@burdenoff/microfe-auth 2026.512.1 → 2026.514.2

package/dist/auth/hooks/useAuthOperations.js.map

@@ -1 +1 @@
-{"version":3,"file":"useAuthOperations.js","names":[],"sources":["../../../src/auth/hooks/useAuthOperations.ts"],"sourcesContent":["import { useEffect, useRef } from \"react\";\nimport { useMutation, useQuery, useApolloClient } from \"@apollo/client/react\";\nimport { useEventBus } from \"@burdenoff/fe-libs/shared/events\";\nimport {\n  loginProfile,\n  type ProfileUser,\n} from \"@burdenoff/fe-libs/shared/providers/shell/ProfileStorageManager\";\nimport { useAuthStore } from \"../store/authStore\";\nimport { useAuth } from \"../providers/AuthProvider\";\nimport {\n  SignInDocument,\n  SignUpDocument,\n  SignOutDocument,\n  RefreshTokenDocument,\n  CurrentUserDocument,\n  VerifyEmailDocument,\n  ResendVerificationEmailDocument,\n} from \"../../generated/global-operations\";\nimport type {\n  SignInInput,\n  SignUpInput,\n  User,\n  AuthPayload,\n  AuthResult,\n} from \"../types\";\n\n// =============================================================================\n// ERROR MAPPING HELPERS\n// =============================================================================\n\n/**\n * Map raw backend error messages to user-friendly descriptions.\n * Keeps a single source of truth for all sign-up error copy.\n */\nfunction mapSignUpError(rawMessage: string, errorCode?: string): string {\n  // Exact matches from the backend\n  if (\n    rawMessage.includes(\"email or username already exists\") ||\n    errorCode === \"BAD_USER_INPUT\"\n  ) {\n    return \"An account with this email or username already exists. Please sign in or use a different email.\";\n  }\n\n  if (errorCode === \"TENANT_CREATION_FAILED\") {\n    return \"We couldn't finish setting up your account. Please try again in a few moments. If this persists, contact support.\";\n  }\n\n  // Network / fetch failures (Apollo wraps these)\n  if (\n    rawMessage.includes(\"Failed to fetch\") ||\n    rawMessage.includes(\"NetworkError\") ||\n    rawMessage.includes(\"Load failed\")\n  ) {\n    return \"Unable to reach the server. Please check your internet connection and try again.\";\n  }\n\n  // CORS or cross-origin issues\n  if (rawMessage.includes(\"CORS\") || rawMessage.includes(\"cross-origin\")) {\n    return \"Unable to reach the server. Please try again or contact support.\";\n  }\n\n  // Generic server errors\n  if (errorCode === \"INTERNAL_SERVER_ERROR\") {\n    return \"Something went wrong on our end. Please try again in a few moments.\";\n  }\n\n  // Pass through any already-descriptive message, or fall back\n  if (rawMessage && rawMessage !== \"Sign up failed\") {\n    return rawMessage;\n  }\n\n  return \"Sign up failed. Please try again.\";\n}\n\nfunction setShellSsoCookie(userId: string): void {\n  try {\n    const hostname = window.location.hostname;\n    const domain = hostname.endsWith(\".local.burdenoff.com\")\n      ? \".local.burdenoff.com\"\n      : undefined;\n    const domainPart = domain ? `; domain=${domain}` : \"\";\n    const securePart = window.location.protocol === \"https:\" ? \"; secure\" : \"\";\n    const ssoValue = JSON.stringify({\n      id: userId,\n      origin: window.location.origin,\n    });\n    document.cookie = `bf-sso=${encodeURIComponent(ssoValue)}${domainPart}; path=/; samesite=lax${securePart}; max-age=86400`;\n    document.cookie = `bf-sso-profile=${encodeURIComponent(ssoValue)}${domainPart}; path=/; samesite=lax${securePart}; max-age=86400`;\n  } catch {\n    // Best effort only.\n  }\n}\n\nfunction toProfileUser(user: User): ProfileUser {\n  return { ...user };\n}\n\ninterface GraphQLErrorLike {\n  message?: string;\n  extensions?: Record<string, unknown>;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null;\n}\n\nfunction asGraphQLErrorArray(value: unknown): GraphQLErrorLike[] {\n  if (!Array.isArray(value)) return [];\n  return value.filter((item): item is GraphQLErrorLike => isRecord(item));\n}\n\nfunction getGraphQLErrors(error: unknown): GraphQLErrorLike[] {\n  if (!isRecord(error)) return [];\n  const directErrors = asGraphQLErrorArray(error.errors);\n  if (directErrors.length > 0) return directErrors;\n  return asGraphQLErrorArray(error.graphQLErrors);\n}\n\nfunction getUnknownErrorMessage(error: unknown): string | undefined {\n  if (error instanceof Error) return error.message;\n  if (isRecord(error) && typeof error.message === \"string\") {\n    return error.message;\n  }\n  return undefined;\n}\n\nfunction getGraphQLErrorCode(\n  error: GraphQLErrorLike | undefined,\n): string | null {\n  const code = error?.extensions?.code;\n  return typeof code === \"string\" ? code : null;\n}\n\n// =============================================================================\n// GRAPHQL RESPONSE INTERFACES (Apollo Client 4.x)\n// =============================================================================\n\ninterface SignInResponse {\n  signIn: AuthPayload;\n}\n\ninterface SignInVariables {\n  input: SignInInput;\n}\n\ninterface SignUpResponse {\n  signUp: AuthPayload;\n}\n\ninterface SignUpVariables {\n  input: SignUpInput;\n}\n\ninterface SignOutResponse {\n  signOut: boolean;\n}\n\ninterface RefreshTokenResponse {\n  refreshToken: AuthPayload;\n}\n\ninterface RefreshTokenVariables {\n  token: string;\n}\n\ninterface CurrentUserResponse {\n  currentUser: User | null;\n}\n\ninterface UseAuthOperationsOptions {\n  disableCurrentUserQuery?: boolean;\n}\n\ninterface VerifyEmailResponse {\n  verifyEmail: {\n    success: boolean;\n    message: string;\n  };\n}\n\ninterface VerifyEmailVariables {\n  token: string;\n}\n\ninterface ResendVerificationEmailResponse {\n  resendVerificationEmail: {\n    success: boolean;\n    message: string;\n  };\n}\n\ninterface ResendVerificationEmailVariables {\n  email: string;\n}\n\n// GraphQL Operations\n\n// SignIn mutation with MFA support\n\n/**\n * Hook for authentication operations\n * Uses Zustand v5 pattern: selectors for state, getState() for actions\n */\nexport function useAuthOperations(options: UseAuthOperationsOptions = {}) {\n  // Use selectors for reactive state values\n  const isLoading = useAuthStore((state) => state.isLoading);\n  const error = useAuthStore((state) => state.error);\n  const errorCode = useAuthStore((state) => state.errorCode);\n  const isAuthenticated = useAuthStore((state) => state.isAuthenticated);\n  const user = useAuthStore((state) => state.user);\n  const accessToken = useAuthStore((state) => state.accessToken);\n  const disableCurrentUserQuery = options.disableCurrentUserQuery ?? false;\n\n  // Track whether signIn just completed — skip the CurrentUser refetch\n  // because signIn already returns the full user object.\n  const loginJustCompletedRef = useRef(false);\n\n  const context = useAuth();\n  const eventBus = useEventBus();\n  const apolloClient = useApolloClient();\n  const [signInMutation] = useMutation<SignInResponse, SignInVariables>(\n    SignInDocument,\n  );\n  const [signUpMutation] = useMutation<SignUpResponse, SignUpVariables>(\n    SignUpDocument,\n  );\n  const [signOutMutation] = useMutation<SignOutResponse>(SignOutDocument);\n  const [refreshTokenMutation] = useMutation<\n    RefreshTokenResponse,\n    RefreshTokenVariables\n  >(RefreshTokenDocument);\n  const [verifyEmailMutation] = useMutation<\n    VerifyEmailResponse,\n    VerifyEmailVariables\n  >(VerifyEmailDocument);\n  const [resendVerificationMutation] = useMutation<\n    ResendVerificationEmailResponse,\n    ResendVerificationEmailVariables\n  >(ResendVerificationEmailDocument);\n\n  /**\n   * Sign in with email/username and password\n   * Uses signIn mutation which returns correct token format (with 'sub' field)\n   */\n  const signIn = async (input: SignInInput): Promise<AuthResult> => {\n    const store = useAuthStore.getState();\n\n    try {\n      store.setLoading(true);\n      store.setError(null);\n\n      // rememberMe is sent to the backend so the server can issue\n      // longer-lived refresh tokens (30 days instead of 7 days)\n\n      // Use signIn mutation (returns correct token format with 'sub' field)\n      const result = await signInMutation({\n        variables: { input },\n        // Override client-level errorPolicy to ensure errors are thrown\n        // and caught by our catch block for proper error message extraction\n        errorPolicy: \"none\",\n      });\n\n      // If we reach here, the mutation succeeded (no errors thrown)\n      // Check if data.signIn is present\n      if (!result.data || !result.data.signIn) {\n        const errorMessage =\n          \"Sign in failed. Please check your credentials and try again.\";\n        store.setError(errorMessage);\n        return {\n          success: false,\n          error: errorMessage,\n        } as AuthResult;\n      }\n\n      const data = result.data;\n\n      const authResult = data.signIn;\n\n      // Check if MFA is required\n      if (authResult.requiresMFA && authResult.mfaChallengeId) {\n        store.setMfaRequired(true, authResult.mfaChallengeId);\n\n        // Return success but with requiresMFA flag\n        return {\n          success: true,\n          requiresMFA: true,\n          mfaChallengeId: authResult.mfaChallengeId,\n          metadata: {\n            mfaMethod: authResult.mfaMethod,\n          },\n        } as AuthResult;\n      }\n\n      // Normal login without MFA - store the authentication result\n      if (\n        authResult.user &&\n        authResult.accessToken &&\n        authResult.refreshToken\n      ) {\n        // Signal that user data is fresh from signIn — skip CurrentUser refetch.\n        loginJustCompletedRef.current = true;\n        store.setUser(authResult.user);\n        store.setAuthTokens(authResult.accessToken, authResult.refreshToken);\n        store.setAuthenticated(true);\n        store.setMfaRequired(false);\n\n        const expiresAt = authResult.expiresIn\n          ? Date.now() + authResult.expiresIn * 1000\n          : undefined;\n        loginProfile(toProfileUser(authResult.user), {\n          accessToken: authResult.accessToken,\n          refreshToken: authResult.refreshToken,\n          expiresAt,\n        });\n        setShellSsoCookie(authResult.user.id);\n\n        eventBus.emit(\n          \"auth.signed_in\",\n          {\n            userId: authResult.user.id,\n            tenantId: authResult.user.tenantId,\n            workspaceId: authResult.user.defaultWorkspaceId,\n            mfaEnabled: authResult.user.mfaEnabled,\n            emailVerified: authResult.user.emailVerified,\n          },\n          { component: \"useAuthOperations\" },\n        );\n\n        context.onAuthSuccess?.(\n          authResult.user,\n          authResult.accessToken,\n          authResult.refreshToken,\n        );\n\n        // Convert AuthPayload to AuthResult for consistent return type\n        return {\n          success: true,\n          user: authResult.user,\n          token: authResult.accessToken,\n          refreshToken: authResult.refreshToken,\n          expiresIn: authResult.expiresIn,\n          requiresMFA: false,\n        } as AuthResult;\n      } else {\n        const errorMsg = \"Login failed: Invalid response from server\";\n        store.setError(errorMsg);\n        return {\n          success: false,\n          error: errorMsg,\n        } as AuthResult;\n      }\n    } catch (err: unknown) {\n      // Extract error message and code from GraphQL error responses.