fix: exempt device-link pairing from timeout

[Morten Barklund (barklund)]

Summary

• Exempt showDeviceLinkQR from the default postMessage request timeout.
• Allow PostMessageHandler.postMessage(..., null) to keep a request pending indefinitely.
• Add regression coverage for the no-timeout path and the showDeviceLinkQR call site.

Fixes DXA-3882

[linear-code]

DXA-3882

[Copilot]

Pull request overview

This PR updates the embedded iframe messaging layer to support disabling request timeouts (via null) and uses that capability to exempt the device-link pairing flow (showDeviceLinkQR) from the default postMessage timeout, with regression tests covering both the handler behavior and the call site.

Changes:

• Extend PostMessageHandler.postMessage to accept timeout?: number | null, where null disables the timeout.
• Update CortiEmbedded.showDeviceLinkQR to pass null timeout so pairing can remain pending indefinitely.
• Add tests validating the no-timeout path in PostMessageHandler and verifying the showDeviceLinkQR call site passes null.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
src/utils/PostMessageHandler.ts	Adds support for null timeout (no timer) and adjusts timeout cleanup logic.
src/CortiEmbedded.ts	Exempts showDeviceLinkQR from default timeout by calling postMessage(..., null).
test/post-message-handler.test.ts	Adds regression test ensuring requests don’t time out when timeout is disabled.
test/corti-embedded.test.ts	Adds regression test ensuring showDeviceLinkQR passes null timeout to the handler.

Suppressed comments (1)

src/utils/PostMessageHandler.ts:310

• If contentWindow.postMessage(...) throws (e.g., DataCloneError), the Promise rejects but the request remains in pendingRequests. With timeout: null, there is no timer to clean it up, so it can leak indefinitely. Wrap the postMessage call in a try/catch and on error delete the pending request and clear any timeout before rejecting.

        if (timeoutId !== null) clearTimeout(timeoutId);
        reject(new Error("Cannot determine trusted origin for postMessage"));
        return;
      }
      contentWindow.postMessage(fullMessage, targetOrigin);

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.