@burdenoff/microfe-auth 2026.527.2 → 2026.527.3

package/dist/auth/pages/SessionsPage.js.map

@@ -1 +1 @@
-{"version":3,"file":"SessionsPage.js","names":[],"sources":["../../../src/auth/pages/SessionsPage.tsx"],"sourcesContent":["import { useState, useMemo } from \"react\";\nimport { useI18n } from \"@burdenoff/fe-libs/shared/providers/shell\";\nimport { useSessionOperations } from \"../hooks/useSessionOperations\";\nimport { useAuthStore } from \"../store/authStore\";\nimport { ConfirmActionDialog } from \"../components/ConfirmActionDialog\";\nimport {\n  formatRelativeTime,\n  parseDeviceName,\n  parseBrowserName,\n} from \"../utils/formatters\";\nimport { SpinnerIcon, AlertIcon } from \"../components/AuthIcons\";\n\n/**\n * Active sessions management page with professional UI\n *\n * Fragment: SessionCard_Session (src/operations/global/fragments/SessionCard.fragment.graphql)\n * Query: ActiveSessions (src/operations/global/queries/sessions.graphql)\n */\nexport function SessionsPage() {\n  const { t } = useI18n();\n  const tr = (key: string, fallback: string): string => {\n    const translated = t(key);\n    return translated === key ? fallback : translated;\n  };\n\n  const isAuthenticated = useAuthStore((state) => state.isAuthenticated);\n  const {\n    activeSessions,\n    revokeSession,\n    revokeAllSessions,\n    isLoading,\n    page,\n    totalPages,\n    totalCount,\n    hasMore,\n    goToNextPage,\n    goToPrevPage,\n  } = useSessionOperations({ disableTokenInfoQuery: true, pageSize: 20 });\n\n  // One entry per device: keep the most-recently-active session for each device name\n  const dedupedSessions = useMemo(() => {\n    const byDevice = new Map<string, (typeof activeSessions)[number]>();\n    for (const s of activeSessions) {\n      const device = parseDeviceName(s.userAgent ?? \"\");\n      const existing = byDevice.get(device);\n      if (\n        !existing ||\n        new Date(s.lastActivityAt) > new Date(existing.lastActivityAt)\n      ) {\n        byDevice.set(device, s);\n      }\n    }\n    return [...byDevice.values()];\n  }, [activeSessions]);\n\n  const [error, setError] = useState<string | null>(null);\n  const [successMessage, setSuccessMessage] = useState<string | null>(null);\n  const [pendingSessionId, setPendingSessionId] = useState<string | null>(null);\n  const [showRevokeAllDialog, setShowRevokeAllDialog] = useState(false);\n\n  const handleRevokeSession = async (sessionId: string) => {\n    try {\n      await revokeSession(sessionId);\n      setSuccessMessage(\"Session revoked successfully\");\n      setPendingSessionId(null);\n    } catch (err) {\n      setError(err instanceof Error ? err.message : \"Failed to revoke session\");\n    }\n  };\n\n  const handleRevokeAll = async () => {\n    try {\n      await revokeAllSessions();\n      setSuccessMessage(\"All other sessions have been revoked\");\n      setShowRevokeAllDialog(false);\n    } catch (err) {\n      setError(\n        err instanceof Error ? err.message : \"Failed to revoke all sessions\",\n      );\n    }\n  };\n\n  if (!isAuthenticated) {\n    return (\n      <div className=\"max-w-4xl mx-auto p-6\">\n        <div className=\"text-center py-16 border-2 border-dashed border-border-subtle rounded-xl\">\n          <div className=\"size-16 mx-auto mb-4 rounded-full bg-status-warning-bg-subtle flex items-center justify-center\">\n            <AlertIcon\n              className=\"size-8 text-status-warning-text\"\n              aria-hidden=\"true\"\n            />\n          </div>\n          <h2 className=\"text-xl font-semibold text-text-primary mb-2\">\n            {tr(\"auth.sessions.authRequired\", \"Authentication Required\")}\n          </h2>\n          <p className=\"text-text-secondary\">\n            {tr(\n              \"auth.sessions.signInToView\",\n              \"Please sign in to view your active sessions\",\n            )}\n          </p>\n        </div>\n      </div>\n    );\n  }\n\n  return (\n    <div className=\"max-w-4xl mx-auto p-6\">\n      <ConfirmActionDialog\n        open={pendingSessionId !== null}\n        onOpenChange={(open) => {\n          if (!open) {\n            setPendingSessionId(null);\n          }\n        }}\n        title=\"Revoke this session?\"\n        description=\"The selected device will be signed out immediately and will need to authenticate again.\"\n        confirmText=\"Revoke session\"\n        variant=\"danger\"\n        isPending={isLoading}\n        onConfirm={async () => {\n          if (pendingSessionId) {\n            await handleRevokeSession(pendingSessionId);\n          }\n        }}\n      />\n      <ConfirmActionDialog\n        open={showRevokeAllDialog}\n        onOpenChange={setShowRevokeAllDialog}\n        title=\"Revoke every other session?\"\n        description=\"All devices except your current one will be signed out immediately.\"\n        confirmText=\"Revoke all other sessions\"\n        variant=\"warning\"\n        isPending={isLoading}\n        onConfirm={handleRevokeAll}\n      />\n\n      {/* Live regions for screen reader announcements */}\n      <div aria-live=\"polite\" aria-atomic=\"true\" className=\"sr-only\">\n        {successMessage}\n      </div>\n      <div\n        role=\"alert\"\n        aria-live=\"assertive\"\n        aria-atomic=\"true\"\n        className=\"sr-only\"\n      >\n        {error}\n      </div>\n\n      {/* Header */}\n      <div className=\"flex items-center justify-between mb-8\">\n        <div>\n          <h1 className=\"text-3xl font-semibold text-text-primary\">\n            {tr(\"auth.sessions.title\", \"Active Sessions\")}\n          </h1>\n          <p className=\"text-text-secondary mt-2\">\n            {tr(\"auth.sessions.sessionCount\", \"You have\")} {totalCount}{\" \"}\n            {tr(\n              totalCount !== 1\n                ? \"auth.sessions.sessionsPlural\"\n                : \"auth.sessions.sessionsSingular\",\n              totalCount !== 1 ? \"active sessions\" : \"active session\",\n            )}\n          </p>\n        </div>\n        <div className=\"flex items-center gap-3\">\n          {/* Export button — commented out until wspace-export-svc is wired for auth_sessions\n          <button\n            type=\"button\"\n            onClick={handleExport}\n            disabled={isExporting}\n            aria-label={tr(\n              \"auth.sessions.exportAriaLabel\",\n              \"Export sessions data\",\n            )}\n            className=\"flex items-center gap-2 px-4 py-2.5 rounded-xl border border-border-default text-text-primary font-medium hover:bg-bg-sunken disabled:opacity-50 disabled:cursor-not-allowed transition-colors duration-200\"\n          >\n            {isExporting ? (\n              <>\n                <SpinnerIcon\n                  className=\"size-4 animate-spin\"\n                  aria-hidden=\"true\"\n                />\n                {tr(\"auth.sessions.exporting\", \"Exporting...