@actuate-media/cms-admin 0.67.0 → 0.68.0

package/dist/views/settings/SessionPolicyCard.js.map

@@ -1 +1 @@
-{"version":3,"file":"SessionPolicyCard.js","sourceRoot":"","sources":["../../../src/views/settings/SessionPolicyCard.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,8BAA8B,EAAE,MAAM,yCAAyC,CAAA;AACxF,OAAO,EAAE,6BAA6B,EAAE,MAAM,iBAAiB,CAAA;AAC/D,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAGjE,SAAS,aAAa,CAAC,CAAS;IAC9B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;AAC1C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,EAChC,IAAI,EACJ,QAAQ,EACR,OAAO,EACP,kBAAkB,EAClB,cAAc,EACd,WAAW,EACX,WAAW,GASZ;IACC,MAAM,SAAS,GAAG,KAAK,EAAE,CAAA;IACzB,MAAM,KAAK,GAAG,KAAK,EAAE,CAAA;IACrB,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAEzD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,GAAG,EAAE,CAAC,CAAA;IAEtD,OAAO,CACL,MAAC,YAAY,IACX,SAAS,EAAE,SAAS,EACpB,KAAK,EAAC,gBAAgB,EACtB,WAAW,EAAC,2EAA2E,aAEvF,cAAK,SAAS,EAAC,WAAW,YACxB,eAAK,SAAS,EAAC,yCAAyC,aACtD,iBAAO,OAAO,EAAE,KAAK,EAAE,SAAS,EAAC,QAAQ,aACvC,eAAM,SAAS,EAAC,uCAAuC,4CAEhD,EACP,YAAG,SAAS,EAAC,sCAAsC,8GAG/C,IACE,EACR,iBACE,EAAE,EAAE,KAAK,EACT,KAAK,EAAE,IAAI,CAAC,qBAAqB,EACjC,QAAQ,EAAE,CAAC,OAAO,EAClB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAC1E,SAAS,EAAC,+MAA+M,YAExN,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CACzC,iBAAgB,KAAK,EAAE,CAAC,YACrB,aAAa,CAAC,CAAC,CAAC,IADN,CAAC,CAEL,CACV,CAAC,GACK,IACL,GACF,EAEN,eAAK,SAAS,EAAC,4CAA4C,aACzD,KAAC,SAAS,IAAC,MAAM,EAAC,MAAM,EAAC,KAAK,EAAC,uBAAuB,EAAC,KAAK,EAAE,MAAM,CAAC,cAAc,CAAC,GAAI,EACxF,KAAC,SAAS,IACR,MAAM,EAAC,MAAM,EACb,KAAK,EAAC,qBAAqB,EAC3B,KAAK,EAAE,GAAG,UAAU,OAAO,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,GACxD,EACF,KAAC,SAAS,IAAC,MAAM,EAAC,MAAM,EAAC,KAAK,EAAC,oCAAoC,EAAC,KAAK,EAAC,SAAS,GAAG,IAClF,EAEN,eAAK,SAAS,EAAC,0EAA0E,aACvF,0BACE,YAAG,SAAS,EAAC,qCAAqC,sCAA0B,EAC5E,YAAG,SAAS,EAAC,+BAA+B,6FAExC,EACH,WAAW,KAAK,MAAM,IAAI,CACzB,YAAG,SAAS,EAAC,2BAA2B,eAAW,QAAQ,wCAEvD,CACL,EACA,WAAW,KAAK,OAAO,IAAI,CAC1B,YAAG,SAAS,EAAC,+BAA+B,eAAW,QAAQ,sDAE3D,CACL,IACG,EACN,kBACE,IAAI,EAAC,QAAQ,EACb,QAAQ,EAAE,CAAC,OAAO,IAAI,WAAW,KAAK,SAAS,EAC/C,OAAO,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EACrC,SAAS,EAAC,yMAAyM,aAElN,WAAW,KAAK,SAAS,IAAI,CAC5B,KAAC,OAAO,IAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAC,cAAc,iBAAa,MAAM,GAAG,CAClE,6BAEM,IACL,EAEN,KAAC,6BAA6B,IAC5B,IAAI,EAAE,aAAa,EACnB,KAAK,EAAC,4BAA4B,EAClC,WAAW,EAAC,+IAA+I,EAC3J,YAAY,EAAC,iBAAiB,EAC9B,SAAS,EAAE,GAAG,EAAE;oBACd,gBAAgB,CAAC,KAAK,CAAC,CAAA;oBACvB,WAAW,EAAE,CAAA;gBACf,CAAC,EACD,QAAQ,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,GACvC,IACW,CAChB,CAAA;AACH,CAAC"}
+{"version":3,"file":"SessionPolicyCard.js","sourceRoot":"","sources":["../../../src/views/settings/SessionPolicyCard.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EACL,8BAA8B,EAC9B,6BAA6B,GAC9B,MAAM,yCAAyC,CAAA;AAChD,OAAO,EAAE,6BAA6B,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAClF,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAGjE,SAAS,aAAa,CAAC,CAAS;IAC9B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;AAC1C,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAA;IAChC,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,QAAQ,CAAA;IAClC,OAAO,GAAG,KAAK,QAAQ,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,EAChC,IAAI,EACJ,QAAQ,EACR,OAAO,EACP,cAAc,EACd,WAAW,EACX,WAAW,GAQZ;IACC,MAAM,SAAS,GAAG,KAAK,EAAE,CAAA;IACzB,MAAM,KAAK,GAAG,KAAK,EAAE,CAAA;IACrB,MAAM,SAAS,GAAG,KAAK,EAAE,CAAA;IACzB,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAEzD,OAAO,CACL,MAAC,YAAY,IACX,SAAS,EAAE,SAAS,EACpB,KAAK,EAAC,UAAU,EAChB,WAAW,EAAC,qFAAqF,aAEjG,eAAK,SAAS,EAAC,WAAW,aACxB,eAAK,SAAS,EAAC,yCAAyC,aACtD,iBAAO,OAAO,EAAE,SAAS,EAAE,SAAS,EAAC,QAAQ,aAC3C,eAAM,SAAS,EAAC,uCAAuC,gCAAuB,EAC9E,YAAG,SAAS,EAAC,sCAAsC,sFAE/C,IACE,EACR,iBACE,EAAE,EAAE,SAAS,EACb,KAAK,EAAE,IAAI,CAAC,YAAY,EACxB,QAAQ,EAAE,CAAC,OAAO,EAClB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EACjE,SAAS,EAAC,+MAA+M,YAExN,6BAA6B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CACxC,iBAAgB,KAAK,EAAE,CAAC,YACrB,YAAY,CAAC,CAAC,CAAC,IADL,CAAC,CAEL,CACV,CAAC,GACK,IACL,EAEN,KAAC,iBAAiB,IAChB,KAAK,EAAC,kBAAkB,EACxB,WAAW,EAAC,mEAAmE,EAC/E,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAC/B,QAAQ,EAAE,CAAC,OAAO,EAClB,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,mBAAmB,EAAE,KAAK,CAAC,GACzD,EAEF,eAAK,SAAS,EAAC,yCAAyC,aACtD,iBAAO,OAAO,EAAE,KAAK,EAAE,SAAS,EAAC,QAAQ,aACvC,eAAM,SAAS,EAAC,uCAAuC,4CAEhD,EACP,YAAG,SAAS,EAAC,sCAAsC,8GAG/C,IACE,EACR,iBACE,EAAE,EAAE,KAAK,EACT,KAAK,EAAE,IAAI,CAAC,qBAAqB,EACjC,QAAQ,EAAE,CAAC,OAAO,EAClB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAC1E,SAAS,EAAC,+MAA+M,YAExN,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CACzC,iBAAgB,KAAK,EAAE,CAAC,YACrB,aAAa,CAAC,CAAC,CAAC,IADN,CAAC,CAEL,CACV,CAAC,GACK,IACL,IACF,EAEN,eAAK,SAAS,EAAC,4CAA4C,aACzD,KAAC,SAAS,IAAC,MAAM,EAAC,MAAM,EAAC,KAAK,EAAC,uBAAuB,EAAC,KAAK,EAAE,MAAM,CAAC,cAAc,CAAC,GAAI,EACxF,KAAC,SAAS,IACR,MAAM,EAAC,MAAM,EACb,KAAK,EAAC,qBAAqB,EAC3B,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,GACtC,EACF,KAAC,SAAS,IAAC,MAAM,EAAC,MAAM,EAAC,KAAK,EAAC,oCAAoC,EAAC,KAAK,EAAC,SAAS,GAAG,IAClF,EAEN,eAAK,SAAS,EAAC,0EAA0E,aACvF,0BACE,YAAG,SAAS,EAAC,qCAAqC,sCAA0B,EAC5E,YAAG,SAAS,EAAC,+BAA+B,6FAExC,EACH,WAAW,KAAK,MAAM,IAAI,CACzB,YAAG,SAAS,EAAC,2BAA2B,eAAW,QAAQ,wCAEvD,CACL,EACA,WAAW,KAAK,OAAO,IAAI,CAC1B,YAAG,SAAS,EAAC,+BAA+B,eAAW,QAAQ,sDAE3D,CACL,IACG,EACN,kBACE,IAAI,EAAC,QAAQ,EACb,QAAQ,EAAE,CAAC,OAAO,IAAI,WAAW,KAAK,SAAS,EAC/C,OAAO,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EACrC,SAAS,EAAC,yMAAyM,aAElN,WAAW,KAAK,SAAS,IAAI,CAC5B,KAAC,OAAO,IAAC,IAAI,EAAE,EAAE,EAAE,SAAS,EAAC,cAAc,iBAAa,MAAM,GAAG,CAClE,6BAEM,IACL,EAEN,KAAC,6BAA6B,IAC5B,IAAI,EAAE,aAAa,EACnB,KAAK,EAAC,4BAA4B,EAClC,WAAW,EAAC,+IAA+I,EAC3J,YAAY,EAAC,iBAAiB,EAC9B,SAAS,EAAE,GAAG,EAAE;oBACd,gBAAgB,CAAC,KAAK,CAAC,CAAA;oBACvB,WAAW,EAAE,CAAA;gBACf,CAAC,EACD,QAAQ,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,GACvC,IACW,CAChB,CAAA;AACH,CAAC"}

