@ankhorage/studio 0.6.10 → 0.7.0

package/dist/ui/admin/pages/AuthAdminPage.js

@@ -0,0 +1,596 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { DEFAULT_AUTH_FLOW, } from '@ankhorage/contracts';
+import { getSupabaseOAuthProviderDefinition, SUPABASE_OAUTH_PROVIDER_IDS, } from '@ankhorage/supabase-auth';
+import { Heading, Text, useZoraTheme } from '@ankhorage/zora';
+import { useRouter } from 'expo-router';
+import React, { useCallback, useEffect, useRef, useState } from 'react';
+import { ActivityIndicator, Pressable, ScrollView, StyleSheet, Switch, TextInput, View, } from 'react-native';
+import { readStudioAuthSettings } from '../../../authSettings';
+import { useStudio } from '../../../core/StudioContext';
+import { getProjectAuthHealth, ProjectAuthApiError } from '../../../projectAuthApi';
+import { configureProjectOAuthProvider } from '../../../projectSecretApi';
+import { useAuthAdminSession } from '../AuthAdminSession';
+import { AuthHealthRefreshCoordinator } from './adminAuthHealthFlow';
+import { persistStoredOAuthCredentialLinkAndPatchLocalDraft, persistStoredOAuthCredentialLink, } from './adminAuthCredentialFlow';
+import { rebaseAuthDraftOntoCanonicalCredentialRefs, } from './adminAuthSessionModel';
+const SIGN_IN_IDENTIFIERS = ['email', 'phone', 'username'];
+const PROFILE_FIELDS = [
+    'email',
+    'phone',
+    'username',
+    'firstName',
+    'lastName',
+    'displayName',
+    'avatarUrl',
+];
+export function AuthAdminPage(props) {
+    const { projectId, manifest, routeId } = props;
+    const studio = useStudio();
+    const authAdminSession = useAuthAdminSession();
+    const { flushManifest, manifest: studioManifest, mutateAuthSettings, updateAuthSettings, } = studio;
+    const router = useRouter();
+    const [draft, setDraft] = useState(() => readStudioAuthSettings(manifest ?? createFallbackManifest()) ?? createDefaultSettings());
+    const [health, setHealth] = useState(null);
+    const [loading, setLoading] = useState(true);
+    const [saving, setSaving] = useState(false);
+    const [message, setMessage] = useState(null);
+    const canonicalManifestRef = useRef(manifest);
+    const initializedDraftFromManifestRef = useRef(manifest !== null);
+    const healthRefreshCoordinatorRef = useRef(new AuthHealthRefreshCoordinator());
+    canonicalManifestRef.current = studioManifest ?? manifest;
+    useEffect(() => {
+        if (initializedDraftFromManifestRef.current || !manifest)
+            return;
+        initializedDraftFromManifestRef.current = true;
+        setDraft(readStudioAuthSettings(manifest) ?? createDefaultSettings());
+    }, [manifest]);
+    const refreshHealth = useCallback(async () => {
+        await healthRefreshCoordinatorRef.current.refresh({
+            loadHealth: () => getProjectAuthHealth({ projectId, environment: 'local' }),
+            onHealth: setHealth,
+            onError: (error) => setMessage(toMessage(error)),
+        });
+    }, [projectId]);
+    const reload = useCallback(async () => {
+        setLoading(true);
+        const result = await healthRefreshCoordinatorRef.current.refresh({
+            loadHealth: () => getProjectAuthHealth({ projectId, environment: 'local' }),
+            onHealth: (loadedHealth) => {
+                const canonicalAuthSettings = canonicalManifestRef.current
+                    ? readStudioAuthSettings(canonicalManifestRef.current)
+                    : null;
+                setDraft(canonicalAuthSettings ?? createDefaultSettings());
+                setHealth(loadedHealth);
+                setMessage(null);
+            },
+            onError: (error) => {
+                const canonicalAuthSettings = canonicalManifestRef.current
+                    ? readStudioAuthSettings(canonicalManifestRef.current)
+                    : null;
+                if (canonicalAuthSettings)
+                    setDraft(canonicalAuthSettings);
+                setMessage(toMessage(error));
+            },
+        });
+        if (result.applied || result.error)
+            setLoading(false);
+    }, [projectId]);
+    useEffect(() => {
+        void refreshHealth().finally(() => {
+            setLoading(false);
+        });
+    }, [refreshHealth]);
+    const persistAuthDraft = useCallback(async (nextDraft, nextMessage) => {
+        const canonicalAuthSettings = canonicalManifestRef.current
+            ? readStudioAuthSettings(canonicalManifestRef.current)
+            : null;
+        const rebasedDraft = rebaseAuthDraftOntoCanonicalCredentialRefs({
+            draft: nextDraft,
+            canonical: canonicalAuthSettings,
+        });
+        updateAuthSettings(rebasedDraft);
+        await flushManifest();
+        setMessage(nextMessage);
+        await refreshHealth();
+    }, [flushManifest, refreshHealth, updateAuthSettings]);
+    const persistCredentialLink = useCallback(async (link) => {
+        const result = await persistStoredOAuthCredentialLink({
+            link,
+            mutateAuthSettings,
