@burdenoff/microfe-auth 2026.510.127

package/dist/auth/pages/SsoConfigPage.js

@@ -0,0 +1,1144 @@
+import { useSsoOperations as e } from "../hooks/useSsoOperations.js";
+import { useAuthPermissions as t } from "../hooks/useAuthPermissions.js";
+import "../hooks/index.js";
+import { AlertIcon as n, SpinnerIcon as r } from "../components/AuthIcons.js";
+import { ConfirmActionDialog as i } from "../components/ConfirmActionDialog.js";
+import { nativeCopyText as a, nativeImpact as o, nativeNotify as s } from "../../utils/nativeBridge.js";
+import { useCallback as c, useEffect as l, useRef as u, useState as d } from "react";
+import { useNavigate as f } from "react-router-dom";
+import { useI18n as p } from "@burdenoff/fe-libs/shared/providers/shell";
+import { Fragment as m, jsx as h, jsxs as g } from "react/jsx-runtime";
+//#region src/auth/pages/SsoConfigPage.tsx
+var _ = async (e) => {
+	o("light"), s(await a(e) ? "success" : "error");
+};
+function v(e) {
+	try {
+		let t = new DOMParser().parseFromString(e, "text/xml"), n = t.querySelector("parsererror");
+		if (n) return console.error("XML parse error:", n.textContent), null;
+		let r = t.querySelector("EntityDescriptor")?.getAttribute("entityID") || "", i = t.querySelector("IDPSSODescriptor");
+		if (!i) return console.error("No IDPSSODescriptor found"), null;
+		let a = i.querySelectorAll("SingleSignOnService"), o = "";
+		for (let e of a) {
+			let t = e.getAttribute("Binding") || "";
+			if (t.includes("HTTP-Redirect") || t.includes("HTTP-POST")) {
+				o = e.getAttribute("Location") || "";
+				break;
+			}
+		}
+		let s = i.querySelectorAll("SingleLogoutService"), c = "";
+		for (let e of s) {
+			let t = e.getAttribute("Binding") || "";
+			if (t.includes("HTTP-Redirect") || t.includes("HTTP-POST")) {
+				c = e.getAttribute("Location") || "";
+				break;
+			}
+		}
+		let l = t.querySelector("X509Certificate")?.textContent?.trim() || "";
+		return l && !l.includes("-----BEGIN") && (l = `-----BEGIN CERTIFICATE-----\n${l}\n-----END CERTIFICATE-----`), !r || !o || !l ? (console.error("Missing required SAML metadata fields"), null) : {
+			entityId: r,
+			ssoUrl: o,
+			sloUrl: c,
+			certificate: l
+		};
+	} catch (e) {
+		return console.error("Failed to parse SAML metadata:", e), null;
+	}
+}
+function y() {
+	let a = f(), { canManageSsoConfig: y, isLoading: ee } = t(), b = u(null), { ssoConfig: x, oidcConfig: S, isLoading: C, isSaving: w, isDeleting: T, saveSsoConfig: E, deleteSsoConfig: D } = e("burdenoff.com"), { t: O } = p(), k = c((e, t) => {
+		let n = O(e);
+		return n === e ? t : n;
+	}, [O]), [A, j] = d("saml"), [M, N] = d(!1), [P, F] = d(!1), [I, L] = d(null), [R, z] = d(null), [B, V] = d(""), [H, U] = d(!1), [W, G] = d(!1), [K, q] = d({
+		client_name: "",
+		redirect_uris: "",
+		grant_types: ["authorization_code", "refresh_token"],
+		token_endpoint_auth_method: "none"
+	}), [J, Y] = d(!1), [X, Z] = d(null), [Q, $] = d({
+		entityId: "",
+		ssoUrl: "",
+		sloUrl: "",
+		certificate: "",
+		enabled: !1
+	});
+	return l(() => {
+		x && $({
+			entityId: x.entityId || "",
+			ssoUrl: x.ssoUrl || "",
+			sloUrl: x.sloUrl || "",
+			certificate: x.certificate || "",
+			enabled: x.enabled || !1
+		});
+	}, [x]), ee ? /* @__PURE__ */ h("div", {
+		className: "max-w-5xl mx-auto p-6",
+		children: /* @__PURE__ */ g("div", {
+			className: "text-center py-16",
+			children: [/* @__PURE__ */ h(r, { className: "w-8 h-8 mx-auto text-text-secondary animate-spin" }), /* @__PURE__ */ h("p", {
+				className: "mt-4 text-text-secondary",
+				children: k("auth.sso.loadingPermissions", "Loading permissions...")
+			})]
+		})
+	}) : y ? /* @__PURE__ */ g("div", {
+		className: "max-w-5xl mx-auto p-6",
+		children: [
+			/* @__PURE__ */ h(i, {
+				open: P,
+				onOpenChange: F,
+				title: k("auth.sso.deleteConfirmTitle", "Delete SSO configuration?"),
+				description: k("auth.sso.deleteConfirmDesc", "Users will immediately lose the ability to sign in with this SSO setup until a new configuration is saved."),
+				confirmText: k("auth.sso.deleteConfirmButton", "Delete configuration"),
+				variant: "danger",
+				isPending: T,
+				onConfirm: async () => {
+					L(null), z(null), o("medium");
+					try {
+						await D(), s("success"), z(k("auth.sso.deleteSuccess", "SSO configuration deleted successfully.")), F(!1), $({
+							entityId: "",
+							ssoUrl: "",
+							sloUrl: "",
+							certificate: "",
+							enabled: !1
+						});
+					} catch (e) {
+						s("error"), L(e instanceof Error ? e.message : k("auth.sso.deleteFailed", "Failed to delete configuration"));
+					}
+				}
+			}),
+			/* @__PURE__ */ g("div", {
+				className: "flex items-center justify-between mb-8",
+				children: [/* @__PURE__ */ g("div", {
+					className: "flex items-center gap-4",
+					children: [/* @__PURE__ */ h("button", {
+						onClick: () => a("/auth/security"),
+						className: "p-2 rounded-lg hover:bg-bg-sunken transition-colors",
+						children: /* @__PURE__ */ h("svg", {
+							className: "w-5 h-5 text-text-secondary",
+							fill: "none",
+							viewBox: "0 0 24 24",
+							stroke: "currentColor",
+							children: /* @__PURE__ */ h("path", {
+								strokeLinecap: "round",
+								strokeLinejoin: "round",
+								strokeWidth: 2,
+								d: "M10 19l-7-7m0 0l7-7m-7 7h18"
+							})
+						})
+					}), /* @__PURE__ */ g("div", { children: [/* @__PURE__ */ h("h1", {
+						className: "text-2xl font-semibold text-text-primary",
+						children: k("auth.sso.title", "Single Sign-On (SSO)")
+					}), /* @__PURE__ */ h("p", {
+						className: "text-text-secondary mt-1",
+						children: k("auth.sso.description", "Configure enterprise SSO with SAML 2.0 or OIDC")
+					})] })]
+				}), x && /* @__PURE__ */ g("div", {
+					className: "flex items-center gap-3",
+					children: [/* @__PURE__ */ h("span", {
