@alxia/react-router 0.41.0 → 0.42.0

package/dist/oauth/index.js

@@ -0,0 +1,106 @@
+import {
+  isApiErrorLike2
+} from "../chunks/index-hn6htqc2.js";
+import {
+  fetcherRefusal
+} from "../chunks/index-gchzf3mc.js";
+import {
+  STEP_UP_REQUIRED2
+} from "../chunks/index-vr82typq.js";
+
+// src/oauth/consent.ts
+import { data } from "react-router";
+
+// src/oauth/model.ts
+function requestIdOf(url) {
+  const id = url.searchParams.get("request_id") ?? url.searchParams.get("request");
+  const trimmed = id?.trim();
+  return trimmed ? trimmed : undefined;
+}
+function followableRedirect(value) {
+  if (typeof value !== "string")
+    return;
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return;
+  }
+  return url.protocol === "https:" || url.protocol === "http:" ? url.href : undefined;
+}
+
+// src/oauth/consent.ts
+var isStrings = (value) => Array.isArray(value) && value.every((item) => typeof item === "string" && item.length > 0);
+function inputOf(body) {
+  const raw = typeof body === "object" && body !== null ? body : {};
+  const { intent, id, scopes } = raw;
+  if (intent !== "approve" && intent !== "deny" || typeof id !== "string" || id.length === 0 || scopes !== undefined && !isStrings(scopes)) {
+    throw data("Bad consent request", { status: 400 });
+  }
+  return { intent, id, scopes };
+}
+function oauthConsent(options) {
+  const notFound = options.notFound ?? ((error) => error.status === 404);
+  const stepUpCode = options.stepUpRequired ?? STEP_UP_REQUIRED2;
+  async function loader(request) {
+    const { viewer, headers: viewerHeaders } = await options.viewer(request);
+    const headers = new Headers(viewerHeaders);
+    headers.set("Cache-Control", "no-store");
+    const id = requestIdOf(new URL(request.url));
+    let pending = null;
+    if (id) {
+      try {
+        pending = await options.find(id, options.caller(request)) ?? null;
+      } catch (error) {
+        if (!(isApiErrorLike2(error) && notFound(error)))
+          throw error;
+      }
+    }
+    return data({ pending, viewer }, pending ? { headers } : { status: 404, headers });
+  }
+  async function action(request, language) {
+    options.json.requireJsonPost(request);
+    const input = inputOf(await options.json.readJson(request));
+    const about = { intent: input.intent, id: input.id };
+    const caller = options.caller(request);
+    try {
+      const { redirectTo } = input.intent === "approve" ? await options.approve({
+        id: input.id,
+        ...input.scopes && { scopes: input.scopes }
+      }, caller) : await options.deny({ id: input.id }, caller);
+      const next = followableRedirect(redirectTo);
+      if (!next) {
+        throw new Error("The API answered a redirect that is not an address");
+      }
+      return { ok: true, ...about, redirectTo: next };
+    } catch (error) {
+      const code = isApiErrorLike2(error) ? error.code : undefined;
+      const { message, status } = fetcherRefusal(options.errors, error, language);
+      const stepUp = code === stepUpCode;
+      const expired = isApiErrorLike2(error) && !stepUp && notFound(error);
+      return data({
+        ok: false,
+        ...about,
+        stepUp,
+        expired,
+        error: stepUp || expired ? "" : message
+      }, { status });
+    }
+  }
+  return { loader, action };
+}
+function consentShouldRevalidate({
+  formMethod,
+  defaultShouldRevalidate
+}) {
+  return formMethod ? false : defaultShouldRevalidate;
+}
+export {
+  consentShouldRevalidate,
+  followableRedirect,
+  oauthConsent,
+  requestIdOf
+};
+
+//# debugId=DB3702F6926B73AE64756E2164756E21
+//# sourceMappingURL=index.js.map

