@antscorp/antsomi-ui 1.3.7-beta.7 → 1.3.7-beta.71

package/es/components/organism/LoginV2/utils/ory.js

@@ -0,0 +1,408 @@
+export const DEFAULT_OAUTH_LOGIN_URL = '/oauth2/login';
+export const DEFAULT_OAUTH_TOKEN_URL = '/oauth2/token';
+export const DEFAULT_KRATOS_LOGIN_URL = '/self-service/login/browser';
+export const DEFAULT_KRATOS_LOGOUT_URL = '/self-service/logout/browser';
+export const DEFAULT_SESSION_URL = '/api/session';
+export const DEFAULT_OAUTH_STORAGE_KEY = 'antsomi.ory.oauth';
+const makeError = (code, message, status) => {
+    const error = new Error(message);
+    error.code = code;
+    if (status !== undefined) {
+        error.status = status;
+    }
+    return error;
+};
+export const makeUserError = (code, message, userMessage, status) => {
+    const error = makeError(code, message, status);
+    error.userMessage = userMessage;
+    return error;
+};
+export const getOrigin = (location) => location?.origin || 'http://localhost';
+export const toURL = (value, origin) => {
+    try {
+        return new URL(value, origin);
+    }
+    catch (error) {
+        throw makeError('ORY_INVALID_REDIRECT', 'Invalid OAuth redirect URL');
+    }
+};
+export const isOryLoginRequest = ({ location }) => {
+    const params = new URLSearchParams(location.search || '');
+    if (params.get('login_challenge')) {
+        return true;
+    }
+    const returnTo = params.get('return_to');
+    if (!returnTo) {
+        return false;
+    }
+    try {
+        return Boolean(toURL(returnTo, getOrigin(location)).searchParams.get('login_challenge'));
+    }
+    catch (error) {
+        return false;
+    }
+};
+export const isOryCallbackRequest = ({ location }) => {
+    const params = new URLSearchParams(location.search || '');
+    return Boolean(params.get('code') || params.get('error'));
+};
+/**
+ * Build the only redirect accepted by the Ory login bridge. A return_to URL
+ * is trusted only when it has the configured bridge origin and path.
+ */
+export const getOAuthBridgeURL = ({ location, oauthLoginUrl = DEFAULT_OAUTH_LOGIN_URL, }) => {
+    const origin = getOrigin(location);
+    const expectedBridge = toURL(oauthLoginUrl, origin);
+    const params = new URLSearchParams(location.search || '');
+    const loginChallenge = params.get('login_challenge');
+    const returnTo = params.get('return_to');
+    const bridge = returnTo ? toURL(returnTo, origin) : expectedBridge;
+    if (bridge.origin !== expectedBridge.origin || bridge.pathname !== expectedBridge.pathname) {
+        throw makeError('ORY_UNTRUSTED_REDIRECT', 'OAuth return URL is not trusted');
+    }
+    if (loginChallenge) {
+        const bridgeChallenge = bridge.searchParams.get('login_challenge');
+        if (bridgeChallenge && bridgeChallenge !== loginChallenge) {
+            throw makeError('ORY_CHALLENGE_MISMATCH', 'OAuth login challenge mismatch');
+        }
+        if (!bridgeChallenge) {
+            bridge.searchParams.set('login_challenge', loginChallenge);
+        }
+    }
+    if (!bridge.searchParams.get('login_challenge')) {
+        throw makeError('ORY_MISSING_CHALLENGE', 'OAuth login challenge is required');
+    }
+    return bridge.toString();
+};
+export const getKratosLoginURL = ({ kratosLoginUrl = DEFAULT_KRATOS_LOGIN_URL, returnTo, location, }) => {
+    const loginURL = toURL(kratosLoginUrl, getOrigin(location));
+    loginURL.searchParams.set('return_to', returnTo);
+    return loginURL.toString();
+};
+const hasSessionSubject = (payload) => {
+    const data = payload?.data;
+    return Boolean(data?.subjectId || data?.identityId);
+};
+export const resolveOryLogin = async ({ location, oauthLoginUrl = DEFAULT_OAUTH_LOGIN_URL, kratosLoginUrl = DEFAULT_KRATOS_LOGIN_URL, sessionUrl = DEFAULT_SESSION_URL, fetchImpl, assign, }) => {
+    const bridgeURL = getOAuthBridgeURL({ location, oauthLoginUrl });
+    const request = fetchImpl || (typeof fetch === 'function' ? fetch : undefined);
+    if (!request) {
+        throw makeError('ORY_SESSION_CHECK_UNAVAILABLE', 'Browser session check is unavailable');
+    }
+    const response = await request(sessionUrl, {
+        credentials: 'include',
+        headers: { Accept: 'application/json' },
+    });
+    let payload = null;
+    try {
+        payload = await response.json();
+    }
+    catch (error) {
+        // An authenticated session endpoint must return its JSON session envelope.
