@burdenoff/fe-libs 2026.527.3 → 2026.527.4

package/dist/shared/providers/shell/AuthProvider.js

@@ -1,407 +1,153 @@
-import { resolveGatewayUrls as e } from "../../config/gatewayUrls.js";
-import { resolveAuthBridgeConfig as t } from "../../config/authBridgeUrls.js";
-import { PROFILE_STORAGE_CHANGE_EVENT as n, addProfile as r, getActiveProfileId as i, getProfileTokens as a, getProfileUser as o, getProfileWorkspaceToken as s, getProfiles as c, loginProfile as ee, logoutAllProfiles as te, removeProfile as l, resolveActiveProfileId as u, setActiveProfileId as d, setProfileTokens as f, setProfileUser as p, setProfileWorkspaceToken as m, setProfiles as h, switchProfile as ne } from "./ProfileStorageManager.js";
-import { clearShellSsoCookies as g, isSharedSsoCookieDomain as re, isTrustedSsoOrigin as _, readShellSsoCookie as v, setShellSsoCookies as ie } from "../../utils/authCookie.js";
-import { getAuthBridge as y, initAuthBridge as ae, isAuthBridgeInitialized as oe } from "./AuthBridgeClient.js";
-import { checkRemoteSLO as se, checkSLO as ce, clearLocalAuthState as b, hasRecentSSORedirectAttempt as x, markSSORedirectAttempt as S, shouldSkipSSORedirect as C } from "../../components/SSORedirectGuard.js";
-import { createContext as w, use as T, useCallback as E, useEffect as D, useMemo as le, useRef as ue, useState as O } from "react";
-import { jsx as de } from "react/jsx-runtime";
+import { getActiveProfileId as e, getProfileTokens as t, getProfileUser as n, getProfileWorkspaceToken as r, getProfiles as i, resolveActiveProfileId as ee } from "./ProfileStorageManager.js";
+import { readShellSsoCookie as a } from "../../utils/authCookie.js";
+import { useBridgeInitialization as o } from "./authProvider/useBridgeInitialization.js";
+import { useTokenExpiryTimer as s } from "./authProvider/useTokenExpiryTimer.js";
+import { useStorageSync as c } from "./authProvider/useStorageSync.js";
+import { useRemoteSLO as l } from "./authProvider/useRemoteSLO.js";
+import { useAuthActions as te } from "./authProvider/useAuthActions.js";
+import { createContext as u, use as d, useCallback as f, useMemo as p, useRef as m, useState as h } from "react";
+import { jsx as g } from "react/jsx-runtime";
 //#region src/shared/providers/shell/AuthProvider.tsx
-var k = w(null);
-function A(e) {
-	try {
-		let t = e.split(".");
-		if (t.length !== 3) return null;
-		let n = JSON.parse(atob(t[1].replace(/-/g, "+").replace(/_/g, "/")));
-		return typeof n.exp == "number" ? n.exp * 1e3 : null;
-	} catch {
-		return null;
-	}
-}
-function j(e) {
-	return e.trigger;
-}
-function M(e, t, n) {
-	let r = (Array.isArray(e.profiles) ? e.profiles : []).map((e) => {
-		let t = typeof e.id == "string" ? e.id : null, n = typeof e.email == "string" ? e.email : null;
-		return !t || !n ? null : {
-			id: t,
-			email: n,
-			name: typeof e.name == "string" && e.name.trim().length > 0 ? e.name : n,
-			avatar: typeof e.avatar == "string" ? e.avatar : void 0,
-			lastLogin: typeof e.lastLogin == "string" ? e.lastLogin : (/* @__PURE__ */ new Date()).toISOString()