package/dist/oauth/index.js.map

@@ -0,0 +1,11 @@
+{
+  "version": 3,
+  "sources": ["../src/oauth/consent.ts", "../src/oauth/model.ts"],
+  "sourcesContent": [
+    "import { data, type ShouldRevalidateFunctionArgs } from 'react-router';\nimport { type ApiErrorLike, isApiErrorLike } from '../errors/api-error';\nimport type { ApiErrors } from '../errors/api-errors';\nimport { fetcherRefusal } from '../errors/fetcher-result';\nimport type { JsonActions } from '../errors/json-actions';\nimport { STEP_UP_REQUIRED } from '../session/step-up-codes';\nimport type { ConsentAnswer, ConsentDecisionIntent } from './answer';\nimport { followableRedirect, requestIdOf } from './model';\n\n/** Where a decided request sends the browser, as `OAuthDecision` of `@nxgt/janus-oauth/graphql` has it. */\nexport interface ConsentRedirect {\n\treadonly redirectTo: string;\n}\n\n/** The decision a page posted, once checked. */\nexport interface ConsentInput {\n\treadonly intent: ConsentDecisionIntent;\n\treadonly id: string;\n\t/** The scopes allowed; all the asked ones when absent. */\n\treadonly scopes?: readonly string[] | undefined;\n}\n\nexport interface ConsentOptions<\n\tL extends string,\n\tCaller,\n\tViewer,\n\tPending extends object,\n> {\n\t/** The app's `jsonActions()`: the same-site and JSON checks of the action. */\n\treadonly json: Pick<JsonActions, 'readJson' | 'requireJsonPost'>;\n\t/** The app's `createApiErrors()`: words the refusals. */\n\treadonly errors: Pick<ApiErrors<L>, 'apiRefusal'>;\n\t/**\n\t * The signed-in viewer, or a thrown redirect to sign in that comes back to\n\t * this very address, request id included (`SessionFlow.signInRedirect`\n\t * does). `headers` are added to the answer (a refreshed session cookie).\n\t */\n\tviewer(\n\t\trequest: Request,\n\t): Promise<{ readonly viewer: Viewer; readonly headers?: HeadersInit }>;\n\t/** The caller that carries the request's session to the API. */\n\tcaller(request: Request): Caller;\n\t/** `oauthRequest(id)`: the pending request, or `null` when the API has none. */\n\tfind(id: string, caller: Caller): Promise<Pending | null | undefined>;\n\t/** `approveOAuthRequest(id, scopes)`. */\n\tapprove(\n\t\tinput: { readonly id: string; readonly scopes?: readonly string[] },\n\t\tcaller: Caller,\n\t): Promise<ConsentRedirect>;\n\t/** `denyOAuthRequest(id)`. */\n\tdeny(\n\t\tinput: { readonly id: string },\n\t\tcaller: Caller,\n\t): Promise<ConsentRedirect>;\n\t/**\n\t * Whether an API refusal means the request is unknown, decided, lapsed or\n\t * not the viewer's (the API cannot tell which). Default: a 404.\n\t */\n\tnotFound?(error: ApiErrorLike): boolean;\n\t/** The API's step-up code. Default `STEP_UP_REQUIRED`. */\n\tstepUpRequired?: string;\n}\n\nexport interface ConsentRoute<\n\tL extends string,\n\tViewer,\n\tPending extends object,\n> {\n\t/**\n\t * The route's loader: the viewer and the pending request (`null` for an\n\t * unknown one or none in the address, answered with a 404 so the page shows\n\t * its expired state). Never cached: it names a one-time request.\n\t */\n\tloader(\n\t\trequest: Request,\n\t): Promise<\n\t\tReturnType<typeof data<{ pending: Pending | null; viewer: Viewer }>>\n\t>;\n\t/**\n\t * The route's action: approves or denies the JSON `{ intent, id, scopes? }`\n\t * and answers a `ConsentAnswer` for the page's fetcher.\n\t */\n\taction(\n\t\trequest: Request,\n\t\tlanguage: L,\n\t): Promise<ConsentAnswer | ReturnType<typeof data<ConsentAnswer>>>;\n}\n\nconst isStrings = (value: unknown): value is string[] =>\n\tArray.isArray(value) &&\n\tvalue.every((item) => typeof item === 'string' && item.length > 0);\n\nfunction inputOf(body: unknown): ConsentInput {\n\tconst raw = (typeof body === 'object' && body !