@anzusystems/common-admin 1.49.0 → 2.0.0-rc.2

package/dist/domains/api/utils/apiErrors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiErrors.js","names":["axios","USER_PROBE_ENTITY","defaultApiErrorLogger","context","error","logger","setApiErrorLogger","fn","LOGGED","AnzuApiAxiosError","AnzuFatalError","AnzuApiResponseCodeError","apiErrorStatus","apiErrorIsReported","status","isInCauseChain","cause","SessionExpiredError","cls","report","mapApiError","labelSystem","system","labelEntity","entity","err","axiosError","isAnzuError","axiosErrorIsCancelled","AnzuApiCancelledError","axiosErrorResponseIsForbidden","AnzuApiForbiddenError","axiosErrorResponseHasValidationData","AnzuApiValidationError","axiosErrorResponseHasDependencyExistsData","AnzuApiDependencyExistsError","axiosErrorResponseHasForbiddenOperationData","AnzuApiForbiddenOperationError","axiosErrorIsTimeout","AnzuApiTimeoutError"],"sources":["../../../../src/domains/api/utils/apiErrors.ts"],"sourcesContent":["import axios, { type AxiosError } from 'axios'\nimport { AnzuApiAxiosError } from '@/shared/error/AnzuApiAxiosError'\nimport { AnzuApiCancelledError, axiosErrorIsCancelled } from '@/shared/error/AnzuApiCancelledError'\nimport {\n  AnzuApiDependencyExistsError,\n  axiosErrorResponseHasDependencyExistsData,\n} from '@/shared/error/AnzuApiDependencyExistsError'\nimport { AnzuApiForbiddenError, axiosErrorResponseIsForbidden } from '@/shared/error/AnzuApiForbiddenError'\nimport {\n  AnzuApiForbiddenOperationError,\n  axiosErrorResponseHasForbiddenOperationData,\n} from '@/shared/error/AnzuApiForbiddenOperationError'\nimport { AnzuApiResponseCodeError } from '@/shared/error/AnzuApiResponseCodeError'\nimport { AnzuApiTimeoutError, axiosErrorIsTimeout } from '@/shared/error/AnzuApiTimeoutError'\nimport { AnzuApiValidationError, axiosErrorResponseHasValidationData } from '@/shared/error/AnzuApiValidationError'\nimport { AnzuError, isAnzuError } from '@/shared/error/AnzuError'\nimport { AnzuFatalError } from '@/shared/error/AnzuFatalError'\nimport { HTTP_STATUS_FORBIDDEN, HTTP_STATUS_UNAUTHORIZED } from '@/shared/statusCodes'\nimport { SessionExpiredError } from '@/shared/error/SessionExpiredError'\nimport { isInCauseChain } from '@/shared/error/isInCauseChain'\n\nexport type ApiErrorContext = {\n  system: string\n  entity: string\n  /** The url actually requested, parameters substituted and query included -- not the template. */\n  url?: string\n  /**\n   * The status the backend answered with, when it answered at all. Absent for a transport failure,\n   * where there is no response.\n   *\n   * It is here so an application can decide what is worth writing down without the call sites having\n   * to: a 404 that a caller probes for, for instance. Those used to be silenced per call, which made\n   * whether a failure was recorded depend on which call made it. The switch is the application's now,\n   * and this is what it needs to use it.\n   *\n   * Two statuses are not the application's to decide, and the library keeps them: 401 and 403. They\n   * are not an endpoint failing its contract, they are the session -- nobody is logged in, or this\n   * user may not -- and every admin in the fleet already branches on them and acts. Everything else\n   * reaches the logger and is filtered here, on this field.\n   */\n  status?: number\n  /**\n   * The i18n scope a field-level validation failure is reported under, when it is not the same as\n   * the backend above.\n   *\n   * `AnzuApiValidationError` turns the server's field names into `<system>.<entity>.model.<field>`\n   * translation keys. For a component shared by nine backends those two are different questions:\n   * *which* backend failed -- which is what the report needs -- and *whose labels* name its fields,\n   * which for a shared form is always the library's own `common.*`. Left unset, the two stay one\n   * value, exactly as before.\n   */\n  validationSystem?: string\n  validationEntity?: string\n}\n\nexport type ApiErrorLogger = (error: Error, context: ApiErrorContext) => void\n\n/**\n * What the user probe calls itself in the error context.\n *\n * A 404 here is an answer, not a failure -- it is how a system says \"no account of yours\". The\n * default logger skips it; an app's own logger still receives it, so it filters on this together\n * with the status rather than on the url, which would also silence a real detail read of the same\n * path. The validation scope stays the user's, so a field error would still name a real label.\n * Defined here, not beside the probe, so the default logger can know it without an import cycle.\n */\nexport const USER_PROBE_ENTITY = 'anzuUserProbe'\n\n/** What reporting does until an application says otherwise; exported so a test can put it back. */\nexport const defaultApiErrorLogger: ApiErrorLogger = (error, context) => {\n  if (context.status === 404 && context.entity === USER_PROBE_ENTITY) return\n  console.error('Api error: ' + (context.url ?? ''), error)\n}\n\nlet logger: ApiErrorLogger | null = defaultApiErrorLogger\n\n/**\n * Replaces the logger the api helpers report unexpected failures through, or turns reporting off\n * with `null`.\n *\n * It is one switch for the whole family rather than a flag on each instance, which is what it\n * replaces: whether a failure was written down used to depend on which helper made the call and how\n * that instance happened to be constructed.\n *\n * An application that wants these where it can see them passes its own:\n * `setApiErrorLogger((e, ctx) => Sentry.captureException(e, { extra: ctx }))`.\n */\nexport const setApiErrorLogger = (fn: ApiErrorLogger | null): void => {\n  logger = fn\n}\n\n// Only the failures nobody planned for. A validation or forbidden answer is the backend saying\n// something the caller asked about and will show; writing those down as well would be noise that\n// teaches people to ignore the log.\nconst LOGGED = [AnzuApiAxiosError, AnzuFatalError, AnzuApiResponseCodeError]\n\n/**\n * The HTTP status the backend answered with, read off whichever class carries it: the axios response\n * of an `AnzuApiAxiosError`, or the `code` of an `AnzuApiResponseCodeError` (a response axios let\n * through). `undefined` when nothing answered -- a timeout, a network failure, a cancel.\n */\nexport const apiErrorStatus = (error: unknown): number | undefined => {\n  if (error instanceof AnzuApiResponseCodeError) return error.code\n  if (error instanceof AnzuApiAxiosError) return error.cause.response?.status\n\n  return undefined\n}\n\n/**\n * Whether `report` hands this error, once mapped, to the logger: not a timeout, a 401 or a 403, nor\n * anything while reporting is off. For a caller that reports only the first failure of a series: a\n * failure dropped here has told nobody, and the series begins with the first one that was written.\n * What the application's own logger does with it is the application's.\n */\nexport const apiErrorIsReported = (error: unknown): boolean => {\n  const status = apiErrorStatus(error)\n  // Neither of these is an unplanned failure. A 401 is \"nobody is logged in\", which every admin\n  // branches on before sending the user to the login page -- writing it down would mean an \"Api\n  // error\" for every unauthenticated start of the app. A 403 is \"this user may not\", which the\n  // caller shows. Both are the session rather than an endpoint breaking its contract.\n  //\n  // By status rather than by class, because the class only keeps it quiet on one of the two paths: a\n  // rejected 403 becomes `AnzuApiForbiddenError`, which is outside `LOGGED`, while one that arrives\n  // fulfilled -- as `options.validateStatus` allows -- becomes an `AnzuApiResponseCodeError`, which\n  // is inside it. Left to the class, the policy would hold or not depending on how the caller\n  // configured axios.\n  //\n  // It is the one thing the `status` field above does not leave to the application, and deliberately:\n  // an app that wanted its own unauthenticated starts in the log would be asking for noise it cannot\n  // act on, while an app that wants 404 or 409 filtered has the field to do it with.\n  if (status === HTTP_STATUS_UNAUTHORIZED || status === HTTP_STATUS_FORBIDDEN) return false\n  // The same as a 401, stopped before it went out: the refresh found the session gone.\n  if (isInCauseChain(error, (cause) => cause instanceof SessionExpiredError)) return false\n\n  return logger !== null && LOGGED.some((cls) => error instanceof cls)\n}\n\n/**\n * Reports an error once, after it has been mapped, and hands it back so the caller can throw it.\n *\n * After, not during: an error the helper raised itself -- a body that never arrived, a status it\n * refuses -- is already an `Anzu*` class by the time it reaches the mapping, so a logger placed\n * inside the mapping would never see the two cases it exists for.\n */\nexport const report = <E>(error: E, context: ApiErrorContext): E => {\n  if (logger !== null && apiErrorIsReported(error)) {\n    try {\n      // Filled in here rather than by the caller: the status belongs to the failure, and only the\n      // mapped error knows it -- the helper that built the context has not looked at the error yet.\n      logger(error as unknown as Error, { ...context, status: apiErrorStatus(error) })\n    } catch {\n      // A logger that throws must not replace the failure the caller is waiting for.\n    }\n  }\n\n  return error\n}\n\n/**\n * Turns whatever axios rejected with into one of the Anzu error classes.\n *\n * There used to be a copy of this inside each helper. The order of the checks is what decides which\n * class a failure becomes, so four copies were four chances for the same failure to arrive under\n * different names depending on which helper made the call.\n */\nexport const mapApiError = (err: unknown, context: ApiErrorContext): AnzuError => {\n  const { system, entity } = context\n  const labelSystem = context.validationSystem ?? system\n  const labelEntity = context.validationEntity ?? entity\n  // The predicates below are typed against `Error` / `AxiosError` and each begins by checking what\n  // it was handed, so narrowing here only satisfies their signatures.\n  const error = err as Error\n  const axiosError = err as AxiosError\n\n  // Already mapped -- including the errors a helper raised about its own contract. Wrapping it again\n  // would bury the class the caller branches on.\n  if (isAnzuError(err)) return err\n\n  // Before everything else, because it is not a failure: the caller stopped this request.\n  if (axiosErrorIsCancelled(err)) return new AnzuApiCancelledError(error)\n\n  // The rendered url, not `config.url`: that one is relative, carries no params, and would become\n  // this error's `message` -- the only url in the family that never went through `requestedUrl`.\n  if (axiosErrorResponseIsForbidden(axiosError)) return new AnzuApiForbiddenError(axiosError, context.url)\n\n  if (axiosErrorResponseHasValidationData(axiosError)) {\n    return new AnzuApiValidationError(axiosError, labelSystem, labelEntity, error)\n  }\n\n  if (axiosErrorResponseHasDependencyExistsData(axiosError)) {\n    return new AnzuApiDependencyExistsError(axiosError, labelSystem, labelEntity, error)\n  }\n\n  if (axiosErrorResponseHasForbiddenOperationData(axiosError)) {\n    return new AnzuApiForbiddenOperationError(axiosError, error)\n  }\n\n  if (axiosErrorIsTimeout(error)) return new AnzuApiTimeoutError(error)\n\n  if (axios.isAxiosError(err)) return new AnzuApiAxiosError(axiosError)\n\n  return new AnzuFatalError(error)\n}\n"],"mappings":";;;;;;;;;;;;;;;AAkEA,IAAaC,IAAoB,iBAGpBC,KAAyC,GAAO,MAAY;CACvE,CAAIC,EAAQ,WAAW,OAAOA,EAAQ,WAAA,oBACtC,QAAQ,MAAM,iBAAiBA,EAAQ,OAAO,KAAKC,CAAK;AAC1D,GAEIC,IAAgCH,GAavBI,KAAqB,MAAoC;CACpE,IAASC;AACX,GAKMC,IAAS;CAACC;CAAmBC;CAAgBC;AAAwB,GAO9DC,KAAkB,MAAuC;CACpE,IAAIR,aAAiBO,GAA0B,OAAOP,EAAM;CAC5D,IAAIA,aAAiBK,GAAmB,OAAOL,EAAM,MAAM,UAAU;AAGvE,GAQaS,KAAsB,MAA4B;CAC7D,IAAMC,IAASF,EAAeR,CAAK;CAmBnC,OAJIU,MAAA,OAAuCA,MAAA,OAEvCC,EAAeX,IAAQ,MAAUY,aAAiBC,CAAmB,IAAU,KAE5EZ,MAAW,QAAQG,EAAO,MAAM,MAAQJ,aAAiBc,CAAG;AACrE,GASaC,KAAa,GAAU,MAAgC;CAClE,IAAId,MAAW,QAAQQ,EAAmBT,CAAK,GAC7C,IAAI;EAGF,EAAOA,GAA2B;GAAE,GAAGD;GAAS,QAAQS,EAAeR,CAAK;EAAE,CAAC;CACjF,QAAQ,CAER;CAGF,OAAOA;AACT,GASagB,KAAe,GAAc,MAAwC;CAChF,IAAM,EAAE,WAAQ,cAAWjB,GACrBkB,IAAclB,EAAQ,oBAAoBmB,GAC1CC,IAAcpB,EAAQ,oBAAoBqB,GAG1CpB,IAAQqB,GACRC,IAAaD;CA6BnB,OAzBIE,EAAYF,CAAG,IAAUA,IAGzBG,EAAsBH,CAAG,IAAU,IAAII,EAAsBzB,CAAK,IAIlE0B,EAA8BJ,CAAU,IAAU,IAAIK,EAAsBL,GAAYvB,EAAQ,GAAG,IAEnG6B,EAAoCN,CAAU,IACzC,IAAIO,EAAuBP,GAAYL,GAAaE,GAAanB,CAAK,IAG3E8B,EAA0CR,CAAU,IAC/C,IAAIS,EAA6BT,GAAYL,GAAaE,GAAanB,CAAK,IAGjFgC,EAA4CV,CAAU,IACjD,IAAIW,EAA+BX,GAAYtB,CAAK,IAGzDkC,EAAoBlC,CAAK,IAAU,IAAImC,EAAoBnC,CAAK,IAEhEJ,EAAM,aAAayB,CAAG,IAAU,IAAIhB,EAAkBiB,CAAU,IAE7D,IAAIhB,EAAeN,CAAK;AACjC"}