\n      // The backend sends user-friendly messages in gqlError.message and\n      // structured error codes in gqlError.extensions.code (e.g., ACCOUNT_DELETED,\n      // ACCOUNT_SUSPENDED, ACCOUNT_INACTIVE, OAUTH_ONLY_ACCOUNT, EMAIL_NOT_VERIFIED,\n      // UNAUTHENTICATED, INTERNAL_SERVER_ERROR).\n      // IMPORTANT: Never use gqlError.extensions.originalError — it may contain\n      // internal details that should not be shown to users.\n      let message = \"Sign in failed\";\n      let errorCode: string | null = null;\n      const graphQLErrors = getGraphQLErrors(err);\n      if (graphQLErrors.length > 0) {\n        // Apollo v4 CombinedGraphQLErrors\n        // Apollo v3 ApolloError — use message only, never originalError\n        const gqlError = graphQLErrors[0];\n        message = gqlError.message || message;\n        errorCode = getGraphQLErrorCode(gqlError);\n      } else {\n        message = getUnknownErrorMessage(err) ?? message;\n      }\n\n      console.error(\n        \"[SignIn] Error:\",\n        message,\n        errorCode ? `(${errorCode})` : \"\",\n      );\n      store.setError(message, errorCode);\n      return {\n        success: false,\n        error: message,\n      } as AuthResult;\n    } finally {\n      store.setLoading(false);\n    }\n  };\n\n  /**\n   * Sign up new user\n   */\n  const signUp = async (input: SignUpInput) => {\n    const store = useAuthStore.getState();\n\n    try {\n      store.setLoading(true);\n      store.setError(null);\n\n      const mutationResult = await signUpMutation({\n        variables: { input },\n      });\n\n      // With errorPolicy: 'all', errors are returned in result, not thrown\n      // Check for GraphQL errors first\n      const graphQLErrors = getGraphQLErrors(mutationResult);\n      if (graphQLErrors.length > 0) {\n        const errorMessage = graphQLErrors[0].message ?? \"Sign up failed\";\n        console.error(\"[SignUp] GraphQL error:\", errorMessage);\n        store.setError(errorMessage);\n        throw new Error(errorMessage);\n      }\n\n      // Check if data.signUp is null (indicates GraphQL error without explicit error)\n      if (!mutationResult.data || !mutationResult.data.signUp) {\n        const errorMessage = \"Sign up failed: No response from server\";\n        console.error(\"[SignUp] No data:\", errorMessage);\n        store.setError(errorMessage);\n        throw new Error(errorMessage);\n      }\n\n      const result = mutationResult.data.signUp;\n\n      // Check if user was created\n      if (!result.user) {\n        throw new Error(\"Sign up failed: No user data returned\");\n      }\n\n      // Check if email verification is required (empty tokens)\n      if (\n        !result.accessToken ||\n        !result.refreshToken ||\n        result.accessToken === \"\" ||\n        result.refreshToken === \"\"\n      ) {\n        // User created successfully but needs to verify email\n        // Don't set authenticated state, but store the user for display\n        store.setUser(result.user);\n        store.setAuthenticated(false);\n\n        // Return special result indicating email verification needed\n        return {\n          ...result,\n          requiresEmailVerification: true,\n        };\n      }\n\n      // Normal sign up with immediate access (tokens provided)\n      store.setUser(result.user);\n      store.setAuthTokens(result.accessToken, result.refreshToken);\n      store.setAuthenticated(true);\n\n      eventBus.emit(\n        \"auth.signed_up\",\n        {\n          userId: result.user.id,\n          tenantId: result.user.tenantId,\n          workspaceId: result.user.defaultWorkspaceId,\n          mfaEnabled: result.user.mfaEnabled,\n          emailVerified: result.user.emailVerified,\n        },\n        { component: \"useAuthOperations\" },\n      );\n\n      context.onAuthSuccess?.(\n        result.user,\n        result.accessToken,\n        result.refreshToken,\n      );\n\n      return result;\n    } catch (err: unknown) {\n      // Extract error message from Apollo error or regular error\n      let message = \"Sign up failed. Please try again.\";\n      let errorCode: string | undefined;\n\n      const graphQLErrors = getGraphQLErrors(err);\n      if (graphQLErrors.length > 0) {\n        const gqlError = graphQLErrors[0];\n        errorCode = getGraphQLErrorCode(gqlError) ?? undefined;\n        const rawMessage = gqlError.message ?? \"\";\n\n        // Map backend error codes to user-friendly messages\n        message = mapSignUpError(rawMessage, errorCode);\n      } else {\n        const rawMessage = getUnknownErrorMessage(err);\n        if (rawMessage) {\n          message = mapSignUpError(rawMessage);\n        }\n      }\n\n      store.setError(message, errorCode ?? null);\n      throw new Error(message);\n    } finally {\n      store.setLoading(false);\n    }\n  };\n\n  /**\n   * Sign out current session\n   */\n  const signOut = async () => {\n    const store = useAuthStore.getState();\n    const signedOutUser = store.user;\n\n    try {\n      await signOutMutation();\n    } catch (err) {\n      console.error(\"Sign out failed:\", err);\n    } finally {\n      // Always clear Apollo cache so stale user data doesn't survive re-login\n      await apolloClient.clearStore();\n      store.clearAuth();\n      eventBus.emit(\n        \"auth.signed_out\",\n        {\n          userId: signedOutUser?.id,\n          tenantId: signedOutUser?.tenantId,\n          workspaceId: signedOutUser?.defaultWorkspaceId,\n        },\n        { component: \"useAuthOperations\" },\n      );\n      context.onLogout?.();\n    }\n  };\n\n  /**\n   * Refresh access token\n   */\n  const refreshToken = async () => {\n    const store = useAuthStore.getState();\n\n    try {\n      const token = store.refreshToken;\n      if (!token) throw new Error(\"No refresh token available\");\n\n      const { data } = await refreshTokenMutation({\n        variables: { token },\n      });\n\n      const result = data!.refreshToken;\n\n      // Refresh token should always return valid tokens and user\n      if (!result.accessToken || !result.refreshToken || !result.user) {\n        throw new Error(\"Token refresh failed: Invalid response from server\");\n      }\n\n      store.setAuthTokens(result.accessToken, result.refreshToken);\n      store.setUser(result.user);\n\n      eventBus.emit(\n        \"auth.token_refreshed\",\n        {\n          userId: result.user.id,\n          tenantId: result.user.tenantId,\n          workspaceId: result.user.defaultWorkspaceId,\n          mfaEnabled: result.user.mfaEnabled,\n          emailVerified: result.user.emailVerified,\n        },\n        { component: \"useAuthOperations\" },\n      );\n\n      return result;\n    } catch (err) {\n      // Refresh failed, logout user\n      eventBus.emit(\n        \"auth.token_refresh_failed\",\n        {\n          userId: store.user?.id,\n          tenantId: store.user?.tenantId,\n          workspaceId: store.user?.defaultWorkspaceId,\n          reason: err instanceof Error ? err.message : \"Token refresh failed\",\n        },\n        { component: \"useAuthOperations\" },\n      );\n      store.clearAuth();\n      throw err;\n    }\n  };\n\n  /**\n   * Get current user.\n   * Skip when:\n   *  - Not authenticated\n   *  - Login just completed (user data is already fresh from signIn response)\n   *\n   * The loginJustCompletedRef is cleared after the first successful fetch\n   * or on the next render cycle after navigation.\n   */\n  const { data: currentUserData, refetch: refetchCurrentUser } =\n    useQuery<CurrentUserResponse>(CurrentUserDocument, {\n      skip:\n        disableCurrentUserQuery ||\n        !isAuthenticated ||\n        loginJustCompletedRef.current,\n      fetchPolicy: \"network-only\",\n    });\n\n  // Handle currentUser data updates (replaces onCompleted callback)\n  useEffect(() => {\n    if (currentUserData?.currentUser) {\n      useAuthStore.getState().setUser(currentUserData.currentUser);\n    }\n  }, [currentUserData]);\n\n  // Clear loginJustCompletedRef after navigation away from login page\n  // so subsequent CurrentUser queries work normally (e.g., profile page).\n  useEffect(() => {\n    if (loginJustCompletedRef.current && isAuthenticated) {\n      const timer = setTimeout(() => {\n        loginJustCompletedRef.current = false;\n      }, 2000);\n      return () => clearTimeout(timer);\n    }\n  }, [isAuthenticated]);\n\n  /**\n   * Verify email with token\n   * Returns { success, message, email } on success\n   */\n  const verifyEmail = async (\n    token: string,\n  ): Promise<{ success: boolean; message: string; email?: string }> => {\n    const store = useAuthStore.getState();\n\n    try {\n      store.setLoading(true);\n      const { data } = await verifyEmailMutation({ variables: { token } });\n\n      if (data!.verifyEmail.success && store.user) {\n        store.setUser({ ...store.user, emailVerified: true });\n      }\n\n      return data!.verifyEmail;\n    } catch (err) {\n      const message =\n        err instanceof Error ? err.message : \"Email verification failed\";\n      store.setError(message);\n      throw err;\n    } finally {\n      store.setLoading(false);\n    }\n  };\n\n  /**\n   * Resend verification email\n   */\n  const resendVerification = async (email: string) => {\n    try {\n      const { data } = await resendVerificationMutation({\n        variables: { email },\n      });\n      return data!.resendVerificationEmail;\n    } catch (err) {\n      console.error(\"Failed to resend verification email:\", err);\n      throw err;\n    }\n  };\n\n  // Legacy aliases for backwards compatibility\n  const login = signIn;\n  const register = signUp;\n  const logout = signOut;\n\n  return {\n    // New API\n    signIn,\n    signUp,\n    signOut,\n    refreshToken,\n    verifyEmail,\n    resendVerification,\n    refetchCurrentUser,\n    // Legacy aliases\n    login,\n    register,\n    logout,\n    // State (reactive via selectors)\n    isLoading,\n    error,\n    errorCode,\n    isAuthenticated,\n    user,\n    accessToken,\n  };\n}\n"],"mappings":";;;;;;;;AAkCA,SAAS,EAAe,GAAoB,GAA4B;AAqCtE,QAlCE,EAAW,SAAS,mCAAmC,IACvD,MAAc,mBAEP,oGAGL,MAAc,2BACT,sHAKP,EAAW,SAAS,kBAAkB,IACtC,EAAW,SAAS,eAAe,IACnC,EAAW,SAAS,cAAc,GAE3B,qFAIL,EAAW,SAAS,OAAO,IAAI,EAAW,SAAS,eAAe,GAC7D,qEAIL,MAAc,0BACT,wEAIL,KAAc,MAAe,mBACxB,IAGF;;AAGT,SAAS,EAAkB,GAAsB;AAC/C,KAAI;EAEF,IAAM,IADW,OAAO,SAAS,SACT,SAAS,uBAAuB,GACpD,yBACA,KAAA,GACE,IAAa,IAAS,YAAY,MAAW,IAC7C,IAAa,OAAO,SAAS,aAAa,WAAW,aAAa,IAClE,IAAW,KAAK,UAAU;GAC9B,IAAI;GACJ,QAAQ,OAAO,SAAS;GACzB,CAAC;AAEF,EADA,SAAS,SAAS,UAAU,mBAAmB,EAAS,GAAG,EAAW,wBAAwB,EAAW,kBACzG,SAAS,SAAS,kBAAkB,mBAAmB,EAAS,GAAG,EAAW,wBAAwB,EAAW;SAC3G;;AAKV,SAAS,EAAc,GAAyB;AAC9C,QAAO,EAAE,GAAG,GAAM;;AAQpB,SAAS,EAAS,GAAkD;AAClE,QAAO,OAAO,KAAU,cAAY;;AAGtC,SAAS,EAAoB,GAAoC;AAE/D,QADK,MAAM,QAAQ,EAAM,GAClB,EAAM,QAAQ,MAAmC,EAAS,EAAK,CAAC,GADrC,EAAE;;AAItC,SAAS,EAAiB,GAAoC;AAC5D,KAAI,CAAC,EAAS,EAAM,CAAE,QAAO,EAAE;CAC/B,IAAM,IAAe,EAAoB,EAAM,OAAO;AAEtD,QADI,EAAa,SAAS,IAAU,IAC7B,EAAoB,EAAM,cAAc;;AAGjD,SAAS,EAAuB,GAAoC;AAElE,KADI,aAAiB,SACjB,EAAS,EAAM,IAAI,OAAO,EAAM,WAAY,SAC9C,QAAO,EAAM;;AAKjB,SAAS,EACP,GACe;CACf,IAAM,IAAO,GAAO,YAAY;AAChC,QAAO,OAAO,KAAS,WAAW,IAAO;;AAyE3C,SAAgB,EAAkB,IAAoC,EAAE,EAAE;CAExE,IAAM,IAAY,GAAc,MAAU,EAAM,UAAU,EACpD,IAAQ,GAAc,MAAU,EAAM,MAAM,EAC5C,IAAY,GAAc,MAAU,EAAM,UAAU,EACpD,IAAkB,GAAc,MAAU,EAAM,gBAAgB,EAChE,IAAO,GAAc,MAAU,EAAM,KAAK,EAC1C,IAAc,GAAc,MAAU,EAAM,YAAY,EACxD,IAA0B,EAAQ,2BAA2B,IAI7D,IAAwB,EAAO,GAAM,EAErC,IAAU,GAAS,EACnB,IAAW,GAAa,EACxB,IAAe,GAAiB,EAChC,CAAC,KAAkB,EACvB,EACD,EACK,CAAC,KAAkB,EACvB,EACD,EACK,CAAC,KAAmB,EAA6B,EAAgB,EACjE,CAAC,KAAwB,EAG7B,EAAqB,EACjB,CAAC,KAAuB,EAG5B,EAAoB,EAChB,CAAC,KAA8B,EAGnC,EAAgC,EAM5B,IAAS,OAAO,MAA4C;EAChE,IAAM,IAAQ,EAAa,UAAU;AAErC,MAAI;AAEF,GADA,EAAM,WAAW,GAAK,EACtB,EAAM,SAAS,KAAK;GAMpB,IAAM,IAAS,MAAM,EAAe;IAClC,WAAW,EAAE,UAAO;IAGpB,aAAa;IACd,CAAC;AAIF,OAAI,CAAC,EAAO,QAAQ,CAAC,EAAO,KAAK,QAAQ;IACvC,IAAM,IACJ;AAEF,WADA,EAAM,SAAS,EAAa,EACrB;KACL,SAAS;KACT,OAAO;KACR;;GAKH,IAAM,IAFO,EAAO,KAEI;AAGxB,OAAI,EAAW,eAAe,EAAW,eAIvC,QAHA,EAAM,eAAe,IAAM,EAAW,eAAe,EAG9C;IACL,SAAS;IACT,aAAa;IACb,gBAAgB,EAAW;IAC3B,UAAU,EACR,WAAW,EAAW,WACvB;IACF;AAIH,OACE,EAAW,QACX,EAAW,eACX,EAAW,cACX;AAMA,IAJA,EAAsB,UAAU,IAChC,EAAM,QAAQ,EAAW,KAAK,EAC9B,EAAM,cAAc,EAAW,aAAa,EAAW,aAAa,EACpE,EAAM,iBAAiB,GAAK,EAC5B,EAAM,eAAe,GAAM;IAE3B,IAAM,IAAY,EAAW,YACzB,KAAK,KAAK,GAAG,EAAW,YAAY,MACpC,KAAA;AA2BJ,WA1BA,EAAa,EAAc,EAAW,KAAK,EAAE;KAC3C,aAAa,EAAW;KACxB,cAAc,EAAW;KACzB;KACD,CAAC,EACF,EAAkB,EAAW,KAAK,GAAG,EAErC,EAAS,KACP,kBACA;KACE,QAAQ,EAAW,KAAK;KACxB,UAAU,EAAW,KAAK;KAC1B,aAAa,EAAW,KAAK;KAC7B,YAAY,EAAW,KAAK;KAC5B,eAAe,EAAW,KAAK;KAChC,EACD,EAAE,WAAW,qBAAqB,CACnC,EAED,EAAQ,gBACN,EAAW,MACX,EAAW,aACX,EAAW,aACZ,EAGM;KACL,SAAS;KACT,MAAM,EAAW;KACjB,OAAO,EAAW;KAClB,cAAc,EAAW;KACzB,WAAW,EAAW;KACtB,aAAa;KACd;UACI;IACL,IAAM,IAAW;AAEjB,WADA,EAAM,SAAS,EAAS,EACjB;KACL,SAAS;KACT,OAAO;KACR;;WAEI,GAAc;GAQrB,IAAI,IAAU,kBACV,IAA2B,MACzB,IAAgB,EAAiB,EAAI;AAC3C,OAAI,EAAc,SAAS,GAAG;IAG5B,IAAM,IAAW,EAAc;AAE/B,IADA,IAAU,EAAS,WAAW,GAC9B,IAAY,EAAoB,EAAS;SAEzC,KAAU,EAAuB,EAAI,IAAI;AAS3C,UANA,QAAQ,MACN,mBACA,GACA,IAAY,IAAI,EAAU,KAAK,GAChC,EACD,EAAM,SAAS,GAAS,EAAU,EAC3B;IACL,SAAS;IACT,OAAO;IACR;YACO;AACR,KAAM,WAAW,GAAM;;IAOrB,IAAS,OAAO,MAAuB;EAC3C,IAAM,IAAQ,EAAa,UAAU;AAErC,MAAI;AAEF,GADA,EAAM,WAAW,GAAK,EACtB,EAAM,SAAS,KAAK;GAEpB,IAAM,IAAiB,MAAM,EAAe,EAC1C,WAAW,EAAE,UAAO,EACrB,CAAC,EAII,IAAgB,EAAiB,EAAe;AACtD,OAAI,EAAc,SAAS,GAAG;IAC5B,IAAM,IAAe,EAAc,GAAG,WAAW;AAGjD,UAFA,QAAQ,MAAM,2BAA2B,EAAa,EACtD,EAAM,SAAS,EAAa,EAClB,MAAM,EAAa;;AAI/B,OAAI,CAAC,EAAe,QAAQ,CAAC,EAAe,KAAK,QAAQ;IACvD,IAAM,IAAe;AAGrB,UAFA,QAAQ,MAAM,qBAAqB,EAAa,EAChD,EAAM,SAAS,EAAa,EAClB,MAAM,EAAa;;GAG/B,IAAM,IAAS,EAAe,KAAK;AAGnC,OAAI,CAAC,EAAO,KACV,OAAU,MAAM,wCAAwC;AA6C1D,UAxCE,CAAC,EAAO,eACR,CAAC,EAAO,gBACR,EAAO,gBAAgB,MACvB,EAAO,iBAAiB,MAIxB,EAAM,QAAQ,EAAO,KAAK,EAC1B,EAAM,iBAAiB,GAAM,EAGtB;IACL,GAAG;IACH,2BAA2B;IAC5B,KAIH,EAAM,QAAQ,EAAO,KAAK,EAC1B,EAAM,cAAc,EAAO,aAAa,EAAO,aAAa,EAC5D,EAAM,iBAAiB,GAAK,EAE5B,EAAS,KACP,kBACA;IACE,QAAQ,EAAO,KAAK;IACpB,UAAU,EAAO,KAAK;IACtB,aAAa,EAAO,KAAK;IACzB,YAAY,EAAO,KAAK;IACxB,eAAe,EAAO,KAAK;IAC5B,EACD,EAAE,WAAW,qBAAqB,CACnC,EAED,EAAQ,gBACN,EAAO,MACP,EAAO,aACP,EAAO,aACR,EAEM;WACA,GAAc;GAErB,IAAI,IAAU,qCACV,GAEE,IAAgB,EAAiB,EAAI;AAC3C,OAAI,EAAc,SAAS,GAAG;IAC5B,IAAM,IAAW,EAAc;AAK/B,IAJA,IAAY,EAAoB,EAAS,IAAI,KAAA,GAI7C,IAAU,EAHS,EAAS,WAAW,IAGF,EAAU;UAC1C;IACL,IAAM,IAAa,EAAuB,EAAI;AAC9C,IAAI,MACF,IAAU,EAAe,EAAW;;AAKxC,SADA,EAAM,SAAS,GAAS,KAAa,KAAK,EAChC,MAAM,EAAQ;YAChB;AACR,KAAM,WAAW,GAAM;;IAOrB,IAAU,YAAY;EAC1B,IAAM,IAAQ,EAAa,UAAU,EAC/B,IAAgB,EAAM;AAE5B,MAAI;AACF,SAAM,GAAiB;WAChB,GAAK;AACZ,WAAQ,MAAM,oBAAoB,EAAI;YAC9B;AAaR,GAXA,MAAM,EAAa,YAAY,EAC/B,EAAM,WAAW,EACjB,EAAS,KACP,mBACA;IACE,QAAQ,GAAe;IACvB,UAAU,GAAe;IACzB,aAAa,GAAe;IAC7B,EACD,EAAE,WAAW,qBAAqB,CACnC,EACD,EAAQ,YAAY;;IAOlB,IAAe,YAAY;EAC/B,IAAM,IAAQ,EAAa,UAAU;AAErC,MAAI;GACF,IAAM,IAAQ,EAAM;AACpB,OAAI,CAAC,EAAO,OAAU,MAAM,6BAA6B;GAEzD,IAAM,EAAE,YAAS,MAAM,EAAqB,EAC1C,WAAW,EAAE,UAAO,EACrB,CAAC,EAEI,IAAS,EAAM;AAGrB,OAAI,CAAC,EAAO,eAAe,CAAC,EAAO,gBAAgB,CAAC,EAAO,KACzD,OAAU,MAAM,qDAAqD;AAkBvE,UAfA,EAAM,cAAc,EAAO,aAAa,EAAO,aAAa,EAC5D,EAAM,QAAQ,EAAO,KAAK,EAE1B,EAAS,KACP,wBACA;IACE,QAAQ,EAAO,KAAK;IACpB,UAAU,EAAO,KAAK;IACtB,aAAa,EAAO,KAAK;IACzB,YAAY,EAAO,KAAK;IACxB,eAAe,EAAO,KAAK;IAC5B,EACD,EAAE,WAAW,qBAAqB,CACnC,EAEM;WACA,GAAK;AAaZ,SAXA,EAAS,KACP,6BACA;IACE,QAAQ,EAAM,MAAM;IACpB,UAAU,EAAM,MAAM;IACtB,aAAa,EAAM,MAAM;IACzB,QAAQ,aAAe,QAAQ,EAAI,UAAU;IAC9C,EACD,EAAE,WAAW,qBAAqB,CACnC,EACD,EAAM,WAAW,EACX;;IAaJ,EAAE,MAAM,GAAiB,SAAS,MACtC,EAA8B,GAAqB;EACjD,MACE,KACA,CAAC,KACD,EAAsB;EACxB,aAAa;EACd,CAAC;AAoEJ,QAjEA,QAAgB;AACd,EAAI,GAAiB,eACnB,EAAa,UAAU,CAAC,QAAQ,EAAgB,YAAY;IAE7D,CAAC,EAAgB,CAAC,EAIrB,QAAgB;AACd,MAAI,EAAsB,WAAW,GAAiB;GACpD,IAAM,IAAQ,iBAAiB;AAC7B,MAAsB,UAAU;MAC/B,IAAK;AACR,gBAAa,aAAa,EAAM;;IAEjC,CAAC,EAAgB,CAAC,EAkDd;EAEL;EACA;EACA;EACA;EACA,aAlDkB,OAClB,MACmE;GACnE,IAAM,IAAQ,EAAa,UAAU;AAErC,OAAI;AACF,MAAM,WAAW,GAAK;IACtB,IAAM,EAAE,YAAS,MAAM,EAAoB,EAAE,WAAW,EAAE,UAAO,EAAE,CAAC;AAMpE,WAJI,EAAM,YAAY,WAAW,EAAM,QACrC,EAAM,QAAQ;KAAE,GAAG,EAAM;KAAM,eAAe;KAAM,CAAC,EAGhD,EAAM;YACN,GAAK;IACZ,IAAM,IACJ,aAAe,QAAQ,EAAI,UAAU;AAEvC,UADA,EAAM,SAAS,EAAQ,EACjB;aACE;AACR,MAAM,WAAW,GAAM;;;EA+BzB,oBAxByB,OAAO,MAAkB;AAClD,OAAI;IACF,IAAM,EAAE,YAAS,MAAM,EAA2B,EAChD,WAAW,EAAE,UAAO,EACrB,CAAC;AACF,WAAO,EAAM;YACN,GAAK;AAEZ,UADA,QAAQ,MAAM,wCAAwC,EAAI,EACpD;;;EAiBR;EAEA,OAdY;EAeZ,UAde;EAef,QAda;EAgBb;EACA;EACA;EACA;EACA;EACA;EACD"}
+{"version":3,"file":"useAuthOperations.js","names":[],"sources":["../../../src/auth/hooks/useAuthOperations.ts"],"sourcesContent":["import { useEffect, useRef } from \"react\";\nimport { useMutation, useQuery, useApolloClient } from \"@apollo/client/react\";\nimport { useEventBus } from \"@burdenoff/fe-libs/shared/events\";\nimport {\n  loginProfile,\n  getProfiles,\n  getProfileTokens,\n  getProfileUser,\n  type ProfileUser,\n} from \"@burdenoff/fe-libs/shared/providers/shell/ProfileStorageManager\";\nimport { useAuthStore } from \"../store/authStore\";\nimport { useAuth } from \"../providers/AuthProvider\";\nimport {\n  SignInDocument,\n  SignUpDocument,\n  SignOutDocument,\n  RefreshTokenDocument,\n  CurrentUserDocument,\n  VerifyEmailDocument,\n  ResendVerificationEmailDocument,\n} from \"../../generated/global-operations\";\nimport type {\n  SignInInput,\n  SignUpInput,\n  User,\n  AuthPayload,\n  AuthResult,\n} from \"../types\";\n\n// =============================================================================\n// ERROR MAPPING HELPERS\n// =============================================================================\n\n/**\n * Map raw backend error messages to user-friendly descriptions.\n * Keeps a single source of truth for all sign-up error copy.\n */\nfunction mapSignUpError(rawMessage: string, errorCode?: string): string {\n  // Exact matches from the backend\n  if (\n    rawMessage.includes(\"email or username already exists\") ||\n    errorCode === \"BAD_USER_INPUT\"\n  ) {\n    return \"An account with this email or username already exists. Please sign in or use a different email.\";\n  }\n\n  if (errorCode === \"TENANT_CREATION_FAILED\") {\n    return \"We couldn't finish setting up your account. Please try again in a few moments. If this persists, contact support.\";\n  }\n\n  // Network / fetch failures (Apollo wraps these)\n  if (\n    rawMessage.includes(\"Failed to fetch\") ||\n    rawMessage.includes(\"NetworkError\") ||\n    rawMessage.includes(\"Load failed\")\n  ) {\n    return \"Unable to reach the server. Please check your internet connection and try again.\";\n  }\n\n  // CORS or cross-origin issues\n  if (rawMessage.includes(\"CORS\") || rawMessage.includes(\"cross-origin\")) {\n    return \"Unable to reach the server. Please try again or contact support.\";\n  }\n\n  // Generic server errors\n  if (errorCode === \"INTERNAL_SERVER_ERROR\") {\n    return \"Something went wrong on our end. Please try again in a few moments.\";\n  }\n\n  // Pass through any already-descriptive message, or fall back\n  if (rawMessage && rawMessage !== \"Sign up failed\") {\n    return rawMessage;\n  }\n\n  return \"Sign up failed. Please try again.\";\n}\n\nfunction setShellSsoCookie(userId: string): void {\n  try {\n    const hostname = window.location.hostname;\n    const domain = hostname.endsWith(\".local.burdenoff.com\")\n      ? \".local.burdenoff.com\"\n      : undefined;\n    const domainPart = domain ? `; domain=${domain}` : \"\";\n    const securePart = window.location.protocol === \"https:\" ? \"; secure\" : \"\";\n    const ssoValue = JSON.stringify({\n      id: userId,\n      origin: window.location.origin,\n    });\n    document.cookie = `bf-sso=${encodeURIComponent(ssoValue)}${domainPart}; path=/; samesite=lax${securePart}; max-age=86400`;\n    document.cookie = `bf-sso-profile=${encodeURIComponent(ssoValue)}${domainPart}; path=/; samesite=lax${securePart}; max-age=86400`;\n  } catch {\n    // Best effort only.\n  }\n}\n\nfunction toProfileUser(user: User): ProfileUser {\n  return { ...user };\n}\n\ninterface GraphQLErrorLike {\n  message?: string;\n  extensions?: Record<string, unknown>;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null;\n}\n\nfunction asGraphQLErrorArray(value: unknown): GraphQLErrorLike[] {\n  if (!Array.isArray(value)) return [];\n  return value.filter((item): item is GraphQLErrorLike => isRecord(item));\n}\n\nfunction getGraphQLErrors(error: unknown): GraphQLErrorLike[] {\n  if (!isRecord(error)) return [];\n  const directErrors = asGraphQLErrorArray(error.errors);\n  if (directErrors.length > 0) return directErrors;\n  return asGraphQLErrorArray(error.graphQLErrors);\n}\n\nfunction getUnknownErrorMessage(error: unknown): string | undefined {\n  if (error instanceof Error) return error.message;\n  if (isRecord(error) && typeof error.message === \"string\") {\n    return error.message;\n  }\n  return undefined;\n}\n\nfunction getGraphQLErrorCode(\n  error: GraphQLErrorLike | undefined,\n): string | null {\n  const code = error?.extensions?.code;\n  return typeof code === \"string\" ? code : null;\n}\n\n// =============================================================================\n// GRAPHQL RESPONSE INTERFACES (Apollo Client 4.x)\n// =============================================================================\n\ninterface SignInResponse {\n  signIn: AuthPayload;\n}\n\ninterface SignInVariables {\n  input: SignInInput;\n}\n\ninterface SignUpResponse {\n  signUp: AuthPayload;\n}\n\ninterface SignUpVariables {\n  input: SignUpInput;\n}\n\ninterface SignOutResponse {\n  signOut: boolean;\n}\n\ninterface RefreshTokenResponse {\n  refreshToken: AuthPayload;\n}\n\ninterface RefreshTokenVariables {\n  token: string;\n}\n\ninterface CurrentUserResponse {\n  currentUser: User | null;\n}\n\ninterface UseAuthOperationsOptions {\n  disableCurrentUserQuery?: boolean;\n}\n\ninterface VerifyEmailResponse {\n  verifyEmail: {\n    success: boolean;\n    message: string;\n  };\n}\n\ninterface VerifyEmailVariables {\n  token: string;\n}\n\ninterface ResendVerificationEmailResponse {\n  resendVerificationEmail: {\n    success: boolean;\n    message: string;\n  };\n}\n\ninterface ResendVerificationEmailVariables {\n  email: string;\n}\n\n// GraphQL Operations\n\n// SignIn mutation with MFA support\n\n/**\n * Hook for authentication operations\n * Uses Zustand v5 pattern: selectors for state, getState() for actions\n */\nexport function useAuthOperations(options: UseAuthOperationsOptions = {}) {\n  // Use selectors for reactive state values\n  const isLoading = useAuthStore((state) => state.isLoading);\n  const error = useAuthStore((state) => state.error);\n  const errorCode = useAuthStore((state) => state.errorCode);\n  const isAuthenticated = useAuthStore((state) => state.isAuthenticated);\n  const user = useAuthStore((state) => state.user);\n  const accessToken = useAuthStore((state) => state.accessToken);\n  const disableCurrentUserQuery = options.disableCurrentUserQuery ?? false;\n\n  // Track whether signIn just completed — skip the CurrentUser refetch\n  // because signIn already returns the full user object.