@acl-identity/react 0.1.0

package/.turbo/turbo-build.log

@@ -0,0 +1,82 @@
+
+> @acl-identity/react@0.1.0 build /Users/lanreyusuf/Developer/personal/acl-identity-sdk/packages/react
+> tsup
+
+▲ [WARNING] The condition "types" here will never be used as it comes after both "import" and "require" [package.json]
+
+    package.json:13:6:
+      13 │       "types": "./dist/index.d.ts"
+         ╵       ~~~~~~~
+
+  The "import" condition comes earlier and will be used for all "import" statements:
+
+    package.json:11:6:
+      11 │       "import": "./dist/index.js",
+         ╵       ~~~~~~~~
+
+  The "require" condition comes earlier and will be used for all "require" calls:
+
+    package.json:12:6:
+      12 │       "require": "./dist/index.cjs",
+         ╵       ~~~~~~~~~
+
+CLI Building entry: {"index":"src/index.ts"}
+CLI Using tsconfig: tsconfig.json
+CLI tsup v8.5.1
+CLI Using tsup config: /Users/lanreyusuf/Developer/personal/acl-identity-sdk/packages/react/tsup.config.ts
+CLI Target: es2020
+CLI Cleaning output folder
+ESM Build start
+CJS Build start
+
+ WARN  ▲ [WARNING] The condition "types" here will never be used as it comes after both "import" and "require" [package.json] 7:52:29 PM
+
+    package.json:13:6:
+      13 │       "types": "./dist/index.d.ts"
+         ╵       ~~~~~~~
+
+  The "import" condition comes earlier and will be used for all "import" statements:
+
+    package.json:11:6:
+      11 │       "import": "./dist/index.js",
+         ╵       ~~~~~~~~
+
+  The "require" condition comes earlier and will be used for all "require" calls:
+
+    package.json:12:6:
+      12 │       "require": "./dist/index.cjs",
+         ╵       ~~~~~~~~~
+
+
+
+
+ WARN  ▲ [WARNING] The condition "types" here will never be used as it comes after both "import" and "require" [package.json] 7:52:29 PM
+
+    package.json:13:6:
+      13 │       "types": "./dist/index.d.ts"
+         ╵       ~~~~~~~
+
+  The "import" condition comes earlier and will be used for all "import" statements:
+
+    package.json:11:6:
+      11 │       "import": "./dist/index.js",
+         ╵       ~~~~~~~~
+
+  The "require" condition comes earlier and will be used for all "require" calls:
+
+    package.json:12:6:
+      12 │       "require": "./dist/index.cjs",
+         ╵       ~~~~~~~~~
+
+
+
+ESM dist/index.mjs     7.33 KB
+ESM dist/index.mjs.map 18.09 KB
+ESM ⚡️ Build success in 78ms
+CJS dist/index.js     8.65 KB
+CJS dist/index.js.map 17.71 KB
+CJS ⚡️ Build success in 85ms
+DTS Build start
+DTS ⚡️ Build success in 440ms
+DTS dist/index.d.mts 4.58 KB
+DTS dist/index.d.ts  4.58 KB

package/dist/index.d.mts

@@ -0,0 +1,121 @@
+import * as react from 'react';
+import { ReactNode, ButtonHTMLAttributes } from 'react';
+import { ACLBrowserClient } from '@acl-identity/browser';
+export { ACLBrowserClient, ACLBrowserClientConfig } from '@acl-identity/browser';
+import { UserClaims } from '@acl-identity/types';
+export { OrgContext, UserClaims } from '@acl-identity/types';
+
+interface AuthProviderProps {
+    client: ACLBrowserClient;
+    /** OAuth2 client_id — passed to buildAuthorizationUrl and silentRenew */
+    clientId: string;
+    /** Redirect URI registered with the auth server for the main auth flow */
+    redirectUri: string;
+    /** Organization slug for multi-tenant routing */
+    orgSlug?: string;
+    /** Space-separated OAuth2 scopes. Defaults to 'openid profile email' */
+    scopes?: string;
+    /**
+     * Redirect URI for silent token renewal via hidden iframe.
+     * Must be registered with the auth server. The page at this URI
+     * must render <SilentCallbackPage />.
+     */
+    silentRedirectUri?: string;
+    /**
+     * Called after the OAuth2 redirect callback is processed.
+     * Use this to navigate the user to their intended destination.
+     */
+    onRedirectCallback?: (appState?: unknown) => void;
+    children: ReactNode;
+}
+declare function AuthProvider({ client, clientId, redirectUri, orgSlug, scopes, silentRedirectUri, onRedirectCallback, children, }: AuthProviderProps): react.JSX.Element;
+
+interface SignInOptions {
+    appState?: unknown;
+}
+interface SignOutOptions {
+    returnTo?: string;
+    revokeToken?: boolean;
+}
+interface AuthContextValue {
+    user: UserClaims | null;
+    isAuthenticated: boolean;
+    isLoading: boolean;
+    error: Error | null;
+    client: ACLBrowserClient;
+    clientId: string;
+    redirectUri: string;
+    orgSlug?: string;
+    scopes?: string;
+    signIn(options?: SignInOptions): Promise<void>;
+    signOut(options?: SignOutOptions): Promise<void>;
+    getAccessToken(): Promise<string | null>;
+    handleCallback(callbackUrl?: string): Promise<{
+        appState?: unknown;
+    }>;
+}
+
+declare function useAuth(): AuthContextValue;
+
+interface SignInButtonProps extends ButtonHTMLAttributes<HTMLButtonElement> {
+    appState?: unknown;
+}
+declare function SignInButton({ children, appState, onClick, ...props }: SignInButtonProps): react.JSX.Element;
+interface SignOutButtonProps extends ButtonHTMLAttributes<HTMLButtonElement> {
+    returnTo?: string;
+    revokeToken?: boolean;
+}
+declare function SignOutButton({ children, returnTo, revokeToken, onClick, ...props }: SignOutButtonProps): react.JSX.Element;
+
+interface CallbackHandlerProps {
+    /** Called after tokens are stored and auth state is updated. Use this to navigate away. */
+    onSuccess?: (appState?: unknown) => void;
+    /** Called if the code exchange fails. */
+    onError?: (error: Error) => void;
+    /** Rendered while the code exchange is in progress. */
+    loading?: React.ReactNode;
+}
+/**
+ * Place this component on the route that matches your `redirectUri`.