package/dist/views/settings/useSecuritySettings.d.ts

@@ -5,8 +5,15 @@ export interface SecurityForm {
     mfaRequired: boolean;
     mfaGracePeriodDays: number;
     maxConcurrentSessions: number;
+    timeoutHours: number;
+    idleLogoutEnabled: boolean;
+    /** Raw textarea contents — one IP/CIDR entry per line. */
+    ipAllowlistText: string;
+    auditLoggingEnabled: boolean;
 }
 type SaveState = 'idle' | 'saving' | 'success' | 'error';
+/** Split the textarea into trimmed, de-duplicated entries (one per line). */
+export declare function parseAllowlistText(text: string): string[];
 export interface UseSecuritySettings {
     loading: boolean;
     loadError: string | null;
@@ -19,9 +26,14 @@ export interface UseSecuritySettings {
     canEdit: boolean;
     saveState: SaveState;
     saveError: string | null;
-    save: () => Promise<void>;
+    save: (options?: {
+        confirmLockout?: boolean;
+    }) => Promise<void>;
     reset: () => void;
     refetch: () => void;
+    /** Server rejected the save with IP_LOCKOUT_RISK — message to confirm. */
+    lockoutPrompt: string | null;
+    dismissLockoutPrompt: () => void;
     revokeState: 'idle' | 'working' | 'done' | 'error';
     revokeAllOtherSessions: () => Promise<number | null>;
 }