+						className: `px-3 py-1 rounded-full text-sm font-medium ${Q.enabled ? "bg-status-success-bg-subtle text-status-success-text" : "bg-bg-sunken text-text-secondary"}`,
+						children: Q.enabled ? k("auth.sso.enabled", "Enabled") : k("auth.sso.disabled", "Disabled")
+					}), /* @__PURE__ */ h("button", {
+						onClick: async () => {
+							L(null);
+							try {
+								await E({
+									...Q,
+									enabled: !Q.enabled
+								}), z(Q.enabled ? k("auth.sso.ssoDisabled", "SSO disabled") : k("auth.sso.ssoEnabled", "SSO enabled"));
+							} catch (e) {
+								L(e instanceof Error ? e.message : k("auth.sso.statusUpdateFailed", "Failed to update status"));
+							}
+						},
+						disabled: w,
+						className: "px-4 py-2 rounded-lg border border-border-default text-text-primary hover:bg-bg-sunken transition-colors text-sm font-medium",
+						children: Q.enabled ? k("auth.sso.disable", "Disable") : k("auth.sso.enable", "Enable")
+					})]
+				})]
+			}),
+			I && /* @__PURE__ */ g("div", {
+				className: "mb-6 flex items-start gap-3 p-4 rounded-xl bg-status-error-bg-subtle border border-status-error-border",
+				children: [/* @__PURE__ */ h(n, { className: "w-5 h-5 text-status-error-text flex-shrink-0 mt-0.5" }), /* @__PURE__ */ g("div", {
+					className: "flex-1",
+					children: [/* @__PURE__ */ h("p", {
+						className: "text-sm text-status-error-text",
+						children: I
+					}), /* @__PURE__ */ h("button", {
+						onClick: () => L(null),
+						className: "mt-2 text-sm text-status-error-text hover:underline",
+						children: k("auth.sso.dismiss", "Dismiss")
+					})]
+				})]
+			}),
+			R && /* @__PURE__ */ g("div", {
+				className: "mb-6 flex items-start gap-3 p-4 rounded-xl bg-status-success-bg-subtle border border-status-success-border",
+				children: [/* @__PURE__ */ h("svg", {
+					className: "w-5 h-5 text-status-success-text flex-shrink-0 mt-0.5",
+					fill: "currentColor",
+					viewBox: "0 0 20 20",
+					children: /* @__PURE__ */ h("path", {
+						fillRule: "evenodd",
+						d: "M10 18a8 8 0 100-16 8 8 0 000 16zm3.707-9.293a1 1 0 00-1.414-1.414L9 10.586 7.707 9.293a1 1 0 00-1.414 1.414l2 2a1 1 0 001.414 0l4-4z",
+						clipRule: "evenodd"
+					})
+				}), /* @__PURE__ */ g("div", {
+					className: "flex-1",
+					children: [/* @__PURE__ */ h("p", {
+						className: "text-sm text-status-success-text",
+						children: R
+					}), /* @__PURE__ */ h("button", {
+						onClick: () => z(null),
+						className: "mt-2 text-sm text-status-success-text hover:underline",
+						children: k("auth.sso.dismiss", "Dismiss")
+					})]
+				})]
+			}),
+			/* @__PURE__ */ h("div", {
+				className: "mb-6 border-b border-border-subtle",
+				children: /* @__PURE__ */ h("nav", {
+					className: "flex gap-6",
+					children: [
+						{
+							id: "saml",
+							label: k("auth.sso.samlTab", "SAML 2.0"),
+							icon: "🔐"
+						},
+						{
+							id: "oidc",
+							label: k("auth.sso.oidcTab", "OIDC Provider"),
+							icon: "🌐"
+						},
+						{
+							id: "clients",
+							label: k("auth.sso.clientsTab", "OIDC Clients"),
+							icon: "🔑"
+						},
+						{
+							id: "test",
+							label: k("auth.sso.testTab", "Test SSO"),
+							icon: "🧪"
+						}
+					].map((e) => /* @__PURE__ */ g("button", {
+						onClick: () => j(e.id),
+						className: `pb-3 text-sm font-medium transition-colors relative ${A === e.id ? "text-text-link" : "text-text-secondary hover:text-text-primary"}`,
+						children: [/* @__PURE__ */ g("span", {
+							className: "flex items-center gap-2",
+							children: [/* @__PURE__ */ h("span", { children: e.icon }), e.label]
+						}), A === e.id && /* @__PURE__ */ h("span", { className: "absolute bottom-0 left-0 right-0 h-0.5 bg-action-primary-bg" })]
+					}, e.id))
+				})
+			}),
+			C && /* @__PURE__ */ g("div", {
+				className: "flex items-center justify-center py-12",
+				children: [/* @__PURE__ */ h(r, { className: "w-8 h-8 text-text-link animate-spin" }), /* @__PURE__ */ h("span", {
+					className: "ml-3 text-text-secondary",
+					children: k("auth.sso.loadingConfig", "Loading configuration...")
+				})]
+			}),
+			!C && A === "saml" && /* @__PURE__ */ g("div", {
+				className: "space-y-6",
+				children: [
+					/* @__PURE__ */ g("div", {
+						className: "p-4 rounded-xl bg-status-info-bg-subtle border border-status-info-border",
+						children: [
+							/* @__PURE__ */ h("h3", {
+								className: "font-medium text-status-info-text mb-2",
+								children: k("auth.sso.samlConfigTitle", "SAML 2.0 Configuration")
+							}),
+							/* @__PURE__ */ h("p", {
+								className: "text-sm text-status-info-text",
+								children: k("auth.sso.samlConfigDesc", "Configure your Identity Provider (IdP) to enable enterprise SSO. You'll need to get the following information from your IdP (Okta, Azure AD, OneLogin, etc.):")
+							}),
+							/* @__PURE__ */ g("ul", {
+								className: "mt-2 text-sm text-status-info-text list-disc list-inside",
+								children: [
+									/* @__PURE__ */ h("li", { children: k("auth.sso.entityIdItem", "Entity ID (Issuer URL)") }),
+									/* @__PURE__ */ h("li", { children: k("auth.sso.ssoUrlItem", "SSO URL (Login URL)") }),
+									/* @__PURE__ */ h("li", { children: k("auth.sso.certificateItem", "X.509 Certificate") })
+								]
+							})
+						]
+					}),
+					/* @__PURE__ */ g("div", {
+						className: "p-6 rounded-xl border border-border-subtle bg-bg-surface",
+						children: [
+							/* @__PURE__ */ h("h3", {
+								className: "text-lg font-medium text-text-primary mb-4",
+								children: k("auth.sso.importMetadata", "Import IdP Metadata")
+							}),
+							/* @__PURE__ */ h("p", {
+								className: "text-sm text-text-secondary mb-4",
+								children: k("auth.sso.importMetadataDesc", "Automatically configure SSO by importing your IdP's metadata XML file or URL.")
+							}),
+							/* @__PURE__ */ g("div", {
+								className: "grid grid-cols-1 md:grid-cols-2 gap-6",
+								children: [/* @__PURE__ */ g("div", {
+									className: "space-y-3",
+									children: [
+										/* @__PURE__ */ h("label", {
+											className: "block text-sm font-medium text-text-primary",
+											children: k("auth.sso.uploadFile", "Upload Metadata File")
+										}),
+										/* @__PURE__ */ h("input", {
+											ref: b,
+											type: "file",
+											accept: ".xml,application/xml,text/xml",
+											onChange: async (e) => {
+												let t = e.target.files?.[0];
+												if (t) {
+													L(null), U(!0);
+													try {
+														let e = v(await t.text());
+														e ? ($({
+															...Q,
+															entityId: e.entityId,
+															ssoUrl: e.ssoUrl,
+															sloUrl: e.sloUrl || "",
+															certificate: e.certificate
+														}), z(k("auth.sso.importSuccess", "SAML metadata imported successfully! Review and save the configuration.")), N(!0)) : L(k("auth.sso.parseError", "Failed to parse SAML metadata. Make sure the file contains valid IdP metadata XML."));
+													} catch {
+														L(k("auth.sso.readError", "Failed to read metadata file"));
+													} finally {
+														U(!1), b.current && (b.current.value = "");
+													}
+												}
+											},
+											className: "hidden",
+											id: "metadata-file"
+										}),
+										/* @__PURE__ */ g("label", {
+											htmlFor: "metadata-file",
+											className: "flex items-center justify-center gap-2 w-full px-4 py-3 border-2 border-dashed border-border-default rounded-xl cursor-pointer hover:border-action-primary-bg transition-colors",
+											children: [H ? /* @__PURE__ */ h(r, { className: "w-5 h-5 animate-spin text-text-link" }) : /* @__PURE__ */ h("svg", {
+												className: "w-5 h-5 text-text-tertiary",
+												fill: "none",
+												viewBox: "0 0 24 24",
+												stroke: "currentColor",
+												children: /* @__PURE__ */ h("path", {
+													strokeLinecap: "round",
+													strokeLinejoin: "round",
+													strokeWidth: 2,
+													d: "M7 16a4 4 0 01-.88-7.903A5 5 0 1115.9 6L16 6a5 5 0 011 9.9M15 13l-3-3m0 0l-3 3m3-3v12"
+												})
+											}), /* @__PURE__ */ h("span", {
+												className: "text-sm text-text-secondary",
+												children: H ? k("auth.sso.importing", "Importing...") : k("auth.sso.chooseFile", "Choose XML file")
+											})]
+										})
+									]
+								}), /* @__PURE__ */ g("div", {
+									className: "space-y-3",
+									children: [/* @__PURE__ */ h("label", {
+										className: "block text-sm font-medium text-text-primary",
+										children: k("auth.sso.fetchFromUrl", "Fetch from URL")
+									}), /* @__PURE__ */ g("div", {
+										className: "flex gap-2",
+										children: [/* @__PURE__ */ h("input", {
+											type: "url",
+											value: B,
+											onChange: (e) => V(e.target.value),
+											placeholder: "https://idp.example.com/metadata.xml",
+											className: "flex-1 px-4 py-2.5 border border-border-default rounded-xl bg-bg-surface text-text-primary placeholder-text-tertiary focus:outline-none focus:ring-2 focus:ring-action-primary-bg/20 focus:border-action-primary-bg transition-all text-sm"
+										}), /* @__PURE__ */ g("button", {
+											type: "button",
+											onClick: async () => {
+												if (!B) {
+													L(k("auth.sso.enterUrl", "Please enter a metadata URL"));
+													return;
+												}
+												L(null), U(!0);
+												try {
+													let e = await fetch(B);
+													if (!e.ok) throw Error(`Failed to fetch: ${e.statusText}`);
+													let t = v(await e.text());
+													t ? ($({
+														...Q,
+														entityId: t.entityId,
+														ssoUrl: t.ssoUrl,
+														sloUrl: t.sloUrl || "",
+														certificate: t.certificate
+													}), z("SAML metadata imported successfully! Review and save the configuration."), N(!0), V("")) : L(k("auth.sso.parseUrlError", "Failed to parse SAML metadata from URL."));
+												} catch (e) {
+													L(e instanceof Error ? e.message : k("auth.sso.fetchError", "Failed to fetch metadata from URL"));
+												} finally {
+													U(!1);
+												}
+											},
+											disabled: H || !B,
+											className: "px-4 py-2.5 rounded-xl bg-action-primary-bg text-white font-medium hover:bg-action-primary-bg-hover disabled:opacity-50 disabled:cursor-not-allowed transition-colors flex items-center gap-2",
+											children: [H ? /* @__PURE__ */ h(r, { className: "w-4 h-4 animate-spin" }) : /* @__PURE__ */ h("svg", {
+												className: "w-4 h-4",
+												fill: "none",
+												viewBox: "0 0 24 24",
+												stroke: "currentColor",
+												children: /* @__PURE__ */ h("path", {
+													strokeLinecap: "round",
+													strokeLinejoin: "round",
+													strokeWidth: 2,
+													d: "M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1m-4-4l-4 4m0 0l-4-4m4 4V4"
+												})
+											}), k("auth.sso.fetch", "Fetch")]
+										})]
+									})]
+								})]
+							})
+						]
+					}),
+					/* @__PURE__ */ g("div", {
+						className: "p-6 rounded-xl border border-border-subtle bg-bg-surface",
+						children: [
+							/* @__PURE__ */ h("h3", {
+								className: "text-lg font-medium text-text-primary mb-4",
+								children: k("auth.sso.spMetadata", "Service Provider (SP) Metadata")
+							}),
+							/* @__PURE__ */ h("p", {
+								className: "text-sm text-text-secondary mb-4",
+								children: k("auth.sso.spMetadataDesc", "Provide these values to your Identity Provider when setting up the SAML integration:")
+							}),
+							/* @__PURE__ */ g("div", {
+								className: "space-y-4",
+								children: [/* @__PURE__ */ g("div", { children: [/* @__PURE__ */ h("label", {
+									className: "block text-sm font-medium text-text-primary mb-1",
+									children: k("auth.sso.spEntityId", "SP Entity ID / Audience URI")
+								}), /* @__PURE__ */ g("div", {
+									className: "flex items-center gap-2",
+									children: [/* @__PURE__ */ g("code", {
+										className: "flex-1 px-3 py-2 rounded-lg bg-bg-sunken text-sm text-text-primary font-mono",
+										children: [window.location.origin, "/auth/saml/metadata"]
+									}), /* @__PURE__ */ h("button", {
+										onClick: () => void _(`${window.location.origin}/auth/saml/metadata`),
+										className: "px-3 py-2 rounded-lg border border-border-default text-text-secondary hover:bg-bg-sunken",
+										children: k("auth.sso.copy", "Copy")
+									})]
+								})] }), /* @__PURE__ */ g("div", { children: [/* @__PURE__ */ h("label", {
+									className: "block text-sm font-medium text-text-primary mb-1",
+									children: k("auth.sso.acsUrl", "Assertion Consumer Service (ACS) URL")
+								}), /* @__PURE__ */ g("div", {
+									className: "flex items-center gap-2",
+									children: [/* @__PURE__ */ g("code", {
+										className: "flex-1 px-3 py-2 rounded-lg bg-bg-sunken text-sm text-text-primary font-mono",
+										children: [window.location.origin, "/auth/sso/callback"]
+									}), /* @__PURE__ */ h("button", {
+										onClick: () => void _(`${window.location.origin}/auth/sso/callback`),
+										className: "px-3 py-2 rounded-lg border border-border-default text-text-secondary hover:bg-bg-sunken",
+										children: k("auth.sso.copy", "Copy")
+									})]
+								})] })]
+							})
+						]
+					}),
+					/* @__PURE__ */ g("form", {
+						onSubmit: async (e) => {
+							e.preventDefault(), L(null), z(null);
+							try {
+								await E(Q), z(k("auth.sso.saveSuccess", "SSO configuration saved successfully!")), N(!1);
+							} catch (e) {