== null ? body : {}) as Record<\n\t\tstring,\n\t\tunknown\n\t>;\n\tconst { intent, id, scopes } = raw;\n\tif (\n\t\t(intent !== 'approve' && intent !== 'deny') ||\n\t\ttypeof id !== 'string' ||\n\t\tid.length === 0 ||\n\t\t(scopes !== undefined && !isStrings(scopes))\n\t) {\n\t\tthrow data('Bad consent request', { status: 400 });\n\t}\n\treturn { intent, id, scopes };\n}\n\n/**\n * The server side of the screen where a viewer allows or denies an OAuth\n * client (`oauthRequest`, `approveOAuthRequest` and `denyOAuthRequest` of\n * `@nxgt/janus-oauth/graphql`): a loader and an action for one route, the\n * GraphQL calls passed in. The page reads `useConsent`\n * (`@alxia/react-router/oauth/react`).\n *\n * @example\n * const consent = oauthConsent({ json, errors, viewer, caller, find, approve, deny });\n * export const loader = ({ request }) => consent.loader(request);\n * export const action = ({ request }) => consent.action(request, language);\n */\nexport function oauthConsent<\n\tL extends string,\n\tCaller,\n\tViewer,\n\tPending extends object,\n>(\n\toptions: ConsentOptions<L, Caller, Viewer, Pending>,\n): ConsentRoute<L, Viewer, Pending> {\n\tconst notFound =\n\t\toptions.notFound ?? ((error: ApiErrorLike) => error.status === 404);\n\tconst stepUpCode = options.stepUpRequired ?? STEP_UP_REQUIRED;\n\n\tasync function loader(request: Request) {\n\t\tconst { viewer, headers: viewerHeaders } = await options.viewer(request);\n\t\tconst headers = new Headers(viewerHeaders);\n\t\theaders.set('Cache-Control', 'no-store');\n\t\tconst id = requestIdOf(new URL(request.url));\n\t\tlet pending: Pending | null = null;\n\t\tif (id) {\n\t\t\ttry {\n\t\t\t\tpending = (await options.find(id, options.caller(request))) ?? null;\n\t\t\t} catch (error) {\n\t\t\t\tif (!(isApiErrorLike(error) && notFound(error))) throw error;\n\t\t\t}\n\t\t}\n\t\treturn data(\n\t\t\t{ pending, viewer },\n\t\t\tpending ? { headers } : { status: 404, headers },\n\t\t);\n\t}\n\n\tasync function action(request: Request, language: L) {\n\t\toptions.json.requireJsonPost(request);\n\t\tconst input = inputOf(await options.json.readJson(request));\n\t\tconst about = { intent: input.intent, id: input.id } as const;\n\t\tconst caller = options.caller(request);\n\t\ttry {\n\t\t\tconst { redirectTo } =\n\t\t\t\tinput.intent === 'approve'\n\t\t\t\t\t? await options.approve(\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\tid: input.id,\n\t\t\t\t\t\t\t\t...(input.scopes && { scopes: input.scopes }),\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\tcaller,\n\t\t\t\t\t\t)\n\t\t\t\t\t: await options.deny({ id: input.id }, caller);\n\t\t\tconst next = followableRedirect(redirectTo);\n\t\t\tif (!next) {\n\t\t\t\tthrow new Error('The API answered a redirect that is not an address');\n\t\t\t}\n\t\t\treturn { ok: true as const, ...about, redirectTo: next };\n\t\t} catch (error) {\n\t\t\tconst code = isApiErrorLike(error) ? error.code : undefined;\n\t\t\tconst { message, status } = fetcherRefusal(\n\t\t\t\toptions.errors,\n\t\t\t\terror,\n\t\t\t\tlanguage,\n\t\t\t);\n\t\t\tconst stepUp = code === stepUpCode;\n\t\t\tconst expired = isApiErrorLike(error) && !stepUp && notFound(error);\n\t\t\treturn data(\n\t\t\t\t{\n\t\t\t\t\tok: false as const,\n\t\t\t\t\t...about,\n\t\t\t\t\tstepUp,\n\t\t\t\t\texpired,\n\t\t\t\t\terror: stepUp || expired ? '' : message,\n\t\t\t\t},\n\t\t\t\t{ status },\n\t\t\t);\n\t\t}\n\t}\n\n\treturn { loader, action };\n}\n\n/**\n * `shouldRevalidate` of the consent route: never reload after a decision.\n * The decision spends the request, so the loader would answer \"expired\"\n * while the browser is on its way to the client's callback. Any other change\n * (another `request_id`, a navigation) reloads as usual.\n */\nexport function consentShouldRevalidate({\n\tformMethod,\n\tdefaultShouldRevalidate,\n}: Pick<\n\tShouldRevalidateFunctionArgs,\n\t'formMethod' | 'defaultShouldRevalidate'\n>): boolean {\n\treturn formMethod ? false : defaultShouldRevalidate;\n}\n",