package/dist/views/settings/useSecuritySettings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useSecuritySettings.d.ts","sourceRoot":"","sources":["../../../src/views/settings/useSecuritySettings.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,kBAAkB,EAExB,MAAM,yCAAyC,CAAA;AAEhD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAE9D,yEAAyE;AACzE,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,OAAO,CAAA;IACpB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,qBAAqB,EAAE,MAAM,CAAA;CAC9B;AAED,KAAK,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAA;AAuBxD,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAC/B,IAAI,EAAE,YAAY,CAAA;IAClB,QAAQ,EAAE,CAAC,CAAC,SAAS,MAAM,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,CAAA;IAChF,KAAK,EAAE,OAAO,CAAA;IACd,MAAM,EAAE,eAAe,EAAE,CAAA;IACzB,SAAS,EAAE,OAAO,CAAA;IAClB,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,SAAS,CAAA;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IACzB,KAAK,EAAE,MAAM,IAAI,CAAA;IACjB,OAAO,EAAE,MAAM,IAAI,CAAA;IACnB,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAA;IAClD,sBAAsB,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;CACrD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,mBAAmB,CAiIzE"}
+{"version":3,"file":"useSecuritySettings.d.ts","sourceRoot":"","sources":["../../../src/views/settings/useSecuritySettings.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,kBAAkB,EAExB,MAAM,yCAAyC,CAAA;AAEhD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAE9D,yEAAyE;AACzE,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,OAAO,CAAA;IACpB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,qBAAqB,EAAE,MAAM,CAAA;IAC7B,YAAY,EAAE,MAAM,CAAA;IACpB,iBAAiB,EAAE,OAAO,CAAA;IAC1B,0DAA0D;IAC1D,eAAe,EAAE,MAAM,CAAA;IACvB,mBAAmB,EAAE,OAAO,CAAA;CAC7B;AAED,KAAK,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAA;AAYxD,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAOzD;AA6BD,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAC/B,IAAI,EAAE,YAAY,CAAA;IAClB,QAAQ,EAAE,CAAC,CAAC,SAAS,MAAM,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,CAAA;IAChF,KAAK,EAAE,OAAO,CAAA;IACd,MAAM,EAAE,eAAe,EAAE,CAAA;IACzB,SAAS,EAAE,OAAO,CAAA;IAClB,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,SAAS,CAAA;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/D,KAAK,EAAE,MAAM,IAAI,CAAA;IACjB,OAAO,EAAE,MAAM,IAAI,CAAA;IACnB,0EAA0E;IAC1E,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,oBAAoB,EAAE,MAAM,IAAI,CAAA;IAChC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAA;IAClD,sBAAsB,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;CACrD;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,mBAAmB,CAuJzE"}

package/dist/views/settings/useSecuritySettings.js

@@ -6,18 +6,44 @@ const EMPTY_FORM = {
     mfaRequired: false,
     mfaGracePeriodDays: 7,
     maxConcurrentSessions: 5,
+    timeoutHours: 168,
+    idleLogoutEnabled: false,
+    ipAllowlistText: '',
+    auditLoggingEnabled: true,
 };
+/** Split the textarea into trimmed, de-duplicated entries (one per line). */
+export function parseAllowlistText(text) {
+    const out = [];
+    for (const line of text.split('\n')) {
+        const entry = line.trim();
+        if (entry && !out.includes(entry))
+            out.push(entry);
+    }
+    return out;
+}
 function formFromSettings(s) {
     return {
         mfaRequired: s.mfa.required,
         mfaGracePeriodDays: s.mfa.gracePeriodDays,
         maxConcurrentSessions: s.session.maxConcurrentSessions,
+        timeoutHours: s.session.timeoutHours ?? 168,
+        idleLogoutEnabled: s.session.idleLogoutEnabled ?? false,
+        ipAllowlistText: (s.access?.ipAllowlist ?? []).join('\n'),
+        auditLoggingEnabled: s.access?.auditLoggingEnabled ?? true,
     };
 }
 function formToSettings(f) {
     return {
         mfa: { required: f.mfaRequired, gracePeriodDays: f.mfaGracePeriodDays },
-        session: { maxConcurrentSessions: f.maxConcurrentSessions },
+        session: {
+            maxConcurrentSessions: f.maxConcurrentSessions,
+            timeoutHours: f.timeoutHours,
+            idleLogoutEnabled: f.idleLogoutEnabled,
+        },
+        access: {
+            ipAllowlist: parseAllowlistText(f.ipAllowlistText),
+            auditLoggingEnabled: f.auditLoggingEnabled,
+        },
     };
 }
 /**
@@ -35,6 +61,7 @@ export function useSecuritySettings(canEdit) {
     const [form, setForm] = useState(EMPTY_FORM);
     const [saveState, setSaveState] = useState('idle');
     const [saveError, setSaveError] = useState(null);
+    const [lockoutPrompt, setLockoutPrompt] = useState(null);
     const [revokeState, setRevokeState] = useState('idle');
     const [reloadKey, setReloadKey] = useState(0);
     useEffect(() => {
@@ -85,18 +112,30 @@ export function useSecuritySettings(canEdit) {
         return list;
     }, [form, baseline.mfaRequired, data]);
     const hasErrors = issues.some((i) => i.severity === 'error');
-    const save = useCallback(async () => {
+    const save = useCallback(async (options) => {
         if (!canEdit || hasErrors || !dirty)
             return;
         setSaveState('saving');
         setSaveError(null);
+        setLockoutPrompt(null);
         try {
             const res = await cmsApi('/security', {
                 method: 'PUT',
-                body: JSON.stringify(formToSettings(form)),
+                body: JSON.stringify({
+                    ...formToSettings(form),
+                    ...(options?.confirmLockout ? { confirmLockout: true } : {}),
+                }),
             });
-            if (res.error || !res.data)
+            // The server's lockout guard: surface a confirm dialog instead of a
+            // generic failure so the operator can retry with confirmLockout.
+            if (res.code === 'IP_LOCKOUT_RISK') {
+                setSaveState('idle');
+                setLockoutPrompt(res.error ?? 'This allowlist may lock you out. Save anyway?');
+                return;
+            }
+            if (res.error || !res.data) {
                 throw new Error(res.error ?? 'Failed to save security settings.');
+            }
             setData(res.data);
             const f = formFromSettings(res.data.settings);
             setBaseline(f);
@@ -108,10 +147,12 @@ export function useSecuritySettings(canEdit) {
             setSaveError(err instanceof Error ? err.message : 'Failed to save security settings.');
         }
     }, [canEdit, hasErrors, dirty, form]);
+    const dismissLockoutPrompt = useCallback(() => setLockoutPrompt(null), []);
     const reset = useCallback(() => {
         setForm(baseline);
         setSaveState('idle');
         setSaveError(null);
+        setLockoutPrompt(null);
     }, [baseline]);
     const refetch = useCallback(() => setReloadKey((k) => k + 1), []);
     const revokeAllOtherSessions = useCallback(async () => {
@@ -147,6 +188,8 @@ export function useSecuritySettings(canEdit) {
         save,
         reset,
         refetch,
+        lockoutPrompt,
+        dismissLockoutPrompt,
         revokeState,
         revokeAllOtherSessions,
     };