+ * It reads the `?code=` and `?state=` from the URL, exchanges them for
+ * tokens, then calls `onSuccess`. The URL is cleaned up automatically.
+ *
+ * @example
+ * // app/callback/page.tsx
+ * 'use client';
+ * import { CallbackHandler } from '@acl-identity/react';
+ * import { useRouter } from 'next/navigation';
+ *
+ * export default function CallbackPage() {
+ *   const router = useRouter();
+ *   return (
+ *     <CallbackHandler
+ *       onSuccess={(appState) => router.replace(appState?.returnTo ?? '/dashboard')}
+ *       onError={() => router.replace('/login?error=callback_failed')}
+ *     />
+ *   );
+ * }
+ */
+declare function CallbackHandler({ onSuccess, onError, loading }: CallbackHandlerProps): react.JSX.Element;
+
+/**
+ * Render this component (and nothing else) at the route matching your
+ * `silentRedirectUri`. It posts the current URL back to the parent window
+ * so the hidden iframe used by silent renew can complete the token exchange.
+ *
+ * The route must be registered as an allowed redirect URI on your OAuth client.
+ *
+ * @example
+ * // app/silent-callback/page.tsx  (Next.js App Router)
+ * 'use client';
+ * import { SilentCallbackPage } from '@acl-identity/react';
+ * export default SilentCallbackPage;
+ *
+ * @example
+ * // pages/silent-callback.tsx  (Next.js Pages Router)
+ * import { SilentCallbackPage } from '@acl-identity/react';
+ * export default SilentCallbackPage;
+ */
+declare function SilentCallbackPage(): null;
+
+export { type AuthContextValue, AuthProvider, type AuthProviderProps, CallbackHandler, type CallbackHandlerProps, SignInButton, type SignInButtonProps, type SignInOptions, SignOutButton, type SignOutButtonProps, type SignOutOptions, SilentCallbackPage, useAuth };

package/dist/index.d.ts

@@ -0,0 +1,121 @@
+import * as react from 'react';
+import { ReactNode, ButtonHTMLAttributes } from 'react';
+import { ACLBrowserClient } from '@acl-identity/browser';
+export { ACLBrowserClient, ACLBrowserClientConfig } from '@acl-identity/browser';
+import { UserClaims } from '@acl-identity/types';
+export { OrgContext, UserClaims } from '@acl-identity/types';
+
+interface AuthProviderProps {
+    client: ACLBrowserClient;
+    /** OAuth2 client_id — passed to buildAuthorizationUrl and silentRenew */
+    clientId: string;
+    /** Redirect URI registered with the auth server for the main auth flow */
+    redirectUri: string;
+    /** Organization slug for multi-tenant routing */
+    orgSlug?: string;
+    /** Space-separated OAuth2 scopes. Defaults to 'openid profile email' */
+    scopes?: string;
+    /**
+     * Redirect URI for silent token renewal via hidden iframe.
+     * Must be registered with the auth server. The page at this URI
+     * must render <SilentCallbackPage />.
+     */
+    silentRedirectUri?: string;
+    /**
+     * Called after the OAuth2 redirect callback is processed.
+     * Use this to navigate the user to their intended destination.
+     */
+    onRedirectCallback?: (appState?: unknown) => void;
+    children: ReactNode;
+}
+declare function AuthProvider({ client, clientId, redirectUri, orgSlug, scopes, silentRedirectUri, onRedirectCallback, children, }: AuthProviderProps): react.JSX.Element;
+
+interface SignInOptions {
+    appState?: unknown;
+}
+interface SignOutOptions {
+    returnTo?: string;
+    revokeToken?: boolean;
+}
+interface AuthContextValue {
+    user: UserClaims | null;
+    isAuthenticated: boolean;
+    isLoading: boolean;
+    error: Error | null;
+    client: ACLBrowserClient;
+    clientId: string;
+    redirectUri: string;
+    orgSlug?: string;
+    scopes?: string;
+    signIn(options?: SignInOptions): Promise<void>;
+    signOut(options?: SignOutOptions): Promise<void>;
+    getAccessToken(): Promise<string | null>;
+    handleCallback(callbackUrl?: string): Promise<{
+        appState?: unknown;
+    }>;
+}
+
+declare function useAuth(): AuthContextValue;
+
+interface SignInButtonProps extends ButtonHTMLAttributes<HTMLButtonElement> {
+    appState?: unknown;
+}
+declare function SignInButton({ children, appState, onClick, ...props }: SignInButtonProps): react.JSX.Element;
+interface SignOutButtonProps extends ButtonHTMLAttributes<HTMLButtonElement> {
+    returnTo?: string;
+    revokeToken?: boolean;
+}
+declare function SignOutButton({ children, returnTo, revokeToken, onClick, ...props }: SignOutButtonProps): react.JSX.Element;
+
+interface CallbackHandlerProps {
+    /** Called after tokens are stored and auth state is updated. Use this to navigate away. */
+    onSuccess?: (appState?: unknown) => void;
+    /** Called if the code exchange fails. */
+    onError?: (error: Error) => void;
+    /** Rendered while the code exchange is in progress. */
+    loading?: React.ReactNode;
+}
+/**
+ * Place this component on the route that matches your `redirectUri`.
+ * It reads the `?code=` and `?state=` from the URL, exchanges them for
+ * tokens, then calls `onSuccess`. The URL is cleaned up automatically.
