@burdenoff/microfe-auth 2026.510.127

package/dist/auth/hooks/useOAuthOperations.js

@@ -0,0 +1,103 @@
+import { useAuth as e } from "../providers/AuthProvider.js";
+import { useAuthStore as t } from "../store/authStore.js";
+import { AuthenticateOAuthDocument as n } from "../../generated/global-operations.js";
+import { useMutation as r } from "@apollo/client/react";
+//#region src/auth/hooks/useOAuthOperations.ts
+var i = {
+	google: {
+		authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+		scopes: [
+			"openid",
+			"email",
+			"profile"
+		],
+		clientIdEnvKey: "VITE_GOOGLE_CLIENT_ID"
+	},
+	github: {
+		authorizationUrl: "https://github.com/login/oauth/authorize",
+		scopes: ["user:email", "read:user"],
+		clientIdEnvKey: "VITE_GITHUB_CLIENT_ID"
+	},
+	microsoft: {
+		authorizationUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
+		scopes: [
+			"openid",
+			"email",
+			"profile"
+		],
+		clientIdEnvKey: "VITE_MICROSOFT_CLIENT_ID"
+	}
+};
+function a() {
+	let e = new Uint8Array(32);
+	return crypto.getRandomValues(e), Array.from(e, (e) => e.toString(16).padStart(2, "0")).join("");
+}
+function o() {
+	let o = e(), [s, { loading: c }] = r(n), l = (e) => {
+		let t = i[e], n = {
+			VITE_GOOGLE_CLIENT_ID: void 0,
+			VITE_GITHUB_CLIENT_ID: void 0,
+			VITE_MICROSOFT_CLIENT_ID: void 0
+		}[t.clientIdEnvKey];
+		if (!n) throw console.error(`OAuth client ID not configured for ${e}`), Error(`${e} OAuth is not configured. Please set ${t.clientIdEnvKey} environment variable.`);
+		let r = a();
+		localStorage.setItem("oauth_state", r), localStorage.setItem("oauth_provider", e);
+		let o = `${window.location.origin}/auth/oauth/callback`;
+		localStorage.setItem("oauth_redirect_uri", o);
+		let s = new URLSearchParams({
+			client_id: n,
+			redirect_uri: o,
+			response_type: "code",
+			scope: t.scopes.join(" "),
+			state: r,
+			...e === "google" && { prompt: "select_account" },
+			...e === "google" && { access_type: "offline" }
+		}), c = `${t.authorizationUrl}?${s.toString()}`;
+		window.location.href = c;
+	};
+	return {
+		initiateOAuth: l,
+		completeOAuth: async (e, n) => {
+			let r = t.getState(), i = localStorage.getItem("oauth_state");
+			if (!i || i !== n) throw console.error("[OAuth Complete] State mismatch!", {
+				storedState: i,
+				urlState: n
+			}), Error("Invalid OAuth state. Please try again.");
+			let a = localStorage.getItem("oauth_provider"), c = localStorage.getItem("oauth_redirect_uri");
+			if (!a || !c) throw console.error("[OAuth Complete] Missing provider or redirectUri"), Error("OAuth session data missing. Please try again.");
+			localStorage.removeItem("oauth_state"), localStorage.removeItem("oauth_provider"), localStorage.removeItem("oauth_redirect_uri");
+			try {
+				r.setLoading(!0), r.setError(null);
+				let { data: t, error: n } = await s({ variables: { input: {
+					provider: a.toUpperCase(),
+					code: e,
+					redirectUri: c
+				} } });
+				if (!t?.authenticateOAuth) {
+					let e = n?.message ?? "OAuth authentication failed. Please try again.";
+					throw Error(e);
+				}
+				let i = t.authenticateOAuth;
+				return i.requiresMFA ? (r.setMfaRequired(!0, i.mfaChallengeId || void 0), i) : (i.success && i.user && i.token ? (r.setUser(i.user), r.setAuthTokens(i.token, i.refreshToken || ""), r.setAuthenticated(!0), r.setMfaRequired(!1), o.onAuthSuccess?.(i.user, i.token, i.refreshToken || void 0)) : i.error && r.setError(i.error), i);
+			} catch (e) {
+				let t = e instanceof Error ? e.message : "OAuth authentication failed";
+				throw r.setError(t), e;
+			} finally {
+				r.setLoading(!1);
+			}
+		},
+		initiateGoogleOAuth: () => l("google"),
+		initiateGitHubOAuth: () => l("github"),
+		initiateMicrosoftOAuth: () => l("microsoft"),
+		isProviderConfigured: (e) => !!{
+			VITE_GOOGLE_CLIENT_ID: void 0,
+			VITE_GITHUB_CLIENT_ID: void 0,
+			VITE_MICROSOFT_CLIENT_ID: void 0
+		}[i[e].clientIdEnvKey],
+		isLoading: c
+	};
+}
+//#endregion
+export { o as useOAuthOperations };
+
+//# sourceMappingURL=useOAuthOperations.js.map