+    "/**\n * The request an authorization link names: `request_id` (what the API sends\n * the browser with), else `request`. Empty or absent: `undefined`.\n */\nexport function requestIdOf(url: URL): string | undefined {\n\tconst id =\n\t\turl.searchParams.get('request_id') ?? url.searchParams.get('request');\n\tconst trimmed = id?.trim();\n\treturn trimmed ? trimmed : undefined;\n}\n\n/**\n * Where the browser is sent once a request is decided: the client's own\n * callback, normalised. Only http(s) is followed (a loopback callback is\n * http), never a `javascript:` or `data:` address. Anything else:\n * `undefined`.\n */\nexport function followableRedirect(value: unknown): string | undefined {\n\tif (typeof value !== 'string') return undefined;\n\tlet url: URL;\n\ttry {\n\t\turl = new URL(value);\n\t} catch {\n\t\treturn undefined;\n\t}\n\treturn url.protocol === 'https:' || url.protocol === 'http:'\n\t\t? url.href\n\t\t: undefined;\n}\n"
+  ],
+  "mappings": ";;;;;;;;;;;AAAA;;;ACIO,SAAS,WAAW,CAAC,KAA8B;AAAA,EACzD,MAAM,KACL,IAAI,aAAa,IAAI,YAAY,KAAK,IAAI,aAAa,IAAI,SAAS;AAAA,EACrE,MAAM,UAAU,IAAI,KAAK;AAAA,EACzB,OAAO,UAAU,UAAU;AAAA;AASrB,SAAS,kBAAkB,CAAC,OAAoC;AAAA,EACtE,IAAI,OAAO,UAAU;AAAA,IAAU;AAAA,EAC/B,IAAI;AAAA,EACJ,IAAI;AAAA,IACH,MAAM,IAAI,IAAI,KAAK;AAAA,IAClB,MAAM;AAAA,IACP;AAAA;AAAA,EAED,OAAO,IAAI,aAAa,YAAY,IAAI,aAAa,UAClD,IAAI,OACJ;AAAA;;;AD6DJ,IAAM,YAAY,CAAC,UAClB,MAAM,QAAQ,KAAK,KACnB,MAAM,MAAM,CAAC,SAAS,OAAO,SAAS,YAAY,KAAK,SAAS,CAAC;AAElE,SAAS,OAAO,CAAC,MAA6B;AAAA,EAC7C,MAAM,MAAO,OAAO,SAAS,YAAY,SAAS,OAAO,OAAO,CAAC;AAAA,EAIjE,QAAQ,QAAQ,IAAI,WAAW;AAAA,EAC/B,IACE,WAAW,aAAa,WAAW,UACpC,OAAO,OAAO,YACd,GAAG,WAAW,KACb,WAAW,aAAa,CAAC,UAAU,MAAM,GACzC;AAAA,IACD,MAAM,KAAK,uBAAuB,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClD;AAAA,EACA,OAAO,EAAE,QAAQ,IAAI,OAAO;AAAA;AAetB,SAAS,YAKf,CACA,SACmC;AAAA,EACnC,MAAM,WACL,QAAQ,aAAa,CAAC,UAAwB,MAAM,WAAW;AAAA,EAChE,MAAM,aAAa,QAAQ,kBAAkB;AAAA,EAE7C,eAAe,MAAM,CAAC,SAAkB;AAAA,IACvC,QAAQ,QAAQ,SAAS,kBAAkB,MAAM,QAAQ,OAAO,OAAO;AAAA,IACvE,MAAM,UAAU,IAAI,QAAQ,aAAa;AAAA,IACzC,QAAQ,IAAI,iBAAiB,UAAU;AAAA,IACvC,MAAM,KAAK,YAAY,IAAI,IAAI,QAAQ,GAAG,CAAC;AAAA,IAC3C,IAAI,UAA0B;AAAA,IAC9B,IAAI,IAAI;AAAA,MACP,IAAI;AAAA,QACH,UAAW,MAAM,QAAQ,KAAK,IAAI,QAAQ,OAAO,OAAO,CAAC,KAAM;AAAA,QAC9D,OAAO,OAAO;AAAA,QACf,IAAI,EAAE,gBAAe,KAAK,KAAK,SAAS,KAAK;AAAA,UAAI,MAAM;AAAA;AAAA,IAEzD;AAAA,IACA,OAAO,KACN,EAAE,SAAS,OAAO,GAClB,UAAU,EAAE,QAAQ,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAChD;AAAA;AAAA,EAGD,eAAe,MAAM,CAAC,SAAkB,UAAa;AAAA,IACpD,QAAQ,KAAK,gBAAgB,OAAO;AAAA,IACpC,MAAM,QAAQ,QAAQ,MAAM,QAAQ,KAAK,SAAS,OAAO,CAAC;AAAA,IAC1D,MAAM,QAAQ,EAAE,QAAQ,MAAM,QAAQ,IAAI,MAAM,GAAG;AAAA,IACnD,MAAM,SAAS,QAAQ,OAAO,OAAO;AAAA,IACrC,IAAI;AAAA,MACH,QAAQ,eACP,MAAM,WAAW,YACd,MAAM,QAAQ,QACd;AAAA,QACC,IAAI,MAAM;AAAA,WACN,MAAM,UAAU,EAAE,QAAQ,MAAM,OAAO;AAAA,MAC5C,GACA,MACD,IACC,MAAM,QAAQ,KAAK,EAAE,IAAI,MAAM,GAAG,GAAG,MAAM;AAAA,MAC/C,MAAM,OAAO,mBAAmB,UAAU;AAAA,MAC1C,IAAI,CAAC,MAAM;AAAA,QACV,MAAM,IAAI,MAAM,oDAAoD;AAAA,MACrE;AAAA,MACA,OAAO,EAAE,IAAI,SAAkB,OAAO,YAAY,KAAK;AAAA,MACtD,OAAO,OAAO;AAAA,MACf,MAAM,OAAO,gBAAe,KAAK,IAAI,MAAM,OAAO;AAAA,MAClD,QAAQ,SAAS,WAAW,eAC3B,QAAQ,QACR,OACA,QACD;AAAA,MACA,MAAM,SAAS,SAAS;AAAA,MACxB,MAAM,UAAU,gBAAe,KAAK,KAAK,CAAC,UAAU,SAAS,KAAK;AAAA,MAClE,OAAO,KACN;AAAA,QACC,IAAI;AAAA,WACD;AAAA,QACH;AAAA,QACA;AAAA,QACA,OAAO,UAAU,UAAU,KAAK;AAAA,MACjC,GACA,EAAE,OAAO,CACV;AAAA;AAAA;AAAA,EAIF,OAAO,EAAE,QAAQ,OAAO;AAAA;AASlB,SAAS,uBAAuB;AAAA,EACtC;AAAA,EACA;AAAA,GAIW;AAAA,EACX,OAAO,aAAa,QAAQ;AAAA;",
+  "debugId": "DB3702F6926B73AE64756E2164756E21",
+  "names": []
+}