+ *
+ * @example
+ * // app/callback/page.tsx
+ * 'use client';
+ * import { CallbackHandler } from '@acl-identity/react';
+ * import { useRouter } from 'next/navigation';
+ *
+ * export default function CallbackPage() {
+ *   const router = useRouter();
+ *   return (
+ *     <CallbackHandler
+ *       onSuccess={(appState) => router.replace(appState?.returnTo ?? '/dashboard')}
+ *       onError={() => router.replace('/login?error=callback_failed')}
+ *     />
+ *   );
+ * }
+ */
+declare function CallbackHandler({ onSuccess, onError, loading }: CallbackHandlerProps): react.JSX.Element;
+
+/**
+ * Render this component (and nothing else) at the route matching your
+ * `silentRedirectUri`. It posts the current URL back to the parent window
+ * so the hidden iframe used by silent renew can complete the token exchange.
+ *
+ * The route must be registered as an allowed redirect URI on your OAuth client.
+ *
+ * @example
+ * // app/silent-callback/page.tsx  (Next.js App Router)
+ * 'use client';
+ * import { SilentCallbackPage } from '@acl-identity/react';
+ * export default SilentCallbackPage;
+ *
+ * @example
+ * // pages/silent-callback.tsx  (Next.js Pages Router)
+ * import { SilentCallbackPage } from '@acl-identity/react';
+ * export default SilentCallbackPage;
+ */
+declare function SilentCallbackPage(): null;
+
+export { type AuthContextValue, AuthProvider, type AuthProviderProps, CallbackHandler, type CallbackHandlerProps, SignInButton, type SignInButtonProps, type SignInOptions, SignOutButton, type SignOutButtonProps, type SignOutOptions, SilentCallbackPage, useAuth };

package/dist/index.js

@@ -0,0 +1,252 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }// src/provider.tsx
+
+
+
+
+
+var _react = require('react');
+var _core = require('@acl-identity/core');
+
+// src/context.ts
+
+var AuthContext = _react.createContext.call(void 0, null);
+
+// src/provider.tsx
+var _jsxruntime = require('react/jsx-runtime');
+var PKCE_KEY_PREFIX = "acl:pkce:";
+function AuthProvider({
+  client,
+  clientId,
+  redirectUri,
+  orgSlug,
+  scopes,
+  silentRedirectUri,
+  onRedirectCallback,
+  children
+}) {
+  const [state, setState] = _react.useState.call(void 0, {
+    user: null,
+    isAuthenticated: false,
+    isLoading: true,
+    error: null
+  });
+  const initialized = _react.useRef.call(void 0, false);
+  const syncAuthState = _react.useCallback.call(void 0, async () => {
+    const [user, isAuthenticated] = await Promise.all([
+      client.auth.parseCurrentUser(),
+      client.auth.isAuthenticated()
+    ]);
+    setState({ user, isAuthenticated, isLoading: false, error: null });
+  }, [client]);
+  const handleSilentRenew = _react.useCallback.call(void 0, async () => {
+    if (!silentRedirectUri) {
+      setState((s) => ({ ...s, isLoading: false }));
+      return;
+    }
+    try {
+      await client.auth.silentRenew(silentRedirectUri, clientId, { orgSlug, scope: scopes });
+      await syncAuthState();
+    } catch (e2) {
+      setState({ user: null, isAuthenticated: false, isLoading: false, error: null });
+    }
+  }, [client, silentRedirectUri, clientId, orgSlug, scopes, syncAuthState]);
+  _react.useEffect.call(void 0, () => {
+    if (initialized.current) return;
+    initialized.current = true;
+    const url = new URL(window.location.href);
+    const isCallbackUrl = url.searchParams.has("code") && url.searchParams.has("state");
+    if (isCallbackUrl) {
+      return;
+    }
+    client.auth.isAuthenticated().then((isAuth) => {
+      if (isAuth) {
+        syncAuthState();
+      } else {
+        handleSilentRenew();
+      }
+    });
+  }, []);
+  _react.useEffect.call(void 0, () => {
+    if (!state.user || !silentRedirectUri) return;
+    let timer;
+    client.auth.getAccessToken().then((token) => {
+      if (!token) return;
+      const expiresAtMs = _core.tokenExpiresAt.call(void 0, token);
+      if (!expiresAtMs) return;
+      const msUntilRenew = expiresAtMs - Date.now() - 3e4;
+      if (msUntilRenew <= 0) {
+        handleSilentRenew();
+        return;
+      }
+      timer = setTimeout(handleSilentRenew, msUntilRenew);
+    });
+    return () => clearTimeout(timer);
+  }, [state.user, silentRedirectUri, handleSilentRenew, client]);
+  const signIn = _react.useCallback.call(void 0, 
+    async (options) => {
+      const { url, state: authState, codeVerifier } = await client.auth.buildAuthorizationUrl({
+        clientId,
+        redirectUri,
+        orgSlug,
+        scope: scopes
+      });
+      sessionStorage.setItem(
+        `${PKCE_KEY_PREFIX}${authState}`,
+        JSON.stringify({ codeVerifier, appState: _nullishCoalesce(_optionalChain([options, 'optionalAccess', _ => _.appState]), () => ( null)) })
