@atlasauth/react 0.19.0 → 0.21.0

package/dist/compat-kinde.js

@@ -0,0 +1,184 @@
+"use strict";
+'use client';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.kindeUserFrom = kindeUserFrom;
+exports.kindeSessionFrom = kindeSessionFrom;
+exports.useKindeAuthCompat = useKindeAuthCompat;
+exports.useKindeBrowserClientCompat = useKindeBrowserClientCompat;
+/**
+ * Drop-in helpers for apps moving to Atlas from Kinde (`@kinde-oss/kinde-auth-react`
+ * and the browser side of `@kinde-oss/kinde-auth-nextjs`).
+ *
+ * `atlas migrate code --from kinde` rewrites `useKindeAuth()` to
+ * {@link useKindeAuthCompat} and `useKindeBrowserClient()` to
+ * {@link useKindeBrowserClientCompat}, so call sites keep the Kinde shapes
+ * (`user.given_name`, `getPermission(key).isGranted`, `organization.orgCode`, …)
+ * and run on day one. Both are thin projections over the `<AtlasProvider>` state;
+ * move call sites to `useUser()` / `useAuth()` / `useOrganization()` at your own pace.
+ *
+ * What maps, and how:
+ *  - the user → Kinde's `{ id, email, given_name, family_name, picture, username, phone_number }`;
+ *  - permissions → the session's organization permissions plus its app-level
+ *    permissions (`org_permissions` / `app_permissions` claims);
+ *  - the organization → the active Atlas organization (`orgCode` is its id);
+ *  - `accessToken` / `getAccessToken()` → the decoded Atlas session claims, and the
+ *    raw token is the Atlas session JWT;
+ *  - feature flags have no Atlas counterpart: the flag getters always return the
+ *    default value you pass (the codemod marks every call site).
+ *
+ * Every getter works with or without `await`, so code written for either the
+ * synchronous (v4) or the asynchronous (v5) Kinde React API keeps working.
+ */
+const react_1 = require("react");
+const AtlasProvider_1 = require("./AtlasProvider");
+const components_shared_1 = require("./components-shared");
+/** Project an Atlas user onto Kinde's user shape. */
+function kindeUserFrom(user) {
+    if (!user)
+        return null;
+    const emails = user.email_addresses ?? [];
+    const email = emails.find((e) => e.primary) ?? emails.find((e) => e.verified) ?? emails[0];
+    const phones = user.phone_numbers ?? [];
+    const phone = phones.find((p) => p.primary) ?? phones[0];
+    return {
+        id: user.id,
+        email: email?.email_address ?? null,
+        given_name: user.first_name,
+        family_name: user.last_name,
+        picture: user.image_url,
+        username: user.username,
+        phone_number: phone?.phone_number ?? null,
+    };
+}
+/** Organization permissions plus app-level permissions, deduplicated. */
+function heldPermissions(claims) {
+    const out = new Set();
+    for (const list of [claims?.org_permissions, claims?.app_permissions]) {
+        if (!Array.isArray(list))
+            continue;
+        for (const p of list)
+            if (typeof p === 'string')
+                out.add(p);
+    }
+    return [...out];
+}
+function flagType(value) {
+    return typeof value === 'boolean' ? 'boolean' : typeof value === 'number' ? 'integer' : 'string';
+}
+/** The flag getters: Atlas has no feature flags, so each returns the default it is given. */
+function flagGetters() {
+    return {
+        getFlag(code, defaultValue, _type) {
+            return { code, type: flagType(defaultValue), value: defaultValue, is_default: true, defaultValue };
+        },
+        getBooleanFlag(_code, defaultValue) {
+            return defaultValue;
+        },
+        getStringFlag(_code, defaultValue) {
+            return defaultValue;
+        },
+        getIntegerFlag(_code, defaultValue) {
+            return defaultValue;
+        },
+    };
+}
+/**
+ * Pure projection of the provider state onto the members `useKindeAuth()` and
+ * `useKindeBrowserClient()` share. Exported for tests and custom wiring.