package/dist/domains/api/utils/apiHelper.d.ts

@@ -0,0 +1,4 @@
+export type UrlParams = {
+    [key: string]: number | string;
+};
+export declare const replaceUrlParameters: (urlTemplate: string, urlParams: UrlParams, overrideUrlTemplate?: string) => string;

package/dist/domains/api/utils/apiHelper.js

@@ -0,0 +1,8 @@
+import { isEmptyObject as e } from "../../../shared/utils/common.js";
+import { stringUrlTemplateReplace as t } from "../../../shared/utils/string.js";
+//#region src/domains/api/utils/apiHelper.ts
+var n = (n, r, i = "") => e(r) ? n : t(i === "" ? n : i, r);
+//#endregion
+export { n as replaceUrlParameters };
+
+//# sourceMappingURL=apiHelper.js.map

package/dist/domains/api/utils/apiHelper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiHelper.js","names":["replaceUrlParameters","isEmptyObject","urlParams","urlTemplate","stringUrlTemplateReplace","overrideUrlTemplate"],"sources":["../../../../src/domains/api/utils/apiHelper.ts"],"sourcesContent":["import { stringUrlTemplateReplace } from '@/shared/utils/string'\nimport { isEmptyObject } from '@/shared/utils/common'\n\nexport type UrlParams = {\n  [key: string]: number | string\n}\n\nexport const replaceUrlParameters = (urlTemplate: string, urlParams: UrlParams, overrideUrlTemplate = '') => {\n  if (isEmptyObject(urlParams)) return urlTemplate\n  return stringUrlTemplateReplace(overrideUrlTemplate === '' ? urlTemplate : overrideUrlTemplate, urlParams)\n}\n"],"mappings":";;;AAOA,IAAaA,KAAwB,GAAqB,GAAsB,IAAsB,OAChGC,EAAcC,CAAS,IAAUC,IAC9BC,EAAyBC,MAAwB,KAAKF,IAAcE,GAAqBH,CAAS"}

package/dist/domains/api/utils/client.d.ts

@@ -0,0 +1,2 @@
+import { AxiosInstance } from 'axios';
+export type AxiosClientFn = () => AxiosInstance;

package/dist/domains/api/utils/listBody.d.ts

@@ -0,0 +1,65 @@
+import { Pagination } from '../composables/pagination';
+export type ListBody<T> = {
+    items: T[];
+    /**
+     * Which kind of list answered, read from the response rather than inferred from `pagination`.
+     *
+     * They are two different things and conflating them cost a bug: `pagination` is what to write, and
+     * for an infinite list that includes `totalCount: 0` to clear the counted mode's leftovers -- so a
+     * reader using `totalCount` to recognise the mode sees a counted list of zero items.
+     */
+    mode: 'counted' | 'infinite' | 'unknown';
+    /**
+     * What the response said about the mode it is in, plus the other mode's field cleared: a counted
+     * body carries `hasNextPage: null` and an infinite one `totalCount: 0`, so a value left over from
+     * the previous query cannot go on describing this one. A missing or malformed field of the mode's
+     * own kind is not written at all.
+     */
+    pagination: Partial<Pagination>;
+    /**
+     * Whether `totalCount` is a bound rather than a count.
+     *
+     * The backend's counted envelope carries `bigTable`, and with it on -- which is the default -- the
+     * count it sends is `offset + limit + 1`: a look-ahead that says "there is at least one more page",
+     * not how many rows exist. It is corrected to the real total only when the page came back short,
+     * which is to say only when there was nothing more to look ahead to.
+     *
+     * Page-by-page navigation does not care: the sentinel is exactly what it needs to enable Next.
+     * Anything that treats the number as a total does -- dividing by a page size to learn how many
+     * pages exist yields 2, whatever the real answer is.
+     */
+    countIsBound: boolean;
+};
+/**
+ * Reads a list response.
+ *
+ * The array is the only thing that decides whether this is a list at all. The existing shape guards
+ * test for a metadata key and nothing else, so `{ totalCount: 1 }` passed as a list and the caller
+ * got `undefined` typed as an array.
+ *
+ * Metadata only picks the mode, and is optional: a well-formed array is not worth discarding because
+ * the count beside it is missing or of the wrong type.
+ *
+ * `hasNextPage` decides, and only its absence falls through to `totalCount`. It has to be that way
+ * round, because the backend's infinite envelope carries BOTH: `ApiInfiniteResponseList` serialises
+ * `hasNextPage`, `data` and `totalCount` (the last marked `@deprecated`, which is a docblock and
+ * suppresses nothing), while the counted one carries `totalCount`, `data` and `bigTable` and never
+ * `hasNextPage`. So the presence of `hasNextPage` is the only unambiguous signal, and reading
+ * `totalCount` first would turn every infinite list in the fleet into a counted one -- with a total
+ * that is not a total: with `bigTable` on, which is the default, the counted number is a look-ahead
+ * sentinel, `offset + limit + 1`, and the infinite envelope reports that same sentinel unconditionally.
+ */
+export declare const readListBody: <T>(body: unknown, status: number, url: string | undefined) => ListBody<T>;
+/**
+ * Reads a list that arrived as a bare array.
+ *
+ * The second of the two shapes a list comes in, and a separate reader rather than one that takes
+ * either: the caller declares which one this endpoint answers with and the reader refuses the
+ * other, the way `optionalBody` makes the caller declare a body. One reader accepting both shapes
+ * is a permissive reader, and a permissive reader is what let a malformed answer through in the
+ * first place.
+ *
+ * Returns `T[]` rather than `ListBody<T>`: `mode: 'unknown'` means the envelope named no mode, and
+ * here there was no envelope to name one.
+ */
+export declare const readArrayBody: <T>(body: unknown, status: number, url: string | undefined) => T[];

package/dist/domains/api/utils/listBody.js

@@ -0,0 +1,36 @@
+import { isBoolean as e, isNumber as t, isObject as n } from "../../../shared/utils/common.js";
+import { AnzuApiResponseCodeError as r } from "../../../shared/error/AnzuApiResponseCodeError.js";
+//#region src/domains/api/utils/listBody.ts
+var i = (i, a, o) => {
+	if (!n(i) || !Array.isArray(i.data)) throw new r(a, void 0, "Expected a list body, url: " + o);
+	let { data: s, totalCount: c, hasNextPage: l, bigTable: u } = i;
+	return e(l) ? {
+		items: s,
+		mode: "infinite",
+		pagination: {
+			hasNextPage: l,
+			totalCount: 0
+		},
+		countIsBound: !1
+	} : t(c) ? {
+		items: s,
+		mode: "counted",
+		pagination: {
+			totalCount: c,
+			hasNextPage: null
+		},
+		countIsBound: u === !0
+	} : {
+		items: s,
+		mode: "unknown",
+		pagination: {},
+		countIsBound: !1
+	};
+}, a = (e, t, n) => {
+	if (!Array.isArray(e)) throw new r(t, void 0, "Expected an array body, url: " + n);
+	return e;
+};
+//#endregion
+export { a as readArrayBody, i as readListBody };
+
+//# sourceMappingURL=listBody.js.map