+    }
+    if (response.ok && hasSessionSubject(payload)) {
+        assign?.(bridgeURL);
+        return { status: 'redirect', destination: bridgeURL };
+    }
+    if (response.status === 401) {
+        const destination = getKratosLoginURL({ kratosLoginUrl, returnTo: bridgeURL, location });
+        assign?.(destination);
+        return { status: 'redirect', destination };
+    }
+    throw makeError(response.ok ? 'ORY_INVALID_SESSION_RESPONSE' : 'ORY_SESSION_CHECK_FAILED', response.ok ? 'Authenticated session response is invalid' : 'Browser session check failed', response.status);
+};
+export const readJSON = async (response) => {
+    try {
+        return await response.json();
+    }
+    catch (error) {
+        return null;
+    }
+};
+export const checkOrySession = async ({ sessionUrl = DEFAULT_SESSION_URL, fetchImpl, }) => {
+    const request = fetchImpl || (typeof fetch === 'function' ? fetch : undefined);
+    if (!request)
+        throw makeError('ORY_SESSION_CHECK_UNAVAILABLE', 'Browser session check is unavailable');
+    const response = await request(sessionUrl, {
+        credentials: 'include',
+        headers: { Accept: 'application/json' },
+    });
+    const payload = await readJSON(response);
+    if (response.ok && hasSessionSubject(payload))
+        return payload;
+    if (response.status === 401 && payload?.error?.code === "MFA_REQUIRED")
+        throw makeError("ORY_MFA_REQUIRED", "Additional verification is required", 401);
+    if (response.status === 401)
+        throw makeError('ORY_SESSION_REQUIRED', 'A browser session is required', 401);
+    throw makeError('ORY_SESSION_CHECK_FAILED', 'Browser session check failed', response.status);
+};
+/** Continue with Kratos's existing MFA UI; retain the validated Hydra bridge. */
+export const redirectOryMFA = ({ location, kratosLoginUrl = DEFAULT_KRATOS_LOGIN_URL, oauthLoginUrl = DEFAULT_OAUTH_LOGIN_URL, assign }) => {
+    const url = toURL(kratosLoginUrl, getOrigin(location));
+    url.searchParams.set('aal', 'aal2');
+    url.searchParams.set('return_to', getOAuthBridgeURL({ location, oauthLoginUrl }));
+    assign(url.toString());
+};
+const hasStepUpNode = (payload) => {
+    const nodes = payload?.ui?.nodes;
+    return (Array.isArray(nodes) &&
+        nodes.some(node => {
+            const name = node?.attributes?.name;
+            return name === 'totp' || name === 'lookup_secret' || name === 'webauthn' || name === 'code';
+        }));
+};
+const getSameOriginKratosAction = ({ location, kratosLoginUrl, flowId, action, }) => {
+    const origin = getOrigin(location);
+    const configured = toURL(kratosLoginUrl, origin);
+    const candidate = action ? toURL(action, origin) : configured;
+    const configuredPath = configured.pathname.replace(/\/browser\/?$/, '');
+    // Kratos may return an absolute action for its upstream port. Only retain
+    // the validated login path and flow id when posting through the app proxy.