+      );
+      window.location.href = url;
+    },
+    [client, clientId, redirectUri, orgSlug, scopes]
+  );
+  const signOut = _react.useCallback.call(void 0, 
+    async (options) => {
+      await client.auth.logout({ revokeToken: _optionalChain([options, 'optionalAccess', _2 => _2.revokeToken]) });
+      setState({ user: null, isAuthenticated: false, isLoading: false, error: null });
+      if (_optionalChain([options, 'optionalAccess', _3 => _3.returnTo])) {
+        window.location.href = options.returnTo;
+      }
+    },
+    [client]
+  );
+  const getAccessToken = _react.useCallback.call(void 0, () => client.auth.getAccessToken(), [client]);
+  const handleCallback = _react.useCallback.call(void 0, 
+    async (callbackUrl) => {
+      const url = new URL(_nullishCoalesce(callbackUrl, () => ( window.location.href)));
+      const error = url.searchParams.get("error");
+      if (error) {
+        const desc = _nullishCoalesce(url.searchParams.get("error_description"), () => ( error));
+        const err = new Error(desc);
+        setState((s) => ({ ...s, error: err, isLoading: false }));
+        throw err;
+      }
+      const code = url.searchParams.get("code");
+      const authState = url.searchParams.get("state");
+      if (!code || !authState) {
+        const err = new Error("Missing code or state in callback URL");
+        setState((s) => ({ ...s, error: err, isLoading: false }));
+        throw err;
+      }
+      const stored = sessionStorage.getItem(`${PKCE_KEY_PREFIX}${authState}`);
+      if (!stored) {
+        const err = new Error("Auth session expired or state mismatch. Please sign in again.");
+        setState((s) => ({ ...s, error: err, isLoading: false }));
+        throw err;
+      }
+      const { codeVerifier, appState } = JSON.parse(stored);
+      sessionStorage.removeItem(`${PKCE_KEY_PREFIX}${authState}`);
+      await client.auth.exchangeCode(code, codeVerifier, redirectUri);
+      await syncAuthState();
+      _optionalChain([onRedirectCallback, 'optionalCall', _4 => _4(appState)]);
+      return { appState };
+    },
+    [client, redirectUri, syncAuthState, onRedirectCallback]
+  );
+  return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, 
+    AuthContext.Provider,
+    {
+      value: {
+        ...state,
+        client,
+        clientId,
+        redirectUri,
+        orgSlug,
+        scopes,
+        signIn,
+        signOut,
+        getAccessToken,
+        handleCallback
+      },
+      children
+    }
+  );
+}
+
+// src/hooks/use-auth.ts
+
+function useAuth() {
+  const ctx = _react.useContext.call(void 0, AuthContext);
+  if (!ctx) {
+    throw new Error(
+      "useAuth must be used within an <AuthProvider>. Wrap your app (or the relevant subtree) with <AuthProvider client={...} clientId={...} redirectUri={...} />."
+    );
+  }
+  return ctx;
+}
+
+// src/components/sign-in-button.tsx
+
+function SignInButton({ children = "Sign in", appState, onClick, ...props }) {
+  const { signIn } = useAuth();
+  const handleClick = (e) => {
+    _optionalChain([onClick, 'optionalCall', _5 => _5(e)]);
+    if (!e.defaultPrevented) {
+      signIn({ appState });
+    }
+  };
+  return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "button", { type: "button", onClick: handleClick, ...props, children });
+}
+function SignOutButton({
+  children = "Sign out",
+  returnTo,
+  revokeToken,
+  onClick,
+  ...props
+}) {
+  const { signOut } = useAuth();
+  const handleClick = (e) => {
+    _optionalChain([onClick, 'optionalCall', _6 => _6(e)]);
+    if (!e.defaultPrevented) {
+      const options = {};
+      if (returnTo) options.returnTo = returnTo;
+      if (revokeToken !== void 0) options.revokeToken = revokeToken;
+      signOut(options);
+    }
+  };
+  return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, "button", { type: "button", onClick: handleClick, ...props, children });
+}
+
+// src/components/callback-handler.tsx
+
+
+function CallbackHandler({ onSuccess, onError, loading = null }) {
+  const { handleCallback } = useAuth();
+  const called = _react.useRef.call(void 0, false);
+  _react.useEffect.call(void 0, () => {
+    if (called.current) return;
+    called.current = true;
+    handleCallback().then(({ appState }) => {
+      window.history.replaceState({}, document.title, window.location.pathname);
+      _optionalChain([onSuccess, 'optionalCall', _7 => _7(appState)]);
+    }).catch((err) => {
+      _optionalChain([onError, 'optionalCall', _8 => _8(err)]);
+    });
+  }, []);
+  return /* @__PURE__ */ _jsxruntime.jsx.call(void 0, _jsxruntime.Fragment, { children: loading });
+}
+
+// src/components/silent-callback-page.tsx
+
+function SilentCallbackPage() {