-		};
-	}).filter((e) => e !== null);
-	return r.some((e) => e.id === t) ? r : [...r, {
-		id: t,
-		email: n.email,
-		name: n.name ?? `${n.firstName ?? ""} ${n.lastName ?? ""}`.trim(),
-		avatar: n.avatar,
-		lastLogin: (/* @__PURE__ */ new Date()).toISOString()
-	}];
-}
-function fe(e) {
-	let t = j(e);
-	if (t === "logout" || t === "logout_all") return b(), !0;
-	if (!e.activeProfileId || !e.user || !e.tokens) return !1;
-	let r = e.activeProfileId, i = e.user, { workspaceToken: a, ...o } = e.tokens;
-	return h(M(e, r, i)), p(r, i), f(r, o), m(r, a ?? null), d(r), window.dispatchEvent(new Event(n)), !0;
-}
-function N() {
-	if (typeof window > "u") return null;
-	try {
-		let e = t(), n = new URL(e.url).origin;
-		if (n === window.location.origin) return null;
-		let r = `${window.location.origin}/auth/login?reason=logout`;
-		return `${n}/auth/sso-clear?returnTo=${encodeURIComponent(r)}`;
-	} catch {
-		return null;
-	}
-}
-function P(e) {
-	if (!e) return !1;
-	try {
-		return !!(localStorage.getItem(`bf-p-${e}-tokens`) && localStorage.getItem(`bf-p-${e}-user`));
-	} catch {
-		return !1;
-	}
-}
-function F(e) {
-	try {
-		if (C()) return null;
-		let t = v();
-		if (!t?.origin || !_(t.origin)) return null;
-		let n = new URL(t.origin).origin, r = new URL(e).origin;
-		if (n === window.location.origin || n === r || P(t.id)) return null;
-		let i = window.location.href;
-		return x(n, i) ? null : (S(n, i), `${n}/auth/sso-relay?returnTo=${encodeURIComponent(i)}`);
-	} catch {
-		return null;
-	}
-}
-function I({ children: t, onTokenExpired: h, onSessionExpiringSoon: _, onRefreshToken: b, bridgeUrl: w, bridgeAllowedOrigins: T, bridgeDebug: j, onBridgeReady: M }) {
-	let P = ue(!1), [I, L] = O(() => u()), [R, z] = O(() => I ? o(I) : null), [B, V] = O(() => I ? a(I) : null), [H, U] = O(() => I ? s(I) : null), [W, G] = O(() => {
-		if (I && o(I)) return !1;
-		if (w) try {
-			let e = v()?.id ?? null;
+var _ = u(null);
+function v({ children: u, onTokenExpired: d, onSessionExpiringSoon: v, onRefreshToken: y, bridgeUrl: b, bridgeAllowedOrigins: x, bridgeDebug: S, onBridgeReady: C }) {
+	let w = m(!1), [T, E] = h(() => ee()), [D, O] = h(() => T ? n(T) : null), [k, A] = h(() => T ? t(T) : null), [j, M] = h(() => T ? r(T) : null), [N, P] = h(() => {
+		if (T && n(T)) return !1;
+		if (b) try {
+			let e = a()?.id ?? null;
 			if (e && localStorage.getItem(`bf-p-${e}-tokens`)) return !1;
 		} catch {}
-		return !!w;
-	}), [pe, K] = O(!1), [me, q] = O(null), [he, J] = O(() => c().map((e) => ({
+		return !!b;
+	}), [F, I] = h(!1), [L, ne] = h(null), [R, z] = h(() => i().map((e) => ({
 		id: e.id,
 		email: e.email,
 		name: e.name,
 		avatar: e.avatar,
-		isActive: e.id === I,
+		isActive: e.id === T,
 		lastLogin: e.lastLogin
-	}))), Y = E(() => {
-		let e = i();
-		J(c().map((t) => ({
-			id: t.id,
-			email: t.email,
-			name: t.name,
-			avatar: t.avatar,
-			isActive: t.id === e,
-			lastLogin: t.lastLogin
+	}))), B = f(() => {
+		z([]);
+	}, []), V = f(() => {
+		let t = e();
