CAS popup login can hang forever if the popup does not close

Description

The CAS login popup flow can hang indefinitely because openCASLoginPopup() waits only for the popup window to close.

If the CAS callback page does not auto-close the window for any reason, the promise returned by openCASLoginPopup() never resolves. That leaves the login flow stuck with no timeout, retry path, or alternate completion signal.

Why this matters

This is a reliability issue for any deployment using CAS, especially when:

• the CAS callback page is customized,
• the popup-close script is blocked by a CSP or browser extension,
• the user reaches an error page that never closes itself,
• or the popup stays open after a successful auth redirect.

In those cases, the UI waits forever even though the user has already completed the auth step or cannot complete it anymore.

Code path

apps/meteor/client/lib/openCASLoginPopup.ts

The current implementation polls popup.closed every 100ms and resolves only when the popup closes:

• waitForPopupClose() keeps a polling interval running
• openCASLoginPopup() awaits that promise with no timeout
• there is no postMessage/callback-based success signal

Expected behavior

The login flow should finish or fail in a bounded amount of time, even if the popup does not close itself.

Actual behavior

The flow can hang forever and force the user to refresh or restart the login attempt.

Suggested fix

Consider one of these:

• add a timeout with a clear fallback error message,
• resolve the flow from a success callback/postMessage from the popup,
• or support both popup-close polling and an explicit completion signal.

Environment

Observed in the CAS popup flow in the web client code path.

Start in apps/meteor/client/lib/openCASLoginPopup.ts by reading waitForPopupClose() and openCASLoginPopup(), then trace the CAS popup flow and any existing tests or completion signals. Done means the login promise cannot remain pending indefinitely and the flow finishes or fails with a clear bounded outcome.