@burdenoff/microfe-auth 2026.527.1 → 2026.527.2

package/dist/auth/pages/SsoCallbackPage.js

@@ -1,6 +1,6 @@
 import { useAuthStore as e } from "../store/authStore.js";
-import { useSsoOperations as t } from "../hooks/useSsoOperations.js";
-import { AlertIcon as n, SpinnerIcon as r } from "../components/AuthIcons.js";
+import { AlertIcon as t, SpinnerIcon as n } from "../components/AuthIcons.js";
+import { useSsoOperations as r } from "../hooks/useSsoOperations.js";
 import { useEffect as i, useRef as a, useState as o } from "react";
 import { useNavigate as s, useSearchParams as c } from "react-router-dom";
 import { useI18n as l } from "@burdenoff/fe-libs/shared/providers/shell";
@@ -10,7 +10,7 @@ function p() {
 	let { t: p } = l(), m = (e, t) => {
 		let n = p(e);
 		return n === e ? t : n;
-	}, h = s(), [g] = c(), _ = e((e) => e.setAuthTokens), v = e((e) => e.setAuthenticated), { exchangeOidcCode: y, validateOidcState: b, isExternalOidcCallback: x, handleExternalOidcCallback: S } = t(), [C, w] = o(null), [T, E] = o("processing"), [D, O] = o("unknown"), k = a(!1);
+	}, h = s(), [g] = c(), _ = e((e) => e.setAuthTokens), v = e((e) => e.setAuthenticated), { exchangeOidcCode: y, validateOidcState: b, isExternalOidcCallback: x, handleExternalOidcCallback: S } = r(), [C, w] = o(null), [T, E] = o("processing"), [D, O] = o("unknown"), k = a(!1), A = a(null);
 	return i(() => {
 		if (k.current) return;
 		k.current = !0;
@@ -31,7 +31,7 @@ function p() {
 				sessionStorage.setItem("mfa_challenge_id", i), sessionStorage.setItem("mfa_pending_token", e), sessionStorage.setItem("mfa_pending_refresh", t || ""), sessionStorage.setItem("mfa_redirect", n || "/dashboard"), h("/auth/mfa-verify", { replace: !0 });
 				return;
 			}
-			_(e, t || ""), v(!0), E("success"), setTimeout(() => {
+			_(e, t || ""), v(!0), E("success"), A.current = setTimeout(() => {
 				h(n || "/dashboard", { replace: !0 });
 			}, 1500);
 		}, n = async (e, t) => {
@@ -41,7 +41,7 @@ function p() {
 				if (!n.success) throw Error(n.error || "Failed to authenticate with external OIDC provider");
 				E("success");
 				let r = n.redirectPath || "/dashboard";
-				setTimeout(() => {
+				A.current = setTimeout(() => {
 					h(r, { replace: !0 });
 				}, 1500);
 				return;
@@ -55,11 +55,13 @@ function p() {
 			}
 			E("success");
 			let r = sessionStorage.getItem("oidc_redirect") || "/dashboard";
-			sessionStorage.removeItem("oidc_redirect"), sessionStorage.removeItem("oidc_client_id"), setTimeout(() => {
+			sessionStorage.removeItem("oidc_redirect"), sessionStorage.removeItem("oidc_client_id"), A.current = setTimeout(() => {
 				h(r, { replace: !0 });
 			}, 1500);
 		};
-		e();
+		return e(), () => {
+			A.current &&= (clearTimeout(A.current), null);
+		};
 	}, [
 		g,
 		h,
@@ -79,9 +81,9 @@ function p() {
 					/* @__PURE__ */ d("div", {
 						className: "mb-6",
 						children: /* @__PURE__ */ d("div", {
-							className: "auth-brand-badge mx-auto flex h-16 w-16 items-center justify-center rounded-xl",
+							className: "auth-brand-badge mx-auto flex size-16 items-center justify-center rounded-xl",
 							children: /* @__PURE__ */ d("svg", {
-								className: "w-8 h-8 text-white",
+								className: "size-8 text-white",
 								fill: "none",
 								viewBox: "0 0 24 24",
 								stroke: "currentColor",
@@ -105,14 +107,14 @@ function p() {
 						}),
 						/* @__PURE__ */ d("div", {
 							className: "flex justify-center",
-							children: /* @__PURE__ */ d(r, { className: "w-10 h-10 text-text-link animate-spin" })
+							children: /* @__PURE__ */ d(n, { className: "size-10 text-text-link animate-spin" })
 						})
 					] }),
 					T === "success" && /* @__PURE__ */ f(u, { children: [
 						/* @__PURE__ */ d("div", {
-							className: "w-16 h-16 mx-auto mb-4 rounded-full bg-status-success-bg-subtle flex items-center justify-center",
+							className: "size-16 mx-auto mb-4 rounded-full bg-status-success-bg-subtle flex items-center justify-center",
 							children: /* @__PURE__ */ d("svg", {
-								className: "w-8 h-8 text-status-success-text",
+								className: "size-8 text-status-success-text",
 								fill: "none",
 								viewBox: "0 0 24 24",
 								stroke: "currentColor",
@@ -134,13 +136,13 @@ function p() {
 						}),
 						/* @__PURE__ */ d("div", {
 							className: "flex justify-center",
-							children: /* @__PURE__ */ d(r, { className: "w-6 h-6 text-status-success-text animate-spin" })
+							children: /* @__PURE__ */ d(n, { className: "size-6 text-status-success-text animate-spin" })
 						})
 					] }),
 					T === "error" && /* @__PURE__ */ f(u, { children: [
 						/* @__PURE__ */ d("div", {
-							className: "w-16 h-16 mx-auto mb-4 rounded-full bg-status-error-bg-subtle flex items-center justify-center",
-							children: /* @__PURE__ */ d(n, { className: "w-8 h-8 text-status-error-text" })
+							className: "size-16 mx-auto mb-4 rounded-full bg-status-error-bg-subtle flex items-center justify-center",
+							children: /* @__PURE__ */ d(t, { className: "size-8 text-status-error-text" })
 						}),
 						/* @__PURE__ */ d("h1", {
 							className: "text-2xl font-semibold text-text-primary mb-4",
@@ -153,10 +155,12 @@ function p() {
 						/* @__PURE__ */ f("div", {
 							className: "space-y-3",
 							children: [/* @__PURE__ */ d("button", {
+								type: "button",
 								onClick: () => h("/auth/sso/login", { replace: !0 }),
 								className: "auth-primary-button w-full px-6 py-3 font-medium",
 								children: m("auth.ssoCallback.tryAgain", "Try Again")
 							}), /* @__PURE__ */ d("button", {
+								type: "button",
 								onClick: () => h("/auth/login", { replace: !0 }),
 								className: "w-full px-6 py-3 rounded-xl border border-border-default text-text-primary font-medium hover:bg-bg-sunken transition-colors",
 								children: m("auth.ssoCallback.backToLogin", "Back to Login")

package/dist/auth/pages/SsoCallbackPage.js.map

@@ -1 +1 @@
-{"version":3,"file":"SsoCallbackPage.js","names":[],"sources":["../../../src/auth/pages/SsoCallbackPage.tsx"],"sourcesContent":["import { useEffect, useState, useRef } from \"react\";\nimport { useI18n } from \"@burdenoff/fe-libs/shared/providers/shell\";\nimport { useNavigate, useSearchParams } from \"react-router-dom\";\nimport { useAuthStore } from \"../store/authStore\";\nimport { useSsoOperations } from \"../hooks/useSsoOperations\";\nimport { SpinnerIcon, AlertIcon } from \"../components/AuthIcons\";\n\n/**\n * SSO Callback Page\n * Handles redirects from:\n * - SAML ACS server (with token/refreshToken in query params)\n * - OIDC Authorization Server (with code/state in query params)\n */\nexport function SsoCallbackPage() {\n  const { t } = useI18n();\n  const tr = (key: string, fallback: string): string => {\n    const translated = t(key);\n    return translated === key ? fallback : translated;\n  };\n\n  const navigate = useNavigate();\n  const [searchParams] = useSearchParams();\n  const setAuthTokens = useAuthStore((state) => state.setAuthTokens);\n  const setAuthenticated = useAuthStore((state) => state.setAuthenticated);\n  const {\n    exchangeOidcCode,\n    validateOidcState,\n    isExternalOidcCallback,\n    handleExternalOidcCallback,\n  } = useSsoOperations();\n\n  const [error, setError] = useState<string | null>(null);\n  const [status, setStatus] = useState<\"processing\" | \"success\" | \"error\">(\n    \"processing\",\n  );\n  const [callbackType, setCallbackType] = useState<\"saml\" | \"oidc\" | \"unknown\">(\n    \"unknown\",\n  );\n  const processedRef = useRef(false);\n\n  useEffect(() => {\n    // Prevent double execution in React StrictMode\n    if (processedRef.current) {\n      return;\n    }\n    processedRef.current = true;\n\n    const processCallback = async () => {\n      try {\n        // Check for error from either SSO provider\n        const errorParam = searchParams.get(\"error\");\n        const errorMessage =\n          searchParams.get(\"message\") || searchParams.get(\"error_description\");\n\n        if (errorParam) {\n          throw new Error(\n            errorMessage || `SSO authentication failed: ${errorParam}`,\n          );\n        }\n\n        // Detect callback type based on query parameters\n        const token = searchParams.get(\"token\");\n        const code = searchParams.get(\"code\");\n        const state = searchParams.get(\"state\");\n\n        if (token) {\n          // SAML callback - token already exchanged by ACS server\n          setCallbackType(\"saml\");\n          await handleSamlCallback(token);\n        } else if (code) {\n          // OIDC callback - need to exchange code for tokens\n          setCallbackType(\"oidc\");\n          await handleOidcCallback(code, state);\n        } else {\n          throw new Error(\n            \"Invalid SSO callback. No token or authorization code received.\",\n          );\n        }\n      } catch (err) {\n        console.error(\"[SSO Callback] Error:\", err);\n        setError(\n          err instanceof Error ? err.message : \"Failed to process SSO response\",\n        );\n        setStatus(\"error\");\n      }\n    };\n\n    /**\n     * Handle SAML callback from ACS server\n     * Token is already exchanged, just store and redirect\n     * Also handles MFA if required\n     */\n    const handleSamlCallback = async (token: string) => {\n      const refreshToken = searchParams.get(\"refreshToken\");\n      const redirect = searchParams.get(\"redirect\");\n      const requiresMFA = searchParams.get(\"requiresMFA\") === \"true\";\n      const mfaChallengeId = searchParams.get(\"mfaChallengeId\");\n\n      // Check if MFA is required\n      if (requiresMFA && mfaChallengeId) {\n        // Store partial auth state and MFA info\n        sessionStorage.setItem(\"mfa_challenge_id\", mfaChallengeId);\n        sessionStorage.setItem(\"mfa_pending_token\", token);\n        sessionStorage.setItem(\"mfa_pending_refresh\", refreshToken || \"\");\n        sessionStorage.setItem(\"mfa_redirect\", redirect || \"/dashboard\");\n\n        // Redirect to MFA verification\n        navigate(\"/auth/mfa-verify\", { replace: true });\n        return;\n      }\n\n      // Store tokens\n      setAuthTokens(token, refreshToken || \"\");\n      setAuthenticated(true);\n\n      setStatus(\"success\");\n\n      // Redirect to the specified URL or default to dashboard\n      setTimeout(() => {\n        const redirectUrl = redirect || \"/dashboard\";\n        navigate(redirectUrl, { replace: true });\n      }, 1500);\n    };\n\n    /**\n     * Handle OIDC callback - exchange code for tokens\n     */\n    const handleOidcCallback = async (code: string, state: string | null) => {\n      const isExternal = isExternalOidcCallback();\n\n      // Check if this is an external OIDC flow (Azure AD, Google, etc.)\n      if (isExternal) {\n        if (!state) {\n          throw new Error(\"State parameter is required for external OIDC flow\");\n        }\n\n        // Use the external OIDC handler\n        const result = await handleExternalOidcCallback(code, state);\n\n        if (!result.success) {\n          throw new Error(\n            result.error ||\n              \"Failed to authenticate with external OIDC provider\",\n          );\n        }\n\n        setStatus(\"success\");\n\n        // Redirect after brief success message using the redirect path from result\n        const redirectUrl = result.redirectPath || \"/dashboard\";\n        setTimeout(() => {\n          navigate(redirectUrl, { replace: true });\n        }, 1500);\n        return;\n      }\n\n      // Internal OIDC flow (our auth service as provider)\n      // Validate state to prevent CSRF\n      if (state && !validateOidcState(state)) {\n        throw new Error(\n          \"Invalid state parameter. This may be a CSRF attack. Please try logging in again.\",\n        );\n      }\n\n      // Get client configuration from session storage\n      const clientId =\n        sessionStorage.getItem(\"oidc_client_id\") || \"default-client\";\n      const redirectUri = window.location.origin + \"/auth/sso/callback\";\n\n      // Exchange code for tokens\n      const result = await exchangeOidcCode(code, clientId, redirectUri);\n\n      if (!result.success) {\n        throw new Error(\n          result.error || \"Failed to exchange authorization code\",\n        );\n      }\n\n      // Check if MFA is required after OIDC authentication\n      if (result.requiresMFA && result.mfaChallengeId) {\n        // Store MFA challenge info for the verification page\n        sessionStorage.setItem(\"mfa_challenge_id\", result.mfaChallengeId);\n        sessionStorage.setItem(\n          \"mfa_redirect\",\n          sessionStorage.getItem(\"oidc_redirect\") || \"/dashboard\",\n        );\n\n        // Clean up OIDC session data\n        sessionStorage.removeItem(\"oidc_redirect\");\n        sessionStorage.removeItem(\"oidc_client_id\");\n\n        // Redirect to MFA verification\n        navigate(\"/auth/mfa-verify\", { replace: true });\n        return;\n      }\n\n      setStatus(\"success\");\n\n      // Get redirect URL from state or session storage\n      const redirect = sessionStorage.getItem(\"oidc_redirect\") || \"/dashboard\";\n      sessionStorage.removeItem(\"oidc_redirect\");\n      sessionStorage.removeItem(\"oidc_client_id\");\n\n      // Redirect after brief success message\n      setTimeout(() => {\n        navigate(redirect, { replace: true });\n      }, 1500);\n    };\n\n    processCallback();\n  }, [\n    searchParams,\n    navigate,\n    setAuthTokens,\n    setAuthenticated,\n    exchangeOidcCode,\n    validateOidcState,\n    isExternalOidcCallback,\n    handleExternalOidcCallback,\n  ]);\n\n  return (\n    <div className=\"min-h-screen flex items-center justify-center bg-bg-canvas p-4\">\n      <div className=\"w-full max-w-md\">\n        <div className=\"bg-bg-surface rounded-2xl shadow-xl p-8 text-center\">\n          {/* Logo */}\n          <div className=\"mb-6\">\n            <div className=\"auth-brand-badge mx-auto flex h-16 w-16 items-center justify-center rounded-xl\">\n              <svg\n                className=\"w-8 h-8 text-white\"\n                fill=\"none\"\n                viewBox=\"0 0 24 24\"\n                stroke=\"currentColor\"\n              >\n                <path\n                  strokeLinecap=\"round\"\n                  strokeLinejoin=\"round\"\n                  strokeWidth={2}\n                  d=\"M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z\"\n                />\n              </svg>\n            </div>\n          </div>\n\n          {/* Processing State */}\n          {status === \"processing\" && (\n            <>\n              <h1 className=\"text-2xl font-semibold text-text-primary mb-4\">\n                {tr(\"auth.ssoCallback.completing\", \"Completing Sign In\")}\n              </h1>\n              <p className=\"text-text-secondary mb-6\">\n                {callbackType === \"oidc\"\n                  ? tr(\n                      \"auth.ssoCallback.exchangingCode\",\n                      \"Exchanging authorization code for access tokens...