+  _react.useEffect.call(void 0, () => {
+    if (window.parent !== window) {
+      window.parent.postMessage(
+        { type: "acl:silent_callback", url: window.location.href },
+        window.location.origin
+      );
+    }
+  }, []);
+  return null;
+}
+
+// src/index.ts
+var _browser = require('@acl-identity/browser');
+
+
+
+
+
+
+
+
+exports.ACLBrowserClient = _browser.ACLBrowserClient; exports.AuthProvider = AuthProvider; exports.CallbackHandler = CallbackHandler; exports.SignInButton = SignInButton; exports.SignOutButton = SignOutButton; exports.SilentCallbackPage = SilentCallbackPage; exports.useAuth = useAuth;
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/Users/lanreyusuf/Developer/personal/acl-identity-sdk/packages/react/dist/index.js","../src/provider.tsx","../src/context.ts","../src/hooks/use-auth.ts","../src/components/sign-in-button.tsx","../src/components/callback-handler.tsx","../src/components/silent-callback-page.tsx","../src/index.ts"],"names":["useEffect"],"mappings":"AAAA;ACAA;AACE;AACA;AACA;AACA;AAAA,8BAEK;AAEP,0CAA+B;ADA/B;AACA;AETA;AA6BO,IAAM,YAAA,EAAc,kCAAA,IAA2C,CAAA;AFjBtE;AACA;AC8LI,+CAAA;AAhKJ,IAAM,gBAAA,EAAkB,WAAA;AAEjB,SAAS,YAAA,CAAa;AAAA,EAC3B,MAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,iBAAA;AAAA,EACA,kBAAA;AAAA,EACA;AACF,CAAA,EAAsB;AACpB,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,EAAA,EAAI,6BAAA;AAAoB,IAC5C,IAAA,EAAM,IAAA;AAAA,IACN,eAAA,EAAiB,KAAA;AAAA,IACjB,SAAA,EAAW,IAAA;AAAA,IACX,KAAA,EAAO;AAAA,EACT,CAAC,CAAA;AAED,EAAA,MAAM,YAAA,EAAc,2BAAA,KAAY,CAAA;AAEhC,EAAA,MAAM,cAAA,EAAgB,gCAAA,MAAY,CAAA,EAAA,GAAY;AAC5C,IAAA,MAAM,CAAC,IAAA,EAAM,eAAe,EAAA,EAAI,MAAM,OAAA,CAAQ,GAAA,CAAI;AAAA,MAChD,MAAA,CAAO,IAAA,CAAK,gBAAA,CAAiB,CAAA;AAAA,MAC7B,MAAA,CAAO,IAAA,CAAK,eAAA,CAAgB;AAAA,IAC9B,CAAC,CAAA;AACD,IAAA,QAAA,CAAS,EAAE,IAAA,EAAM,eAAA,EAAiB,SAAA,EAAW,KAAA,EAAO,KAAA,EAAO,KAAK,CAAC,CAAA;AAAA,EACnE,CAAA,EAAG,CAAC,MAAM,CAAC,CAAA;AAEX,EAAA,MAAM,kBAAA,EAAoB,gCAAA,MAAY,CAAA,EAAA,GAAY;AAChD,IAAA,GAAA,CAAI,CAAC,iBAAA,EAAmB;AACtB,MAAA,QAAA,CAAS,CAAC,CAAA,EAAA,GAAA,CAAO,EAAE,GAAG,CAAA,EAAG,SAAA,EAAW,MAAM,CAAA,CAAE,CAAA;AAC5C,MAAA,MAAA;AAAA,IACF;AACA,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,CAAO,IAAA,CAAK,WAAA,CAAY,iBAAA,EAAmB,QAAA,EAAU,EAAE,OAAA,EAAS,KAAA,EAAO,OAAO,CAAC,CAAA;AACrF,MAAA,MAAM,aAAA,CAAc,CAAA;AAAA,IACtB,EAAA,WAAQ;AACN,MAAA,QAAA,CAAS,EAAE,IAAA,EAAM,IAAA,EAAM,eAAA,EAAiB,KAAA,EAAO,SAAA,EAAW,KAAA,EAAO,KAAA,EAAO,KAAK,CAAC,CAAA;AAAA,IAChF;AAAA,EACF,CAAA,EAAG,CAAC,MAAA,EAAQ,iBAAA,EAAmB,QAAA,EAAU,OAAA,EAAS,MAAA,EAAQ,aAAa,CAAC,CAAA;AAGxE,EAAA,8BAAA,CAAU,EAAA,GAAM;AACd,IAAA,GAAA,CAAI,WAAA,CAAY,OAAA,EAAS,MAAA;AACzB,IAAA,WAAA,CAAY,QAAA,EAAU,IAAA;AAEtB,IAAA,MAAM,IAAA,EAAM,IAAI,GAAA,CAAI,MAAA,CAAO,QAAA,CAAS,IAAI,CAAA;AACxC,IAAA,MAAM,cAAA,EAAgB,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,MAAM,EAAA,GAAK,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,OAAO,CAAA;AAElF,IAAA,GAAA,CAAI,aAAA,EAAe;AAEjB,MAAA,MAAA;AAAA,IACF;AAEA,IAAA,MAAA,CAAO,IAAA,CAAK,eAAA,CAAgB,CAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAA,GAAW;AAC7C,MAAA,GAAA,CAAI,MAAA,EAAQ;AACV,QAAA,aAAA,CAAc,CAAA;AAAA,MAChB,EAAA,KAAO;AACL,QAAA,iBAAA,CAAkB,CAAA;AAAA,MACpB;AAAA,IACF,CAAC,CAAA;AAAA,EACH,CAAA,EAAG,CAAC,CAAC,CAAA;AAGL,EAAA,8BAAA,CAAU,EAAA,GAAM;AACd,IAAA,GAAA,CAAI,CAAC,KAAA,CAAM,KAAA,GAAQ,CAAC,iBAAA,EAAmB,MAAA;AAEvC,IAAA,IAAI,KAAA;AAEJ,IAAA,MAAA,CAAO,IAAA,CAAK,cAAA,CAAe,CAAA,CAAE,IAAA,CAAK,CAAC,KAAA,EAAA,GAAU;AAC3C,MAAA,GAAA,CAAI,CAAC,KAAA,EAAO,MAAA;AACZ,MAAA,MAAM,YAAA,EAAc,kCAAA,KAAoB,CAAA;AACxC,MAAA,GAAA,CAAI,CAAC,WAAA,EAAa,MAAA;AAElB,MAAA,MAAM,aAAA,EAAe,YAAA,EAAc,IAAA,CAAK,GAAA,CAAI,EAAA,EAAI,GAAA;AAChD,MAAA,GAAA,CAAI,aAAA,GAAgB,CAAA,EAAG;AACrB,QAAA,iBAAA,CAAkB,CAAA;AAClB,QAAA,MAAA;AAAA,MACF;AACA,MAAA,MAAA,EAAQ,UAAA,CAAW,iBAAA,EAAmB,YAAY,CAAA;AAAA,IACpD,CAAC,CAAA;AAED,IAAA,OAAO,CAAA,EAAA,GAAM,YAAA,CAAa,KAAK,CAAA;AAAA,EACjC,CAAA,EAAG,CAAC,KAAA,CAAM,IAAA,EAAM,iBAAA,EAAmB,iBAAA,EAAmB,MAAM,CAAC,CAAA;AAE7D,EAAA,MAAM,OAAA,EAAS,gCAAA;AAAA,IACb,MAAA,CAAO,OAAA,EAAA,GAA4B;AACjC,MAAA,MAAM,EAAE,GAAA,EAAK,KAAA,EAAO,SAAA,EAAW,aAAa,EAAA,EAAI,MAAM,MAAA,CAAO,IAAA,CAAK,qBAAA,CAAsB;AAAA,QACtF,QAAA;AAAA,QACA,WAAA;AAAA,QACA,OAAA;AAAA,QACA,KAAA,EAAO;AAAA,MACT,CAAC,CAAA;AACD,MAAA,cAAA,CAAe,OAAA;AAAA,QACb,CAAA,EAAA;AACA,QAAA;AACF,MAAA;AACA,MAAA;AACF,IAAA;AACC,IAAA;AACH,EAAA;AAEM,EAAA;AACJ,IAAA;AACE,MAAA;AACA,MAAA;AACA,MAAA;AACE,QAAA;AACF,MAAA;AACF,IAAA;AACC,IAAA;AACH,EAAA;AAEM,EAAA;AAEA,EAAA;AACJ,IAAA;AACE,MAAA;AACA,MAAA;AAEA,MAAA;AACE,QAAA;AACA,QAAA;AACA,QAAA;AACA,QAAA;AACF,MAAA;AAEA,MAAA;AACA,MAAA;AAEA,MAAA;AACE,QAAA;AACA,QAAA;AACA,QAAA;AACF,MAAA;AAEA,MAAA;AACA,MAAA;AACE,QAAA;AACA,QAAA;AACA,QAAA;AACF,MAAA;AAEA,MAAA;AAIA,MAAA;AAEA,MAAA;AACA,MAAA;AAEA,sBAAA;AACA,MAAA;AACF,IAAA;AACC,IAAA;AACH,EAAA;AAGE,EAAA;AAAC,