package/dist/domains/api/utils/listBody.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"listBody.js","names":["readListBody","isObject","body","AnzuApiResponseCodeError","status","url","isBoolean","hasNextPage","data","isNumber","totalCount","bigTable","readArrayBody"],"sources":["../../../../src/domains/api/utils/listBody.ts"],"sourcesContent":["import { AnzuApiResponseCodeError } from '@/shared/error/AnzuApiResponseCodeError'\nimport { isBoolean, isNumber, isObject } from '@/shared/utils/common'\nimport type { Pagination } from '@/domains/api/composables/pagination'\n\nexport type ListBody<T> = {\n  items: T[]\n  /**\n   * Which kind of list answered, read from the response rather than inferred from `pagination`.\n   *\n   * They are two different things and conflating them cost a bug: `pagination` is what to write, and\n   * for an infinite list that includes `totalCount: 0` to clear the counted mode's leftovers -- so a\n   * reader using `totalCount` to recognise the mode sees a counted list of zero items.\n   */\n  mode: 'counted' | 'infinite' | 'unknown'\n  /**\n   * What the response said about the mode it is in, plus the other mode's field cleared: a counted\n   * body carries `hasNextPage: null` and an infinite one `totalCount: 0`, so a value left over from\n   * the previous query cannot go on describing this one. A missing or malformed field of the mode's\n   * own kind is not written at all.\n   */\n  pagination: Partial<Pagination>\n  /**\n   * Whether `totalCount` is a bound rather than a count.\n   *\n   * The backend's counted envelope carries `bigTable`, and with it on -- which is the default -- the\n   * count it sends is `offset + limit + 1`: a look-ahead that says \"there is at least one more page\",\n   * not how many rows exist. It is corrected to the real total only when the page came back short,\n   * which is to say only when there was nothing more to look ahead to.\n   *\n   * Page-by-page navigation does not care: the sentinel is exactly what it needs to enable Next.\n   * Anything that treats the number as a total does -- dividing by a page size to learn how many\n   * pages exist yields 2, whatever the real answer is.\n   */\n  countIsBound: boolean\n}\n\n/**\n * Reads a list response.\n *\n * The array is the only thing that decides whether this is a list at all. The existing shape guards\n * test for a metadata key and nothing else, so `{ totalCount: 1 }` passed as a list and the caller\n * got `undefined` typed as an array.\n *\n * Metadata only picks the mode, and is optional: a well-formed array is not worth discarding because\n * the count beside it is missing or of the wrong type.\n *\n * `hasNextPage` decides, and only its absence falls through to `totalCount`. It has to be that way\n * round, because the backend's infinite envelope carries BOTH: `ApiInfiniteResponseList` serialises\n * `hasNextPage`, `data` and `totalCount` (the last marked `@deprecated`, which is a docblock and\n * suppresses nothing), while the counted one carries `totalCount`, `data` and `bigTable` and never\n * `hasNextPage`. So the presence of `hasNextPage` is the only unambiguous signal, and reading\n * `totalCount` first would turn every infinite list in the fleet into a counted one -- with a total\n * that is not a total: with `bigTable` on, which is the default, the counted number is a look-ahead\n * sentinel, `offset + limit + 1`, and the infinite envelope reports that same sentinel unconditionally.\n */\nexport const readListBody = <T>(body: unknown, status: number, url: string | undefined): ListBody<T> => {\n  if (!isObject(body) || !Array.isArray((body as { data?: unknown }).data)) {\n    throw new AnzuApiResponseCodeError(status, undefined, 'Expected a list body, url: ' + url)\n  }\n\n  const { data, totalCount, hasNextPage, bigTable } = body as {\n    data: T[]\n    totalCount?: unknown\n    hasNextPage?: unknown\n    bigTable?: unknown\n  }\n\n  if (isBoolean(hasNextPage)) {\n    return { items: data, mode: 'infinite', pagination: { hasNextPage, totalCount: 0 }, countIsBound: false }\n  }\n\n  if (isNumber(totalCount)) {\n    // `null`, not `false`: the field is three-valued and the paginators read it that way. `isNull`\n    // is what picks the mode -- `ADatatablePagination.vue:62,67,73` and both `ASubjectSelect.vue`\n    // take a non-null value to mean an infinite list, so `false` here says \"infinite, and there is\n    // no next page\": Next and Last go dead on every page and the total renders as the number of\n    // rows on screen. `null` is the counted list saying the infinite mode's field does not apply.\n    return {\n      items: data,\n      mode: 'counted',\n      pagination: { totalCount, hasNextPage: null },\n      countIsBound: bigTable === true,\n    }\n  }\n\n  return { items: data, mode: 'unknown', pagination: {}, countIsBound: false }\n}\n\n/**\n * Reads a list that arrived as a bare array.\n *\n * The second of the two shapes a list comes in, and a separate reader rather than one that takes\n * either: the caller declares which one this endpoint answers with and the reader refuses the\n * other, the way `optionalBody` makes the caller declare a body. One reader accepting both shapes\n * is a permissive reader, and a permissive reader is what let a malformed answer through in the\n * first place.\n *\n * Returns `T[]` rather than `ListBody<T>`: `mode: 'unknown'` means the envelope named no mode, and\n * here there was no envelope to name one.\n */\nexport const readArrayBody = <T>(body: unknown, status: number, url: string | undefined): T[] => {\n  if (!Array.isArray(body)) {\n    throw new AnzuApiResponseCodeError(status, undefined, 'Expected an array body, url: ' + url)\n  }\n\n  return body as T[]\n}\n"],"mappings":";;;AAuDA,IAAaA,KAAmB,GAAe,GAAgB,MAAyC;CACtG,IAAI,CAACC,EAASC,CAAI,KAAK,CAAC,MAAM,QAASA,EAA4B,IAAI,GACrE,MAAM,IAAIC,EAAyBC,GAAQ,KAAA,GAAW,gCAAgCC,CAAG;CAG3F,IAAM,EAAE,SAAM,eAAY,gBAAa,gBAAaH;CAyBpD,OAlBII,EAAUC,CAAW,IAChB;EAAE,OAAOC;EAAM,MAAM;EAAY,YAAY;GAAE;GAAa,YAAY;EAAE;EAAG,cAAc;CAAM,IAGtGC,EAASC,CAAU,IAMd;EACL,OAAOF;EACP,MAAM;EACN,YAAY;GAAE;GAAY,aAAa;EAAK;EAC5C,cAAcG,MAAa;CAC7B,IAGK;EAAE,OAAOH;EAAM,MAAM;EAAW,YAAY,CAAC;EAAG,cAAc;CAAM;AAC7E,GAcaI,KAAoB,GAAe,GAAgB,MAAiC;CAC/F,IAAI,CAAC,MAAM,QAAQV,CAAI,GACrB,MAAM,IAAIC,EAAyBC,GAAQ,KAAA,GAAW,kCAAkCC,CAAG;CAG7F,OAAOH;AACT"}

package/dist/domains/api/utils/response.d.ts

@@ -0,0 +1 @@
+export declare const isValidHTTPStatus: (statusCode: number) => boolean;

package/dist/domains/api/utils/response.js

@@ -0,0 +1,7 @@
+import { HTTP_STATUS_VALID_ALL as e } from "../../../shared/statusCodes.js";
+//#region src/domains/api/utils/response.ts
+var t = (t) => e.includes(t);
+//#endregion
+export { t as isValidHTTPStatus };
+
+//# sourceMappingURL=response.js.map

package/dist/domains/api/utils/response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response.js","names":["isValidHTTPStatus","HTTP_STATUS_VALID_ALL","statusCode"],"sources":["../../../../src/domains/api/utils/response.ts"],"sourcesContent":["import { HTTP_STATUS_VALID_ALL } from '@/shared/statusCodes'\n\nexport const isValidHTTPStatus = (statusCode: number) => {\n  return HTTP_STATUS_VALID_ALL.includes(statusCode)\n}\n"],"mappings":";;AAEA,IAAaA,KAAqB,MACzBC,EAAsB,SAASC,CAAU"}

package/dist/domains/auth/components/Acl.js

@@ -0,0 +1,7 @@
+import e from "./Acl.vue_vue_type_script_setup_true_lang.js";
+//#region src/domains/auth/components/Acl.vue
+var t = e;
+//#endregion
+export { t as default };
+
+//# sourceMappingURL=Acl.js.map

package/dist/domains/auth/components/Acl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Acl.js","names":["_sfc_main","Acl_vue_vue_type_script_setup_true_lang_default","Acl_default"],"sources":["../../../../src/domains/auth/components/Acl.vue"],"sourcesContent":["<script lang=\"ts\" setup generic=\"TAclValue extends RegisteredAclValue\">\nimport { computed } from 'vue'\nimport type { RegisteredAclValue } from '@/domains/auth/types/Permission'\nimport { useAuthHelpers } from '@/domains/auth/composables/defineAuth'\n\nconst props = withDefaults(\n  defineProps<{\n    // An array is evaluated with AND. Values from different systems are handled correctly --\n    // every system involved must be loaded, or the slot stays hidden -- but keeping them from one\n    // system is still the clearer thing to write.\n    permission: TAclValue | TAclValue[]\n    subject?: object\n  }>(),\n  {\n    subject: undefined,\n  }\n)\n\nconst { canSafeHelper } = useAuthHelpers<TAclValue>()\n\n/**\n * A computed, not a watcher that latches on the first `true`: it re-evaluates when its own system's\n * current user arrives, and a permission taken away is taken away without a reload.\n *\n * This is the non-throwing variant of `can()`, for templates that may render before their system is\n * there -- `canSafeHelper` answers false where `canHelper` would throw.\n */\nconst allowed = computed<boolean>(() => canSafeHelper(props.permission, props.subject, 'Acl'))\n</script>\n\n<template>\n  <slot v-if=\"allowed\" />\n</template>\n"],"mappings":""}