\",\n                    )\n                  : callbackType === \"saml\"\n                    ? tr(\n                        \"auth.ssoCallback.validatingSaml\",\n                        \"Validating your SAML credentials...\",\n                      )\n                    : tr(\n                        \"auth.ssoCallback.validatingCreds\",\n                        \"Validating your credentials from your identity provider...\",\n                      )}\n              </p>\n              <div className=\"flex justify-center\">\n                <SpinnerIcon className=\"w-10 h-10 text-text-link animate-spin\" />\n              </div>\n            </>\n          )}\n\n          {/* Success State */}\n          {status === \"success\" && (\n            <>\n              <div className=\"w-16 h-16 mx-auto mb-4 rounded-full bg-status-success-bg-subtle flex items-center justify-center\">\n                <svg\n                  className=\"w-8 h-8 text-status-success-text\"\n                  fill=\"none\"\n                  viewBox=\"0 0 24 24\"\n                  stroke=\"currentColor\"\n                >\n                  <path\n                    strokeLinecap=\"round\"\n                    strokeLinejoin=\"round\"\n                    strokeWidth={2}\n                    d=\"M5 13l4 4L19 7\"\n                  />\n                </svg>\n              </div>\n              <h1 className=\"text-2xl font-semibold text-text-primary mb-4\">\n                {tr(\"auth.ssoCallback.success\", \"Sign In Successful\")}\n              </h1>\n              <p className=\"text-text-secondary mb-6\">\n                {callbackType === \"oidc\"\n                  ? tr(\n                      \"auth.ssoCallback.oidcComplete\",\n                      \"OIDC authentication complete. Redirecting...\",\n                    )\n                  : callbackType === \"saml\"\n                    ? tr(\n                        \"auth.ssoCallback.samlComplete\",\n                        \"SAML authentication complete. Redirecting...\",\n                      )\n                    : tr(\n                        \"auth.ssoCallback.authSuccess\",\n                        \"You have been authenticated successfully. Redirecting...\",\n                      )}\n              </p>\n              <div className=\"flex justify-center\">\n                <SpinnerIcon className=\"w-6 h-6 text-status-success-text animate-spin\" />\n              </div>\n            </>\n          )}\n\n          {/* Error State */}\n          {status === \"error\" && (\n            <>\n              <div className=\"w-16 h-16 mx-auto mb-4 rounded-full bg-status-error-bg-subtle flex items-center justify-center\">\n                <AlertIcon className=\"w-8 h-8 text-status-error-text\" />\n              </div>\n              <h1 className=\"text-2xl font-semibold text-text-primary mb-4\">\n                {tr(\"auth.ssoCallback.failed\", \"Sign In Failed\")}\n              </h1>\n              <p className=\"text-status-error-text mb-6 text-sm\">{error}</p>\n              <div className=\"space-y-3\">\n                <button\n                  onClick={() => navigate(\"/auth/sso/login\", { replace: true })}\n                  className=\"auth-primary-button w-full px-6 py-3 font-medium\"\n                >\n                  {tr(\"auth.ssoCallback.tryAgain\", \"Try Again\")}\n                </button>\n                <button\n                  onClick={() => navigate(\"/auth/login\", { replace: true })}\n                  className=\"w-full px-6 py-3 rounded-xl border border-border-default text-text-primary font-medium hover:bg-bg-sunken transition-colors\"\n                >\n                  {tr(\"auth.ssoCallback.backToLogin\", \"Back to Login\")}\n                </button>\n              </div>\n            </>\n          )}\n\n          {/* SSO Type Badge */}\n          {callbackType !== \"unknown\" && (\n            <div className=\"mt-6\">\n              <span\n                className={`inline-flex items-center px-3 py-1 rounded-full text-xs font-medium ${\n                  callbackType === \"oidc\"\n                    ? \"bg-accent-purple-subtle text-accent-purple\"\n                    : \"bg-status-info-bg-subtle text-text-linkHover\"\n                }`}\n              >\n                {callbackType === \"oidc\" ? \"OpenID Connect\" : \"SAML 2.0\"}\n              </span>\n            </div>\n          )}\n\n          {/* Help Text */}\n          <div className=\"mt-8 pt-6 border-t border-border-subtle\">\n            <p className=\"text-xs text-text-secondary\">\n              {tr(\n                \"auth.ssoCallback.helpText\",\n                \"Having trouble? Contact your organization's IT administrator for assistance with SSO login.\",\n              )}\n            </p>\n          </div>\n        </div>\n      </div>\n    </div>\n  );\n}\n"],"mappings":";;;;;;;;AAaA,SAAgB,IAAkB;CAChC,IAAM,EAAE,SAAM,GAAS,EACjB,KAAM,GAAa,MAA6B;EACpD,IAAM,IAAa,EAAE,EAAI;AACzB,SAAO,MAAe,IAAM,IAAW;IAGnC,IAAW,GAAa,EACxB,CAAC,KAAgB,GAAiB,EAClC,IAAgB,GAAc,MAAU,EAAM,cAAc,EAC5D,IAAmB,GAAc,MAAU,EAAM,iBAAiB,EAClE,EACJ,qBACA,sBACA,2BACA,kCACE,GAAkB,EAEhB,CAAC,GAAO,KAAY,EAAwB,KAAK,EACjD,CAAC,GAAQ,KAAa,EAC1B,aACD,EACK,CAAC,GAAc,KAAmB,EACtC,UACD,EACK,IAAe,EAAO,GAAM;AAuLlC,QArLA,QAAgB;AAEd,MAAI,EAAa,QACf;AAEF,IAAa,UAAU;EAEvB,IAAM,IAAkB,YAAY;AAClC,OAAI;IAEF,IAAM,IAAa,EAAa,IAAI,QAAQ,EACtC,IACJ,EAAa,IAAI,UAAU,IAAI,EAAa,IAAI,oBAAoB;AAEtE,QAAI,EACF,OAAU,MACR,KAAgB,8BAA8B,IAC/C;IAIH,IAAM,IAAQ,EAAa,IAAI,QAAQ,EACjC,IAAO,EAAa,IAAI,OAAO,EAC/B,IAAQ,EAAa,IAAI,QAAQ;AAEvC,QAAI,EAGF,CADA,EAAgB,OAAO,EACvB,MAAM,EAAmB,EAAM;aACtB,EAGT,CADA,EAAgB,OAAO,EACvB,MAAM,EAAmB,GAAM,EAAM;QAErC,OAAU,MACR,iEACD;YAEI,GAAK;AAKZ,IAJA,QAAQ,MAAM,yBAAyB,EAAI,EAC3C,EACE,aAAe,QAAQ,EAAI,UAAU,iCACtC,EACD,EAAU,QAAQ;;KAShB,IAAqB,OAAO,MAAkB;GAClD,IAAM,IAAe,EAAa,IAAI,eAAe,EAC/C,IAAW,EAAa,IAAI,WAAW,EACvC,IAAc,EAAa,IAAI,cAAc,KAAK,QAClD,IAAiB,EAAa,IAAI,iBAAiB;AAGzD,OAAI,KAAe,GAAgB;AAQjC,IANA,eAAe,QAAQ,oBAAoB,EAAe,EAC1D,eAAe,QAAQ,qBAAqB,EAAM,EAClD,eAAe,QAAQ,uBAAuB,KAAgB,GAAG,EACjE,eAAe,QAAQ,gBAAgB,KAAY,aAAa,EAGhE,EAAS,oBAAoB,EAAE,SAAS,IAAM,CAAC;AAC/C;;AAUF,GANA,EAAc,GAAO,KAAgB,GAAG,EACxC,EAAiB,GAAK,EAEtB,EAAU,UAAU,EAGpB,iBAAiB;AAEf,MADoB,KAAY,cACV,EAAE,SAAS,IAAM,CAAC;MACvC,KAAK;KAMJ,IAAqB,OAAO,GAAc,MAAyB;AAIvE,OAHmB,GAAwB,EAG3B;AACd,QAAI,CAAC,EACH,OAAU,MAAM,qDAAqD;IAIvE,IAAM,IAAS,MAAM,EAA2B,GAAM,EAAM;AAE5D,QAAI,CAAC,EAAO,QACV,OAAU,MACR,EAAO,SACL,qDACH;AAGH,MAAU,UAAU;IAGpB,IAAM,IAAc,EAAO,gBAAgB;AAC3C,qBAAiB;AACf,OAAS,GAAa,EAAE,SAAS,IAAM,CAAC;OACvC,KAAK;AACR;;AAKF,OAAI,KAAS,CAAC,EAAkB,EAAM,CACpC,OAAU,MACR,mFACD;GASH,IAAM,IAAS,MAAM,EAAiB,GAJpC,eAAe,QAAQ,iBAAiB,IAAI,kBAC1B,OAAO,SAAS,SAAS,qBAGqB;AAElE,OAAI,CAAC,EAAO,QACV,OAAU,MACR,EAAO,SAAS,wCACjB;AAIH,OAAI,EAAO,eAAe,EAAO,gBAAgB;AAa/C,IAXA,eAAe,QAAQ,oBAAoB,EAAO,eAAe,EACjE,eAAe,QACb,gBACA,eAAe,QAAQ,gBAAgB,IAAI,aAC5C,EAGD,eAAe,WAAW,gBAAgB,EAC1C,eAAe,WAAW,iBAAiB,EAG3C,EAAS,oBAAoB,EAAE,SAAS,IAAM,CAAC;AAC/C;;AAGF,KAAU,UAAU;GAGpB,IAAM,IAAW,eAAe,QAAQ,gBAAgB,IAAI;AAK5D,GAJA,eAAe,WAAW,gBAAgB,EAC1C,eAAe,WAAW,iBAAiB,EAG3C,iBAAiB;AACf,MAAS,GAAU,EAAE,SAAS,IAAM,CAAC;MACpC,KAAK;;AAGV,KAAiB;IAChB;EACD;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CAAC,EAGA,kBAAC,OAAD;EAAK,WAAU;YACb,kBAAC,OAAD;GAAK,WAAU;aACb,kBAAC,OAAD;IAAK,WAAU;cAAf;KAEE,kBAAC,OAAD;MAAK,WAAU;gBACb,kBAAC,OAAD;OAAK,WAAU;iBACb,kBAAC,OAAD;QACE,WAAU;QACV,MAAK;QACL,SAAQ;QACR,QAAO;kBAEP,kBAAC,QAAD;SACE,eAAc;SACd,gBAAe;SACf,aAAa;SACb,GAAE;SACF,CAAA;QACE,CAAA;OACF,CAAA;MACF,CAAA;KAGL,MAAW,gBACV,kBAAA,GAAA,EAAA,UAAA;MACE,kBAAC,MAAD;OAAI,WAAU;iBACX,EAAG,+BAA+B,qBAAqB;OACrD,CAAA;MACL,kBAAC,KAAD;OAAG,WAAU;iBACV,MAAiB,SACd,EACE,mCACA,qDACD,GACD,MAAiB,SACf,EACE,mCACA,sCACD,GACD,EACE,oCACA,6DACD;OACL,CAAA;MACJ,kBAAC,OAAD;OAAK,WAAU;iBACb,kBAAC,GAAD,EAAa,WAAU,yCAA0C,CAAA;OAC7D,CAAA;MACL,EAAA,CAAA;KAIJ,MAAW,aACV,kBAAA,GAAA,EAAA,UAAA;MACE,kBAAC,OAAD;OAAK,WAAU;iBACb,kBAAC,OAAD;QACE,WAAU;QACV,MAAK;QACL,SAAQ;QACR,QAAO;kBAEP,kBAAC,QAAD;SACE,eAAc;SACd,gBAAe;SACf,aAAa;SACb,GAAE;SACF,CAAA;QACE,CAAA;OACF,CAAA;MACN,kBAAC,MAAD;OAAI,WAAU;iBACX,EAAG,4BAA4B,qBAAqB;OAClD,CAAA;MACL,kBAAC,KAAD;OAAG,WAAU;iBACV,MAAiB,SACd,EACE,iCACA,+CACD,GACD,MAAiB,SACf,EACE,iCACA,+CACD,GACD,EACE,gCACA,2DACD;OACL,CAAA;MACJ,kBAAC,OAAD;OAAK,WAAU;iBACb,kBAAC,GAAD,EAAa,WAAU,iDAAkD,CAAA;OACrE,CAAA;MACL,EAAA,CAAA;KAIJ,MAAW,WACV,kBAAA,GAAA,EAAA,UAAA;MACE,kBAAC,OAAD;OAAK,WAAU;iBACb,kBAAC,GAAD,EAAW,WAAU,kCAAmC,CAAA;OACpD,CAAA;MACN,kBAAC,MAAD;OAAI,WAAU;iBACX,EAAG,2BAA2B,iBAAiB;OAC7C,CAAA;MACL,kBAAC,KAAD;OAAG,WAAU;iBAAuC;OAAU,CAAA;MAC9D,kBAAC,OAAD;OAAK,WAAU;iBAAf,CACE,kBAAC,UAAD;QACE,eAAe,EAAS,mBAAmB,EAAE,SAAS,IAAM,CAAC;QAC7D,WAAU;kBAET,EAAG,6BAA6B,YAAY;QACtC,CAAA,EACT,kBAAC,UAAD;QACE,eAAe,EAAS,eAAe,EAAE,SAAS,IAAM,CAAC;QACzD,WAAU;kBAET,EAAG,gCAAgC,gBAAgB;QAC7C,CAAA,CACL;;MACL,EAAA,CAAA;KAIJ,MAAiB,aAChB,kBAAC,OAAD;MAAK,WAAU;gBACb,kBAAC,QAAD;OACE,WAAW,uEACT,MAAiB,SACb,+CACA;iBAGL,MAAiB,SAAS,mBAAmB;OACzC,CAAA;MACH,CAAA;KAIR,kBAAC,OAAD;MAAK,WAAU;gBACb,kBAAC,KAAD;OAAG,WAAU;iBACV,EACC,6BACA,8FACD;OACC,CAAA;MACA,CAAA;KACF;;GACF,CAAA;EACF,CAAA"}
+{"version":3,"file":"SsoCallbackPage.js","names":[],"sources":["../../../src/auth/pages/SsoCallbackPage.tsx"],"sourcesContent":["import { useEffect, useState, useRef } from \"react\";\nimport { useI18n } from \"@burdenoff/fe-libs/shared/providers/shell\";\nimport { useNavigate, useSearchParams } from \"react-router-dom\";\nimport { useAuthStore } from \"../store/authStore\";\nimport { useSsoOperations } from \"../hooks/useSsoOperations\";\nimport { SpinnerIcon, AlertIcon } from \"../components/AuthIcons\";\n\n/**\n * SSO Callback Page\n * Handles redirects from:\n * - SAML ACS server (with token/refreshToken in query params)\n * - OIDC Authorization Server (with code/state in query params)\n */\nexport function SsoCallbackPage() {\n  const { t } = useI18n();\n  const tr = (key: string, fallback: string): string => {\n    const translated = t(key);\n    return translated === key ? fallback : translated;\n  };\n\n  const navigate = useNavigate();\n  const [searchParams] = useSearchParams();\n  const setAuthTokens = useAuthStore((state) => state.setAuthTokens);\n  const setAuthenticated = useAuthStore((state) => state.setAuthenticated);\n  const {\n    exchangeOidcCode,\n    validateOidcState,\n    isExternalOidcCallback,\n    handleExternalOidcCallback,\n  } = useSsoOperations();\n\n  const [error, setError] = useState<string | null>(null);\n  const [status, setStatus] = useState<\"processing\" | \"success\" | \"error\">(\n    \"processing\",\n  );\n  const [callbackType, setCallbackType] = useState<\"saml\" | \"oidc\" | \"unknown\">(\n    \"unknown\",\n  );\n  const processedRef = useRef(false);\n  const redirectTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);\n\n  useEffect(() => {\n    // Prevent double execution in React StrictMode\n    if (processedRef.current) {\n      return;\n    }\n    processedRef.current = true;\n\n    const processCallback = async () => {\n      try {\n        // Check for error from either SSO provider\n        const errorParam = searchParams.get(\"error\");\n        const errorMessage =\n          searchParams.get(\"message\") || searchParams.get(\"error_description\");\n\n        if (errorParam) {\n          throw new Error(\n            errorMessage || `SSO authentication failed: ${errorParam}`,\n          );\n        }\n\n        // Detect callback type based on query parameters\n        const token = searchParams.get(\"token\");\n        const code = searchParams.get(\"code\");\n        const state = searchParams.get(\"state\");\n\n        if (token) {\n          // SAML callback - token already exchanged by ACS server\n          setCallbackType(\"saml\");\n          await handleSamlCallback(token);\n        } else if (code) {\n          // OIDC callback - need to exchange code for tokens\n          setCallbackType(\"oidc\");\n          await handleOidcCallback(code, state);\n        } else {\n          throw new Error(\n            \"Invalid SSO callback. No token or authorization code received.\",\n          );\n        }\n      } catch (err) {\n        console.error(\"[SSO Callback] Error:\", err);\n        setError(\n          err instanceof Error ? err.message : \"Failed to process SSO response\",\n        );\n        setStatus(\"error\");\n      }\n    };\n\n    /**\n     * Handle SAML callback from ACS server\n     * Token is already exchanged, just store and redirect\n     * Also handles MFA if required\n     */\n    const handleSamlCallback = async (token: string) => {\n      const refreshToken = searchParams.get(\"refreshToken\");\n      const redirect = searchParams.get(\"redirect\");\n      const requiresMFA = searchParams.get(\"requiresMFA\") === \"true\";\n      const mfaChallengeId = searchParams.get(\"mfaChallengeId\");\n\n      // Check if MFA is required\n      if (requiresMFA && mfaChallengeId) {\n        // Store partial auth state and MFA info\n        sessionStorage.setItem(\"mfa_challenge_id\", mfaChallengeId);\n        sessionStorage.setItem(\"mfa_pending_token\", token);\n        sessionStorage.setItem(\"mfa_pending_refresh\", refreshToken || \"\");\n        sessionStorage.setItem(\"mfa_redirect\", redirect || \"/dashboard\");\n\n        // Redirect to MFA verification\n        navigate(\"/auth/mfa-verify\", { replace: true });\n        return;\n      }\n\n      // Store tokens\n      setAuthTokens(token, refreshToken || \"\");\n      setAuthenticated(true);\n\n      setStatus(\"success\");\n\n      // Redirect to the specified URL or default to dashboard\n      redirectTimerRef.current = setTimeout(() => {\n        const redirectUrl = redirect || \"/dashboard\";\n        navigate(redirectUrl, { replace: true });\n      }, 1500);\n    };\n\n    /**\n     * Handle OIDC callback - exchange code for tokens\n     */\n    const handleOidcCallback = async (code: string, state: string | null) => {\n      const isExternal = isExternalOidcCallback();\n\n      // Check if this is an external OIDC flow (Azure AD, Google, etc.)\n      if (isExternal) {\n        if (!state) {\n          throw new Error(\"State parameter is required for external OIDC flow\");\n        }\n\n        // Use the external OIDC handler\n        const result = await handleExternalOidcCallback(code, state);\n\n        if (!result.success) {\n          throw new Error(\n            result.error ||\n              \"Failed to authenticate with external OIDC provider\",\n          );\n        }\n\n        setStatus(\"success\");\n\n        // Redirect after brief success message using the redirect path from result\n        const redirectUrl = result.redirectPath || \"/dashboard\";\n        redirectTimerRef.current = setTimeout(() => {\n          navigate(redirectUrl, { replace: true });\n        }, 1500);\n        return;\n      }\n\n      // Internal OIDC flow (our auth service as provider)\n      // Validate state to prevent CSRF\n      if (state && !validateOidcState(state)) {\n        throw new Error(\n          \"Invalid state parameter. This may be a CSRF attack. Please try logging in again.