\n  const loginJustCompletedRef = useRef(false);\n\n  const context = useAuth();\n  const eventBus = useEventBus();\n  const apolloClient = useApolloClient();\n  const [signInMutation] = useMutation<SignInResponse, SignInVariables>(\n    SignInDocument,\n  );\n  const [signUpMutation] = useMutation<SignUpResponse, SignUpVariables>(\n    SignUpDocument,\n  );\n  const [signOutMutation] = useMutation<SignOutResponse>(SignOutDocument);\n  const [refreshTokenMutation] = useMutation<\n    RefreshTokenResponse,\n    RefreshTokenVariables\n  >(RefreshTokenDocument);\n  const [verifyEmailMutation] = useMutation<\n    VerifyEmailResponse,\n    VerifyEmailVariables\n  >(VerifyEmailDocument);\n  const [resendVerificationMutation] = useMutation<\n    ResendVerificationEmailResponse,\n    ResendVerificationEmailVariables\n  >(ResendVerificationEmailDocument);\n\n  /**\n   * Sign in with email/username and password\n   * Uses signIn mutation which returns correct token format (with 'sub' field)\n   */\n  const signIn = async (input: SignInInput): Promise<AuthResult> => {\n    const store = useAuthStore.getState();\n\n    try {\n      store.setLoading(true);\n      store.setError(null);\n\n      // rememberMe is sent to the backend so the server can issue\n      // longer-lived refresh tokens (30 days instead of 7 days)\n\n      // Use signIn mutation (returns correct token format with 'sub' field)\n      const result = await signInMutation({\n        variables: { input },\n        // Override client-level errorPolicy to ensure errors are thrown\n        // and caught by our catch block for proper error message extraction\n        errorPolicy: \"none\",\n      });\n\n      // If we reach here, the mutation succeeded (no errors thrown)\n      // Check if data.signIn is present\n      if (!result.data || !result.data.signIn) {\n        const errorMessage =\n          \"Sign in failed. Please check your credentials and try again.\";\n        store.setError(errorMessage);\n        return {\n          success: false,\n          error: errorMessage,\n        } as AuthResult;\n      }\n\n      const data = result.data;\n\n      const authResult = data.signIn;\n\n      // Check if MFA is required\n      if (authResult.requiresMFA && authResult.mfaChallengeId) {\n        store.setMfaRequired(true, authResult.mfaChallengeId);\n\n        // Return success but with requiresMFA flag\n        return {\n          success: true,\n          requiresMFA: true,\n          mfaChallengeId: authResult.mfaChallengeId,\n          metadata: {\n            mfaMethod: authResult.mfaMethod,\n          },\n        } as AuthResult;\n      }\n\n      // Normal login without MFA - store the authentication result\n      if (\n        authResult.user &&\n        authResult.accessToken &&\n        authResult.refreshToken\n      ) {\n        // Signal that user data is fresh from signIn — skip CurrentUser refetch.\n        loginJustCompletedRef.current = true;\n        store.setUser(authResult.user);\n        store.setAuthTokens(authResult.accessToken, authResult.refreshToken);\n        store.setAuthenticated(true);\n        store.setMfaRequired(false);\n\n        const expiresAt = authResult.expiresIn\n          ? Date.now() + authResult.expiresIn * 1000\n          : undefined;\n        loginProfile(toProfileUser(authResult.user), {\n          accessToken: authResult.accessToken,\n          refreshToken: authResult.refreshToken,\n          expiresAt,\n        });\n        setShellSsoCookie(authResult.user.id);\n\n        eventBus.emit(\n          \"auth.signed_in\",\n          {\n            userId: authResult.user.id,\n            tenantId: authResult.user.tenantId,\n            workspaceId: authResult.user.defaultWorkspaceId,\n            mfaEnabled: authResult.user.mfaEnabled,\n            emailVerified: authResult.user.emailVerified,\n          },\n          { component: \"useAuthOperations\" },\n        );\n\n        context.onAuthSuccess?.(\n          authResult.user,\n          authResult.accessToken,\n          authResult.refreshToken,\n        );\n\n        // Convert AuthPayload to AuthResult for consistent return type\n        return {\n          success: true,\n          user: authResult.user,\n          token: authResult.accessToken,\n          refreshToken: authResult.refreshToken,\n          expiresIn: authResult.expiresIn,\n          requiresMFA: false,\n        } as AuthResult;\n      } else {\n        const errorMsg = \"Login failed: Invalid response from server\";\n        store.setError(errorMsg);\n        return {\n          success: false,\n          error: errorMsg,\n        } as AuthResult;\n      }\n    } catch (err: unknown) {\n      // Extract error message and code from GraphQL error responses.\n      // The backend sends user-friendly messages in gqlError.message and\n      // structured error codes in gqlError.extensions.code (e.g., ACCOUNT_DELETED,\n      // ACCOUNT_SUSPENDED, ACCOUNT_INACTIVE, OAUTH_ONLY_ACCOUNT, EMAIL_NOT_VERIFIED,\n      // UNAUTHENTICATED, INTERNAL_SERVER_ERROR).\n      // IMPORTANT: Never use gqlError.extensions.originalError — it may contain\n      // internal details that should not be shown to users.\n      let message = \"Sign in failed\";\n      let errorCode: string | null = null;\n      const graphQLErrors = getGraphQLErrors(err);\n      if (graphQLErrors.length > 0) {\n        // Apollo v4 CombinedGraphQLErrors\n        // Apollo v3 ApolloError — use message only, never originalError\n        const gqlError = graphQLErrors[0];\n        message = gqlError.message || message;\n        errorCode = getGraphQLErrorCode(gqlError);\n      } else {\n        message = getUnknownErrorMessage(err) ?? message;\n      }\n\n      console.error(\n        \"[SignIn] Error:\",\n        message,\n        errorCode ? `(${errorCode})` : \"\",\n      );\n      store.setError(message, errorCode);\n      return {\n        success: false,\n        error: message,\n      } as AuthResult;\n    } finally {\n      store.setLoading(false);\n    }\n  };\n\n  /**\n   * Sign up new user\n   */\n  const signUp = async (input: SignUpInput) => {\n    const store = useAuthStore.getState();\n\n    try {\n      store.setLoading(true);\n      store.setError(null);\n\n      const mutationResult = await signUpMutation({\n        variables: { input },\n      });\n\n      // With errorPolicy: 'all', errors are returned in result, not thrown\n      // Check for GraphQL errors first\n      const graphQLErrors = getGraphQLErrors(mutationResult);\n      if (graphQLErrors.length > 0) {\n        const errorMessage = graphQLErrors[0].message ?? \"Sign up failed\";\n        console.error(\"[SignUp] GraphQL error:\", errorMessage);\n        store.setError(errorMessage);\n        throw new Error(errorMessage);\n      }\n\n      // Check if data.signUp is null (indicates GraphQL error without explicit error)\n      if (!mutationResult.data || !mutationResult.data.signUp) {\n        const errorMessage = \"Sign up failed: No response from server\";\n        console.error(\"[SignUp] No data:\", errorMessage);\n        store.setError(errorMessage);\n        throw new Error(errorMessage);\n      }\n\n      const result = mutationResult.data.signUp;\n\n      // Check if user was created\n      if (!result.user) {\n        throw new Error(\"Sign up failed: No user data returned\");\n      }\n\n      // Check if email verification is required (empty tokens)\n      if (\n        !result.accessToken ||\n        !result.refreshToken ||\n        result.accessToken === \"\" ||\n        result.refreshToken === \"\"\n      ) {\n        // User created successfully but needs to verify email\n        // Don't set authenticated state, but store the user for display\n        store.setUser(result.user);\n        store.setAuthenticated(false);\n\n        // Return special result indicating email verification needed\n        return {\n          ...result,\n          requiresEmailVerification: true,\n        };\n      }\n\n      // Normal sign up with immediate access (tokens provided)\n      store.setUser(result.user);\n      store.setAuthTokens(result.accessToken, result.refreshToken);\n      store.setAuthenticated(true);\n\n      eventBus.emit(\n        \"auth.signed_up\",\n        {\n          userId: result.user.id,\n          tenantId: result.user.tenantId,\n          workspaceId: result.user.defaultWorkspaceId,\n          mfaEnabled: result.user.mfaEnabled,\n          emailVerified: result.user.emailVerified,\n        },\n        { component: \"useAuthOperations\" },\n      );\n\n      context.onAuthSuccess?.(\n        result.user,\n        result.accessToken,\n        result.refreshToken,\n      );\n\n      return result;\n    } catch (err: unknown) {\n      // Extract error message from Apollo error or regular error\n      let message = \"Sign up failed. Please try again.\";\n      let errorCode: string | undefined;\n\n      const graphQLErrors = getGraphQLErrors(err);\n      if (graphQLErrors.length > 0) {\n        const gqlError = graphQLErrors[0];\n        errorCode = getGraphQLErrorCode(gqlError) ?? undefined;\n        const rawMessage = gqlError.message ?? \"\";\n\n        // Map backend error codes to user-friendly messages\n        message = mapSignUpError(rawMessage, errorCode);\n      } else {\n        const rawMessage = getUnknownErrorMessage(err);\n        if (rawMessage) {\n          message = mapSignUpError(rawMessage);\n        }\n      }\n\n      store.setError(message, errorCode ?? null);\n      throw new Error(message);\n    } finally {\n      store.setLoading(false);\n    }\n  };\n\n  /**\n   * Sign out current session\n   */\n  const signOut = async () => {\n    const store = useAuthStore.getState();\n    const signedOutUser = store.user;\n\n    try {\n      await signOutMutation();\n    } catch (err) {\n      console.error(\"Sign out failed:\", err);\n    }\n\n    // Always clear Apollo cache so stale user data doesn't survive re-login\n    await apolloClient.clearStore();\n    store.clearAuth();\n    eventBus.emit(\n      \"auth.signed_out\",\n      {\n        userId: signedOutUser?.id,\n        tenantId: signedOutUser?.tenantId,\n        workspaceId: signedOutUser?.defaultWorkspaceId,\n      },\n      { component: \"useAuthOperations\" },\n    );\n\n    // If other profiles exist after clearing the current one, switch to the first\n    // remaining profile instead of fully logging out.\n    const remainingProfiles = getProfiles().filter(\n      (p) => p.id !