+ */
+function kindeSessionFrom(state) {
+    const signedIn = state.status === 'signed_in';
+    const claims = signedIn ? state.claims : null;
+    const orgCode = claims?.org_id ?? null;
+    const memberships = signedIn ? (state.memberships ?? []) : [];
+    const active = memberships.find((m) => m.organization.id === orgCode) ?? null;
+    const user = signedIn ? kindeUserFrom(state.user) : null;
+    const permissions = { permissions: heldPermissions(claims), orgCode };
+    const organization = orgCode
+        ? { orgCode, orgName: active?.organization.name ?? null }
+        : null;
+    const userOrganizations = signedIn
+        ? {
+            orgCodes: memberships.map((m) => m.organization.id),
+            orgs: memberships.map((m) => ({ code: m.organization.id, name: m.organization.name })),
+        }
+        : null;
+    return {
+        isLoading: state.status === 'loading',
+        isAuthenticated: signedIn,
+        user,
+        permissions,
+        organization,
+        userOrganizations,
+        /** The decoded Atlas session claims (Kinde's decoded access token). */
+        accessToken: claims,
+        getUser: () => user,
+        getPermission: (key) => ({
+            isGranted: permissions.permissions.includes(key),
+            orgCode,
+        }),
+        getPermissions: () => permissions,
+        getOrganization: () => organization,
+        getUserOrganizations: () => userOrganizations,
+        getAccessToken: () => claims,
+        /** A claim of the Atlas session token, as `{ name, value }`; null when signed out. */
+        getClaim: (name, _tokenType) => claims ? { name, value: claims[name] ?? null } : null,
+        ...flagGetters(),
+    };
+}
+function returnPath(options) {
+    return options.app_state?.redirectTo ?? options.redirectURL ?? options.post_login_redirect_url;
+}
+/**
+ * `useKindeAuth()` from `@kinde-oss/kinde-auth-react`, on Atlas. `login()` and
+ * `register()` open your Atlas sign-in / sign-up pages; `logout(url?)` signs out
+ * and goes to `url` (default `/`); `getToken()` resolves the Atlas session JWT.
+ */
+function useKindeAuthCompat() {
+    const atlas = (0, AtlasProvider_1.useAtlas)();
+    return {
+        ...kindeSessionFrom(atlas),
+        error: undefined,
+        login: async (options = {}) => (0, components_shared_1.navigateTo)((0, components_shared_1.withRedirect)(options.signInUrl ?? '/sign-in', returnPath(options))),
+        register: async (options = {}) => (0, components_shared_1.navigateTo)((0, components_shared_1.withRedirect)(options.signUpUrl ?? '/sign-up', returnPath(options))),
+        logout: async (options) => {
+            await atlas.signOut();
+            const to = typeof options === 'string' ? options : (options?.redirectUrl ?? options?.returnTo);
+            (0, components_shared_1.navigateTo)(to ?? '/');
+        },
+        getToken: async () => (await atlas.getToken()) ?? undefined,
+    };
+}
+/**
+ * `useKindeBrowserClient()` from `@kinde-oss/kinde-auth-nextjs`, on Atlas.
+ * `accessTokenRaw` / `getToken()` hold the latest Atlas session JWT (null until the
+ * first one is fetched); for a request, prefer `await useAuth().getToken()`, which
+ * is always fresh. `refreshData()` reloads the user and session.
+ */
+function useKindeBrowserClientCompat() {
+    const atlas = (0, AtlasProvider_1.useAtlas)();
+    const [token, setToken] = (0, react_1.useState)(null);
+    (0, react_1.useEffect)(() => {
+        if (atlas.status !== 'signed_in') {
+            setToken(null);
+            return;
+        }
+        let live = true;
+        void atlas.getToken().then((t) => live && setToken(t), () => live && setToken(null));
+        return () => {
+            live = false;
+        };
+    }, [atlas.status, atlas.claims]);
+    return {
+        ...kindeSessionFrom(atlas),
+        error: null,
+        accessTokenRaw: token,
+        accessTokenEncoded: token,
+        getAccessTokenRaw: () => token,
+        getToken: () => token,
+        refreshData: async () => {
+            await atlas.reload();
+        },
+    };
+}
+//# sourceMappingURL=compat-kinde.js.map