+            flushManifest,
+            refreshHealth,
+            toMessage,
+        });
+        if (result.ok) {
+            authAdminSession.clearPendingCredentialLink(link.providerId);
+            setMessage(result.message);
+            return result;
+        }
+        authAdminSession.setPendingCredentialLink(result.pendingLink);
+        setMessage(result.message);
+        return result;
+    }, [authAdminSession, flushManifest, mutateAuthSettings, refreshHealth]);
+    const persistCredentialLinkAndPatchDraft = useCallback(async (link) => persistStoredOAuthCredentialLinkAndPatchLocalDraft({
+        link,
+        persistCredentialLink,
+        patchDraft: (mutation) => setDraft(mutation),
+    }), [persistCredentialLink]);
+    const retryPendingCredentialLink = useCallback(async (link) => {
+        const result = await authAdminSession.runCredentialTransaction(link.providerId, link.credentialsRef, () => persistCredentialLinkAndPatchDraft(link));
+        if (!result.ok) {
+            setMessage(formatAuthAdminWriteBusyReason(result.reason));
+        }
+    }, [authAdminSession, persistCredentialLinkAndPatchDraft]);
+    const save = useCallback(async () => {
+        setSaving(true);
+        setMessage(null);
+        try {
+            const result = await authAdminSession.runFullAuthSave(() => persistAuthDraft(draft, 'Authentication configuration saved to the Studio manifest.'));
+            if (!result.ok)
+                setMessage(formatAuthAdminWriteBusyReason(result.reason));
+        }
+        catch (error) {
+            setMessage(toMessage(error));
+        }
+        finally {
+            setSaving(false);
+        }
+    }, [authAdminSession, draft, persistAuthDraft]);
+    const authEnabled = draft.scope !== 'none';
+    const signUpEnabled = draft.signUp !== undefined;
+    const profileEnabled = draft.profile !== undefined;
+    const oauth = draft.oauth ?? createDefaultOAuth();
+    const showGeneral = routeId === 'auth';
+    const showProviders = routeId === 'auth-providers';
+    const showRoutes = routeId === 'auth-routes';
+    const showProfile = routeId === 'auth-profile';
+    return (_jsxs(ScrollView, { contentContainerStyle: styles.content, keyboardShouldPersistTaps: "handled", children: [loading ? _jsx(ActivityIndicator, {}) : null, showGeneral || showProviders ? _jsx(AuthHealthCard, { health: health }) : null, authAdminSession.pendingCredentialLinks.map((pendingCredentialLink) => (_jsx(PendingCredentialLinkCard, { link: pendingCredentialLink, loading: authAdminSession.fullAuthSaveBusy ||
+                    authAdminSession.busyCredentialProviderIds.has(pendingCredentialLink.providerId), onRetry: () => void retryPendingCredentialLink(pendingCredentialLink), onOpenSecrets: () => {
+                    router.push('/ankh/secrets');
+                } }, pendingCredentialLink.providerId))), showGeneral ? (_jsxs(Card, { title: "Overview", children: [_jsx(SwitchSetting, { title: "Authentication enabled", description: "Disabling auth keeps the configuration but sets the canonical scope to none.", value: authEnabled, onValueChange: (enabled) => setDraft((current) => ({ ...current, scope: enabled ? 'global' : 'none' })) }), _jsx(KeyValue, { label: "Provider", value: "Supabase" }), _jsx(KeyValue, { label: "Configuration source", value: "infra.auth" }), _jsx(Text, { color: "neutral", emphasis: "muted", variant: "caption", children: "Roles, RBAC, ABAC, registered users, and user passwords are intentionally not managed here." })] })) : null, showGeneral ? (_jsxs(Card, { title: "Email and password", children: [_jsx(Text, { weight: "semiBold", children: "Sign-in identifiers" }), _jsx(View, { style: styles.choiceRow, children: SIGN_IN_IDENTIFIERS.map((identifier) => {
+                            const selected = draft.signIn.identifiers.includes(identifier);
+                            return (_jsx(Choice, { label: identifier, selected: selected, onPress: () => setDraft((current) => {
+                                    const identifiers = selected
+                                        ? current.signIn.identifiers.filter((value) => value !== identifier)
+                                        : [...current.signIn.identifiers, identifier];
+                                    if (identifiers.length === 0)
+                                        return current;
+                                    return { ...current, signIn: { identifiers } };
+                                }) }, identifier));
+                        }) }), _jsx(SwitchSetting, { title: "Public sign-up enabled", description: "When disabled, sign-up configuration is removed from the desired state.", value: signUpEnabled, onValueChange: (enabled) => setDraft((current) => enabled
+                            ? {
+                                ...current,
+                                signUp: current.signUp ?? {
+                                    requiredFields: ['email', 'password'],
+                                    optionalFields: [],