IAAA;AAAA,IAAA;AACC,MAAA;AACE,QAAA;AACA,QAAA;AACA,QAAA;AACA,QAAA;AACA,QAAA;AACA,QAAA;AACA,QAAA;AACA,QAAA;AACA,QAAA;AACA,QAAA;AACF,MAAA;AAEC,MAAA;AAAA,IAAA;AACH,EAAA;AAEJ;AD1DS;AACA;AGnKA;AAGO;AACR,EAAA;AACD,EAAA;AACH,IAAA;AACE,MAAA;AAEF,IAAA;AACF,EAAA;AACO,EAAA;AACT;AHkKS;AACA;AI5JL;AAXY;AACR,EAAA;AAEA,EAAA;AACJ,oBAAA;AACK,IAAA;AACH,MAAA;AACF,IAAA;AACF,EAAA;AAGE,EAAA;AAIJ;AAOgB;AACd,EAAA;AACA,EAAA;AACA,EAAA;AACA,EAAA;AACG,EAAA;AACkB;AACf,EAAA;AAEA,EAAA;AACJ,oBAAA;AACK,IAAA;AACH,MAAA;AACA,MAAA;AACA,MAAA;AACA,MAAA;AACF,IAAA;AACF,EAAA;AAGE,EAAA;AAIJ;AJwJS;AACA;AK/MA;AAmDA;AAlBO;AACR,EAAA;AACA,EAAA;AAENA,EAAAA;AACM,IAAA;AACJ,IAAA;AAEA,IAAA;AAEI,MAAA;AACA,sBAAA;AAED,IAAA;AACC,sBAAA;AACD,IAAA;AACA,EAAA;AAEE,EAAA;AACT;AL6KS;AACA;AMlOA;AAoBO;AACdA,EAAAA;AACM,IAAA;AACF,MAAA;AACE,QAAA;AACA,QAAA;AACF,MAAA;AACF,IAAA;AACG,EAAA;AAEE,EAAA;AACT;ANgNS;AACA;AOhOA;APkOA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA","file":"/Users/lanreyusuf/Developer/personal/acl-identity-sdk/packages/react/dist/index.js","sourcesContent":[null,"import {\n  useCallback,\n  useEffect,\n  useRef,\n  useState,\n  type ReactNode,\n} from 'react';\nimport type { ACLBrowserClient } from '@acl-identity/browser';\nimport { tokenExpiresAt } from '@acl-identity/core';\nimport type { UserClaims } from '@acl-identity/types';\nimport { AuthContext, type SignInOptions, type SignOutOptions } from './context';\n\nexport interface AuthProviderProps {\n  client: ACLBrowserClient;\n  /** OAuth2 client_id — passed to buildAuthorizationUrl and silentRenew */\n  clientId: string;\n  /** Redirect URI registered with the auth server for the main auth flow */\n  redirectUri: string;\n  /** Organization slug for multi-tenant routing */\n  orgSlug?: string;\n  /** Space-separated OAuth2 scopes. Defaults to 'openid profile email' */\n  scopes?: string;\n  /**\n   * Redirect URI for silent token renewal via hidden iframe.\n   * Must be registered with the auth server. The page at this URI\n   * must render <SilentCallbackPage />.\n   */\n  silentRedirectUri?: string;\n  /**\n   * Called after the OAuth2 redirect callback is processed.\n   * Use this to navigate the user to their intended destination.\n   */\n  onRedirectCallback?: (appState?: unknown) => void;\n  children: ReactNode;\n}\n\ninterface AuthState {\n  user: UserClaims | null;\n  isAuthenticated: boolean;\n  isLoading: boolean;\n  error: Error | null;\n}\n\nconst PKCE_KEY_PREFIX = 'acl:pkce:';\n\nexport function AuthProvider({\n  client,\n  clientId,\n  redirectUri,\n  orgSlug,\n  scopes,\n  silentRedirectUri,\n  onRedirectCallback,\n  children,\n}: AuthProviderProps) {\n  const [state, setState] = useState<AuthState>({\n    user: null,\n    isAuthenticated: false,\n    isLoading: true,\n    error: null,\n  });\n\n  const initialized = useRef(false);\n\n  const syncAuthState = useCallback(async () => {\n    const [user, isAuthenticated] = await Promise.all([\n      client.auth.parseCurrentUser(),\n      client.auth.isAuthenticated(),\n    ]);\n    setState({ user, isAuthenticated, isLoading: false, error: null });\n  }, [client]);\n\n  const handleSilentRenew = useCallback(async () => {\n    if (!silentRedirectUri) {\n      setState((s) => ({ ...s, isLoading: false }));\n      return;\n    }\n    try {\n      await client.auth.silentRenew(silentRedirectUri, clientId, { orgSlug, scope: scopes });\n      await syncAuthState();\n    } catch {\n      setState({ user: null, isAuthenticated: false, isLoading: false, error: null });\n    }\n  }, [client, silentRedirectUri, clientId, orgSlug, scopes, syncAuthState]);\n\n  // Initial session check — runs once on mount\n  useEffect(() => {\n    if (initialized.current) return;\n    initialized.current = true;\n\n    const url = new URL(window.location.href);\n    const isCallbackUrl = url.searchParams.has('code') && url.searchParams.has('state');\n\n    if (isCallbackUrl) {\n      // Stay loading while CallbackHandler processes the code exchange\n      return;\n    }\n\n    client.auth.isAuthenticated().then((isAuth) => {\n      if (isAuth) {\n        syncAuthState();\n      } else {\n        handleSilentRenew();\n      }\n    });\n  }, []); // eslint-disable-line react-hooks/exhaustive-deps\n\n  // Schedule proactive silent renew before the current token expires\n  useEffect(() => {\n    if (!state.user || !silentRedirectUri) return;\n\n    let timer: ReturnType<typeof setTimeout>;\n\n    client.auth.getAccessToken().then((token) => {\n      if (!token) return;\n      const expiresAtMs = tokenExpiresAt(token);\n      if (!expiresAtMs) return;\n\n      const msUntilRenew = expiresAtMs - Date.now() - 30_000;\n      if (msUntilRenew <= 0) {\n        handleSilentRenew();\n        return;\n      }\n      timer = setTimeout(handleSilentRenew, msUntilRenew);\n    });\n\n    return () => clearTimeout(timer);\n  }, [state.user, silentRedirectUri, handleSilentRenew, client]);\n\n  const signIn = useCallback(\n    async (options?: SignInOptions) => {\n      const { url, state: authState, codeVerifier } = await client.auth.buildAuthorizationUrl({\n        clientId,\n        redirectUri,\n        orgSlug,\n        scope: scopes,\n      });\n      sessionStorage.setItem(\n        `${PKCE_KEY_PREFIX}${authState}`,\n        JSON.stringify({ codeVerifier, appState: options?.appState ?? null })\n      );\n      window.location.href = url;\n    },\n    [client, clientId, redirectUri, orgSlug, scopes]\n  );\n\n  const signOut = useCallback(\n    async (options?: SignOutOptions) => {\n      await client.auth.logout({ revokeToken: options?.revokeToken });\n      setState({ user: null, isAuthenticated: false, isLoading: false, error: null });\n      if (options?.returnTo) {\n        window.location.href = options.returnTo;\n      }\n    },\n    [client]\n  );\n\n  const getAccessToken = useCallback(() => client.auth.getAccessToken(), [client]);\n\n  const handleCallback = useCallback(\n    async (callbackUrl?: string): Promise<{ appState?: unknown }> => {\n      const url = new URL(callbackUrl ?? window.location.href);\n      const error = url.searchParams.get('error');\n\n      if (error) {\n        const desc = url.searchParams.get('error_description') ?? error;\n        const err = new Error(desc);\n        setState((s) => ({ ...s, error: err, isLoading: false }));\n        throw err;\n      }\n\n      const code = url.searchParams.get('code');\n      const authState = url.searchParams.get('state');\n\n      if (!code || !authState) {\n        const err = new Error('Missing code or state in callback URL');\n        setState((s) => ({ ...s, error: err, isLoading: false }));\n        throw err;\n      }\n\n      const stored = sessionStorage.getItem(`${PKCE_KEY_PREFIX}${authState}`);\n      if (!stored) {\n        const err = new Error('Auth session expired or state mismatch. Please sign in again.');\n        setState((s) => ({ ...s, error: err, isLoading: false }));\n        throw err;\n      }\n\n      const { codeVerifier, appState } = JSON.parse(stored) as {\n        codeVerifier: string;\n        appState?: unknown;\n      };\n      sessionStorage.removeItem(`${PKCE_KEY_PREFIX}${authState}`);\n\n      await client.auth.exchangeCode(code, codeVerifier, redirectUri);\n      await syncAuthState();\n\n      onRedirectCallback?.(appState);\n      return { appState };\n    },\n    [client, redirectUri, syncAuthState, onRedirectCallback]\n  );\n\n  return (\n    <AuthContext.Provider\n      value={{\n        ...state,\n        client,\n        clientId,\n        redirectUri,\n        orgSlug,\n        scopes,\n        signIn,\n        signOut,\n        getAccessToken,\n        handleCallback,\n      }}\n    >\n      {children}\n    </AuthContext.Provider>\n  );\n}\n","import { createContext } from 'react';\nimport type { ACLBrowserClient } from '@acl-identity/browser';\nimport type { UserClaims } from '@acl-identity/types';\n\nexport interface SignInOptions {\n  appState?: unknown;\n}\n\nexport interface SignOutOptions {\n  returnTo?: string;\n  revokeToken?: boolean;\n}\n\nexport interface AuthContextValue {\n  user: UserClaims | null;\n  isAuthenticated: boolean;\n  isLoading: boolean;\n  error: Error | null;\n  client: ACLBrowserClient;\n  clientId: string;\n  redirectUri: string;\n  orgSlug?: string;\n  scopes?: string;\n  signIn(options?: SignInOptions): Promise<void>;\n  signOut(options?: SignOutOptions): Promise<void>;\n  getAccessToken(): Promise<string | null>;\n  handleCallback(callbackUrl?: string): Promise<{ appState?: unknown }>;\n}\n\nexport const AuthContext = createContext<AuthContextValue | null>(null);\n","import { useContext } from 'react';\nimport { AuthContext, type AuthContextValue } from '../context';\n\nexport function useAuth(): AuthContextValue {\n  const ctx = useContext(AuthContext);\n  if (!ctx) {\n    throw new Error(\n      'useAuth must be used within an <AuthProvider>. ' +\n        'Wrap your app (or the relevant subtree) with <AuthProvider client={...} clientId={...} redirectUri={...} />.'\n    );\n  }\n  return ctx;\n}\n","import { type ButtonHTMLAttributes } from 'react';\nimport { useAuth } from '../hooks/use-auth';\nimport type { SignOutOptions } from '../context';\n\nexport interface SignInButtonProps extends ButtonHTMLAttributes<HTMLButtonElement> {\n  appState?: unknown;\n}\n\nexport function SignInButton({ children = 'Sign in', appState, onClick, ...props }: SignInButtonProps) {\n  const { signIn } = useAuth();\n\n  const handleClick = (e: React.MouseEvent<HTMLButtonElement>) => {\n    onClick?.