\",\n        );\n      }\n\n      // Get client configuration from session storage\n      const clientId =\n        sessionStorage.getItem(\"oidc_client_id\") || \"default-client\";\n      const redirectUri = window.location.origin + \"/auth/sso/callback\";\n\n      // Exchange code for tokens\n      const result = await exchangeOidcCode(code, clientId, redirectUri);\n\n      if (!result.success) {\n        throw new Error(\n          result.error || \"Failed to exchange authorization code\",\n        );\n      }\n\n      // Check if MFA is required after OIDC authentication\n      if (result.requiresMFA && result.mfaChallengeId) {\n        // Store MFA challenge info for the verification page\n        sessionStorage.setItem(\"mfa_challenge_id\", result.mfaChallengeId);\n        sessionStorage.setItem(\n          \"mfa_redirect\",\n          sessionStorage.getItem(\"oidc_redirect\") || \"/dashboard\",\n        );\n\n        // Clean up OIDC session data\n        sessionStorage.removeItem(\"oidc_redirect\");\n        sessionStorage.removeItem(\"oidc_client_id\");\n\n        // Redirect to MFA verification\n        navigate(\"/auth/mfa-verify\", { replace: true });\n        return;\n      }\n\n      setStatus(\"success\");\n\n      // Get redirect URL from state or session storage\n      const redirect = sessionStorage.getItem(\"oidc_redirect\") || \"/dashboard\";\n      sessionStorage.removeItem(\"oidc_redirect\");\n      sessionStorage.removeItem(\"oidc_client_id\");\n\n      // Redirect after brief success message\n      redirectTimerRef.current = setTimeout(() => {\n        navigate(redirect, { replace: true });\n      }, 1500);\n    };\n\n    processCallback();\n    return () => {\n      if (redirectTimerRef.current) {\n        clearTimeout(redirectTimerRef.current);\n        redirectTimerRef.current = null;\n      }\n    };\n  }, [\n    searchParams,\n    navigate,\n    setAuthTokens,\n    setAuthenticated,\n    exchangeOidcCode,\n    validateOidcState,\n    isExternalOidcCallback,\n    handleExternalOidcCallback,\n  ]);\n\n  return (\n    <div className=\"min-h-screen flex items-center justify-center bg-bg-canvas p-4\">\n      <div className=\"w-full max-w-md\">\n        <div className=\"bg-bg-surface rounded-2xl shadow-xl p-8 text-center\">\n          {/* Logo */}\n          <div className=\"mb-6\">\n            <div className=\"auth-brand-badge mx-auto flex size-16 items-center justify-center rounded-xl\">\n              <svg\n                className=\"size-8 text-white\"\n                fill=\"none\"\n                viewBox=\"0 0 24 24\"\n                stroke=\"currentColor\"\n              >\n                <path\n                  strokeLinecap=\"round\"\n                  strokeLinejoin=\"round\"\n                  strokeWidth={2}\n                  d=\"M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z\"\n                />\n              </svg>\n            </div>\n          </div>\n\n          {/* Processing State */}\n          {status === \"processing\" && (\n            <>\n              <h1 className=\"text-2xl font-semibold text-text-primary mb-4\">\n                {tr(\"auth.ssoCallback.completing\", \"Completing Sign In\")}\n              </h1>\n              <p className=\"text-text-secondary mb-6\">\n                {callbackType === \"oidc\"\n                  ? tr(\n                      \"auth.ssoCallback.exchangingCode\",\n                      \"Exchanging authorization code for access tokens...\",\n                    )\n                  : callbackType === \"saml\"\n                    ? tr(\n                        \"auth.ssoCallback.validatingSaml\",\n                        \"Validating your SAML credentials...\",\n                      )\n                    : tr(\n                        \"auth.ssoCallback.validatingCreds\",\n                        \"Validating your credentials from your identity provider...\",\n                      )}\n              </p>\n              <div className=\"flex justify-center\">\n                <SpinnerIcon className=\"size-10 text-text-link animate-spin\" />\n              </div>\n            </>\n          )}\n\n          {/* Success State */}\n          {status === \"success\" && (\n            <>\n              <div className=\"size-16 mx-auto mb-4 rounded-full bg-status-success-bg-subtle flex items-center justify-center\">\n                <svg\n                  className=\"size-8 text-status-success-text\"\n                  fill=\"none\"\n                  viewBox=\"0 0 24 24\"\n                  stroke=\"currentColor\"\n                >\n                  <path\n                    strokeLinecap=\"round\"\n                    strokeLinejoin=\"round\"\n                    strokeWidth={2}\n                    d=\"M5 13l4 4L19 7\"\n                  />\n                </svg>\n              </div>\n              <h1 className=\"text-2xl font-semibold text-text-primary mb-4\">\n                {tr(\"auth.ssoCallback.success\", \"Sign In Successful\")}\n              </h1>\n              <p className=\"text-text-secondary mb-6\">\n                {callbackType === \"oidc\"\n                  ? tr(\n                      \"auth.ssoCallback.oidcComplete\",\n                      \"OIDC authentication complete. Redirecting...\",\n                    )\n                  : callbackType === \"saml\"\n                    ? tr(\n                        \"auth.ssoCallback.samlComplete\",\n                        \"SAML authentication complete. Redirecting...\",\n                      )\n                    : tr(\n                        \"auth.ssoCallback.authSuccess\",\n                        \"You have been authenticated successfully. Redirecting...\",\n                      )}\n              </p>\n              <div className=\"flex justify-center\">\n                <SpinnerIcon className=\"size-6 text-status-success-text animate-spin\" />\n              </div>\n            </>\n          )}\n\n          {/* Error State */}\n          {status === \"error\" && (\n            <>\n              <div className=\"size-16 mx-auto mb-4 rounded-full bg-status-error-bg-subtle flex items-center justify-center\">\n                <AlertIcon className=\"size-8 text-status-error-text\" />\n              </div>\n              <h1 className=\"text-2xl font-semibold text-text-primary mb-4\">\n                {tr(\"auth.ssoCallback.failed\", \"Sign In Failed\")}\n              </h1>\n              <p className=\"text-status-error-text mb-6 text-sm\">{error}</p>\n              <div className=\"space-y-3\">\n                <button type=\"button\"\n                  onClick={() => navigate(\"/auth/sso/login\", { replace: true })}\n                  className=\"auth-primary-button w-full px-6 py-3 font-medium\"\n                >\n                  {tr(\"auth.ssoCallback.tryAgain\", \"Try Again\")}\n                </button>\n                <button type=\"button\"\n                  onClick={() => navigate(\"/auth/login\", { replace: true })}\n                  className=\"w-full px-6 py-3 rounded-xl border border-border-default text-text-primary font-medium hover:bg-bg-sunken transition-colors\"\n                >\n                  {tr(\"auth.ssoCallback.backToLogin\", \"Back to Login\")}\n                </button>\n              </div>\n            </>\n          )}\n\n          {/* SSO Type Badge */}\n          {callbackType !