+                                    signUpPolicy: 'requireVerification',
+                                },
+                            }
+                            : omitSignUp(current)) }), draft.signUp ? (_jsxs(_Fragment, { children: [_jsx(Field, { label: "Required sign-up fields (comma-separated)", children: _jsx(Input, { value: draft.signUp.requiredFields.join(', '), autoCapitalize: "none", onChangeText: (value) => setDraft((current) => current.signUp
+                                        ? {
+                                            ...current,
+                                            signUp: {
+                                                ...current.signUp,
+                                                requiredFields: splitList(value),
+                                            },
+                                        }
+                                        : current) }) }), _jsx(Field, { label: "Optional sign-up fields (comma-separated)", children: _jsx(Input, { value: (draft.signUp.optionalFields ?? []).join(', '), autoCapitalize: "none", onChangeText: (value) => setDraft((current) => current.signUp
+                                        ? {
+                                            ...current,
+                                            signUp: {
+                                                ...current.signUp,
+                                                optionalFields: splitList(value),
+                                            },
+                                        }
+                                        : current) }) }), _jsx(SwitchSetting, { title: "Email confirmation required", description: "Uses the canonical requireVerification sign-up policy.", value: draft.signUp.signUpPolicy === 'requireVerification', onValueChange: (required) => setDraft((current) => current.signUp
+                                    ? {
+                                        ...current,
+                                        signUp: {
+                                            ...current.signUp,
+                                            signUpPolicy: required ? 'requireVerification' : 'autoSignIn',
+                                        },
+                                    }
+                                    : current) })] })) : null] })) : null, showRoutes ? (_jsxs(Card, { title: "Routes", children: [_jsx(RouteField, { label: "Sign-in route", value: draft.flow.signInRoute, onChange: (signInRoute) => updateFlow(setDraft, { signInRoute }) }), _jsx(RouteField, { label: "Sign-up route", value: draft.flow.signUpRoute ?? '', onChange: (signUpRoute) => updateFlow(setDraft, { signUpRoute }) }), _jsx(RouteField, { label: "Sign-out route", value: draft.flow.signOutRoute ?? '', onChange: (signOutRoute) => updateFlow(setDraft, { signOutRoute }) }), _jsx(RouteField, { label: "Post-sign-in route", value: draft.flow.postSignInRoute, onChange: (postSignInRoute) => updateFlow(setDraft, { postSignInRoute }) }), _jsx(RouteField, { label: "Unauthorized route", value: draft.flow.unauthorizedRoute ?? '', onChange: (unauthorizedRoute) => updateFlow(setDraft, { unauthorizedRoute }) }), _jsx(RouteField, { label: "Forgot-password route", value: draft.flow.forgotPasswordRoute ?? '', onChange: (forgotPasswordRoute) => updateFlow(setDraft, { forgotPasswordRoute }) }), _jsx(Field, { label: "OAuth callback route", children: _jsx(Input, { value: oauth.callbackRoute, autoCapitalize: "none", onChangeText: (callbackRoute) => setDraft((current) => ({
+                                ...current,
+                                oauth: { ...(current.oauth ?? createDefaultOAuth()), callbackRoute },
+                            })) }) })] })) : null, showProviders ? (_jsxs(Card, { title: "OAuth providers", children: [_jsx(SwitchSetting, { title: "OAuth enabled", description: "Provider credentials remain in the server-side secret store.", value: oauth.enabled, onValueChange: (enabled) => setDraft((current) => ({
+                            ...current,
+                            oauth: { ...(current.oauth ?? createDefaultOAuth()), enabled },
+                        })) }), SUPABASE_OAUTH_PROVIDER_IDS.map((providerId) => (_jsx(OAuthProviderSetting, { projectId: projectId, providerId: providerId, oauth: oauth, providerHealth: health?.providers.find((provider) => provider.providerId === providerId), onChange: (nextOAuth, nextMessage) => {
+                            setDraft((current) => ({ ...current, oauth: nextOAuth }));
+                            setMessage(nextMessage);
+                        }, onSaved: persistCredentialLinkAndPatchDraft, runCredentialTransaction: authAdminSession.runCredentialTransaction, transactionBusy: authAdminSession.fullAuthSaveBusy ||
+                            authAdminSession.busyCredentialProviderIds.has(providerId) }, providerId))), _jsx(View, { style: styles.actions, children: _jsx(SecondaryButton, { label: "Open project secrets", onPress: () => {
+                                router.push('/ankh/secrets');