+								L(e instanceof Error ? e.message : k("auth.sso.saveFailed", "Failed to save configuration"));
+							}
+						},
+						className: "p-6 rounded-xl border border-border-subtle bg-bg-surface",
+						children: [
+							/* @__PURE__ */ g("div", {
+								className: "flex items-center justify-between mb-6",
+								children: [/* @__PURE__ */ h("h3", {
+									className: "text-lg font-medium text-text-primary",
+									children: k("auth.sso.idpSettings", "Identity Provider (IdP) Settings")
+								}), !M && x && /* @__PURE__ */ h("button", {
+									type: "button",
+									onClick: () => N(!0),
+									className: "px-4 py-2 rounded-lg border border-status-info-border text-text-link hover:bg-status-info-bg-subtle text-sm font-medium transition-colors",
+									children: k("auth.sso.editConfig", "Edit Configuration")
+								})]
+							}),
+							/* @__PURE__ */ g("div", {
+								className: "space-y-5",
+								children: [
+									/* @__PURE__ */ g("div", { children: [
+										/* @__PURE__ */ g("label", {
+											className: "block text-sm font-medium text-text-primary mb-2",
+											children: [
+												k("auth.sso.idpEntityId", "IdP Entity ID / Issuer URL"),
+												" ",
+												/* @__PURE__ */ h("span", {
+													className: "text-status-error-text",
+													children: "*"
+												})
+											]
+										}),
+										/* @__PURE__ */ h("input", {
+											type: "url",
+											value: Q.entityId,
+											onChange: (e) => $({
+												...Q,
+												entityId: e.target.value
+											}),
+											disabled: !M && !!x,
+											placeholder: k("auth.sso.idpEntityIdPlaceholder", "https://your-idp.example.com/saml/metadata"),
+											required: !0,
+											className: "block w-full px-4 py-3 border border-border-default rounded-xl bg-bg-surface text-text-primary placeholder-text-tertiary focus:outline-none focus:ring-2 focus:ring-action-primary-bg/20 focus:border-action-primary-bg disabled:opacity-60 disabled:cursor-not-allowed transition-all"
+										}),
+										/* @__PURE__ */ h("p", {
+											className: "mt-1 text-xs text-text-secondary",
+											children: k("auth.sso.idpEntityIdHelper", "The unique identifier of your Identity Provider")
+										})
+									] }),
+									/* @__PURE__ */ g("div", { children: [
+										/* @__PURE__ */ g("label", {
+											className: "block text-sm font-medium text-text-primary mb-2",
+											children: [
+												k("auth.sso.ssoUrl", "SSO URL (Login URL)"),
+												" ",
+												/* @__PURE__ */ h("span", {
+													className: "text-status-error-text",
+													children: "*"
+												})
+											]
+										}),
+										/* @__PURE__ */ h("input", {
+											type: "url",
+											value: Q.ssoUrl,
+											onChange: (e) => $({
+												...Q,
+												ssoUrl: e.target.value
+											}),
+											disabled: !M && !!x,
+											placeholder: k("auth.sso.ssoUrlPlaceholder", "https://your-idp.example.com/saml/sso"),
+											required: !0,
+											className: "block w-full px-4 py-3 border border-border-default rounded-xl bg-bg-surface text-text-primary placeholder-text-tertiary focus:outline-none focus:ring-2 focus:ring-action-primary-bg/20 focus:border-action-primary-bg disabled:opacity-60 disabled:cursor-not-allowed transition-all"
+										}),
+										/* @__PURE__ */ h("p", {
+											className: "mt-1 text-xs text-text-secondary",
+											children: k("auth.sso.ssoUrlHelper", "The URL where users are redirected to authenticate")
+										})
+									] }),
+									/* @__PURE__ */ g("div", { children: [
+										/* @__PURE__ */ h("label", {
+											className: "block text-sm font-medium text-text-primary mb-2",
+											children: k("auth.sso.sloUrl", "Single Logout (SLO) URL")
+										}),
+										/* @__PURE__ */ h("input", {
+											type: "url",
+											value: Q.sloUrl,
+											onChange: (e) => $({
+												...Q,
+												sloUrl: e.target.value
+											}),
+											disabled: !M && !!x,
+											placeholder: k("auth.sso.sloUrlPlaceholder", "https://your-idp.example.com/saml/slo"),
+											className: "block w-full px-4 py-3 border border-border-default rounded-xl bg-bg-surface text-text-primary placeholder-text-tertiary focus:outline-none focus:ring-2 focus:ring-action-primary-bg/20 focus:border-action-primary-bg disabled:opacity-60 disabled:cursor-not-allowed transition-all"
+										}),
+										/* @__PURE__ */ h("p", {
+											className: "mt-1 text-xs text-text-secondary",
+											children: k("auth.sso.sloUrlHelper", "Optional: URL for single logout across all applications")
+										})
+									] }),
+									/* @__PURE__ */ g("div", { children: [
+										/* @__PURE__ */ g("label", {
+											className: "block text-sm font-medium text-text-primary mb-2",
+											children: [
+												k("auth.sso.certificate", "X.509 Certificate"),
+												" ",
+												/* @__PURE__ */ h("span", {
+													className: "text-status-error-text",
+													children: "*"
+												})
+											]
+										}),
+										/* @__PURE__ */ h("textarea", {
+											value: Q.certificate,
+											onChange: (e) => $({
+												...Q,
+												certificate: e.target.value
+											}),
+											disabled: !M && !!x,
+											placeholder: k("auth.sso.certificatePlaceholder", "-----BEGIN CERTIFICATE-----\nMIIDpDCCAoygAwIBAgIGAX...\n-----END CERTIFICATE-----"),
+											required: !0,
+											rows: 6,
+											className: "block w-full px-4 py-3 border border-border-default rounded-xl bg-bg-surface text-text-primary placeholder-text-tertiary focus:outline-none focus:ring-2 focus:ring-action-primary-bg/20 focus:border-action-primary-bg disabled:opacity-60 disabled:cursor-not-allowed transition-all font-mono text-sm"
+										}),
+										/* @__PURE__ */ h("p", {
+											className: "mt-1 text-xs text-text-secondary",
+											children: k("auth.sso.certificateHelper", "The public X.509 certificate from your IdP for signature verification")
+										})
+									] })
+								]
+							}),
+							(M || !x) && /* @__PURE__ */ g("div", {
+								className: "mt-6 flex items-center gap-3",
+								children: [/* @__PURE__ */ h("button", {
+									type: "submit",
+									disabled: w,
+									className: "auth-primary-button flex items-center gap-2 px-6 py-3 font-medium",
+									children: w ? /* @__PURE__ */ g(m, { children: [/* @__PURE__ */ h(r, { className: "w-4 h-4 animate-spin" }), k("auth.sso.saving", "Saving...")] }) : k("auth.sso.saveConfig", "Save Configuration")
+								}), M && /* @__PURE__ */ h("button", {
+									type: "button",
+									onClick: () => {
+										N(!1), x && $({
+											entityId: x.entityId || "",
+											ssoUrl: x.ssoUrl || "",
+											sloUrl: x.sloUrl || "",
+											certificate: x.certificate || "",
+											enabled: x.enabled || !1
+										});
+									},
+									className: "px-6 py-3 rounded-xl border border-border-default text-text-primary font-medium hover:bg-bg-sunken transition-colors",
+									children: k("auth.sso.cancel", "Cancel")
+								})]
+							})
+						]
+					}),
+					x && /* @__PURE__ */ g("div", {
+						className: "p-6 rounded-xl border border-status-error-border bg-status-error-bg-subtle",
+						children: [
+							/* @__PURE__ */ h("h3", {
+								className: "text-lg font-medium text-status-error-text mb-2",
+								children: k("auth.sso.dangerZone", "Danger Zone")
+							}),
+							/* @__PURE__ */ h("p", {
+								className: "text-sm text-status-error-text mb-4",
+								children: k("auth.sso.dangerZoneDesc", "Deleting the SSO configuration will prevent users from signing in with their enterprise credentials. This action cannot be undone.")