+    if (candidate.pathname.replace(/\/$/, '') !== configuredPath.replace(/\/$/, '') &&
+        candidate.pathname !== configured.pathname) {
+        throw makeError('ORY_LOGIN_ACTION_INVALID', 'Kratos login action is invalid');
+    }
+    const postURL = new URL(configuredPath || '/self-service/login', origin);
+    postURL.searchParams.set('flow', flowId);
+    return postURL.toString();
+};
+/**
+ * Submit the existing package SignIn form to a same-origin Kratos browser
+ * flow, then return the verified browser session to Hydra's login bridge.
+ * Passwords are sent only in the form request and are never persisted.
+ */
+export const submitOryPasswordLogin = async ({ location, email, password, kratosLoginUrl = DEFAULT_KRATOS_LOGIN_URL, sessionUrl = DEFAULT_SESSION_URL, oauthLoginUrl = DEFAULT_OAUTH_LOGIN_URL, returnToBridge = true, inlineMfa = false, fetchImpl, assign, }) => {
+    const request = fetchImpl || (typeof fetch === 'function' ? fetch : undefined);
+    if (!request) {
+        throw makeError('ORY_LOGIN_UNAVAILABLE', 'Kratos login is unavailable');
+    }
+    const bridgeURL = returnToBridge ? getOAuthBridgeURL({ location, oauthLoginUrl }) : '';
+    const loginURL = toURL(kratosLoginUrl, getOrigin(location));
+    loginURL.searchParams.set('refresh', 'true');
+    if (bridgeURL) {
+        loginURL.searchParams.set('return_to', bridgeURL);
+    }
+    const flowResponse = await request(loginURL.toString(), {
+        credentials: 'include',
+        headers: { Accept: 'application/json' },
+    });
+    const flowPayload = (await readJSON(flowResponse));
+    if (!flowResponse.ok || !flowPayload?.id) {
+        throw makeUserError('ORY_LOGIN_FLOW_FAILED', 'Kratos login flow could not be initialized', 'Unable to start secure sign-in. Please try again.', flowResponse.status);
+    }
+    const csrfNode = flowPayload.ui?.nodes?.find(node => node?.attributes?.name === 'csrf_token');
+    const csrfToken = csrfNode?.attributes?.value;
+    if (!csrfToken) {
+        throw makeUserError('ORY_CSRF_MISSING', 'Kratos login flow did not provide a CSRF token', 'Secure sign-in could not be verified. Please try again.');
+    }
+    const body = new URLSearchParams({
+        method: 'password',
+        identifier: email,
+        password,
+        csrf_token: csrfToken,
+    });
+    const submitURL = getSameOriginKratosAction({
+        location,
+        kratosLoginUrl,
+        flowId: flowPayload.id,
+        action: flowPayload.ui?.action,
+    });
+    const submitResponse = await request(submitURL, {
+        method: 'POST',
+        credentials: 'include',
+        headers: { Accept: 'application/json', 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: body.toString(),
+    });
+    const submitPayload = await readJSON(submitResponse);
+    if (!submitResponse.ok && submitPayload?.error?.id !== 'browser_location_change_required') {
+        if (hasStepUpNode(submitPayload) || submitPayload?.error?.id === 'session_aal2_required') {
+            if (!returnToBridge || inlineMfa)
+                return { status: 'mfa-required' };
+            if (assign) {
+                redirectOryMFA({ location, kratosLoginUrl, oauthLoginUrl, assign });
+                return { status: 'mfa-required' };
+            }
+            throw makeUserError('ORY_MFA_REQUIRED', 'Additional Kratos verification is required', 'Additional verification is required to finish signing in.', submitResponse.status);
+        }
