Update forward API to return in JSON iframe srcdoc with options injected. (currently broken in dev mode).

passkey/fastapi/admin.py

@@ -33,14 +33,7 @@ async def auth_exception_handler(_request, exc: authz.AuthException):
     """Handle AuthException with auth info for UI."""
     return JSONResponse(
         status_code=exc.status_code,
-        content={
-            "detail": exc.detail,
-            "auth": {
-                "mode": exc.mode,
-                "iframe": f"/auth/restricted/?mode={exc.mode}",
-                **exc.metadata,
-            },
-        },
+        content=authz.auth_error_content(exc),
     )
 
 

passkey/fastapi/api.py

@@ -62,14 +62,7 @@ async def auth_exception_handler(_request: Request, exc: authz.AuthException):
     """Handle AuthException with auth info for UI."""
     return JSONResponse(
         status_code=exc.status_code,
-        content={
-            "detail": exc.detail,
-            "auth": {
-                "mode": exc.mode,
-                "iframe": f"/auth/restricted/?mode={exc.mode}",
-                **exc.metadata,
-            },
-        },
+        content=authz.auth_error_content(exc),
     )
 
 
@@ -184,27 +177,18 @@ async def forward_authentication(
         wants_html = "text/html" in accept
 
         if wants_html:
-            # Browser request - return HTML with metadata
-            html = frontend.file("int", "forward", "index.html").read_bytes()
-            # Inject mode and any additional metadata
+            # Browser request - return full-page HTML with metadata
             data_attrs = {"mode": e.mode, **e.metadata}
+            html = frontend.file("int", "forward", "index.html").read_bytes()
             html = htmlutil.patch_html_data_attrs(html, **data_attrs)
             return Response(
                 html, status_code=e.status_code, media_type="text/html; charset=UTF-8"
             )
         else:
-            # API request - return JSON with iframe src link
-            iframe_url = f"/auth/restricted/?mode={e.mode}"
+            # API request - return JSON with iframe srcdoc HTML
             return JSONResponse(
                 status_code=e.status_code,
-                content={
-                    "detail": e.detail,
-                    "auth": {
-                        "mode": e.mode,
-                        "iframe": iframe_url,
-                        **e.metadata,
-                    },
-                },
+                content=authz.auth_error_content(e),
             )
 
 

passkey/fastapi/authz.py

@@ -2,7 +2,7 @@ import logging
 
 from fastapi import HTTPException
 
-from ..util import permutil, sessionutil
+from ..util import frontend, htmlutil, permutil, sessionutil
 
 logger = logging.getLogger(__name__)
 
@@ -32,6 +32,24 @@ class AuthException(HTTPException):
         self.metadata = metadata
 
 
+def auth_error_content(exc: AuthException) -> dict:
+    """Generate JSON response content for an AuthException.
+
+    Returns a dict with detail, mode, and iframe HTML for srcdoc embedding.
+    """
+    data_attrs = {"mode": exc.mode, **exc.metadata}
+    iframe_html = frontend.file("auth", "restricted", "index.html").read_bytes()
+    iframe_html = htmlutil.patch_html_data_attrs(iframe_html, **data_attrs)
+    return {
+        "detail": exc.detail,
+        "auth": {
+            "mode": exc.mode,
+            "iframe": iframe_html.decode("utf-8"),
+            **exc.metadata,
+        },
+    }
+
+
 async def verify(
     auth: str | None,
     perm: list[str],

passkey/fastapi/user.py

@@ -29,14 +29,7 @@ async def auth_exception_handler(_request, exc: authz.AuthException):
     """Handle AuthException with auth info for UI."""
     return JSONResponse(
         status_code=exc.status_code,
-        content={
-            "detail": exc.detail,
-            "auth": {
-                "mode": exc.mode,
-                "iframe": f"/auth/restricted/?mode={exc.mode}",
-                **exc.metadata,
-            },
-        },
+        content=authz.auth_error_content(exc),
     )
 
 

passkey/fastapi/ws.py

@@ -26,12 +26,7 @@ def websocket_error_handler(func):
             await ws.send_json(
                 {
                     "status": e.status_code,
-                    "detail": e.detail,
-                    "auth": {
-                        "mode": e.mode,
-                        "iframe": f"/auth/restricted/?mode={e.mode}",
-                        **e.metadata,
-                    },
+                    **authz.auth_error_content(e),
                 }
             )
         except (ValueError, InvalidAuthenticationResponse) as e: