@burdenoff/microfe-auth 2026.1013.2 → 2026.1014.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authStore.js","names":[],"sources":["../../../src/auth/store/authStore.ts"],"sourcesContent":["import { create } from \"zustand\";\nimport { persist } from \"zustand/middleware\";\nimport { createProfileScopedStorage } from \"@burdenoff/fe-libs/shared/utils\";\nimport type {\n User,\n Session,\n MfaDevice,\n OAuthAccount,\n TrustedDevice,\n SecurityAudit,\n ApiKey,\n App,\n AppUserDelegation,\n Workspace,\n Organization,\n Project,\n} from \"../types\";\n\n/**\n * Sync auth state to profile-scoped storage (ProfileStorageManager keys).\n * The active profile ID comes from sessionStorage (\"bf-active-profile\").\n * Data is stored under localStorage keys: bf-p-{profileId}-user, bf-p-{profileId}-tokens, etc.\n */\nconst BF_PREFIX = \"bf-p\";\nconst BF_PROFILES = \"bf-profiles\";\nconst BF_ACTIVE = \"bf-active-profile\";\nconst AUTH_STORAGE_KEY = \"auth-storage\";\nconst AUTH_STATE_CLEARED_EVENT = \"bf-auth-state-cleared\";\n\nfunction getActiveProfileForSync(): string | null {\n return sessionStorage.getItem(BF_ACTIVE);\n}\n\nfunction pfKey(profileId: string, suffix: string): string {\n return `${BF_PREFIX}-${profileId}-${suffix}`;\n}\n\nfunction clearPersistedAuthStorage(profileId?: string | null): void {\n localStorage.removeItem(AUTH_STORAGE_KEY);\n if (profileId) {\n localStorage.removeItem(pfKey(profileId, AUTH_STORAGE_KEY));\n }\n for (const key of Object.keys(localStorage)) {\n if (\n key.startsWith(`${BF_PREFIX}-`) &&\n key.endsWith(`-${AUTH_STORAGE_KEY}`)\n ) {\n localStorage.removeItem(key);\n }\n }\n}\n\ninterface ProfileMeta {\n id: string;\n email: string;\n name: string;\n avatar?: string;\n lastLogin: string;\n}\n\n/** Dispatch custom event to notify fe-libs AuthProvider of storage changes (same-tab). */\nfunction notifyProfileStorageChange(): void {\n if (typeof window !== \"undefined\") {\n window.dispatchEvent(new Event(\"bf-profile-storage-change\"));\n }\n}\n\nfunction syncToProfileStorage(data: {\n user?: User | null;\n accessToken?: string | null;\n refreshToken?: string | null;\n workspaceToken?: string | null;\n clear?: boolean;\n}) {\n if (typeof window === \"undefined\") return;\n\n const profileId = getActiveProfileForSync();\n if (!profileId && !data.user && !data.clear) return;\n\n // For login/signup: prefer the user's own ID as the target profile.\n // This prevents overwriting an existing active profile when a NEW user\n // signs up or logs in (multi-account scenario).\n const targetId = data.user?.id ?? profileId;\n if (!targetId && !data.clear) return;\n\n if (data.clear) {\n clearPersistedAuthStorage(targetId);\n if (!targetId) {\n localStorage.removeItem(BF_PROFILES);\n sessionStorage.removeItem(BF_ACTIVE);\n return;\n }\n // Remove profile data keys\n localStorage.removeItem(pfKey(targetId, \"user\"));\n localStorage.removeItem(pfKey(targetId, \"tokens\"));\n localStorage.removeItem(pfKey(targetId, \"workspace-token\"));\n // Remove from profiles list\n try {\n const profilesRaw = localStorage.getItem(BF_PROFILES);\n const profiles: ProfileMeta[] = profilesRaw\n ? JSON.parse(profilesRaw)\n : [];\n const filtered = profiles.filter((p) => p.id !== targetId);\n localStorage.setItem(BF_PROFILES, JSON.stringify(filtered));\n } catch {\n /* ignore */\n }\n sessionStorage.removeItem(BF_ACTIVE);\n return;\n }\n\n if (!targetId) return;\n\n if (data.user) {\n localStorage.setItem(pfKey(targetId, \"user\"), JSON.stringify(data.user));\n // Update profiles list\n try {\n const profilesRaw = localStorage.getItem(BF_PROFILES);\n const profiles: ProfileMeta[] = profilesRaw\n ? JSON.parse(profilesRaw)\n : [];\n const existing = profiles.filter((p) => p.id !== targetId);\n existing.push({\n id: targetId,\n email: data.user.email ?? \"\",\n name:\n data.user.name ??\n `${data.user.firstName ?? \"\"} ${data.user.lastName ?? \"\"}`.trim(),\n avatar: data.user.avatar,\n lastLogin: new Date().toISOString(),\n });\n localStorage.setItem(BF_PROFILES, JSON.stringify(existing));\n } catch {\n /* ignore */\n }\n // Set as active profile in this tab\n sessionStorage.setItem(BF_ACTIVE, targetId);\n }\n\n if (data.accessToken !== undefined || data.refreshToken !== undefined) {\n const existingRaw = localStorage.getItem(pfKey(targetId, \"tokens\"));\n const existing = existingRaw ? JSON.parse(existingRaw) : {};\n // Compute expiresAt from the actual JWT exp claim if a new access token is provided\n let expiresAt = existing.expiresAt ?? Date.now() + 60 * 60 * 1000;\n const tokenToCheck = data.accessToken ?? existing.accessToken;\n if (tokenToCheck) {\n try {\n const raw = tokenToCheck\n .split(\".\")[1]\n .replace(/-/g, \"+\")\n .replace(/_/g, \"/\");\n const padded = raw.padEnd(Math.ceil(raw.length / 4) * 4, \"=\");\n const payload = JSON.parse(atob(padded));\n if (typeof payload.exp === \"number\") {\n expiresAt = payload.exp * 1000; // JWT exp is in seconds → ms\n }\n } catch {\n // Fallback: keep existing or default 1h\n }\n }\n const merged = {\n ...existing,\n ...(data.accessToken !== undefined\n ? { accessToken: data.accessToken }\n : {}),\n ...(data.refreshToken !== undefined\n ? { refreshToken: data.refreshToken }\n : {}),\n expiresAt,\n };\n if (merged.accessToken) {\n localStorage.setItem(pfKey(targetId, \"tokens\"), JSON.stringify(merged));\n } else {\n localStorage.removeItem(pfKey(targetId, \"tokens\"));\n }\n }\n\n if (data.workspaceToken !== undefined) {\n if (data.workspaceToken) {\n localStorage.setItem(\n pfKey(targetId, \"workspace-token\"),\n data.workspaceToken,\n );\n } else {\n localStorage.removeItem(pfKey(targetId, \"workspace-token\"));\n }\n }\n\n // Notify fe-libs AuthProvider of the change (same-tab custom event)\n notifyProfileStorageChange();\n\n // Set SSO cookie for cross-domain session sharing (works in all envs)\n // Stores profile ID + the origin where the user logged in.\n // Other shells use the origin to redirect to /auth/sso-relay for token relay.\n try {\n const hostname = window.location.hostname;\n // For local dev, set cookie on shared .local.burdenoff.com domain\n // For production, set cookie on current domain only (relay handles cross-domain)\n const isSharedDomain = hostname.endsWith(\".local.burdenoff.com\");\n const domain = isSharedDomain ? \".local.burdenoff.com\" : undefined;\n const domainPart = domain ? `; domain=${domain}` : \"\";\n const securePart = window.location.protocol === \"https:\" ? \"; secure\" : \"\";\n const cookieOpts = `${domainPart}; path=/; samesite=lax${securePart}`;\n\n if (data.accessToken && targetId) {\n // Store profile ID + login origin for SSO relay\n const ssoValue = JSON.stringify({\n id: targetId,\n origin: window.location.origin,\n });\n document.cookie = `bf-sso=${encodeURIComponent(ssoValue)}${cookieOpts}; max-age=86400`;\n document.cookie = `bf-sso-profile=${encodeURIComponent(ssoValue)}${cookieOpts}; max-age=86400`;\n }\n\n if (data.clear) {\n document.cookie = \"bf-sso=; path=/; max-age=0\";\n document.cookie = \"bf-sso-profile=; path=/; max-age=0\";\n if (domain) {\n document.cookie = `bf-sso=; path=/; domain=${domain}; max-age=0`;\n document.cookie = `bf-sso-profile=; path=/; domain=${domain}; max-age=0`;\n }\n if (hostname && ![\"localhost\", \"127.0.0.1\"].includes(hostname)) {\n document.cookie = `bf-sso=; path=/; domain=${hostname}; max-age=0`;\n document.cookie = `bf-sso-profile=; path=/; domain=${hostname}; max-age=0`;\n }\n }\n } catch {\n /* ignore */\n }\n}\n\ninterface AuthState {\n // Auth state\n user: User | null;\n accessToken: string | null;\n refreshToken: string | null;\n isAuthenticated: boolean;\n\n // Organization state\n organizations: Organization[];\n currentOrganizationId: string | null;\n isLoadingOrganizations: boolean;\n\n // Workspace state\n workspaces: Workspace[];\n currentWorkspaceId: string | null;\n workspaceToken: string | null;\n isLoadingWorkspaces: boolean;\n\n // Project state\n projects: Project[];\n currentProjectId: string | null;\n isLoadingProjects: boolean;\n\n // MFA state\n mfaRequired: boolean;\n mfaChallengeId: string | null;\n mfaDevices: MfaDevice[];\n\n // Session state\n activeSessions: Session[];\n currentSessionId: string | null;\n\n // OAuth state\n linkedAccounts: OAuthAccount[];\n\n // Security state\n trustedDevices: TrustedDevice[];\n securityEvents: SecurityAudit[];\n\n // API Keys state\n apiKeys: ApiKey[];\n\n // Apps state\n apps: App[];\n currentApp: App | null;\n\n // Delegations state\n delegations: AppUserDelegation[];\n grantedDelegations: AppUserDelegation[];\n\n // UI state\n isLoading: boolean;\n error: string | null;\n errorCode: string | null;\n\n // Actions - Auth\n setUser: (user: User | null) => void;\n setAccessToken: (token: string | null) => void;\n setAuthTokens: (accessToken: string, refreshToken: string) => void;\n setAuthenticated: (isAuthenticated: boolean) => void;\n clearAuth: () => void;\n\n // Actions - Organization\n setOrganizations: (organizations: Organization[]) => void;\n setCurrentOrganizationId: (orgId: string | null) => void;\n setLoadingOrganizations: (loading: boolean) => void;\n\n // Actions - Workspace\n setWorkspaces: (workspaces: Workspace[]) => void;\n setCurrentWorkspaceId: (workspaceId: string | null) => void;\n setWorkspaceToken: (token: string | null) => void;\n setLoadingWorkspaces: (loading: boolean) => void;\n clearWorkspace: () => void;\n\n // Actions - Project\n setProjects: (projects: Project[]) => void;\n setCurrentProjectId: (projectId: string | null) => void;\n setLoadingProjects: (loading: boolean) => void;\n clearProject: () => void;\n\n // Actions - Context (clears org, workspace, project)\n clearContext: () => void;\n\n // Actions - Profile Switch (load from profile storage without syncing back)\n loadFromProfile: (profileId: string) => void;\n\n // Actions - MFA\n setMfaRequired: (required: boolean, challengeId?: string) => void;\n setMfaDevices: (devices: MfaDevice[]) => void;\n removeMfaDevice: (deviceId: string) => void;\n\n // Actions - Sessions\n setActiveSessions: (sessions: Session[]) => void;\n removeSession: (sessionId: string) => void;\n\n // Actions - OAuth\n setLinkedAccounts: (accounts: OAuthAccount[]) => void;\n removeLinkedAccount: (accountId: string) => void;\n\n // Actions - Security\n setTrustedDevices: (devices: TrustedDevice[]) => void;\n removeTrustedDevice: (deviceId: string) => void;\n setSecurityEvents: (events: SecurityAudit[]) => void;\n\n // Actions - API Keys\n setApiKeys: (keys: ApiKey[]) => void;\n removeApiKey: (keyId: string) => void;\n\n // Actions - Apps\n setApps: (apps: App[]) => void;\n setCurrentApp: (app: App | null) => void;\n addApp: (app: App) => void;\n updateApp: (app: App) => void;\n removeApp: (appId: string) => void;\n\n // Actions - Delegations\n setDelegations: (delegations: AppUserDelegation[]) => void;\n setGrantedDelegations: (delegations: AppUserDelegation[]) => void;\n addDelegation: (delegation: AppUserDelegation) => void;\n removeDelegation: (delegationId: string) => void;\n\n // Actions - UI\n setLoading: (loading: boolean) => void;\n setError: (error: string | null, errorCode?: string | null) => void;\n}\n\n/**\n * Auth Zustand store — browser-tab-local state.\n *\n * SAFE for in-memory (no Redis needed):\n * - accessToken / refreshToken / user: per-tab, backed by profileScopedStorage\n * (localStorage key bf-p-{profileId}-*). Tabs sharing the same profile ID\n * stay in sync via the \"bf-profile-storage-change\" custom event + \"storage\"\n * cross-tab event.\n * - workspaceToken: same pattern as above.\n * - mfaRequired / mfaChallengeId: transient login-flow state; not needed\n * cross-tab (each login has its own challenge).\n * - organizations / workspaces / projects lists: cached context, re-fetched\n * after account switch; no cross-tab sharing needed.\n * - UI state (isLoading, error): purely ephemeral.\n *\n * NOT safe for in-memory (needs Redis in future if required server-side):\n * - Nothing currently — all server-side session tracking is done by the\n * backend (global-auth-svc) using its own DB. The frontend only holds\n * short-lived JWT access tokens that expire independently.\n */\nexport const useAuthStore = create<AuthState>()(\n persist(\n (set) => ({\n // Initial state\n user: null,\n accessToken: null,\n refreshToken: null,\n isAuthenticated: false,\n organizations: [],\n currentOrganizationId: null,\n isLoadingOrganizations: false,\n workspaces: [],\n currentWorkspaceId: null,\n workspaceToken: null,\n isLoadingWorkspaces: false,\n projects: [],\n currentProjectId: null,\n isLoadingProjects: false,\n mfaRequired: false,\n mfaChallengeId: null,\n mfaDevices: [],\n activeSessions: [],\n currentSessionId: null,\n linkedAccounts: [],\n trustedDevices: [],\n securityEvents: [],\n apiKeys: [],\n apps: [],\n currentApp: null,\n delegations: [],\n grantedDelegations: [],\n isLoading: false,\n error: null,\n errorCode: null,\n\n // Actions - Auth (with profile storage sync)\n setUser: (user) => {\n set({ user });\n syncToProfileStorage({ user });\n },\n\n setAccessToken: (token) => {\n set({ accessToken: token });\n syncToProfileStorage({ accessToken: token });\n },\n\n setAuthTokens: (accessToken, refreshToken) => {\n // Only set tokens here. Do NOT overwrite user — setUser() handles that\n // with the full user object from the GraphQL response (firstName, lastName, etc.).\n // Fall back to JWT-decoded user ONLY if no user is currently in the store.\n const currentState = useAuthStore.getState();\n if (currentState.user) {\n // User already set (from setUser call) — just update tokens\n set({ accessToken, refreshToken });\n syncToProfileStorage({ accessToken, refreshToken });\n } else {\n // No user yet — decode JWT as fallback\n try {\n const b64 = accessToken\n .split(\".\")[1]\n .replace(/-/g, \"+\")\n .replace(/_/g, \"/\");\n const padded = b64.padEnd(Math.ceil(b64.length / 4) * 4, \"=\");\n const payload = JSON.parse(atob(padded));\n const user: User = {\n id: payload.sub,\n email: payload.email,\n username: payload.username,\n role: payload.role,\n status: \"ACTIVE\",\n emailVerified: true,\n mfaEnabled: false,\n createdAt: new Date().toISOString(),\n updatedAt: new Date().toISOString(),\n };\n set({ accessToken, refreshToken, user });\n syncToProfileStorage({ accessToken, refreshToken, user });\n } catch (error) {\n console.error(\"[AuthStore] Failed to decode JWT:\", error);\n set({ accessToken, refreshToken });\n syncToProfileStorage({ accessToken, refreshToken });\n }\n }\n },\n\n setAuthenticated: (isAuthenticated) => set({ isAuthenticated }),\n\n clearAuth: () => {\n set({\n user: null,\n accessToken: null,\n refreshToken: null,\n isAuthenticated: false,\n mfaRequired: false,\n mfaChallengeId: null,\n activeSessions: [],\n currentSessionId: null,\n organizations: [],\n currentOrganizationId: null,\n isLoadingOrganizations: false,\n workspaces: [],\n workspaceToken: null,\n currentWorkspaceId: null,\n isLoadingWorkspaces: false,\n projects: [],\n currentProjectId: null,\n isLoadingProjects: false,\n });\n syncToProfileStorage({ clear: true });\n },\n\n // Actions - Organization\n setOrganizations: (organizations) => set({ organizations }),\n\n setCurrentOrganizationId: (orgId) =>\n set((state) =>\n state.currentOrganizationId === orgId\n ? state\n : { currentOrganizationId: orgId },\n ),\n\n setLoadingOrganizations: (loading) =>\n set({ isLoadingOrganizations: loading }),\n\n // Actions - Workspace\n setWorkspaces: (workspaces) => set({ workspaces }),\n\n setCurrentWorkspaceId: (workspaceId) =>\n set((state) =>\n state.currentWorkspaceId === workspaceId\n ? state\n : { currentWorkspaceId: workspaceId },\n ),\n\n setWorkspaceToken: (token) => {\n set({ workspaceToken: token });\n syncToProfileStorage({ workspaceToken: token });\n },\n\n setLoadingWorkspaces: (loading) => set({ isLoadingWorkspaces: loading }),\n\n clearWorkspace: () =>\n set({ currentWorkspaceId: null, workspaceToken: null, workspaces: [] }),\n\n // Actions - Project\n setProjects: (projects) => set({ projects }),\n\n setCurrentProjectId: (projectId) =>\n set((state) =>\n state.currentProjectId === projectId\n ? state\n : { currentProjectId: projectId },\n ),\n\n setLoadingProjects: (loading) => set({ isLoadingProjects: loading }),\n\n clearProject: () => set({ currentProjectId: null, projects: [] }),\n\n // Actions - Context (clears org, workspace, project)\n clearContext: () =>\n set({\n organizations: [],\n currentOrganizationId: null,\n isLoadingOrganizations: false,\n workspaces: [],\n currentWorkspaceId: null,\n workspaceToken: null,\n isLoadingWorkspaces: false,\n projects: [],\n currentProjectId: null,\n isLoadingProjects: false,\n }),\n\n // Actions - Profile Switch\n // Loads user/tokens from profile-scoped localStorage WITHOUT syncing back.\n // Used during account switching to align zustand with the new active profile.\n loadFromProfile: (profileId: string) => {\n let user: User | null = null;\n let accessToken: string | null = null;\n let refreshToken: string | null = null;\n let workspaceToken: string | null = null;\n\n try {\n const userRaw = localStorage.getItem(pfKey(profileId, \"user\"));\n if (userRaw) user = JSON.parse(userRaw);\n } catch {\n /* ignore */\n }\n\n try {\n const tokensRaw = localStorage.getItem(pfKey(profileId, \"tokens\"));\n if (tokensRaw) {\n const tokens = JSON.parse(tokensRaw);\n accessToken = tokens.accessToken ?? null;\n refreshToken = tokens.refreshToken ?? null;\n }\n } catch {\n /* ignore */\n }\n\n workspaceToken = localStorage.getItem(\n pfKey(profileId, \"workspace-token\"),\n );\n\n // Set everything in one batch — clears context data so it will be re-fetched\n set({\n user,\n accessToken,\n refreshToken,\n isAuthenticated: !!accessToken && !!user,\n workspaceToken,\n // Clear all context — will be re-fetched for the new user\n organizations: [],\n currentOrganizationId: null,\n isLoadingOrganizations: false,\n workspaces: [],\n currentWorkspaceId: null,\n isLoadingWorkspaces: false,\n projects: [],\n currentProjectId: null,\n isLoadingProjects: false,\n // Clear MFA state\n mfaRequired: false,\n mfaChallengeId: null,\n });\n\n // Notify listeners (e.g., AuthTokenProvider) without writing back to storage\n notifyProfileStorageChange();\n },\n\n // Actions - MFA\n setMfaRequired: (required, challengeId) =>\n set({ mfaRequired: required, mfaChallengeId: challengeId || null }),\n\n setMfaDevices: (devices) => set({ mfaDevices: devices }),\n\n removeMfaDevice: (deviceId) =>\n set((state) => ({\n mfaDevices: state.mfaDevices.filter((d) => d.id !== deviceId),\n })),\n\n // Actions - Sessions\n setActiveSessions: (sessions) => set({ activeSessions: sessions }),\n\n removeSession: (sessionId) =>\n set((state) => ({\n activeSessions: state.activeSessions.filter(\n (s) => s.id !== sessionId,\n ),\n })),\n\n // Actions - OAuth\n setLinkedAccounts: (accounts) => set({ linkedAccounts: accounts }),\n\n removeLinkedAccount: (accountId) =>\n set((state) => ({\n linkedAccounts: state.linkedAccounts.filter(\n (a) => a.id !== accountId,\n ),\n })),\n\n // Actions - Security\n setTrustedDevices: (devices) => set({ trustedDevices: devices }),\n\n removeTrustedDevice: (deviceId) =>\n set((state) => ({\n trustedDevices: state.trustedDevices.filter((d) => d.id !== deviceId),\n })),\n\n setSecurityEvents: (events) => set({ securityEvents: events }),\n\n // Actions - API Keys\n setApiKeys: (keys) => set({ apiKeys: keys }),\n\n removeApiKey: (keyId) =>\n set((state) => ({\n apiKeys: state.apiKeys.filter((k) => k.id !== keyId),\n })),\n\n // Actions - Apps\n setApps: (apps) => set({ apps }),\n\n setCurrentApp: (app) => set({ currentApp: app }),\n\n addApp: (app) =>\n set((state) => ({\n apps: [...state.apps, app],\n })),\n\n updateApp: (app) =>\n set((state) => ({\n apps: state.apps.map((a) => (a.id === app.id ? app : a)),\n currentApp: state.currentApp?.id === app.id ? app : state.currentApp,\n })),\n\n removeApp: (appId) =>\n set((state) => ({\n apps: state.apps.filter((a) => a.id !== appId),\n currentApp: state.currentApp?.id === appId ? null : state.currentApp,\n })),\n\n // Actions - Delegations\n setDelegations: (delegations) => set({ delegations }),\n\n setGrantedDelegations: (delegations) =>\n set({ grantedDelegations: delegations }),\n\n addDelegation: (delegation) =>\n set((state) => ({\n delegations: [...state.delegations, delegation],\n })),\n\n removeDelegation: (delegationId) =>\n set((state) => ({\n delegations: state.delegations.filter((d) => d.id !== delegationId),\n grantedDelegations: state.grantedDelegations.filter(\n (d) => d.id !== delegationId,\n ),\n })),\n\n // Actions - UI\n setLoading: (loading) => set({ isLoading: loading }),\n\n setError: (error, errorCode) =>\n set({ error, errorCode: errorCode ?? null }),\n }),\n {\n name: \"auth-storage\",\n storage: createProfileScopedStorage(),\n partialize: (state) => ({\n accessToken: state.accessToken,\n refreshToken: state.refreshToken,\n user: state.user,\n isAuthenticated: state.isAuthenticated,\n // Context state\n currentOrganizationId: state.currentOrganizationId,\n currentWorkspaceId: state.currentWorkspaceId,\n currentProjectId: state.currentProjectId,\n workspaceToken: state.workspaceToken,\n // MFA state must be persisted for login verification flow\n mfaRequired: state.mfaRequired,\n mfaChallengeId: state.mfaChallengeId,\n }),\n },\n ),\n);\n\ntype AuthClearWindow = Window & { __bfAuthClearListenerInstalled?: boolean };\n\nif (typeof window !== \"undefined\") {\n const authWindow = window as AuthClearWindow;\n if (!authWindow.__bfAuthClearListenerInstalled) {\n authWindow.__bfAuthClearListenerInstalled = true;\n window.addEventListener(AUTH_STATE_CLEARED_EVENT, () => {\n const state = useAuthStore.getState();\n if (\n state.isAuthenticated ||\n state.accessToken ||\n state.refreshToken ||\n state.user\n ) {\n state.clearAuth();\n return;\n }\n clearPersistedAuthStorage(sessionStorage.getItem(BF_ACTIVE));\n });\n }\n}\n"],"mappings":";;;;AAuBA,IAAM,IAAY,QACZ,IAAc,eACd,IAAY,qBACZ,IAAmB,gBACnB,IAA2B;AAEjC,SAAS,IAAyC;CAChD,OAAO,eAAe,QAAQ,CAAS;AACzC;AAEA,SAAS,EAAM,GAAmB,GAAwB;CACxD,OAAO,GAAG,EAAU,GAAG,EAAU,GAAG;AACtC;AAEA,SAAS,EAA0B,GAAiC;CAElE,AADA,aAAa,WAAW,CAAgB,GACpC,KACF,aAAa,WAAW,EAAM,GAAW,CAAgB,CAAC;CAE5D,KAAK,IAAM,KAAO,OAAO,KAAK,YAAY,GACxC,AACE,EAAI,WAAW,GAAG,EAAU,EAAE,KAC9B,EAAI,SAAS,IAAI,GAAkB,KAEnC,aAAa,WAAW,CAAG;AAGjC;AAWA,SAAS,IAAmC;CAC1C,AAAI,OAAO,SAAW,OACpB,OAAO,cAAc,IAAI,MAAM,2BAA2B,CAAC;AAE/D;AAEA,SAAS,EAAqB,GAM3B;CACD,IAAI,OAAO,SAAW,KAAa;CAEnC,IAAM,IAAY,EAAwB;CAC1C,IAAI,CAAC,KAAa,CAAC,EAAK,QAAQ,CAAC,EAAK,OAAO;CAK7C,IAAM,IAAW,EAAK,MAAM,MAAM;CAC9B,OAAC,KAAY,CAAC,EAAK,QAEvB;MAAI,EAAK,OAAO;GAEd,IADA,EAA0B,CAAQ,GAC9B,CAAC,GAAU;IAEb,AADA,aAAa,WAAW,CAAW,GACnC,eAAe,WAAW,CAAS;IACnC;GACF;GAIA,AAFA,aAAa,WAAW,EAAM,GAAU,MAAM,CAAC,GAC/C,aAAa,WAAW,EAAM,GAAU,QAAQ,CAAC,GACjD,aAAa,WAAW,EAAM,GAAU,iBAAiB,CAAC;GAE1D,IAAI;IACF,IAAM,IAAc,aAAa,QAAQ,CAAW,GAI9C,KAH0B,IAC5B,KAAK,MAAM,CAAW,IACtB,CAAC,GACqB,QAAQ,MAAM,EAAE,OAAO,CAAQ;IACzD,aAAa,QAAQ,GAAa,KAAK,UAAU,CAAQ,CAAC;GAC5D,QAAQ,CAER;GACA,eAAe,WAAW,CAAS;GACnC;EACF;EAEK,OAEL;OAAI,EAAK,MAAM;IACb,aAAa,QAAQ,EAAM,GAAU,MAAM,GAAG,KAAK,UAAU,EAAK,IAAI,CAAC;IAEvE,IAAI;KACF,IAAM,IAAc,aAAa,QAAQ,CAAW,GAI9C,KAH0B,IAC5B,KAAK,MAAM,CAAW,IACtB,CAAC,GACqB,QAAQ,MAAM,EAAE,OAAO,CAAQ;KAUzD,AATA,EAAS,KAAK;MACZ,IAAI;MACJ,OAAO,EAAK,KAAK,SAAS;MAC1B,MACE,EAAK,KAAK,QACV,GAAG,EAAK,KAAK,aAAa,GAAG,GAAG,EAAK,KAAK,YAAY,KAAK,KAAK;MAClE,QAAQ,EAAK,KAAK;MAClB,4BAAW,IAAI,KAAK,GAAE,YAAY;KACpC,CAAC,GACD,aAAa,QAAQ,GAAa,KAAK,UAAU,CAAQ,CAAC;IAC5D,QAAQ,CAER;IAEA,eAAe,QAAQ,GAAW,CAAQ;GAC5C;GAEA,IAAI,EAAK,gBAAgB,KAAA,KAAa,EAAK,iBAAiB,KAAA,GAAW;IACrE,IAAM,IAAc,aAAa,QAAQ,EAAM,GAAU,QAAQ,CAAC,GAC5D,IAAW,IAAc,KAAK,MAAM,CAAW,IAAI,CAAC,GAEtD,IAAY,EAAS,aAAa,KAAK,IAAI,IAAI,OAAU,KACvD,IAAe,EAAK,eAAe,EAAS;IAClD,IAAI,GACF,IAAI;KACF,IAAM,IAAM,EACT,MAAM,GAAG,EAAE,GACX,QAAQ,MAAM,GAAG,EACjB,QAAQ,MAAM,GAAG,GACd,IAAS,EAAI,OAAO,KAAK,KAAK,EAAI,SAAS,CAAC,IAAI,GAAG,GAAG,GACtD,IAAU,KAAK,MAAM,KAAK,CAAM,CAAC;KACvC,AAAI,OAAO,EAAQ,OAAQ,aACzB,IAAY,EAAQ,MAAM;IAE9B,QAAQ,CAER;IAEF,IAAM,IAAS;KACb,GAAG;KACH,GAAI,EAAK,gBAAgB,KAAA,IAErB,CAAC,IADD,EAAE,aAAa,EAAK,YAAY;KAEpC,GAAI,EAAK,iBAAiB,KAAA,IAEtB,CAAC,IADD,EAAE,cAAc,EAAK,aAAa;KAEtC;IACF;IACA,AAAI,EAAO,cACT,aAAa,QAAQ,EAAM,GAAU,QAAQ,GAAG,KAAK,UAAU,CAAM,CAAC,IAEtE,aAAa,WAAW,EAAM,GAAU,QAAQ,CAAC;GAErD;GAcA,AAZI,EAAK,mBAAmB,KAAA,MACtB,EAAK,iBACP,aAAa,QACX,EAAM,GAAU,iBAAiB,GACjC,EAAK,cACP,IAEA,aAAa,WAAW,EAAM,GAAU,iBAAiB,CAAC,IAK9D,EAA2B;GAK3B,IAAI;IACF,IAAM,IAAW,OAAO,SAAS,UAI3B,IADiB,EAAS,SAAS,sBAC1B,IAAiB,yBAAyB,KAAA,GAGnD,IAAa,GAFA,IAAS,YAAY,MAAW,GAElB,wBADd,OAAO,SAAS,aAAa,WAAW,aAAa;IAGxE,IAAI,EAAK,eAAe,GAAU;KAEhC,IAAM,IAAW,KAAK,UAAU;MAC9B,IAAI;MACJ,QAAQ,OAAO,SAAS;KAC1B,CAAC;KAED,AADA,SAAS,SAAS,UAAU,mBAAmB,CAAQ,IAAI,EAAW,kBACtE,SAAS,SAAS,kBAAkB,mBAAmB,CAAQ,IAAI,EAAW;IAChF;IAEA,AAAI,EAAK,UACP,SAAS,SAAS,8BAClB,SAAS,SAAS,sCACd,MACF,SAAS,SAAS,2BAA2B,EAAO,cACpD,SAAS,SAAS,mCAAmC,EAAO,eAE1D,KAAY,CAAC,CAAC,aAAa,WAAW,EAAE,SAAS,CAAQ,MAC3D,SAAS,SAAS,2BAA2B,EAAS,cACtD,SAAS,SAAS,mCAAmC,EAAS;GAGpE,QAAQ,CAER;EA3FA;CA5BA;AAwHF;AAoJA,IAAa,IAAe,EAAkB,EAC5C,GACG,OAAS;CAER,MAAM;CACN,aAAa;CACb,cAAc;CACd,iBAAiB;CACjB,eAAe,CAAC;CAChB,uBAAuB;CACvB,wBAAwB;CACxB,YAAY,CAAC;CACb,oBAAoB;CACpB,gBAAgB;CAChB,qBAAqB;CACrB,UAAU,CAAC;CACX,kBAAkB;CAClB,mBAAmB;CACnB,aAAa;CACb,gBAAgB;CAChB,YAAY,CAAC;CACb,gBAAgB,CAAC;CACjB,kBAAkB;CAClB,gBAAgB,CAAC;CACjB,gBAAgB,CAAC;CACjB,gBAAgB,CAAC;CACjB,SAAS,CAAC;CACV,MAAM,CAAC;CACP,YAAY;CACZ,aAAa,CAAC;CACd,oBAAoB,CAAC;CACrB,WAAW;CACX,OAAO;CACP,WAAW;CAGX,UAAU,MAAS;EAEjB,AADA,EAAI,EAAE,QAAK,CAAC,GACZ,EAAqB,EAAE,QAAK,CAAC;CAC/B;CAEA,iBAAiB,MAAU;EAEzB,AADA,EAAI,EAAE,aAAa,EAAM,CAAC,GAC1B,EAAqB,EAAE,aAAa,EAAM,CAAC;CAC7C;CAEA,gBAAgB,GAAa,MAAiB;EAK5C,IADqB,EAAa,SAC9B,EAAa,MAGf,AADA,EAAI;GAAE;GAAa;EAAa,CAAC,GACjC,EAAqB;GAAE;GAAa;EAAa,CAAC;OAGlD,IAAI;GACF,IAAM,IAAM,EACT,MAAM,GAAG,EAAE,GACX,QAAQ,MAAM,GAAG,EACjB,QAAQ,MAAM,GAAG,GACd,IAAS,EAAI,OAAO,KAAK,KAAK,EAAI,SAAS,CAAC,IAAI,GAAG,GAAG,GACtD,IAAU,KAAK,MAAM,KAAK,CAAM,CAAC,GACjC,IAAa;IACjB,IAAI,EAAQ;IACZ,OAAO,EAAQ;IACf,UAAU,EAAQ;IAClB,MAAM,EAAQ;IACd,QAAQ;IACR,eAAe;IACf,YAAY;IACZ,4BAAW,IAAI,KAAK,GAAE,YAAY;IAClC,4BAAW,IAAI,KAAK,GAAE,YAAY;GACpC;GAEA,AADA,EAAI;IAAE;IAAa;IAAc;GAAK,CAAC,GACvC,EAAqB;IAAE;IAAa;IAAc;GAAK,CAAC;EAC1D,SAAS,GAAO;GAGd,AAFA,QAAQ,MAAM,qCAAqC,CAAK,GACxD,EAAI;IAAE;IAAa;GAAa,CAAC,GACjC,EAAqB;IAAE;IAAa;GAAa,CAAC;EACpD;CAEJ;CAEA,mBAAmB,MAAoB,EAAI,EAAE,mBAAgB,CAAC;CAE9D,iBAAiB;EAqBf,AApBA,EAAI;GACF,MAAM;GACN,aAAa;GACb,cAAc;GACd,iBAAiB;GACjB,aAAa;GACb,gBAAgB;GAChB,gBAAgB,CAAC;GACjB,kBAAkB;GAClB,eAAe,CAAC;GAChB,uBAAuB;GACvB,wBAAwB;GACxB,YAAY,CAAC;GACb,gBAAgB;GAChB,oBAAoB;GACpB,qBAAqB;GACrB,UAAU,CAAC;GACX,kBAAkB;GAClB,mBAAmB;EACrB,CAAC,GACD,EAAqB,EAAE,OAAO,GAAK,CAAC;CACtC;CAGA,mBAAmB,MAAkB,EAAI,EAAE,iBAAc,CAAC;CAE1D,2BAA2B,MACzB,GAAK,MACH,EAAM,0BAA0B,IAC5B,IACA,EAAE,uBAAuB,EAAM,CACrC;CAEF,0BAA0B,MACxB,EAAI,EAAE,wBAAwB,EAAQ,CAAC;CAGzC,gBAAgB,MAAe,EAAI,EAAE,cAAW,CAAC;CAEjD,wBAAwB,MACtB,GAAK,MACH,EAAM,uBAAuB,IACzB,IACA,EAAE,oBAAoB,EAAY,CACxC;CAEF,oBAAoB,MAAU;EAE5B,AADA,EAAI,EAAE,gBAAgB,EAAM,CAAC,GAC7B,EAAqB,EAAE,gBAAgB,EAAM,CAAC;CAChD;CAEA,uBAAuB,MAAY,EAAI,EAAE,qBAAqB,EAAQ,CAAC;CAEvE,sBACE,EAAI;EAAE,oBAAoB;EAAM,gBAAgB;EAAM,YAAY,CAAC;CAAE,CAAC;CAGxE,cAAc,MAAa,EAAI,EAAE,YAAS,CAAC;CAE3C,sBAAsB,MACpB,GAAK,MACH,EAAM,qBAAqB,IACvB,IACA,EAAE,kBAAkB,EAAU,CACpC;CAEF,qBAAqB,MAAY,EAAI,EAAE,mBAAmB,EAAQ,CAAC;CAEnE,oBAAoB,EAAI;EAAE,kBAAkB;EAAM,UAAU,CAAC;CAAE,CAAC;CAGhE,oBACE,EAAI;EACF,eAAe,CAAC;EAChB,uBAAuB;EACvB,wBAAwB;EACxB,YAAY,CAAC;EACb,oBAAoB;EACpB,gBAAgB;EAChB,qBAAqB;EACrB,UAAU,CAAC;EACX,kBAAkB;EAClB,mBAAmB;CACrB,CAAC;CAKH,kBAAkB,MAAsB;EACtC,IAAI,IAAoB,MACpB,IAA6B,MAC7B,IAA8B,MAC9B,IAAgC;EAEpC,IAAI;GACF,IAAM,IAAU,aAAa,QAAQ,EAAM,GAAW,MAAM,CAAC;GAC7D,AAAI,MAAS,IAAO,KAAK,MAAM,CAAO;EACxC,QAAQ,CAER;EAEA,IAAI;GACF,IAAM,IAAY,aAAa,QAAQ,EAAM,GAAW,QAAQ,CAAC;GACjE,IAAI,GAAW;IACb,IAAM,IAAS,KAAK,MAAM,CAAS;IAEnC,AADA,IAAc,EAAO,eAAe,MACpC,IAAe,EAAO,gBAAgB;GACxC;EACF,QAAQ,CAER;EA6BA,AA3BA,IAAiB,aAAa,QAC5B,EAAM,GAAW,iBAAiB,CACpC,GAGA,EAAI;GACF;GACA;GACA;GACA,iBAAiB,CAAC,CAAC,KAAe,CAAC,CAAC;GACpC;GAEA,eAAe,CAAC;GAChB,uBAAuB;GACvB,wBAAwB;GACxB,YAAY,CAAC;GACb,oBAAoB;GACpB,qBAAqB;GACrB,UAAU,CAAC;GACX,kBAAkB;GAClB,mBAAmB;GAEnB,aAAa;GACb,gBAAgB;EAClB,CAAC,GAGD,EAA2B;CAC7B;CAGA,iBAAiB,GAAU,MACzB,EAAI;EAAE,aAAa;EAAU,gBAAgB,KAAe;CAAK,CAAC;CAEpE,gBAAgB,MAAY,EAAI,EAAE,YAAY,EAAQ,CAAC;CAEvD,kBAAkB,MAChB,GAAK,OAAW,EACd,YAAY,EAAM,WAAW,QAAQ,MAAM,EAAE,OAAO,CAAQ,EAC9D,EAAE;CAGJ,oBAAoB,MAAa,EAAI,EAAE,gBAAgB,EAAS,CAAC;CAEjE,gBAAgB,MACd,GAAK,OAAW,EACd,gBAAgB,EAAM,eAAe,QAClC,MAAM,EAAE,OAAO,CAClB,EACF,EAAE;CAGJ,oBAAoB,MAAa,EAAI,EAAE,gBAAgB,EAAS,CAAC;CAEjE,sBAAsB,MACpB,GAAK,OAAW,EACd,gBAAgB,EAAM,eAAe,QAClC,MAAM,EAAE,OAAO,CAClB,EACF,EAAE;CAGJ,oBAAoB,MAAY,EAAI,EAAE,gBAAgB,EAAQ,CAAC;CAE/D,sBAAsB,MACpB,GAAK,OAAW,EACd,gBAAgB,EAAM,eAAe,QAAQ,MAAM,EAAE,OAAO,CAAQ,EACtE,EAAE;CAEJ,oBAAoB,MAAW,EAAI,EAAE,gBAAgB,EAAO,CAAC;CAG7D,aAAa,MAAS,EAAI,EAAE,SAAS,EAAK,CAAC;CAE3C,eAAe,MACb,GAAK,OAAW,EACd,SAAS,EAAM,QAAQ,QAAQ,MAAM,EAAE,OAAO,CAAK,EACrD,EAAE;CAGJ,UAAU,MAAS,EAAI,EAAE,QAAK,CAAC;CAE/B,gBAAgB,MAAQ,EAAI,EAAE,YAAY,EAAI,CAAC;CAE/C,SAAS,MACP,GAAK,OAAW,EACd,MAAM,CAAC,GAAG,EAAM,MAAM,CAAG,EAC3B,EAAE;CAEJ,YAAY,MACV,GAAK,OAAW;EACd,MAAM,EAAM,KAAK,KAAK,MAAO,EAAE,OAAO,EAAI,KAAK,IAAM,CAAE;EACvD,YAAY,EAAM,YAAY,OAAO,EAAI,KAAK,IAAM,EAAM;CAC5D,EAAE;CAEJ,YAAY,MACV,GAAK,OAAW;EACd,MAAM,EAAM,KAAK,QAAQ,MAAM,EAAE,OAAO,CAAK;EAC7C,YAAY,EAAM,YAAY,OAAO,IAAQ,OAAO,EAAM;CAC5D,EAAE;CAGJ,iBAAiB,MAAgB,EAAI,EAAE,eAAY,CAAC;CAEpD,wBAAwB,MACtB,EAAI,EAAE,oBAAoB,EAAY,CAAC;CAEzC,gBAAgB,MACd,GAAK,OAAW,EACd,aAAa,CAAC,GAAG,EAAM,aAAa,CAAU,EAChD,EAAE;CAEJ,mBAAmB,MACjB,GAAK,OAAW;EACd,aAAa,EAAM,YAAY,QAAQ,MAAM,EAAE,OAAO,CAAY;EAClE,oBAAoB,EAAM,mBAAmB,QAC1C,MAAM,EAAE,OAAO,CAClB;CACF,EAAE;CAGJ,aAAa,MAAY,EAAI,EAAE,WAAW,EAAQ,CAAC;CAEnD,WAAW,GAAO,MAChB,EAAI;EAAE;EAAO,WAAW,KAAa;CAAK,CAAC;AAC/C,IACA;CACE,MAAM;CACN,SAAS,EAA2B;CACpC,aAAa,OAAW;EACtB,aAAa,EAAM;EACnB,cAAc,EAAM;EACpB,MAAM,EAAM;EACZ,iBAAiB,EAAM;EAEvB,uBAAuB,EAAM;EAC7B,oBAAoB,EAAM;EAC1B,kBAAkB,EAAM;EACxB,gBAAgB,EAAM;EAEtB,aAAa,EAAM;EACnB,gBAAgB,EAAM;CACxB;AACF,CACF,CACF;AAIA,IAAI,OAAO,SAAW,KAAa;CACjC,IAAM,IAAa;CACnB,AAAK,EAAW,mCACd,EAAW,iCAAiC,IAC5C,OAAO,iBAAiB,SAAgC;EACtD,IAAM,IAAQ,EAAa,SAAS;EACpC,IACE,EAAM,mBACN,EAAM,eACN,EAAM,gBACN,EAAM,MACN;GACA,EAAM,UAAU;GAChB;EACF;EACA,EAA0B,eAAe,QAAQ,CAAS,CAAC;CAC7D,CAAC;AAEL"}
|
|
1
|
+