== signedOutUser?.id,\n    );\n    if (remainingProfiles.length > 0) {\n      const nextProfile = remainingProfiles[0];\n      const nextTokens = getProfileTokens(nextProfile.id);\n      const nextUser = getProfileUser(nextProfile.id);\n      if (nextTokens?.accessToken && nextUser) {\n        // Switch to next profile instead of fully logging out\n        store.loadFromProfile(nextProfile.id);\n        return;\n      }\n    }\n\n    context.onLogout?.();\n  };\n\n  /**\n   * Refresh access token\n   */\n  const refreshToken = async () => {\n    const store = useAuthStore.getState();\n\n    try {\n      const token = store.refreshToken;\n      if (!token) throw new Error(\"No refresh token available\");\n\n      const { data } = await refreshTokenMutation({\n        variables: { token },\n      });\n\n      const result = data!.refreshToken;\n\n      // Refresh token should always return valid tokens and user\n      if (!result.accessToken || !result.refreshToken || !result.user) {\n        throw new Error(\"Token refresh failed: Invalid response from server\");\n      }\n\n      store.setAuthTokens(result.accessToken, result.refreshToken);\n      store.setUser(result.user);\n\n      eventBus.emit(\n        \"auth.token_refreshed\",\n        {\n          userId: result.user.id,\n          tenantId: result.user.tenantId,\n          workspaceId: result.user.defaultWorkspaceId,\n          mfaEnabled: result.user.mfaEnabled,\n          emailVerified: result.user.emailVerified,\n        },\n        { component: \"useAuthOperations\" },\n      );\n\n      return result;\n    } catch (err) {\n      // Refresh failed, logout user\n      eventBus.emit(\n        \"auth.token_refresh_failed\",\n        {\n          userId: store.user?.id,\n          tenantId: store.user?.tenantId,\n          workspaceId: store.user?.defaultWorkspaceId,\n          reason: err instanceof Error ? err.message : \"Token refresh failed\",\n        },\n        { component: \"useAuthOperations\" },\n      );\n      store.clearAuth();\n      throw err;\n    }\n  };\n\n  /**\n   * Get current user.\n   * Skip when:\n   *  - Not authenticated\n   *  - Login just completed (user data is already fresh from signIn response)\n   *\n   * The loginJustCompletedRef is cleared after the first successful fetch\n   * or on the next render cycle after navigation.\n   */\n  const { data: currentUserData, refetch: refetchCurrentUser } =\n    useQuery<CurrentUserResponse>(CurrentUserDocument, {\n      skip:\n        disableCurrentUserQuery ||\n        !isAuthenticated ||\n        loginJustCompletedRef.current,\n      fetchPolicy: \"network-only\",\n    });\n\n  // Handle currentUser data updates (replaces onCompleted callback)\n  useEffect(() => {\n    if (currentUserData?.currentUser) {\n      useAuthStore.getState().setUser(currentUserData.currentUser);\n    }\n  }, [currentUserData]);\n\n  // Clear loginJustCompletedRef after navigation away from login page\n  // so subsequent CurrentUser queries work normally (e.g., profile page).\n  useEffect(() => {\n    if (loginJustCompletedRef.current && isAuthenticated) {\n      const timer = setTimeout(() => {\n        loginJustCompletedRef.current = false;\n      }, 2000);\n      return () => clearTimeout(timer);\n    }\n  }, [isAuthenticated]);\n\n  /**\n   * Verify email with token\n   * Returns { success, message, email } on success\n   */\n  const verifyEmail = async (\n    token: string,\n  ): Promise<{ success: boolean; message: string; email?: string }> => {\n    const store = useAuthStore.getState();\n\n    try {\n      store.setLoading(true);\n      const { data } = await verifyEmailMutation({ variables: { token } });\n\n      if (data!.verifyEmail.success && store.user) {\n        store.setUser({ ...store.user, emailVerified: true });\n      }\n\n      return data!.verifyEmail;\n    } catch (err) {\n      const message =\n        err instanceof Error ? err.message : \"Email verification failed\";\n      store.setError(message);\n      throw err;\n    } finally {\n      store.setLoading(false);\n    }\n  };\n\n  /**\n   * Resend verification email\n   */\n  const resendVerification = async (email: string) => {\n    try {\n      const { data } = await resendVerificationMutation({\n        variables: { email },\n      });\n      return data!.resendVerificationEmail;\n    } catch (err) {\n      console.error(\"Failed to resend verification email:\", err);\n      throw err;\n    }\n  };\n\n  // Legacy aliases for backwards compatibility\n  const login = signIn;\n  const register = signUp;\n  const logout = signOut;\n\n  return {\n    // New API\n    signIn,\n    signUp,\n    signOut,\n    refreshToken,\n    verifyEmail,\n    resendVerification,\n    refetchCurrentUser,\n    // Legacy aliases\n    login,\n    register,\n    logout,\n    // State (reactive via selectors)\n    isLoading,\n    error,\n    errorCode,\n    isAuthenticated,\n    user,\n    accessToken,\n  };\n}\n"],"mappings":";;;;;;;;AAqCA,SAAS,EAAe,GAAoB,GAA4B;AAqCtE,QAlCE,EAAW,SAAS,mCAAmC,IACvD,MAAc,mBAEP,oGAGL,MAAc,2BACT,sHAKP,EAAW,SAAS,kBAAkB,IACtC,EAAW,SAAS,eAAe,IACnC,EAAW,SAAS,cAAc,GAE3B,qFAIL,EAAW,SAAS,OAAO,IAAI,EAAW,SAAS,eAAe,GAC7D,qEAIL,MAAc,0BACT,wEAIL,KAAc,MAAe,mBACxB,IAGF;;AAGT,SAAS,EAAkB,GAAsB;AAC/C,KAAI;EAEF,IAAM,IADW,OAAO,SAAS,SACT,SAAS,uBAAuB,GACpD,yBACA,KAAA,GACE,IAAa,IAAS,YAAY,MAAW,IAC7C,IAAa,OAAO,SAAS,aAAa,WAAW,aAAa,IAClE,IAAW,KAAK,UAAU;GAC9B,IAAI;GACJ,QAAQ,OAAO,SAAS;GACzB,CAAC;AAEF,EADA,SAAS,SAAS,UAAU,mBAAmB,EAAS,GAAG,EAAW,wBAAwB,EAAW,kBACzG,SAAS,SAAS,kBAAkB,mBAAmB,EAAS,GAAG,EAAW,wBAAwB,EAAW;SAC3G;;AAKV,SAAS,EAAc,GAAyB;AAC9C,QAAO,EAAE,GAAG,GAAM;;AAQpB,SAAS,EAAS,GAAkD;AAClE,QAAO,OAAO,KAAU,cAAY;;AAGtC,SAAS,EAAoB,GAAoC;AAE/D,QADK,MAAM,QAAQ,EAAM,GAClB,EAAM,QAAQ,MAAmC,EAAS,EAAK,CAAC,GADrC,EAAE;;AAItC,SAAS,EAAiB,GAAoC;AAC5D,KAAI,CAAC,EAAS,EAAM,CAAE,QAAO,EAAE;CAC/B,IAAM,IAAe,EAAoB,EAAM,OAAO;AAEtD,QADI,EAAa,SAAS,IAAU,IAC7B,EAAoB,EAAM,cAAc;;AAGjD,SAAS,EAAuB,GAAoC;AAElE,KADI,aAAiB,SACjB,EAAS,EAAM,IAAI,OAAO,EAAM,WAAY,SAC9C,QAAO,EAAM;;AAKjB,SAAS,EACP,GACe;CACf,IAAM,IAAO,GAAO,YAAY;AAChC,QAAO,OAAO,KAAS,WAAW,IAAO;;AAyE3C,SAAgB,EAAkB,IAAoC,EAAE,EAAE;CAExE,IAAM,IAAY,GAAc,MAAU,EAAM,UAAU,EACpD,IAAQ,GAAc,MAAU,EAAM,MAAM,EAC5C,IAAY,GAAc,MAAU,EAAM,UAAU,EACpD,IAAkB,GAAc,MAAU,EAAM,gBAAgB,EAChE,IAAO,GAAc,MAAU,EAAM,KAAK,EAC1C,IAAc,GAAc,MAAU,EAAM,YAAY,EACxD,IAA0B,EAAQ,2BAA2B,IAI7D,IAAwB,EAAO,GAAM,EAErC,IAAU,GAAS,EACnB,IAAW,GAAa,EACxB,IAAe,GAAiB,EAChC,CAAC,KAAkB,EACvB,EACD,EACK,CAAC,KAAkB,EACvB,EACD,EACK,CAAC,KAAmB,EAA6B,EAAgB,EACjE,CAAC,KAAwB,EAG7B,EAAqB,EACjB,CAAC,KAAuB,EAG5B,EAAoB,EAChB,CAAC,KAA8B,EAGnC,EAAgC,EAM5B,IAAS,OAAO,MAA4C;EAChE,IAAM,IAAQ,EAAa,UAAU;AAErC,MAAI;AAEF,GADA,EAAM,WAAW,GAAK,EACtB,EAAM,SAAS,KAAK;GAMpB,IAAM,IAAS,MAAM,EAAe;IAClC,WAAW,EAAE,UAAO;IAGpB,aAAa;IACd,CAAC;AAIF,OAAI,CAAC,EAAO,QAAQ,CAAC,EAAO,KAAK,QAAQ;IACvC,IAAM,IACJ;AAEF,WADA,EAAM,SAAS,EAAa,EACrB;KACL,SAAS;KACT,OAAO;KACR;;GAKH,IAAM,IAFO,EAAO,KAEI;AAGxB,OAAI,EAAW,eAAe,EAAW,eAIvC,QAHA,EAAM,eAAe,IAAM,EAAW,eAAe,EAG9C;IACL,SAAS;IACT,aAAa;IACb,gBAAgB,EAAW;IAC3B,UAAU,EACR,WAAW,EAAW,WACvB;IACF;AAIH,OACE,EAAW,QACX,EAAW,eACX,EAAW,cACX;AAMA,IAJA,EAAsB,UAAU,IAChC,EAAM,QAAQ,EAAW,KAAK,EAC9B,EAAM,cAAc,EAAW,aAAa,EAAW,aAAa,EACpE,EAAM,iBAAiB,GAAK,EAC5B,EAAM,eAAe,GAAM;IAE3B,IAAM,IAAY,EAAW,YACzB,KAAK,KAAK,GAAG,EAAW,YAAY,MACpC,KAAA;AA2BJ,WA1BA,EAAa,EAAc,EAAW,KAAK,EAAE;KAC3C,aAAa,EAAW;KACxB,cAAc,EAAW;KACzB;KACD,CAAC,EACF,EAAkB,EAAW,KAAK,GAAG,EAErC,EAAS,KACP,kBACA;KACE,QAAQ,EAAW,KAAK;KACxB,UAAU,EAAW,KAAK;KAC1B,aAAa,EAAW,KAAK;KAC7B,YAAY,EAAW,KAAK;KAC5B,eAAe,EAAW,KAAK;KAChC,EACD,EAAE,WAAW,qBAAqB,CACnC,EAED,EAAQ,gBACN,EAAW,MACX,EAAW,aACX,EAAW,aACZ,EAGM;KACL,SAAS;KACT,MAAM,EAAW;KACjB,OAAO,EAAW;KAClB,cAAc,EAAW;KACzB,WAAW,EAAW;KACtB,aAAa;KACd;UACI;IACL,IAAM,IAAW;AAEjB,WADA,EAAM,SAAS,EAAS,EACjB;KACL,SAAS;KACT,OAAO;KACR;;WAEI,GAAc;GAQrB,IAAI,IAAU,kBACV,IAA2B,MACzB,IAAgB,EAAiB,EAAI;AAC3C,OAAI,EAAc,SAAS,GAAG;IAG5B,IAAM,IAAW,EAAc;AAE/B,IADA,IAAU,EAAS,WAAW,GAC9B,IAAY,EAAoB,EAAS;SAEzC,KAAU,EAAuB,EAAI,IAAI;AAS3C,UANA,QAAQ,MACN,mBACA,GACA,IAAY,IAAI,EAAU,KAAK,GAChC,EACD,EAAM,SAAS,GAAS,EAAU,EAC3B;IACL,SAAS;IACT,OAAO;IACR;YACO;AACR,KAAM,WAAW,GAAM;;IAOrB,IAAS,OAAO,MAAuB;EAC3C,IAAM,IAAQ,EAAa,UAAU;AAErC,MAAI;AAEF,GADA,EAAM,WAAW,GAAK,EACtB,EAAM,SAAS,KAAK;GAEpB,IAAM,IAAiB,MAAM,EAAe,EAC1C,WAAW,EAAE,UAAO,EACrB,CAAC,EAII,IAAgB,EAAiB,EAAe;AACtD,OAAI,EAAc,SAAS,GAAG;IAC5B,IAAM,IAAe,EAAc,GAAG,WAAW;AAGjD,UAFA,QAAQ,MAAM,2BAA2B,EAAa,EACtD,EAAM,SAAS,EAAa,EAClB,MAAM,EAAa;;AAI/B,OAAI,CAAC,EAAe,QAAQ,CAAC,EAAe,KAAK,QAAQ;IACvD,IAAM,IAAe;AAGrB,UAFA,QAAQ,MAAM,qBAAqB,EAAa,EAChD,EAAM,SAAS,EAAa,EAClB,MAAM,EAAa;;GAG/B,IAAM,IAAS,EAAe,KAAK;AAGnC,OAAI,CAAC,EAAO,KACV,OAAU,MAAM,wCAAwC;AA6C1D,UAxCE,CAAC,EAAO,eACR,CAAC,EAAO,gBACR,EAAO,gBAAgB,MACvB,EAAO,iBAAiB,MAIxB,EAAM,QAAQ,EAAO,KAAK,EAC1B,EAAM,iBAAiB,GAAM,EAGtB;IACL,GAAG;IACH,2BAA2B;IAC5B,KAIH,EAAM,QAAQ,EAAO,KAAK,EAC1B,EAAM,cAAc,EAAO,aAAa,EAAO,aAAa,EAC5D,EAAM,iBAAiB,GAAK,EAE5B,EAAS,KACP,kBACA;IACE,QAAQ,EAAO,KAAK;IACpB,UAAU,EAAO,KAAK;IACtB,aAAa,EAAO,KAAK;IACzB,YAAY,EAAO,KAAK;IACxB,eAAe,EAAO,KAAK;IAC5B,EACD,EAAE,WAAW,qBAAqB,CACnC,EAED,EAAQ,gBACN,EAAO,MACP,EAAO,aACP,EAAO,aACR,EAEM;WACA,GAAc;GAErB,IAAI,IAAU,qCACV,GAEE,IAAgB,EAAiB,EAAI;AAC3C,OAAI,EAAc,SAAS,GAAG;IAC5B,IAAM,IAAW,EAAc;AAK/B,IAJA,IAAY,EAAoB,EAAS,IAAI,KAAA,GAI7C,IAAU,EAHS,EAAS,WAAW,IAGF,EAAU;UAC1C;IACL,IAAM,IAAa,EAAuB,EAAI;AAC9C,IAAI,MACF,IAAU,EAAe,EAAW;;AAKxC,SADA,EAAM,SAAS,GAAS,KAAa,KAAK,EAChC,MAAM,EAAQ;YAChB;AACR,KAAM,WAAW,GAAM;;IAOrB,IAAU,YAAY;EAC1B,IAAM,IAAQ,EAAa,UAAU,EAC/B,IAAgB,EAAM;AAE5B,MAAI;AACF,SAAM,GAAiB;WAChB,GAAK;AACZ,WAAQ,MAAM,oBAAoB,EAAI;;AAMxC,EAFA,MAAM,EAAa,YAAY,EAC/B,EAAM,WAAW,EACjB,EAAS,KACP,mBACA;GACE,QAAQ,GAAe;GACvB,UAAU,GAAe;GACzB,aAAa,GAAe;GAC7B,EACD,EAAE,WAAW,qBAAqB,CACnC;EAID,IAAM,IAAoB,GAAa,CAAC,QACrC,MAAM,EAAE,OAAO,GAAe,GAChC;AACD,MAAI,EAAkB,SAAS,GAAG;GAChC,IAAM,IAAc,EAAkB,IAChC,IAAa,EAAiB,EAAY,GAAG,EAC7C,IAAW,EAAe,EAAY,GAAG;AAC/C,OAAI,GAAY,eAAe,GAAU;AAEvC,MAAM,gBAAgB,EAAY,GAAG;AACrC;;;AAIJ,IAAQ,YAAY;IAMhB,IAAe,YAAY;EAC/B,IAAM,IAAQ,EAAa,UAAU;AAErC,MAAI;GACF,IAAM,IAAQ,EAAM;AACpB,OAAI,CAAC,EAAO,OAAU,MAAM,6BAA6B;GAEzD,IAAM,EAAE,YAAS,MAAM,EAAqB,EAC1C,WAAW,EAAE,UAAO,EACrB,CAAC,EAEI,IAAS,EAAM;AAGrB,OAAI,CAAC,EAAO,eAAe,CAAC,EAAO,gBAAgB,CAAC,EAAO,KACzD,OAAU,MAAM,qDAAqD;AAkBvE,UAfA,EAAM,cAAc,EAAO,aAAa,EAAO,aAAa,EAC5D,EAAM,QAAQ,EAAO,KAAK,EAE1B,EAAS,KACP,wBACA;IACE,QAAQ,EAAO,KAAK;IACpB,UAAU,EAAO,KAAK;IACtB,aAAa,EAAO,KAAK;IACzB,YAAY,EAAO,KAAK;IACxB,eAAe,EAAO,KAAK;IAC5B,EACD,EAAE,WAAW,qBAAqB,CACnC,EAEM;WACA,GAAK;AAaZ,SAXA,EAAS,KACP,6BACA;IACE,QAAQ,EAAM,MAAM;IACpB,UAAU,EAAM,MAAM;IACtB,aAAa,EAAM,MAAM;IACzB,QAAQ,aAAe,QAAQ,EAAI,UAAU;IAC9C,EACD,EAAE,WAAW,qBAAqB,CACnC,EACD,EAAM,WAAW,EACX;;IAaJ,EAAE,MAAM,GAAiB,SAAS,MACtC,EAA8B,GAAqB;EACjD,MACE,KACA,CAAC,KACD,EAAsB;EACxB,aAAa;EACd,CAAC;AAoEJ,QAjEA,QAAgB;AACd,EAAI,GAAiB,eACnB,EAAa,UAAU,CAAC,QAAQ,EAAgB,YAAY;IAE7D,CAAC,EAAgB,CAAC,EAIrB,QAAgB;AACd,MAAI,EAAsB,WAAW,GAAiB;GACpD,IAAM,IAAQ,iBAAiB;AAC7B,MAAsB,UAAU;MAC/B,IAAK;AACR,gBAAa,aAAa,EAAM;;IAEjC,CAAC,EAAgB,CAAC,EAkDd;EAEL;EACA;EACA;EACA;EACA,aAlDkB,OAClB,MACmE;GACnE,IAAM,IAAQ,EAAa,UAAU;AAErC,OAAI;AACF,MAAM,WAAW,GAAK;IACtB,IAAM,EAAE,YAAS,MAAM,EAAoB,EAAE,WAAW,EAAE,UAAO,EAAE,CAAC;AAMpE,WAJI,EAAM,YAAY,WAAW,EAAM,QACrC,EAAM,QAAQ;KAAE,GAAG,EAAM;KAAM,eAAe;KAAM,CAAC,EAGhD,EAAM;YACN,GAAK;IACZ,IAAM,IACJ,aAAe,QAAQ,EAAI,UAAU;AAEvC,UADA,EAAM,SAAS,EAAQ,EACjB;aACE;AACR,MAAM,WAAW,GAAM;;;EA+BzB,oBAxByB,OAAO,MAAkB;AAClD,OAAI;IACF,IAAM,EAAE,YAAS,MAAM,EAA2B,EAChD,WAAW,EAAE,UAAO,EACrB,CAAC;AACF,WAAO,EAAM;YACN,GAAK;AAEZ,UADA,QAAQ,MAAM,wCAAwC,EAAI,EACpD;;;EAiBR;EAEA,OAdY;EAeZ,UAde;EAef,QAda;EAgBb;EACA;EACA;EACA;EACA;EACA;EACD"}