package/dist/domains/auth/components/Acl.vue.d.ts

@@ -0,0 +1,24 @@
+import { RegisteredAclValue } from '../types/Permission';
+declare const __VLS_export: <TAclValue extends RegisteredAclValue>(__VLS_props: NonNullable<Awaited<typeof __VLS_setup>>["props"], __VLS_ctx?: __VLS_PrettifyLocal<Pick<NonNullable<Awaited<typeof __VLS_setup>>, "attrs" | "emit" | "slots">>, __VLS_exposed?: NonNullable<Awaited<typeof __VLS_setup>>["expose"], __VLS_setup?: Promise<{
+    props: import('vue').PublicProps & __VLS_PrettifyLocal<{
+        permission: TAclValue | TAclValue[];
+        subject?: object;
+    }> & (typeof globalThis extends {
+        __VLS_PROPS_FALLBACK: infer P;
+    } ? P : {});
+    expose: (exposed: {}) => void;
+    attrs: any;
+    slots: {
+        default?: (props: {}) => any;
+    };
+    emit: {};
+}>) => import('vue').VNode & {
+    __ctx?: NonNullable<Awaited<typeof __VLS_setup>>;
+};
+declare const _default: typeof __VLS_export;
+export default _default;
+type __VLS_PrettifyLocal<T> = (T extends any ? {
+    [K in keyof T]: T[K];
+} : {
+    [K in keyof T as K]: T[K];
+}) & {};

package/dist/domains/auth/components/Acl.vue_vue_type_script_setup_true_lang.js

@@ -0,0 +1,18 @@
+import { useAuthHelpers as e } from "../composables/defineAuth.js";
+import { computed as t, createCommentVNode as n, defineComponent as r, renderSlot as i } from "vue";
+//#region src/domains/auth/components/Acl.vue?vue&type=script&setup=true&lang.ts
+var a = /*@__PURE__*/ r({
+	__name: "Acl",
+	props: {
+		permission: {},
+		subject: { default: void 0 }
+	},
+	setup(r) {
+		let a = r, { canSafeHelper: o } = e(), s = t(() => o(a.permission, a.subject, "Acl"));
+		return (e, t) => s.value ? i(e.$slots, "default", {}, void 0, void 0, 0) : n("", !0);
+	}
+});
+//#endregion
+export { a as default };
+
+//# sourceMappingURL=Acl.vue_vue_type_script_setup_true_lang.js.map

package/dist/domains/auth/components/Acl.vue_vue_type_script_setup_true_lang.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Acl.vue_vue_type_script_setup_true_lang.js","names":["_renderSlot","_createCommentVNode","Acl_vue_vue_type_script_setup_true_lang_default","props","__props","useAuthHelpers","allowed","computed","canSafeHelper","renderSlot","_ctx","createCommentVNode"],"sources":["../../../../src/domains/auth/components/Acl.vue"],"sourcesContent":["<script lang=\"ts\" setup generic=\"TAclValue extends RegisteredAclValue\">\nimport { computed } from 'vue'\nimport type { RegisteredAclValue } from '@/domains/auth/types/Permission'\nimport { useAuthHelpers } from '@/domains/auth/composables/defineAuth'\n\nconst props = withDefaults(\n  defineProps<{\n    // An array is evaluated with AND. Values from different systems are handled correctly --\n    // every system involved must be loaded, or the slot stays hidden -- but keeping them from one\n    // system is still the clearer thing to write.\n    permission: TAclValue | TAclValue[]\n    subject?: object\n  }>(),\n  {\n    subject: undefined,\n  }\n)\n\nconst { canSafeHelper } = useAuthHelpers<TAclValue>()\n\n/**\n * A computed, not a watcher that latches on the first `true`: it re-evaluates when its own system's\n * current user arrives, and a permission taken away is taken away without a reload.\n *\n * This is the non-throwing variant of `can()`, for templates that may render before their system is\n * there -- `canSafeHelper` answers false where `canHelper` would throw.\n */\nconst allowed = computed<boolean>(() => canSafeHelper(props.permission, props.subject, 'Acl'))\n</script>\n\n<template>\n  <slot v-if=\"allowed\" />\n</template>\n"],"mappings":";;;;;;;;;;EAKA,IAAMG,IAAQC,GAaR,EAAE,qBAAkBC,EAA0B,GAS9CC,IAAUC,QAAwBC,EAAcL,EAAM,YAAYA,EAAM,SAAS,KAAK,CAAC;E,iBAI/EG,EAAA,QAAZN,EAAuBU,EAAA,QAAA,WAAA,CAAA,GAAA,KAAA,GAAA,KAAA,GAAA,CAAA,I"}

package/dist/domains/auth/composables/aclAllowed.d.ts

@@ -0,0 +1,8 @@
+import { ComputedRef, MaybeRefOrGetter } from 'vue';
+import { RegisteredAclValue } from '../types/Permission';
+/**
+ * Whether a component guarded by an optional ACL may show itself. No ACL means no guard, so a component
+ * that takes one keeps its old behaviour for callers that pass none. The check never throws (see
+ * `canSafeHelper`).
+ */
+export declare function useAclAllowed(acl: MaybeRefOrGetter<RegisteredAclValue | RegisteredAclValue[] | undefined>, subject?: MaybeRefOrGetter<object | undefined>): ComputedRef<boolean>;

package/dist/domains/auth/composables/aclAllowed.js

@@ -0,0 +1,15 @@
+import { isUndefined as e } from "../../../shared/utils/common.js";
+import { useAuthHelpers as t } from "./defineAuth.js";
+import { computed as n, toValue as r } from "vue";
+//#region src/domains/auth/composables/aclAllowed.ts
+function i(i, a = void 0) {
+	let { canSafeHelper: o } = t();
+	return n(() => {
+		let t = r(i);
+		return e(t) ? !0 : o(t, r(a));
+	});
+}
+//#endregion
+export { i as useAclAllowed };
+
+//# sourceMappingURL=aclAllowed.js.map

package/dist/domains/auth/composables/aclAllowed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aclAllowed.js","names":["useAclAllowed","useAuthHelpers","computed","value","toValue","acl","isUndefined","canSafeHelper","subject"],"sources":["../../../../src/domains/auth/composables/aclAllowed.ts"],"sourcesContent":["import { computed, type ComputedRef, type MaybeRefOrGetter, toValue } from 'vue'\nimport type { RegisteredAclValue } from '@/domains/auth/types/Permission'\nimport { useAuthHelpers } from '@/domains/auth/composables/defineAuth'\nimport { isUndefined } from '@/shared/utils/common'\n\n/**\n * Whether a component guarded by an optional ACL may show itself. No ACL means no guard, so a component\n * that takes one keeps its old behaviour for callers that pass none. The check never throws (see\n * `canSafeHelper`).\n */\nexport function useAclAllowed(\n  acl: MaybeRefOrGetter<RegisteredAclValue | RegisteredAclValue[] | undefined>,\n  subject: MaybeRefOrGetter<object | undefined> = undefined\n): ComputedRef<boolean> {\n  const { canSafeHelper } = useAuthHelpers<RegisteredAclValue>()\n\n  return computed(() => {\n    const value = toValue(acl)\n    if (isUndefined(value)) return true\n\n    return canSafeHelper(value, toValue(subject))\n  })\n}\n"],"mappings":";;;;AAUA,SAAgBA,EACd,GACA,IAAgD,KAAA,GAC1B;CACtB,IAAM,EAAE,qBAAkBC,EAAmC;CAE7D,OAAOC,QAAe;EACpB,IAAMC,IAAQC,EAAQC,CAAG;EAGzB,OAFIC,EAAYH,CAAK,IAAU,KAExBI,EAAcJ,GAAOC,EAAQI,CAAO,CAAC;CAC9C,CAAC;AACH"}

package/dist/domains/auth/composables/defineAuth.d.ts

@@ -0,0 +1,49 @@
+import { AxiosInstance } from 'axios';
+import { AclValue } from '../types/Permission';
+import { AnzuUser } from '../../../shared/types/AnzuUser';
+import { UrlParams } from '../../api/utils/apiHelper';
+export type DefineAuthConfig = {
+    adminRole: string | Array<{
+        system: string;
+        adminRole: string;
+    }>;
+};
+export declare const ROLE_SUPER_ADMIN = "ROLE_SUPER_ADMIN";
+/**
+ * @param mainCurrentUserSystem - By this system currentUser object is used to get user ID.
+ * @param config
+ */
+export declare function defineAuth<TAclValue extends AclValue>(mainCurrentUserSystem: string, config?: Partial<DefineAuthConfig>): {
+    can: (acl: TAclValue, subject?: object) => boolean;
+    canForAll: (acls: TAclValue[], subject?: object) => boolean;
+    canForSome: (acls: TAclValue[], subject?: object) => boolean;
+    canSafe: (acl: TAclValue | TAclValue[], subject?: object) => boolean;
+    canOwner: (subject: object) => boolean;
+    useCurrentUser: <TCurrentUser extends AnzuUser | undefined>(system: string) => {
+        currentUser: import('vue').ComputedRef<TCurrentUser | undefined>;
+        setCurrentUser: (user: TCurrentUser) => void;
+        isCurrentUserLoaded: import('vue').ComputedRef<boolean | undefined>;
+        isSuperAdmin: import('vue').ComputedRef<boolean>;
+        isAnonymous: import('vue').ComputedRef<boolean | undefined>;
+        hasCurrentUser: import('vue').ComputedRef<false | NonNullable<TCurrentUser>>;
+        fetchCurrentUser: (client: () => AxiosInstance, endPoint?: string, urlParams?: UrlParams | undefined, entity?: string, options?: {
+            throwOnError?: boolean;
+        }) => Promise<TCurrentUser | undefined>;
+    };
+    currentUserId: import('vue').ComputedRef<number | undefined>;
+    config: {
+        adminRole: string | Array<{
+            system: string;
+            adminRole: string;
+        }>;
+    };
+};
+export declare function useAuthHelpers<TAclValue extends AclValue>(): {
+    canHelper: (acl: TAclValue, subject: object | undefined) => boolean;
+    canForAllHelper: (acls: TAclValue[], subject?: object) => boolean;
+    canOwnerHelper: (subject: object, system: string) => boolean;
+    isAdminHelper: (userRoles: string[], system: string) => boolean;
+    canSafeHelper: (acl: TAclValue | TAclValue[], subject?: object, label?: string) => boolean;
+};
+/** An ACL value carries its system in front of the first underscore: `weather_location_ui`. */
+export declare function getSystemFromAcl(acl: any): any;