package/dist/compat-kinde.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compat-kinde.js","sourceRoot":"","sources":["../src/compat-kinde.ts"],"names":[],"mappings":";AAAA,YAAY,CAAC;;AA2Fb,sCAeC;AAsCD,4CAwCC;AAuBD,gDAgBC;AAQD,kEA4BC;AAjQD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,iCAA4C;AAC5C,mDAA2C;AAC3C,2DAA+D;AA8D/D,qDAAqD;AACrD,SAAgB,aAAa,CAAC,IAAsB;IAClD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;IACzD,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,KAAK,EAAE,aAAa,IAAI,IAAI;QACnC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,IAAI,CAAC,SAAS;QAC3B,OAAO,EAAE,IAAI,CAAC,SAAS;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,YAAY,EAAE,KAAK,EAAE,YAAY,IAAI,IAAI;KAC1C,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,SAAS,eAAe,CAAC,MAA4B;IACnD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,CAAC;QACtE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnG,CAAC;AAED,6FAA6F;AAC7F,SAAS,WAAW;IAClB,OAAO;QACL,OAAO,CAAI,IAAY,EAAE,YAAe,EAAE,KAAc;YACtD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QACrG,CAAC;QACD,cAAc,CAAC,KAAa,EAAE,YAAsB;YAClD,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,aAAa,CAAC,KAAa,EAAE,YAAqB;YAChD,OAAO,YAAY,CAAC;QACtB,CAAC;QACD,cAAc,CAAC,KAAa,EAAE,YAAqB;YACjD,OAAO,YAAY,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,KAAuB;IACtD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC;IAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,MAAM,OAAO,GAAG,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC;IACvC,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC;IAC9E,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,MAAM,WAAW,GAA2B,EAAE,WAAW,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IAC9F,MAAM,YAAY,GAAmC,OAAO;QAC1D,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,IAAI,IAAI,IAAI,EAAE;QACzD,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,iBAAiB,GAAwC,QAAQ;QACrE,CAAC,CAAC;YACE,QAAQ,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC;YACnD,IAAI,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;SACvF;QACH,CAAC,CAAC,IAAI,CAAC;IACT,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,MAAM,KAAK,SAAS;QACrC,eAAe,EAAE,QAAQ;QACzB,IAAI;QACJ,WAAW;QACX,YAAY;QACZ,iBAAiB;QACjB,uEAAuE;QACvE,WAAW,EAAE,MAAM;QACnB,OAAO,EAAE,GAA2B,EAAE,CAAC,IAAI;QAC3C,aAAa,EAAE,CAAC,GAAW,EAAyB,EAAE,CAAC,CAAC;YACtD,SAAS,EAAE,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;YAChD,OAAO;SACR,CAAC;QACF,cAAc,EAAE,GAA2B,EAAE,CAAC,WAAW;QACzD,eAAe,EAAE,GAAmC,EAAE,CAAC,YAAY;QACnE,oBAAoB,EAAE,GAAwC,EAAE,CAAC,iBAAiB;QAClF,cAAc,EAAE,GAAyB,EAAE,CAAC,MAAM;QAClD,sFAAsF;QACtF,QAAQ,EAAE,CAAC,IAAY,EAAE,UAAmB,EAA2B,EAAE,CACvE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI;QACvD,GAAG,WAAW,EAAE;KACjB,CAAC;AACJ,CAAC;AAcD,SAAS,UAAU,CAAC,OAAgC;IAClD,OAAO,OAAO,CAAC,SAAS,EAAE,UAAU,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,uBAAuB,CAAC;AACjG,CAAC;AAED;;;;GAIG;AACH,SAAgB,kBAAkB;IAChC,MAAM,KAAK,GAAG,IAAA,wBAAQ,GAAE,CAAC;IACzB,OAAO;QACL,GAAG,gBAAgB,CAAC,KAAK,CAAC;QAC1B,KAAK,EAAE,SAAS;QAChB,KAAK,EAAE,KAAK,EAAE,UAAmC,EAAE,EAAiB,EAAE,CACpE,IAAA,8BAAU,EAAC,IAAA,gCAAY,EAAC,OAAO,CAAC,SAAS,IAAI,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;QAChF,QAAQ,EAAE,KAAK,EAAE,UAAmC,EAAE,EAAiB,EAAE,CACvE,IAAA,8BAAU,EAAC,IAAA,gCAAY,EAAC,OAAO,CAAC,SAAS,IAAI,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;QAChF,MAAM,EAAE,KAAK,EAAE,OAA8D,EAAiB,EAAE;YAC9F,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;YACtB,MAAM,EAAE,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,WAAW,IAAI,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC/F,IAAA,8BAAU,EAAC,EAAE,IAAI,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,QAAQ,EAAE,KAAK,IAAiC,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC,IAAI,SAAS;KACzF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,2BAA2B;IACzC,MAAM,KAAK,GAAG,IAAA,wBAAQ,GAAE,CAAC;IACzB,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAA,gBAAQ,EAAgB,IAAI,CAAC,CAAC;IACxD,IAAA,iBAAS,EAAC,GAAG,EAAE;QACb,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACjC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACf,OAAO;QACT,CAAC;QACD,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC,IAAI,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC,EAC1B,GAAG,EAAE,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,CAC7B,CAAC;QACF,OAAO,GAAG,EAAE;YACV,IAAI,GAAG,KAAK,CAAC;QACf,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACjC,OAAO;QACL,GAAG,gBAAgB,CAAC,KAAK,CAAC;QAC1B,KAAK,EAAE,IAAI;QACX,cAAc,EAAE,KAAK;QACrB,kBAAkB,EAAE,KAAK;QACzB,iBAAiB,EAAE,GAAkB,EAAE,CAAC,KAAK;QAC7C,QAAQ,EAAE,GAAkB,EAAE,CAAC,KAAK;QACpC,WAAW,EAAE,KAAK,IAAmB,EAAE;YACrC,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/compat-msal.d.ts