package/dist/auth/hooks/useDelegationOperations.d.ts

@@ -1,10 +1,18 @@
 import { AppUserDelegation, GrantDelegationInput } from '../types';
 
 interface CurrentUserDelegationsResponse {
-    currentUserDelegations: AppUserDelegation[];
+    currentUserDelegations: {
+        delegations: AppUserDelegation[];
+        hasMore: boolean;
+        totalCount: number;
+    };
 }
 interface CurrentUserGrantedDelegationsResponse {
-    currentUserGrantedDelegations: AppUserDelegation[];
+    currentUserGrantedDelegations: {
+        delegations: AppUserDelegation[];
+        hasMore: boolean;
+        totalCount: number;
+    };
 }
 /**
  * Hook for app-user delegation operations

package/dist/auth/hooks/useDelegationOperations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useDelegationOperations.d.ts","sourceRoot":"","sources":["../../../src/auth/hooks/useDelegationOperations.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAYxE,UAAU,8BAA8B;IACtC,sBAAsB,EAAE,iBAAiB,EAAE,CAAC;CAC7C;AAED,UAAU,qCAAqC;IAC7C,6BAA6B,EAAE,iBAAiB,EAAE,CAAC;CACpD;AAuBD;;GAEG;AACH,wBAAgB,uBAAuB;6BAsF5B,oBAAoB,KAC1B,OAAO,CAAC,iBAAiB,CAAC;2BA0BvB,MAAM,WACD,MAAM,KACd,OAAO,CAAC,OAAO,CAAC;kCAsBkB,MAAM,KAAG,iBAAiB,EAAE;oCAUxD,MAAM,eACA,MAAM,KAClB,OAAO;;;;;;;EAgCX"}
+{"version":3,"file":"useDelegationOperations.d.ts","sourceRoot":"","sources":["../../../src/auth/hooks/useDelegationOperations.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAYxE,UAAU,8BAA8B;IACtC,sBAAsB,EAAE;QACtB,WAAW,EAAE,iBAAiB,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED,UAAU,qCAAqC;IAC7C,6BAA6B,EAAE;QAC7B,WAAW,EAAE,iBAAiB,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAuBD;;GAEG;AACH,wBAAgB,uBAAuB;6BAsF5B,oBAAoB,KAC1B,OAAO,CAAC,iBAAiB,CAAC;2BA0BvB,MAAM,WACD,MAAM,KACd,OAAO,CAAC,OAAO,CAAC;kCAsBkB,MAAM,KAAG,iBAAiB,EAAE;oCAUxD,MAAM,eACA,MAAM,KAClB,OAAO;;;;;;;EAgCX"}

package/dist/auth/hooks/useSessionOperations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useSessionOperations.d.ts","sourceRoot":"","sources":["../../../src/auth/hooks/useSessionOperations.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACV,mBAAmB,EAKpB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAM7E,UAAU,sBAAsB;IAC9B,SAAS,EAAE,uBAAuB,CAAC;CACpC;AAUD,UAAU,2BAA2B;IACnC,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,GAAE,2BAAgC;4BA2ChC,mBAAmB,KACzB,OAAO,CAAC,uBAAuB,CAAC;0BAaR,OAAO;iCAQA,MAAM;;+BASA,MAAM,KAAG,OAAO,CAAC,OAAO,CAAC;6BAmB7B,OAAO,CAAC;QAC1C,OAAO,EAAE,OAAO,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;;;;;;;;;;;;;;;;;EA8BH"}
+{"version":3,"file":"useSessionOperations.d.ts","sourceRoot":"","sources":["../../../src/auth/hooks/useSessionOperations.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACV,mBAAmB,EAKpB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAM7E,UAAU,sBAAsB;IAC9B,SAAS,EAAE,uBAAuB,CAAC;CACpC;AAUD,UAAU,2BAA2B;IACnC,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,GAAE,2BAAgC;4BAoDhC,mBAAmB,KACzB,OAAO,CAAC,uBAAuB,CAAC;0BAaR,OAAO;iCAQA,MAAM;;+BASA,MAAM,KAAG,OAAO,CAAC,OAAO,CAAC;6BAmB7B,OAAO,CAAC;QAC1C,OAAO,EAAE,OAAO,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;;;;;;;;;;;;;;;;;EA8BH"}

package/dist/auth/hooks/useSessionOperations.js

@@ -9,7 +9,8 @@ function c(c = {}) {
 		pollInterval: 300 * 1e3
 	}), { data: h, loading: g, refetch: _ } = s(t, {
 		skip: !l.isAuthenticated,
-		fetchPolicy: "cache-and-network"
+		fetchPolicy: "cache-and-network",
+		context: l.accessToken ? { headers: { authorization: `Bearer ${l.accessToken}` } } : void 0
 	}), [v] = o(r), [y] = o(n);
 	return {
 		validateTokens: async (e) => {
@@ -46,7 +47,7 @@ function c(c = {}) {
 				throw console.error("Failed to revoke all sessions:", e), e;
 			}
 		},
-		activeSessions: h?.activeSessions ?? [],
+		activeSessions: h?.activeSessions?.sessions ?? [],
 		sessionsLoading: g,
 		refetchSessions: _,
 		isLoading: p || g,