== \"unknown\" && (\n            <div className=\"mt-6\">\n              <span\n                className={`inline-flex items-center px-3 py-1 rounded-full text-xs font-medium ${\n                  callbackType === \"oidc\"\n                    ? \"bg-accent-purple-subtle text-accent-purple\"\n                    : \"bg-status-info-bg-subtle text-text-linkHover\"\n                }`}\n              >\n                {callbackType === \"oidc\" ? \"OpenID Connect\" : \"SAML 2.0\"}\n              </span>\n            </div>\n          )}\n\n          {/* Help Text */}\n          <div className=\"mt-8 pt-6 border-t border-border-subtle\">\n            <p className=\"text-xs text-text-secondary\">\n              {tr(\n                \"auth.ssoCallback.helpText\",\n                \"Having trouble? Contact your organization's IT administrator for assistance with SSO login.\",\n              )}\n            </p>\n          </div>\n        </div>\n      </div>\n    </div>\n  );\n}\n"],"mappings":";;;;;;;;AAaA,SAAgB,IAAkB;CAChC,IAAM,EAAE,SAAM,GAAS,EACjB,KAAM,GAAa,MAA6B;EACpD,IAAM,IAAa,EAAE,EAAI;AACzB,SAAO,MAAe,IAAM,IAAW;IAGnC,IAAW,GAAa,EACxB,CAAC,KAAgB,GAAiB,EAClC,IAAgB,GAAc,MAAU,EAAM,cAAc,EAC5D,IAAmB,GAAc,MAAU,EAAM,iBAAiB,EAClE,EACJ,qBACA,sBACA,2BACA,kCACE,GAAkB,EAEhB,CAAC,GAAO,KAAY,EAAwB,KAAK,EACjD,CAAC,GAAQ,KAAa,EAC1B,aACD,EACK,CAAC,GAAc,KAAmB,EACtC,UACD,EACK,IAAe,EAAO,GAAM,EAC5B,IAAmB,EAA6C,KAAK;AA6L3E,QA3LA,QAAgB;AAEd,MAAI,EAAa,QACf;AAEF,IAAa,UAAU;EAEvB,IAAM,IAAkB,YAAY;AAClC,OAAI;IAEF,IAAM,IAAa,EAAa,IAAI,QAAQ,EACtC,IACJ,EAAa,IAAI,UAAU,IAAI,EAAa,IAAI,oBAAoB;AAEtE,QAAI,EACF,OAAU,MACR,KAAgB,8BAA8B,IAC/C;IAIH,IAAM,IAAQ,EAAa,IAAI,QAAQ,EACjC,IAAO,EAAa,IAAI,OAAO,EAC/B,IAAQ,EAAa,IAAI,QAAQ;AAEvC,QAAI,EAGF,CADA,EAAgB,OAAO,EACvB,MAAM,EAAmB,EAAM;aACtB,EAGT,CADA,EAAgB,OAAO,EACvB,MAAM,EAAmB,GAAM,EAAM;QAErC,OAAU,MACR,iEACD;YAEI,GAAK;AAKZ,IAJA,QAAQ,MAAM,yBAAyB,EAAI,EAC3C,EACE,aAAe,QAAQ,EAAI,UAAU,iCACtC,EACD,EAAU,QAAQ;;KAShB,IAAqB,OAAO,MAAkB;GAClD,IAAM,IAAe,EAAa,IAAI,eAAe,EAC/C,IAAW,EAAa,IAAI,WAAW,EACvC,IAAc,EAAa,IAAI,cAAc,KAAK,QAClD,IAAiB,EAAa,IAAI,iBAAiB;AAGzD,OAAI,KAAe,GAAgB;AAQjC,IANA,eAAe,QAAQ,oBAAoB,EAAe,EAC1D,eAAe,QAAQ,qBAAqB,EAAM,EAClD,eAAe,QAAQ,uBAAuB,KAAgB,GAAG,EACjE,eAAe,QAAQ,gBAAgB,KAAY,aAAa,EAGhE,EAAS,oBAAoB,EAAE,SAAS,IAAM,CAAC;AAC/C;;AAUF,GANA,EAAc,GAAO,KAAgB,GAAG,EACxC,EAAiB,GAAK,EAEtB,EAAU,UAAU,EAGpB,EAAiB,UAAU,iBAAiB;AAE1C,MADoB,KAAY,cACV,EAAE,SAAS,IAAM,CAAC;MACvC,KAAK;KAMJ,IAAqB,OAAO,GAAc,MAAyB;AAIvE,OAHmB,GAAwB,EAG3B;AACd,QAAI,CAAC,EACH,OAAU,MAAM,qDAAqD;IAIvE,IAAM,IAAS,MAAM,EAA2B,GAAM,EAAM;AAE5D,QAAI,CAAC,EAAO,QACV,OAAU,MACR,EAAO,SACL,qDACH;AAGH,MAAU,UAAU;IAGpB,IAAM,IAAc,EAAO,gBAAgB;AAC3C,MAAiB,UAAU,iBAAiB;AAC1C,OAAS,GAAa,EAAE,SAAS,IAAM,CAAC;OACvC,KAAK;AACR;;AAKF,OAAI,KAAS,CAAC,EAAkB,EAAM,CACpC,OAAU,MACR,mFACD;GASH,IAAM,IAAS,MAAM,EAAiB,GAJpC,eAAe,QAAQ,iBAAiB,IAAI,kBAC1B,OAAO,SAAS,SAAS,qBAGqB;AAElE,OAAI,CAAC,EAAO,QACV,OAAU,MACR,EAAO,SAAS,wCACjB;AAIH,OAAI,EAAO,eAAe,EAAO,gBAAgB;AAa/C,IAXA,eAAe,QAAQ,oBAAoB,EAAO,eAAe,EACjE,eAAe,QACb,gBACA,eAAe,QAAQ,gBAAgB,IAAI,aAC5C,EAGD,eAAe,WAAW,gBAAgB,EAC1C,eAAe,WAAW,iBAAiB,EAG3C,EAAS,oBAAoB,EAAE,SAAS,IAAM,CAAC;AAC/C;;AAGF,KAAU,UAAU;GAGpB,IAAM,IAAW,eAAe,QAAQ,gBAAgB,IAAI;AAK5D,GAJA,eAAe,WAAW,gBAAgB,EAC1C,eAAe,WAAW,iBAAiB,EAG3C,EAAiB,UAAU,iBAAiB;AAC1C,MAAS,GAAU,EAAE,SAAS,IAAM,CAAC;MACpC,KAAK;;AAIV,SADA,GAAiB,QACJ;AACX,GAEE,EAAiB,aADjB,aAAa,EAAiB,QAAQ,EACX;;IAG9B;EACD;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CAAC,EAGA,kBAAC,OAAD;EAAK,WAAU;YACb,kBAAC,OAAD;GAAK,WAAU;aACb,kBAAC,OAAD;IAAK,WAAU;cAAf;KAEE,kBAAC,OAAD;MAAK,WAAU;gBACb,kBAAC,OAAD;OAAK,WAAU;iBACb,kBAAC,OAAD;QACE,WAAU;QACV,MAAK;QACL,SAAQ;QACR,QAAO;kBAEP,kBAAC,QAAD;SACE,eAAc;SACd,gBAAe;SACf,aAAa;SACb,GAAE;SACF,CAAA;QACE,CAAA;OACF,CAAA;MACF,CAAA;KAGL,MAAW,gBACV,kBAAA,GAAA,EAAA,UAAA;MACE,kBAAC,MAAD;OAAI,WAAU;iBACX,EAAG,+BAA+B,qBAAqB;OACrD,CAAA;MACL,kBAAC,KAAD;OAAG,WAAU;iBACV,MAAiB,SACd,EACE,mCACA,qDACD,GACD,MAAiB,SACf,EACE,mCACA,sCACD,GACD,EACE,oCACA,6DACD;OACL,CAAA;MACJ,kBAAC,OAAD;OAAK,WAAU;iBACb,kBAAC,GAAD,EAAa,WAAU,uCAAwC,CAAA;OAC3D,CAAA;MACL,EAAA,CAAA;KAIJ,MAAW,aACV,kBAAA,GAAA,EAAA,UAAA;MACE,kBAAC,OAAD;OAAK,WAAU;iBACb,kBAAC,OAAD;QACE,WAAU;QACV,MAAK;QACL,SAAQ;QACR,QAAO;kBAEP,kBAAC,QAAD;SACE,eAAc;SACd,gBAAe;SACf,aAAa;SACb,GAAE;SACF,CAAA;QACE,CAAA;OACF,CAAA;MACN,kBAAC,MAAD;OAAI,WAAU;iBACX,EAAG,4BAA4B,qBAAqB;OAClD,CAAA;MACL,kBAAC,KAAD;OAAG,WAAU;iBACV,MAAiB,SACd,EACE,iCACA,+CACD,GACD,MAAiB,SACf,EACE,iCACA,+CACD,GACD,EACE,gCACA,2DACD;OACL,CAAA;MACJ,kBAAC,OAAD;OAAK,WAAU;iBACb,kBAAC,GAAD,EAAa,WAAU,gDAAiD,CAAA;OACpE,CAAA;MACL,EAAA,CAAA;KAIJ,MAAW,WACV,kBAAA,GAAA,EAAA,UAAA;MACE,kBAAC,OAAD;OAAK,WAAU;iBACb,kBAAC,GAAD,EAAW,WAAU,iCAAkC,CAAA;OACnD,CAAA;MACN,kBAAC,MAAD;OAAI,WAAU;iBACX,EAAG,2BAA2B,iBAAiB;OAC7C,CAAA;MACL,kBAAC,KAAD;OAAG,WAAU;iBAAuC;OAAU,CAAA;MAC9D,kBAAC,OAAD;OAAK,WAAU;iBAAf,CACE,kBAAC,UAAD;QAAQ,MAAK;QACX,eAAe,EAAS,mBAAmB,EAAE,SAAS,IAAM,CAAC;QAC7D,WAAU;kBAET,EAAG,6BAA6B,YAAY;QACtC,CAAA,EACT,kBAAC,UAAD;QAAQ,MAAK;QACX,eAAe,EAAS,eAAe,EAAE,SAAS,IAAM,CAAC;QACzD,WAAU;kBAET,EAAG,gCAAgC,gBAAgB;QAC7C,CAAA,CACL;;MACL,EAAA,CAAA;KAIJ,MAAiB,aAChB,kBAAC,OAAD;MAAK,WAAU;gBACb,kBAAC,QAAD;OACE,WAAW,uEACT,MAAiB,SACb,+CACA;iBAGL,MAAiB,SAAS,mBAAmB;OACzC,CAAA;MACH,CAAA;KAIR,kBAAC,OAAD;MAAK,WAAU;gBACb,kBAAC,KAAD;OAAG,WAAU;iBACV,EACC,6BACA,8FACD;OACC,CAAA;MACA,CAAA;KACF;;GACF,CAAA;EACF,CAAA"}

package/dist/auth/pages/SsoConfigPage.js

@@ -1,7 +1,6 @@
-import { useSsoOperations as e } from "../hooks/useSsoOperations.js";
-import { useAuthPermissions as t } from "../hooks/useAuthPermissions.js";
-import "../hooks/index.js";
-import { AlertIcon as n, SpinnerIcon as r } from "../components/AuthIcons.js";
+import { AlertIcon as e, SpinnerIcon as t } from "../components/AuthIcons.js";
+import { useSsoOperations as n } from "../hooks/useSsoOperations.js";
+import { useAuthPermissions as r } from "../hooks/useAuthPermissions.js";
 import { ConfirmActionDialog as i } from "../components/ConfirmActionDialog.js";
 import { nativeCopyText as a, nativeImpact as o, nativeNotify as s } from "../../utils/nativeBridge.js";
 import { useCallback as c, useEffect as l, useRef as ee, useState as u } from "react";
@@ -47,7 +46,7 @@ function g(e) {
 	}
 }
 function _({ bypassEnterprisePlanGate: a = !1 }) {
-	let _ = te(), [v] = d(), { canManageSsoConfig: y, isLoading: ie } = t(), ae = re("workspace.auth.enterprise-sso"), oe = a || ae?.value === !0, b = ee(null), x = v.get("tenant"), S = v.get("org"), C = v.get("workspace"), { ssoConfig: w, oidcConfig: T, isLoading: E, isSaving: D, isDeleting: O, saveSsoConfig: k, deleteSsoConfig: se } = e(x ?? "burdenoff.com"), { t: A } = ne(), j = c((e, t) => {
+	let _ = te(), [v] = d(), { canManageSsoConfig: y, isLoading: ie } = r(), ae = re("workspace.auth.enterprise-sso"), oe = a || ae?.value === !0, b = ee(null), x = v.get("tenant"), S = v.get("org"), C = v.get("workspace"), { ssoConfig: w, oidcConfig: T, isLoading: E, isSaving: D, isDeleting: O, saveSsoConfig: k, deleteSsoConfig: se } = n(x ?? "burdenoff.com"), { t: A } = ne(), j = c((e, t) => {
 		let n = A(e);
 		return n === e ? t : n;
 	}, [A]), [M, ce] = u("saml"), [N, P] = u(!1), [le, F] = u(!1), [I, L] = u(null), [R, z] = u(null), [B, V] = u(""), [H, U] = u(!1), [W, G] = u(!1), [K, q] = u({
@@ -74,7 +73,7 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 		className: "max-w-5xl mx-auto p-6",
 		children: /* @__PURE__ */ m("div", {
 			className: "text-center py-16",
-			children: [/* @__PURE__ */ p(r, { className: "w-8 h-8 mx-auto text-text-secondary animate-spin" }), /* @__PURE__ */ p("p", {
+			children: [/* @__PURE__ */ p(t, { className: "size-8 mx-auto text-text-secondary animate-spin" }), /* @__PURE__ */ p("p", {
 				className: "mt-4 text-text-secondary",
 				children: j("auth.sso.loadingPermissions", "Loading permissions...")