\")}\n              </>\n            ) : (\n              <>\n                <svg\n                  className=\"size-4\"\n                  fill=\"none\"\n                  viewBox=\"0 0 24 24\"\n                  stroke=\"currentColor\"\n                  aria-hidden=\"true\"\n                >\n                  <path\n                    strokeLinecap=\"round\"\n                    strokeLinejoin=\"round\"\n                    strokeWidth={2}\n                    d=\"M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1m-4-4l-4 4m0 0l-4-4m4 4V4\"\n                  />\n                </svg>\n                {tr(\"auth.sessions.export\", \"Export\")}\n              </>\n            )}\n          </button>\n          */}\n          {totalCount > 1 && (\n            <button\n              type=\"button\"\n              onClick={() => setShowRevokeAllDialog(true)}\n              className=\"px-4 py-2.5 rounded-xl border border-status-error-border text-status-error-text font-medium hover:bg-status-error-bg-subtle transition-colors duration-200\"\n            >\n              {tr(\"auth.sessions.revokeAll\", \"Revoke All Sessions\")}\n            </button>\n          )}\n        </div>\n      </div>\n\n      {/* Success Message */}\n      {successMessage && (\n        <div\n          role=\"status\"\n          className=\"mb-6 p-4 rounded-xl bg-status-success-bg-subtle border border-status-success-border\"\n        >\n          <p className=\"text-status-success-text\">{successMessage}</p>\n          <button\n            type=\"button\"\n            onClick={() => setSuccessMessage(null)}\n            className=\"mt-2 text-sm text-status-success-text hover:underline transition-colors duration-200\"\n          >\n            Dismiss\n          </button>\n        </div>\n      )}\n\n      {/* Error Message */}\n      {error && (\n        <div\n          role=\"alert\"\n          className=\"mb-6 flex items-start gap-3 p-4 rounded-xl bg-status-error-bg-subtle border border-status-error-border\"\n        >\n          <AlertIcon\n            className=\"size-5 text-status-error-text flex-shrink-0 mt-0.5\"\n            aria-hidden=\"true\"\n          />\n          <div className=\"flex-1\">\n            <p className=\"text-sm text-status-error-text\">{error}</p>\n            <button\n              type=\"button\"\n              onClick={() => setError(null)}\n              className=\"mt-2 text-sm text-status-error-text hover:underline transition-colors duration-200\"\n            >\n              Dismiss\n            </button>\n          </div>\n        </div>\n      )}\n\n      {isLoading ? (\n        <div\n          aria-live=\"polite\"\n          aria-busy=\"true\"\n          className=\"flex items-center justify-center py-12\"\n        >\n          <SpinnerIcon\n            className=\"size-8 text-text-link animate-spin\"\n            aria-hidden=\"true\"\n          />\n          <span className=\"ml-3 text-text-secondary\">\n            {tr(\"auth.sessions.loading\", \"Loading sessions...