+        throw makeUserError('ORY_INVALID_CREDENTIALS', 'Kratos rejected the submitted credentials', 'Email or password is invalid', submitResponse.status);
+    }
+    const sessionResponse = await request(sessionUrl, {
+        credentials: 'include',
+        headers: { Accept: 'application/json' },
+    });
+    const sessionPayload = await readJSON(sessionResponse);
+    if (sessionResponse.status === 401 && sessionPayload?.error?.code === 'MFA_REQUIRED') {
+        if (returnToBridge && assign && !inlineMfa) {
+            redirectOryMFA({ location, kratosLoginUrl, oauthLoginUrl, assign });
+        }
+        return { status: 'mfa-required' };
+    }
+    if (!sessionResponse.ok || !hasSessionSubject(sessionPayload)) {
+        throw makeUserError('ORY_SESSION_CHECK_FAILED', 'Kratos did not establish a browser session', 'Secure sign-in could not be completed. Please try again.', sessionResponse.status);
+    }
+    if (!bridgeURL) {
+        return { status: 'authenticated', session: sessionPayload };
+    }
+    assign?.(bridgeURL);
+    return { status: 'redirect', destination: bridgeURL };
+};
+const encodeBase64URL = (value) => {
+    if (typeof btoa !== 'function') {
+        throw makeError('ORY_PKCE_UNAVAILABLE', 'Browser PKCE support is unavailable');
+    }
+    let binary = '';
+    value.forEach(byte => {
+        binary += String.fromCharCode(byte);
+    });
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+};
+const randomURLSafeValue = (cryptoImpl) => {
+    const bytes = new Uint8Array(32);
+    cryptoImpl.getRandomValues(bytes);
+    return encodeBase64URL(bytes);
+};
+const getStorage = (storage) => {
+    if (storage) {
+        return storage;
+    }
+    if (typeof sessionStorage === 'undefined') {
+        throw makeError('ORY_STORAGE_UNAVAILABLE', 'Browser OAuth session storage is unavailable');
+    }
+    return sessionStorage;
+};
+const getCrypto = (cryptoImpl) => {
+    if (cryptoImpl) {
+        return cryptoImpl;
+    }
+    if (typeof crypto === 'undefined' || !crypto.subtle) {
+        throw makeError('ORY_PKCE_UNAVAILABLE', 'Browser PKCE support is unavailable');
+    }
+    return crypto;
+};
+const getRequiredConfig = (value, code, message) => {
+    if (!value || !value.trim()) {
+        throw makeError(code, message);
+    }
+    return value.trim();
+};
+export const startOryAuthorization = async ({ location, authorizeUrl, clientId, redirectUri, scope, audience, storage, storageKey = DEFAULT_OAUTH_STORAGE_KEY, cryptoImpl, assign, }) => {
+    const resolvedClientId = getRequiredConfig(clientId, 'ORY_CLIENT_ID_REQUIRED', 'OAuth client ID is required');
+    const resolvedRedirectUri = getRequiredConfig(redirectUri, 'ORY_REDIRECT_URI_REQUIRED', 'OAuth redirect URI is required');
+    const resolvedScope = getRequiredConfig(scope, 'ORY_SCOPE_REQUIRED', 'OAuth scope is required');
+    const cryptoValue = getCrypto(cryptoImpl);
+    const state = randomURLSafeValue(cryptoValue);
+    const verifier = randomURLSafeValue(cryptoValue);
+    const digest = await cryptoValue.subtle.digest('SHA-256', new TextEncoder().encode(verifier));
+    const challenge = encodeBase64URL(new Uint8Array(digest));
+    const authURL = toURL(authorizeUrl, getOrigin(location));
+    authURL.searchParams.set('client_id', resolvedClientId);
+    authURL.searchParams.set('redirect_uri', resolvedRedirectUri);
+    authURL.searchParams.set('response_type', 'code');
+    authURL.searchParams.set('scope', resolvedScope);
+    authURL.searchParams.set('state', state);
+    authURL.searchParams.set('code_challenge', challenge);