 			})]
@@ -110,11 +109,12 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 				children: [/* @__PURE__ */ m("div", {
 					className: "flex items-center gap-4",
 					children: [/* @__PURE__ */ p("button", {
+						type: "button",
 						onClick: () => _("/auth/security"),
 						"aria-label": j("auth.sso.backToSecurity", "Back to Security"),
 						className: "p-2 rounded-lg hover:bg-bg-sunken transition-colors",
 						children: /* @__PURE__ */ p("svg", {
-							className: "w-5 h-5 text-text-secondary",
+							className: "size-5 text-text-secondary",
 							fill: "none",
 							viewBox: "0 0 24 24",
 							stroke: "currentColor",
@@ -139,6 +139,7 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 						className: `px-3 py-1 rounded-full text-sm font-medium ${Q.enabled ? "bg-status-success-bg-subtle text-status-success-text" : "bg-bg-sunken text-text-secondary"}`,
 						children: Q.enabled ? j("auth.sso.enabled", "Enabled") : j("auth.sso.disabled", "Disabled")
 					}), /* @__PURE__ */ p("button", {
+						type: "button",
 						onClick: async () => {
 							L(null);
 							try {
@@ -202,12 +203,13 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 			}),
 			I && /* @__PURE__ */ m("div", {
 				className: "mb-6 flex items-start gap-3 p-4 rounded-xl bg-status-error-bg-subtle border border-status-error-border",
-				children: [/* @__PURE__ */ p(n, { className: "w-5 h-5 text-status-error-text flex-shrink-0 mt-0.5" }), /* @__PURE__ */ m("div", {
+				children: [/* @__PURE__ */ p(e, { className: "size-5 text-status-error-text flex-shrink-0 mt-0.5" }), /* @__PURE__ */ m("div", {
 					className: "flex-1",
 					children: [/* @__PURE__ */ p("p", {
 						className: "text-sm text-status-error-text",
 						children: I
 					}), /* @__PURE__ */ p("button", {
+						type: "button",
 						onClick: () => L(null),
 						className: "mt-2 text-sm text-status-error-text hover:underline",
 						children: j("auth.sso.dismiss", "Dismiss")
@@ -217,7 +219,7 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 			R && /* @__PURE__ */ m("div", {
 				className: "mb-6 flex items-start gap-3 p-4 rounded-xl bg-status-success-bg-subtle border border-status-success-border",
 				children: [/* @__PURE__ */ p("svg", {
-					className: "w-5 h-5 text-status-success-text flex-shrink-0 mt-0.5",
+					className: "size-5 text-status-success-text flex-shrink-0 mt-0.5",
 					fill: "currentColor",
 					viewBox: "0 0 20 20",
 					children: /* @__PURE__ */ p("path", {
@@ -231,6 +233,7 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 						className: "text-sm text-status-success-text",
 						children: R
 					}), /* @__PURE__ */ p("button", {
+						type: "button",
 						onClick: () => z(null),
 						className: "mt-2 text-sm text-status-success-text hover:underline",
 						children: j("auth.sso.dismiss", "Dismiss")
@@ -263,6 +266,7 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 							icon: "🧪"
 						}
 					].map((e) => /* @__PURE__ */ m("button", {
+						type: "button",
 						onClick: () => ce(e.id),
 						className: `pb-3 text-sm font-medium transition-colors relative ${M === e.id ? "text-text-link" : "text-text-secondary hover:text-text-primary"}`,
 						children: [/* @__PURE__ */ m("span", {
@@ -274,7 +278,7 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 			}),
 			E && /* @__PURE__ */ m("div", {
 				className: "flex items-center justify-center py-12",
-				children: [/* @__PURE__ */ p(r, { className: "w-8 h-8 text-text-link animate-spin" }), /* @__PURE__ */ p("span", {
+				children: [/* @__PURE__ */ p(t, { className: "size-8 text-text-link animate-spin" }), /* @__PURE__ */ p("span", {
 					className: "ml-3 text-text-secondary",
 					children: j("auth.sso.loadingConfig", "Loading configuration...")
 				})]
@@ -353,8 +357,8 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 										/* @__PURE__ */ m("label", {
 											htmlFor: "metadata-file",
 											className: "flex items-center justify-center gap-2 w-full px-4 py-3 border-2 border-dashed border-border-default rounded-xl cursor-pointer hover:border-action-primary-bg transition-colors",
-											children: [H ? /* @__PURE__ */ p(r, { className: "w-5 h-5 animate-spin text-text-link" }) : /* @__PURE__ */ p("svg", {
-												className: "w-5 h-5 text-text-tertiary",
+											children: [H ? /* @__PURE__ */ p(t, { className: "size-5 animate-spin text-text-link" }) : /* @__PURE__ */ p("svg", {
+												className: "size-5 text-text-tertiary",
 												fill: "none",
 												viewBox: "0 0 24 24",
 												stroke: "currentColor",
@@ -412,8 +416,8 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 											},
 											disabled: H || !B,
 											className: "px-4 py-2.5 rounded-xl bg-action-primary-bg text-white font-medium hover:bg-action-primary-bg-hover disabled:opacity-50 disabled:cursor-not-allowed transition-colors flex items-center gap-2",
-											children: [H ? /* @__PURE__ */ p(r, { className: "w-4 h-4 animate-spin" }) : /* @__PURE__ */ p("svg", {
-												className: "w-4 h-4",
+											children: [H ? /* @__PURE__ */ p(t, { className: "size-4 animate-spin" }) : /* @__PURE__ */ p("svg", {
+												className: "size-4",
 												fill: "none",
 												viewBox: "0 0 24 24",
 												stroke: "currentColor",
@@ -452,6 +456,7 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 										className: "flex-1 px-3 py-2 rounded-lg bg-bg-sunken text-sm text-text-primary font-mono",
 										children: [window.location.origin, "/auth/saml/metadata"]
 									}), /* @__PURE__ */ p("button", {
+										type: "button",
 										onClick: () => void h(`${window.location.origin}/auth/saml/metadata`),
 										className: "px-3 py-2 rounded-lg border border-border-default text-text-secondary hover:bg-bg-sunken",
 										children: j("auth.sso.copy", "Copy")
@@ -465,6 +470,7 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 										className: "flex-1 px-3 py-2 rounded-lg bg-bg-sunken text-sm text-text-primary font-mono",
 										children: [window.location.origin, "/auth/sso/callback"]
 									}), /* @__PURE__ */ p("button", {
+										type: "button",
 										onClick: () => void h(`${window.location.origin}/auth/sso/callback`),
 										className: "px-3 py-2 rounded-lg border border-border-default text-text-secondary hover:bg-bg-sunken",
 										children: j("auth.sso.copy", "Copy")
@@ -637,7 +643,7 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 									type: "submit",
 									disabled: D,
 									className: "auth-primary-button flex items-center gap-2 px-6 py-3 font-medium",
-									children: D ? /* @__PURE__ */ m(f, { children: [/* @__PURE__ */ p(r, { className: "w-4 h-4 animate-spin" }), j("auth.sso.saving", "Saving...")] }) : j("auth.sso.saveConfig", "Save Configuration")
+									children: D ? /* @__PURE__ */ m(f, { children: [/* @__PURE__ */ p(t, { className: "size-4 animate-spin" }), j("auth.sso.saving", "Saving...")] }) : j("auth.sso.saveConfig", "Save Configuration")
 								}), N && /* @__PURE__ */ p("button", {
 									type: "button",
 									onClick: () => {
@@ -667,10 +673,11 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 								children: j("auth.sso.dangerZoneDesc", "Deleting the SSO configuration will prevent users from signing in with their enterprise credentials. This action cannot be undone.")