package/dist/domains/auth/composables/defineAuth.js

@@ -0,0 +1,122 @@
+import { isArray as e, isNull as t, isUndefined as n } from "../../../shared/utils/common.js";
+import { useAuthStore as r } from "../store/authStore.js";
+import { objectGetValueByPath as i } from "../../../shared/utils/object.js";
+import { warnOnceInDevelopment as a } from "../../../shared/utils/development.js";
+import { Grant as o } from "../valueObject/Grant.js";
+import { isOwnerAware as s } from "../../../shared/types/OwnerAware.js";
+import { isCreatedByAware as c } from "../../../shared/types/CreatedByAware.js";
+import { useApiRequest as l } from "../../api/composables/useApiRequest.js";
+import { computed as u } from "vue";
+import "axios";
+//#region src/domains/auth/composables/defineAuth.ts
+var d = "ROLE_SUPER_ADMIN", f = { adminRole: d };
+function p(i, a = {}) {
+	let o = {
+		...f,
+		...a
+	}, s = r(), { canHelper: c, canForAllHelper: d, canOwnerHelper: p, isAdminHelper: h, canSafeHelper: g } = m(), _ = (e, t) => h(e, t), v = (e, t) => c(e, t);
+	function y(e) {
+		return p(e, i);
+	}
+	let b = (e, t) => d(e, t), x = (e, t) => g(e, t), S = (e, t) => e.length === 0 || e.some((e) => v(e, t)), C = u(() => {
+		let e = s.getCurrentUserBySystem(i), r = s.isCurrentUserLoadedBySystem(i);
+		if (!n(r) && !(n(e) || n(e.id) || t(e.id) || e.id === 0)) return e.id;
+	});
+	function w(t) {
+		let r = (e) => {
+			s.currentUsers.value.set(t, e), s.currentUsersLoaded.value.set(t, !0);
+		}, i = u(() => s.currentUsers.value.get(t)), a = u(() => s.currentUsersLoaded.value.get(t)), c = u(() => i.value ? _(i.value.roles, t) : !1), d = u(() => i.value ?? !1), f = u(() => {
+			if (!n(a.value)) return !d.value;
+		}), p = () => {
+			if (e(o.adminRole)) {
+				let e = o.adminRole.find((e) => e.system === t);
+				e && s.isAdminRoleBySystem.value.set(t, e.adminRole);
+			} else s.isAdminRoleBySystem.value.set(t, o.adminRole);
+		};
+		return {
+			currentUser: i,
+			setCurrentUser: r,
+			isCurrentUserLoaded: a,
+			isSuperAdmin: c,
+			isAnonymous: f,
+			hasCurrentUser: d,
+			fetchCurrentUser: async (e, n = "/adm/v1/users/current", a = void 0, o = "user", c = {}) => {
+				try {
+					let { execute: c } = l({
+						client: e,
+						method: "GET",
+						system: t,
+						entity: o
+					}), u = await c({
+						urlTemplate: n,
+						urlParams: a
+					});
+					return r(u), s.currentUsersLoaded.value.set(t, !0), p(), i.value;
+				} catch (e) {
+					if (s.currentUsersLoaded.value.set(t, !0), c.throwOnError) throw e;
+					return;
+				}
+			}
+		};
+	}
+	return {
+		can: v,
+		canForAll: b,
+		canForSome: S,
+		canSafe: x,
+		canOwner: y,
+		useCurrentUser: w,
+		currentUserId: C,
+		config: o
+	};
+}
+function m() {
+	let l = r(), u = (e, r) => {
+		let a = h(e), s = l.getCurrentUserBySystem(a), c = l.isCurrentUserLoadedBySystem(a);
+		if (n(c)) throw Error("Composable defineAuth must try to load currentUser first to use can function.");
+		if (n(s) || n(s.id) || t(s.id) || s.id === 0) return !1;
+		if (f(s.roles, a)) return !0;
+		let u = i(s, "resolvedPermissions." + e);
+		if (n(u)) return !1;
+		switch (u) {
+			case o.Allow: return !0;
+			case o.Deny: return !1;
+			case o.AllowOwner:
+				if (n(r)) throw Error(`Required subject for acl "${e}" to determine an ability to access the resource.`);
+				return p(r, a);
+			default: return !1;
+		}
+	}, d = (e, t) => e.length === 0 || e.every((e) => u(e, t)), f = (e, t) => {
+		let i = r().getAdminRoleBySystem(t);
+		return !n(i) && e.includes(i);
+	};
+	function p(e, r) {
+		let i = l.getCurrentUserBySystem(r), a = l.isCurrentUserLoadedBySystem(r);
+		if (n(a)) throw Error("Composable defineAuth must try to load currentUser first to use canOwner function.");
+		return n(i) || n(i.id) || t(i.id) || i.id === 0 ? !1 : s(e) ? e.owners.includes(i.id) : c(e) ? e.createdBy === i.id : !1;
+	}
+	return {
+		canHelper: u,
+		canForAllHelper: d,
+		canOwnerHelper: p,
+		isAdminHelper: f,
+		canSafeHelper: (t, r, i = "canSafe") => {
+			let o = e(t) ? t : [t];
+			if (o.length === 0) return !0;
+			for (let e of o.map((e) => h(e))) if (l.currentUsers.value.get(e), n(l.isCurrentUserLoadedBySystem(e))) return !1;
+			try {
+				return d(o, r);
+			} catch (e) {
+				let t = o.join(", ");
+				return a(`${i}:${t}`, `[${i}] the check of ${t} threw, so it is denied:`, e), !1;
+			}
+		}
+	};
+}
+function h(e) {
+	return e.split("_")[0];
+}
+//#endregion
+export { d as ROLE_SUPER_ADMIN, p as defineAuth, h as getSystemFromAcl, m as useAuthHelpers };
+
+//# sourceMappingURL=defineAuth.js.map