+							}),
+							/* @__PURE__ */ h("button", {
+								onClick: () => F(!0),
+								disabled: T,
+								className: "px-4 py-2 rounded-lg bg-status-error-bg text-white font-medium hover:bg-status-error-bg-hover disabled:opacity-50 transition-colors flex items-center gap-2",
+								children: T ? /* @__PURE__ */ g(m, { children: [/* @__PURE__ */ h(r, { className: "w-4 h-4 animate-spin" }), k("auth.sso.deleting", "Deleting...")] }) : k("auth.sso.deleteConfig", "Delete SSO Configuration")
+							})
+						]
+					})
+				]
+			}),
+			!C && A === "oidc" && /* @__PURE__ */ g("div", {
+				className: "space-y-6",
+				children: [
+					/* @__PURE__ */ g("div", {
+						className: "p-4 rounded-xl bg-accent-purple-subtle border border-accent-purple-subtle",
+						children: [/* @__PURE__ */ h("h3", {
+							className: "font-medium text-accent-purple mb-2",
+							children: k("auth.sso.oidcProviderInfo", "OIDC Provider Information")
+						}), /* @__PURE__ */ h("p", {
+							className: "text-sm text-accent-purple",
+							children: k("auth.sso.oidcProviderInfoDesc", "Your auth service acts as an OpenID Connect Provider. This allows other applications to authenticate users through your system using standard OAuth 2.0/OIDC flows.")
+						})]
+					}),
+					/* @__PURE__ */ g("div", {
+						className: "p-6 rounded-xl border border-border-subtle bg-bg-surface",
+						children: [
+							/* @__PURE__ */ h("h3", {
+								className: "text-lg font-medium text-text-primary mb-4",
+								children: k("auth.sso.discoveryEndpoint", "Discovery Endpoint")
+							}),
+							/* @__PURE__ */ h("p", {
+								className: "text-sm text-text-secondary mb-4",
+								children: k("auth.sso.discoveryEndpointDesc", "Applications can auto-configure by fetching the OpenID Connect Discovery document:")
+							}),
+							/* @__PURE__ */ g("div", {
+								className: "flex items-center gap-2",
+								children: [/* @__PURE__ */ h("code", {
+									className: "flex-1 px-3 py-2 rounded-lg bg-bg-sunken text-sm text-text-primary font-mono break-all",
+									children: S?.issuer ? `${S.issuer}/.well-known/openid-configuration` : "Discovery endpoint unavailable until OIDC is configured"
+								}), /* @__PURE__ */ h("button", {
+									onClick: () => {
+										let e = S?.issuer ? `${S.issuer}/.well-known/openid-configuration` : "";
+										e && _(e);
+									},
+									disabled: !S?.issuer,
+									className: "px-3 py-2 rounded-lg border border-border-default text-text-secondary hover:bg-bg-sunken flex-shrink-0",
+									children: k("auth.sso.copy", "Copy")
+								})]
+							})
+						]
+					}),
+					S && /* @__PURE__ */ g("div", {
+						className: "p-6 rounded-xl border border-border-subtle bg-bg-surface",
+						children: [/* @__PURE__ */ h("h3", {
+							className: "text-lg font-medium text-text-primary mb-4",
+							children: k("auth.sso.oidcEndpoints", "OIDC Endpoints")
+						}), /* @__PURE__ */ h("div", {
+							className: "space-y-4",
+							children: [
+								{
+									label: k("auth.sso.issuer", "Issuer"),
+									value: S.issuer
+								},
+								{
+									label: k("auth.sso.authorizationEndpoint", "Authorization Endpoint"),
+									value: S.authorizationEndpoint
+								},
+								{
+									label: k("auth.sso.tokenEndpoint", "Token Endpoint"),
+									value: S.tokenEndpoint
+								},
+								{
+									label: k("auth.sso.userinfoEndpoint", "UserInfo Endpoint"),
+									value: S.userinfoEndpoint
+								},
+								{
+									label: k("auth.sso.jwksUri", "JWKS URI"),
+									value: S.jwksUri
+								}
+							].map((e) => /* @__PURE__ */ g("div", {
+								className: "flex items-start gap-4",
+								children: [/* @__PURE__ */ h("span", {
+									className: "w-48 text-sm font-medium text-text-primary flex-shrink-0",
+									children: e.label
+								}), /* @__PURE__ */ h("code", {
+									className: "text-sm text-text-secondary font-mono break-all",
+									children: e.value
+								})]
+							}, e.label))
+						})]
+					}),
+					/* @__PURE__ */ g("div", {
+						className: "p-6 rounded-xl border border-border-subtle bg-bg-surface",
+						children: [/* @__PURE__ */ h("h3", {
+							className: "text-lg font-medium text-text-primary mb-4",
+							children: k("auth.sso.supportedFeatures", "Supported Features")
+						}), /* @__PURE__ */ h("div", {
+							className: "grid grid-cols-2 gap-4",
+							children: [
+								{
+									name: k("auth.sso.featAuthCodePkce", "Authorization Code + PKCE"),
+									status: !0
+								},
+								{
+									name: k("auth.sso.featClientCreds", "Client Credentials"),
+									status: !0
+								},
+								{
+									name: k("auth.sso.featDeviceAuth", "Device Authorization"),
+									status: !0
+								},
+								{
+									name: k("auth.sso.featRefreshTokens", "Refresh Tokens"),
+									status: !0
+								},
+								{
+									name: k("auth.sso.featTokenIntrospection", "Token Introspection"),
+									status: !0
+								},
+								{
+									name: k("auth.sso.featTokenRevocation", "Token Revocation"),
+									status: !0
+								}
+							].map((e) => /* @__PURE__ */ g("div", {
+								className: "flex items-center gap-2",
+								children: [/* @__PURE__ */ h("span", { className: `w-2 h-2 rounded-full ${e.status ? "bg-status-success-text" : "bg-bg-sunken"}` }), /* @__PURE__ */ h("span", {
+									className: "text-sm text-text-primary",
+									children: e.name
+								})]
+							}, e.name))
+						})]
+					})
+				]
+			}),
+			!C && A === "clients" && /* @__PURE__ */ g("div", {
+				className: "space-y-6",
+				children: [
+					/* @__PURE__ */ g("div", {
+						className: "p-4 rounded-xl bg-status-warning-bg-subtle border border-status-warning-border",
+						children: [/* @__PURE__ */ h("h3", {
+							className: "font-medium text-status-warning-text mb-2",
+							children: k("auth.sso.clientManagement", "OIDC Client Management")
+						}), /* @__PURE__ */ h("p", {
+							className: "text-sm text-status-warning-text",
+							children: k("auth.sso.clientManagementDesc", "Register applications that can authenticate users through your OIDC provider. Each client gets unique credentials to use in the OAuth 2.0 / OIDC flow.")
