add per-page timeout for passwordless auth

src/D2L.Bmx/OktaAuthenticator.cs

@@ -151,10 +151,20 @@ The provided Okta user '{providedLogin}' does not match the system configured pa
 	private async Task<string?> GetSessionIdFromBrowserAsync( string browserPath, Uri orgUrl ) {
 		await using var browser = await browserLauncher.LaunchAsync( browserPath );
 
-		using var cancellationTokenSource = new CancellationTokenSource( TimeSpan.FromSeconds( 15 ) );
 		var sessionIdTcs = new TaskCompletionSource<string?>( TaskCreationOptions.RunContinuationsAsynchronously );
+
+		// cancel if the total time exceeds 15 seconds, including all page loads and retries
+		using var cancellationTokenSource = new CancellationTokenSource( TimeSpan.FromSeconds( 15 ) );
 		cancellationTokenSource.Token.Register( () => sessionIdTcs.TrySetCanceled() );
 
+		// cancel if we're stuck on a single page for 3 seconds
+		using var pageTimer = new System.Timers.Timer( TimeSpan.FromSeconds( 3 ) ) { AutoReset = false };
+		pageTimer.Elapsed += ( _, _ ) => {
+			sessionIdTcs.TrySetCanceled();
+			cancellationTokenSource.Cancel();
+		};
+		pageTimer.Start();
+
 		using var page = await browser.NewPageAsync().WaitAsync( cancellationTokenSource.Token );
 		int attempt = 1;
 
@@ -163,6 +173,12 @@ The provided Okta user '{providedLogin}' does not match the system configured pa
 		return await sessionIdTcs.Task;
 
 		async Task OnPageLoadAsync() {
+			// reset on every page load, so only the last page load can trigger the timeout
+			lock( pageTimer ) {
+				pageTimer.Stop();
+				pageTimer.Start();
+			}
+
 			var url = new Uri( page.Url );
 			if( url.Host == orgUrl.Host ) {
 				string title = await page.GetTitleAsync().WaitAsync( cancellationTokenSource.Token );