(e);\n    if (!e.defaultPrevented) {\n      signIn({ appState });\n    }\n  };\n\n  return (\n    <button type=\"button\" onClick={handleClick} {...props}>\n      {children}\n    </button>\n  );\n}\n\nexport interface SignOutButtonProps extends ButtonHTMLAttributes<HTMLButtonElement> {\n  returnTo?: string;\n  revokeToken?: boolean;\n}\n\nexport function SignOutButton({\n  children = 'Sign out',\n  returnTo,\n  revokeToken,\n  onClick,\n  ...props\n}: SignOutButtonProps) {\n  const { signOut } = useAuth();\n\n  const handleClick = (e: React.MouseEvent<HTMLButtonElement>) => {\n    onClick?.(e);\n    if (!e.defaultPrevented) {\n      const options: SignOutOptions = {};\n      if (returnTo) options.returnTo = returnTo;\n      if (revokeToken !== undefined) options.revokeToken = revokeToken;\n      signOut(options);\n    }\n  };\n\n  return (\n    <button type=\"button\" onClick={handleClick} {...props}>\n      {children}\n    </button>\n  );\n}\n","import { useEffect, useRef } from 'react';\nimport { useAuth } from '../hooks/use-auth';\n\nexport interface CallbackHandlerProps {\n  /** Called after tokens are stored and auth state is updated. Use this to navigate away. */\n  onSuccess?: (appState?: unknown) => void;\n  /** Called if the code exchange fails. */\n  onError?: (error: Error) => void;\n  /** Rendered while the code exchange is in progress. */\n  loading?: React.ReactNode;\n}\n\n/**\n * Place this component on the route that matches your `redirectUri`.\n * It reads the `?code=` and `?state=` from the URL, exchanges them for\n * tokens, then calls `onSuccess`. The URL is cleaned up automatically.\n *\n * @example\n * // app/callback/page.tsx\n * 'use client';\n * import { CallbackHandler } from '@acl-identity/react';\n * import { useRouter } from 'next/navigation';\n *\n * export default function CallbackPage() {\n *   const router = useRouter();\n *   return (\n *     <CallbackHandler\n *       onSuccess={(appState) => router.replace(appState?.returnTo ?? '/dashboard')}\n *       onError={() => router.replace('/login?error=callback_failed')}\n *     />\n *   );\n * }\n */\nexport function CallbackHandler({ onSuccess, onError, loading = null }: CallbackHandlerProps) {\n  const { handleCallback } = useAuth();\n  const called = useRef(false);\n\n  useEffect(() => {\n    if (called.current) return;\n    called.current = true;\n\n    handleCallback()\n      .then(({ appState }) => {\n        window.history.replaceState({}, document.title, window.location.pathname);\n        onSuccess?.(appState);\n      })\n      .catch((err: Error) => {\n        onError?.(err);\n      });\n  }, []); // eslint-disable-line react-hooks/exhaustive-deps\n\n  return <>{loading}</>;\n}\n","import { useEffect } from 'react';\n\n/**\n * Render this component (and nothing else) at the route matching your\n * `silentRedirectUri`. It posts the current URL back to the parent window\n * so the hidden iframe used by silent renew can complete the token exchange.\n *\n * The route must be registered as an allowed redirect URI on your OAuth client.\n *\n * @example\n * // app/silent-callback/page.tsx  (Next.js App Router)\n * 'use client';\n * import { SilentCallbackPage } from '@acl-identity/react';\n * export default SilentCallbackPage;\n *\n * @example\n * // pages/silent-callback.tsx  (Next.js Pages Router)\n * import { SilentCallbackPage } from '@acl-identity/react';\n * export default SilentCallbackPage;\n */\nexport function SilentCallbackPage() {\n  useEffect(() => {\n    if (window.parent !== window) {\n      window.parent.postMessage(\n        { type: 'acl:silent_callback', url: window.location.href },\n        window.location.origin\n      );\n    }\n  }, []);\n\n  return null;\n}\n","export { AuthProvider } from './provider';\nexport type { AuthProviderProps } from './provider';\n\nexport { useAuth } from './hooks/use-auth';\n\nexport { SignInButton, SignOutButton } from './components/sign-in-button';\nexport type { SignInButtonProps, SignOutButtonProps } from './components/sign-in-button';\n\nexport { CallbackHandler } from './components/callback-handler';\nexport type { CallbackHandlerProps } from './components/callback-handler';\n\nexport { SilentCallbackPage } from './components/silent-callback-page';\n\nexport type { AuthContextValue, SignInOptions, SignOutOptions } from './context';\n\n// Re-export the browser client so consumers need only one install\nexport { ACLBrowserClient } from '@acl-identity/browser';\nexport type { ACLBrowserClientConfig } from '@acl-identity/browser';\n// Re-export useful types\nexport type { UserClaims, OrgContext } from '@acl-identity/types';\n"]}