package/dist/views/settings/useSecuritySettings.js.map

@@ -1 +1 @@
-{"version":3,"file":"useSecuritySettings.js","sourceRoot":"","sources":["../../../src/views/settings/useSecuritySettings.ts"],"names":[],"mappings":"AAAA,YAAY,CAAA;AAEZ,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AACjE,OAAO,EACL,wBAAwB,GAGzB,MAAM,yCAAyC,CAAA;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAYzC,MAAM,UAAU,GAAiB;IAC/B,WAAW,EAAE,KAAK;IAClB,kBAAkB,EAAE,CAAC;IACrB,qBAAqB,EAAE,CAAC;CACzB,CAAA;AAED,SAAS,gBAAgB,CAAC,CAAmB;IAC3C,OAAO;QACL,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ;QAC3B,kBAAkB,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe;QACzC,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB;KACvD,CAAA;AACH,CAAC;AAED,SAAS,cAAc,CAAC,CAAe;IACrC,OAAO;QACL,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC,kBAAkB,EAAE;QACvE,OAAO,EAAE,EAAE,qBAAqB,EAAE,CAAC,CAAC,qBAAqB,EAAE;KAC5D,CAAA;AACH,CAAC;AAqBD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC5C,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IAC/D,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAA4B,IAAI,CAAC,CAAA;IACjE,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAe,UAAU,CAAC,CAAA;IAClE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAe,UAAU,CAAC,CAAA;IAC1D,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAY,MAAM,CAAC,CAAA;IAC7D,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IAC/D,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAwC,MAAM,CAAC,CAAA;IAC7F,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;IAE7C,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,SAAS,GAAG,KAAK,CAAA;QACrB,UAAU,CAAC,IAAI,CAAC,CAAA;QAChB,YAAY,CAAC,IAAI,CAAC,CAAA;QAClB,MAAM,CAAqB,WAAW,CAAC;aACpC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACZ,IAAI,SAAS;gBAAE,OAAM;YACrB,IAAI,GAAG,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC3B,YAAY,CAAC,GAAG,CAAC,KAAK,IAAI,mCAAmC,CAAC,CAAA;gBAC9D,OAAM;YACR,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACjB,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC7C,WAAW,CAAC,CAAC,CAAC,CAAA;YACd,OAAO,CAAC,CAAC,CAAC,CAAA;QACZ,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE;YACV,IAAI,CAAC,SAAS;gBAAE,YAAY,CAAC,mCAAmC,CAAC,CAAA;QACnE,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,SAAS;gBAAE,UAAU,CAAC,KAAK,CAAC,CAAA;QACnC,CAAC,CAAC,CAAA;QACJ,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAA;QAClB,CAAC,CAAA;IACH,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;IAEf,MAAM,QAAQ,GAAG,WAAW,CAAC,CAA+B,GAAM,EAAE,KAAsB,EAAE,EAAE;QAC5F,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;QAC9C,YAAY,CAAC,MAAM,CAAC,CAAA;IACtB,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,MAAM,KAAK,GAAG,OAAO,CACnB,GAAG,EAAE,CAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAC3F,CAAC,IAAI,EAAE,QAAQ,CAAC,CACjB,CAAA;IAED,MAAM,MAAM,GAAG,OAAO,CAAoB,GAAG,EAAE;QAC7C,MAAM,IAAI,GAAG,wBAAwB,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAA;QAC3D,uEAAuE;QACvE,qEAAqE;QACrE,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5E,IAAI,CAAC,IAAI,CAAC;gBACR,KAAK,EAAE,aAAa;gBACpB,OAAO,EACL,2GAA2G;gBAC7G,QAAQ,EAAE,OAAO;aAClB,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAA;IAEtC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAA;IAE5D,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE;QAClC,IAAI,CAAC,OAAO,IAAI,SAAS,IAAI,CAAC,KAAK;YAAE,OAAM;QAC3C,YAAY,CAAC,QAAQ,CAAC,CAAA;QACtB,YAAY,CAAC,IAAI,CAAC,CAAA;QAClB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAqB,WAAW,EAAE;gBACxD,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;aAC3C,CAAC,CAAA;YACF,IAAI,GAAG,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,mCAAmC,CAAC,CAAA;YAC7F,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACjB,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC7C,WAAW,CAAC,CAAC,CAAC,CAAA;YACd,OAAO,CAAC,CAAC,CAAC,CAAA;YACV,YAAY,CAAC,SAAS,CAAC,CAAA;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CAAC,OAAO,CAAC,CAAA;YACrB,YAAY,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAA;QACxF,CAAC;IACH,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;IAErC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,OAAO,CAAC,QAAQ,CAAC,CAAA;QACjB,YAAY,CAAC,MAAM,CAAC,CAAA;QACpB,YAAY,CAAC,IAAI,CAAC,CAAA;IACpB,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEd,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAEjE,MAAM,sBAAsB,GAAG,WAAW,CAAC,KAAK,IAA4B,EAAE;QAC5E,cAAc,CAAC,SAAS,CAAC,CAAA;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAsB,+BAA+B,EAAE;gBAC7E,MAAM,EAAE,MAAM;aACf,CAAC,CAAA;YACF,IAAI,GAAG,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACzC,cAAc,CAAC,MAAM,CAAC,CAAA;YACtB,oCAAoC;YACpC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YAC1B,OAAO,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,CAAA;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,cAAc,CAAC,OAAO,CAAC,CAAA;YACvB,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,OAAO;QACL,OAAO;QACP,SAAS;QACT,IAAI;QACJ,IAAI;QACJ,QAAQ;QACR,KAAK;QACL,MAAM;QACN,SAAS;QACT,OAAO;QACP,SAAS;QACT,SAAS;QACT,IAAI;QACJ,KAAK;QACL,OAAO;QACP,WAAW;QACX,sBAAsB;KACvB,CAAA;AACH,CAAC"}