package/dist/oauth/model.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The request an authorization link names: `request_id` (what the API sends
+ * the browser with), else `request`. Empty or absent: `undefined`.
+ */
+export declare function requestIdOf(url: URL): string | undefined;
+/**
+ * Where the browser is sent once a request is decided: the client's own
+ * callback, normalised. Only http(s) is followed (a loopback callback is
+ * http), never a `javascript:` or `data:` address. Anything else:
+ * `undefined`.
+ */
+export declare function followableRedirect(value: unknown): string | undefined;
+//# sourceMappingURL=model.d.ts.map

package/dist/oauth/model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../src/oauth/model.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,GAAG,GAAG,MAAM,GAAG,SAAS,CAKxD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAWrE"}

package/dist/oauth/react/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * `@alxia/react-router/oauth/react`: the hook of the screen where a viewer
+ * allows or denies an OAuth client. `react` and `react-router` are its only
+ * imports; it shares nothing with the server side of `/oauth`.
+ */
+export { type UseConsentOptions, useConsent } from './use-consent';
+//# sourceMappingURL=index.d.ts.map

package/dist/oauth/react/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/oauth/react/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,KAAK,iBAAiB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC"}

package/dist/oauth/react/index.js

@@ -0,0 +1,87 @@
+import {
+  useFetcherAnswer2
+} from "../../chunks/index-zyg8amjc.js";
+import {
+  useStepUpReplay2
+} from "../../chunks/index-1f16k1sj.js";
+
+// src/oauth/react/use-consent.ts
+import { useRef, useState } from "react";
+import { useFetcher } from "react-router";
+function useConsent(requestId, { go, action, request, confirm }) {
+  const fetcher = useFetcher({
+    key: `oauth-consent-${requestId}`
+  });
+  const busy = fetcher.state !== "idle";
+  const last = useRef(undefined);
+  const [error, setError] = useState(undefined);
+  const [expired, setExpired] = useState(false);
+  const [leaving, setLeaving] = useState(false);
+  const [shownFor, setShownFor] = useState(requestId);
+  if (shownFor !== requestId) {
+    setShownFor(requestId);
+    setError(undefined);
+    setExpired(false);
+    setLeaving(false);
+    last.current = undefined;
+  }
+  const send = (intent) => fetcher.submit({ intent, id: requestId }, {
+    method: "post",
+    encType: "application/json",
+    ...action ? { action } : {}
+  });
+  const decide = (intent) => {
+    if (busy || leaving)
+      return;
+    last.current = intent;
+    setError(undefined);
+    send(intent);
+  };
+  const latest = useFetcherAnswer2(fetcher, (answer) => {
+    if (!answer.ok) {
+      if (answer.stepUp)
+        return;
+      last.current = undefined;
+      if (answer.expired)
+        setExpired(true);
+      else
+        setError(answer.error);
+      return;
+    }
+    setLeaving(true);
+    (go ?? ((url) => window.location.assign(url)))(answer.redirectTo);
+  });
+  const stepUp = useStepUpReplay2({
+    answer: latest,
+    action: last.current,
+    replay() {
+      if (last.current)
+        send(last.current);
+    },
+    spendsCode: () => false,
+    request,
+    confirm
+  });
+  const { dialogProps } = stepUp;
+  const pending = busy || leaving || dialogProps.open;
+  return {
+    approve: () => decide("approve"),
+    deny: () => decide("deny"),
+    pending: pending ? last.current ?? true : false,
+    expired,
+    error,
+    dialogProps: {
+      ...dialogProps,
+      onCancel() {
+        dialogProps.onCancel();
+        last.current = undefined;
+      }
+    }
+  };
+}
+export {
+  useConsent
+};
+
+//# debugId=8F0D98662C6B0DFC64756E2164756E21
+//# sourceMappingURL=index.js.map