package/dist/auth/hooks/useOAuthOperations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useOAuthOperations.js","names":[],"sources":["../../../src/auth/hooks/useOAuthOperations.ts"],"sourcesContent":["import { useMutation } from \"@apollo/client/react\";\nimport { useAuthStore } from \"../store/authStore\";\nimport { useAuth } from \"../providers/AuthProvider\";\nimport type { AuthResult, OAuthInput } from \"../types\";\n\nimport { AuthenticateOAuthDocument } from \"../../generated/global-operations\";\n\n// =============================================================================\n// GRAPHQL RESPONSE INTERFACES\n// =============================================================================\n\ninterface AuthenticateOAuthResponse {\n  authenticateOAuth: AuthResult;\n}\n\ninterface AuthenticateOAuthVariables {\n  input: OAuthInput;\n}\n\n/**\n * Supported OAuth providers\n */\nexport type OAuthProvider = \"google\" | \"github\" | \"microsoft\";\n\n/**\n * OAuth configuration for each provider\n */\ninterface OAuthConfig {\n  authorizationUrl: string;\n  scopes: string[];\n  clientIdEnvKey: string;\n}\n\nconst OAUTH_CONFIGS: Record<OAuthProvider, OAuthConfig> = {\n  google: {\n    authorizationUrl: \"https://accounts.google.com/o/oauth2/v2/auth\",\n    scopes: [\"openid\", \"email\", \"profile\"],\n    clientIdEnvKey: \"VITE_GOOGLE_CLIENT_ID\",\n  },\n  github: {\n    authorizationUrl: \"https://github.com/login/oauth/authorize\",\n    scopes: [\"user:email\", \"read:user\"],\n    clientIdEnvKey: \"VITE_GITHUB_CLIENT_ID\",\n  },\n  microsoft: {\n    authorizationUrl:\n      \"https://login.microsoftonline.com/common/oauth2/v2.0/authorize\",\n    scopes: [\"openid\", \"email\", \"profile\"],\n    clientIdEnvKey: \"VITE_MICROSOFT_CLIENT_ID\",\n  },\n};\n\n/**\n * Generate a random state parameter for CSRF protection\n */\nfunction generateState(): string {\n  const array = new Uint8Array(32);\n  crypto.getRandomValues(array);\n  return Array.from(array, (byte) => byte.toString(16).padStart(2, \"0\")).join(\n    \"\",\n  );\n}\n\n/**\n * Hook for OAuth authentication operations\n */\nexport function useOAuthOperations() {\n  const context = useAuth();\n  const [authenticateOAuthMutation, { loading }] = useMutation<\n    AuthenticateOAuthResponse,\n    AuthenticateOAuthVariables\n  >(AuthenticateOAuthDocument);\n\n  /**\n   * Initiate OAuth flow by redirecting to the provider\n   * @param provider - The OAuth provider to use\n   */\n  const initiateOAuth = (provider: OAuthProvider) => {\n    const config = OAUTH_CONFIGS[provider];\n\n    // Get client ID from environment\n    // In Vite, environment variables are accessed via import.meta.env\n    const envVars: Record<string, string | undefined> = {\n      VITE_GOOGLE_CLIENT_ID: import.meta.env.VITE_GOOGLE_CLIENT_ID,\n      VITE_GITHUB_CLIENT_ID: import.meta.env.VITE_GITHUB_CLIENT_ID,\n      VITE_MICROSOFT_CLIENT_ID: import.meta.env.VITE_MICROSOFT_CLIENT_ID,\n    };\n    const clientId = envVars[config.clientIdEnvKey];\n\n    if (!clientId) {\n      console.error(`OAuth client ID not configured for ${provider}`);\n      throw new Error(\n        `${provider} OAuth is not configured. Please set ${config.clientIdEnvKey} environment variable.`,\n      );\n    }\n\n    // Generate state for CSRF protection and store it\n    // Use localStorage instead of sessionStorage for better persistence across redirects\n    const state = generateState();\n    localStorage.setItem(\"oauth_state\", state);\n    localStorage.setItem(\"oauth_provider\", provider);\n\n    // Build redirect URI - use current origin + callback path\n    const redirectUri = `${window.location.origin}/auth/oauth/callback`;\n    localStorage.setItem(\"oauth_redirect_uri\", redirectUri);\n\n    // Build authorization URL\n    const params = new URLSearchParams({\n      client_id: clientId,\n      redirect_uri: redirectUri,\n      response_type: \"code\",\n      scope: config.scopes.join(\" \"),\n      state: state,\n      // Google-specific: force account selection\n      ...(provider === \"google\" && { prompt: \"select_account\" }),\n      // Google-specific: enable offline access for refresh token\n      ...(provider === \"google\" && { access_type: \"offline\" }),\n    });\n\n    const authUrl = `${config.authorizationUrl}?${params.toString()}`;\n\n    // Redirect to OAuth provider\n    window.location.href = authUrl;\n  };\n\n  /**\n   * Complete OAuth flow by exchanging authorization code for tokens\n   * Called from the callback page after provider redirects back\n   * @param code - Authorization code from OAuth provider\n   * @param state - State parameter for CSRF validation\n   */\n  const completeOAuth = async (\n    code: string,\n    state: string,\n  ): Promise<AuthResult> => {\n    const store = useAuthStore.getState();\n\n    // Validate state parameter\n    const storedState = localStorage.getItem(\"oauth_state\");\n    if (!storedState || storedState !== state) {\n      console.error(\"[OAuth Complete] State mismatch!\", {\n        storedState,\n        urlState: state,\n      });\n      throw new Error(\"Invalid OAuth state. Please try again.\");\n    }\n\n    // Get provider and redirect URI from localStorage\n    const provider = localStorage.getItem(\"oauth_provider\") as OAuthProvider;\n    const redirectUri = localStorage.getItem(\"oauth_redirect_uri\");\n\n    if (!provider || !redirectUri) {\n      console.error(\"[OAuth Complete] Missing provider or redirectUri\");\n      throw new Error(\"OAuth session data missing. Please try again.\");\n    }\n\n    // Clear localStorage\n    localStorage.removeItem(\"oauth_state\");\n    localStorage.removeItem(\"oauth_provider\");\n    localStorage.removeItem(\"oauth_redirect_uri\");\n\n    try {\n      store.setLoading(true);\n      store.setError(null);\n\n      // Call backend mutation to exchange code for tokens\n      const { data, error } = await authenticateOAuthMutation({\n        variables: {\n          input: {\n            provider: provider.toUpperCase(),\n            code,\n            redirectUri,\n          },\n        },\n      });\n\n      if (!data?.authenticateOAuth) {\n        const errMsg =\n          error?.message ?? \"OAuth authentication failed. Please try again.\";\n        throw new Error(errMsg);\n      }\n\n      const result = data.authenticateOAuth;\n\n      if (result.requiresMFA) {\n        store.setMfaRequired(true, result.mfaChallengeId || undefined);\n        return result;\n      }\n\n      if (result.success && result.user && result.token) {\n        store.setUser(result.user);\n        store.setAuthTokens(result.token, result.refreshToken || \"\");\n        store.setAuthenticated(true);\n        store.setMfaRequired(false);\n\n        context.onAuthSuccess?.(\n          result.user,\n          result.token,\n          result.refreshToken || undefined,\n        );\n      } else if (result.error) {\n        store.setError(result.error);\n      }\n\n      return result;\n    } catch (err) {\n      const message =\n        err instanceof Error ? err.message : \"OAuth authentication failed\";\n      store.setError(message);\n      throw err;\n    } finally {\n      store.setLoading(false);\n    }\n  };\n\n  /**\n   * Convenience method to initiate Google OAuth\n   */\n  const initiateGoogleOAuth = () => initiateOAuth(\"google\");\n\n  /**\n   * Convenience method to initiate GitHub OAuth\n   */\n  const initiateGitHubOAuth = () => initiateOAuth(\"github\");\n\n  /**\n   * Convenience method to initiate Microsoft OAuth\n   */\n  const initiateMicrosoftOAuth = () => initiateOAuth(\"microsoft\");\n\n  /**\n   * Check if a provider is configured (has client ID)\n   */\n  const isProviderConfigured = (provider: OAuthProvider): boolean => {\n    const envVars: Record<string, string | undefined> = {\n      VITE_GOOGLE_CLIENT_ID: import.meta.env.VITE_GOOGLE_CLIENT_ID,\n      VITE_GITHUB_CLIENT_ID: import.meta.env.VITE_GITHUB_CLIENT_ID,\n      VITE_MICROSOFT_CLIENT_ID: import.meta.env.VITE_MICROSOFT_CLIENT_ID,\n    };\n    const config = OAUTH_CONFIGS[provider];\n    const clientId = envVars[config.clientIdEnvKey];\n    return !!clientId;\n  };\n\n  return {\n    initiateOAuth,\n    completeOAuth,\n    initiateGoogleOAuth,\n    initiateGitHubOAuth,\n    initiateMicrosoftOAuth,\n    isProviderConfigured,\n    isLoading: loading,\n  };\n}\n"],"mappings":";;;;;AAiCA,IAAM,IAAoD;CACxD,QAAQ;EACN,kBAAkB;EAClB,QAAQ;GAAC;GAAU;GAAS;GAAU;EACtC,gBAAgB;EACjB;CACD,QAAQ;EACN,kBAAkB;EAClB,QAAQ,CAAC,cAAc,YAAY;EACnC,gBAAgB;EACjB;CACD,WAAW;EACT,kBACE;EACF,QAAQ;GAAC;GAAU;GAAS;GAAU;EACtC,gBAAgB;EACjB;CACF;AAKD,SAAS,IAAwB;CAC/B,IAAM,IAAQ,IAAI,WAAW,GAAG;AAEhC,QADA,OAAO,gBAAgB,EAAM,EACtB,MAAM,KAAK,IAAQ,MAAS,EAAK,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,KACrE,GACD;;AAMH,SAAgB,IAAqB;CACnC,IAAM,IAAU,GAAS,EACnB,CAAC,GAA2B,EAAE,gBAAa,EAG/C,EAA0B,EAMtB,KAAiB,MAA4B;EACjD,IAAM,IAAS,EAAc,IASvB,IAL8C;GAClD,uBAAA,KAAA;GACA,uBAAA,KAAA;GACA,0BAAA,KAAA;GACD,CACwB,EAAO;AAEhC,MAAI,CAAC,EAEH,OADA,QAAQ,MAAM,sCAAsC,IAAW,EACrD,MACR,GAAG,EAAS,uCAAuC,EAAO,eAAe,wBAC1E;EAKH,IAAM,IAAQ,GAAe;AAE7B,EADA,aAAa,QAAQ,eAAe,EAAM,EAC1C,aAAa,QAAQ,kBAAkB,EAAS;EAGhD,IAAM,IAAc,GAAG,OAAO,SAAS,OAAO;AAC9C,eAAa,QAAQ,sBAAsB,EAAY;EAGvD,IAAM,IAAS,IAAI,gBAAgB;GACjC,WAAW;GACX,cAAc;GACd,eAAe;GACf,OAAO,EAAO,OAAO,KAAK,IAAI;GACvB;GAEP,GAAI,MAAa,YAAY,EAAE,QAAQ,kBAAkB;GAEzD,GAAI,MAAa,YAAY,EAAE,aAAa,WAAW;GACxD,CAAC,EAEI,IAAU,GAAG,EAAO,iBAAiB,GAAG,EAAO,UAAU;AAG/D,SAAO,SAAS,OAAO;;AA0HzB,QAAO;EACL;EACA,eAnHoB,OACpB,GACA,MACwB;GACxB,IAAM,IAAQ,EAAa,UAAU,EAG/B,IAAc,aAAa,QAAQ,cAAc;AACvD,OAAI,CAAC,KAAe,MAAgB,EAKlC,OAJA,QAAQ,MAAM,oCAAoC;IAChD;IACA,UAAU;IACX,CAAC,EACQ,MAAM,yCAAyC;GAI3D,IAAM,IAAW,aAAa,QAAQ,iBAAiB,EACjD,IAAc,aAAa,QAAQ,qBAAqB;AAE9D,OAAI,CAAC,KAAY,CAAC,EAEhB,OADA,QAAQ,MAAM,mDAAmD,EACvD,MAAM,gDAAgD;AAMlE,GAFA,aAAa,WAAW,cAAc,EACtC,aAAa,WAAW,iBAAiB,EACzC,aAAa,WAAW,qBAAqB;AAE7C,OAAI;AAEF,IADA,EAAM,WAAW,GAAK,EACtB,EAAM,SAAS,KAAK;IAGpB,IAAM,EAAE,SAAM,aAAU,MAAM,EAA0B,EACtD,WAAW,EACT,OAAO;KACL,UAAU,EAAS,aAAa;KAChC;KACA;KACD,EACF,EACF,CAAC;AAEF,QAAI,CAAC,GAAM,mBAAmB;KAC5B,IAAM,IACJ,GAAO,WAAW;AACpB,WAAU,MAAM,EAAO;;IAGzB,IAAM,IAAS,EAAK;AAsBpB,WApBI,EAAO,eACT,EAAM,eAAe,IAAM,EAAO,kBAAkB,KAAA,EAAU,EACvD,MAGL,EAAO,WAAW,EAAO,QAAQ,EAAO,SAC1C,EAAM,QAAQ,EAAO,KAAK,EAC1B,EAAM,cAAc,EAAO,OAAO,EAAO,gBAAgB,GAAG,EAC5D,EAAM,iBAAiB,GAAK,EAC5B,EAAM,eAAe,GAAM,EAE3B,EAAQ,gBACN,EAAO,MACP,EAAO,OACP,EAAO,gBAAgB,KAAA,EACxB,IACQ,EAAO,SAChB,EAAM,SAAS,EAAO,MAAM,EAGvB;YACA,GAAK;IACZ,IAAM,IACJ,aAAe,QAAQ,EAAI,UAAU;AAEvC,UADA,EAAM,SAAS,EAAQ,EACjB;aACE;AACR,MAAM,WAAW,GAAM;;;EAoCzB,2BA7BgC,EAAc,SAAS;EA8BvD,2BAzBgC,EAAc,SAAS;EA0BvD,8BArBmC,EAAc,YAAY;EAsB7D,uBAjB4B,MAQrB,CAAC,CAP4C;GAClD,uBAAA,KAAA;GACA,uBAAA,KAAA;GACA,0BAAA,KAAA;GACD,CACc,EAAc,GACG;EAWhC,WAAW;EACZ"}