+{"version":3,"file":"useSecuritySettings.js","sourceRoot":"","sources":["../../../src/views/settings/useSecuritySettings.ts"],"names":[],"mappings":"AAAA,YAAY,CAAA;AAEZ,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AACjE,OAAO,EACL,wBAAwB,GAGzB,MAAM,yCAAyC,CAAA;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAiBzC,MAAM,UAAU,GAAiB;IAC/B,WAAW,EAAE,KAAK;IAClB,kBAAkB,EAAE,CAAC;IACrB,qBAAqB,EAAE,CAAC;IACxB,YAAY,EAAE,GAAG;IACjB,iBAAiB,EAAE,KAAK;IACxB,eAAe,EAAE,EAAE;IACnB,mBAAmB,EAAE,IAAI;CAC1B,CAAA;AAED,6EAA6E;AAC7E,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACzB,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACpD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAmB;IAC3C,OAAO;QACL,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ;QAC3B,kBAAkB,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe;QACzC,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB;QACtD,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,IAAI,GAAG;QAC3C,iBAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,IAAI,KAAK;QACvD,eAAe,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACzD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,mBAAmB,IAAI,IAAI;KAC3D,CAAA;AACH,CAAC;AAED,SAAS,cAAc,CAAC,CAAe;IACrC,OAAO;QACL,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC,kBAAkB,EAAE;QACvE,OAAO,EAAE;YACP,qBAAqB,EAAE,CAAC,CAAC,qBAAqB;YAC9C,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;SACvC;QACD,MAAM,EAAE;YACN,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC,eAAe,CAAC;YAClD,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;SAC3C;KACF,CAAA;AACH,CAAC;AAwBD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC5C,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IAC/D,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAA4B,IAAI,CAAC,CAAA;IACjE,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAe,UAAU,CAAC,CAAA;IAClE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAe,UAAU,CAAC,CAAA;IAC1D,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAY,MAAM,CAAC,CAAA;IAC7D,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IAC/D,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IACvE,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,QAAQ,CAAwC,MAAM,CAAC,CAAA;IAC7F,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;IAE7C,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,SAAS,GAAG,KAAK,CAAA;QACrB,UAAU,CAAC,IAAI,CAAC,CAAA;QAChB,YAAY,CAAC,IAAI,CAAC,CAAA;QAClB,MAAM,CAAqB,WAAW,CAAC;aACpC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACZ,IAAI,SAAS;gBAAE,OAAM;YACrB,IAAI,GAAG,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC3B,YAAY,CAAC,GAAG,CAAC,KAAK,IAAI,mCAAmC,CAAC,CAAA;gBAC9D,OAAM;YACR,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACjB,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC7C,WAAW,CAAC,CAAC,CAAC,CAAA;YACd,OAAO,CAAC,CAAC,CAAC,CAAA;QACZ,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE;YACV,IAAI,CAAC,SAAS;gBAAE,YAAY,CAAC,mCAAmC,CAAC,CAAA;QACnE,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,SAAS;gBAAE,UAAU,CAAC,KAAK,CAAC,CAAA;QACnC,CAAC,CAAC,CAAA;QACJ,OAAO,GAAG,EAAE;YACV,SAAS,GAAG,IAAI,CAAA;QAClB,CAAC,CAAA;IACH,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAA;IAEf,MAAM,QAAQ,GAAG,WAAW,CAAC,CAA+B,GAAM,EAAE,KAAsB,EAAE,EAAE;QAC5F,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;QAC9C,YAAY,CAAC,MAAM,CAAC,CAAA;IACtB,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,MAAM,KAAK,GAAG,OAAO,CACnB,GAAG,EAAE,CAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAC3F,CAAC,IAAI,EAAE,QAAQ,CAAC,CACjB,CAAA;IAED,MAAM,MAAM,GAAG,OAAO,CAAoB,GAAG,EAAE;QAC7C,MAAM,IAAI,GAAG,wBAAwB,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAA;QAC3D,uEAAuE;QACvE,qEAAqE;QACrE,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5E,IAAI,CAAC,IAAI,CAAC;gBACR,KAAK,EAAE,aAAa;gBACpB,OAAO,EACL,2GAA2G;gBAC7G,QAAQ,EAAE,OAAO;aAClB,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAA;IAEtC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAA;IAE5D,MAAM,IAAI,GAAG,WAAW,CACtB,KAAK,EAAE,OAAsC,EAAE,EAAE;QAC/C,IAAI,CAAC,OAAO,IAAI,SAAS,IAAI,CAAC,KAAK;YAAE,OAAM;QAC3C,YAAY,CAAC,QAAQ,CAAC,CAAA;QACtB,YAAY,CAAC,IAAI,CAAC,CAAA;QAClB,gBAAgB,CAAC,IAAI,CAAC,CAAA;QACtB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAqB,WAAW,EAAE;gBACxD,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,GAAG,cAAc,CAAC,IAAI,CAAC;oBACvB,GAAG,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC7D,CAAC;aACH,CAAC,CAAA;YACF,oEAAoE;YACpE,iEAAiE;YACjE,IAAI,GAAG,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBACnC,YAAY,CAAC,MAAM,CAAC,CAAA;gBACpB,gBAAgB,CAAC,GAAG,CAAC,KAAK,IAAI,+CAA+C,CAAC,CAAA;gBAC9E,OAAM;YACR,CAAC;YACD,IAAI,GAAG,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,mCAAmC,CAAC,CAAA;YACnE,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACjB,MAAM,CAAC,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAC7C,WAAW,CAAC,CAAC,CAAC,CAAA;YACd,OAAO,CAAC,CAAC,CAAC,CAAA;YACV,YAAY,CAAC,SAAS,CAAC,CAAA;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CAAC,OAAO,CAAC,CAAA;YACrB,YAAY,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAA;QACxF,CAAC;IACH,CAAC,EACD,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,CAClC,CAAA;IAED,MAAM,oBAAoB,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;IAE1E,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,OAAO,CAAC,QAAQ,CAAC,CAAA;QACjB,YAAY,CAAC,MAAM,CAAC,CAAA;QACpB,YAAY,CAAC,IAAI,CAAC,CAAA;QAClB,gBAAgB,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEd,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAEjE,MAAM,sBAAsB,GAAG,WAAW,CAAC,KAAK,IAA4B,EAAE;QAC5E,cAAc,CAAC,SAAS,CAAC,CAAA;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAsB,+BAA+B,EAAE;gBAC7E,MAAM,EAAE,MAAM;aACf,CAAC,CAAA;YACF,IAAI,GAAG,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YACzC,cAAc,CAAC,MAAM,CAAC,CAAA;YACtB,oCAAoC;YACpC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YAC1B,OAAO,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,CAAA;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,cAAc,CAAC,OAAO,CAAC,CAAA;YACvB,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC,EAAE,EAAE,CAAC,CAAA;IAEN,OAAO;QACL,OAAO;QACP,SAAS;QACT,IAAI;QACJ,IAAI;QACJ,QAAQ;QACR,KAAK;QACL,MAAM;QACN,SAAS;QACT,OAAO;QACP,SAAS;QACT,SAAS;QACT,IAAI;QACJ,KAAK;QACL,OAAO;QACP,aAAa;QACb,oBAAoB;QACpB,WAAW;QACX,sBAAsB;KACvB,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actuate-media/cms-admin",
-  "version": "0.67.0",
+  "version": "0.68.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/actuate-media/actuatecms.git",
@@ -95,7 +95,7 @@
     "tailwindcss": "^4.0.0",
     "typescript": "^5.7.0",
     "vitest": "^4.1.0",
-    "@actuate-media/cms-core": "0.87.0",
+    "@actuate-media/cms-core": "0.88.0",
     "@actuate-media/component-blocks": "0.2.1"
   },
   "scripts": {