package/dist/domains/auth/composables/defineAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"defineAuth.js","names":["ROLE_SUPER_ADMIN","defaultConfig","defineAuth","mergedConfig","config","authStore","useAuthStore","useAuthHelpers","isAdmin","isAdminHelper","userRoles","system","can","canHelper","acl","subject","canOwner","canOwnerHelper","mainCurrentUserSystem","canForAll","canForAllHelper","acls","canSafe","canSafeHelper","canForSome","currentUserId","computed","user","userIsLoaded","isUndefined","isNull","useCurrentUser","setCurrentUser","currentUser","isCurrentUserLoaded","isSuperAdmin","hasCurrentUser","isAnonymous","storeAdminRoleBySystem","isArray","found","role","useApiRequest","res","execute","endPoint","error","options","getSystemFromAcl","permission","objectGetValueByPath","Grant","adminRole","isOwnerAware","isCreatedByAware","value","key","warnOnceInDevelopment","label"],"sources":["../../../../src/domains/auth/composables/defineAuth.ts"],"sourcesContent":["import { computed } from 'vue'\nimport { useAuthStore } from '@/domains/auth/store/authStore'\nimport { type AxiosInstance } from 'axios'\nimport type { AclValue } from '@/domains/auth/types/Permission'\nimport { isArray, isNull, isUndefined } from '@/shared/utils/common'\nimport { objectGetValueByPath } from '@/shared/utils/object'\nimport { warnOnceInDevelopment } from '@/shared/utils/development'\nimport { Grant } from '@/domains/auth/valueObject/Grant'\nimport { isOwnerAware } from '@/shared/types/OwnerAware'\nimport { isCreatedByAware } from '@/shared/types/CreatedByAware'\nimport type { AnzuUser } from '@/shared/types/AnzuUser'\nimport type { UrlParams } from '@/domains/api/utils/apiHelper'\nimport { useApiRequest } from '@/domains/api/composables/useApiRequest'\n\nexport type DefineAuthConfig = {\n  adminRole: string | Array<{ system: string; adminRole: string }>\n}\n\nexport const ROLE_SUPER_ADMIN = 'ROLE_SUPER_ADMIN'\n\nconst defaultConfig: DefineAuthConfig = {\n  adminRole: ROLE_SUPER_ADMIN,\n}\n\n/**\n * @param mainCurrentUserSystem - By this system currentUser object is used to get user ID.\n * @param config\n */\nexport function defineAuth<TAclValue extends AclValue>(\n  mainCurrentUserSystem: string,\n  config: Partial<DefineAuthConfig> = {}\n) {\n  const mergedConfig = { ...defaultConfig, ...config }\n  const authStore = useAuthStore()\n  const { canHelper, canForAllHelper, canOwnerHelper, isAdminHelper, canSafeHelper } = useAuthHelpers()\n\n  const isAdmin = (userRoles: string[], system: string) => {\n    return isAdminHelper(userRoles, system)\n  }\n\n  const can = (acl: TAclValue, subject?: object) => {\n    return canHelper(acl, subject)\n  }\n\n  function canOwner(subject: object) {\n    return canOwnerHelper(subject, mainCurrentUserSystem)\n  }\n\n  const canForAll = (acls: TAclValue[], subject?: object) => {\n    return canForAllHelper(acls, subject)\n  }\n\n  /** `can()` and `canForAll()` that never throw -- for templates and route guards. See `canSafeHelper`. */\n  const canSafe = (acl: TAclValue | TAclValue[], subject?: object) => {\n    return canSafeHelper(acl, subject)\n  }\n\n  const canForSome = (acls: TAclValue[], subject?: object) => {\n    if (acls.length === 0) {\n      return true\n    }\n    return acls.some((acl) => {\n      return can(acl, subject)\n    })\n  }\n\n  const currentUserId = computed(() => {\n    const user = authStore.getCurrentUserBySystem(mainCurrentUserSystem)\n    const userIsLoaded = authStore.isCurrentUserLoadedBySystem(mainCurrentUserSystem)\n    if (isUndefined(userIsLoaded)) {\n      return undefined\n    }\n    if (isUndefined(user) || isUndefined(user.id) || isNull(user.id) || user.id === 0) {\n      return undefined\n    }\n    return user.id\n  })\n\n  function useCurrentUser<TCurrentUser extends AnzuUser | undefined>(system: string) {\n    const setCurrentUser = (user: TCurrentUser) => {\n      authStore.currentUsers.value.set(system, user)\n      authStore.currentUsersLoaded.value.set(system, true)\n    }\n\n    const currentUser = computed((): TCurrentUser | undefined => {\n      return authStore.currentUsers.value.get(system) as TCurrentUser | undefined\n    })\n\n    const isCurrentUserLoaded = computed((): boolean | undefined => {\n      return authStore.currentUsersLoaded.value.get(system) as boolean | undefined\n    })\n\n    const isSuperAdmin = computed(() => {\n      if (currentUser.value) {\n        return isAdmin(currentUser.value.roles, system)\n      }\n      return false\n    })\n\n    const hasCurrentUser = computed(() => {\n      return currentUser.value ?? false\n    })\n\n    const isAnonymous = computed(() => {\n      if (isUndefined(isCurrentUserLoaded.value)) return undefined\n      return !hasCurrentUser.value\n    })\n\n    const storeAdminRoleBySystem = () => {\n      if (isArray(mergedConfig.adminRole)) {\n        const found = mergedConfig.adminRole.find((role) => role.system === system)\n        if (found) {\n          authStore.isAdminRoleBySystem.value.set(system, found.adminRole)\n        }\n      } else {\n        authStore.isAdminRoleBySystem.value.set(system, mergedConfig.adminRole)\n      }\n    }\n\n    /**\n     * Answers `undefined` for every failure by default, which loses the reason. `throwOnError`\n     * hands the original error back, for callers that must tell a lost session from a dead backend.\n     *\n     * A failure leaves `currentUser` as it was: unset before the first successful load, the previous\n     * user on a later call, whose permissions `can()` then keeps answering from. The system still\n     * counts as loaded either way, so `can()` does not throw for a system that was never loaded.\n     */\n    const fetchCurrentUser = async (\n      client: () => AxiosInstance,\n      endPoint = '/adm/v1/users/current',\n      urlParams: UrlParams | undefined = undefined,\n      entity = 'user',\n      options: { throwOnError?: boolean } = {}\n    ) => {\n      try {\n        // `useApiRequest`, not the older `apiFetchOne`: it is where the fleet is going, and it is\n        // the difference between a failure arriving as a bare `AnzuFatalError` and arriving as the\n        // error it actually was -- `AnzuApiAxiosError` with the response on its cause, or\n        // `AnzuApiTimeoutError`. A caller passing `throwOnError` can only tell a dead session from\n        // a dead backend if the error says which it was.\n        const { execute } = useApiRequest<NonNullable<TCurrentUser>>({\n          client,\n          method: 'GET',\n          system,\n          entity,\n        })\n        const res = await execute({ urlTemplate: endPoint, urlParams })\n        setCurrentUser(res)\n        authStore.currentUsersLoaded.value.set(system, true)\n        storeAdminRoleBySystem()\n        return currentUser.value\n      } catch (error) {\n        // Set before rethrowing too, or `can()` throws \"must try to load currentUser first\".\n        authStore.currentUsersLoaded.value.set(system, true)\n        if (options.throwOnError) throw error\n        return undefined\n      }\n    }\n\n    return {\n      currentUser,\n      setCurrentUser,\n      // `undefined` until something has tried to load this system, which is the one state\n      // `currentUser` alone cannot tell apart from \"loaded, but there is no such user\".\n      isCurrentUserLoaded,\n      isSuperAdmin,\n      isAnonymous,\n      hasCurrentUser,\n      fetchCurrentUser,\n    }\n  }\n\n  return {\n    can,\n    canForAll,\n    canForSome,\n    canSafe,\n    canOwner,\n    useCurrentUser,\n    currentUserId,\n    config: mergedConfig,\n  }\n}\n\nexport function useAuthHelpers<TAclValue extends AclValue>() {\n  const authStore = useAuthStore()\n\n  const canHelper = (acl: TAclValue, subject: object | undefined) => {\n    const system = getSystemFromAcl(acl)\n    const user = authStore.getCurrentUserBySystem(system)\n    const userIsLoaded = authStore.isCurrentUserLoadedBySystem(system)\n    if (isUndefined(userIsLoaded)) {\n      throw new Error('Composable defineAuth must try to load currentUser first to use can function.')\n    }\n    if (isUndefined(user) || isUndefined(user.id) || isNull(user.id) || user.id === 0) {\n      return false\n    }\n    if (isAdminHelper(user.roles, system)) return true\n    const permission = objectGetValueByPath(user, 'resolvedPermissions.' + acl)\n    if (isUndefined(permission)) return false\n    switch (permission) {\n      case Grant.Allow:\n        return true\n      case Grant.Deny:\n        return false\n      case Grant.AllowOwner:\n        if (isUndefined(subject))\n          throw new Error(`Required subject for acl \"${acl}\" to determine an ability to access the resource.`)\n        return canOwnerHelper(subject, system)\n      default:\n        return false\n    }\n  }\n\n  const canForAllHelper = (acls: TAclValue[], subject?: object) => {\n    if (acls.length === 0) {\n      return true\n    }\n    return acls.every((acl) => {\n      return canHelper(acl, subject)\n    })\n  }\n\n  const isAdminHelper = (userRoles: string[], system: string) => {\n    const authStore = useAuthStore()\n    const adminRole = authStore.getAdminRoleBySystem(system)\n    if (isUndefined(adminRole)) return false\n\n    return userRoles.includes(adminRole)\n  }\n\n  function canOwnerHelper(subject: object, system: string) {\n    const user = authStore.getCurrentUserBySystem(system)\n    const userIsLoaded = authStore.isCurrentUserLoadedBySystem(system)\n    if (isUndefined(userIsLoaded)) {\n      throw new Error('Composable defineAuth must try to load currentUser first to use canOwner function.')\n    }\n    if (isUndefined(user) || isUndefined(user.id) || isNull(user.id) || user.id === 0) {\n      return false\n    }\n    if (isOwnerAware(subject)) {\n      return subject.owners.includes(user.id)\n    }\n    if (isCreatedByAware(subject)) {\n      return subject.createdBy === user.id\n    }\n    return false\n  }\n\n  /**\n   * `canForAll` that answers false instead of throwing: for a system nothing has tried to load yet, which a\n   * template or a route guard may reach first, and for a check that throws, such as an `allowOwner` grant\n   * with no subject. An array is evaluated with AND.\n   *\n   * Reading each system's current user tracks that key, so a render or a computed re-evaluates when its\n   * own system arrives.\n   */\n  const canSafeHelper = (acl: TAclValue | TAclValue[], subject?: object, label = 'canSafe'): boolean => {\n    const acls = isArray(acl) ? acl : [acl]\n    if (acls.length === 0) {\n      return true\n    }\n    for (const system of acls.map((value) => getSystemFromAcl(value))) {\n      authStore.currentUsers.value.get(system)\n      if (isUndefined(authStore.isCurrentUserLoadedBySystem(system))) {\n        return false\n      }\n    }\n    try {\n      return canForAllHelper(acls, subject)\n    } catch (error) {\n      // Denied either way; without a word it looks exactly like a missing permission.\n      const key = acls.join(', ')\n      warnOnceInDevelopment(`${label}:${key}`, `[${label}] the check of ${key} threw, so it is denied:`, error)\n      return false\n    }\n  }\n\n  return {\n    canHelper,\n    canForAllHelper,\n    canOwnerHelper,\n    isAdminHelper,\n    canSafeHelper,\n  }\n}\n\n/** An ACL value carries its system in front of the first underscore: `weather_location_ui`. */\nexport function getSystemFromAcl(acl: any) {\n  const parts = acl.split('_')\n\n  return parts[0]\n}\n"],"mappings":";;;;;;;;;;;AAkBA,IAAaA,IAAmB,oBAE1BC,IAAkC,EACtC,WAAWD,EACb;AAMA,SAAgBE,EACd,GACA,IAAoC,CAAC,GACrC;CACA,IAAMC,IAAe;EAAE,GAAGF;EAAe,GAAGG;CAAO,GAC7CC,IAAYC,EAAa,GACzB,EAAE,cAAW,oBAAiB,mBAAgB,kBAAe,qBAAkBC,EAAe,GAE9FC,KAAW,GAAqB,MAC7BC,EAAcC,GAAWC,CAAM,GAGlCC,KAAO,GAAgB,MACpBC,EAAUC,GAAKC,CAAO;CAG/B,SAASC,EAAS,GAAiB;EACjC,OAAOC,EAAeF,GAASG,CAAqB;CACtD;CAEA,IAAMC,KAAa,GAAmB,MAC7BC,EAAgBC,GAAMN,CAAO,GAIhCO,KAAW,GAA8B,MACtCC,EAAcT,GAAKC,CAAO,GAG7BS,KAAc,GAAmB,MACjCH,EAAK,WAAW,KAGbA,EAAK,MAAM,MACTT,EAAIE,GAAKC,CAAO,CACxB,GAGGU,IAAgBC,QAAe;EACnC,IAAMC,IAAOtB,EAAU,uBAAuBa,CAAqB,GAC7DU,IAAevB,EAAU,4BAA4Ba,CAAqB;EAChF,IAAI,GAAYU,CAAY,KAGxB,IAAYD,CAAI,KAAKE,EAAYF,EAAK,EAAE,KAAKG,EAAOH,EAAK,EAAE,KAAKA,EAAK,OAAO,IAGhF,OAAOA,EAAK;CACd,CAAC;CAED,SAASI,EAA0D,GAAgB;EACjF,IAAMC,KAAkB,MAAuB;GAE7C,AADA3B,EAAU,aAAa,MAAM,IAAIM,GAAQgB,CAAI,GAC7CtB,EAAU,mBAAmB,MAAM,IAAIM,GAAQ,EAAI;EACrD,GAEMsB,IAAcP,QACXrB,EAAU,aAAa,MAAM,IAAIM,CAAM,CAC/C,GAEKuB,IAAsBR,QACnBrB,EAAU,mBAAmB,MAAM,IAAIM,CAAM,CACrD,GAEKwB,IAAeT,QACfO,EAAY,QACPzB,EAAQyB,EAAY,MAAM,OAAOtB,CAAM,IAEzC,EACR,GAEKyB,IAAiBV,QACdO,EAAY,SAAS,EAC7B,GAEKI,IAAcX,QAAe;GACjC,IAAI,GAAYQ,EAAoB,KAAK,GACzC,OAAO,CAACE,EAAe;EACzB,CAAC,GAEKE,UAA+B;GACnC,IAAIC,EAAQpC,EAAa,SAAS,GAAG;IACnC,IAAMqC,IAAQrC,EAAa,UAAU,MAAM,MAASsC,EAAK,WAAW9B,CAAM;IAC1E,AAAI6B,KACFnC,EAAU,oBAAoB,MAAM,IAAIM,GAAQ6B,EAAM,SAAS;GAEnE,OACE,EAAU,oBAAoB,MAAM,IAAI7B,GAAQR,EAAa,SAAS;EAE1E;EA0CA,OAAO;GACL;GACA;GAGA;GACA;GACA;GACA;GACA,yBAxCA,GACA,IAAW,yBACX,IAAmC,KAAA,GACnC,IAAS,QACT,IAAsC,CAAC,MACpC;IACH,IAAI;KAMF,IAAM,EAAE,eAAYuC,EAAyC;MAC3D;MACA,QAAQ;MACR;MACA;KACF,CAAC,GACKC,IAAM,MAAMC,EAAQ;MAAE,aAAaC;MAAU;KAAU,CAAC;KAI9D,OAHAb,EAAeW,CAAG,GAClBtC,EAAU,mBAAmB,MAAM,IAAIM,GAAQ,EAAI,GACnD2B,EAAuB,GAChBL,EAAY;IACrB,SAASa,GAAO;KAGd,IADAzC,EAAU,mBAAmB,MAAM,IAAIM,GAAQ,EAAI,GAC/CoC,EAAQ,cAAc,MAAMD;KAChC;IACF;GACF;EAYA;CACF;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA,QAAQ3C;CACV;AACF;AAEA,SAAgBI,IAA6C;CAC3D,IAAMF,IAAYC,EAAa,GAEzBO,KAAa,GAAgB,MAAgC;EACjE,IAAMF,IAASqC,EAAiBlC,CAAG,GAC7Ba,IAAOtB,EAAU,uBAAuBM,CAAM,GAC9CiB,IAAevB,EAAU,4BAA4BM,CAAM;EACjE,IAAIkB,EAAYD,CAAY,GAC1B,MAAU,MAAM,+EAA+E;EAEjG,IAAIC,EAAYF,CAAI,KAAKE,EAAYF,EAAK,EAAE,KAAKG,EAAOH,EAAK,EAAE,KAAKA,EAAK,OAAO,GAC9E,OAAO;EAET,IAAIlB,EAAckB,EAAK,OAAOhB,CAAM,GAAG,OAAO;EAC9C,IAAMsC,IAAaC,EAAqBvB,GAAM,yBAAyBb,CAAG;EAC1E,IAAIe,EAAYoB,CAAU,GAAG,OAAO;EACpC,QAAQA,GAAR;GACE,KAAKE,EAAM,OACT,OAAO;GACT,KAAKA,EAAM,MACT,OAAO;GACT,KAAKA,EAAM;IACT,IAAItB,EAAYd,CAAO,GACrB,MAAU,MAAM,6BAA6BD,EAAI,kDAAkD;IACrG,OAAOG,EAAeF,GAASJ,CAAM;GACvC,SACE,OAAO;EACX;CACF,GAEMS,KAAmB,GAAmB,MACtCC,EAAK,WAAW,KAGbA,EAAK,OAAO,MACVR,EAAUC,GAAKC,CAAO,CAC9B,GAGGN,KAAiB,GAAqB,MAAmB;EAE7D,IAAM2C,IADY9C,EACA,CAAA,CAAU,qBAAqBK,CAAM;EAGvD,OAFA,CAAIkB,EAAYuB,CAAS,KAElB1C,EAAU,SAAS0C,CAAS;CACrC;CAEA,SAASnC,EAAe,GAAiB,GAAgB;EACvD,IAAMU,IAAOtB,EAAU,uBAAuBM,CAAM,GAC9CiB,IAAevB,EAAU,4BAA4BM,CAAM;EACjE,IAAIkB,EAAYD,CAAY,GAC1B,MAAU,MAAM,oFAAoF;EAWtG,OATIC,EAAYF,CAAI,KAAKE,EAAYF,EAAK,EAAE,KAAKG,EAAOH,EAAK,EAAE,KAAKA,EAAK,OAAO,IACvE,KAEL0B,EAAatC,CAAO,IACfA,EAAQ,OAAO,SAASY,EAAK,EAAE,IAEpC2B,EAAiBvC,CAAO,IACnBA,EAAQ,cAAcY,EAAK,KAE7B;CACT;CA+BA,OAAO;EACL;EACA;EACA;EACA;EACA,gBA1BqB,GAA8B,GAAkB,IAAQ,cAAuB;GACpG,IAAMN,IAAOkB,EAAQzB,CAAG,IAAIA,IAAM,CAACA,CAAG;GACtC,IAAIO,EAAK,WAAW,GAClB,OAAO;GAET,KAAK,IAAMV,KAAUU,EAAK,KAAK,MAAU2B,EAAiBO,CAAK,CAAC,GAE9D,IADAlD,EAAU,aAAa,MAAM,IAAIM,CAAM,GACnCkB,EAAYxB,EAAU,4BAA4BM,CAAM,CAAC,GAC3D,OAAO;GAGX,IAAI;IACF,OAAOS,EAAgBC,GAAMN,CAAO;GACtC,SAAS+B,GAAO;IAEd,IAAMU,IAAMnC,EAAK,KAAK,IAAI;IAE1B,OADAoC,EAAsB,GAAGC,EAAM,GAAGF,KAAO,IAAIE,EAAM,iBAAiBF,EAAI,2BAA2BV,CAAK,GACjG;GACT;EACF;CAQA;AACF;AAGA,SAAgBE,EAAiB,GAAU;CAGzC,OAFclC,EAAI,MAAM,GAEjB,CAAA,CAAM;AACf"}