package/dist/auth/hooks/useSessionOperations.js.map

@@ -1 +1 @@
-{"version":3,"file":"useSessionOperations.js","names":[],"sources":["../../../src/auth/hooks/useSessionOperations.ts"],"sourcesContent":["import { useQuery, useMutation } from \"@apollo/client/react\";\nimport { useAuthStore } from \"../store/authStore\";\nimport {\n  TokenInfoDocument,\n  ValidateTokensDocument,\n  ActiveSessionsDocument,\n  RevokeSessionDocument,\n  RevokeAllSessionsDocument,\n} from \"../../generated/global-operations\";\nimport type {\n  ActiveSessionsQuery,\n  RevokeSessionMutation,\n  RevokeSessionMutationVariables,\n  RevokeAllSessionsMutation,\n  RevokeAllSessionsMutationVariables,\n} from \"../../generated/global-operations\";\nimport type { TokenValidationResponse, ValidateTokensInput } from \"../types\";\n\n// =============================================================================\n// GRAPHQL RESPONSE INTERFACES\n// =============================================================================\n\ninterface TokenInfoQueryResponse {\n  tokenInfo: TokenValidationResponse;\n}\n\ninterface ValidateTokensMutationResponse {\n  validateTokens: TokenValidationResponse;\n}\n\ninterface ValidateTokensMutationVariables {\n  input: ValidateTokensInput;\n}\n\ninterface UseSessionOperationsOptions {\n  disableTokenInfoQuery?: boolean;\n}\n\n/**\n * Hook for session/token management operations\n */\nexport function useSessionOperations(\n  options: UseSessionOperationsOptions = {},\n) {\n  const store = useAuthStore();\n  const disableTokenInfoQuery = options.disableTokenInfoQuery ?? false;\n  const [validateTokensMutation] = useMutation<\n    ValidateTokensMutationResponse,\n    ValidateTokensMutationVariables\n  >(ValidateTokensDocument);\n\n  const { data, loading, refetch } = useQuery<TokenInfoQueryResponse>(\n    TokenInfoDocument,\n    {\n      skip: disableTokenInfoQuery || !store.isAuthenticated,\n      fetchPolicy: \"cache-and-network\",\n      pollInterval: 5 * 60 * 1000, // Poll every 5 minutes (was 1 min — too aggressive)\n    },\n  );\n\n  // Active sessions query\n  const {\n    data: sessionsData,\n    loading: sessionsLoading,\n    refetch: refetchSessions,\n  } = useQuery<ActiveSessionsQuery>(ActiveSessionsDocument, {\n    skip: !store.isAuthenticated,\n    fetchPolicy: \"cache-and-network\",\n  });\n\n  // Session mutations\n  const [revokeSessionMutation] = useMutation<\n    RevokeSessionMutation,\n    RevokeSessionMutationVariables\n  >(RevokeSessionDocument);\n\n  const [revokeAllSessionsMutation] = useMutation<\n    RevokeAllSessionsMutation,\n    RevokeAllSessionsMutationVariables\n  >(RevokeAllSessionsDocument);\n\n  /**\n   * Validate tokens\n   */\n  const validateTokens = async (\n    input: ValidateTokensInput,\n  ): Promise<TokenValidationResponse> => {\n    try {\n      const { data } = await validateTokensMutation({ variables: { input } });\n      return data!.validateTokens;\n    } catch (error) {\n      console.error(\"Failed to validate tokens:\", error);\n      throw error;\n    }\n  };\n\n  /**\n   * Check if token is expired\n   */\n  const isTokenExpired = (): boolean => {\n    if (!data?.tokenInfo?.expiresAt) return true;\n    return Date.now() / 1000 > data.tokenInfo.expiresAt;\n  };\n\n  /**\n   * Get remaining time until token expires (in seconds)\n   */\n  const getTokenRemainingTime = (): number => {\n    if (!data?.tokenInfo?.expiresAt) return 0;\n    const remaining = data.tokenInfo.expiresAt - Date.now() / 1000;\n    return Math.max(0, remaining);\n  };\n\n  /**\n   * Revoke a specific session by ID\n   */\n  const revokeSession = async (sessionId: string): Promise<boolean> => {\n    try {\n      const { data } = await revokeSessionMutation({\n        variables: { sessionId },\n      });\n      if (data?.revokeSession) {\n        // Refetch active sessions to reflect the change\n        await refetchSessions();\n      }\n      return data?.revokeSession ?? false;\n    } catch (error) {\n      console.error(\"Failed to revoke session:\", error);\n      throw error;\n    }\n  };\n\n  /**\n   * Revoke all sessions except the current one\n   */\n  const revokeAllSessions = async (): Promise<{\n    success: boolean;\n    revokedCount: number;\n  }> => {\n    try {\n      const { data } = await revokeAllSessionsMutation();\n      if (data?.revokeAllSessions?.success) {\n        // Refetch active sessions to reflect the change\n        await refetchSessions();\n      }\n      return data?.revokeAllSessions ?? { success: false, revokedCount: 0 };\n    } catch (error) {\n      console.error(\"Failed to revoke all sessions:\", error);\n      throw error;\n    }\n  };\n\n  return {\n    // Token operations\n    validateTokens,\n    isTokenExpired,\n    getTokenRemainingTime,\n    tokenInfo: data?.tokenInfo,\n    // Session operations\n    revokeSession,\n    revokeAllSessions,\n    activeSessions: sessionsData?.activeSessions ?? [],\n    sessionsLoading,\n    refetchSessions,\n    // General state\n    isLoading: loading || sessionsLoading,\n    refetch,\n  };\n}\n"],"mappings":";;;;AAyCA,SAAgB,EACd,IAAuC,EAAE,EACzC;CACA,IAAM,IAAQ,GAAc,EACtB,IAAwB,EAAQ,yBAAyB,IACzD,CAAC,KAA0B,EAG/B,EAAuB,EAEnB,EAAE,SAAM,YAAS,eAAY,EACjC,GACA;EACE,MAAM,KAAyB,CAAC,EAAM;EACtC,aAAa;EACb,cAAc,MAAS;EACxB,CACF,EAGK,EACJ,MAAM,GACN,SAAS,GACT,SAAS,MACP,EAA8B,GAAwB;EACxD,MAAM,CAAC,EAAM;EACb,aAAa;EACd,CAAC,EAGI,CAAC,KAAyB,EAG9B,EAAsB,EAElB,CAAC,KAA6B,EAGlC,EAA0B;AAyE5B,QAAO;EAEL,gBAtEqB,OACrB,MACqC;AACrC,OAAI;IACF,IAAM,EAAE,YAAS,MAAM,EAAuB,EAAE,WAAW,EAAE,UAAO,EAAE,CAAC;AACvE,WAAO,EAAM;YACN,GAAO;AAEd,UADA,QAAQ,MAAM,8BAA8B,EAAM,EAC5C;;;EA+DR,sBAvDK,GAAM,WAAW,YACf,KAAK,KAAK,GAAG,MAAO,EAAK,UAAU,YADF;EAwDxC,6BAjD0C;AAC1C,OAAI,CAAC,GAAM,WAAW,UAAW,QAAO;GACxC,IAAM,IAAY,EAAK,UAAU,YAAY,KAAK,KAAK,GAAG;AAC1D,UAAO,KAAK,IAAI,GAAG,EAAU;;EA+C7B,WAAW,GAAM;EAEjB,eA3CoB,OAAO,MAAwC;AACnE,OAAI;IACF,IAAM,EAAE,YAAS,MAAM,EAAsB,EAC3C,WAAW,EAAE,cAAW,EACzB,CAAC;AAKF,WAJI,GAAM,iBAER,MAAM,GAAiB,EAElB,GAAM,iBAAiB;YACvB,GAAO;AAEd,UADA,QAAQ,MAAM,6BAA6B,EAAM,EAC3C;;;EAgCR,mBAzBwB,YAGpB;AACJ,OAAI;IACF,IAAM,EAAE,YAAS,MAAM,GAA2B;AAKlD,WAJI,GAAM,mBAAmB,WAE3B,MAAM,GAAiB,EAElB,GAAM,qBAAqB;KAAE,SAAS;KAAO,cAAc;KAAG;YAC9D,GAAO;AAEd,UADA,QAAQ,MAAM,kCAAkC,EAAM,EAChD;;;EAaR,gBAAgB,GAAc,kBAAkB,EAAE;EAClD;EACA;EAEA,WAAW,KAAW;EACtB;EACD"}
+{"version":3,"file":"useSessionOperations.js","names":[],"sources":["../../../src/auth/hooks/useSessionOperations.ts"],"sourcesContent":["import { useQuery, useMutation } from \"@apollo/client/react\";\nimport { useAuthStore } from \"../store/authStore\";\nimport {\n  TokenInfoDocument,\n  ValidateTokensDocument,\n  ActiveSessionsDocument,\n  RevokeSessionDocument,\n  RevokeAllSessionsDocument,\n} from \"../../generated/global-operations\";\nimport type {\n  ActiveSessionsQuery,\n  RevokeSessionMutation,\n  RevokeSessionMutationVariables,\n  RevokeAllSessionsMutation,\n  RevokeAllSessionsMutationVariables,\n} from \"../../generated/global-operations\";\nimport type { TokenValidationResponse, ValidateTokensInput } from \"../types\";\n\n// =============================================================================\n// GRAPHQL RESPONSE INTERFACES\n// =============================================================================\n\ninterface TokenInfoQueryResponse {\n  tokenInfo: TokenValidationResponse;\n}\n\ninterface ValidateTokensMutationResponse {\n  validateTokens: TokenValidationResponse;\n}\n\ninterface ValidateTokensMutationVariables {\n  input: ValidateTokensInput;\n}\n\ninterface UseSessionOperationsOptions {\n  disableTokenInfoQuery?: boolean;\n}\n\n/**\n * Hook for session/token management operations\n */\nexport function useSessionOperations(\n  options: UseSessionOperationsOptions = {},\n) {\n  const store = useAuthStore();\n  const disableTokenInfoQuery = options.disableTokenInfoQuery ?? false;\n  const [validateTokensMutation] = useMutation<\n    ValidateTokensMutationResponse,\n    ValidateTokensMutationVariables\n  >(ValidateTokensDocument);\n\n  const { data, loading, refetch } = useQuery<TokenInfoQueryResponse>(\n    TokenInfoDocument,\n    {\n      skip: disableTokenInfoQuery || !store.isAuthenticated,\n      fetchPolicy: \"cache-and-network\",\n      pollInterval: 5 * 60 * 1000, // Poll every 5 minutes (was 1 min — too aggressive)\n    },\n  );\n\n  // Active sessions query\n  // Pass the access token explicitly in Apollo operation context so the query\n  // works both via the shell's MultiGatewayProvider auth link and in standalone mode.\n  const {\n    data: sessionsData,\n    loading: sessionsLoading,\n    refetch: refetchSessions,\n  } = useQuery<ActiveSessionsQuery>(ActiveSessionsDocument, {\n    skip: !store.isAuthenticated,\n    fetchPolicy: \"cache-and-network\",\n    context: store.accessToken\n      ? {\n          headers: {\n            authorization: `Bearer ${store.accessToken}`,\n          },\n        }\n      : undefined,\n  });\n\n  // Session mutations\n  const [revokeSessionMutation] = useMutation<\n    RevokeSessionMutation,\n    RevokeSessionMutationVariables\n  >(RevokeSessionDocument);\n\n  const [revokeAllSessionsMutation] = useMutation<\n    RevokeAllSessionsMutation,\n    RevokeAllSessionsMutationVariables\n  >(RevokeAllSessionsDocument);\n\n  /**\n   * Validate tokens\n   */\n  const validateTokens = async (\n    input: ValidateTokensInput,\n  ): Promise<TokenValidationResponse> => {\n    try {\n      const { data } = await validateTokensMutation({ variables: { input } });\n      return data!.validateTokens;\n    } catch (error) {\n      console.error(\"Failed to validate tokens:\", error);\n      throw error;\n    }\n  };\n\n  /**\n   * Check if token is expired\n   */\n  const isTokenExpired = (): boolean => {\n    if (!data?.tokenInfo?.expiresAt) return true;\n    return Date.now() / 1000 > data.tokenInfo.expiresAt;\n  };\n\n  /**\n   * Get remaining time until token expires (in seconds)\n   */\n  const getTokenRemainingTime = (): number => {\n    if (!data?.tokenInfo?.expiresAt) return 0;\n    const remaining = data.tokenInfo.expiresAt - Date.now() / 1000;\n    return Math.max(0, remaining);\n  };\n\n  /**\n   * Revoke a specific session by ID\n   */\n  const revokeSession = async (sessionId: string): Promise<boolean> => {\n    try {\n      const { data } = await revokeSessionMutation({\n        variables: { sessionId },\n      });\n      if (data?.revokeSession) {\n        // Refetch active sessions to reflect the change\n        await refetchSessions();\n      }\n      return data?.revokeSession ?? false;\n    } catch (error) {\n      console.error(\"Failed to revoke session:\", error);\n      throw error;\n    }\n  };\n\n  /**\n   * Revoke all sessions except the current one\n   */\n  const revokeAllSessions = async (): Promise<{\n    success: boolean;\n    revokedCount: number;\n  }> => {\n    try {\n      const { data } = await revokeAllSessionsMutation();\n      if (data?.revokeAllSessions?.success) {\n        // Refetch active sessions to reflect the change\n        await refetchSessions();\n      }\n      return data?.revokeAllSessions ?? { success: false, revokedCount: 0 };\n    } catch (error) {\n      console.error(\"Failed to revoke all sessions:\", error);\n      throw error;\n    }\n  };\n\n  return {\n    // Token operations\n    validateTokens,\n    isTokenExpired,\n    getTokenRemainingTime,\n    tokenInfo: data?.tokenInfo,\n    // Session operations\n    revokeSession,\n    revokeAllSessions,\n    activeSessions: sessionsData?.activeSessions?.sessions ?? [],\n    sessionsLoading,\n    refetchSessions,\n    // General state\n    isLoading: loading || sessionsLoading,\n    refetch,\n  };\n}\n"],"mappings":";;;;AAyCA,SAAgB,EACd,IAAuC,EAAE,EACzC;CACA,IAAM,IAAQ,GAAc,EACtB,IAAwB,EAAQ,yBAAyB,IACzD,CAAC,KAA0B,EAG/B,EAAuB,EAEnB,EAAE,SAAM,YAAS,eAAY,EACjC,GACA;EACE,MAAM,KAAyB,CAAC,EAAM;EACtC,aAAa;EACb,cAAc,MAAS;EACxB,CACF,EAKK,EACJ,MAAM,GACN,SAAS,GACT,SAAS,MACP,EAA8B,GAAwB;EACxD,MAAM,CAAC,EAAM;EACb,aAAa;EACb,SAAS,EAAM,cACX,EACE,SAAS,EACP,eAAe,UAAU,EAAM,eAChC,EACF,GACD,KAAA;EACL,CAAC,EAGI,CAAC,KAAyB,EAG9B,EAAsB,EAElB,CAAC,KAA6B,EAGlC,EAA0B;AAyE5B,QAAO;EAEL,gBAtEqB,OACrB,MACqC;AACrC,OAAI;IACF,IAAM,EAAE,YAAS,MAAM,EAAuB,EAAE,WAAW,EAAE,UAAO,EAAE,CAAC;AACvE,WAAO,EAAM;YACN,GAAO;AAEd,UADA,QAAQ,MAAM,8BAA8B,EAAM,EAC5C;;;EA+DR,sBAvDK,GAAM,WAAW,YACf,KAAK,KAAK,GAAG,MAAO,EAAK,UAAU,YADF;EAwDxC,6BAjD0C;AAC1C,OAAI,CAAC,GAAM,WAAW,UAAW,QAAO;GACxC,IAAM,IAAY,EAAK,UAAU,YAAY,KAAK,KAAK,GAAG;AAC1D,UAAO,KAAK,IAAI,GAAG,EAAU;;EA+C7B,WAAW,GAAM;EAEjB,eA3CoB,OAAO,MAAwC;AACnE,OAAI;IACF,IAAM,EAAE,YAAS,MAAM,EAAsB,EAC3C,WAAW,EAAE,cAAW,EACzB,CAAC;AAKF,WAJI,GAAM,iBAER,MAAM,GAAiB,EAElB,GAAM,iBAAiB;YACvB,GAAO;AAEd,UADA,QAAQ,MAAM,6BAA6B,EAAM,EAC3C;;;EAgCR,mBAzBwB,YAGpB;AACJ,OAAI;IACF,IAAM,EAAE,YAAS,MAAM,GAA2B;AAKlD,WAJI,GAAM,mBAAmB,WAE3B,MAAM,GAAiB,EAElB,GAAM,qBAAqB;KAAE,SAAS;KAAO,cAAc;KAAG;YAC9D,GAAO;AAEd,UADA,QAAQ,MAAM,kCAAkC,EAAM,EAChD;;;EAaR,gBAAgB,GAAc,gBAAgB,YAAY,EAAE;EAC5D;EACA;EAEA,WAAW,KAAW;EACtB;EACD"}

package/dist/auth/pages/AuditLogPage.d.ts

@@ -1,5 +1,12 @@
 /**
- * Security audit log page
+ * Security audit log page with pagination and export
+ *
+ * Fragment: AuditLogEntry_AuthAuditLog (graphql/operations/global/fragments/AuditLogEntry.fragment.graphql)
+ * Query: AuthAuditLogs (graphql/operations/global/queries/auditLog.graphql)
+ *
+ * TODO: When authAuditLogs backend migrates to AuthAuditLogConnection type,
+ *   update this query to use: authAuditLogs { auditLogs: [...], totalCount, hasMore }
+ *   and remove the client-side hasMore approximation below.
  */
 export declare function AuditLogPage(): import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=AuditLogPage.d.ts.map

package/dist/auth/pages/AuditLogPage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuditLogPage.d.ts","sourceRoot":"","sources":["../../../src/auth/pages/AuditLogPage.tsx"],"names":[],"mappings":"AAiCA;;GAEG;AACH,wBAAgB,YAAY,4CA8H3B"}
+{"version":3,"file":"AuditLogPage.d.ts","sourceRoot":"","sources":["../../../src/auth/pages/AuditLogPage.tsx"],"names":[],"mappings":"AAaA;;;;;;;;;GASG;AACH,wBAAgB,YAAY,4CA2Q3B"}