\")}\n          </span>\n        </div>\n      ) : dedupedSessions.length === 0 ? (\n        <div\n          className=\"text-center py-16 border-2 border-dashed border-border-subtle rounded-xl\"\n          role=\"status\"\n        >\n          <div className=\"size-16 mx-auto mb-4 rounded-full bg-bg-muted flex items-center justify-center\">\n            <svg\n              className=\"size-8 text-text-tertiary\"\n              fill=\"none\"\n              viewBox=\"0 0 24 24\"\n              stroke=\"currentColor\"\n              aria-hidden=\"true\"\n            >\n              <path\n                strokeLinecap=\"round\"\n                strokeLinejoin=\"round\"\n                strokeWidth={1.5}\n                d=\"M9.75 17L9 20l-1 1h8l-1-1-.75-3M3 13h18M5 17h14a2 2 0 002-2V5a2 2 0 00-2-2H5a2 2 0 00-2 2v10a2 2 0 002 2z\"\n              />\n            </svg>\n          </div>\n          <p className=\"text-text-secondary\">\n            {tr(\"auth.sessions.noSessions\", \"No active sessions found\")}\n          </p>\n        </div>\n      ) : (\n        <div className=\"space-y-4\" aria-live=\"polite\" aria-busy={isLoading}>\n          {dedupedSessions.map((session) => (\n            <div\n              key={session.id}\n              className=\"p-6 rounded-xl border border-border-default bg-bg-surface shadow-sm hover:shadow-md transition-shadow\"\n            >\n              <div className=\"flex items-start justify-between\">\n                <div className=\"flex items-start gap-4\">\n                  {/* Device Icon */}\n                  <div\n                    className=\"size-12 rounded-xl bg-bg-accent flex items-center justify-center flex-shrink-0\"\n                    aria-hidden=\"true\"\n                  >\n                    <svg\n                      className=\"size-6 text-text-link\"\n                      fill=\"none\"\n                      viewBox=\"0 0 24 24\"\n                      stroke=\"currentColor\"\n                    >\n                      <path\n                        strokeLinecap=\"round\"\n                        strokeLinejoin=\"round\"\n                        strokeWidth={1.5}\n                        d=\"M9.75 17L9 20l-1 1h8l-1-1-.75-3M3 13h18M5 17h14a2 2 0 002-2V5a2 2 0 00-2-2H5a2 2 0 00-2 2v10a2 2 0 002 2z\"\n                      />\n                    </svg>\n                  </div>\n\n                  <div className=\"flex-1\">\n                    <div className=\"flex items-center gap-3 mb-1\">\n                      <h3 className=\"text-lg font-semibold text-text-primary\">\n                        {session.isCurrent &&\n                        parseDeviceName(session.userAgent) === \"Unknown Device\"\n                          ? tr(\"auth.sessions.thisDevice\", \"This Device\")\n                          : parseDeviceName(session.userAgent)}\n                      </h3>\n                      {session.isCurrent && (\n                        <span\n                          role=\"status\"\n                          className=\"px-2.5 py-1 rounded-full bg-status-success-bg-subtle text-status-success-text text-xs font-medium\"\n                        >\n                          {tr(\n                            \"auth.sessions.currentSession\",\n                            \"Current Session\",\n                          )}\n                        </span>\n                      )}\n                    </div>\n                    <p className=\"text-sm text-text-secondary mb-2\">\n                      {parseBrowserName(session.userAgent) ===\n                        \"Unknown Browser\" && session.isCurrent\n                        ? tr(\"auth.sessions.currentBrowser\", \"Current Browser\")\n                        : parseBrowserName(session.userAgent)}\n                    </p>\n                    <dl className=\"flex flex-wrap gap-4 text-sm text-text-secondary\">\n                      {session.ipAddress && session.ipAddress !