package/dist/auth/hooks/usePasswordOperations.d.ts

@@ -0,0 +1,13 @@
+import { ChangePasswordInput, PasswordResetRequestResult } from '../types';
+
+/**
+ * Hook for password management operations
+ * Uses Zustand v5 pattern: selectors for state, getState() for actions
+ */
+export declare function usePasswordOperations(): {
+    changePassword: (input: ChangePasswordInput) => Promise<boolean>;
+    requestPasswordReset: (email: string, recaptchaToken?: string) => Promise<PasswordResetRequestResult>;
+    resetPassword: (token: string, newPassword: string) => Promise<boolean>;
+    isLoading: boolean;
+};
+//# sourceMappingURL=usePasswordOperations.d.ts.map

package/dist/auth/hooks/usePasswordOperations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"usePasswordOperations.d.ts","sourceRoot":"","sources":["../../../src/auth/hooks/usePasswordOperations.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,UAAU,CAAC;AAoChF;;;GAGG;AACH,wBAAgB,qBAAqB;4BAqB1B,mBAAmB,KACzB,OAAO,CAAC,OAAO,CAAC;kCAsBV,MAAM,mBACI,MAAM,KACtB,OAAO,CAAC,0BAA0B,CAAC;2BAsB7B,MAAM,eACA,MAAM,KAClB,OAAO,CAAC,OAAO,CAAC;;EAwBpB"}

package/dist/auth/hooks/usePasswordOperations.js

@@ -0,0 +1,56 @@
+import { useAuthStore as e } from "../store/authStore.js";
+import { ChangePasswordDocument as t, RequestPasswordResetDocument as n, ResetPasswordDocument as r } from "../../generated/global-operations.js";
+import { useMutation as i } from "@apollo/client/react";
+//#region src/auth/hooks/usePasswordOperations.ts
+function a() {
+	let a = e((e) => e.isLoading), [o] = i(t), [s] = i(n), [c] = i(r);
+	return {
+		changePassword: async (t) => {
+			let n = e.getState();
+			try {
+				n.setLoading(!0);
+				let { data: e } = await o({ variables: { input: t } });
+				return e.changePassword;
+			} catch (e) {
+				throw console.error("Failed to change password:", e), e;
+			} finally {
+				n.setLoading(!1);
+			}
+		},
+		requestPasswordReset: async (t, n) => {
+			let r = e.getState();
+			try {
+				r.setLoading(!0);
+				let { data: e } = await s({ variables: {
+					email: t,
+					...n ? { recaptchaToken: n } : {}
+				} });
+				return e.requestPasswordReset;
+			} catch (e) {
+				throw console.error("Failed to request password reset:", e), e;
+			} finally {
+				r.setLoading(!1);
+			}
+		},
+		resetPassword: async (t, n) => {
+			let r = e.getState();
+			try {
+				r.setLoading(!0);
+				let { data: e } = await c({ variables: {
+					token: t,
+					newPassword: n
+				} });
+				return e.resetPassword;
+			} catch (e) {
+				throw console.error("Failed to reset password:", e), e;
+			} finally {
+				r.setLoading(!1);
+			}
+		},
+		isLoading: a
+	};
+}
+//#endregion
+export { a as usePasswordOperations };
+
+//# sourceMappingURL=usePasswordOperations.js.map