{"version":3,"file":"authStore.js","names":[],"sources":["../../../src/auth/store/authStore.ts"],"sourcesContent":["import { create } from \"zustand\";\nimport { persist } from \"zustand/middleware\";\nimport { createProfileScopedStorage } from \"@burdenoff/fe-libs/shared/utils\";\nimport type {\n User,\n Session,\n MfaDevice,\n OAuthAccount,\n TrustedDevice,\n SecurityAudit,\n ApiKey,\n App,\n AppUserDelegation,\n Workspace,\n Organization,\n Project,\n} from \"../types\";\n\n/**\n * Sync auth state to profile-scoped storage (ProfileStorageManager keys).\n * The active profile ID comes from sessionStorage (\"bf-active-profile\").\n * Data is stored under localStorage keys: bf-p-{profileId}-user, bf-p-{profileId}-tokens, etc.\n */\nconst BF_PREFIX = \"bf-p\";\nconst BF_PROFILES = \"bf-profiles\";\nconst BF_ACTIVE = \"bf-active-profile\";\nconst AUTH_STORAGE_KEY = \"auth-storage\";\nconst AUTH_STATE_CLEARED_EVENT = \"bf-auth-state-cleared\";\n\nfunction getActiveProfileForSync(): string | null {\n return sessionStorage.getItem(BF_ACTIVE);\n}\n\nfunction pfKey(profileId: string, suffix: string): string {\n return `${BF_PREFIX}-${profileId}-${suffix}`;\n}\n\nfunction clearPersistedAuthStorage(profileId?: string | null): void {\n localStorage.removeItem(AUTH_STORAGE_KEY);\n if (profileId) {\n localStorage.removeItem(pfKey(profileId, AUTH_STORAGE_KEY));\n }\n for (const key of Object.keys(localStorage)) {\n if (\n key.startsWith(`${BF_PREFIX}-`) &&\n key.endsWith(`-${AUTH_STORAGE_KEY}`)\n ) {\n localStorage.removeItem(key);\n }\n }\n}\n\ninterface ProfileMeta {\n id: string;\n email: string;\n name: string;\n avatar?: string;\n lastLogin: string;\n}\n\n/** Dispatch custom event to notify fe-libs AuthProvider of storage changes (same-tab). */\nfunction notifyProfileStorageChange(): void {\n if (typeof window !== \"undefined\") {\n window.dispatchEvent(new Event(\"bf-profile-storage-change\"));\n }\n}\n\nfunction syncToProfileStorage(data: {\n user?: User | null;\n accessToken?: string | null;\n refreshToken?: string | null;\n workspaceToken?: string | null;\n clear?: boolean;\n}) {\n if (typeof window === \"undefined\") return;\n\n const profileId = getActiveProfileForSync();\n if (!profileId && !data.user && !data.clear) return;\n\n // For login/signup: prefer the user's own ID as the target profile.\n // This prevents overwriting an existing active profile when a NEW user\n // signs up or logs in (multi-account scenario).\n const targetId = data.user?.id ?? profileId;\n if (!targetId && !data.clear) return;\n\n if (data.clear) {\n clearPersistedAuthStorage(targetId);\n if (!targetId) {\n localStorage.removeItem(BF_PROFILES);\n sessionStorage.removeItem(BF_ACTIVE);\n return;\n }\n // Remove profile data keys\n localStorage.removeItem(pfKey(targetId, \"user\"));\n localStorage.removeItem(pfKey(targetId, \"tokens\"));\n localStorage.removeItem(pfKey(targetId, \"workspace-token\"));\n // Remove from profiles list\n try {\n const profilesRaw = localStorage.getItem(BF_PROFILES);\n const profiles: ProfileMeta[] = profilesRaw\n ? JSON.parse(profilesRaw)\n : [];\n const filtered = profiles.filter((p) => p.id !== targetId);\n localStorage.setItem(BF_PROFILES, JSON.stringify(filtered));\n } catch {\n /* ignore */\n }\n sessionStorage.removeItem(BF_ACTIVE);\n return;\n }\n\n if (!targetId) return;\n\n // An account whose email is not verified cannot sign in (the backend rejects\n // it with EMAIL_NOT_VERIFIED), so it must never become a switchable profile.\n // signUp() keeps the pending user in this store for display only (BOFF-7215).\n if (data.user && data.user.emailVerified === false) return;\n\n if (data.user) {\n localStorage.setItem(pfKey(targetId, \"user\"), JSON.stringify(data.user));\n // Update profiles list\n try {\n const profilesRaw = localStorage.getItem(BF_PROFILES);\n const profiles: ProfileMeta[] = profilesRaw\n ? JSON.parse(profilesRaw)\n : [];\n const existing = profiles.filter((p) => p.id !== targetId);\n existing.push({\n id: targetId,\n email: data.user.email ?? \"\",\n name:\n data.user.name ??\n `${data.user.firstName ?? \"\"} ${data.user.lastName ?? \"\"}`.trim(),\n avatar: data.user.avatar,\n lastLogin: new Date().toISOString(),\n });\n localStorage.setItem(BF_PROFILES, JSON.stringify(existing));\n } catch {\n /* ignore */\n }\n // Set as active profile in this tab\n sessionStorage.setItem(BF_ACTIVE, targetId);\n }\n\n if (data.accessToken !== undefined || data.refreshToken !== undefined) {\n const existingRaw = localStorage.getItem(pfKey(targetId, \"tokens\"));\n const existing = existingRaw ? JSON.parse(existingRaw) : {};\n // Compute expiresAt from the actual JWT exp claim if a new access token is provided\n let expiresAt = existing.expiresAt ?? Date.now() + 60 * 60 * 1000;\n const tokenToCheck = data.accessToken ?? existing.accessToken;\n if (tokenToCheck) {\n try {\n const raw = tokenToCheck\n .split(\".\")[1]\n .replace(/-/g, \"+\")\n .replace(/_/g, \"/\");\n const padded = raw.padEnd(Math.ceil(raw.length / 4) * 4, \"=\");\n const payload = JSON.parse(atob(padded));\n if (typeof payload.exp === \"number\") {\n expiresAt = payload.exp * 1000; // JWT exp is in seconds → ms\n }\n } catch {\n // Fallback: keep existing or default 1h\n }\n }\n const merged = {\n ...existing,\n ...(data.accessToken !== undefined\n ? { accessToken: data.accessToken }\n : {}),\n ...(data.refreshToken !== undefined\n ? { refreshToken: data.refreshToken }\n : {}),\n expiresAt,\n };\n if (merged.accessToken) {\n localStorage.setItem(pfKey(targetId, \"tokens\"), JSON.stringify(merged));\n } else {\n localStorage.removeItem(pfKey(targetId, \"tokens\"));\n }\n }\n\n if (data.workspaceToken !== undefined) {\n if (data.workspaceToken) {\n localStorage.setItem(\n pfKey(targetId, \"workspace-token\"),\n data.workspaceToken,\n );\n } else {\n localStorage.removeItem(pfKey(targetId, \"workspace-token\"));\n }\n }\n\n // Notify fe-libs AuthProvider of the change (same-tab custom event)\n notifyProfileStorageChange();\n\n // Set SSO cookie for cross-domain session sharing (works in all envs)\n // Stores profile ID + the origin where the user logged in.\n // Other shells use the origin to redirect to /auth/sso-relay for token relay.\n try {\n const hostname = window.location.hostname;\n // For local dev, set cookie on shared .local.burdenoff.com domain\n // For production, set cookie on current domain only (relay handles cross-domain)\n const isSharedDomain = hostname.endsWith(\".local.burdenoff.com\");\n const domain = isSharedDomain ? \".local.burdenoff.com\" : undefined;\n const domainPart = domain ? `; domain=${domain}` : \"\";\n const securePart = window.location.protocol === \"https:\" ? \"; secure\" : \"\";\n const cookieOpts = `${domainPart}; path=/; samesite=lax${securePart}`;\n\n if (data.accessToken && targetId) {\n // Store profile ID + login origin for SSO relay\n const ssoValue = JSON.stringify({\n id: targetId,\n origin: window.location.origin,\n });\n document.cookie = `bf-sso=${encodeURIComponent(ssoValue)}${cookieOpts}; max-age=86400`;\n document.cookie = `bf-sso-profile=${encodeURIComponent(ssoValue)}${cookieOpts}; max-age=86400`;\n }\n\n if (data.clear) {\n document.cookie = \"bf-sso=; path=/; max-age=0\";\n document.cookie = \"bf-sso-profile=; path=/; max-age=0\";\n if (domain) {\n document.cookie = `bf-sso=; path=/; domain=${domain}; max-age=0`;\n document.cookie = `bf-sso-profile=; path=/; domain=${domain}; max-age=0`;\n }\n if (hostname && ![\"localhost\", \"127.0.0.1\"].includes(hostname)) {\n document.cookie = `bf-sso=; path=/; domain=${hostname}; max-age=0`;\n document.cookie = `bf-sso-profile=; path=/; domain=${hostname}; max-age=0`;\n }\n }\n } catch {\n /* ignore */\n }\n}\n\ninterface AuthState {\n // Auth state\n user: User | null;\n accessToken: string | null;\n refreshToken: string | null;\n isAuthenticated: boolean;\n\n // Organization state\n organizations: Organization[];\n currentOrganizationId: string | null;\n isLoadingOrganizations: boolean;\n\n // Workspace state\n workspaces: Workspace[];\n currentWorkspaceId: string | null;\n workspaceToken: string | null;\n isLoadingWorkspaces: boolean;\n\n // Project state\n projects: Project[];\n currentProjectId: string | null;\n isLoadingProjects: boolean;\n\n // MFA state\n mfaRequired: boolean;\n mfaChallengeId: string | null;\n mfaDevices: MfaDevice[];\n\n // Session state\n activeSessions: Session[];\n currentSessionId: string | null;\n\n // OAuth state\n linkedAccounts: OAuthAccount[];\n\n // Security state\n trustedDevices: TrustedDevice[];\n securityEvents: SecurityAudit[];\n\n // API Keys state\n apiKeys: ApiKey[];\n\n // Apps state\n apps: App[];\n currentApp: App | null;\n\n // Delegations state\n delegations: AppUserDelegation[];\n grantedDelegations: AppUserDelegation[];\n\n // UI state\n isLoading: boolean;\n error: string | null;\n errorCode: string | null;\n\n // Actions - Auth\n setUser: (user: User | null) => void;\n setAccessToken: (token: string | null) => void;\n setAuthTokens: (accessToken: string, refreshToken: string) => void;\n setAuthenticated: (isAuthenticated: boolean) => void;\n clearAuth: () => void;\n\n // Actions - Organization\n setOrganizations: (organizations: Organization[]) => void;\n setCurrentOrganizationId: (orgId: string | null) => void;\n setLoadingOrganizations: (loading: boolean) => void;\n\n // Actions - Workspace\n setWorkspaces: (workspaces: Workspace[]) => void;\n setCurrentWorkspaceId: (workspaceId: string | null) => void;\n setWorkspaceToken: (token: string | null) => void;\n setLoadingWorkspaces: (loading: boolean) => void;\n clearWorkspace: () => void;\n\n // Actions - Project\n setProjects: (projects: Project[]) => void;\n setCurrentProjectId: (projectId: string | null) => void;\n setLoadingProjects: (loading: boolean) => void;\n clearProject: () => void;\n\n // Actions - Context (clears org, workspace, project)\n clearContext: () => void;\n\n // Actions - Profile Switch (load from profile storage without syncing back)\n loadFromProfile: (profileId: string) => void;\n\n // Actions - MFA\n setMfaRequired: (required: boolean, challengeId?: string) => void;\n setMfaDevices: (devices: MfaDevice[]) => void;\n removeMfaDevice: (deviceId: string) => void;\n\n // Actions - Sessions\n setActiveSessions: (sessions: Session[]) => void;\n removeSession: (sessionId: string) => void;\n\n // Actions - OAuth\n setLinkedAccounts: (accounts: OAuthAccount[]) => void;\n removeLinkedAccount: (accountId: string) => void;\n\n // Actions - Security\n setTrustedDevices: (devices: TrustedDevice[]) => void;\n removeTrustedDevice: (deviceId: string) => void;\n setSecurityEvents: (events: SecurityAudit[]) => void;\n\n // Actions - API Keys\n setApiKeys: (keys: ApiKey[]) => void;\n removeApiKey: (keyId: string) => void;\n\n // Actions - Apps\n setApps: (apps: App[]) => void;\n setCurrentApp: (app: App | null) => void;\n addApp: (app: App) => void;\n updateApp: (app: App) => void;\n removeApp: (appId: string) => void;\n\n // Actions - Delegations\n setDelegations: (delegations: AppUserDelegation[]) => void;\n setGrantedDelegations: (delegations: AppUserDelegation[]) => void;\n addDelegation: (delegation: AppUserDelegation) => void;\n removeDelegation: (delegationId: string) => void;\n\n // Actions - UI\n setLoading: (loading: boolean) => void;\n setError: (error: string | null, errorCode?: string | null) => void;\n}\n\n/**\n * Auth Zustand store — browser-tab-local state.\n *\n * SAFE for in-memory (no Redis needed):\n * - accessToken / refreshToken / user: per-tab, backed by profileScopedStorage\n * (localStorage key bf-p-{profileId}-*). Tabs sharing the same profile ID\n * stay in sync via the \"bf-profile-storage-change\" custom event + \"storage\"\n * cross-tab event.\n * - workspaceToken: same pattern as above.\n * - mfaRequired / mfaChallengeId: transient login-flow state; not needed\n * cross-tab (each login has its own challenge).\n * - organizations / workspaces / projects lists: cached context, re-fetched\n * after account switch; no cross-tab sharing needed.\n * - UI state (isLoading, error): purely ephemeral.\n *\n * NOT safe for in-memory (needs Redis in future if required server-side):\n * - Nothing currently — all server-side session tracking is done by the\n * backend (global-auth-svc) using its own DB. The frontend only holds\n * short-lived JWT access tokens that expire independently.\n */\nexport const useAuthStore = create<AuthState>()(\n persist(\n (set) => ({\n // Initial state\n user: null,\n accessToken: null,\n refreshToken: null,\n isAuthenticated: false,\n organizations: [],\n currentOrganizationId: null,\n isLoadingOrganizations: false,\n workspaces: [],\n currentWorkspaceId: null,\n workspaceToken: null,\n isLoadingWorkspaces: false,\n projects: [],\n currentProjectId: null,\n isLoadingProjects: false,\n mfaRequired: false,\n mfaChallengeId: null,\n mfaDevices: [],\n activeSessions: [],\n currentSessionId: null,\n linkedAccounts: [],\n trustedDevices: [],\n securityEvents: [],\n apiKeys: [],\n apps: [],\n currentApp: null,\n delegations: [],\n grantedDelegations: [],\n isLoading: false,\n error: null,\n errorCode: null,\n\n // Actions - Auth (with profile storage sync)\n setUser: (user) => {\n set({ user });\n syncToProfileStorage({ user });\n },\n\n setAccessToken: (token) => {\n set({ accessToken: token });\n syncToProfileStorage({ accessToken: token });\n },\n\n setAuthTokens: (accessToken, refreshToken) => {\n // Only set tokens here. Do NOT overwrite user — setUser() handles that\n // with the full user object from the GraphQL response (firstName, lastName, etc.).\n // Fall back to JWT-decoded user ONLY if no user is currently in the store.\n const currentState = useAuthStore.getState();\n if (currentState.user) {\n // User already set (from setUser call) — just update tokens\n set({ accessToken, refreshToken });\n syncToProfileStorage({ accessToken, refreshToken });\n } else {\n // No user yet — decode JWT as fallback\n try {\n const b64 = accessToken\n .split(\".\")[1]\n .replace(/-/g, \"+\")\n .replace(/_/g, \"/\");\n const padded = b64.padEnd(Math.ceil(b64.length / 4) * 4, \"=\");\n const payload = JSON.parse(atob(padded));\n const user: User = {\n id: payload.sub,\n email: payload.email,\n username: payload.username,\n role: payload.role,\n status: \"ACTIVE\",\n emailVerified: true,\n mfaEnabled: false,\n createdAt: new Date().toISOString(),\n updatedAt: new Date().toISOString(),\n };\n set({ accessToken, refreshToken, user });\n syncToProfileStorage({ accessToken, refreshToken, user });\n } catch (error) {\n console.error(\"[AuthStore] Failed to decode JWT:\", error);\n set({ accessToken, refreshToken });\n syncToProfileStorage({ accessToken, refreshToken });\n }\n }\n },\n\n setAuthenticated: (isAuthenticated) => set({ isAuthenticated }),\n\n clearAuth: () => {\n set({\n user: null,\n accessToken: null,\n refreshToken: null,\n isAuthenticated: false,\n mfaRequired: false,\n mfaChallengeId: null,\n activeSessions: [],\n currentSessionId: null,\n organizations: [],\n currentOrganizationId: null,\n isLoadingOrganizations: false,\n workspaces: [],\n workspaceToken: null,\n currentWorkspaceId: null,\n isLoadingWorkspaces: false,\n projects: [],\n currentProjectId: null,\n isLoadingProjects: false,\n });\n