+						})]
+					}),
+					X && /* @__PURE__ */ g("div", {
+						className: "p-6 rounded-xl border-2 border-status-success-border bg-status-success-bg-subtle",
+						children: [/* @__PURE__ */ g("div", {
+							className: "flex items-start justify-between mb-4",
+							children: [/* @__PURE__ */ g("div", { children: [/* @__PURE__ */ h("h3", {
+								className: "text-lg font-medium text-status-success-text",
+								children: k("auth.sso.clientCreatedTitle", "Client Created Successfully!")
+							}), /* @__PURE__ */ h("p", {
+								className: "text-sm text-status-success-text mt-1",
+								children: k("auth.sso.clientCreatedDesc", "Save these credentials securely. The client secret will not be shown again.")
+							})] }), /* @__PURE__ */ h("button", {
+								onClick: () => Z(null),
+								className: "text-status-success-text hover:text-status-success-text",
+								children: /* @__PURE__ */ h("svg", {
+									className: "w-5 h-5",
+									fill: "none",
+									viewBox: "0 0 24 24",
+									stroke: "currentColor",
+									children: /* @__PURE__ */ h("path", {
+										strokeLinecap: "round",
+										strokeLinejoin: "round",
+										strokeWidth: 2,
+										d: "M6 18L18 6M6 6l12 12"
+									})
+								})
+							})]
+						}), /* @__PURE__ */ g("div", {
+							className: "space-y-3",
+							children: [
+								/* @__PURE__ */ g("div", { children: [/* @__PURE__ */ h("label", {
+									className: "block text-xs font-medium text-status-success-text mb-1",
+									children: k("auth.sso.clientId", "Client ID")
+								}), /* @__PURE__ */ g("div", {
+									className: "flex gap-2",
+									children: [/* @__PURE__ */ h("code", {
+										className: "flex-1 px-3 py-2 rounded-lg bg-bg-surface text-sm font-mono border border-status-success-border",
+										children: X.client_id
+									}), /* @__PURE__ */ h("button", {
+										onClick: () => void _(X.client_id),
+										className: "px-3 py-2 rounded-lg bg-status-success-bg text-white text-sm hover:bg-status-success-bg",
+										children: k("auth.sso.copy", "Copy")
+									})]
+								})] }),
+								X.client_secret && /* @__PURE__ */ g("div", { children: [/* @__PURE__ */ h("label", {
+									className: "block text-xs font-medium text-status-success-text mb-1",
+									children: k("auth.sso.clientSecret", "Client Secret (save now!)")
+								}), /* @__PURE__ */ g("div", {
+									className: "flex gap-2",
+									children: [/* @__PURE__ */ h("code", {
+										className: "flex-1 px-3 py-2 rounded-lg bg-bg-surface text-sm font-mono border border-status-success-border",
+										children: X.client_secret
+									}), /* @__PURE__ */ h("button", {
+										onClick: () => void _(X.client_secret || ""),
+										className: "px-3 py-2 rounded-lg bg-status-success-bg text-white text-sm hover:bg-status-success-bg",
+										children: k("auth.sso.copy", "Copy")
+									})]
+								})] }),
+								/* @__PURE__ */ g("div", { children: [/* @__PURE__ */ h("label", {
+									className: "block text-xs font-medium text-status-success-text mb-1",
+									children: k("auth.sso.redirectUris", "Redirect URIs")
+								}), /* @__PURE__ */ h("code", {
+									className: "block px-3 py-2 rounded-lg bg-bg-surface text-sm font-mono border border-status-success-border",
+									children: X.redirect_uris.join(", ")
+								})] })
+							]
+						})]
+					}),
+					/* @__PURE__ */ g("div", {
+						className: "p-6 rounded-xl border border-border-subtle bg-bg-surface",
+						children: [/* @__PURE__ */ g("div", {
+							className: "flex items-center justify-between mb-6",
+							children: [/* @__PURE__ */ h("h3", {
+								className: "text-lg font-medium text-text-primary",
+								children: k("auth.sso.registerClient", "Register New Client")
+							}), !W && /* @__PURE__ */ g("button", {
+								onClick: () => G(!0),
+								className: "px-4 py-2 rounded-lg bg-action-primary-bg text-white font-medium hover:bg-action-primary-bg-hover transition-colors flex items-center gap-2",
+								children: [/* @__PURE__ */ h("svg", {
+									className: "w-4 h-4",
+									fill: "none",
+									viewBox: "0 0 24 24",
+									stroke: "currentColor",
+									children: /* @__PURE__ */ h("path", {
+										strokeLinecap: "round",
+										strokeLinejoin: "round",
+										strokeWidth: 2,
+										d: "M12 4v16m8-8H4"
+									})
+								}), k("auth.sso.newClient", "New Client")]
+							})]
+						}), W ? /* @__PURE__ */ g("div", {
+							className: "space-y-5",
+							children: [
+								/* @__PURE__ */ g("div", { children: [/* @__PURE__ */ g("label", {
+									className: "block text-sm font-medium text-text-primary mb-2",
+									children: [
+										k("auth.sso.clientName", "Client Name"),
+										" ",
+										/* @__PURE__ */ h("span", {
+											className: "text-status-error-text",
+											children: "*"
+										})
+									]
+								}), /* @__PURE__ */ h("input", {
+									type: "text",
+									value: K.client_name,
+									onChange: (e) => q({
+										...K,
+										client_name: e.target.value
+									}),
+									placeholder: k("auth.sso.clientNamePlaceholder", "My Application"),
+									className: "block w-full px-4 py-3 border border-border-default rounded-xl bg-bg-surface text-text-primary placeholder-text-tertiary focus:outline-none focus:ring-2 focus:ring-action-primary-bg/20 focus:border-action-primary-bg transition-all"
+								})] }),
+								/* @__PURE__ */ g("div", { children: [
+									/* @__PURE__ */ g("label", {
+										className: "block text-sm font-medium text-text-primary mb-2",
+										children: [
+											k("auth.sso.redirectUris", "Redirect URIs"),
+											" ",
+											/* @__PURE__ */ h("span", {
+												className: "text-status-error-text",
+												children: "*"
+											})
+										]
+									}),
+									/* @__PURE__ */ h("input", {
+										type: "text",
+										value: K.redirect_uris,
+										onChange: (e) => q({
+											...K,
+											redirect_uris: e.target.value
+										}),
+										placeholder: k("auth.sso.redirectUrisPlaceholder", "http://localhost:3000/callback, https://app.example.com/callback"),