 							}),
 							/* @__PURE__ */ p("button", {
+								type: "button",
 								onClick: () => F(!0),
 								disabled: O,
 								className: "px-4 py-2 rounded-lg bg-status-error-bg text-white font-medium hover:bg-status-error-bg-hover disabled:opacity-50 transition-colors flex items-center gap-2",
-								children: O ? /* @__PURE__ */ m(f, { children: [/* @__PURE__ */ p(r, { className: "w-4 h-4 animate-spin" }), j("auth.sso.deleting", "Deleting...")] }) : j("auth.sso.deleteConfig", "Delete SSO Configuration")
+								children: O ? /* @__PURE__ */ m(f, { children: [/* @__PURE__ */ p(t, { className: "size-4 animate-spin" }), j("auth.sso.deleting", "Deleting...")] }) : j("auth.sso.deleteConfig", "Delete SSO Configuration")
 							})
 						]
 					})
@@ -706,6 +713,7 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 									className: "flex-1 px-3 py-2 rounded-lg bg-bg-sunken text-sm text-text-primary font-mono break-all",
 									children: T?.issuer ? `${T.issuer}/.well-known/openid-configuration` : "Discovery endpoint unavailable until OIDC is configured"
 								}), /* @__PURE__ */ p("button", {
+									type: "button",
 									onClick: () => {
 										let e = T?.issuer ? `${T.issuer}/.well-known/openid-configuration` : "";
 										e && h(e);
@@ -791,7 +799,7 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 								}
 							].map((e) => /* @__PURE__ */ m("div", {
 								className: "flex items-center gap-2",
-								children: [/* @__PURE__ */ p("span", { className: `w-2 h-2 rounded-full ${e.status ? "bg-status-success-text" : "bg-bg-sunken"}` }), /* @__PURE__ */ p("span", {
+								children: [/* @__PURE__ */ p("span", { className: `size-2 rounded-full ${e.status ? "bg-status-success-text" : "bg-bg-sunken"}` }), /* @__PURE__ */ p("span", {
 									className: "text-sm text-text-primary",
 									children: e.name
 								})]
@@ -824,10 +832,11 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 								className: "text-sm text-status-success-text mt-1",
 								children: j("auth.sso.clientCreatedDesc", "Save these credentials securely. The client secret will not be shown again.")
 							})] }), /* @__PURE__ */ p("button", {
+								type: "button",
 								onClick: () => Z(null),
 								className: "text-status-success-text hover:text-status-success-text",
 								children: /* @__PURE__ */ p("svg", {
-									className: "w-5 h-5",
+									className: "size-5",
 									fill: "none",
 									viewBox: "0 0 24 24",
 									stroke: "currentColor",
@@ -851,6 +860,7 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 										className: "flex-1 px-3 py-2 rounded-lg bg-bg-surface text-sm font-mono border border-status-success-border",
 										children: X.client_id
 									}), /* @__PURE__ */ p("button", {
+										type: "button",
 										onClick: () => void h(X.client_id),
 										className: "px-3 py-2 rounded-lg bg-status-success-bg text-white text-sm hover:bg-status-success-bg",
 										children: j("auth.sso.copy", "Copy")
@@ -865,6 +875,7 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 										className: "flex-1 px-3 py-2 rounded-lg bg-bg-surface text-sm font-mono border border-status-success-border",
 										children: X.client_secret
 									}), /* @__PURE__ */ p("button", {
+										type: "button",
 										onClick: () => void h(X.client_secret || ""),
 										className: "px-3 py-2 rounded-lg bg-status-success-bg text-white text-sm hover:bg-status-success-bg",
 										children: j("auth.sso.copy", "Copy")
@@ -888,10 +899,11 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 								className: "text-lg font-medium text-text-primary",
 								children: j("auth.sso.registerClient", "Register New Client")
 							}), !W && /* @__PURE__ */ m("button", {
+								type: "button",
 								onClick: () => G(!0),
 								className: "px-4 py-2 rounded-lg bg-action-primary-bg text-white font-medium hover:bg-action-primary-bg-hover transition-colors flex items-center gap-2",
 								children: [/* @__PURE__ */ p("svg", {
-									className: "w-4 h-4",
+									className: "size-4",
 									fill: "none",
 									viewBox: "0 0 24 24",
 									stroke: "currentColor",
@@ -986,7 +998,7 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 													grant_types: K.grant_types.filter((t) => t !== e)
 												});
 											},
-											className: "w-4 h-4 rounded border-border-default text-text-link focus:ring-action-primary-bg"
+											className: "size-4 rounded border-border-default text-text-link focus:ring-action-primary-bg"
 										}), /* @__PURE__ */ p("span", {
 											className: "text-sm text-text-primary",
 											children: e.replace(/_/g, " ")
@@ -1023,6 +1035,7 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 								/* @__PURE__ */ m("div", {
 									className: "flex items-center gap-3 pt-2",
 									children: [/* @__PURE__ */ p("button", {
+										type: "button",
 										onClick: async () => {
 											if (!K.client_name || !K.redirect_uris) {
 												L(j("auth.sso.clientRequired", "Client name and redirect URI are required"));
@@ -1061,8 +1074,9 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 										},
 										disabled: J,
 										className: "auth-primary-button flex items-center gap-2 px-6 py-3 font-medium",
-										children: J ? /* @__PURE__ */ m(f, { children: [/* @__PURE__ */ p(r, { className: "w-4 h-4 animate-spin" }), j("auth.sso.registering", "Registering...")] }) : j("auth.sso.registerClientButton", "Register Client")
+										children: J ? /* @__PURE__ */ m(f, { children: [/* @__PURE__ */ p(t, { className: "size-4 animate-spin" }), j("auth.sso.registering", "Registering...")] }) : j("auth.sso.registerClientButton", "Register Client")
 									}), /* @__PURE__ */ p("button", {
+										type: "button",
 										onClick: () => {
 											G(!1), q({
 												client_name: "",
@@ -1079,7 +1093,7 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 						}) : /* @__PURE__ */ m("div", {
 							className: "text-center py-8 text-text-secondary",
 							children: [/* @__PURE__ */ p("svg", {
-								className: "w-12 h-12 mx-auto mb-3 text-text-muted",
+								className: "size-12 mx-auto mb-3 text-text-muted",
 								fill: "none",
 								viewBox: "0 0 24 24",
 								stroke: "currentColor",
@@ -1170,7 +1184,7 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 								href: `${window.location.origin}/auth/sso/login`,
 								className: "inline-flex items-center gap-2 px-6 py-3 rounded-xl bg-status-success-bg text-white font-medium shadow-sm hover:opacity-90 transition-all duration-200",
 								children: [/* @__PURE__ */ p("svg", {
-									className: "w-5 h-5",
+									className: "size-5",
 									fill: "none",
 									viewBox: "0 0 24 24",
 									stroke: "currentColor",
@@ -1206,8 +1220,8 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 			className: "text-center py-16 border-2 border-dashed border-border-subtle rounded-xl",
 			children: [
 				/* @__PURE__ */ p("div", {
-					className: "w-16 h-16 mx-auto mb-4 rounded-full bg-status-warning-bg-subtle flex items-center justify-center",
-					children: /* @__PURE__ */ p(n, { className: "w-8 h-8 text-status-warning-text" })
+					className: "size-16 mx-auto mb-4 rounded-full bg-status-warning-bg-subtle flex items-center justify-center",
+					children: /* @__PURE__ */ p(e, { className: "size-8 text-status-warning-text" })
 				}),
 				/* @__PURE__ */ p("h2", {
 					className: "text-xl font-semibold text-text-primary mb-2",
@@ -1229,8 +1243,8 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 			className: "text-center py-16 border-2 border-dashed border-border-subtle rounded-xl",
 			children: [
 				/* @__PURE__ */ p("div", {
-					className: "w-16 h-16 mx-auto mb-4 rounded-full bg-status-error-bg-subtle flex items-center justify-center",
-					children: /* @__PURE__ */ p(n, { className: "w-8 h-8 text-status-error-text" })
+					className: "size-16 mx-auto mb-4 rounded-full bg-status-error-bg-subtle flex items-center justify-center",
+					children: /* @__PURE__ */ p(e, { className: "size-8 text-status-error-text" })
 				}),
 				/* @__PURE__ */ p("h2", {
 					className: "text-xl font-semibold text-text-primary mb-2",