SAML/SSO login interrupted by injected.ts retries reloading the page during external IdP authentication (e.g. Microsoft Entra)

[gaincoder]

Describe the bug

When logging in via SAML/SSO, the Desktop app force-reloads the login page while
the user is still on the external Identity Provider page (e.g. Microsoft Entra).
This interrupts the authentication flow before the user can complete
password entry and MFA.

The login only succeeds if the user completes the entire IdP authentication
(password + MFA) and is redirected back to RocketChat within 30 seconds.
For users with MFA (Authenticator App, hardware token, etc.) this is often
not possible, especially on slower connections or when the MFA prompt
takes a moment to arrive.

Root cause

The injected.ts script continuously retries because window.require is not
defined on the external IdP page (e.g. login.microsoftonline.com). After
exhausting its retries at the 30 second mark, it explicitly triggers a
force reload with cache clear — which interrupts the login flow.

The injection logic does not detect that the current page is an external IdP
page and should not attempt injection or trigger a reload there.

Console output

injected.ts:3 [Rocket.Chat Desktop] Injected.ts
injected.ts:38 [Rocket.Chat Desktop] Injected.ts start fired
injected.ts:40 [Rocket.Chat Desktop] window.require is not defined
injected.ts:64 [Rocket.Chat Desktop] Inject start - retry 1 in 1000ms (total time: 1000ms)
BrowserSso.js:376 BSSO Telemetry: {"result":"Error","error":"bssoNotSupported","type":"TBAuthTelemetry","data":{"BSSO.info":"not-supported"},"traces":["BrowserSSO Initialized","window.navigator.msLaunchUri is not available for _pullBrowserSsoCookie"]}
injected.ts:38 [Rocket.Chat Desktop] Injected.ts start fired
injected.ts:40 [Rocket.Chat Desktop] window.require is not defined
injected.ts:64 [Rocket.Chat Desktop] Inject start - retry 2 in 1500ms (total time: 2500ms)
injected.ts:38 [Rocket.Chat Desktop] Injected.ts start fired
injected.ts:40 [Rocket.Chat Desktop] window.require is not defined
injected.ts:64 [Rocket.Chat Desktop] Inject start - retry 3 in 2250ms (total time: 4750ms)
injected.ts:38 [Rocket.Chat Desktop] Injected.ts start fired
injected.ts:40 [Rocket.Chat Desktop] window.require is not defined
injected.ts:64 [Rocket.Chat Desktop] Inject start - retry 4 in 3375ms (total time: 8125ms)
injected.ts:38 [Rocket.Chat Desktop] Injected.ts start fired
injected.ts:40 [Rocket.Chat Desktop] window.require is not defined
injected.ts:64 [Rocket.Chat Desktop] Inject start - retry 5 in 5000ms (total time: 13125ms)
injected.ts:38 [Rocket.Chat Desktop] Injected.ts start fired
injected.ts:40 [Rocket.Chat Desktop] window.require is not defined
injected.ts:64 [Rocket.Chat Desktop] Inject start - retry 6 in 5000ms (total time: 18125ms)
injected.ts:38 [Rocket.Chat Desktop] Injected.ts start fired
injected.ts:40 [Rocket.Chat Desktop] window.require is not defined
injected.ts:64 [Rocket.Chat Desktop] Inject start - retry 7 in 5000ms (total time: 23125ms)
injected.ts:38 [Rocket.Chat Desktop] Injected.ts start fired
injected.ts:40 [Rocket.Chat Desktop] window.require is not defined
injected.ts:64 [Rocket.Chat Desktop] Inject start - retry 8 in 5000ms (total time: 28125ms)
injected.ts:38 [Rocket.Chat Desktop] Injected.ts start fired
injected.ts:40 [Rocket.Chat Desktop] window.require is not defined
injected.ts:64 [Rocket.Chat Desktop] Inject start - retry 9 in 1875ms (total time: 30000ms)
injected.ts:38 [Rocket.Chat Desktop] Injected.ts start fired
injected.ts:40 [Rocket.Chat Desktop] window.require is not defined
injected.ts:43 [Rocket.Chat Desktop] Maximum retry time (30000ms) reached. window.require is still not available.
injected.ts:46 [Rocket.Chat Desktop] Triggering force reload with cache clear to recover...

Steps to reproduce

1. Open the RocketChat Desktop app
2. Click the SAML/SSO login button
3. The app navigates to the external IdP login page (e.g. Microsoft Entra)
4. Enter email, password, and wait for the MFA prompt (Authenticator App,
   SMS, etc.) — total time exceeds 30 seconds
5. The page force-reloads before authentication completes

Expected behavior

The injection logic should detect that the current page is an external IdP
page (i.e. not a RocketChat instance) and either:

• suspend retries while on external pages, or
• not trigger a force reload when the maximum retry time is reached on
  a non-RocketChat URL

Actual behavior

After 30 seconds of failed retries on the external IdP page, injected.ts
explicitly calls Triggering force reload with cache clear to recover...,
the force reload leads into missing information with the login flow.

Workaround

Login succeeds if the user completes password + MFA and is redirected back
to RocketChat within 30 seconds. This is not reliably achievable for most
MFA flows, particularly when the MFA notification is delayed or the user
needs to manually open an Authenticator App.

Environment

• OS: Windows 11
• RocketChat Desktop version: 4.14.0
• RocketChat Server version: 7.12.1
• Identity Provider: Microsoft Entra ID (SAML)

[gaincoder]

I've made a PR 6 weeks ago, when will it be merged?

Same Issue for custom oauth with Microsoft Entra. Current Workaround: oauth with popup