+		z(i().map((e) => ({
+			id: e.id,
+			email: e.email,
+			name: e.name,
+			avatar: e.avatar,
+			isActive: e.id === t,
+			lastLogin: e.lastLogin
 		})));
 	}, []);
-	D(() => {
-		if (!w) return;
-		try {
-			let e = new URL(w).pathname;
-			if (window.location.pathname === e) {
-				G(!1), M?.();
-				return;
-			}
-		} catch {
-			G(!1), M?.();
-			return;
-		}
-		if (oe()) {
-			G(!1), M?.();
-			return;
-		}
-		let e = () => {
-			G(!1), M?.();
-		}, t = (t) => {
-			P.current = !0;
-			try {
-				if (w) {
-					let e = F(w);
-					if (e) {
-						window.location.replace(e);
-						return;
-					}
-				}
-				fe(t);
-				let e = u();
-				if (e) L(e), z(o(e)), V(a(e)), U(s(e)), Y();
-				else {
-					if (w && !t.user && !t.tokens) try {
-						let e = new URL(w).origin, t = window.location.origin, n = F(w);
-						if (n) {
-							window.location.replace(n);
-							return;
-						}
-						if (e !== t && !C()) {
-							let t = window.location.href;
-							if (x(e, t)) return;
-							S(e, t), window.location.replace(`${e}/auth/sso-relay?returnTo=${encodeURIComponent(t)}`);
-							return;
-						}
-					} catch {}
-					L(null), z(null), V(null), U(null), J([]);
-				}
-			} finally {
-				P.current = !1, e();
-			}
-		}, n = setTimeout(() => {
-			e();
-		}, 5e3);
-		return ae({
-			bridgeUrl: w,
-			allowedOrigins: T,
-			onStateChanged: t,
-			debug: j ?? !1
-		}), () => {
-			clearTimeout(n);
-		};
-	}, [
-		w,
-		T,
-		j,
-		M,
-		Y
-	]);
-	let ge = E((e, t, n) => {
-		let r = A(t) ?? Date.now() + 3600 * 1e3, i = {
-			accessToken: t,
-			refreshToken: n,
-			expiresAt: r
-		}, a = ee(e, i);
-		L(a), z(e), V(i), U(null), K(!1), q(null), Y();
-		try {
-			ie(a, window.location.origin);
-		} catch {}
-		P.current || y()?.notifyLogin({
-			user: e,
-			tokens: {
-				accessToken: t,
-				refreshToken: n,
-				expiresAt: r
-			},
-			activeAccountId: a,
-			activeProfileId: a,
-			profiles: c()
-		});
-	}, [Y]), X = E(() => {
-		I && l(I);
-		let e = u();
-		e ? (L(e), z(o(e)), V(a(e)), U(s(e))) : (L(null), z(null), V(null), U(null)), K(!1), q(null), Y();
-		try {
-			g();
-		} catch {}
-		P.current || y()?.notifyLogout();
-		let t = N();
-		t && !P.current && window.location.replace(t);
-	}, [I, Y]), _e = E((e) => {
-		if (!R || !I) return;
-		let t = {
-			...R,
-			...e
-		};
-		z(t), p(I, t), r({
-			id: I,
-			email: t.email,
-			name: t.name ?? `${t.firstName ?? ""} ${t.lastName ?? ""}`.trim(),
-			avatar: t.avatar,
-			lastLogin: (/* @__PURE__ */ new Date()).toISOString()
-		}), Y();
-	}, [
-		R,
-		I,
-		Y
-	]), Z = E(async () => {
-		if (!(!B?.refreshToken || !b || !I)) {
-			G(!0);
-			try {
-				let e = await b(B.refreshToken), t = A(e.accessToken), n = e.expiresAt ?? t ?? Date.now() + 3600 * 1e3, r = {
-					accessToken: e.accessToken,
-					refreshToken: e.refreshToken ?? B.refreshToken,
-					expiresAt: n
-				};
-				V(r), f(I, r), P.current || y()?.notifyTokenRefresh({
-					accessToken: r.accessToken,
-					refreshToken: r.refreshToken,
-					expiresAt: r.expiresAt