package/dist/domains/auth/composables/refreshSession.d.ts

@@ -0,0 +1,49 @@
+import { InternalAxiosRequestConfig } from 'axios';
+export type RefreshResult = {
+    type: 'refreshed';
+} | {
+    type: 'session-expired';
+} | {
+    type: 'auth-unavailable';
+    error: unknown;
+};
+/** What the refresh needs to know about the auth cookies. */
+export interface AuthCookieState {
+    refreshTokenExists: unknown;
+    jwtPayload: string | null | undefined;
+}
+/**
+ * The session refresh, single flight: a refresh already running is joined, otherwise a new one
+ * starts; a finished result is never reused.
+ *
+ * Only a 401 means the session is gone. A 400 (`unable_to_refresh`) can equally mean another tab
+ * rotated the token first -- the backend rotation is not atomic -- which a changed JWT cookie shows,
+ * up to a second later when that tab's answer arrives after this one's.
+ * Everything else is the auth backend being unavailable, never a reason to log out.
+ */
+export declare function createRefreshSession(options: {
+    /** Calls the refresh endpoint; rejects with whatever the api helper throws. */
+    refresh: () => Promise<unknown>;
+    /** The JWT payload cookie as it is now. */
+    jwtPayload: () => string | null | undefined;
+}): () => Promise<RefreshResult>;
+/**
+ * The axios request interceptor that refreshes an expired JWT before a request goes out, with the
+ * `runWhen` that keeps it off the auth endpoints themselves. Concurrent requests share one refresh
+ * (`refreshSession`), and a request is rejected with `SessionExpiredError` (after `logout`) or
+ * `AuthUnavailableError` (the user stays logged in).
+ */
+export declare function createRefreshRequestInterceptor(options: {
+    cookies: () => AuthCookieState;
+    refreshSession: () => Promise<RefreshResult>;
+    logout: () => void;
+    /** Requests to these urls (the auth endpoints) are never held for a refresh. */
+    skipUrlPrefix: string;
+    /** A JWT that is still there but past its expiry also needs a refresh (default: only a missing one). */
+    jwtExpired?: () => boolean;
+}): {
+    interceptor: (requestConfig: InternalAxiosRequestConfig) => Promise<InternalAxiosRequestConfig>;
+    options: {
+        runWhen: (config: import('axios').AxiosRequestConfig) => boolean;
+    };
+};

package/dist/domains/auth/composables/refreshSession.js

@@ -0,0 +1,56 @@
+import { isDefined as e, isNull as t } from "../../../shared/utils/common.js";
+import { AuthUnavailableError as n } from "../../../shared/error/AuthUnavailableError.js";
+import { SessionExpiredError as r } from "../../../shared/error/SessionExpiredError.js";
+import { isInCauseChain as i } from "../../../shared/error/isInCauseChain.js";
+import { skipUrlPrefixes as a } from "../../api/composables/defineApiClient.js";
+import o from "axios";
+//#region src/domains/auth/composables/refreshSession.ts
+var s = 400, c = 401, l = 1e3, u = 100, d = (t) => {
+	let n;
+	return i(t, (t) => !o.isAxiosError(t) || !e(t.response) ? !1 : (n = t.response.status, !0)), n;
+};
+function f(n) {
+	let r = null, i = async (r) => {
+		for (let i = 0;; i += u) {
+			let a = n.jwtPayload();
+			if (e(a) && !t(a) && a !== r) return !0;
+			if (i >= l) return !1;
+			await new Promise((e) => setTimeout(e, u));
+		}
+	}, a = async () => {
+		let e = n.jwtPayload();
+		try {
+			return await n.refresh(), { type: "refreshed" };
+		} catch (t) {
+			let n = d(t);
+			return n === c ? { type: "session-expired" } : n === s ? await i(e) ? { type: "refreshed" } : { type: "session-expired" } : {
+				type: "auth-unavailable",
+				error: t
+			};
+		}
+	};
+	return () => (t(r) && (r = a().finally(() => {
+		r = null;
+	})), r);
+}
+function p(e) {
+	let t = /* @__PURE__ */ new WeakSet();
+	return {
+		interceptor: async (i) => {
+			let { refreshTokenExists: a, jwtPayload: s } = e.cookies();
+			if (!a && !s) throw e.logout(), new r();
+			if (a && (!s || e.jwtExpired?.())) {
+				let a = await e.refreshSession();
+				if (a.type === "session-expired") throw t.has(a) || (t.add(a), e.logout()), new r();
+				if (i.signal?.aborted) throw new o.CanceledError();
+				if (a.type === "auth-unavailable") throw new n(a.error);
+			}
+			return i;
+		},
+		options: { runWhen: a(e.skipUrlPrefix) }
+	};
+}
+//#endregion
+export { p as createRefreshRequestInterceptor, f as createRefreshSession };
+
+//# sourceMappingURL=refreshSession.js.map