package/src/AdminRoot.tsx

@@ -38,6 +38,7 @@ import { ThemeProvider } from './components/ThemeProvider.js'
 import { LocaleProvider } from './components/LocaleProvider.js'
 import { useKeyboardShortcuts } from './hooks/useKeyboardShortcuts.js'
 import { useAppearanceBootstrap } from './hooks/useAppearanceBootstrap.js'
+import { useIdleLogout } from './hooks/useIdleLogout.js'
 import { PageBuilder } from './views/page-builder/PageBuilder.js'
 import { PageSectionEditor } from './views/page-editor/PageSectionEditor.js'
 import { PagePreview } from './views/page-editor/PagePreview.js'
@@ -52,6 +53,7 @@ import { PagesListView } from './views/Pages/PagesListView.js'
 import { PageTagManager } from './views/Pages/PageTagManager.js'
 import { PostsListView } from './views/Posts/PostsListView.js'
 import { PostTypesView } from './views/Posts/PostTypesView.js'
+import { PostTypeEditor } from './views/Posts/PostTypeEditor.js'
 import { NewPostPicker } from './views/Posts/NewPostPicker.js'
 import { NewPostTypeInstructions } from './views/Posts/NewPostTypeInstructions.js'
 import { PostSectionEditor } from './views/post-editor/PostSectionEditor.js'
@@ -179,6 +181,39 @@ function AdminShell({
     [buildHref],
   )
 
+  // Idle auto-logout (Settings → Security). The policy is read from the
+  // non-admin-gated /auth/session-policy endpoint so every member's client
+  // enforces it, not just admins. When enabled, `timeoutHours` of inactivity
+  // signs the user out through the normal logout flow (server revocation +
+  // cookie clear + local state reset).
+  const [sessionPolicy, setSessionPolicy] = useState<{
+    timeoutHours: number
+    idleLogoutEnabled: boolean
+  } | null>(null)
+  useEffect(() => {
+    if (!session) {
+      setSessionPolicy(null)
+      return
+    }
+    let cancelled = false
+    void cmsApi<{ timeoutHours: number; idleLogoutEnabled: boolean }>('/auth/session-policy').then(
+      (res) => {
+        if (!cancelled && res.data && typeof res.data.timeoutHours === 'number') {
+          setSessionPolicy(res.data)
+        }
+      },
+    )
+    return () => {
+      cancelled = true
+    }
+  }, [session])
+
+  useIdleLogout({
+    enabled: Boolean(session && sessionPolicy?.idleLogoutEnabled),
+    timeoutMs: (sessionPolicy?.timeoutHours ?? 0) * 3_600_000,
+    onIdle: handleLogout,
+  })
+
   useBranding(config)
   useAppearanceBootstrap(session)
   useAdminPageTitle(config, currentPath)
@@ -358,13 +393,7 @@ function AdminShell({
     }
     const postTypeEdit = matchRoute('/posts/types/:slug/edit')
     if (postTypeEdit?.slug) {
-      // V1 falls through to the per-collection list view; future
-      // PR introduces a dedicated PostTypeEditor with field-level
-      // metadata. The list view is the natural per-type management
-      // surface today (it already shows posts in that type).
-      return (
-        <CollectionList collectionSlug={postTypeEdit.slug} config={config} onNavigate={navigate} />
-      )
+      return <PostTypeEditor slug={postTypeEdit.slug} onNavigate={navigate} />
     }
     if (matchRoute('/posts/types')) {
       return <PostTypesView onNavigate={navigate} />

package/src/__tests__/hooks/useIdleLogout.test.tsx

@@ -0,0 +1,86 @@
+// @vitest-environment happy-dom
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { render } from '@testing-library/react'
+
+import { useIdleLogout } from '../../hooks/useIdleLogout.js'
+
+function Harness({
+  enabled,
+  timeoutMs,
+  onIdle,
+}: {
+  enabled: boolean
+  timeoutMs: number
+  onIdle: () => void
+}) {
+  useIdleLogout({ enabled, timeoutMs, onIdle })
+  return null
+}
+
+const TIMEOUT_MS = 60_000
+
+beforeEach(() => {
+  vi.useFakeTimers()
+})
+
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+describe('useIdleLogout', () => {
+  it('fires onIdle exactly once after the timeout with no activity', () => {
+    const onIdle = vi.fn()
+    render(<Harness enabled timeoutMs={TIMEOUT_MS} onIdle={onIdle} />)
+
+    vi.advanceTimersByTime(TIMEOUT_MS - 1_000)
+    expect(onIdle).not.toHaveBeenCalled()
+
+    vi.advanceTimersByTime(TIMEOUT_MS)
+    expect(onIdle).toHaveBeenCalledTimes(1)
+
+    // The idle callback must not re-fire on subsequent ticks.
+    vi.advanceTimersByTime(TIMEOUT_MS * 3)
+    expect(onIdle).toHaveBeenCalledTimes(1)
+  })
+
+  it('resets the idle deadline on user activity', () => {
+    const onIdle = vi.fn()
+    render(<Harness enabled timeoutMs={TIMEOUT_MS} onIdle={onIdle} />)
+
+    // Just before the deadline the user types — the clock restarts.
+    vi.advanceTimersByTime(TIMEOUT_MS - 5_000)
+    window.dispatchEvent(new Event('keydown'))
+    vi.advanceTimersByTime(TIMEOUT_MS - 5_000)
+    expect(onIdle).not.toHaveBeenCalled()
+
+    // A full quiet timeout after the last activity signs the user out.
+    vi.advanceTimersByTime(TIMEOUT_MS)
+    expect(onIdle).toHaveBeenCalledTimes(1)
+  })
+
+  it('does nothing when disabled', () => {
+    const onIdle = vi.fn()
+    render(<Harness enabled={false} timeoutMs={TIMEOUT_MS} onIdle={onIdle} />)
+    vi.advanceTimersByTime(TIMEOUT_MS * 10)
+    expect(onIdle).not.toHaveBeenCalled()
+  })
+
+  it('tears everything down on unmount', () => {
+    const onIdle = vi.fn()
+    const { unmount } = render(<Harness enabled timeoutMs={TIMEOUT_MS} onIdle={onIdle} />)
+    unmount()
+    vi.advanceTimersByTime(TIMEOUT_MS * 10)
+    expect(onIdle).not.toHaveBeenCalled()
+  })
+
+  it('checks the deadline immediately when a hidden tab becomes visible', () => {
+    const onIdle = vi.fn()
+    render(<Harness enabled timeoutMs={TIMEOUT_MS} onIdle={onIdle} />)
+
+    // Simulate the deadline passing while the tab was hidden (the interval is
+    // shared with visibility, so freeze it by only moving the mocked clock).
+    vi.setSystemTime(Date.now() + TIMEOUT_MS + 1_000)
+    document.dispatchEvent(new Event('visibilitychange'))
+    expect(onIdle).toHaveBeenCalledTimes(1)
+  })
+})