+                            } }) })] })) : null, showProfile ? (_jsxs(Card, { title: "Profile", children: [_jsx(SwitchSetting, { title: "Profile table enabled", description: "Profiles are separate from Supabase Auth users. The users table is not an option.", value: profileEnabled, onValueChange: (enabled) => setDraft((current) => enabled
+                            ? {
+                                ...current,
+                                profile: current.profile ?? {
+                                    table: 'profiles',
+                                    fields: ['email', 'displayName', 'avatarUrl'],
+                                    primaryKey: 'authUserId',
+                                    createStrategy: 'trigger',
+                                    updateStrategy: 'api',
+                                },
+                            }
+                            : omitProfile(current)) }), draft.profile ? (_jsxs(_Fragment, { children: [_jsx(Field, { label: "Profile table", children: _jsx(Input, { value: draft.profile.table ?? 'profiles', autoCapitalize: "none", onChangeText: (table) => setDraft((current) => current.profile
+                                        ? { ...current, profile: { ...current.profile, table } }
+                                        : current) }) }), _jsx(Text, { weight: "semiBold", children: "Profile fields" }), _jsx(View, { style: styles.choiceRow, children: PROFILE_FIELDS.map((field) => {
+                                    const selected = draft.profile?.fields.includes(field) ?? false;
+                                    return (_jsx(Choice, { label: field, selected: selected, onPress: () => setDraft((current) => {
+                                            if (!current.profile)
+                                                return current;
+                                            const fields = selected
+                                                ? current.profile.fields.filter((value) => value !== field)
+                                                : [...current.profile.fields, field];
+                                            return {
+                                                ...current,
+                                                profile: { ...current.profile, fields },
+                                            };
+                                        }) }, field));
+                                }) }), _jsx(KeyValue, { label: "Primary key", value: "authUserId" }), _jsx(Field, { label: "Create strategy", children: _jsx(View, { style: styles.choiceRow, children: ['trigger', 'api', 'app'].map((strategy) => (_jsx(Choice, { label: strategy, selected: draft.profile?.createStrategy === strategy, onPress: () => setDraft((current) => current.profile
+                                            ? {
+                                                ...current,
+                                                profile: { ...current.profile, createStrategy: strategy },
+                                            }
+                                            : current) }, strategy))) }) }), _jsx(Field, { label: "Update strategy", children: _jsx(View, { style: styles.choiceRow, children: ['api', 'app'].map((strategy) => (_jsx(Choice, { label: strategy, selected: draft.profile?.updateStrategy === strategy, onPress: () => setDraft((current) => current.profile
+                                            ? {
+                                                ...current,
+                                                profile: { ...current.profile, updateStrategy: strategy },
+                                            }
+                                            : current) }, strategy))) }) })] })) : null] })) : null, _jsxs(View, { style: styles.footerActions, children: [_jsx(SecondaryButton, { label: "Reload", onPress: () => void reload() }), _jsx(PrimaryButton, { label: "Save authentication", loading: saving || authAdminSession.authWriteBusy, onPress: () => void save() })] }), message ? _jsx(Message, { text: message }) : null] }));
+}
+function PendingCredentialLinkCard(props) {
+    return (_jsxs(Card, { title: "Credential link pending", children: [_jsxs(Text, { color: "warning", weight: "semiBold", children: [props.link.providerLabel, " credentials were saved, but the Studio manifest link still needs to be persisted."] }), _jsx(KeyValue, { label: "Credentials ref", value: props.link.credentialsRef }), _jsxs(View, { style: styles.actions, children: [_jsx(PrimaryButton, { label: "Retry manifest link", loading: props.loading, onPress: props.onRetry }), _jsx(SecondaryButton, { label: "Open project secrets", onPress: props.onOpenSecrets })] })] }));
+}
+function OAuthProviderSetting(props) {
+    const definition = getSupabaseOAuthProviderDefinition(props.providerId);
+    const current = props.oauth.providers.find((provider) => provider.id === props.providerId);
+    const requiredFields = props.providerHealth?.requiredFields ??