-				});
-			} catch (e) {
-				console.error("Failed to refresh token:", e), X(), h?.();
-			} finally {
-				G(!1);
-			}
-		}
-	}, [
-		B,
-		b,
-		I,
-		X,
-		h
-	]), Q = E((e) => R?.permissions ? R.permissions.includes(e) || R.permissions.includes("*") : !1, [R]), ve = E((e) => {
-		U(e), I && m(I, e);
-	}, [I]), ye = E((e, t) => {
-		K(e), q(t ?? null);
-	}, []), be = E((e) => {
-		if (!ne(e)) {
-			console.error(`Profile ${e} not found`);
-			return;
-		}
-		L(e), z(o(e)), V(a(e)), U(s(e)), K(!1), q(null), Y(), P.current || y()?.notifyAccountSwitch(e);
-	}, [Y]), xe = E((e, t, n) => {
-		ee(e, {
-			accessToken: t,
-			refreshToken: n,
-			expiresAt: A(t) ?? Date.now() + 3600 * 1e3
-		}), I && d(I), Y();
-	}, [I, Y]), Se = E((e) => {
-		if (e === I) {
-			console.error("Cannot remove active account — logout first");
-			return;
-		}
-		l(e), Y();
-	}, [I, Y]), Ce = E(() => {
-		te(), L(null), z(null), V(null), U(null), K(!1), q(null), J([]);
-		try {
-			g();
-		} catch {}
-		P.current || y()?.notifyLogoutAll();
-		let e = N();
-		e && !P.current && window.location.replace(e);
-	}, []);
-	D(() => {
-		if (!B?.expiresAt) return;
-		let e = B.expiresAt - Date.now();
-		if (e <= 0) {
-			b && B?.refreshToken ? Z() : h?.();
-			return;
-		}
-		let t = [];
-		if (b && B?.refreshToken) {
-			let n = Math.max(0, e - 300 * 1e3);
-			t.push(setTimeout(() => {
-				Z();
-			}, n));
-		}
-		if (_) {
-			let n = Math.max(0, e - 300 * 1e3);
-			t.push(setTimeout(() => {
-				_();
-			}, n));
-		}
-		return (!b || !B?.refreshToken) && t.push(setTimeout(() => {
-			h?.();
-		}, e)), () => t.forEach(clearTimeout);
-	}, [
-		B?.expiresAt,
-		B?.refreshToken,
-		Z,
-		b,
-		h,
-		_
-	]);
-	let we = E(() => {
-		let e = u();
-		if (!e) {
-			(R || B) && (z(null), V(null), U(null), L(null), J([]));
-			return;
-		}
-		let t = a(e), n = s(e), r = o(e);
-		e !== I && L(e), t?.accessToken !== B?.accessToken && V(t), n !== H && U(n), r && r.id !== R?.id && z(r), Y();
-	}, [
-		B,
-		R,
-		H,
-		I,
-		Y
-	]);
-	D(() => {
-		let e = () => we();
-		window.addEventListener(n, e), window.addEventListener("storage", e);
-		let t = setInterval(e, 1e4);
-		return () => {
-			window.removeEventListener(n, e), window.removeEventListener("storage", e), clearInterval(t);
-		};
-	}, [we]), D(() => {
-		if (!B?.accessToken || !w) return;
-		let t = async () => {
-			if (document.visibilityState === "visible") try {
-				if (ce()) {
-					L(null), z(null), V(null), U(null), J([]);
-					return;
-				}
-				if (re()) return;
-				await se(`${e().globalBaseUrl}/global/graphql`, B.accessToken) && X();
-			} catch {}
-		};
-		return document.addEventListener("visibilitychange", t), () => document.removeEventListener("visibilitychange", t);
-	}, [
-		B?.accessToken,
-		w,
-		X
-	]);
-	let $ = le(() => !!R && !!B, [R, B]), Te = le(() => ({
-		user: R,
-		tokens: B,
+	o({
+		bridgeUrl: b,
+		bridgeAllowedOrigins: x,
+		bridgeDebug: S,
+		onBridgeReady: C,
+		bridgeSyncInProgress: w,
+		setIsLoading: P,
+		setActiveId: E,
+		setUser: O,