package/dist/auth/hooks/usePasswordOperations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"usePasswordOperations.js","names":[],"sources":["../../../src/auth/hooks/usePasswordOperations.ts"],"sourcesContent":["import { useMutation } from \"@apollo/client/react\";\nimport { useAuthStore } from \"../store/authStore\";\nimport type { ChangePasswordInput, PasswordResetRequestResult } from \"../types\";\n\nimport {\n  ChangePasswordDocument,\n  RequestPasswordResetDocument,\n  ResetPasswordDocument,\n} from \"../../generated/global-operations\";\n// Apollo Client 4.x Response Interfaces\ninterface ChangePasswordResponse {\n  changePassword: boolean;\n}\n\ninterface ChangePasswordVariables {\n  input: ChangePasswordInput;\n}\n\ninterface RequestPasswordResetResponse {\n  requestPasswordReset: PasswordResetRequestResult;\n}\n\ninterface RequestPasswordResetVariables {\n  email: string;\n  recaptchaToken?: string;\n}\n\ninterface ResetPasswordResponse {\n  resetPassword: boolean;\n}\n\ninterface ResetPasswordVariables {\n  token: string;\n  newPassword: string;\n}\n\n// GraphQL Operations\n\n/**\n * Hook for password management operations\n * Uses Zustand v5 pattern: selectors for state, getState() for actions\n */\nexport function usePasswordOperations() {\n  // Use selectors for reactive state\n  const isLoading = useAuthStore((state) => state.isLoading);\n\n  const [changePasswordMutation] = useMutation<\n    ChangePasswordResponse,\n    ChangePasswordVariables\n  >(ChangePasswordDocument);\n  const [requestPasswordResetMutation] = useMutation<\n    RequestPasswordResetResponse,\n    RequestPasswordResetVariables\n  >(RequestPasswordResetDocument);\n  const [resetPasswordMutation] = useMutation<\n    ResetPasswordResponse,\n    ResetPasswordVariables\n  >(ResetPasswordDocument);\n\n  /**\n   * Change password for authenticated user\n   */\n  const changePassword = async (\n    input: ChangePasswordInput,\n  ): Promise<boolean> => {\n    const store = useAuthStore.getState();\n    try {\n      store.setLoading(true);\n\n      const { data } = await changePasswordMutation({\n        variables: { input },\n      });\n\n      return data!.changePassword;\n    } catch (error) {\n      console.error(\"Failed to change password:\", error);\n      throw error;\n    } finally {\n      store.setLoading(false);\n    }\n  };\n\n  /**\n   * Request password reset email\n   */\n  const requestPasswordReset = async (\n    email: string,\n    recaptchaToken?: string,\n  ): Promise<PasswordResetRequestResult> => {\n    const store = useAuthStore.getState();\n    try {\n      store.setLoading(true);\n\n      const { data } = await requestPasswordResetMutation({\n        variables: { email, ...(recaptchaToken ? { recaptchaToken } : {}) },\n      });\n\n      return data!.requestPasswordReset;\n    } catch (error) {\n      console.error(\"Failed to request password reset:\", error);\n      throw error;\n    } finally {\n      store.setLoading(false);\n    }\n  };\n\n  /**\n   * Reset password with token\n   */\n  const resetPassword = async (\n    token: string,\n    newPassword: string,\n  ): Promise<boolean> => {\n    const store = useAuthStore.getState();\n    try {\n      store.setLoading(true);\n\n      const { data } = await resetPasswordMutation({\n        variables: { token, newPassword },\n      });\n\n      return data!.resetPassword;\n    } catch (error) {\n      console.error(\"Failed to reset password:\", error);\n      throw error;\n    } finally {\n      store.setLoading(false);\n    }\n  };\n\n  return {\n    changePassword,\n    requestPasswordReset,\n    resetPassword,\n    isLoading,\n  };\n}\n"],"mappings":";;;;AA0CA,SAAgB,IAAwB;CAEtC,IAAM,IAAY,GAAc,MAAU,EAAM,UAAU,EAEpD,CAAC,KAA0B,EAG/B,EAAuB,EACnB,CAAC,KAAgC,EAGrC,EAA6B,EACzB,CAAC,KAAyB,EAG9B,EAAsB;AAyExB,QAAO;EACL,gBArEqB,OACrB,MACqB;GACrB,IAAM,IAAQ,EAAa,UAAU;AACrC,OAAI;AACF,MAAM,WAAW,GAAK;IAEtB,IAAM,EAAE,YAAS,MAAM,EAAuB,EAC5C,WAAW,EAAE,UAAO,EACrB,CAAC;AAEF,WAAO,EAAM;YACN,GAAO;AAEd,UADA,QAAQ,MAAM,8BAA8B,EAAM,EAC5C;aACE;AACR,MAAM,WAAW,GAAM;;;EAsDzB,sBA/C2B,OAC3B,GACA,MACwC;GACxC,IAAM,IAAQ,EAAa,UAAU;AACrC,OAAI;AACF,MAAM,WAAW,GAAK;IAEtB,IAAM,EAAE,YAAS,MAAM,EAA6B,EAClD,WAAW;KAAE;KAAO,GAAI,IAAiB,EAAE,mBAAgB,GAAG,EAAE;KAAG,EACpE,CAAC;AAEF,WAAO,EAAM;YACN,GAAO;AAEd,UADA,QAAQ,MAAM,qCAAqC,EAAM,EACnD;aACE;AACR,MAAM,WAAW,GAAM;;;EA+BzB,eAxBoB,OACpB,GACA,MACqB;GACrB,IAAM,IAAQ,EAAa,UAAU;AACrC,OAAI;AACF,MAAM,WAAW,GAAK;IAEtB,IAAM,EAAE,YAAS,MAAM,EAAsB,EAC3C,WAAW;KAAE;KAAO;KAAa,EAClC,CAAC;AAEF,WAAO,EAAM;YACN,GAAO;AAEd,UADA,QAAQ,MAAM,6BAA6B,EAAM,EAC3C;aACE;AACR,MAAM,WAAW,GAAM;;;EAQzB;EACD"}