+        definition?.secretFields.map((field) => field.name) ??
+        [];
+    const configuredFields = props.providerHealth?.configuredFields ?? [];
+    const credentialsComplete = definition !== null &&
+        Boolean(current?.credentialsRef) &&
+        requiredFields.length > 0 &&
+        requiredFields.every((field) => configuredFields.includes(field));
+    const enabled = current?.enabled === true;
+    const [credentialValues, setCredentialValues] = useState({});
+    const [savingCredentials, setSavingCredentials] = useState(false);
+    const [credentialMessage, setCredentialMessage] = useState(null);
+    const setEnabled = (nextEnabled) => {
+        if (nextEnabled && !credentialsComplete) {
+            props.onChange(props.oauth, `Complete ${definition?.label ?? props.providerId} credentials before enabling the provider.`);
+            return;
+        }
+        const nextProvider = {
+            ...(current ?? {
+                id: props.providerId,
+                label: definition?.label ?? props.providerId,
+                scopes: [...(definition?.defaultScopes ?? [])],
+            }),
+            enabled: nextEnabled,
+        };
+        props.onChange({
+            ...props.oauth,
+            providers: upsertProvider(props.oauth.providers, nextProvider),
+        }, null);
+    };
+    const saveCredentials = async () => {
+        if (props.transactionBusy) {
+            setCredentialMessage(`${definition?.label ?? props.providerId} credentials are already being saved.`);
+            return;
+        }
+        if (!definition) {
+            setCredentialMessage('The selected OAuth provider is not supported.');
+            return;
+        }
+        const entries = definition.secretFields.map((field) => [field.name, credentialValues[field.name] ?? '']);
+        if (entries.some(([, value]) => !value)) {
+            setCredentialMessage('Enter a complete credential payload. Existing values cannot be merged.');
+            return;
+        }
+        const credentialsRef = current?.credentialsRef ?? `auth/oauth/${props.providerId}`;
+        const transaction = await props.runCredentialTransaction(props.providerId, credentialsRef, async () => {
+            setSavingCredentials(true);
+            setCredentialMessage(null);
+            try {
+                const result = await configureProjectOAuthProvider({
+                    projectId: props.projectId,
+                    providerId: props.providerId,
+                    environment: 'local',
+                    credentialsRef,
+                    payload: Object.freeze(Object.fromEntries(entries)),
+                });
+                if (result.ok) {
+                    const linkResult = await props.onSaved({
+                        providerId: props.providerId,
+                        providerLabel: definition.label,
+                        credentialsRef: result.credentialsRef,
+                        providerDefaults: {
+                            label: definition.label,
+                            scopes: [...definition.defaultScopes],
+                        },
+                        successMessage: `${definition.label} credentials saved through ${result.credentialsRef}.`,
+                    });
+                    if (!linkResult.ok)
+                        setCredentialMessage(linkResult.message);
+                    return linkResult;
+                }
+                setCredentialMessage(result.error.message);
+                return null;
+            }
+            catch (error) {
+                setCredentialMessage(toMessage(error));
+                return null;
+            }
+            finally {
+                setCredentialValues({});
+                setSavingCredentials(false);
+            }
+        });
+        if (!transaction.ok) {
+            setCredentialMessage(formatAuthAdminWriteBusyReason(transaction.reason));
+        }
+    };