+										className: "block w-full px-4 py-3 border border-border-default rounded-xl bg-bg-surface text-text-primary placeholder-text-tertiary focus:outline-none focus:ring-2 focus:ring-action-primary-bg/20 focus:border-action-primary-bg transition-all"
+									}),
+									/* @__PURE__ */ h("p", {
+										className: "mt-1 text-xs text-text-secondary",
+										children: k("auth.sso.redirectUrisHelper", "Separate multiple URIs with commas")
+									})
+								] }),
+								/* @__PURE__ */ g("div", { children: [/* @__PURE__ */ h("label", {
+									className: "block text-sm font-medium text-text-primary mb-2",
+									children: k("auth.sso.grantTypes", "Grant Types")
+								}), /* @__PURE__ */ h("div", {
+									className: "flex flex-wrap gap-3",
+									children: [
+										"authorization_code",
+										"refresh_token",
+										"client_credentials"
+									].map((e) => /* @__PURE__ */ g("label", {
+										className: "flex items-center gap-2 cursor-pointer",
+										children: [/* @__PURE__ */ h("input", {
+											type: "checkbox",
+											checked: K.grant_types.includes(e),
+											onChange: (t) => {
+												t.target.checked ? q({
+													...K,
+													grant_types: [...K.grant_types, e]
+												}) : q({
+													...K,
+													grant_types: K.grant_types.filter((t) => t !== e)
+												});
+											},
+											className: "w-4 h-4 rounded border-border-default text-text-link focus:ring-action-primary-bg"
+										}), /* @__PURE__ */ h("span", {
+											className: "text-sm text-text-primary",
+											children: e.replace(/_/g, " ")
+										})]
+									}, e))
+								})] }),
+								/* @__PURE__ */ g("div", { children: [/* @__PURE__ */ h("label", {
+									className: "block text-sm font-medium text-text-primary mb-2",
+									children: k("auth.sso.tokenEndpointAuth", "Token Endpoint Auth Method")
+								}), /* @__PURE__ */ g("select", {
+									value: K.token_endpoint_auth_method,
+									onChange: (e) => q({
+										...K,
+										token_endpoint_auth_method: e.target.value
+									}),
+									className: "block w-full px-4 py-3 border border-border-default rounded-xl bg-bg-surface text-text-primary focus:outline-none focus:ring-2 focus:ring-action-primary-bg/20 focus:border-action-primary-bg transition-all",
+									children: [
+										/* @__PURE__ */ h("option", {
+											value: "none",
+											children: k("auth.sso.tokenAuthNone", "None (Public Client - SPAs, Mobile Apps)")
+										}),
+										/* @__PURE__ */ h("option", {
+											value: "client_secret_basic",
+											children: k("auth.sso.tokenAuthBasic", "Client Secret Basic")
+										}),
+										/* @__PURE__ */ h("option", {
+											value: "client_secret_post",
+											children: k("auth.sso.tokenAuthPost", "Client Secret Post")
+										})
+									]
+								})] }),
+								/* @__PURE__ */ g("div", {
+									className: "flex items-center gap-3 pt-2",
+									children: [/* @__PURE__ */ h("button", {
+										onClick: async () => {
+											if (!K.client_name || !K.redirect_uris) {
+												L(k("auth.sso.clientRequired", "Client name and redirect URI are required"));
+												return;
+											}
+											Y(!0), L(null);
+											try {
+												let e = S?.registrationEndpoint;
+												if (!e) throw Error(k("auth.sso.oidcNotConfigured", "OIDC dynamic client registration is not configured for this environment."));
+												let t = await fetch(e, {
+													method: "POST",
+													headers: { "Content-Type": "application/json" },
+													body: JSON.stringify({
+														client_name: K.client_name,
+														redirect_uris: K.redirect_uris.split(",").map((e) => e.trim()),
+														grant_types: K.grant_types,
+														response_types: ["code"],
+														token_endpoint_auth_method: K.token_endpoint_auth_method
+													})
+												});
+												if (!t.ok) {
+													let e = await t.json();
+													throw Error(e.error_description || e.error || "Registration failed");
+												}
+												Z(await t.json()), z(k("auth.sso.clientRegistered", "OIDC client registered successfully! Save the client credentials.")), G(!1), q({
+													client_name: "",
+													redirect_uris: "",
+													grant_types: ["authorization_code", "refresh_token"],
+													token_endpoint_auth_method: "none"
+												});
+											} catch (e) {
+												L(e instanceof Error ? e.message : k("auth.sso.registerFailed", "Failed to register client"));
+											} finally {
+												Y(!1);
+											}
+										},
+										disabled: J,
+										className: "auth-primary-button flex items-center gap-2 px-6 py-3 font-medium",
+										children: J ? /* @__PURE__ */ g(m, { children: [/* @__PURE__ */ h(r, { className: "w-4 h-4 animate-spin" }), k("auth.sso.registering", "Registering...")] }) : k("auth.sso.registerClientButton", "Register Client")
+									}), /* @__PURE__ */ h("button", {
+										onClick: () => {
+											G(!1), q({
+												client_name: "",
+												redirect_uris: "",
+												grant_types: ["authorization_code", "refresh_token"],
+												token_endpoint_auth_method: "none"
+											});
+										},
+										className: "px-6 py-3 rounded-xl border border-border-default text-text-primary font-medium hover:bg-bg-sunken transition-colors",
+										children: k("auth.sso.cancel", "Cancel")
+									})]
+								})
+							]
+						}) : /* @__PURE__ */ g("div", {
+							className: "text-center py-8 text-text-secondary",
+							children: [/* @__PURE__ */ h("svg", {
+								className: "w-12 h-12 mx-auto mb-3 text-text-muted",
+								fill: "none",
+								viewBox: "0 0 24 24",
+								stroke: "currentColor",
+								children: /* @__PURE__ */ h("path", {
+									strokeLinecap: "round",
+									strokeLinejoin: "round",
+									strokeWidth: 1.5,
+									d: "M15 7a2 2 0 012 2m4 0a6 6 0 01-7.743 5.743L11 17H9v2H7v2H4a1 1 0 01-1-1v-2.586a1 1 0 01.293-.707l5.964-5.964A6 6 0 1121 9z"
+								})
+							}), /* @__PURE__ */ h("p", {
+								className: "text-sm",
+								children: k("auth.sso.emptyClients", "Click \"New Client\" to register an OAuth 2.0 / OIDC client application.")