package/dist/oauth/react/index.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../src/oauth/react/use-consent.ts"],
+  "sourcesContent": [
+    "import { useRef, useState } from 'react';\nimport { useFetcher } from 'react-router';\nimport { useFetcherAnswer } from '../../fetcher/use-fetcher-answer';\nimport {\n\ttype StepUpReplayOptions,\n\tuseStepUpReplay,\n} from '../../session/react/step-up';\nimport type { ConsentAnswer, ConsentDecisionIntent } from '../answer';\n\nexport interface UseConsentOptions\n\textends Pick<\n\t\tStepUpReplayOptions<ConsentDecisionIntent>,\n\t\t'request' | 'confirm'\n\t> {\n\t/**\n\t * Where the browser goes once a decision lands. A hard navigation by\n\t * default (`window.location.assign`): the callback is another site's.\n\t * A parameter so a test can watch it.\n\t */\n\tgo?(url: string): void;\n\t/** The route whose action decides, when it is not the page's own. */\n\taction?: string;\n}\n\n/**\n * The decision of a consent screen, posted as JSON to the page's action\n * (`oauthConsent().action`). A session not confirmed lately opens the shared\n * step-up (`useStepUpReplay`, nothing spent) and the decision goes again by\n * itself; a decision that lands sends the browser to the client's callback\n * (`go`), and the card stays pending until the page is left. A request the\n * API no longer knows is `expired`; any other refusal is the `error`.\n *\n * @example\n * const { approve, deny, pending, expired, error, dialogProps } =\n * \tuseConsent(request.id, { request: stepUpRequest, confirm: stepUpConfirm });\n */\nexport function useConsent(\n\trequestId: string,\n\t{ go, action, request, confirm }: UseConsentOptions,\n) {\n\tconst fetcher = useFetcher<ConsentAnswer>({\n\t\tkey: `oauth-consent-${requestId}`,\n\t});\n\tconst busy = fetcher.state !== 'idle';\n\tconst last = useRef<ConsentDecisionIntent | undefined>(undefined);\n\tconst [error, setError] = useState<string | undefined>(undefined);\n\tconst [expired, setExpired] = useState(false);\n\tconst [leaving, setLeaving] = useState(false);\n\n\t// Another request in the same mounted route starts from a clean card.\n\tconst [shownFor, setShownFor] = useState(requestId);\n\tif (shownFor !== requestId) {\n\t\tsetShownFor(requestId);\n\t\tsetError(undefined);\n\t\tsetExpired(false);\n\t\tsetLeaving(false);\n\t\tlast.current = undefined;\n\t}\n\n\tconst send = (intent: ConsentDecisionIntent) =>\n\t\tfetcher.submit(\n\t\t\t{ intent, id: requestId },\n\t\t\t{\n\t\t\t\tmethod: 'post',\n\t\t\t\tencType: 'application/json',\n\t\t\t\t...(action ? { action } : {}),\n\t\t\t},\n\t\t);\n\n\tconst decide = (intent: ConsentDecisionIntent) => {\n\t\tif (busy || leaving) return;\n\t\tlast.current = intent;\n\t\tsetError(undefined);\n\t\tvoid send(intent);\n\t};\n\n\tconst latest = useFetcherAnswer(fetcher, (answer) => {\n\t\tif (!answer.ok) {\n\t\t\tif (answer.stepUp) return; // the dialog asks; `replay` sends again\n\t\t\tlast.current = undefined;\n\t\t\tif (answer.expired) setExpired(true);\n\t\t\telse setError(answer.error);\n\t\t\treturn;\n\t\t}\n\t\tsetLeaving(true);\n\t\t(go ?? ((url) => window.location.assign(url)))(answer.redirectTo);\n\t});\n\n\tconst stepUp = useStepUpReplay<ConsentDecisionIntent>({\n\t\tanswer: latest,\n\t\taction: last.current,\n\t\treplay() {\n\t\t\tif (last.current) void send(last.current);\n\t\t},\n\t\t// A decision carries no one-time code: nothing was spent.\n\t\tspendsCode: () => false,\n\t\trequest,\n\t\tconfirm,\n\t});\n\n\tconst { dialogProps } = stepUp;\n\t// `last` is a ref, but each write sits beside a state change or a fetcher\n\t// transition, so a render follows it.\n\tconst pending = busy || leaving || dialogProps.open;\n\treturn {\n\t\tapprove: () => decide('approve'),\n\t\tdeny: () => decide('deny'),\n\t\t/** What the card spins: the decision in flight, held until the page is left. */\n\t\tpending: pending ? (last.current ?? true) : (false as const),\n\t\texpired,\n\t\terror,\n\t\t/** The step-up dialog's props; cancelling it frees the card. */\n\t\tdialogProps: {\n\t\t\t...dialogProps,\n\t\t\tonCancel() {\n\t\t\t\tdialogProps.onCancel();\n\t\t\t\tlast.current = undefined;\n\t\t\t},\n\t\t},\n\t};\n}\n"
+  ],
+  "mappings": ";;;;;;;;AAAA;AACA;AAmCO,SAAS,UAAU,CACzB,aACE,IAAI,QAAQ,SAAS,WACtB;AAAA,EACD,MAAM,UAAU,WAA0B;AAAA,IACzC,KAAK,iBAAiB;AAAA,EACvB,CAAC;AAAA,EACD,MAAM,OAAO,QAAQ,UAAU;AAAA,EAC/B,MAAM,OAAO,OAA0C,SAAS;AAAA,EAChE,OAAO,OAAO,YAAY,SAA6B,SAAS;AAAA,EAChE,OAAO,SAAS,cAAc,SAAS,KAAK;AAAA,EAC5C,OAAO,SAAS,cAAc,SAAS,KAAK;AAAA,EAG5C,OAAO,UAAU,eAAe,SAAS,SAAS;AAAA,EAClD,IAAI,aAAa,WAAW;AAAA,IAC3B,YAAY,SAAS;AAAA,IACrB,SAAS,SAAS;AAAA,IAClB,WAAW,KAAK;AAAA,IAChB,WAAW,KAAK;AAAA,IAChB,KAAK,UAAU;AAAA,EAChB;AAAA,EAEA,MAAM,OAAO,CAAC,WACb,QAAQ,OACP,EAAE,QAAQ,IAAI,UAAU,GACxB;AAAA,IACC,QAAQ;AAAA,IACR,SAAS;AAAA,OACL,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,EAC5B,CACD;AAAA,EAED,MAAM,SAAS,CAAC,WAAkC;AAAA,IACjD,IAAI,QAAQ;AAAA,MAAS;AAAA,IACrB,KAAK,UAAU;AAAA,IACf,SAAS,SAAS;AAAA,IACb,KAAK,MAAM;AAAA;AAAA,EAGjB,MAAM,SAAS,kBAAiB,SAAS,CAAC,WAAW;AAAA,IACpD,IAAI,CAAC,OAAO,IAAI;AAAA,MACf,IAAI,OAAO;AAAA,QAAQ;AAAA,MACnB,KAAK,UAAU;AAAA,MACf,IAAI,OAAO;AAAA,QAAS,WAAW,IAAI;AAAA,MACnC;AAAA,QAAK,SAAS,OAAO,KAAK;AAAA,MAC1B;AAAA,IACD;AAAA,IACA,WAAW,IAAI;AAAA,KACd,OAAO,CAAC,QAAQ,OAAO,SAAS,OAAO,GAAG,IAAI,OAAO,UAAU;AAAA,GAChE;AAAA,EAED,MAAM,SAAS,iBAAuC;AAAA,IACrD,QAAQ;AAAA,IACR,QAAQ,KAAK;AAAA,IACb,MAAM,GAAG;AAAA,MACR,IAAI,KAAK;AAAA,QAAc,KAAK,KAAK,OAAO;AAAA;AAAA,IAGzC,YAAY,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,EACD,CAAC;AAAA,EAED,QAAQ,gBAAgB;AAAA,EAGxB,MAAM,UAAU,QAAQ,WAAW,YAAY;AAAA,EAC/C,OAAO;AAAA,IACN,SAAS,MAAM,OAAO,SAAS;AAAA,IAC/B,MAAM,MAAM,OAAO,MAAM;AAAA,IAEzB,SAAS,UAAW,KAAK,WAAW,OAAS;AAAA,IAC7C;AAAA,IACA;AAAA,IAEA,aAAa;AAAA,SACT;AAAA,MACH,QAAQ,GAAG;AAAA,QACV,YAAY,SAAS;AAAA,QACrB,KAAK,UAAU;AAAA;AAAA,IAEjB;AAAA,EACD;AAAA;",
+  "debugId": "8F0D98662C6B0DFC64756E2164756E21",
+  "names": []
+}