+		setTokens: A,
+		setWorkspaceTokenLocal: M,
+		clearAccounts: B,
+		refreshAccounts: V
+	});
+	let { login: H, logout: U, logoutAll: W, updateUser: G, refreshAccessToken: K, hasPermission: q, setWorkspaceToken: J, setMfaState: Y, switchAccount: X, addAccount: Z, removeAccount: Q } = te({
+		user: D,
+		tokens: k,
+		activeId: T,
+		bridgeSyncInProgress: w,
+		onRefreshToken: y,
+		onTokenExpired: d,
+		setActiveId: E,
+		setUser: O,
+		setTokens: A,
+		setWorkspaceTokenLocal: M,
+		setMfaRequiredState: I,
+		setMfaChallengeIdState: ne,
+		setIsLoading: P,
+		clearAccounts: B,
+		refreshAccounts: V
+	});
+	s({
+		tokens: k,
+		onRefreshToken: y,
+		onTokenExpired: d,
+		onSessionExpiringSoon: v,
+		refreshAccessToken: K
+	}), c({
+		user: D,
+		tokens: k,
+		workspaceToken: j,
+		activeId: T,
+		setUser: O,
+		setTokens: A,
+		setWorkspaceTokenLocal: M,
+		setActiveId: E,
+		clearAccounts: B,
+		refreshAccounts: V
+	}), l({
+		tokens: k,
+		bridgeUrl: b,
+		logout: U,
+		setActiveId: E,
+		setUser: O,
+		setTokens: A,
+		setWorkspaceTokenLocal: M,
+		clearAccounts: B
+	});
+	let $ = p(() => !!D && !!k, [D, k]), re = p(() => ({
+		user: D,
+		tokens: k,
 		isAuthenticated: $,
-		isLoading: W,
-		login: ge,
-		logout: X,
-		updateUser: _e,
-		refreshAccessToken: Z,
-		hasPermission: Q,
-		setWorkspaceToken: ve,
-		workspaceToken: H,
-		mfaRequired: pe,
-		mfaChallengeId: me,
-		setMfaState: ye,
-		activeProfileId: I,
-		accounts: he,
-		switchAccount: be,
-		addAccount: xe,
-		removeAccount: Se,
-		logoutAll: Ce,
-		currentUser: R
+		isLoading: N,
+		login: H,
+		logout: U,
+		updateUser: G,
+		refreshAccessToken: K,
+		hasPermission: q,
+		setWorkspaceToken: J,
+		workspaceToken: j,
+		mfaRequired: F,
+		mfaChallengeId: L,
+		setMfaState: Y,
+		activeProfileId: T,
+		accounts: R,
+		switchAccount: X,
+		addAccount: Z,
+		removeAccount: Q,
+		logoutAll: W,
+		currentUser: D
 	}), [
-		R,
-		B,
+		D,
+		k,
 		$,
-		W,
-		ge,
+		N,
+		H,
+		U,
+		G,
+		K,
+		q,
+		J,
+		j,
+		F,
+		L,
+		Y,
+		T,
+		R,
 		X,
-		_e,
 		Z,
 		Q,
-		ve,
-		H,
-		pe,
-		me,
-		ye,
-		I,
-		he,
-		be,
-		xe,
-		Se,
-		Ce
+		W
 	]);
-	return /* @__PURE__ */ de(k.Provider, {
-		value: Te,
-		children: t
+	return /* @__PURE__ */ g(_.Provider, {
+		value: re,
+		children: u
 	});
 }
-function L() {
-	let e = T(k);
+function y() {
+	let e = d(_);
 	if (!e) throw Error("useAuth must be used within an AuthProvider");
 	return e;
 }
 //#endregion
-export { I as AuthProvider, L as useAuth };
+export { v as AuthProvider, y as useAuth };

package/dist/shared/providers/shell/authProvider/bridgeStateSync.js

@@ -0,0 +1,34 @@
+import { PROFILE_STORAGE_CHANGE_EVENT as e, setActiveProfileId as t, setProfileTokens as n, setProfileUser as r, setProfileWorkspaceToken as i, setProfiles as a } from "../ProfileStorageManager.js";
+import { clearLocalAuthState as o } from "../../../components/SSORedirectGuard.js";
+//#region src/shared/providers/shell/authProvider/bridgeStateSync.ts
+function s(e) {
+	return e.trigger;
+}
+function c(e, t, n) {