@@ -0,0 +1,84 @@
+import type { AtlasUser } from './types';
+/** MSAL's `AccountInfo`, as far as apps read it. */
+export interface MsalCompatAccount {
+    homeAccountId: string;
+    localAccountId: string;
+    environment: string;
+    tenantId: string;
+    username: string;
+    name?: string;
+    idTokenClaims?: Record<string, unknown>;
+}
+export interface MsalCompatAuthResult {
+    accessToken: string;
+    idToken: string;
+    account: MsalCompatAccount;
+    scopes: string[];
+    expiresOn: Date | null;
+    tokenType: 'Bearer';
+    idTokenClaims: Record<string, unknown>;
+    uniqueId: string;
+    tenantId: string;
+    fromCache: boolean;
+}
+/** Thrown like MSAL's `InteractionRequiredAuthError` when nobody is signed in. */
+export declare class MsalCompatInteractionRequiredError extends Error {
+    readonly errorCode = "interaction_required";
+    constructor();
+}
+export declare function msalAccountFrom(user: AtlasUser | null, claims?: Record<string, unknown> | null): MsalCompatAccount | null;
+/** `PublicClientApplication`, answered by the Atlas session. The config is accepted and ignored. */
+export declare class MsalCompatClient {
+    constructor(_config?: unknown);
+    /** `PublicClientApplication.createPublicClientApplication(config)`. */
+    static createPublicClientApplication(config?: unknown): Promise<MsalCompatClient>;
+    initialize(): Promise<void>;
+    handleRedirectPromise(_hash?: string): Promise<MsalCompatAuthResult | null>;
+    getAllAccounts(): MsalCompatAccount[];
+    getActiveAccount(): MsalCompatAccount | null;
+    getAccountByHomeId(id: string): MsalCompatAccount | null;
+    getAccountByLocalId(id: string): MsalCompatAccount | null;
+    getAccountByUsername(username: string): MsalCompatAccount | null;
+    /** There is one account: the signed-in user. */
+    setActiveAccount(_account: MsalCompatAccount | null): void;
+    acquireTokenSilent(request?: {
+        scopes?: string[];
+        account?: unknown;
+    }): Promise<MsalCompatAuthResult>;
+    acquireTokenPopup(request?: {
+        scopes?: string[];
+    }): Promise<MsalCompatAuthResult>;
+    acquireTokenRedirect(request?: {
+        redirectUri?: string;
+    }): Promise<void>;
+    loginRedirect(request?: {
+        redirectUri?: string;
+        redirectStartPage?: string;
+    }): Promise<void>;
+    /** There is no popup sign-in: this opens the sign-in page in the window. */
+    loginPopup(request?: {
+        redirectUri?: string;
+    }): Promise<MsalCompatAuthResult>;
+    logoutRedirect(request?: {
+        postLogoutRedirectUri?: string;
+    }): Promise<void>;
+    logoutPopup(request?: {
+        postLogoutRedirectUri?: string;
+        mainWindowRedirectUri?: string;
+    }): Promise<void>;
+    /** MSAL events have no Atlas counterpart; the callback never fires. */
+    addEventCallback(_callback: unknown): string | null;
+    removeEventCallback(_id: string): void;
+}
+/** The single client `useMsalCompat().instance` returns. */
+export declare const msalCompatInstance: MsalCompatClient;
+/** `useMsal()`: `{ instance, accounts, inProgress }`. */
+export declare function useMsalCompat(): {
+    instance: MsalCompatClient;
+    accounts: MsalCompatAccount[];
+    inProgress: 'startup' | 'none';
+};
+/** `useIsAuthenticated()`. */
+export declare function useIsAuthenticatedCompat(_matchAccount?: unknown): boolean;
+/** `useAccount(accountIdentifiers)`: the signed-in account, or null. */
+export declare function useAccountCompat(_accountIdentifiers?: unknown): MsalCompatAccount | null;

package/dist/compat-msal.js

@@ -0,0 +1,158 @@
+"use strict";
+'use client';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.msalCompatInstance = exports.MsalCompatClient = exports.MsalCompatInteractionRequiredError = void 0;
+exports.msalAccountFrom = msalAccountFrom;
+exports.useMsalCompat = useMsalCompat;
+exports.useIsAuthenticatedCompat = useIsAuthenticatedCompat;
+exports.useAccountCompat = useAccountCompat;
+/**
+ * MSAL (Azure AD B2C / Microsoft Entra External ID) compatibility helpers, for
+ * `atlas migrate code --from azure-ad-b2c` / `--from entra-external-id`.