package/dist/oauth/react/use-consent.d.ts

@@ -0,0 +1,47 @@
+import { type StepUpReplayOptions } from '../../session/react/step-up';
+import type { ConsentDecisionIntent } from '../answer';
+export interface UseConsentOptions extends Pick<StepUpReplayOptions<ConsentDecisionIntent>, 'request' | 'confirm'> {
+    /**
+     * Where the browser goes once a decision lands. A hard navigation by
+     * default (`window.location.assign`): the callback is another site's.
+     * A parameter so a test can watch it.
+     */
+    go?(url: string): void;
+    /** The route whose action decides, when it is not the page's own. */
+    action?: string;
+}
+/**
+ * The decision of a consent screen, posted as JSON to the page's action
+ * (`oauthConsent().action`). A session not confirmed lately opens the shared
+ * step-up (`useStepUpReplay`, nothing spent) and the decision goes again by
+ * itself; a decision that lands sends the browser to the client's callback
+ * (`go`), and the card stays pending until the page is left. A request the
+ * API no longer knows is `expired`; any other refusal is the `error`.
+ *
+ * @example
+ * const { approve, deny, pending, expired, error, dialogProps } =
+ * 	useConsent(request.id, { request: stepUpRequest, confirm: stepUpConfirm });
+ */
+export declare function useConsent(requestId: string, { go, action, request, confirm }: UseConsentOptions): {
+    approve: () => void;
+    deny: () => void;
+    /** What the card spins: the decision in flight, held until the page is left. */
+    pending: boolean | ConsentDecisionIntent;
+    expired: boolean;
+    error: string | undefined;
+    /** The step-up dialog's props; cancelling it frees the card. */
+    dialogProps: {
+        onCancel(): void;
+        open: boolean;
+        phase: import("../../session/react").StepUpDialogPhase;
+        via: import("../../session/model").StepUpVia | undefined;
+        props: import("../../session/model").StepUpProps;
+        message: string | undefined;
+        busy: boolean;
+        confirming: boolean;
+        onRetry(): void;
+        onSubmit(code: string): void;
+        onResend: (() => void) | undefined;
+    };
+};
+//# sourceMappingURL=use-consent.d.ts.map

package/dist/oauth/react/use-consent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-consent.d.ts","sourceRoot":"","sources":["../../../src/oauth/react/use-consent.ts"],"names":[],"mappings":"AAGA,OAAO,EACN,KAAK,mBAAmB,EAExB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAiB,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAEtE,MAAM,WAAW,iBAChB,SAAQ,IAAI,CACX,mBAAmB,CAAC,qBAAqB,CAAC,EAC1C,SAAS,GAAG,SAAS,CACrB;IACD;;;;OAIG;IACH,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CACzB,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,iBAAiB;;;IAqElD,gFAAgF;;;;IAIhF,gEAAgE;;;;;;;;;;;;;;EASjE"}