+    return (_jsxs(View, { style: styles.providerPanel, children: [_jsxs(View, { style: styles.providerRow, children: [_jsxs(View, { style: styles.grow, children: [_jsx(Text, { weight: "semiBold", children: definition?.label ?? props.providerId }), _jsxs(Text, { color: credentialsComplete ? 'success' : 'warning', emphasis: "muted", variant: "caption", children: [formatProviderHealthStatus(props.providerHealth?.status ?? 'missing'), current?.credentialsRef ? `: ${current.credentialsRef}` : ''] }), _jsxs(Text, { color: "neutral", emphasis: "muted", variant: "caption", children: ["Required fields: ", props.providerHealth?.requiredFields.join(', ') || 'loading'] })] }), _jsx(Switch, { value: enabled, onValueChange: setEnabled })] }), definition?.secretFields.map((field) => (_jsx(Field, { label: field.label, children: _jsx(Input, { value: credentialValues[field.name] ?? '', secureTextEntry: field.secret, autoCapitalize: "none", placeholder: credentialsComplete ? 'Enter complete replacement value' : field.label, onChangeText: (value) => setCredentialValues((currentValues) => ({
+                        ...currentValues,
+                        [field.name]: value,
+                    })) }) }, field.name))), _jsx(View, { style: styles.actions, children: _jsx(PrimaryButton, { label: credentialsComplete ? 'Replace credentials' : 'Save credentials', loading: savingCredentials || props.transactionBusy, onPress: () => void saveCredentials() }) }), credentialMessage ? _jsx(Message, { text: credentialMessage }) : null] }));
+}
+function upsertProvider(providers, provider) {
+    const index = providers.findIndex((candidate) => candidate.id === provider.id);
+    if (index < 0)
+        return [...providers, provider];
+    return providers.map((candidate, candidateIndex) => candidateIndex === index ? provider : candidate);
+}
+function updateFlow(setDraft, patch) {
+    setDraft((current) => ({ ...current, flow: { ...current.flow, ...patch } }));
+}
+function omitSignUp(settings) {
+    const { signUp: _signUp, ...rest } = settings;
+    return rest;
+}
+function omitProfile(settings) {
+    const { profile: _profile, ...rest } = settings;
+    return rest;
+}
+function createDefaultSettings() {
+    return {
+        scope: 'none',
+        provider: 'supabase',
+        flow: { ...DEFAULT_AUTH_FLOW },
+        signIn: { identifiers: ['email'] },
+        oauth: createDefaultOAuth(),
+    };
+}
+function createDefaultOAuth() {
+    return {
+        enabled: false,
+        callbackRoute: '/auth/callback',
+        providers: [],
+    };
+}
+function createFallbackManifest() {
+    return {
+        metadata: { name: 'App', slug: 'app', version: '1.0.0', themeId: 'default' },
+        settings: { localization: { defaultLocale: 'en', locales: ['en'] } },
+        infra: { plugins: [] },
+        navigator: { type: 'stack', routes: [] },
+        screens: {},
+        themes: [],
+        activeThemeId: 'default',
+    };
+}
+function splitList(value) {
+    return [
+        ...new Set(value
+            .split(',')
+            .map((entry) => entry.trim())
+            .filter(Boolean)),
+    ];
+}
+function toMessage(error) {
+    if (error instanceof ProjectAuthApiError)
+        return error.message;
+    return error instanceof Error ? error.message : 'Authentication configuration request failed.';
+}
+function formatAuthAdminWriteBusyReason(reason) {
+    if (reason === 'full_auth_save_busy') {
+        return 'Authentication configuration is already being saved.';
+    }
+    if (reason === 'credential_transaction_busy') {
+        return 'OAuth credential changes are still being linked. Try again after they finish.';
+    }
+    if (reason === 'credential_ref_busy') {
+        return 'OAuth credentials for this secret are already being linked.';
+    }
+    if (reason === 'credential_secret_cleanup_busy') {
+        return 'Project secret cleanup is in progress for these OAuth credentials.';
+    }
+    return 'OAuth provider credentials are already being saved.';
+}
+function AuthHealthCard({ health }) {
