
               }
             })();
             </script>
             """,
-            height=0,
+            height=1,
         )
 
         # 2) Read query params for recovery flow