package/dist/session/index.js

@@ -1,12 +1,8 @@
 import {
-  isApiErrorLike2,
-  retryAfterOf2,
-  attemptsLeftOf2,
-  routeError2,
   nextOf2,
   hasSiteCheck,
   refuseCrossSite
-} from "../chunks/index-2swe47m6.js";
+} from "../chunks/index-atxcmy0f.js";
 import {
   HOME2,
   safeNext2,
@@ -15,16 +11,20 @@ import {
   signInPath2,
   secondFactorPath2
 } from "../chunks/index-xvx63t7n.js";
-
-// src/session/codes.ts
-var INVALID_CODE = "CODE_INVALID";
-var CHALLENGE_OVER = [
-  "TOKEN_UNKNOWN",
-  "TOKEN_SPENT",
-  "TOKEN_EXPIRED"
-];
-var MAIL_THROTTLED = "MAIL_THROTTLED";
-var UNAUTHENTICATED = "UNAUTHENTICATED";
+import {
+  isApiErrorLike2,
+  retryAfterOf2,
+  attemptsLeftOf2,
+  routeError2
+} from "../chunks/index-hn6htqc2.js";
+import {
+  INVALID_CODE2,
+  CHALLENGE_OVER2,
+  MAIL_THROTTLED2,
+  UNAUTHENTICATED2,
+  STEP_UP_REQUIRED2,
+  STEP_UP_OVER2
+} from "../chunks/index-vr82typq.js";
 // src/session/serialize.ts
 var SAME_SITE = { lax: "Lax", strict: "Strict", none: "None" };
 function checkSameSite(caller, sameSite, secure) {
@@ -349,7 +349,7 @@ async function afterReset(options, resetDone, request, { context } = {}) {
 var RESET_DONE = "/sign-in?password-reset=1";
 var worded = ({ wording, errors }, error, language) => wording?.(error, language) ?? errors.apiErrorMessage(error, language);
 var throttleCodes = (codes) => {
-  const configured = codes?.mailThrottled ?? MAIL_THROTTLED;
+  const configured = codes?.mailThrottled ?? MAIL_THROTTLED2;
   return typeof configured === "string" ? [configured] : configured;
 };
 async function requestLink(options, run, { request, language }) {
@@ -536,8 +536,8 @@ function resolve(options) {
   if (!hasSiteCheck(options.json)) {
     throw new TypeError("signInFlow(): json must come from jsonActions(), which carries the site check every step runs; this object has none (a hand-made double?). Pass the app's jsonActions({ origin }) instance, or a spread copy of it.");
   }
-  const invalidCode = options.codes?.invalidCode ?? INVALID_CODE;
-  const challengeOver = options.codes?.challengeOver ?? CHALLENGE_OVER;
+  const invalidCode = options.codes?.invalidCode ?? INVALID_CODE2;
+  const challengeOver = options.codes?.challengeOver ?? CHALLENGE_OVER2;
   if (challengeOver.includes(invalidCode)) {
     throw new TypeError(`signInFlow(): the code ${JSON.stringify(invalidCode)} is both the wrong-code code (codes.invalidCode) and in codes.challengeOver. A wrong code that leaves tries cannot end the challenge.`);
   }
@@ -639,15 +639,6 @@ function signedSession(options) {
 // src/session/step-up.ts
 import { data as data6 } from "react-router";
 
-// src/session/step-up-codes.ts
-var STEP_UP_REQUIRED = "STEP_UP_REQUIRED";
-var STEP_UP_OVER = [
-  ...CHALLENGE_OVER,
-  "TOKEN_STALE",
-  "SECOND_FACTOR_ACTIVE",
-  "SECOND_FACTOR_NOT_ENROLLED"
-];
-
 // src/session/step-up-signed-out.ts
 function isSignedOut(error, unauthenticated, from) {
   if (error instanceof Response)
@@ -705,8 +696,8 @@ async function signingOut({
 
 // src/session/step-up.ts
 function resolve2(steps) {
-  const invalidCode = steps.codes?.invalidCode ?? INVALID_CODE;
-  const challengeOver = steps.codes?.challengeOver ?? STEP_UP_OVER;
+  const invalidCode = steps.codes?.invalidCode ?? INVALID_CODE2;
+  const challengeOver = steps.codes?.challengeOver ?? STEP_UP_OVER2;
   if (challengeOver.includes(invalidCode)) {
     throw new TypeError(`stepUpSteps(): the code ${JSON.stringify(invalidCode)} is both the wrong-code code (codes.invalidCode) and in codes.challengeOver. A wrong code that leaves tries cannot end the challenge.`);
   }
@@ -720,9 +711,9 @@ function resolve2(steps) {
     steps,
     invalidCode,
     challengeOver,
-    stepUpRequired: steps.codes?.stepUpRequired ?? STEP_UP_REQUIRED,
-    mailThrottled: steps.codes?.mailThrottled ?? MAIL_THROTTLED,
-    unauthenticated: steps.codes?.unauthenticated ?? UNAUTHENTICATED
+    stepUpRequired: steps.codes?.stepUpRequired ?? STEP_UP_REQUIRED2,
+    mailThrottled: steps.codes?.mailThrottled ?? MAIL_THROTTLED2,
+    unauthenticated: steps.codes?.unauthenticated ?? UNAUTHENTICATED2
   };
 }
 function worded2({ steps }, error, language) {
@@ -963,13 +954,13 @@ function createSignInThrottle(options = {}) {
   };
 }
 export {
-  CHALLENGE_OVER,
-  INVALID_CODE,
-  MAIL_THROTTLED,
-  STEP_UP_OVER,
-  STEP_UP_REQUIRED,
+  CHALLENGE_OVER2 as CHALLENGE_OVER,
+  INVALID_CODE2 as INVALID_CODE,
+  MAIL_THROTTLED2 as MAIL_THROTTLED,
+  STEP_UP_OVER2 as STEP_UP_OVER,
+  STEP_UP_REQUIRED2 as STEP_UP_REQUIRED,
   TOKEN_PAGE_HEADERS,
-  UNAUTHENTICATED,
+  UNAUTHENTICATED2 as UNAUTHENTICATED,
   authLinks,
   createSignInThrottle,
   readCookie,
@@ -981,5 +972,5 @@ export {
   stepUpSteps
 };
 
-//# debugId=E267BD0EB46649CD64756E2164756E21
+//# debugId=5F046EFEF4108A2264756E2164756E21
 //# sourceMappingURL=index.js.map