+    if (!health) {
+        return (_jsx(Card, { title: "Health", children: _jsx(Text, { color: "neutral", emphasis: "muted", variant: "bodySmall", children: "Auth health is unavailable." }) }));
+    }
+    return (_jsxs(Card, { title: "Health", children: [_jsx(Text, { color: healthStatusColor(health.status), weight: "semiBold", children: formatHealthStatus(health.status) }), _jsx(KeyValue, { label: "Callback route", value: health.callbackUrls.appCallbackRoute }), health.callbackUrls.providerRedirectUrl ? (_jsx(KeyValue, { label: "Provider redirect URL", value: health.callbackUrls.providerRedirectUrl })) : null, health.providers.map((provider) => (_jsxs(View, { style: styles.healthProvider, children: [_jsxs(Text, { weight: "semiBold", children: [provider.label, ": ", formatProviderHealthStatus(provider.status)] }), _jsxs(Text, { color: "neutral", emphasis: "muted", variant: "caption", children: ["Ref: ", provider.credentialsRef ?? 'none'] }), _jsxs(Text, { color: "neutral", emphasis: "muted", variant: "caption", children: ["Required fields: ", provider.requiredFields.join(', ') || 'none'] }), _jsxs(Text, { color: "neutral", emphasis: "muted", variant: "caption", children: ["Configured fields: ", provider.configuredFields.join(', ') || 'none'] }), provider.missingFields.length > 0 ? (_jsxs(Text, { color: "warning", variant: "caption", children: ["Missing fields: ", provider.missingFields.join(', ')] })) : null] }, provider.providerId))), health.diagnostics.map((diagnostic) => (_jsxs(View, { style: styles.diagnostic, children: [_jsx(Text, { color: diagnosticSeverityColor(diagnostic.severity), variant: "bodySmall", children: diagnostic.code }), _jsx(Text, { color: "neutral", emphasis: "muted", variant: "caption", children: diagnostic.message })] }, `${diagnostic.code}:${diagnostic.path ?? ''}`))), health.diagnostics.length === 0 ? (_jsx(Text, { color: "success", variant: "bodySmall", children: "No auth diagnostics." })) : null] }));
+}
+function formatHealthStatus(status) {
+    if (status === 'healthy')
+        return 'Healthy';
+    if (status === 'warning')
+        return 'Warning';
+    if (status === 'error')
+        return 'Error';
+    return 'Not configured';
+}
+function formatProviderHealthStatus(status) {
+    if (status === 'configured')
+        return 'Configured';
+    if (status === 'incomplete')
+        return 'Incomplete';
+    if (status === 'missing')
+        return 'Missing secret';
+    if (status === 'invalid')
+        return 'Invalid';
+    return 'Disabled';
+}
+function healthStatusColor(status) {
+    if (status === 'healthy')
+        return 'success';
+    if (status === 'warning')
+        return 'warning';
+    if (status === 'error')
+        return 'danger';
+    return 'neutral';
+}
+function diagnosticSeverityColor(severity) {
+    if (severity === 'error')
+        return 'danger';
+    if (severity === 'warning')
+        return 'warning';
+    return 'neutral';
+}
+function Card(props) {
+    const { theme } = useZoraTheme();
+    return (_jsxs(View, { style: [
+            styles.card,
+            { backgroundColor: theme.colors.surface, borderColor: theme.colors.border },
+        ], children: [_jsx(Heading, { level: 3, text: props.title }), props.children] }));
+}
+function Field(props) {
+    return (_jsxs(View, { style: styles.field, children: [_jsx(Text, { variant: "bodySmall", weight: "semiBold", children: props.label }), props.children] }));
+}
+function RouteField(props) {
+    return (_jsx(Field, { label: props.label, children: _jsx(Input, { value: props.value, autoCapitalize: "none", onChangeText: props.onChange }) }));
+}
+function Input(props) {
+    const { theme } = useZoraTheme();
+    return (_jsx(TextInput, { ...props, placeholderTextColor: theme.colors.textMuted, style: [
+            styles.input,
+            {
+                color: theme.colors.text,
+                backgroundColor: theme.colors.background,
+                borderColor: theme.colors.border,
+            },
