Keep Xaman login in the current tab

[xrpbanks]

Summary

• Remove the CalorieApp-created Xaman launch tab and all window.open / opener messaging.
• Start WordPress/Xaman through same-tab navigation only.
• Store the short-lived handoff proof in the initiating tab's session storage and securely restore that browser session when the user returns.
• Keep the callback browser fully usable when the mobile OS returns through its configured default browser.
• Update CalorieApp-owned notices to distinguish same-tab app behavior from the documented mobile OS/Xaman return limitation.
• Remove the now-unused /auth/launching route.

Platform boundary

Xaman documents that iOS and Android do not allow a browser flow to force a return to the exact originating tab. This change removes every extra tab CalorieApp itself controlled; any remaining default-browser return is created by Xaman/the mobile operating system.

Verification

• No runtime window.open, /auth/launching, opener, or launch-message references remain.
• Frontend lint passed.
• Frontend production build passed.
• Build exposes no /auth/launching route.
• Exact scope: six frontend/documentation paths.
• No backend, WordPress plugin, or release-check.ps1 changes.

Please do not merge until all checks are green.

[Copilot]

Pull request overview

This PR updates the Xaman sign-in flow to use same-tab navigation (removing CalorieApp-controlled extra tabs and window.open/opener messaging), while preserving the ability to restore the initiating tab’s session using short-lived handoff data stored in sessionStorage. It also removes the now-unused /auth/launching route and updates user-facing notices to clarify the remaining mobile OS/browser return limitation.

Changes:

• Replace the launch-tab + postMessage flow with same-tab navigation to the WordPress/Xaman sign-in URL.
• Persist pending login handoff data in initiating-tab sessionStorage and attempt restoration when the user returns to that browsing context.
• Remove /auth/launching and update documentation + UI notices to reflect the new behavior.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
README.md	Updates documentation to describe same-tab Xaman login and session restoration behavior.
frontend/components/XamanLoginPanel.tsx	Implements same-tab login navigation and initiating-tab restoration via sessionStorage.
frontend/components/FoodSearchPlaceholder.tsx	Updates phone/browser notice copy to match same-tab login behavior.
frontend/app/auth/launching/page.tsx	Removes the no-longer-needed launch/holding page route.
frontend/app/auth/complete/page.tsx	Updates completion page messaging for default-browser returns.
frontend/app/auth/callback/page.tsx	Updates callback page notices to reflect mobile return behavior and lack of extra tab creation.

Suppressed comments (1)

frontend/components/XamanLoginPanel.tsx:276

• restoreLogin sets up an AbortController and aborts it on cleanup, but refreshCurrentUser does not pass any signal to backendRequest, so the in-flight /api/identity/me request cannot be cancelled and can still call setCurrentUser after the effect is cancelled/unmounted. That undermines the new cancellation logic and can cause late state updates/races.

Consider wiring loginAbortController.current?.signal into the backendRequest call and skipping state updates when the signal is aborted.

  const refreshCurrentUser = useCallback(async (): Promise<MeResponse | null> => {
    try {
      const response = await backendRequest(
        `${BACKEND_BASE_URL}/api/identity/me`
      );

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.