syncToProfileStorage({ clear: true });\n },\n\n // Actions - Organization\n setOrganizations: (organizations) => set({ organizations }),\n\n setCurrentOrganizationId: (orgId) =>\n set((state) =>\n state.currentOrganizationId === orgId\n ? state\n : { currentOrganizationId: orgId },\n ),\n\n setLoadingOrganizations: (loading) =>\n set({ isLoadingOrganizations: loading }),\n\n // Actions - Workspace\n setWorkspaces: (workspaces) => set({ workspaces }),\n\n setCurrentWorkspaceId: (workspaceId) =>\n set((state) =>\n state.currentWorkspaceId === workspaceId\n ? state\n : { currentWorkspaceId: workspaceId },\n ),\n\n setWorkspaceToken: (token) => {\n set({ workspaceToken: token });\n syncToProfileStorage({ workspaceToken: token });\n },\n\n setLoadingWorkspaces: (loading) => set({ isLoadingWorkspaces: loading }),\n\n clearWorkspace: () =>\n set({ currentWorkspaceId: null, workspaceToken: null, workspaces: [] }),\n\n // Actions - Project\n setProjects: (projects) => set({ projects }),\n\n setCurrentProjectId: (projectId) =>\n set((state) =>\n state.currentProjectId === projectId\n ? state\n : { currentProjectId: projectId },\n ),\n\n setLoadingProjects: (loading) => set({ isLoadingProjects: loading }),\n\n clearProject: () => set({ currentProjectId: null, projects: [] }),\n\n // Actions - Context (clears org, workspace, project)\n clearContext: () =>\n set({\n organizations: [],\n currentOrganizationId: null,\n isLoadingOrganizations: false,\n workspaces: [],\n currentWorkspaceId: null,\n workspaceToken: null,\n isLoadingWorkspaces: false,\n projects: [],\n currentProjectId: null,\n isLoadingProjects: false,\n }),\n\n // Actions - Profile Switch\n // Loads user/tokens from profile-scoped localStorage WITHOUT syncing back.\n // Used during account switching to align zustand with the new active profile.\n loadFromProfile: (profileId: string) => {\n let user: User | null = null;\n let accessToken: string | null = null;\n let refreshToken: string | null = null;\n let workspaceToken: string | null = null;\n\n try {\n const userRaw = localStorage.getItem(pfKey(profileId, \"user\"));\n if (userRaw) user = JSON.parse(userRaw);\n } catch {\n /* ignore */\n }\n\n try {\n const tokensRaw = localStorage.getItem(pfKey(profileId, \"tokens\"));\n if (tokensRaw) {\n const tokens = JSON.parse(tokensRaw);\n accessToken = tokens.accessToken ?? null;\n refreshToken = tokens.refreshToken ?? null;\n }\n } catch {\n /* ignore */\n }\n\n workspaceToken = localStorage.getItem(\n pfKey(profileId, \"workspace-token\"),\n );\n\n // Set everything in one batch — clears context data so it will be re-fetched\n set({\n user,\n accessToken,\n refreshToken,\n isAuthenticated: !!accessToken && !!user,\n workspaceToken,\n // Clear all context — will be re-fetched for the new user\n organizations: [],\n currentOrganizationId: null,\n isLoadingOrganizations: false,\n workspaces: [],\n currentWorkspaceId: null,\n isLoadingWorkspaces: false,\n projects: [],\n currentProjectId: null,\n isLoadingProjects: false,\n // Clear MFA state\n mfaRequired: false,\n mfaChallengeId: null,\n });\n\n // Notify listeners (e.g., AuthTokenProvider) without writing back to storage\n notifyProfileStorageChange();\n },\n\n // Actions - MFA\n setMfaRequired: (required, challengeId) =>\n set({ mfaRequired: required, mfaChallengeId: challengeId || null }),\n\n setMfaDevices: (devices) => set({ mfaDevices: devices }),\n\n removeMfaDevice: (deviceId) =>\n set((state) => ({\n mfaDevices: state.mfaDevices.filter((d) => d.id !== deviceId),\n })),\n\n // Actions - Sessions\n setActiveSessions: (sessions) => set({ activeSessions: sessions }),\n\n removeSession: (sessionId) =>\n set((state) => ({\n activeSessions: state.activeSessions.filter(\n (s) => s.id !== sessionId,\n ),\n })),\n\n // Actions - OAuth\n setLinkedAccounts: (accounts) => set({ linkedAccounts: accounts }),\n\n removeLinkedAccount: (accountId) =>\n set((state) => ({\n linkedAccounts: state.linkedAccounts.filter(\n (a) => a.id !== accountId,\n ),\n })),\n\n // Actions - Security\n setTrustedDevices: (devices) => set({ trustedDevices: devices }),\n\n removeTrustedDevice: (deviceId) =>\n set((state) => ({\n trustedDevices: state.trustedDevices.filter((d) => d.id !== deviceId),\n })),\n\n setSecurityEvents: (events) => set({ securityEvents: events }),\n\n // Actions - API Keys\n setApiKeys: (keys) => set({ apiKeys: keys }),\n\n removeApiKey: (keyId) =>\n set((state) => ({\n apiKeys: state.apiKeys.filter((k) => k.id !== keyId),\n })),\n\n // Actions - Apps\n setApps: (apps) => set({ apps }),\n\n setCurrentApp: (app) => set({ currentApp: app }),\n\n addApp: (app) =>\n set((state) => ({\n apps: [...state.apps, app],\n })),\n\n updateApp: (app) =>\n set((state) => ({\n apps: state.apps.map((a) => (a.id === app.id ? app : a)),\n currentApp: state.currentApp?.id === app.id ? app : state.currentApp,\n })),\n\n removeApp: (appId) =>\n set((state) => ({\n apps: state.apps.filter((a) => a.id !== appId),\n currentApp: state.currentApp?.id === appId ? null : state.currentApp,\n })),\n\n // Actions - Delegations\n setDelegations: (delegations) => set({ delegations }),\n\n setGrantedDelegations: (delegations) =>\n set({ grantedDelegations: delegations }),\n\n addDelegation: (delegation) =>\n set((state) => ({\n delegations: [...state.delegations, delegation],\n })),\n\n removeDelegation: (delegationId) =>\n set((state) => ({\n delegations: state.delegations.filter((d) => d.id !== delegationId),\n grantedDelegations: state.grantedDelegations.filter(\n (d) => d.id !== delegationId,\n ),\n })),\n\n // Actions - UI\n setLoading: (loading) => set({ isLoading: loading }),\n\n setError: (error, errorCode) =>\n set({ error, errorCode: errorCode ?? null }),\n }),\n {\n name: \"auth-storage\",\n storage: createProfileScopedStorage(),\n partialize: (state) => ({\n accessToken: state.accessToken,\n refreshToken: state.refreshToken,\n user: state.user,\n isAuthenticated: state.isAuthenticated,\n // Context state\n currentOrganizationId: state.currentOrganizationId,\n currentWorkspaceId: state.currentWorkspaceId,\n currentProjectId: state.currentProjectId,\n workspaceToken: state.workspaceToken,\n // MFA state must be persisted for login verification flow\n mfaRequired: state.mfaRequired,\n mfaChallengeId: state.mfaChallengeId,\n }),\n },\n ),\n);\n\ntype AuthClearWindow = Window & { __bfAuthClearListenerInstalled?: boolean };\n\nif (typeof window !== \"undefined\") {\n const authWindow = window as AuthClearWindow;\n if (!authWindow.__bfAuthClearListenerInstalled) {\n authWindow.