+            props.style,
+        ] }));
+}
+function SwitchSetting(props) {
+    return (_jsxs(View, { style: styles.switchRow, children: [_jsxs(View, { style: styles.grow, children: [_jsx(Text, { weight: "semiBold", children: props.title }), _jsx(Text, { color: "neutral", emphasis: "muted", variant: "caption", children: props.description })] }), _jsx(Switch, { value: props.value, onValueChange: props.onValueChange })] }));
+}
+function Choice(props) {
+    const { theme } = useZoraTheme();
+    return (_jsx(Pressable, { onPress: props.onPress, style: [
+            styles.choice,
+            {
+                borderColor: props.selected ? theme.colors.primary : theme.colors.border,
+                backgroundColor: props.selected ? theme.colors.surface : theme.colors.background,
+            },
+        ], children: _jsx(Text, { color: props.selected ? 'primary' : 'neutral', variant: "bodySmall", weight: "semiBold", children: props.label }) }));
+}
+function KeyValue(props) {
+    return (_jsxs(View, { style: styles.keyValue, children: [_jsx(Text, { color: "neutral", emphasis: "muted", variant: "bodySmall", children: props.label }), _jsx(Text, { weight: "semiBold", children: props.value })] }));
+}
+function PrimaryButton(props) {
+    const { theme } = useZoraTheme();
+    return (_jsx(Pressable, { disabled: props.loading, onPress: props.onPress, style: [styles.primaryButton, { backgroundColor: theme.colors.primary }], children: props.loading ? (_jsx(ActivityIndicator, { color: "#ffffff" })) : (_jsx(Text, { emphasis: "inverse", weight: "semiBold", children: props.label })) }));
+}
+function SecondaryButton(props) {
+    const { theme } = useZoraTheme();
+    return (_jsx(Pressable, { onPress: props.onPress, style: [styles.secondaryButton, { borderColor: theme.colors.border }], children: _jsx(Text, { weight: "semiBold", children: props.label }) }));
+}
+function Message({ text }) {
+    return (_jsx(Text, { color: "info", variant: "bodySmall", children: text }));
+}
+const styles = StyleSheet.create({
+    content: {
+        width: '100%',
+        maxWidth: 920,
+        alignSelf: 'center',
+        padding: 20,
+        gap: 16,
+    },
+    card: {
+        borderWidth: 1,
+        borderRadius: 14,
+        padding: 16,
+        gap: 14,
+    },
+    grow: { flex: 1 },
+    field: { gap: 6 },
+    input: {
+        minHeight: 42,
+        borderWidth: 1,
+        borderRadius: 8,
+        paddingHorizontal: 12,
+        paddingVertical: 8,
+    },
+    switchRow: {
+        flexDirection: 'row',
+        alignItems: 'center',
+        gap: 16,
+    },
+    choiceRow: {
+        flexDirection: 'row',
+        flexWrap: 'wrap',
+        gap: 8,
+    },
+    choice: {
+        borderWidth: 1,
+        borderRadius: 999,
+        paddingHorizontal: 12,
+        paddingVertical: 8,
+    },
+    providerRow: {
+        flexDirection: 'row',
+        alignItems: 'center',
+        gap: 16,
+        paddingVertical: 8,
+    },
+    providerPanel: {
+        gap: 10,
+        paddingVertical: 8,
+    },
+    healthProvider: {
+        gap: 3,
+        paddingVertical: 8,
+    },
+    diagnostic: {
+        gap: 3,
+        paddingVertical: 6,
+    },
+    keyValue: {
+        flexDirection: 'row',
+        alignItems: 'center',
+        justifyContent: 'space-between',
+        gap: 16,
+    },
+    actions: {
+        flexDirection: 'row',
+        justifyContent: 'flex-end',
+        gap: 10,
+    },
+    footerActions: {
+        flexDirection: 'row',
+        justifyContent: 'flex-end',
+        gap: 10,
+    },
+    primaryButton: {
+        minHeight: 42,
+        borderRadius: 8,
+        paddingHorizontal: 16,
+        alignItems: 'center',
+        justifyContent: 'center',
+    },
+    secondaryButton: {
+        minHeight: 42,
+        borderWidth: 1,
+        borderRadius: 8,
+        paddingHorizontal: 16,
+        alignItems: 'center',
+        justifyContent: 'center',
+    },
+});
+//# sourceMappingURL=AuthAdminPage.js.map