+ *
+ *  - `MsalCompatClient` stands in for `PublicClientApplication`: the account
+ *    and token methods apps call (`getAllAccounts`, `getActiveAccount`,
+ *    `acquireTokenSilent`, `loginRedirect`, `logoutRedirect`, …) answer from
+ *    the `<AtlasProvider>` session; `acquireTokenSilent` resolves the Atlas
+ *    session JWT as both `accessToken` and `idToken`.
+ *  - `useMsalCompat`, `useIsAuthenticatedCompat`, `useAccountCompat` keep the
+ *    `@azure/msal-react` hook shapes.
+ *
+ * `localAccountId` / `homeAccountId` are the ATLAS user id; the directory
+ * object id (`oid`) the user had is kept by the import as their external id.
+ */
+const AtlasProvider_1 = require("./AtlasProvider");
+const components_shared_1 = require("./components-shared");
+const compat_1 = require("./compat");
+const active_atlas_1 = require("./active-atlas");
+/** Thrown like MSAL's `InteractionRequiredAuthError` when nobody is signed in. */
+class MsalCompatInteractionRequiredError extends Error {
+    errorCode = 'interaction_required';
+    constructor() {
+        super('interaction_required: no signed-in user');
+        this.name = 'InteractionRequiredAuthError';
+    }
+}
+exports.MsalCompatInteractionRequiredError = MsalCompatInteractionRequiredError;
+function msalAccountFrom(user, claims = null) {
+    if (!user)
+        return null;
+    const email = (0, compat_1.primaryEmail)(user)?.address;
+    const name = (0, compat_1.displayName)(user) ?? undefined;
+    return {
+        homeAccountId: user.id,
+        localAccountId: user.id,
+        environment: 'atlas',
+        tenantId: 'atlas',
+        username: email ?? user.username ?? user.id,
+        ...(name ? { name } : {}),
+        idTokenClaims: { ...(claims ?? {}), ...(email ? { emails: [email], email } : {}), ...(name ? { name } : {}) },
+    };
+}
+function current() {
+    const atlas = (0, active_atlas_1.getActiveAtlas)();
+    return atlas?.status === 'signed_in' ? msalAccountFrom(atlas.user, atlas.claims ?? null) : null;
+}
+function goToSignIn(redirectUri) {
+    const back = redirectUri ?? (typeof window !== 'undefined' ? window.location.href : undefined);
+    (0, components_shared_1.navigateTo)((0, components_shared_1.withRedirect)('/sign-in', back));
+}
+/** `PublicClientApplication`, answered by the Atlas session. The config is accepted and ignored. */
+class MsalCompatClient {
+    constructor(_config) { }
+    /** `PublicClientApplication.createPublicClientApplication(config)`. */
+    static async createPublicClientApplication(config) {
+        return new MsalCompatClient(config);
+    }
+    async initialize() { }
+    async handleRedirectPromise(_hash) {
+        return null;
+    }
+    getAllAccounts() {
+        const account = current();
+        return account ? [account] : [];
+    }
+    getActiveAccount() {
+        return current();
+    }
+    getAccountByHomeId(id) {
+        const account = current();
+        return account && account.homeAccountId === id ? account : null;
+    }
+    getAccountByLocalId(id) {
+        return this.getAccountByHomeId(id);
+    }
+    getAccountByUsername(username) {
+        const account = current();
+        return account && account.username.toLowerCase() === username.toLowerCase() ? account : null;
+    }
+    /** There is one account: the signed-in user. */
+    setActiveAccount(_account) { }
+    async acquireTokenSilent(request = {}) {
+        const atlas = (0, active_atlas_1.requireActive)('acquireTokenSilent');
+        const account = current();
+        const token = account ? await atlas.getToken() : null;
+        if (!account || !token)
+            throw new MsalCompatInteractionRequiredError();
+        const exp = typeof atlas.claims?.exp === 'number' ? new Date(atlas.claims.exp * 1000) : null;
+        return {
+            accessToken: token,