+    authURL.searchParams.set('code_challenge_method', 'S256');
+    if (audience && audience.trim()) {
+        authURL.searchParams.set('audience', audience.trim());
+    }
+    getStorage(storage).setItem(storageKey, JSON.stringify({
+        state,
+        verifier,
+        clientId: resolvedClientId,
+        redirectUri: resolvedRedirectUri,
+    }));
+    const destination = authURL.toString();
+    assign?.(destination);
+    return { status: 'redirect', destination };
+};
+export const completeOryAuthorization = async ({ location, tokenUrl, clientId, redirectUri, storage, storageKey = DEFAULT_OAUTH_STORAGE_KEY, fetchImpl, }) => {
+    const params = new URLSearchParams(location.search || '');
+    const oauthError = params.get('error');
+    if (oauthError) {
+        throw makeError('ORY_AUTHORIZATION_DENIED', 'OAuth authorization was denied');
+    }
+    const code = getRequiredConfig(params.get('code') || undefined, 'ORY_CODE_REQUIRED', 'OAuth authorization code is required');
+    const returnedState = getRequiredConfig(params.get('state') || undefined, 'ORY_STATE_REQUIRED', 'OAuth state is required');
+    const resolvedClientId = getRequiredConfig(clientId, 'ORY_CLIENT_ID_REQUIRED', 'OAuth client ID is required');
+    const resolvedRedirectUri = getRequiredConfig(redirectUri, 'ORY_REDIRECT_URI_REQUIRED', 'OAuth redirect URI is required');
+    const stored = getStorage(storage);
+    const rawTransaction = stored.getItem(storageKey);
+    stored.removeItem(storageKey);
+    if (!rawTransaction) {
+        throw makeError('ORY_STATE_MISSING', 'OAuth login transaction is missing');
+    }
+    let transaction;
+    try {
+        transaction = JSON.parse(rawTransaction);
+    }
+    catch (error) {
+        throw makeError('ORY_STATE_INVALID', 'OAuth login transaction is invalid');
+    }
+    if (transaction.state !== returnedState ||
+        transaction.clientId !== resolvedClientId ||
+        transaction.redirectUri !== resolvedRedirectUri ||
+        !transaction.verifier) {
+        throw makeError('ORY_STATE_MISMATCH', 'OAuth state verification failed');
+    }
+    const request = fetchImpl || (typeof fetch === 'function' ? fetch : undefined);
+    const resolvedTokenUrl = getRequiredConfig(tokenUrl, 'ORY_TOKEN_URL_REQUIRED', 'OAuth token URL is required');
+    if (!request) {
+        throw makeError('ORY_TOKEN_EXCHANGE_UNAVAILABLE', 'OAuth token exchange is unavailable');
+    }
+    const response = await request(resolvedTokenUrl, {
+        method: 'POST',
+        credentials: 'omit',
+        headers: { Accept: 'application/json', 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            grant_type: 'authorization_code',
+            client_id: resolvedClientId,
+            redirect_uri: resolvedRedirectUri,
+            code,
+            code_verifier: transaction.verifier,
+        }).toString(),
+    });
+    let payload = null;
+    try {
+        payload = await response.json();
+    }
+    catch (error) {
+        // An OAuth token endpoint must return JSON on both success and failure.
+    }
+    if (!response.ok ||
+        !payload ||
+        typeof payload !== 'object' ||
+        typeof payload.access_token !== 'string') {
+        throw makeError('ORY_TOKEN_EXCHANGE_FAILED', 'OAuth token exchange failed', response.status);
+    }
+    return payload;
+};
+/**
+ * End the Kratos browser session ("sign in with a different account"). Kratos
+ * hands back a one-time logout URL for the same-origin session cookie; the
+ * return URL must stay on this origin.