+							})]
+						})]
+					}),
+					/* @__PURE__ */ g("div", {
+						className: "p-6 rounded-xl border border-border-subtle bg-bg-surface",
+						children: [/* @__PURE__ */ h("h3", {
+							className: "text-lg font-medium text-text-primary mb-4",
+							children: k("auth.sso.preconfiguredClients", "Pre-configured Clients")
+						}), /* @__PURE__ */ h("div", {
+							className: "space-y-4",
+							children: /* @__PURE__ */ g("div", {
+								className: "p-4 rounded-lg bg-bg-canvas/50 border border-border-default",
+								children: [
+									/* @__PURE__ */ g("div", {
+										className: "flex items-center justify-between mb-2",
+										children: [/* @__PURE__ */ h("span", {
+											className: "font-medium text-text-primary",
+											children: "tenant-frontend"
+										}), /* @__PURE__ */ h("span", {
+											className: "px-2 py-1 rounded-full text-xs bg-status-success-bg-subtle text-status-success-text",
+											children: k("auth.sso.active", "Active")
+										})]
+									}),
+									/* @__PURE__ */ h("p", {
+										className: "text-sm text-text-secondary",
+										children: k("auth.sso.preconfigClientDesc", "Default frontend client for tenant authentication")
+									}),
+									/* @__PURE__ */ g("div", {
+										className: "mt-2 flex flex-wrap gap-2",
+										children: [
+											/* @__PURE__ */ h("span", {
+												className: "px-2 py-0.5 rounded bg-bg-sunken text-xs text-text-primary",
+												children: "authorization_code"
+											}),
+											/* @__PURE__ */ h("span", {
+												className: "px-2 py-0.5 rounded bg-bg-sunken text-xs text-text-primary",
+												children: "refresh_token"
+											}),
+											/* @__PURE__ */ h("span", {
+												className: "px-2 py-0.5 rounded bg-bg-sunken text-xs text-text-primary",
+												children: k("auth.sso.pkceRequired", "PKCE required")
+											})
+										]
+									})
+								]
+							})
+						})]
+					})
+				]
+			}),
+			!C && A === "test" && /* @__PURE__ */ g("div", {
+				className: "space-y-6",
+				children: [
+					/* @__PURE__ */ g("div", {
+						className: "p-4 rounded-xl bg-status-warning-bg-subtle border border-status-warning-border",
+						children: [/* @__PURE__ */ h("h3", {
+							className: "font-medium text-status-warning-text mb-2",
+							children: k("auth.sso.testLoginTitle", "Test SSO Login")
+						}), /* @__PURE__ */ h("p", {
+							className: "text-sm text-status-warning-text",
+							children: k("auth.sso.testLoginDesc", "Use this section to test your SSO configuration before rolling it out to users. Make sure your IdP is properly configured with the SP metadata above.")
+						})]
+					}),
+					/* @__PURE__ */ g("div", {
+						className: "p-6 rounded-xl border border-border-subtle bg-bg-surface",
+						children: [
+							/* @__PURE__ */ h("h3", {
+								className: "text-lg font-medium text-text-primary mb-4",
+								children: k("auth.sso.spInitiatedTest", "SP-Initiated Login Test")
+							}),
+							/* @__PURE__ */ h("p", {
+								className: "text-sm text-text-secondary mb-4",
+								children: k("auth.sso.spInitiatedTestDesc", "Click the button below to initiate an SSO login flow. You will be redirected to your IdP to authenticate.")
+							}),
+							x && x.enabled ? /* @__PURE__ */ g("a", {
+								href: `${window.location.origin}/auth/sso/login`,
+								className: "inline-flex items-center gap-2 px-6 py-3 rounded-xl bg-gradient-to-r from-green-600 to-emerald-600 text-white font-medium shadow-lg shadow-green-500/25 hover:shadow-xl hover:shadow-green-500/30 hover:from-green-500 hover:to-emerald-500 transition-all duration-200",
+								children: [/* @__PURE__ */ h("svg", {
+									className: "w-5 h-5",
+									fill: "none",
+									viewBox: "0 0 24 24",
+									stroke: "currentColor",
+									children: /* @__PURE__ */ h("path", {
+										strokeLinecap: "round",
+										strokeLinejoin: "round",
+										strokeWidth: 2,
+										d: "M11 16l-4-4m0 0l4-4m-4 4h14m-5 4v1a3 3 0 01-3 3H6a3 3 0 01-3-3V7a3 3 0 013-3h7a3 3 0 013 3v1"
+									})
+								}), k("auth.sso.testSsoLoginButton", "Test SSO Login")]
+							}) : /* @__PURE__ */ h("div", {
+								className: "p-4 rounded-xl bg-bg-sunken/50 text-text-secondary text-sm",
+								children: x ? k("auth.sso.disabledTest", "SSO is disabled. Enable it to test the login flow.") : k("auth.sso.notConfigured", "SSO is not configured. Please configure your IdP settings first.")
+							})
+						]
+					}),
+					/* @__PURE__ */ g("div", {
+						className: "p-6 rounded-xl border border-border-subtle bg-bg-surface",
+						children: [/* @__PURE__ */ h("h3", {
+							className: "text-lg font-medium text-text-primary mb-4",
+							children: k("auth.sso.testResults", "Test Results")
+						}), /* @__PURE__ */ h("p", {
+							className: "text-sm text-text-secondary",
+							children: k("auth.sso.testResultsDesc", "After testing, results will appear here. Check the browser console for detailed logs.")
+						})]
+					})
+				]
+			})
+		]
+	}) : /* @__PURE__ */ h("div", {
+		className: "max-w-5xl mx-auto p-6",
+		children: /* @__PURE__ */ g("div", {
+			className: "text-center py-16 border-2 border-dashed border-border-subtle rounded-xl",
+			children: [
+				/* @__PURE__ */ h("div", {
+					className: "w-16 h-16 mx-auto mb-4 rounded-full bg-status-error-bg-subtle flex items-center justify-center",
+					children: /* @__PURE__ */ h(n, { className: "w-8 h-8 text-status-error-text" })
+				}),
+				/* @__PURE__ */ h("h2", {
+					className: "text-xl font-semibold text-text-primary mb-2",
+					children: k("auth.sso.adminRequired", "Admin Access Required")
+				}),
+				/* @__PURE__ */ h("p", {
+					className: "text-text-secondary",
+					children: k("auth.sso.adminRequiredDesc", "You need administrator privileges to configure SSO settings.")
+				})
+			]
+		})
+	});
+}
+//#endregion
+export { y as SsoConfigPage };
+
+//# sourceMappingURL=SsoConfigPage.js.map