+            idToken: token,
+            account,
+            scopes: request.scopes ?? [],
+            expiresOn: exp,
+            tokenType: 'Bearer',
+            idTokenClaims: account.idTokenClaims ?? {},
+            uniqueId: account.localAccountId,
+            tenantId: account.tenantId,
+            fromCache: true,
+        };
+    }
+    async acquireTokenPopup(request = {}) {
+        return this.acquireTokenSilent(request);
+    }
+    async acquireTokenRedirect(request = {}) {
+        if (!current())
+            goToSignIn(request.redirectUri);
+    }
+    async loginRedirect(request = {}) {
+        goToSignIn(request.redirectStartPage ?? request.redirectUri);
+    }
+    /** There is no popup sign-in: this opens the sign-in page in the window. */
+    async loginPopup(request = {}) {
+        goToSignIn(request.redirectUri);
+        return new Promise(() => undefined);
+    }
+    async logoutRedirect(request = {}) {
+        await (0, active_atlas_1.requireActive)('logoutRedirect').signOut();
+        if (request.postLogoutRedirectUri)
+            (0, components_shared_1.navigateTo)(request.postLogoutRedirectUri);
+    }
+    async logoutPopup(request = {}) {
+        await this.logoutRedirect({ postLogoutRedirectUri: request.mainWindowRedirectUri ?? request.postLogoutRedirectUri });
+    }
+    /** MSAL events have no Atlas counterpart; the callback never fires. */
+    addEventCallback(_callback) {
+        return null;
+    }
+    removeEventCallback(_id) { }
+}
+exports.MsalCompatClient = MsalCompatClient;
+/** The single client `useMsalCompat().instance` returns. */
+exports.msalCompatInstance = new MsalCompatClient();
+/** `useMsal()`: `{ instance, accounts, inProgress }`. */
+function useMsalCompat() {
+    const atlas = (0, AtlasProvider_1.useAtlas)();
+    const account = atlas.status === 'signed_in' ? msalAccountFrom(atlas.user) : null;
+    return { instance: exports.msalCompatInstance, accounts: account ? [account] : [], inProgress: atlas.status === 'loading' ? 'startup' : 'none' };
+}
+/** `useIsAuthenticated()`. */
+function useIsAuthenticatedCompat(_matchAccount) {
+    return (0, AtlasProvider_1.useAtlas)().status === 'signed_in';
+}
+/** `useAccount(accountIdentifiers)`: the signed-in account, or null. */
+function useAccountCompat(_accountIdentifiers) {
+    const atlas = (0, AtlasProvider_1.useAtlas)();
+    return atlas.status === 'signed_in' ? msalAccountFrom(atlas.user) : null;
+}
+//# sourceMappingURL=compat-msal.js.map

package/dist/compat-msal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compat-msal.js","sourceRoot":"","sources":["../src/compat-msal.ts"],"names":[],"mappings":";AAAA,YAAY,CAAC;;;AAwDb,0CAaC;AAgHD,sCAIC;AAGD,4DAEC;AAGD,4CAGC;AAlMD;;;;;;;;;;;;;;GAcG;AACH,mDAA2C;AAC3C,2DAA+D;AAC/D,qCAAqD;AAErD,iDAA+D;AA0B/D,kFAAkF;AAClF,MAAa,kCAAmC,SAAQ,KAAK;IAClD,SAAS,GAAG,sBAAsB,CAAC;IAC5C;QACE,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAND,gFAMC;AAED,SAAgB,eAAe,CAAC,IAAsB,EAAE,SAAyC,IAAI;IACnG,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,IAAA,qBAAY,EAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IAC5C,OAAO;QACL,aAAa,EAAE,IAAI,CAAC,EAAE;QACtB,cAAc,EAAE,IAAI,CAAC,EAAE;QACvB,WAAW,EAAE,OAAO;QACpB,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,KAAK,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,EAAE;QAC3C,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,aAAa,EAAE,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;KAC9G,CAAC;AACJ,CAAC;AAED,SAAS,OAAO;IACd,MAAM,KAAK,GAAG,IAAA,6BAAc,GAAE,CAAC;IAC/B,OAAO,KAAK,EAAE,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,EAAG,KAAK,CAAC,MAAyC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACtI,CAAC;AAED,SAAS,UAAU,CAAC,WAAoB;IACtC,MAAM,IAAI,GAAG,WAAW,IAAI,CAAC,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC/F,IAAA,8BAAU,EAAC,IAAA,gCAAY,EAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,oGAAoG;AACpG,MAAa,gBAAgB;IAC3B,YAAY,OAAiB,IAAG,CAAC;IAEjC,uEAAuE;IACvE,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,MAAgB;QACzD,OAAO,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,UAAU,KAAmB,CAAC;IAEpC,KAAK,CAAC,qBAAqB,CAAC,KAAc;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,cAAc;QACZ,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClC,CAAC;IAED,gBAAgB;QACd,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;IAED,kBAAkB,CAAC,EAAU;QAC3B,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC;QAC1B,OAAO,OAAO,IAAI,OAAO,CAAC,aAAa,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,CAAC;IAED,mBAAmB,CAAC,EAAU;QAC5B,OAAO,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,oBAAoB,CAAC,QAAgB;QACnC,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC;QAC1B,OAAO,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/F,CAAC;IAED,gDAAgD;IAChD,gBAAgB,CAAC,QAAkC,IAAS,CAAC;IAE7D,KAAK,CAAC,kBAAkB,CAAC,UAAoD,EAAE;QAC7E,MAAM,KAAK,GAAG,IAAA,4BAAa,EAAC,oBAAoB,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACtD,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,kCAAkC,EAAE,CAAC;QACvE,MAAM,GAAG,GAAG,OAAO,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7F,OAAO;YACL,WAAW,EAAE,KAAK;YAClB,OAAO,EAAE,KAAK;YACd,OAAO;YACP,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;YAC5B,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,EAAE;YAC1C,QAAQ,EAAE,OAAO,CAAC,cAAc;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,UAAiC,EAAE;QACzD,OAAO,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,UAAoC,EAAE;QAC/D,IAAI,CAAC,OAAO,EAAE;YAAE,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,UAAgE,EAAE;QACpF,UAAU,CAAC,OAAO,CAAC,iBAAiB,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/D,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,UAAU,CAAC,UAAoC,EAAE;QACrD,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAChC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,UAA8C,EAAE;QACnE,MAAM,IAAA,4BAAa,EAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC;QAChD,IAAI,OAAO,CAAC,qBAAqB;YAAE,IAAA,8BAAU,EAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,UAA8E,EAAE;QAChG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACvH,CAAC;IAED,uEAAuE;IACvE,gBAAgB,CAAC,SAAkB;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,mBAAmB,CAAC,GAAW,IAAS,CAAC;CAC1C;AA7FD,4CA6FC;AAED,4DAA4D;AAC/C,QAAA,kBAAkB,GAAG,IAAI,gBAAgB,EAAE,CAAC;AAEzD,yDAAyD;AACzD,SAAgB,aAAa;IAC3B,MAAM,KAAK,GAAG,IAAA,wBAAQ,GAAE,CAAC;IACzB,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClF,OAAO,EAAE,QAAQ,EAAE,0BAAkB,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AAC3I,CAAC;AAED,8BAA8B;AAC9B,SAAgB,wBAAwB,CAAC,aAAuB;IAC9D,OAAO,IAAA,wBAAQ,GAAE,CAAC,MAAM,KAAK,WAAW,CAAC;AAC3C,CAAC;AAED,wEAAwE;AACxE,SAAgB,gBAAgB,CAAC,mBAA6B;IAC5D,MAAM,KAAK,GAAG,IAAA,wBAAQ,GAAE,CAAC;IACzB,OAAO,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3E,CAAC"}

package/dist/compat-okta.d.ts

@@ -0,0 +1,102 @@
+import type { AtlasUser, SessionClaims } from './types';
+import { type ActiveAtlas } from './active-atlas';
+/** The OIDC user claims okta-auth-js's `getUser()` / `token.getUserInfo()` resolve to. */
+export interface OktaCompatUserClaims {
+    sub: string;
+    name?: string;
+    given_name?: string;
+    family_name?: string;
+    preferred_username?: string;
+    email?: string;
+    email_verified?: boolean;
+    picture?: string;
+    [claim: string]: unknown;
+}
+/** okta-auth-js's `AuthState`: `null` while loading, then signed in or not. */
+export interface OktaCompatAuthState {
+    isAuthenticated: boolean;
+    /** The Atlas session token, with the user's profile claims merged into its claims. */
+    idToken?: {
+        idToken: string;
+        claims: OktaCompatUserClaims & SessionClaims;
+    };
+    /** The Atlas session token and its claims. */