+ */
+export const startOryLogout = async ({ location, returnTo, kratosLogoutUrl = DEFAULT_KRATOS_LOGOUT_URL, fetchImpl, assign, }) => {
+    const request = fetchImpl || (typeof fetch === 'function' ? fetch : undefined);
+    if (!request) {
+        throw makeError('ORY_LOGOUT_UNAVAILABLE', 'Kratos logout is unavailable');
+    }
+    const origin = getOrigin(location);
+    const target = toURL(returnTo, origin);
+    if (target.origin !== origin) {
+        throw makeError('ORY_UNTRUSTED_REDIRECT', 'Logout return URL is not trusted');
+    }
+    const logoutInit = toURL(kratosLogoutUrl, origin);
+    logoutInit.searchParams.set('return_to', target.toString());
+    const response = await request(logoutInit.toString(), {
+        credentials: 'include',
+        headers: { Accept: 'application/json' },
+    });
+    const payload = await readJSON(response);
+    const logoutUrl = payload?.logout_url || payload?.data?.logout_url;
+    if (!response.ok || !logoutUrl) {
+        throw makeUserError('ORY_LOGOUT_FAILED', 'Kratos logout could not be initialized', 'Unable to sign out. Please try again.', response.status);
+    }
+    const destination = toURL(logoutUrl, origin).toString();
+    assign?.(destination);
+    return { status: 'redirect', destination };
+};

package/es/components/organism/LoginV2/utils/oryConsent.d.ts

@@ -0,0 +1,52 @@
+import type { OryAccount, OryConsentGrant, OryConsentRequest, OryPortal, OryScopeCatalog, OryScopeInfo } from '../types/ory';
+import { FetchLike, LocationLike } from './ory';
+/** Scopes that describe the user's identity rather than a portal resource. */
+export declare const OIDC_SCOPES: string[];
+export declare const DEFAULT_SCOPE_CATALOG: OryScopeCatalog;
+export declare const getOryScopeInfo: (scope: string, catalog?: OryScopeCatalog) => OryScopeInfo;
+/** A portal must be chosen when the token carries business (non-OIDC) access. */
+export declare const requiresOryPortal: (request?: OryConsentRequest | null) => boolean;
+/**
+ * Portals come from the verified session memberships. Only the identifier is
+ * guaranteed; name, environment and tags are shown when the backend sends them.
+ */
+export declare const getOryPortals: (payload: unknown) => OryPortal[];
+export declare const getOryAccount: (payload: unknown, subject?: string) => OryAccount;
+export declare const getOryAccountLabel: (account: OryAccount) => string;
+export declare const getInitials: (value: string) => string;
+/** Preferred portal (e.g. `portal_id` in the URL) wins, then the default, then a sole portal. */
+export declare const getInitialOryPortalId: (portals: OryPortal[], preferred?: string | null) => string;
+/** Multiple memberships always require an explicit portal choice for the token. */
+export declare const shouldPromptForOryPortal: (portals: OryPortal[], preferred?: string | null) => boolean;
+/** Distinct environment/tag labels, used as filter chips. */
+export declare const getOryPortalTags: (portals: OryPortal[]) => string[];
+export declare const filterOryPortals: (portals: OryPortal[], { query, tag }: {
+    query?: string;
+    tag?: string;
+}) => OryPortal[];
+export declare const getInitialSelectedScopes: (request: OryConsentRequest) => string[];
+/**
+ * Build the acceptance body. Only scopes Hydra requested can be granted, in the
+ * requested order, and required scopes (openid) are always kept.
+ */
+export declare const buildOryConsentGrant: ({ request, selected, portalId, remember, catalog, }: {
+    request: OryConsentRequest;
+    selected: string[];
+    portalId: string;
+    remember: boolean;
+    catalog?: OryScopeCatalog;
+}) => OryConsentGrant;
+/**
+ * Decline the authorization request. Hydra answers with the redirect back to
+ * the requesting application carrying `error=access_denied`, so the client is
+ * told the outcome instead of the challenge silently expiring.