package/src/__tests__/lib/post-types-service.test.ts

@@ -0,0 +1,112 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const cmsApiMock = vi.fn()
+vi.mock('../../lib/api.js', () => ({
+  cmsApi: (...args: unknown[]) => cmsApiMock(...args),
+}))
+
+const {
+  fetchPostTypeDetail,
+  fieldKeyFromName,
+  fieldTypeLabel,
+  humanizeFieldName,
+  renderFieldSnippet,
+} = await import('../../lib/post-types-service.js')
+
+const COLLECTIONS = [
+  {
+    slug: 'blog',
+    labels: { singular: 'Blog Post', plural: 'Blog' },
+    type: 'post',
+    urlPrefix: 'blog',
+    description: 'Long-form articles',
+    icon: 'file-text',
+    color: 'purple',
+    hidden: false,
+    fields: [
+      { name: 'title', type: 'text', required: true },
+      { name: 'body', type: 'richText', required: false },
+      { name: 'author', type: 'relationship', required: false, relationTo: 'users' },
+    ],
+  },
+]
+
+describe('fetchPostTypeDetail', () => {
+  beforeEach(() => {
+    cmsApiMock.mockReset()
+    cmsApiMock.mockResolvedValue({ data: COLLECTIONS })
+  })
+
+  it('maps the matching collection row onto PostTypeDetail', async () => {
+    const detail = await fetchPostTypeDetail('blog')
+    expect(detail).toEqual({
+      slug: 'blog',
+      singular: 'Blog Post',
+      plural: 'Blog',
+      description: 'Long-form articles',
+      urlPrefix: 'blog',
+      icon: 'file-text',
+      color: 'purple',
+      fields: COLLECTIONS[0]!.fields,
+    })
+  })
+
+  it('returns null when the slug is unknown', async () => {
+    expect(await fetchPostTypeDetail('missing')).toBeNull()
+  })
+
+  it('throws on an API error envelope', async () => {
+    cmsApiMock.mockResolvedValue({ error: 'boom' })
+    await expect(fetchPostTypeDetail('blog')).rejects.toThrow('boom')
+  })
+})
+
+describe('field name helpers', () => {
+  it('humanizes camelCase and snake_case keys', () => {
+    expect(humanizeFieldName('clientName')).toBe('Client Name')
+    expect(humanizeFieldName('meta_description')).toBe('Meta Description')
+    expect(humanizeFieldName('seo-score')).toBe('Seo Score')
+  })
+
+  it('derives camelCase keys from display names', () => {
+    expect(fieldKeyFromName('Client Name')).toBe('clientName')
+    expect(fieldKeyFromName('  Featured   Image!  ')).toBe('featuredImage')
+    expect(fieldKeyFromName('')).toBe('')
+  })
+
+  it('labels known field types and passes through unknown ones', () => {
+    expect(fieldTypeLabel('text')).toBe('Short Text')
+    expect(fieldTypeLabel('relationship')).toBe('Relation')
+    expect(fieldTypeLabel('customThing')).toBe('customThing')
+  })
+})
+
+describe('renderFieldSnippet', () => {
+  it('renders a minimal optional field', () => {
+    expect(
+      renderFieldSnippet({ key: 'subtitle', label: 'Subtitle', type: 'text', required: false }),
+    ).toBe("subtitle: { type: 'text', label: 'Subtitle' },")
+  })
+
+  it('includes required, help text, and escapes quotes', () => {
+    const snippet = renderFieldSnippet({
+      key: 'clientName',
+      label: "Client's Name",
+      type: 'text',
+      required: true,
+      helpText: "Editor's hint",
+    })
+    expect(snippet).toContain("label: 'Client\\'s Name'")
+    expect(snippet).toContain('required: true')
+    expect(snippet).toContain("admin: { description: 'Editor\\'s hint' }")
+  })
+
+  it('seeds placeholder options for select and relationTo for relationship', () => {
+    expect(
+      renderFieldSnippet({ key: 'tone', label: 'Tone', type: 'select', required: false }),
+    ).toContain("options: [{ label: 'Option A', value: 'option-a' }]")
+    expect(
+      renderFieldSnippet({ key: 'owner', label: 'Owner', type: 'relationship', required: false }),
+    ).toContain("relationTo: 'posts'")
+  })
+})

package/src/__tests__/views/collection-list-nav.render.test.tsx

@@ -3,9 +3,14 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { fireEvent, render, screen, within } from '@testing-library/react'
 
 /**
- * Regression for the post-list navigation bug: CollectionList must open
- * post-type rows in the section editor (`/posts/:type/:id/edit`), not the
- * generic `/:collection/:id` route — which 404s when the slug is `posts`.
+ * CollectionList row interactions with the inline entry detail pane
+ * (design Entries split-pane):
+ *  - row / title click toggles the 400px detail pane (no navigation)
+ *  - "Open full editor" and row double-click open the correct editor route
+ *
+ * Regression (post-list navigation bug): post-type rows must open the section
+ * editor (`/posts/:type/:id/edit`), never the generic `/:collection/:id`
+ * route — which 404s when the slug is `posts`.
  */
 
 vi.mock('../../lib/api.js', () => ({
@@ -40,17 +45,58 @@ beforeEach(() => {
   listDocs = []
 })
 