+	let r = (Array.isArray(e.profiles) ? e.profiles : []).map((e) => {
+		let t = typeof e.id == "string" ? e.id : null, n = typeof e.email == "string" ? e.email : null;
+		return !t || !n ? null : {
+			id: t,
+			email: n,
+			name: typeof e.name == "string" && e.name.trim().length > 0 ? e.name : n,
+			avatar: typeof e.avatar == "string" ? e.avatar : void 0,
+			lastLogin: typeof e.lastLogin == "string" ? e.lastLogin : (/* @__PURE__ */ new Date()).toISOString()
+		};
+	}).filter((e) => e !== null);
+	return r.some((e) => e.id === t) ? r : [...r, {
+		id: t,
+		email: n.email,
+		name: n.name ?? `${n.firstName ?? ""} ${n.lastName ?? ""}`.trim(),
+		avatar: n.avatar,
+		lastLogin: (/* @__PURE__ */ new Date()).toISOString()
+	}];
+}
+function l(l) {
+	let u = s(l);
+	if (u === "logout" || u === "logout_all") return o(), !0;
+	if (!l.activeProfileId || !l.user || !l.tokens) return !1;
+	let d = l.activeProfileId, f = l.user, { workspaceToken: p, ...m } = l.tokens;
+	return a(c(l, d, f)), r(d, f), n(d, m), i(d, p ?? null), t(d), window.dispatchEvent(new Event(e)), !0;
+}
+//#endregion
+export { l as syncBridgeStateToProfileStorage };

package/dist/shared/providers/shell/authProvider/jwt.js

@@ -0,0 +1,13 @@
+//#region src/shared/providers/shell/authProvider/jwt.ts
+function e(e) {
+	try {
+		let t = e.split(".");
+		if (t.length !== 3) return null;
+		let n = JSON.parse(atob(t[1].replace(/-/g, "+").replace(/_/g, "/")));
+		return typeof n.exp == "number" ? n.exp * 1e3 : null;
+	} catch {
+		return null;
+	}
+}
+//#endregion
+export { e as getJwtExpiry };

package/dist/shared/providers/shell/authProvider/ssoRelay.js

@@ -0,0 +1,38 @@
+import { resolveAuthBridgeConfig as e } from "../../../config/authBridgeUrls.js";
+import { isTrustedSsoOrigin as t, readShellSsoCookie as n } from "../../../utils/authCookie.js";
+import { hasRecentSSORedirectAttempt as r, markSSORedirectAttempt as i, shouldSkipSSORedirect as a } from "../../../components/SSORedirectGuard.js";
+//#region src/shared/providers/shell/authProvider/ssoRelay.ts
+function o() {
+	if (typeof window > "u") return null;
+	try {
+		let t = e(), n = new URL(t.url).origin;
+		if (n === window.location.origin) return null;
+		let r = `${window.location.origin}/auth/login?reason=logout`;
+		return `${n}/auth/sso-clear?returnTo=${encodeURIComponent(r)}`;
+	} catch {
+		return null;
+	}
+}
+function s(e) {
+	if (!e) return !1;
+	try {
+		return !!(localStorage.getItem(`bf-p-${e}-tokens`) && localStorage.getItem(`bf-p-${e}-user`));
+	} catch {
+		return !1;
+	}
+}
+function c(e) {
+	try {
+		if (a()) return null;
+		let o = n();
+		if (!o?.origin || !t(o.origin)) return null;
+		let c = new URL(o.origin).origin, l = new URL(e).origin;
+		if (c === window.location.origin || c === l || s(o.id)) return null;
+		let u = window.location.href;
+		return r(c, u) ? null : (i(c, u), `${c}/auth/sso-relay?returnTo=${encodeURIComponent(u)}`);
+	} catch {
+		return null;
+	}
+}
+//#endregion
+export { c as getCookieSsoRelayUrl, o as getCrossOriginLogoutUrl };