package/dist/auth/pages/AuditLogPage.js

@@ -1,56 +1,38 @@
-import { AlertIcon as e } from "../components/AuthIcons.js";
-import { formatDateTime as t } from "../utils/formatters.js";
-import { useI18n as n } from "@burdenoff/fe-libs/shared/providers/shell";
-import { jsx as r, jsxs as i } from "react/jsx-runtime";
-import { useFeatureFlagDetails as a } from "@burdenoff/fe-libs/shared/feature-flags";
-import { useQuery as o } from "@apollo/client/react";
-import { gql as s } from "@apollo/client";
+import { useAuthAuditLogsQuery as e } from "../../generated/global-operations.js";
+import { AlertIcon as t, SpinnerIcon as n } from "../components/AuthIcons.js";
+import { formatDateTime as r } from "../utils/formatters.js";
+import { useCreateAuthExportJobMutation as i } from "../../generated/wspace-operations.js";
+import { useState as a } from "react";
+import { useI18n as o } from "@burdenoff/fe-libs/shared/providers/shell";
+import { Fragment as s, jsx as c, jsxs as l } from "react/jsx-runtime";
+import { useFeatureFlagDetails as u } from "@burdenoff/fe-libs/shared/feature-flags";
 //#region src/auth/pages/AuditLogPage.tsx
-var c = s`
-  query AuthAuditLogs($pagination: PaginationInput) {
-    authAuditLogs(pagination: $pagination) {
-      id
-      action
-      description
-      ipAddress
-      userAgent
-      createdAt
-    }
-  }
-`;
-function l() {
-	let { t: s } = n(), l = (e, t) => {
-		let n = s(e);
+var d = 20;
+function f() {
+	let { t: f } = o(), p = (e, t) => {
+		let n = f(e);
 		return n === e ? t : n;
-	}, u = a("auth.audit-log")?.value === !0, { data: d, loading: f, error: p } = o(c, {
-		skip: !u,
+	}, [m, h] = a(1), g = (m - 1) * d, _ = u("auth.audit-log")?.value === !0, { data: v, loading: y, error: b } = e({
+		skip: !_,
 		fetchPolicy: "cache-and-network",
 		variables: { pagination: {
-			limit: 50,
-			offset: 0
+			limit: d,
+			offset: g
 		} }
-	}), m = d?.authAuditLogs ?? [];
-	if (!u) return /* @__PURE__ */ r("div", {
-		className: "max-w-4xl mx-auto p-6",
-		children: /* @__PURE__ */ i("div", {
-			className: "text-center py-16 border-2 border-dashed border-border-subtle rounded-xl",
-			children: [
-				/* @__PURE__ */ r("div", {
-					className: "w-16 h-16 mx-auto mb-4 rounded-full bg-status-warning-bg-subtle flex items-center justify-center",
-					children: /* @__PURE__ */ r(e, { className: "w-8 h-8 text-status-warning-text" })
-				}),
-				/* @__PURE__ */ r("h2", {
-					className: "text-xl font-semibold text-text-primary mb-2",
-					children: l("auth.auditLog.notAvailable", "Page Not Available")
-				}),
-				/* @__PURE__ */ r("p", {
-					className: "text-text-secondary",
-					children: l("auth.auditLog.notEnabled", "The Security Audit Log is not enabled for your account.")
-				})
-			]
-		})
-	});
-	let h = (e) => {
+	}), x = v?.authAuditLogs ?? [], S = x.length === d, [C, { loading: w }] = i(), [T, E] = a(null), D = async () => {
+		E(null);
+		try {
+			await C({ variables: { input: {
+				name: "Audit Log Export",
+				entityTypes: ["permission_audit_logs"],
+				format: "CSV",
+				exportScope: "INDIVIDUAL",
+				includeMetadata: !0
+			} } });
+		} catch (e) {
+			E(e instanceof Error ? e.message : "Failed to start export");
+		}
+	}, O = (e) => {
 		switch (e) {
 			case "LOGIN_SUCCESS": return "OK";
 			case "LOGIN_FAILURE": return "ER";
@@ -62,68 +44,171 @@ function l() {
 			default: return "AU";
 		}
 	};
-	return /* @__PURE__ */ i("div", {
+	return _ ? /* @__PURE__ */ l("div", {
 		className: "max-w-4xl mx-auto p-6",
-		children: [/* @__PURE__ */ r("h1", {
-			className: "text-3xl font-semibold text-text-primary mb-8",
-			children: l("auth.auditLog.title", "Security Audit Log")
-		}), f ? /* @__PURE__ */ r("div", {
-			className: "text-center py-12",
-			children: /* @__PURE__ */ r("p", {
-				className: "text-text-secondary",
-				children: l("auth.auditLog.loading", "Loading audit events...")
-			})
-		}) : p ? /* @__PURE__ */ r("div", {
-			className: "text-center py-12 border border-status-error-border rounded-xl bg-status-error-bg-subtle",
-			children: /* @__PURE__ */ r("p", {
-				className: "text-status-error-text",
-				children: l("auth.auditLog.error", "Unable to load audit events")
-			})
-		}) : m.length === 0 ? /* @__PURE__ */ r("div", {
-			className: "text-center py-12",
-			children: /* @__PURE__ */ r("p", {
-				className: "text-text-secondary",
-				children: l("auth.auditLog.noEvents", "No security events recorded")
-			})
-		}) : /* @__PURE__ */ r("div", {
-			className: "space-y-4",
-			children: m.map((e) => /* @__PURE__ */ r("div", {
-				className: "p-6 rounded-xl border border-border-subtle bg-bg-surface shadow-sm",
-				children: /* @__PURE__ */ i("div", {
-					className: "flex items-start gap-4",
-					children: [
-						/* @__PURE__ */ r("div", {
-							className: "flex h-10 w-10 shrink-0 items-center justify-center rounded-full bg-bg-muted text-xs font-semibold text-text-secondary",
-							children: h(e.action)
-						}),
-						/* @__PURE__ */ i("div", {
-							className: "flex-1",
-							children: [
-								/* @__PURE__ */ r("h3", {
-									className: "text-lg font-medium text-text-primary mb-1",
-									children: e.action.replace(/_/g, " ")
-								}),
-								/* @__PURE__ */ r("p", {
-									className: "text-sm text-text-secondary mb-2",
-									children: t(e.createdAt)
-								}),
-								/* @__PURE__ */ i("p", {
-									className: "text-sm text-text-secondary",
-									children: [e.description ?? l("auth.auditLog.defaultDescription", "Authentication event"), e.ipAddress && ` • ${e.ipAddress}`]
-								})
-							]
-						}),
-						e.action.includes("FAILURE") && /* @__PURE__ */ r("span", {
-							className: "px-3 py-1 rounded-full bg-status-error-bg-subtle text-status-error-text text-sm font-medium",
-							children: l("auth.auditLog.failed", "Failed")
+		children: [
+			/* @__PURE__ */ l("div", {
+				className: "flex items-center justify-between mb-8",
+				children: [/* @__PURE__ */ c("h1", {
+					className: "text-3xl font-semibold text-text-primary",
+					children: p("auth.auditLog.title", "Security Audit Log")
+				}), /* @__PURE__ */ c("button", {
+					type: "button",
+					onClick: () => void D(),
+					disabled: w,
+					"aria-label": p("auth.auditLog.exportAriaLabel", "Export audit log"),
+					className: "flex items-center gap-2 px-4 py-2.5 rounded-xl border border-border-default text-text-primary bg-bg-surface hover:bg-bg-sunken disabled:opacity-50 disabled:cursor-not-allowed transition-colors font-medium",
+					children: w ? /* @__PURE__ */ l(s, { children: [/* @__PURE__ */ c(n, {
+						className: "w-4 h-4 animate-spin",
+						"aria-hidden": "true"
+					}), p("auth.auditLog.exporting", "Exporting...")] }) : /* @__PURE__ */ l(s, { children: [/* @__PURE__ */ c("svg", {
+						className: "w-4 h-4",
+						fill: "none",
+						viewBox: "0 0 24 24",
+						stroke: "currentColor",
+						"aria-hidden": "true",
+						children: /* @__PURE__ */ c("path", {
+							strokeLinecap: "round",
+							strokeLinejoin: "round",
+							strokeWidth: 2,
+							d: "M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1m-4-4l-4 4m0 0l-4-4m4 4V4"
 						})
+					}), p("auth.auditLog.export", "Export")] })
+				})]
+			}),
+			T && /* @__PURE__ */ l("div", {
+				role: "alert",
+				className: "mb-6 flex items-start gap-3 p-4 rounded-xl bg-status-error-bg-subtle border border-status-error-border",
+				children: [/* @__PURE__ */ c(t, {
+					className: "w-5 h-5 text-status-error-text flex-shrink-0 mt-0.5",
+					"aria-hidden": "true"
+				}), /* @__PURE__ */ c("p", {
+					className: "text-sm text-status-error-text",
+					children: T
+				})]
+			}),
+			y ? /* @__PURE__ */ l("div", {
+				"aria-live": "polite",
+				"aria-busy": "true",
+				className: "text-center py-12",
+				children: [/* @__PURE__ */ c(n, {
+					className: "w-8 h-8 mx-auto text-text-link animate-spin",
+					"aria-hidden": "true"
+				}), /* @__PURE__ */ c("p", {
+					className: "mt-3 text-text-secondary",
+					children: p("auth.auditLog.loading", "Loading audit events...")
+				})]
+			}) : b ? /* @__PURE__ */ c("div", {
+				role: "alert",
+				className: "text-center py-12 border border-status-error-border rounded-xl bg-status-error-bg-subtle",
+				children: /* @__PURE__ */ c("p", {
+					className: "text-status-error-text",
+					children: p("auth.auditLog.error", "Unable to load audit events")
+				})
+			}) : x.length === 0 ? /* @__PURE__ */ c("div", {
+				className: "text-center py-12",
+				role: "status",
+				children: /* @__PURE__ */ c("p", {
+					className: "text-text-secondary",
+					children: p("auth.auditLog.noEvents", "No security events recorded")
+				})
+			}) : /* @__PURE__ */ l(s, { children: [/* @__PURE__ */ c("div", {
+				className: "space-y-4",
+				"aria-live": "polite",
+				"aria-busy": y,
+				children: x.map((e) => /* @__PURE__ */ c("div", {
+					className: "p-6 rounded-xl border border-border-subtle bg-bg-surface shadow-sm",
+					children: /* @__PURE__ */ l("div", {
+						className: "flex items-start gap-4",
+						children: [
+							/* @__PURE__ */ c("div", {
+								className: "flex h-10 w-10 shrink-0 items-center justify-center rounded-full bg-bg-muted text-xs font-semibold text-text-secondary",
+								"aria-hidden": "true",
+								children: O(e.action)
+							}),
+							/* @__PURE__ */ l("div", {
+								className: "flex-1",
+								children: [
+									/* @__PURE__ */ c("h3", {
+										className: "text-lg font-medium text-text-primary mb-1",
+										children: e.action.replace(/_/g, " ")
+									}),
+									/* @__PURE__ */ c("p", {
+										className: "text-sm text-text-secondary mb-2",
+										children: /* @__PURE__ */ c("time", {
+											dateTime: e.createdAt,
+											children: r(e.createdAt)
+										})
+									}),
+									/* @__PURE__ */ l("p", {
+										className: "text-sm text-text-secondary",
+										children: [e.description ?? p("auth.auditLog.defaultDescription", "Authentication event"), e.ipAddress && ` • ${e.ipAddress}`]
+									})
+								]
+							}),
+							e.action.includes("FAILURE") && /* @__PURE__ */ c("span", {
+								role: "status",
+								className: "px-3 py-1 rounded-full bg-status-error-bg-subtle text-status-error-text text-sm font-medium",
+								children: p("auth.auditLog.failed", "Failed")
+							})
+						]
+					})
+				}, e.id))
+			}), /* @__PURE__ */ l("nav", {
+				"aria-label": p("auth.auditLog.paginationAriaLabel", "Audit log pagination"),
+				className: "mt-6 flex items-center justify-between",
+				children: [/* @__PURE__ */ l("p", {
+					className: "text-sm text-text-secondary",
+					children: [
+						p("auth.auditLog.page", "Page"),
+						" ",
+						m
 					]
+				}), /* @__PURE__ */ l("div", {
+					className: "flex gap-2",
+					children: [/* @__PURE__ */ c("button", {
+						type: "button",
+						onClick: () => h((e) => Math.max(1, e - 1)),
+						disabled: m === 1,
+						"aria-label": p("auth.auditLog.previousPageAriaLabel", "Go to previous page"),
+						className: "px-4 py-2 rounded-lg border border-border-default text-text-primary bg-bg-surface disabled:opacity-50 disabled:cursor-not-allowed hover:bg-bg-sunken transition-colors",
+						children: p("auth.auditLog.previous", "Previous")
+					}), /* @__PURE__ */ c("button", {
+						type: "button",
+						onClick: () => h((e) => e + 1),
+						disabled: !S,
+						"aria-label": p("auth.auditLog.nextPageAriaLabel", "Go to next page"),
+						className: "px-4 py-2 rounded-lg border border-border-default text-text-primary bg-bg-surface disabled:opacity-50 disabled:cursor-not-allowed hover:bg-bg-sunken transition-colors",
+						children: p("auth.auditLog.next", "Next")
+					})]
+				})]
+			})] })
+		]
+	}) : /* @__PURE__ */ c("div", {
+		className: "max-w-4xl mx-auto p-6",
+		children: /* @__PURE__ */ l("div", {
+			className: "text-center py-16 border-2 border-dashed border-border-subtle rounded-xl",
+			children: [
+				/* @__PURE__ */ c("div", {
+					className: "w-16 h-16 mx-auto mb-4 rounded-full bg-status-warning-bg-subtle flex items-center justify-center",
+					children: /* @__PURE__ */ c(t, {
+						className: "w-8 h-8 text-status-warning-text",
+						"aria-hidden": "true"
+					})
+				}),
+				/* @__PURE__ */ c("h2", {
+					className: "text-xl font-semibold text-text-primary mb-2",
+					children: p("auth.auditLog.notAvailable", "Page Not Available")
+				}),
+				/* @__PURE__ */ c("p", {
+					className: "text-text-secondary",
+					children: p("auth.auditLog.notEnabled", "The Security Audit Log is not enabled for your account.")
 				})
-			}, e.id))
-		})]
+			]
+		})
 	});
 }
 //#endregion
-export { l as AuditLogPage };
+export { f as AuditLogPage };
 
 //# sourceMappingURL=AuditLogPage.js.map