package/dist/auth/hooks/useSessionOperations.d.ts

@@ -0,0 +1,41 @@
+import { ActiveSessionsQuery } from '../../generated/global-operations';
+import { TokenValidationResponse, ValidateTokensInput } from '../types';
+
+interface TokenInfoQueryResponse {
+    tokenInfo: TokenValidationResponse;
+}
+interface UseSessionOperationsOptions {
+    disableTokenInfoQuery?: boolean;
+}
+/**
+ * Hook for session/token management operations
+ */
+export declare function useSessionOperations(options?: UseSessionOperationsOptions): {
+    validateTokens: (input: ValidateTokensInput) => Promise<TokenValidationResponse>;
+    isTokenExpired: () => boolean;
+    getTokenRemainingTime: () => number;
+    tokenInfo: TokenValidationResponse | undefined;
+    revokeSession: (sessionId: string) => Promise<boolean>;
+    revokeAllSessions: () => Promise<{
+        success: boolean;
+        revokedCount: number;
+    }>;
+    activeSessions: {
+        __typename?: "Session";
+        id: string;
+        status: import('../../generated/global-types').SessionStatus;
+        ipAddress?: string | null;
+        userAgent?: string | null;
+        location?: string | null;
+        lastActivityAt: string;
+        expiresAt: string;
+        createdAt: string;
+        isCurrent: boolean;
+    }[];
+    sessionsLoading: boolean;
+    refetchSessions: (variables?: Partial<import('@apollo/client').OperationVariables> | undefined) => Promise<import("@apollo/client").ApolloClient.QueryResult<ActiveSessionsQuery>>;
+    isLoading: boolean;
+    refetch: (variables?: Partial<import('@apollo/client').OperationVariables> | undefined) => Promise<import("@apollo/client").ApolloClient.QueryResult<TokenInfoQueryResponse>>;
+};
+export {};
+//# sourceMappingURL=useSessionOperations.d.ts.map

package/dist/auth/hooks/useSessionOperations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useSessionOperations.d.ts","sourceRoot":"","sources":["../../../src/auth/hooks/useSessionOperations.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACV,mBAAmB,EAKpB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAM7E,UAAU,sBAAsB;IAC9B,SAAS,EAAE,uBAAuB,CAAC;CACpC;AAUD,UAAU,2BAA2B;IACnC,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,GAAE,2BAAgC;4BA2ChC,mBAAmB,KACzB,OAAO,CAAC,uBAAuB,CAAC;0BAaR,OAAO;iCAQA,MAAM;;+BASA,MAAM,KAAG,OAAO,CAAC,OAAO,CAAC;6BAmB7B,OAAO,CAAC;QAC1C,OAAO,EAAE,OAAO,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;;;;;;;;;;;;;;;;;EA8BH"}

package/dist/auth/hooks/useSessionOperations.js

@@ -0,0 +1,59 @@
+import { useAuthStore as e } from "../store/authStore.js";
+import { ActiveSessionsDocument as t, RevokeAllSessionsDocument as n, RevokeSessionDocument as r, TokenInfoDocument as i, ValidateTokensDocument as a } from "../../generated/global-operations.js";
+import { useMutation as o, useQuery as s } from "@apollo/client/react";
+//#region src/auth/hooks/useSessionOperations.ts
+function c(c = {}) {
+	let l = e(), u = c.disableTokenInfoQuery ?? !1, [d] = o(a), { data: f, loading: p, refetch: m } = s(i, {
+		skip: u || !l.isAuthenticated,
+		fetchPolicy: "cache-and-network",
+		pollInterval: 300 * 1e3
+	}), { data: h, loading: g, refetch: _ } = s(t, {
+		skip: !l.isAuthenticated,
+		fetchPolicy: "cache-and-network"
+	}), [v] = o(r), [y] = o(n);
+	return {
+		validateTokens: async (e) => {
+			try {
+				let { data: t } = await d({ variables: { input: e } });
+				return t.validateTokens;
+			} catch (e) {
+				throw console.error("Failed to validate tokens:", e), e;
+			}
+		},
+		isTokenExpired: () => f?.tokenInfo?.expiresAt ? Date.now() / 1e3 > f.tokenInfo.expiresAt : !0,
+		getTokenRemainingTime: () => {
+			if (!f?.tokenInfo?.expiresAt) return 0;
+			let e = f.tokenInfo.expiresAt - Date.now() / 1e3;
+			return Math.max(0, e);
+		},
+		tokenInfo: f?.tokenInfo,
+		revokeSession: async (e) => {
+			try {
+				let { data: t } = await v({ variables: { sessionId: e } });
+				return t?.revokeSession && await _(), t?.revokeSession ?? !1;
+			} catch (e) {
+				throw console.error("Failed to revoke session:", e), e;
+			}
+		},
+		revokeAllSessions: async () => {
+			try {
+				let { data: e } = await y();
+				return e?.revokeAllSessions?.success && await _(), e?.revokeAllSessions ?? {
+					success: !1,
+					revokedCount: 0
+				};
+			} catch (e) {
+				throw console.error("Failed to revoke all sessions:", e), e;
+			}
+		},
+		activeSessions: h?.activeSessions ?? [],
+		sessionsLoading: g,
+		refetchSessions: _,
+		isLoading: p || g,
+		refetch: m
+	};
+}
+//#endregion
+export { c as useSessionOperations };
+
+//# sourceMappingURL=useSessionOperations.js.map