+ */
+export declare const declineOryConsent: ({ location, rejectUrl, csrfUrl, challenge, fetchImpl, }: {
+    location: LocationLike;
+    rejectUrl: string;
+    csrfUrl: string;
+    challenge: string;
+    fetchImpl?: FetchLike;
+}) => Promise<{
+    redirectTo: string;
+}>;

package/es/components/organism/LoginV2/utils/oryConsent.js

@@ -0,0 +1,174 @@
+import { getOrigin, makeUserError, readJSON, toURL } from './ory';
+/** Scopes that describe the user's identity rather than a portal resource. */
+export const OIDC_SCOPES = ['openid', 'profile', 'email', 'offline_access'];
+export const DEFAULT_SCOPE_CATALOG = {
+    openid: {
+        title: 'Verify your identity',
+        description: 'Confirm who you are with your Antsomi account.',
+        required: true,
+    },
+    profile: {
+        title: 'Basic profile',
+        description: 'Read your name and profile details.',
+    },
+    email: {
+        title: 'Email address',
+        description: 'Read the email address of your account.',
+    },
+    offline_access: {
+        title: 'Offline access',
+        description: 'Stay connected without asking you to sign in again.',
+    },
+    'reports.read': {
+        title: 'View reports',
+        description: 'Read reports in the selected portal.',
+    },
+    'reports.write': {
+        title: 'Manage reports',
+        description: 'Create and edit reports in the selected portal.',
+        sensitive: true,
+    },
+};
+export const getOryScopeInfo = (scope, catalog = {}) => catalog[scope] ||
+    DEFAULT_SCOPE_CATALOG[scope] || {
+    title: scope,
+    description: 'Access requested by this application.',
+};
+const isRequiredScope = (scope, catalog) => Boolean(getOryScopeInfo(scope, catalog).required);
+/** A portal must be chosen when the token carries business (non-OIDC) access. */
+export const requiresOryPortal = (request) => {
+    if (!request)
+        return false;
+    const hasBusinessScope = (request.requested_scope || []).some(scope => !OIDC_SCOPES.includes(scope));
+    return hasBusinessScope || Boolean(request.requested_access_token_audience?.length);
+};
+const asText = (value) => typeof value === 'string' && value.trim() ? value.trim() : undefined;
+/**
+ * Portals come from the verified session memberships. Only the identifier is
+ * guaranteed; name, environment and tags are shown when the backend sends them.
+ */
+export const getOryPortals = (payload) => {
+    const memberships = payload?.data?.memberships;
+    if (!Array.isArray(memberships))
+        return [];
+    const seen = new Set();
+    const portals = [];
+    memberships.forEach((item) => {
+        const id = item?.portalId === undefined ? '' : String(item.portalId);
+        if (!id || seen.has(id))
+            return;
+        seen.add(id);
+        const label = item.legacyPortalId ?? id;
+        portals.push({
+            id,
+            name: asText(item.portalName) || `Portal ${label}`,
+            slug: asText(item.portalSlug),
+            environment: asText(item.environment),
+            tags: Array.isArray(item.tags)
+                ? item.tags.map(asText).filter(Boolean)
+                : undefined,
+            logo: asText(item.logo),
+            isDefault: item.isDefault === true,
+        });
+    });
+    return portals;
+};
+export const getOryAccount = (payload, subject) => {
+    const data = (payload?.data || {});
+    return {
+        name: asText(data.displayName) || asText(data.name) || asText(data.fullName),
+        email: asText(data.email),
+        avatar: asText(data.avatar),
+        subject: asText(data.subjectId) || subject,
+    };
+};
+export const getOryAccountLabel = (account) => account.email || account.name || account.subject || 'your account';
+export const getInitials = (value) => {
+    const words = value
+        .trim()
+        .split(/[\s@._-]+/)
+        .filter(Boolean);
+    const letters = words.length > 1 ? words[0][0] + words[1][0] : (words[0] || '?').slice(0, 2);