== \"unknown\" && (\n                        <div className=\"flex items-center gap-1.5\">\n                          <svg\n                            className=\"size-4\"\n                            fill=\"none\"\n                            viewBox=\"0 0 24 24\"\n                            stroke=\"currentColor\"\n                            aria-hidden=\"true\"\n                          >\n                            <path\n                              strokeLinecap=\"round\"\n                              strokeLinejoin=\"round\"\n                              strokeWidth={2}\n                              d=\"M21 12a9 9 0 01-9 9m9-9a9 9 0 00-9-9m9 9H3m9 9a9 9 0 01-9-9m9 9c1.657 0 3-4.03 3-9s-1.343-9-3-9m0 18c-1.657 0-3-4.03-3-9s1.343-9 3-9m-9 9a9 9 0 019-9\"\n                            />\n                          </svg>\n                          <dt className=\"sr-only\">IP address</dt>\n                          <dd>{session.ipAddress}</dd>\n                        </div>\n                      )}\n                      {session.location && (\n                        <div className=\"flex items-center gap-1.5\">\n                          <svg\n                            className=\"size-4\"\n                            fill=\"none\"\n                            viewBox=\"0 0 24 24\"\n                            stroke=\"currentColor\"\n                            aria-hidden=\"true\"\n                          >\n                            <path\n                              strokeLinecap=\"round\"\n                              strokeLinejoin=\"round\"\n                              strokeWidth={2}\n                              d=\"M17.657 16.657L13.414 20.9a1.998 1.998 0 01-2.827 0l-4.244-4.243a8 8 0 1111.314 0z\"\n                            />\n                            <path\n                              strokeLinecap=\"round\"\n                              strokeLinejoin=\"round\"\n                              strokeWidth={2}\n                              d=\"M15 11a3 3 0 11-6 0 3 3 0 016 0z\"\n                            />\n                          </svg>\n                          <dt className=\"sr-only\">Location</dt>\n                          <dd>{session.location}</dd>\n                        </div>\n                      )}\n                      <div className=\"flex items-center gap-1.5\">\n                        <svg\n                          className=\"size-4\"\n                          fill=\"none\"\n                          viewBox=\"0 0 24 24\"\n                          stroke=\"currentColor\"\n                          aria-hidden=\"true\"\n                        >\n                          <path\n                            strokeLinecap=\"round\"\n                            strokeLinejoin=\"round\"\n                            strokeWidth={2}\n                            d=\"M12 8v4l3 3m6-3a9 9 0 11-18 0 9 9 0 0118 