__bfAuthClearListenerInstalled = true;\n window.addEventListener(AUTH_STATE_CLEARED_EVENT, () => {\n const state = useAuthStore.getState();\n if (\n state.isAuthenticated ||\n state.accessToken ||\n state.refreshToken ||\n state.user\n ) {\n state.clearAuth();\n return;\n }\n clearPersistedAuthStorage(sessionStorage.getItem(BF_ACTIVE));\n });\n }\n}\n"],"mappings":";;;;AAuBA,IAAM,IAAY,QACZ,IAAc,eACd,IAAY,qBACZ,IAAmB,gBACnB,IAA2B;AAEjC,SAAS,IAAyC;CAChD,OAAO,eAAe,QAAQ,CAAS;AACzC;AAEA,SAAS,EAAM,GAAmB,GAAwB;CACxD,OAAO,GAAG,EAAU,GAAG,EAAU,GAAG;AACtC;AAEA,SAAS,EAA0B,GAAiC;CAElE,AADA,aAAa,WAAW,CAAgB,GACpC,KACF,aAAa,WAAW,EAAM,GAAW,CAAgB,CAAC;CAE5D,KAAK,IAAM,KAAO,OAAO,KAAK,YAAY,GACxC,AACE,EAAI,WAAW,GAAG,EAAU,EAAE,KAC9B,EAAI,SAAS,IAAI,GAAkB,KAEnC,aAAa,WAAW,CAAG;AAGjC;AAWA,SAAS,IAAmC;CAC1C,AAAI,OAAO,SAAW,OACpB,OAAO,cAAc,IAAI,MAAM,2BAA2B,CAAC;AAE/D;AAEA,SAAS,EAAqB,GAM3B;CACD,IAAI,OAAO,SAAW,KAAa;CAEnC,IAAM,IAAY,EAAwB;CAC1C,IAAI,CAAC,KAAa,CAAC,EAAK,QAAQ,CAAC,EAAK,OAAO;CAK7C,IAAM,IAAW,EAAK,MAAM,MAAM;CAC9B,OAAC,KAAY,CAAC,EAAK,QAEvB;MAAI,EAAK,OAAO;GAEd,IADA,EAA0B,CAAQ,GAC9B,CAAC,GAAU;IAEb,AADA,aAAa,WAAW,CAAW,GACnC,eAAe,WAAW,CAAS;IACnC;GACF;GAIA,AAFA,aAAa,WAAW,EAAM,GAAU,MAAM,CAAC,GAC/C,aAAa,WAAW,EAAM,GAAU,QAAQ,CAAC,GACjD,aAAa,WAAW,EAAM,GAAU,iBAAiB,CAAC;GAE1D,IAAI;IACF,IAAM,IAAc,aAAa,QAAQ,CAAW,GAI9C,KAH0B,IAC5B,KAAK,MAAM,CAAW,IACtB,CAAC,GACqB,QAAQ,MAAM,EAAE,OAAO,CAAQ;IACzD,aAAa,QAAQ,GAAa,KAAK,UAAU,CAAQ,CAAC;GAC5D,QAAQ,CAER;GACA,eAAe,WAAW,CAAS;GACnC;EACF;EAEK,SAKD,IAAK,QAAQ,EAAK,KAAK,kBAAkB,KAE7C;OAAI,EAAK,MAAM;IACb,aAAa,QAAQ,EAAM,GAAU,MAAM,GAAG,KAAK,UAAU,EAAK,IAAI,CAAC;IAEvE,IAAI;KACF,IAAM,IAAc,aAAa,QAAQ,CAAW,GAI9C,KAH0B,IAC5B,KAAK,MAAM,CAAW,IACtB,CAAC,GACqB,QAAQ,MAAM,EAAE,OAAO,CAAQ;KAUzD,AATA,EAAS,KAAK;MACZ,IAAI;MACJ,OAAO,EAAK,KAAK,SAAS;MAC1B,MACE,EAAK,KAAK,QACV,GAAG,EAAK,KAAK,aAAa,GAAG,GAAG,EAAK,KAAK,YAAY,KAAK,KAAK;MAClE,QAAQ,EAAK,KAAK;MAClB,4BAAW,IAAI,KAAK,GAAE,YAAY;KACpC,CAAC,GACD,aAAa,QAAQ,GAAa,KAAK,UAAU,CAAQ,CAAC;IAC5D,QAAQ,CAER;IAEA,eAAe,QAAQ,GAAW,CAAQ;GAC5C;GAEA,IAAI,EAAK,gBAAgB,KAAA,KAAa,EAAK,iBAAiB,KAAA,GAAW;IACrE,IAAM,IAAc,aAAa,QAAQ,EAAM,GAAU,QAAQ,CAAC,GAC5D,IAAW,IAAc,KAAK,MAAM,CAAW,IAAI,CAAC,GAEtD,IAAY,EAAS,aAAa,KAAK,IAAI,IAAI,OAAU,KACvD,IAAe,EAAK,eAAe,EAAS;IAClD,IAAI,GACF,IAAI;KACF,IAAM,IAAM,EACT,MAAM,GAAG,EAAE,GACX,QAAQ,MAAM,GAAG,EACjB,QAAQ,MAAM,GAAG,GACd,IAAS,EAAI,OAAO,KAAK,KAAK,EAAI,SAAS,CAAC,IAAI,GAAG,GAAG,GACtD,IAAU,KAAK,MAAM,KAAK,CAAM,CAAC;KACvC,AAAI,OAAO,EAAQ,OAAQ,aACzB,IAAY,EAAQ,MAAM;IAE9B,QAAQ,CAER;IAEF,IAAM,IAAS;KACb,GAAG;KACH,GAAI,EAAK,gBAAgB,KAAA,IAErB,CAAC,IADD,EAAE,aAAa,EAAK,YAAY;KAEpC,GAAI,EAAK,iBAAiB,KAAA,IAEtB,CAAC,IADD,EAAE,cAAc,EAAK,aAAa;KAEtC;IACF;IACA,AAAI,EAAO,cACT,aAAa,QAAQ,EAAM,GAAU,QAAQ,GAAG,KAAK,UAAU,CAAM,CAAC,IAEtE,aAAa,WAAW,EAAM,GAAU,QAAQ,CAAC;GAErD;GAcA,AAZI,EAAK,mBAAmB,KAAA,MACtB,EAAK,iBACP,aAAa,QACX,EAAM,GAAU,iBAAiB,GACjC,EAAK,cACP,IAEA,aAAa,WAAW,EAAM,GAAU,iBAAiB,CAAC,IAK9D,EAA2B;GAK3B,IAAI;IACF,IAAM,IAAW,OAAO,SAAS,UAI3B,IADiB,EAAS,SAAS,sBAC1B,IAAiB,yBAAyB,KAAA,GAGnD,IAAa,GAFA,IAAS,YAAY,MAAW,GAElB,wBADd,OAAO,SAAS,aAAa,WAAW,aAAa;IAGxE,IAAI,EAAK,eAAe,GAAU;KAEhC,IAAM,IAAW,KAAK,UAAU;MAC9B,IAAI;MACJ,QAAQ,OAAO,SAAS;KAC1B,CAAC;KAED,AADA,SAAS,SAAS,UAAU,mBAAmB,CAAQ,IAAI,EAAW,kBACtE,SAAS,SAAS,kBAAkB,mBAAmB,CAAQ,IAAI,EAAW;IAChF;IAEA,AAAI,EAAK,UACP,SAAS,SAAS,8BAClB,SAAS,SAAS,sCACd,MACF,SAAS,SAAS,2BAA2B,EAAO,cACpD,SAAS,SAAS,mCAAmC,EAAO,eAE1D,KAAY,CAAC,CAAC,aAAa,WAAW,EAAE,SAAS,CAAQ,MAC3D,SAAS,SAAS,2BAA2B,EAAS,cACtD,SAAS,SAAS,mCAAmC,EAAS;GAGpE,QAAQ,CAER;EA3FA;CAjCA;AA6HF;AAoJA,IAAa,IAAe,EAAkB,EAC5C,GACG,OAAS;CAER,MAAM;CACN,aAAa;CACb,cAAc;CACd,iBAAiB;CACjB,eAAe,CAAC;CAChB,uBAAuB;CACvB,wBAAwB;CACxB,YAAY,CAAC;CACb,oBAAoB;CACpB,gBAAgB;CAChB,qBAAqB;CACrB,UAAU,CAAC;CACX,kBAAkB;CAClB,mBAAmB;CACnB,aAAa;CACb,gBAAgB;CAChB,YAAY,CAAC;CACb,gBAAgB,CAAC;CACjB,kBAAkB;CAClB,gBAAgB,CAAC;CACjB,gBAAgB,CAAC;CACjB,gBAAgB,CAAC;CACjB,SAAS,CAAC;CACV,MAAM,CAAC;CACP,YAAY;CACZ,aAAa,CAAC;CACd,oBAAoB,CAAC;CACrB,WAAW;CACX,OAAO;CACP,WAAW;CAGX,UAAU,MAAS;EAEjB,AADA,EAAI,EAAE,QAAK,CAAC,GACZ,EAAqB,EAAE,QAAK,CAAC;CAC/B;CAEA,iBAAiB,MAAU;EAEzB,AADA,EAAI,EAAE,aAAa,EAAM,CAAC,GAC1B,EAAqB,EAAE,aAAa,EAAM,CAAC;CAC7C;CAEA,gBAAgB,GAAa,MAAiB;EAK5C,IADqB,EAAa,SAC9B,EAAa,MAGf,AADA,EAAI;GAAE;GAAa;EAAa,CAAC,GACjC,EAAqB;GAAE;GAAa;EAAa,CAAC;OAGlD,IAAI;GACF,IAAM,IAAM,EACT,MAAM,GAAG,EAAE,GACX,QAAQ,MAAM,GAAG,EACjB,QAAQ,MAAM,GAAG,GACd,IAAS,EAAI,OAAO,KAAK,KAAK,EAAI,SAAS,CAAC,IAAI,GAAG,GAAG,GACtD,IAAU,KAAK,MAAM,KAAK,CAAM,CAAC,GACjC,IAAa;IACjB,IAAI,EAAQ;IACZ,OAAO,EAAQ;IACf,UAAU,EAAQ;IAClB,MAAM,EAAQ;IACd,QAAQ;IACR,eAAe;IACf,YAAY;IACZ,4BAAW,IAAI,KAAK,GAAE,YAAY;IAClC,4BAAW,IAAI,KAAK,GAAE,YAAY;GACpC;GAEA,AADA,EAAI;IAAE;IAAa;IAAc;GAAK,CAAC,GACvC,EAAqB;IAAE;IAAa;IAAc;GAAK,CAAC;EAC1D,SAAS,GAAO;GAGd,AAFA,QAAQ,MAAM,qCAAqC,CAAK,GACxD,EAAI;IAAE;IAAa;GAAa,CAAC,GACjC,EAAqB;IAAE;IAAa;GAAa,CAAC;EACpD;CAEJ;CAEA,mBAAmB,MAAoB,EAAI,EAAE,mBAAgB,CAAC;CAE9D,iBAAiB;EAqBf,AApBA,EAAI;GACF,MAAM;GACN,aAAa;GACb,cAAc;GACd,iBAAiB;GACjB,aAAa;GACb,gBAAgB;GAChB,gBAAgB,CAAC;GACjB,kBAAkB;GAClB,eAAe,CAAC;GAChB,uBAAuB;GACvB,wBAAwB;GACxB,YAAY,CAAC;GACb,gBAAgB;GAChB,oBAAoB;GACpB,qBAAqB;GACrB,UAAU,CAAC;GACX,kBAAkB;GAClB,mBAAmB;EACrB,CAAC,GACD,EAAqB,EAAE,OAAO,GAAK,CAAC;CACtC;CAGA,mBAAmB,MAAkB,EAAI,EAAE,iBAAc,CAAC;CAE1D,2BAA2B,MACzB,GAAK,MACH,EAAM,0BAA0B,IAC5B,IACA,EAAE,uBAAuB,EAAM,CACrC;CAEF,0BAA0B,MACxB,EAAI,EAAE,wBAAwB,EAAQ,CAAC;CAGzC,gBAAgB,MAAe,EAAI,EAAE,cAAW,CAAC;CAEjD,wBAAwB,MACtB,GAAK,MACH,EAAM,uBAAuB,IACzB,IACA,EAAE,oBAAoB,EAAY,CACxC;CAEF,oBAAoB,MAAU;EAE5B,AADA,EAAI,EAAE,gBAAgB,EAAM,CAAC,GAC7B,EAAqB,EAAE,gBAAgB,EAAM,CAAC;CAChD;CAEA,uBAAuB,MAAY,EAAI,EAAE,qBAAqB,EAAQ,CAAC;CAEvE,sBACE,EAAI;EAAE,oBAAoB;EAAM,gBAAgB;EAAM,YAAY,CAAC;CAAE,CAAC;CAGxE,cAAc,MAAa,EAAI,EAAE,YAAS,CAAC;CAE3C,sBAAsB,MACpB,GAAK,MACH,EAAM,qBAAqB,IACvB,IACA,EAAE,kBAAkB,EAAU,CACpC;CAEF,qBAAqB,MAAY,EAAI,EAAE,mBAAmB,EAAQ,CAAC;CAEnE,oBAAoB,EAAI;EAAE,kBAAkB;EAAM,UAAU,CAAC;CAAE,CAAC;CAGhE,oBACE,EAAI;EACF,eAAe,CAAC;EAChB,uBAAuB;EACvB,wBAAwB;EACxB,YAAY,CAAC;EACb,oBAAoB;EACpB,gBAAgB;EAChB,qBAAqB;EACrB,UAAU,CAAC;EACX,kBAAkB;EAClB,mBAAmB;CACrB,CAAC;CAKH,kBAAkB,MAAsB;EACtC,IAAI,IAAoB,MACpB,IAA6B,MAC7B,IAA8B,MAC9B,IAAgC;EAEpC,IAAI;GACF,IAAM,IAAU,aAAa,QAAQ,EAAM,GAAW,MAAM,CAAC;GAC7D,AAAI,MAAS,IAAO,KAAK,MAAM,CAAO;EACxC,QAAQ,CAER;EAEA,IAAI;GACF,IAAM,IAAY,aAAa,QAAQ,EAAM,GAAW,QAAQ,CAAC;GACjE,IAAI,GAAW;IACb,IAAM,IAAS,KAAK,MAAM,CAAS;IAEnC,AADA,IAAc,EAAO,eAAe,MACpC,IAAe,EAAO,gBAAgB;GACxC;EACF,QAAQ,CAER;EA6BA,AA3BA,IAAiB,aAAa,QAC5B,EAAM,GAAW,iBAAiB,CACpC,GAGA,EAAI;GACF;GACA;GACA;GACA,iBAAiB,CAAC,CAAC,KAAe,CAAC,CAAC;GACpC;GAEA,eAAe,CAAC;GAChB,uBAAuB;GACvB,wBAAwB;GACxB,YAAY,CAAC;GACb,oBAAoB;GACpB,qBAAqB;GACrB,UAAU,CAAC;GACX,kBAAkB;GAClB,mBAAmB;GAEnB,aAAa;GACb,gBAAgB;EAClB,CAAC,GAGD,EAA2B;CAC7B;CAGA,iBAAiB,GAAU,MACzB,EAAI;EAAE,aAAa;EAAU,gBAAgB,KAAe;CAAK,CAAC;CAEpE,gBAAgB,MAAY,EAAI,EAAE,YAAY,EAAQ,CAAC;CAEvD,kBAAkB,MAChB,GAAK,OAAW,EACd,YAAY,EAAM,WAAW,QAAQ,MAAM,EAAE,OAAO,CAAQ,EAC9D,EAAE;CAGJ,oBAAoB,MAAa,EAAI,EAAE,gBAAgB,EAAS,CAAC;CAEjE,gBAAgB,MACd,GAAK,OAAW,EACd,gBAAgB,EAAM,eAAe,QAClC,MAAM,EAAE,OAAO,CAClB,EACF,EAAE;CAGJ,oBAAoB,MAAa,EAAI,EAAE,gBAAgB,EAAS,CAAC;CAEjE,sBAAsB,MACpB,GAAK,OAAW,EACd,gBAAgB,EAAM,eAAe,QAClC,MAAM,EAAE,OAAO,CAClB,EACF,EAAE;CAGJ,oBAAoB,MAAY,EAAI,EAAE,gBAAgB,EAAQ,CAAC;CAE/D,sBAAsB,MACpB,GAAK,OAAW,EACd,gBAAgB,EAAM,eAAe,QAAQ,MAAM,EAAE,OAAO,CAAQ,EACtE,EAAE;CAEJ,oBAAoB,MAAW,EAAI,EAAE,gBAAgB,EAAO,CAAC;CAG7D,aAAa,MAAS,EAAI,EAAE,SAAS,EAAK,CAAC;CAE3C,eAAe,MACb,GAAK,OAAW,EACd,SAAS,EAAM,QAAQ,QAAQ,MAAM,EAAE,OAAO,CAAK,EACrD,EAAE;CAGJ,UAAU,MAAS,EAAI,EAAE,QAAK,CAAC;CAE/B,gBAAgB,MAAQ,EAAI,EAAE,YAAY,EAAI,CAAC;CAE/C,SAAS,MACP,GAAK,OAAW,EACd,MAAM,CAAC,GAAG,EAAM,MAAM,CAAG,EAC3B,EAAE;CAEJ,YAAY,MACV,GAAK,OAAW;EACd,MAAM,EAAM,KAAK,KAAK,MAAO,EAAE,OAAO,EAAI,KAAK,IAAM,CAAE;EACvD,YAAY,EAAM,YAAY,OAAO,EAAI,KAAK,IAAM,EAAM;CAC5D,EAAE;CAEJ,YAAY,MACV,GAAK,OAAW;EACd,MAAM,EAAM,KAAK,QAAQ,MAAM,EAAE,OAAO,CAAK;EAC7C,YAAY,EAAM,YAAY,OAAO,IAAQ,OAAO,EAAM;CAC5D,EAAE;CAGJ,iBAAiB,MAAgB,EAAI,EAAE,eAAY,CAAC;CAEpD,wBAAwB,MACtB,EAAI,EAAE,oBAAoB,EAAY,CAAC;CAEzC,gBAAgB,MACd,GAAK,OAAW,EACd,aAAa,CAAC,GAAG,EAAM,aAAa,CAAU,EAChD,EAAE;CAEJ,mBAAmB,MACjB,GAAK,OAAW;EACd,aAAa,EAAM,YAAY,QAAQ,MAAM,EAAE,OAAO,CAAY;EAClE,oBAAoB,EAAM,mBAAmB,QAC1C,MAAM,EAAE,OAAO,CAClB;CACF,EAAE;CAGJ,aAAa,MAAY,EAAI,EAAE,WAAW,EAAQ,CAAC;CAEnD,WAAW,GAAO,MAChB,EAAI;EAAE;EAAO,WAAW,KAAa;CAAK,CAAC;AAC/C,IACA;CACE,MAAM;CACN,SAAS,EAA2B;CACpC,aAAa,OAAW;EACtB,aAAa,EAAM;EACnB,cAAc,EAAM;EACpB,MAAM,EAAM;EACZ,iBAAiB,EAAM;EAEvB,uBAAuB,EAAM;EAC7B,oBAAoB,EAAM;EAC1B,kBAAkB,EAAM;EACxB,gBAAgB,EAAM;EAEtB,aAAa,EAAM;EACnB,gBAAgB,EAAM;CACxB;AACF,CACF,CACF;AAIA,IAAI,OAAO,SAAW,KAAa;CACjC,IAAM,IAAa;CACnB,AAAK,EAAW,mCACd,EAAW,iCAAiC,IAC5C,OAAO,iBAAiB,SAAgC;EACtD,IAAM,IAAQ,EAAa,SAAS;EACpC,IACE,EAAM,mBACN,EAAM,eACN,EAAM,gBACN,EAAM,MACN;GACA,EAAM,UAAU;GAChB;EACF;EACA,EAA0B,eAAe,QAAQ,CAAS,CAAC;CAC7D,CAAC;AAEL"}
|