package/dist/domains/auth/composables/refreshSession.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refreshSession.js","names":["axios","HTTP_BAD_REQUEST","HTTP_UNAUTHORIZED","ROTATION_GRACE_MS","ROTATION_POLL_MS","httpStatusInCauseChain","status","isInCauseChain","error","value","isDefined","createRefreshSession","inFlight","rotatedMeanwhile","waited","now","options","isNull","before","resolve","run","jwtPayloadBefore","createRefreshRequestInterceptor","loggedOut","refreshTokenExists","jwtPayload","SessionExpiredError","result","requestConfig","AuthUnavailableError","skipUrlPrefixes"],"sources":["../../../../src/domains/auth/composables/refreshSession.ts"],"sourcesContent":["import axios, { type InternalAxiosRequestConfig } from 'axios'\nimport { isDefined, isNull } from '@/shared/utils/common'\nimport { skipUrlPrefixes } from '@/domains/api/composables/defineApiClient'\nimport { AuthUnavailableError } from '@/shared/error/AuthUnavailableError'\nimport { isInCauseChain } from '@/shared/error/isInCauseChain'\nimport { SessionExpiredError } from '@/shared/error/SessionExpiredError'\n\nconst HTTP_BAD_REQUEST = 400\nconst HTTP_UNAUTHORIZED = 401\n// How long a 400 waits for the cookie of the tab whose refresh won: its answer can come after this one's.\nconst ROTATION_GRACE_MS = 1000\nconst ROTATION_POLL_MS = 100\n\nexport type RefreshResult =\n  | { type: 'refreshed' }\n  | { type: 'session-expired' }\n  | { type: 'auth-unavailable'; error: unknown }\n\n/** What the refresh needs to know about the auth cookies. */\nexport interface AuthCookieState {\n  refreshTokenExists: unknown\n  jwtPayload: string | null | undefined\n}\n\n// `undefined`: no response anywhere in the chain -- a timeout or a network failure.\nconst httpStatusInCauseChain = (error: unknown): number | undefined => {\n  let status: number | undefined\n  isInCauseChain(error, (value) => {\n    if (!axios.isAxiosError(value) || !isDefined(value.response)) return false\n    status = value.response.status\n    return true\n  })\n  return status\n}\n\n/**\n * The session refresh, single flight: a refresh already running is joined, otherwise a new one\n * starts; a finished result is never reused.\n *\n * Only a 401 means the session is gone. A 400 (`unable_to_refresh`) can equally mean another tab\n * rotated the token first -- the backend rotation is not atomic -- which a changed JWT cookie shows,\n * up to a second later when that tab's answer arrives after this one's.\n * Everything else is the auth backend being unavailable, never a reason to log out.\n */\nexport function createRefreshSession(options: {\n  /** Calls the refresh endpoint; rejects with whatever the api helper throws. */\n  refresh: () => Promise<unknown>\n  /** The JWT payload cookie as it is now. */\n  jwtPayload: () => string | null | undefined\n}): () => Promise<RefreshResult> {\n  let inFlight: Promise<RefreshResult> | null = null\n\n  const rotatedMeanwhile = async (before: string | null | undefined): Promise<boolean> => {\n    for (let waited = 0; ; waited += ROTATION_POLL_MS) {\n      const now = options.jwtPayload()\n      if (isDefined(now) && !isNull(now) && now !== before) return true\n      if (waited >= ROTATION_GRACE_MS) return false\n      await new Promise((resolve) => setTimeout(resolve, ROTATION_POLL_MS))\n    }\n  }\n\n  const run = async (): Promise<RefreshResult> => {\n    // Before the request: with a refresh in flight the cookie is already there, so only a changed\n    // value says something afterwards.\n    const jwtPayloadBefore = options.jwtPayload()\n    try {\n      await options.refresh()\n      return { type: 'refreshed' }\n    } catch (error) {\n      const status = httpStatusInCauseChain(error)\n      if (status === HTTP_UNAUTHORIZED) return { type: 'session-expired' }\n      if (status === HTTP_BAD_REQUEST) {\n        return (await rotatedMeanwhile(jwtPayloadBefore)) ? { type: 'refreshed' } : { type: 'session-expired' }\n      }\n      return { type: 'auth-unavailable', error }\n    }\n  }\n\n  return () => {\n    if (isNull(inFlight)) {\n      inFlight = run().finally(() => {\n        inFlight = null\n      })\n    }\n    return inFlight\n  }\n}\n\n/**\n * The axios request interceptor that refreshes an expired JWT before a request goes out, with the\n * `runWhen` that keeps it off the auth endpoints themselves. Concurrent requests share one refresh\n * (`refreshSession`), and a request is rejected with `SessionExpiredError` (after `logout`) or\n * `AuthUnavailableError` (the user stays logged in).\n */\nexport function createRefreshRequestInterceptor(options: {\n  cookies: () => AuthCookieState\n  refreshSession: () => Promise<RefreshResult>\n  logout: () => void\n  /** Requests to these urls (the auth endpoints) are never held for a refresh. */\n  skipUrlPrefix: string\n  /** A JWT that is still there but past its expiry also needs a refresh (default: only a missing one). */\n  jwtExpired?: () => boolean\n}) {\n  // Requests waiting on one refresh share its result: log out once for it, not once per request.\n  const loggedOut = new WeakSet<RefreshResult>()\n\n  const interceptor = async (requestConfig: InternalAxiosRequestConfig): Promise<InternalAxiosRequestConfig> => {\n    const { refreshTokenExists, jwtPayload } = options.cookies()\n    if (!refreshTokenExists && !jwtPayload) {\n      options.logout()\n      throw new SessionExpiredError()\n    }\n    if (refreshTokenExists && (!jwtPayload || options.jwtExpired?.())) {\n      const result = await options.refreshSession()\n      if (result.type === 'session-expired') {\n        if (!loggedOut.has(result)) {\n          loggedOut.add(result)\n          options.logout()\n        }\n        throw new SessionExpiredError()\n      }\n      // Stopped while it waited (its page is gone): cancelled, as it would have been on its way out, and not a\n      // failure to show on the page the user went to. Axios checks the signal only once the interceptors are done.\n      if (requestConfig.signal?.aborted) throw new axios.CanceledError()\n      if (result.type === 'auth-unavailable') throw new AuthUnavailableError(result.error)\n    }\n    return requestConfig\n  }\n\n  return {\n    interceptor,\n    options: { runWhen: skipUrlPrefixes(options.skipUrlPrefix) },\n  }\n}\n"],"mappings":";;;;;;;AAOA,IAAMC,IAAmB,KACnBC,IAAoB,KAEpBC,IAAoB,KACpBC,IAAmB,KAcnBC,KAA0B,MAAuC;CACrE,IAAIC;CAMJ,OALAC,EAAeC,IAAQ,MACjB,CAACR,EAAM,aAAaS,CAAK,KAAK,CAACC,EAAUD,EAAM,QAAQ,IAAU,MACrE,IAASA,EAAM,SAAS,QACjB,GACR,GACMH;AACT;AAWA,SAAgBK,EAAqB,GAKJ;CAC/B,IAAIC,IAA0C,MAExCC,IAAmB,OAAO,MAAwD;EACtF,KAAK,IAAIC,IAAS,IAAK,KAAUV,GAAkB;GACjD,IAAMW,IAAMC,EAAQ,WAAW;GAC/B,IAAIN,EAAUK,CAAG,KAAK,CAACE,EAAOF,CAAG,KAAKA,MAAQG,GAAQ,OAAO;GAC7D,IAAIJ,KAAUX,GAAmB,OAAO;GACxC,MAAM,IAAI,SAAS,MAAY,WAAWgB,GAASf,CAAgB,CAAC;EACtE;CACF,GAEMgB,IAAM,YAAoC;EAG9C,IAAMC,IAAmBL,EAAQ,WAAW;EAC5C,IAAI;GAEF,OADA,MAAMA,EAAQ,QAAQ,GACf,EAAE,MAAM,YAAY;EAC7B,SAASR,GAAO;GACd,IAAMF,IAASD,EAAuBG,CAAK;GAK3C,OAJIF,MAAWJ,IAA0B,EAAE,MAAM,kBAAkB,IAC/DI,MAAWL,IACL,MAAMY,EAAiBQ,CAAgB,IAAK,EAAE,MAAM,YAAY,IAAI,EAAE,MAAM,kBAAkB,IAEjG;IAAE,MAAM;IAAoB;GAAM;EAC3C;CACF;CAEA,cACMJ,EAAOL,CAAQ,MACjB,IAAWQ,EAAI,CAAC,CAAC,cAAc;EAC7B,IAAW;CACb,CAAC,IAEIR;AAEX;AAQA,SAAgBU,EAAgC,GAQ7C;CAED,IAAMC,oBAAY,IAAI,QAAuB;CAyB7C,OAAO;EACL,oBAxByB,MAAmF;GAC5G,IAAM,EAAE,uBAAoB,kBAAeP,EAAQ,QAAQ;GAC3D,IAAI,CAACQ,KAAsB,CAACC,GAE1B,MADAT,EAAQ,OAAO,GACT,IAAIU,EAAoB;GAEhC,IAAIF,MAAuB,CAACC,KAAcT,EAAQ,aAAa,IAAI;IACjE,IAAMW,IAAS,MAAMX,EAAQ,eAAe;IAC5C,IAAIW,EAAO,SAAS,mBAKlB,MAJKJ,EAAU,IAAII,CAAM,MACvBJ,EAAU,IAAII,CAAM,GACpBX,EAAQ,OAAO,IAEX,IAAIU,EAAoB;IAIhC,IAAIE,EAAc,QAAQ,SAAS,MAAM,IAAI5B,EAAM,cAAc;IACjE,IAAI2B,EAAO,SAAS,oBAAoB,MAAM,IAAIE,EAAqBF,EAAO,KAAK;GACrF;GACA,OAAOC;EACT;EAIE,SAAS,EAAE,SAASE,EAAgBd,EAAQ,aAAa,EAAE;CAC7D;AACF"}