+    return letters.toUpperCase();
+};
+/** Preferred portal (e.g. `portal_id` in the URL) wins, then the default, then a sole portal. */
+export const getInitialOryPortalId = (portals, preferred) => {
+    if (preferred && portals.some(portal => portal.id === preferred))
+        return preferred;
+    const fallback = portals.find(portal => portal.isDefault);
+    if (fallback)
+        return fallback.id;
+    return portals.length === 1 ? portals[0].id : '';
+};
+/** Multiple memberships always require an explicit portal choice for the token. */
+export const shouldPromptForOryPortal = (portals, preferred) => portals.length > 1 && !(preferred && portals.some(portal => portal.id === preferred));
+const portalLabels = (portal) => [portal.environment, ...(portal.tags || [])].filter(Boolean);
+/** Distinct environment/tag labels, used as filter chips. */
+export const getOryPortalTags = (portals) => {
+    const labels = [];
+    portals.forEach(portal => {
+        portalLabels(portal).forEach(label => {
+            if (!labels.some(existing => existing.toLowerCase() === label.toLowerCase())) {
+                labels.push(label);
+            }
+        });
+    });
+    return labels;
+};
+export const filterOryPortals = (portals, { query = '', tag = '' }) => {
+    const needle = query.trim().toLowerCase();
+    const wantedTag = tag.trim().toLowerCase();
+    return portals.filter(portal => {
+        const labels = portalLabels(portal).map(label => label.toLowerCase());
+        if (wantedTag && !labels.includes(wantedTag))
+            return false;
+        if (!needle)
+            return true;
+        return [portal.name, portal.slug, portal.id, ...labels].some(value => value && value.toLowerCase().includes(needle));
+    });
+};
+export const getInitialSelectedScopes = (request) => [
+    ...(request.requested_scope || []),
+];
+/**
+ * Build the acceptance body. Only scopes Hydra requested can be granted, in the
+ * requested order, and required scopes (openid) are always kept.
+ */
+export const buildOryConsentGrant = ({ request, selected, portalId, remember, catalog = {}, }) => ({
+    portalId,
+    grantScope: (request.requested_scope || []).filter(scope => selected.includes(scope) || isRequiredScope(scope, catalog)),
+    grantAccessTokenAudience: request.requested_access_token_audience || [],
+    remember,
+});
+/**
+ * Decline the authorization request. Hydra answers with the redirect back to
+ * the requesting application carrying `error=access_denied`, so the client is
+ * told the outcome instead of the challenge silently expiring.
+ */
+export const declineOryConsent = async ({ location, rejectUrl, csrfUrl, challenge, fetchImpl, }) => {
+    const request = fetchImpl || (typeof fetch === 'function' ? fetch : undefined);
+    const failure = (status) => makeUserError('ORY_CONSENT_DECLINE_FAILED', 'The authorization request could not be declined', 'Unable to decline the request. Please try again.', status);
+    if (!request || !challenge)
+        throw failure();
+    const origin = getOrigin(location);
+    const csrfResponse = await request(toURL(csrfUrl, origin).toString(), {
+        credentials: 'include',
+        headers: { Accept: 'application/json' },
+    });
+    const csrfPayload = await readJSON(csrfResponse);
+    const csrfToken = csrfPayload?.token || csrfPayload?.data?.token;
+    if (!csrfResponse.ok || !csrfToken)
+        throw failure(csrfResponse.status);
+    const url = toURL(rejectUrl, origin);
+    url.searchParams.set('consent_challenge', challenge);
+    const response = await request(url.toString(), {
+        method: 'POST',
+        credentials: 'include',
+        headers: { Accept: 'application/json', 'X-CSRF-Token': csrfToken },
+    });
+    const payload = await readJSON(response);
+    const redirectTo = payload?.data?.redirectTo || payload?.redirectTo;
+    if (!response.ok || !redirectTo)
+        throw failure(response.status);
+    return { redirectTo: toURL(redirectTo, origin).toString() };
+};