package/dist/auth/hooks/useSessionOperations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useSessionOperations.js","names":[],"sources":["../../../src/auth/hooks/useSessionOperations.ts"],"sourcesContent":["import { useQuery, useMutation } from \"@apollo/client/react\";\nimport { useAuthStore } from \"../store/authStore\";\nimport {\n  TokenInfoDocument,\n  ValidateTokensDocument,\n  ActiveSessionsDocument,\n  RevokeSessionDocument,\n  RevokeAllSessionsDocument,\n} from \"../../generated/global-operations\";\nimport type {\n  ActiveSessionsQuery,\n  RevokeSessionMutation,\n  RevokeSessionMutationVariables,\n  RevokeAllSessionsMutation,\n  RevokeAllSessionsMutationVariables,\n} from \"../../generated/global-operations\";\nimport type { TokenValidationResponse, ValidateTokensInput } from \"../types\";\n\n// =============================================================================\n// GRAPHQL RESPONSE INTERFACES\n// =============================================================================\n\ninterface TokenInfoQueryResponse {\n  tokenInfo: TokenValidationResponse;\n}\n\ninterface ValidateTokensMutationResponse {\n  validateTokens: TokenValidationResponse;\n}\n\ninterface ValidateTokensMutationVariables {\n  input: ValidateTokensInput;\n}\n\ninterface UseSessionOperationsOptions {\n  disableTokenInfoQuery?: boolean;\n}\n\n/**\n * Hook for session/token management operations\n */\nexport function useSessionOperations(\n  options: UseSessionOperationsOptions = {},\n) {\n  const store = useAuthStore();\n  const disableTokenInfoQuery = options.disableTokenInfoQuery ?? false;\n  const [validateTokensMutation] = useMutation<\n    ValidateTokensMutationResponse,\n    ValidateTokensMutationVariables\n  >(ValidateTokensDocument);\n\n  const { data, loading, refetch } = useQuery<TokenInfoQueryResponse>(\n    TokenInfoDocument,\n    {\n      skip: disableTokenInfoQuery || !store.isAuthenticated,\n      fetchPolicy: \"cache-and-network\",\n      pollInterval: 5 * 60 * 1000, // Poll every 5 minutes (was 1 min — too aggressive)\n    },\n  );\n\n  // Active sessions query\n  const {\n    data: sessionsData,\n    loading: sessionsLoading,\n    refetch: refetchSessions,\n  } = useQuery<ActiveSessionsQuery>(ActiveSessionsDocument, {\n    skip: !store.isAuthenticated,\n    fetchPolicy: \"cache-and-network\",\n  });\n\n  // Session mutations\n  const [revokeSessionMutation] = useMutation<\n    RevokeSessionMutation,\n    RevokeSessionMutationVariables\n  >(RevokeSessionDocument);\n\n  const [revokeAllSessionsMutation] = useMutation<\n    RevokeAllSessionsMutation,\n    RevokeAllSessionsMutationVariables\n  >(RevokeAllSessionsDocument);\n\n  /**\n   * Validate tokens\n   */\n  const validateTokens = async (\n    input: ValidateTokensInput,\n  ): Promise<TokenValidationResponse> => {\n    try {\n      const { data } = await validateTokensMutation({ variables: { input } });\n      return data!.validateTokens;\n    } catch (error) {\n      console.error(\"Failed to validate tokens:\", error);\n      throw error;\n    }\n  };\n\n  /**\n   * Check if token is expired\n   */\n  const isTokenExpired = (): boolean => {\n    if (!data?.tokenInfo?.expiresAt) return true;\n    return Date.now() / 1000 > data.tokenInfo.expiresAt;\n  };\n\n  /**\n   * Get remaining time until token expires (in seconds)\n   */\n  const getTokenRemainingTime = (): number => {\n    if (!data?.tokenInfo?.expiresAt) return 0;\n    const remaining = data.tokenInfo.expiresAt - Date.now() / 1000;\n    return Math.max(0, remaining);\n  };\n\n  /**\n   * Revoke a specific session by ID\n   */\n  const revokeSession = async (sessionId: string): Promise<boolean> => {\n    try {\n      const { data } = await revokeSessionMutation({\n        variables: { sessionId },\n      });\n      if (data?.revokeSession) {\n        // Refetch active sessions to reflect the change\n        await refetchSessions();\n      }\n      return data?.revokeSession ?? false;\n    } catch (error) {\n      console.error(\"Failed to revoke session:\", error);\n      throw error;\n    }\n  };\n\n  /**\n   * Revoke all sessions except the current one\n   */\n  const revokeAllSessions = async (): Promise<{\n    success: boolean;\n    revokedCount: number;\n  }> => {\n    try {\n      const { data } = await revokeAllSessionsMutation();\n      if (data?.revokeAllSessions?.success) {\n        // Refetch active sessions to reflect the change\n        await refetchSessions();\n      }\n      return data?.revokeAllSessions ?? { success: false, revokedCount: 0 };\n    } catch (error) {\n      console.error(\"Failed to revoke all sessions:\", error);\n      throw error;\n    }\n  };\n\n  return {\n    // Token operations\n    validateTokens,\n    isTokenExpired,\n    getTokenRemainingTime,\n    tokenInfo: data?.tokenInfo,\n    // Session operations\n    revokeSession,\n    revokeAllSessions,\n    activeSessions: sessionsData?.activeSessions ?? [],\n    sessionsLoading,\n    refetchSessions,\n    // General state\n    isLoading: loading || sessionsLoading,\n    refetch,\n  };\n}\n"],"mappings":";;;;AAyCA,SAAgB,EACd,IAAuC,EAAE,EACzC;CACA,IAAM,IAAQ,GAAc,EACtB,IAAwB,EAAQ,yBAAyB,IACzD,CAAC,KAA0B,EAG/B,EAAuB,EAEnB,EAAE,SAAM,YAAS,eAAY,EACjC,GACA;EACE,MAAM,KAAyB,CAAC,EAAM;EACtC,aAAa;EACb,cAAc,MAAS;EACxB,CACF,EAGK,EACJ,MAAM,GACN,SAAS,GACT,SAAS,MACP,EAA8B,GAAwB;EACxD,MAAM,CAAC,EAAM;EACb,aAAa;EACd,CAAC,EAGI,CAAC,KAAyB,EAG9B,EAAsB,EAElB,CAAC,KAA6B,EAGlC,EAA0B;AAyE5B,QAAO;EAEL,gBAtEqB,OACrB,MACqC;AACrC,OAAI;IACF,IAAM,EAAE,YAAS,MAAM,EAAuB,EAAE,WAAW,EAAE,UAAO,EAAE,CAAC;AACvE,WAAO,EAAM;YACN,GAAO;AAEd,UADA,QAAQ,MAAM,8BAA8B,EAAM,EAC5C;;;EA+DR,sBAvDK,GAAM,WAAW,YACf,KAAK,KAAK,GAAG,MAAO,EAAK,UAAU,YADF;EAwDxC,6BAjD0C;AAC1C,OAAI,CAAC,GAAM,WAAW,UAAW,QAAO;GACxC,IAAM,IAAY,EAAK,UAAU,YAAY,KAAK,KAAK,GAAG;AAC1D,UAAO,KAAK,IAAI,GAAG,EAAU;;EA+C7B,WAAW,GAAM;EAEjB,eA3CoB,OAAO,MAAwC;AACnE,OAAI;IACF,IAAM,EAAE,YAAS,MAAM,EAAsB,EAC3C,WAAW,EAAE,cAAW,EACzB,CAAC;AAKF,WAJI,GAAM,iBAER,MAAM,GAAiB,EAElB,GAAM,iBAAiB;YACvB,GAAO;AAEd,UADA,QAAQ,MAAM,6BAA6B,EAAM,EAC3C;;;EAgCR,mBAzBwB,YAGpB;AACJ,OAAI;IACF,IAAM,EAAE,YAAS,MAAM,GAA2B;AAKlD,WAJI,GAAM,mBAAmB,WAE3B,MAAM,GAAiB,EAElB,GAAM,qBAAqB;KAAE,SAAS;KAAO,cAAc;KAAG;YAC9D,GAAO;AAEd,UADA,QAAQ,MAAM,kCAAkC,EAAM,EAChD;;;EAaR,gBAAgB,GAAc,kBAAkB,EAAE;EAClD;EACA;EAEA,WAAW,KAAW;EACtB;EACD"}