-describe('CollectionList navigation (post collection)', () => {
-  it('opens a post row in the section editor, not the generic route', () => {
+describe('CollectionList entry detail pane + navigation (post collection)', () => {
+  it('row click opens the detail pane instead of navigating', () => {
+    listDocs = [
+      {
+        id: '1',
+        title: 'Hello',
+        status: 'PUBLISHED',
+        updatedAt: '2026-06-01T00:00:00Z',
+        data: { title: 'Hello' },
+      },
+    ]
+    const onNavigate = vi.fn()
+    render(<CollectionList collectionSlug="posts" config={POST_CONFIG} onNavigate={onNavigate} />)
+
+    const titleButton = within(screen.getByRole('table')).getByRole('button', { name: 'Hello' })
+    expect(titleButton.getAttribute('aria-expanded')).toBe('false')
+    fireEvent.click(titleButton)
+
+    expect(onNavigate).not.toHaveBeenCalled()
+    expect(titleButton.getAttribute('aria-expanded')).toBe('true')
+    expect(screen.getByRole('region', { name: 'Post details' })).toBeTruthy()
+
+    // Clicking again toggles the pane closed.
+    fireEvent.click(titleButton)
+    expect(screen.queryByRole('region', { name: 'Post details' })).toBeNull()
+  })
+
+  it('"Open full editor" opens the section editor, not the generic route', () => {
     listDocs = [{ id: '1', title: 'Hello', status: 'PUBLISHED', updatedAt: '2026-06-01T00:00:00Z' }]
     const onNavigate = vi.fn()
     render(<CollectionList collectionSlug="posts" config={POST_CONFIG} onNavigate={onNavigate} />)
 
     fireEvent.click(within(screen.getByRole('table')).getByRole('button', { name: 'Hello' }))
+    fireEvent.click(screen.getByRole('button', { name: 'Open full editor' }))
+
     expect(onNavigate).toHaveBeenCalledWith('/posts/posts/1/edit')
     expect(onNavigate).not.toHaveBeenCalledWith('/posts/1')
   })
 
+  it('row double-click opens the section editor directly', () => {
+    listDocs = [{ id: '1', title: 'Hello', status: 'PUBLISHED', updatedAt: '2026-06-01T00:00:00Z' }]
+    const onNavigate = vi.fn()
+    render(<CollectionList collectionSlug="posts" config={POST_CONFIG} onNavigate={onNavigate} />)
+
+    const row = within(screen.getByRole('table'))
+      .getByRole('button', { name: 'Hello' })
+      .closest('tr')!
+    fireEvent.doubleClick(row)
+
+    expect(onNavigate).toHaveBeenCalledWith('/posts/posts/1/edit')
+  })
+
   it('starts a new post in the section editor', () => {
     const onNavigate = vi.fn()
     render(<CollectionList collectionSlug="posts" config={POST_CONFIG} onNavigate={onNavigate} />)

package/src/__tests__/views/forms-list.render.test.tsx

@@ -3,8 +3,8 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { fireEvent, render, screen, waitFor } from '@testing-library/react'
 
 // Drive the Forms list through a mocked forms-service so the test owns the
-// data and can assert filtering, search, the notify toggle, and the schema
-// drawer without a real backend.
+// data and can assert filtering, search, the notify toggle, and the inline
+// schema pane without a real backend.
 function makeForm(over: Record<string, unknown> = {}) {
   return {
     id: 'f1',
@@ -56,6 +56,7 @@ const fetchFormSchema = vi.fn(async () => ({
   activeVersionId: null,
   versions: [],
 }))
+const saveFormSchema = vi.fn(async (_id: string, _fields: unknown[]) => ({ data: {} }))
 const fetchEmbedSettings = vi.fn(async () => ({}))
 const fetchNotificationSettings = vi.fn(async () => ({ enabled: true, recipients: [] }))
 
@@ -64,7 +65,7 @@ vi.mock('../../lib/forms-service.js', () => ({
   fetchFormStats: () => fetchFormStats(),
   setNotifyEnabled: (id: string, v: boolean) => setNotifyEnabled(id, v),
   fetchFormSchema: () => fetchFormSchema(),
-  saveFormSchema: vi.fn(async () => ({ data: {} })),
+  saveFormSchema: (id: string, fields: unknown[]) => saveFormSchema(id, fields),
   fetchEmbedSettings: () => fetchEmbedSettings(),
   updateEmbedSettings: vi.fn(async () => ({ data: {} })),
   fetchNotificationSettings: () => fetchNotificationSettings(),
@@ -79,6 +80,8 @@ beforeEach(() => {
   fetchForms.mockClear()
   fetchFormStats.mockClear()
   setNotifyEnabled.mockClear()
+  fetchFormSchema.mockClear()
+  saveFormSchema.mockClear()
 })
 
 describe('Forms list', () => {
@@ -128,14 +131,39 @@ describe('Forms list', () => {
     await waitFor(() => expect(setNotifyEnabled).toHaveBeenCalledWith('f1', false))
   })
 
-  it('opens the schema drawer from the Schema action', async () => {
+  it('opens the inline schema pane from the Schema action and saves through the service', async () => {
     render(<Forms onNavigate={() => {}} />)
     await screen.findByText('Contact Us')
 
-    fireEvent.click(screen.getAllByRole('button', { name: 'Schema' })[0]!)
+    const schemaButton = screen.getAllByRole('button', { name: 'Schema' })[0]!
+    expect(schemaButton.getAttribute('aria-expanded')).toBe('false')
+    fireEvent.click(schemaButton)
 
     await waitFor(() => expect(fetchFormSchema).toHaveBeenCalled())
-    // Drawer tabs are present.
+    // Pane renders as a labelled inline region (not an overlay dialog).
+    expect(screen.getByRole('region', { name: 'Form schema' })).toBeTruthy()
+    expect(schemaButton.getAttribute('aria-expanded')).toBe('true')
     expect(await screen.findByRole('tab', { name: 'Fields' })).toBeTruthy()
+
+    // Saving flows through the same saveFormSchema service call.
+    fireEvent.click(await screen.findByRole('button', { name: 'Save Schema' }))
+    await waitFor(() =>
+      expect(saveFormSchema).toHaveBeenCalledWith(
+        'f1',
+        expect.arrayContaining([expect.objectContaining({ key: 'name' })]),
+      ),
+    )
+  })
+
+  it('clicking Schema again toggles the pane closed', async () => {
+    render(<Forms onNavigate={() => {}} />)
+    await screen.findByText('Contact Us')
+
+    const schemaButton = screen.getAllByRole('button', { name: 'Schema' })[0]!
+    fireEvent.click(schemaButton)
+    await waitFor(() => expect(screen.getByRole('region', { name: 'Form schema' })).toBeTruthy())
+
+    fireEvent.click(schemaButton)
+    await waitFor(() => expect(screen.queryByRole('region', { name: 'Form schema' })).toBeNull())
   })
 })