fix: prevent auth button cross-contamination when SlackKit and TeamsKit are co-rendered

.changeset/fix-auth-button-cross-contamination.md

@@ -0,0 +1,5 @@
+---
+"@knocklabs/react-core": patch
+---
+
+Fix auth button cross-contamination when SlackKit and TeamsKit are rendered simultaneously. The shared `useAuthPostMessageListener` hook now checks whether its own popup is open before processing `authComplete` messages, preventing one integration's OAuth completion from incorrectly updating the other's connection state.

packages/react-core/src/modules/core/hooks/useAuthPostMessageListener.ts

@@ -84,6 +84,11 @@ export function useAuthPostMessageListener(
         return;
       }
 
+      // Ignore messages when this integration hasn't opened a popup
+      if (!popupWindowRef.current || popupWindowRef.current.closed) {
+        return;
+      }
+
       const messageType = getMessageType(event.data);
 
       if (messageType === "authComplete") {

packages/react-core/test/core/hooks/useAuthPostMessageListener.test.ts

@@ -132,6 +132,50 @@ describe("useAuthPostMessageListener", () => {
     expect(popupWindowRef.current).toBeNull();
   });
 
+  it("should ignore messages when popupWindowRef is null", () => {
+    popupWindowRef.current = null;
+
+    renderHook(() =>
+      useAuthPostMessageListener({
+        knockHost,
+        popupWindowRef,
+        setConnectionStatus,
+        onAuthenticationComplete,
+      }),
+    );
+
+    const event = new MessageEvent("message", {
+      data: "authComplete",
+      origin: knockHost,
+    });
+    window.dispatchEvent(event);
+
+    expect(setConnectionStatus).not.toHaveBeenCalled();
+    expect(onAuthenticationComplete).not.toHaveBeenCalled();
+  });
+
+  it("should ignore messages when popup is closed", () => {
+    mockPopup.closed = true;
+
+    renderHook(() =>
+      useAuthPostMessageListener({
+        knockHost,
+        popupWindowRef,
+        setConnectionStatus,
+        onAuthenticationComplete,
+      }),
+    );
+
+    const event = new MessageEvent("message", {
+      data: "authComplete",
+      origin: knockHost,
+    });
+    window.dispatchEvent(event);
+
+    expect(setConnectionStatus).not.toHaveBeenCalled();
+    expect(onAuthenticationComplete).not.toHaveBeenCalled();
+  });
+
   it("should ignore messages from different origins", () => {
     renderHook(() =>
       useAuthPostMessageListener({