package/dist/auth/hooks/useSsoOperations.d.ts

@@ -0,0 +1,65 @@
+import { AuthResult, SSOConfig } from '../types';
+
+interface GetSSOConfigResponse {
+    getSSOConfig: SSOConfig | null;
+}
+interface GetSSOConfigVariables {
+    tenantId: string;
+}
+export interface SSOConfigInput {
+    entityId: string;
+    ssoUrl: string;
+    sloUrl?: string;
+    certificate: string;
+    enabled?: boolean;
+    metadata?: Record<string, unknown>;
+}
+export interface SAMLRequestResult {
+    requestId: string;
+    ssoUrl: string;
+    samlRequest: string;
+}
+export interface ExternalOIDCAuthUrlResult {
+    authUrl: string;
+    state: string;
+    nonce: string;
+    codeVerifier: string;
+    relayState?: string;
+}
+export interface OIDCConfig {
+    issuer: string;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    userinfoEndpoint: string;
+    jwksUri: string;
+    registrationEndpoint?: string;
+    scopesSupported: string[];
+    responseTypesSupported: string[];
+    grantTypesSupported: string[];
+}
+/**
+ * Hook for SSO/SAML operations
+ */
+export declare function useSsoOperations(tenantId?: string): {
+    initiateSsoLogin: (targetTenantId: string, relayState?: string) => Promise<void>;
+    handleSamlCallback: (samlResponse: string, relayState?: string) => Promise<AuthResult>;
+    saveSsoConfig: (configOrTenantId: SSOConfigInput | string, config?: SSOConfigInput) => Promise<SSOConfig>;
+    deleteSsoConfig: (targetTenantId?: string) => Promise<boolean>;
+    getOidcAuthUrl: (clientId: string, redirectUri: string, scopes?: string[]) => Promise<string>;
+    exchangeOidcCode: (code: string, clientId: string, redirectUri: string) => Promise<AuthResult>;
+    validateOidcState: (state: string) => boolean;
+    initiateExternalOidcLogin: (targetTenantId: string, redirectPath?: string) => Promise<void>;
+    handleExternalOidcCallback: (code: string, state: string) => Promise<AuthResult>;
+    isExternalOidcCallback: () => boolean;
+    ssoConfig: SSOConfig | undefined;
+    oidcConfig: OIDCConfig | undefined;
+    isLoading: boolean;
+    isGeneratingRequest: boolean;
+    isAuthenticating: boolean;
+    isSaving: boolean;
+    isDeleting: boolean;
+    isGeneratingOidcUrl: boolean;
+    refetchConfig: (variables?: Partial<GetSSOConfigVariables> | undefined) => Promise<import("@apollo/client").ApolloClient.QueryResult<GetSSOConfigResponse>>;
+};
+export {};
+//# sourceMappingURL=useSsoOperations.d.ts.map

package/dist/auth/hooks/useSsoOperations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useSsoOperations.d.ts","sourceRoot":"","sources":["../../../src/auth/hooks/useSsoOperations.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAQ,MAAM,UAAU,CAAC;AAwB5D,UAAU,oBAAoB;IAC5B,YAAY,EAAE,SAAS,GAAG,IAAI,CAAC;CAChC;AAED,UAAU,qBAAqB;IAC7B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAkFD,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC/B;AAiCD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,CAAC,EAAE,MAAM;uCAkD9B,MAAM,eACT,MAAM,KAClB,OAAO,CAAC,IAAI,CAAC;uCA0CA,MAAM,eACP,MAAM,KAClB,OAAO,CAAC,UAAU,CAAC;sCAwNF,cAAc,GAAG,MAAM,WAChC,cAAc,KACtB,OAAO,CAAC,SAAS,CAAC;uCAyB2B,MAAM,KAAG,OAAO,CAAC,OAAO,CAAC;+BAsB7D,MAAM,eACH,MAAM,WACX,MAAM,EAAE,KACf,OAAO,CAAC,MAAM,CAAC;6BAgCV,MAAM,YACF,MAAM,eACH,MAAM,KAClB,OAAO,CAAC,UAAU,CAAC;+BAoGY,MAAM,KAAG,OAAO;gDAhWhC,MAAM,iBACP,MAAM,KACpB,OAAO,CAAC,IAAI,CAAC;uCA8CR,MAAM,SACL,MAAM,KACZ,OAAO,CAAC,UAAU,CAAC;kCAsGa,OAAO;;;;;;;;;;EAqP3C"}