+    accessToken?: {
+        accessToken: string;
+        claims: SessionClaims;
+    };
+}
+export interface OktaAuthCompatOptions {
+    /** Where your Atlas sign-in page lives (default `/sign-in`). */
+    signInUrl?: string;
+    /** Where `signOut()` goes when the call does not say (okta-auth-js's option of the same name). Default `/`. */
+    postLogoutRedirectUri?: string;
+    /** okta-auth-js options (`issuer`, `clientId`, `redirectUri`, `scopes`, `pkce`, …) are accepted and ignored. */
+    [option: string]: unknown;
+}
+export interface OktaCompatSignInOptions {
+    /** Where to land after sign-in (sent to the sign-in page as `redirect_url`). */
+    originalUri?: string;
+    [option: string]: unknown;
+}
+export interface OktaCompatSignOutOptions {
+    postLogoutRedirectUri?: string;
+    [option: string]: unknown;
+}
+/** okta-auth-js's `AuthSdkError`, thrown when a call needs a signed-in user. */
+export declare class OktaCompatAuthSdkError extends Error {
+    readonly errorCode = "INTERNAL";
+    readonly errorSummary: string;
+    constructor(message: string);
+}
+/** Project an Atlas user onto the OIDC user claims Okta returns. */
+export declare function oktaUserFrom(user: AtlasUser | null): OktaCompatUserClaims | null;
+/**
+ * Pure projection of the provider state onto okta-auth-js's `AuthState`.
+ * `token` is the session token: `undefined` while it is being read (the state
+ * is then `null`, as Okta's is before its first evaluation), `null` when there
+ * is none.
+ */
+export declare function oktaAuthStateFrom(state: Pick<ActiveAtlas, 'status' | 'user' | 'claims'>, token: string | null | undefined): OktaCompatAuthState | null;
+/** okta-auth-js's `toRelativeUrl(path, baseUrl)`: an absolute URL loses its `baseUrl` prefix. */
+export declare function toRelativeUrlCompat(path?: string, baseUrl?: string): string;
+/**
+ * `new OktaAuth(config)` from `@okta/okta-auth-js`, on Atlas, for a React app
+ * that renders `<AtlasProvider>`. The config is accepted and ignored apart from
+ * `signInUrl` and `postLogoutRedirectUri`: sign-in runs on your Atlas pages and
+ * the provider holds the session.
+ */
+export declare class OktaAuthCompat {
+    readonly options: OktaAuthCompatOptions;
+    /** okta-auth-js's `oktaAuth.token` namespace (`getUserInfo` only). */
+    readonly token: {
+        getUserInfo(): Promise<OktaCompatUserClaims>;
+    };
+    private readonly atlas;
+    private cached;
+    private pending;
+    /**
+     * @param atlas Where the provider state comes from. Internal: the hook passes
+     * its own; by default the `<AtlasProvider>` mounted on the page.
+     */
+    constructor(options?: OktaAuthCompatOptions, atlas?: () => ActiveAtlas);
+    /** Open your Atlas sign-in page, coming back to `originalUri` afterwards. */
+    signInWithRedirect(options?: OktaCompatSignInOptions): Promise<void>;
+    /** Sign out, then go to `postLogoutRedirectUri` (default `/`). */
+    signOut(options?: OktaCompatSignOutOptions): Promise<void>;
+    isAuthenticated(): Promise<boolean>;
+    /** The signed-in user's claims; throws `AuthSdkError` when nobody is signed in, like Okta. */
+    getUser(): Promise<OktaCompatUserClaims>;
+    /** The session token on hand (synchronous, like okta-auth-js), refreshed in the background. */
+    getAccessToken(): string | undefined;
+    /** Atlas has one session token: the same value as `getAccessToken()`. */
+    getIdToken(): string | undefined;
+    /** Read a fresh session token now (the async form of `getAccessToken()`). */
+    getFreshAccessToken(): Promise<string | undefined>;
+    private current;
+}
+/** `useOktaAuth()` from `@okta/okta-react`, on Atlas: `{ oktaAuth, authState }`. */
+export declare function useOktaAuthCompat(): {
+    oktaAuth: OktaAuthCompat;
+    authState: OktaCompatAuthState | null;
+};