package/dist/auth/hooks/useSsoOperations.js

@@ -0,0 +1,236 @@
+import { useAuthStore as e } from "../store/authStore.js";
+import { AuthenticateOidcDocument as t, AuthenticateSamlDocument as n, DeleteSsoConfigDocument as r, GenerateOidcAuthUrlDocument as i, GenerateSamlRequestDocument as a, GetOidcConfigDocument as o, GetSsoConfigDocument as s, SaveSsoConfigDocument as c } from "../../generated/global-operations.js";
+import { OIDC_CODE_VERIFIER as l, OIDC_FLOW as u, OIDC_NONCE as d, OIDC_REDIRECT as f, OIDC_STATE as p, OIDC_TENANT_ID as m } from "../constants/sessionKeys.js";
+import { useMutation as h, useQuery as g } from "@apollo/client/react";
+//#region src/auth/hooks/useSsoOperations.ts
+function _(e) {
+	return typeof e == "object" && !!e;
+}
+function v(e) {
+	if (!_(e)) return [];
+	let t = e.graphQLErrors;
+	return Array.isArray(t) ? t.filter((e) => _(e)) : [];
+}
+function y(e, t) {
+	let n = v(e)[0];
+	return n?.message ? n.message : e instanceof Error || _(e) && typeof e.message == "string" ? e.message : t;
+}
+function b(_) {
+	let [v, { loading: b }] = h(a), [w, { loading: T }] = h(n), [E, { loading: D }] = h(c), [O, { loading: k }] = h(r), [A, { loading: j }] = h(i), [M, { loading: N }] = h(t), { data: P, loading: F, refetch: I } = g(s, {
+		variables: { tenantId: _ || "" },
+		skip: !_
+	}), { data: L, loading: R } = g(o, { skip: !1 });
+	return {
+		initiateSsoLogin: async (e, t) => {
+			try {
+				let { data: n } = await v({ variables: {
+					tenantId: e,
+					relayState: t
+				} });
+				if (!n || !n.generateSAMLRequest) throw Error("SAML SSO is not configured for this tenant. Please contact your administrator or use email/password login.");
+				let r = n.generateSAMLRequest, i = new URLSearchParams({ SAMLRequest: r.samlRequest });
+				t && i.append("RelayState", t), window.location.href = `${r.ssoUrl}?${i.toString()}`;
+			} catch (e) {
+				let t = y(e, "Failed to initiate SAML SSO login");
+				throw console.error("Failed to initiate SSO login:", t), Error(t);
+			}
+		},
+		handleSamlCallback: async (t, n) => {
+			let r = e.getState(), i = _ || sessionStorage.getItem("oidc_tenant_id") || void 0;
+			try {
+				r.setLoading(!0), r.setError(null);
+				let { data: e, error: a } = await w({ variables: { input: {
+					samlResponse: t,
+					relayState: n,
+					tenantId: i
+				} } });
+				if (!e?.authenticateSAML) {
+					let e = a?.message ?? "SAML authentication failed. Please try again.";
+					throw Error(e);
+				}
+				let o = e.authenticateSAML;
+				return o.success && o.user && o.token ? (r.setUser(o.user), r.setAuthTokens(o.token, o.refreshToken || ""), r.setAuthenticated(!0)) : o.error && r.setError(o.error), o;
+			} catch (e) {
+				let t = e instanceof Error ? e.message : "SAML authentication failed";
+				throw r.setError(t), e;
+			} finally {
+				r.setLoading(!1);
+			}
+		},
+		saveSsoConfig: async (e, t) => {
+			let n = typeof e == "string" ? e : _ || "", r = typeof e == "string" ? t : e;
+			try {
+				let { data: e, error: t } = await E({ variables: {
+					tenantId: n,
+					input: r
+				} });
+				if (await I(), !e?.saveSSOConfig) throw Error(t?.message ?? "Failed to save SSO config");
+				return e.saveSSOConfig;
+			} catch (e) {
+				throw console.error("Failed to save SSO config:", e), e;
+			}
+		},
+		deleteSsoConfig: async (e) => {
+			let t = e || _ || "";
+			try {
+				let { data: e, error: n } = await O({ variables: { tenantId: t } });
+				if (await I(), e?.deleteSSOConfig == null) throw Error(n?.message ?? "Failed to delete SSO config");
+				return e.deleteSSOConfig;
+			} catch (e) {
+				throw console.error("Failed to delete SSO config:", e), e;
+			}
+		},
+		getOidcAuthUrl: async (e, t, n = [
+			"openid",
+			"profile",
+			"email"
+		]) => {
+			let r = L?.getOIDCConfig;
+			if (!r) throw Error("OIDC configuration not available");
+			let i = x(), a = await S(i), o = C();
+			sessionStorage.setItem(l, i), sessionStorage.setItem(p, o);
+			let s = new URLSearchParams({
+				response_type: "code",
+				client_id: e,
+				redirect_uri: t,
+				scope: n.join(" "),
+				state: o,
+				code_challenge: a,
+				code_challenge_method: "S256"
+			});
+			return `${r.authorizationEndpoint}?${s.toString()}`;
+		},
+		exchangeOidcCode: async (t, n, r) => {
+			let i = L?.getOIDCConfig;
+			if (!i) throw Error("OIDC configuration not available");
+			let a = e.getState(), o = sessionStorage.getItem(l);
+			if (!o) throw Error("Code verifier not found. Please restart the login flow.");
+			try {
+				a.setLoading(!0), a.setError(null);
+				let e = await fetch(i.tokenEndpoint, {
+					method: "POST",
+					headers: { "Content-Type": "application/x-www-form-urlencoded" },
+					body: new URLSearchParams({
+						grant_type: "authorization_code",
+						code: t,
+						redirect_uri: r,
+						client_id: n,
+						code_verifier: o
+					})
+				}), s = await e.json();
+				if (!e.ok) throw Error(s.error_description || s.error || "Token exchange failed");
+				sessionStorage.removeItem(l), sessionStorage.removeItem(p);
+				let c = await (await fetch(i.userinfoEndpoint, { headers: { Authorization: `Bearer ${s.access_token}` } })).json(), u = (/* @__PURE__ */ new Date()).toISOString(), d = {
+					success: !0,
+					token: s.access_token,
+					refreshToken: s.refresh_token,
+					expiresIn: s.expires_in,
+					user: {
+						id: c.sub,
+						email: c.email,
+						username: c.preferred_username || c.email,
+						emailVerified: c.email_verified ?? !0,
+						firstName: c.given_name,
+						lastName: c.family_name,
+						name: c.name,
+						role: "MEMBER",
+						status: "ACTIVE",
+						mfaEnabled: !1,
+						createdAt: u,
+						updatedAt: u
+					}
+				};
+				return d.user && d.token && (a.setUser(d.user), a.setAuthTokens(d.token, d.refreshToken || ""), a.setAuthenticated(!0)), d;
+			} catch (e) {
+				let t = e instanceof Error ? e.message : "OIDC authentication failed";
+				throw a.setError(t), e;
+			} finally {
+				a.setLoading(!1);
+			}
+		},
+		validateOidcState: (e) => sessionStorage.getItem(p) === e,
+		initiateExternalOidcLogin: async (e, t) => {
+			try {
+				let { data: n } = await A({ variables: {
+					tenantId: e,
+					state: t
+				} });
+				if (!n || !n.generateOIDCAuthUrl) throw Error("SSO is not configured for this tenant. Please contact your administrator or use email/password login.");
+				let r = n.generateOIDCAuthUrl;
+				sessionStorage.setItem(l, r.codeVerifier), sessionStorage.setItem(p, r.state), sessionStorage.setItem(d, r.nonce), sessionStorage.setItem(m, e), sessionStorage.setItem(u, "external"), sessionStorage.setItem("oidc_redirect", r.relayState || t || "/dashboard"), window.location.href = r.authUrl;
+			} catch (e) {
+				let t = y(e, "Failed to initiate OIDC SSO login");
+				throw console.error("Failed to initiate external OIDC login:", t), Error(t);
+			}
+		},
+		handleExternalOidcCallback: async (t, n) => {
+			let r = e.getState();
+			try {
+				r.setLoading(!0), r.setError(null);
+				let e = sessionStorage.getItem(p);
+				if (n !== e) throw Error(`Invalid state parameter. Possible CSRF attack. Expected: ${e?.substring(0, 10)}..., Got: ${n.substring(0, 10)}...`);
+				let i = sessionStorage.getItem(l), a = sessionStorage.getItem(d), o = sessionStorage.getItem("oidc_tenant_id") || "default";
+				if (!i) throw Error("Code verifier not found. Please restart the login flow.");
+				let { data: s } = await M({ variables: { input: {
+					tenantId: o,
+					code: t,
+					state: n,
+					codeVerifier: i,
+					nonce: a
+				} } });
+				if (!s) throw Error("No data returned from authenticateOIDC mutation");
+				let c = s.authenticateOIDC, h = sessionStorage.getItem("oidc_redirect") || "/dashboard";
+				return sessionStorage.removeItem(l), sessionStorage.removeItem(p), sessionStorage.removeItem(d), sessionStorage.removeItem(m), sessionStorage.removeItem(u), sessionStorage.removeItem(f), c.user && c.accessToken ? (r.setUser(c.user), r.setAuthTokens(c.accessToken, c.refreshToken || ""), r.setAuthenticated(!0), {
+					success: !0,
+					user: c.user,
+					token: c.accessToken,
+					refreshToken: c.refreshToken,
+					expiresIn: c.expiresIn,
+					redirectPath: h
+				}) : {
+					success: !1,
+					error: "Authentication failed",
+					redirectPath: h
+				};
+			} catch (e) {
+				console.error("[OIDC Callback] Error:", e);
+				let t = e instanceof Error ? e.message : "OIDC authentication failed";
+				throw r.setError(t), sessionStorage.removeItem(l), sessionStorage.removeItem(p), sessionStorage.removeItem(d), sessionStorage.removeItem(m), sessionStorage.removeItem(u), sessionStorage.removeItem(f), e;
+			} finally {
+				r.setLoading(!1);
+			}
+		},
+		isExternalOidcCallback: () => {
+			let e = sessionStorage.getItem(u) === "external", t = !!sessionStorage.getItem(m), n = !!sessionStorage.getItem(l);
+			return e || t && n;
+		},
+		ssoConfig: P?.getSSOConfig ?? void 0,
+		oidcConfig: L?.getOIDCConfig ?? void 0,
+		isLoading: F || R || b || T || D || k || j || N,
+		isGeneratingRequest: b,
+		isAuthenticating: T || N,
+		isSaving: D,
+		isDeleting: k,
+		isGeneratingOidcUrl: j,
+		refetchConfig: I
+	};
+}
+function x() {
+	let e = new Uint8Array(32);
+	return crypto.getRandomValues(e), w(e);
+}
+async function S(e) {
+	let t = new TextEncoder().encode(e), n = await crypto.subtle.digest("SHA-256", t);
+	return w(new Uint8Array(n));
+}
+function C() {
+	let e = new Uint8Array(16);
+	return crypto.getRandomValues(e), w(e);
+}
+function w(e) {
+	return btoa(String.fromCharCode(...e)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+//#endregion
+export { b as useSsoOperations };
+
+//# sourceMappingURL=useSsoOperations.js.map