0z\"\n                          />\n                        </svg>\n                        <dt className=\"sr-only\">Last active</dt>\n                        <dd>\n                          {tr(\"auth.sessions.lastActive\", \"Last active\")}{\" \"}\n                          {formatRelativeTime(session.lastActivityAt)}\n                        </dd>\n                      </div>\n                    </dl>\n                  </div>\n                </div>\n\n                {!session.isCurrent && (\n                  <button\n                    type=\"button\"\n                    onClick={() => setPendingSessionId(session.id)}\n                    aria-label={`${tr(\"auth.sessions.revoke\", \"Revoke\")} ${parseDeviceName(session.userAgent)} session`}\n                    className=\"ml-4 px-4 py-2 rounded-lg text-sm font-medium border border-status-error-border text-status-error-text bg-bg-surface hover:bg-status-error-bg-subtle transition-colors duration-200\"\n                  >\n                    {tr(\"auth.sessions.revoke\", \"Revoke\")}\n                  </button>\n                )}\n              </div>\n            </div>\n          ))}\n        </div>\n      )}\n\n      {/* Pagination controls */}\n      {!isLoading && totalPages > 1 && (\n        <div className=\"flex items-center justify-between mt-6 pt-4 border-t border-border-subtle\">\n          <button\n            type=\"button\"\n            onClick={goToPrevPage}\n            disabled={page === 0}\n            className=\"flex items-center gap-2 px-4 py-2 rounded-lg border border-border-default text-text-primary bg-bg-surface hover:bg-bg-sunken disabled:opacity-40 disabled:cursor-not-allowed transition-colors font-medium text-sm\"\n            aria-label={tr(\"auth.sessions.prevPage\", \"Previous page\")}\n          >\n            <svg\n              className=\"size-4\"\n              fill=\"none\"\n              viewBox=\"0 0 24 24\"\n              stroke=\"currentColor\"\n              aria-hidden=\"true\"\n            >\n              <path\n                strokeLinecap=\"round\"\n                strokeLinejoin=\"round\"\n                strokeWidth={2}\n                d=\"M15 19l-7-7 7-7\"\n              />\n            </svg>\n            {tr(\"auth.sessions.prev\", \"Previous\")}\n          </button>\n\n          <span className=\"text-sm text-text-secondary\">\n            {tr(\"auth.sessions.pageOf\", \"Page\")}{\" \"}\n            <span className=\"font-medium text-text-primary\">{page + 1}</span>{\" \"}\n            {tr(\"auth.sessions.of\", \"of\")}{\" \"}\n            <span className=\"font-medium text-text-primary\">{totalPages}</span>\n          </span>\n\n          <button\n            type=\"button\"\n            onClick={goToNextPage}\n            disabled={!hasMore}\n            className=\"flex items-center gap-2 px-4 py-2 rounded-lg border border-border-default text-text-primary bg-bg-surface hover:bg-bg-sunken disabled:opacity-40 disabled:cursor-not-allowed transition-colors font-medium text-sm\"\n            aria-label={tr(\"auth.sessions.nextPage\", \"Next page\")}\n          >\n            {tr(\"auth.sessions.next\", \"Next\")}\n            <svg\n              className=\"size-4\"\n              fill=\"none\"\n              viewBox=\"0 0 24 24\"\n              stroke=\"currentColor\"\n              aria-hidden=\"true\"\n            >\n              <path\n                strokeLinecap=\"round\"\n                strokeLinejoin=\"round\"\n                strokeWidth={2}\n                d=\"M9 5l7 7-7 7\"\n              />\n            </svg>\n          </button>\n        </div>\n      )}\n    </div>\n  );\n}\n"],"mappings":";;;;;;;;;AAkBA,SAAgB,IAAe;CAC7B,IAAM,EAAE,SAAM,GAAS,EACjB,KAAM,GAAa,MAA6B;EACpD,IAAM,IAAa,EAAE,EAAI;AACzB,SAAO,MAAe,IAAM,IAAW;IAGnC,IAAkB,GAAc,MAAU,EAAM,gBAAgB,EAChE,EACJ,mBACA,kBACA,sBACA,cACA,SACA,eACA,eACA,YACA,iBACA,oBACE,EAAqB;EAAE,uBAAuB;EAAM,UAAU;EAAI,CAAC,EAGjE,IAAkB,QAAc;EACpC,IAAM,oBAAW,IAAI,KAA8C;AACnE,OAAK,IAAM,KAAK,GAAgB;GAC9B,IAAM,IAAS,EAAgB,EAAE,aAAa,GAAG,EAC3C,IAAW,EAAS,IAAI,EAAO;AACrC,IACE,CAAC,KACD,IAAI,KAAK,EAAE,eAAe,GAAG,IAAI,KAAK,EAAS,eAAe,KAE9D,EAAS,IAAI,GAAQ,EAAE;;AAG3B,SAAO,CAAC,GAAG,EAAS,QAAQ,CAAC;IAC5B,CAAC,EAAe,CAAC,EAEd,CAAC,GAAO,KAAY,EAAwB,KAAK,EACjD,CAAC,GAAgB,KAAqB,EAAwB,KAAK,EACnE,CAAC,GAAkB,KAAuB,EAAwB,KAAK,EACvE,CAAC,GAAqB,KAA0B,EAAS,GAAM,EAE/D,IAAsB,OAAO,MAAsB;AACvD,MAAI;AAGF,GAFA,MAAM,EAAc,EAAU,EAC9B,EAAkB,+BAA+B,EACjD,EAAoB,KAAK;WAClB,GAAK;AACZ,KAAS,aAAe,QAAQ,EAAI,UAAU,2BAA2B;;;AAwC7E,QAxBK,IAyBH,kBAAC,OAAD;EAAK,WAAU;YAAf;GACE,kBAAC,GAAD;IACE,MAAM,MAAqB;IAC3B,eAAe,MAAS;AACtB,KAAK,KACH,EAAoB,KAAK;;IAG7B,OAAM;IACN,aAAY;IACZ,aAAY;IACZ,SAAQ;IACR,WAAW;IACX,WAAW,YAAY;AACrB,KAAI,KACF,MAAM,EAAoB,EAAiB;;IAG/C,CAAA;GACF,kBAAC,GAAD;IACE,MAAM;IACN,cAAc;IACd,OAAM;IACN,aAAY;IACZ,aAAY;IACZ,SAAQ;IACR,WAAW;IACX,WAhEkB,YAAY;AAClC,SAAI;AAGF,MAFA,MAAM,GAAmB,EACzB,EAAkB,uCAAuC,EACzD,EAAuB,GAAM;cACtB,GAAK;AACZ,QACE,aAAe,QAAQ,EAAI,UAAU,gCACtC;;;IAyDC,CAAA;GAGF,kBAAC,OAAD;IAAK,aAAU;IAAS,eAAY;IAAO,WAAU;cAClD;IACG,CAAA;GACN,kBAAC,OAAD;IACE,MAAK;IACL,aAAU;IACV,eAAY;IACZ,WAAU;cAET;IACG,CAAA;GAGN,kBAAC,OAAD;IAAK,WAAU;cAAf,CACE,kBAAC,OAAD,EAAA,UAAA,CACE,kBAAC,MAAD;KAAI,WAAU;eACX,EAAG,uBAAuB,kBAAkB;KAC1C,CAAA,EACL,kBAAC,KAAD;KAAG,WAAU;eAAb;MACG,EAAG,8BAA8B,WAAW;MAAC;MAAE;MAAY;MAC3D,EACC,MAAe,IAEX,mCADA,gCAEJ,MAAe,IAAwB,mBAApB,kBACpB;MACC;OACA,EAAA,CAAA,EACN,kBAAC,OAAD;KAAK,WAAU;eAyCZ,IAAa,KACZ,kBAAC,UAAD;MACE,MAAK;MACL,eAAe,EAAuB,GAAK;MAC3C,WAAU;gBAET,EAAG,2BAA2B,sBAAsB;MAC9C,CAAA;KAEP,CAAA,CACF;;GAGL,KACC,kBAAC,OAAD;IACE,MAAK;IACL,WAAU;cAFZ,CAIE,kBAAC,KAAD;KAAG,WAAU;eAA4B;KAAmB,CAAA,EAC5D,kBAAC,UAAD;KACE,MAAK;KACL,eAAe,EAAkB,KAAK;KACtC,WAAU;eACX;KAEQ,CAAA,CACL;;GAIP,KACC,kBAAC,OAAD;IACE,MAAK;IACL,WAAU;cAFZ,CAIE,kBAAC,GAAD;KACE,WAAU;KACV,eAAY;KACZ,CAAA,EACF,kBAAC,OAAD;KAAK,WAAU;eAAf,CACE,kBAAC,KAAD;MAAG,WAAU;gBAAkC;MAAU,CAAA,EACzD,kBAAC,UAAD;MACE,MAAK;MACL,eAAe,EAAS,KAAK;MAC7B,WAAU;gBACX;MAEQ,CAAA,CACL;OACF;;GAGP,IACC,kBAAC,OAAD;IACE,aAAU;IACV,aAAU;IACV,WAAU;cAHZ,CAKE,kBAAC,GAAD;KACE,WAAU;KACV,eAAY;KACZ,CAAA,EACF,kBAAC,QAAD;KAAM,WAAU;eACb,EAAG,yBAAyB,sBAAsB;KAC9C,CAAA,CACH;QACJ,EAAgB,WAAW,IAC7B,kBAAC,OAAD;IACE,WAAU;IACV,MAAK;cAFP,CAIE,kBAAC,OAAD;KAAK,WAAU;eACb,kBAAC,OAAD;MACE,WAAU;MACV,MAAK;MACL,SAAQ;MACR,QAAO;MACP,eAAY;gBAEZ,kBAAC,QAAD;OACE,eAAc;OACd,gBAAe;OACf,aAAa;OACb,GAAE;OACF,CAAA;MACE,CAAA;KACF,CAAA,EACN,kBAAC,KAAD;KAAG,WAAU;eACV,EAAG,4BAA4B,2BAA2B;KACzD,CAAA,CACA;QAEN,kBAAC,OAAD;IAAK,WAAU;IAAY,aAAU;IAAS,aAAW;cACtD,EAAgB,KAAK,MACpB,kBAAC,OAAD;KAEE,WAAU;eAEV,kBAAC,OAAD;MAAK,WAAU;gBAAf,CACE,kBAAC,OAAD;OAAK,WAAU;iBAAf,CAEE,kBAAC,OAAD;QACE,WAAU;QACV,eAAY;kBAEZ,kBAAC,OAAD;SACE,WAAU;SACV,MAAK;SACL,SAAQ;SACR,QAAO;mBAEP,kBAAC,QAAD;UACE,eAAc;UACd,gBAAe;UACf,aAAa;UACb,GAAE;UACF,CAAA;SACE,CAAA;QACF,CAAA,EAEN,kBAAC,OAAD;QAAK,WAAU;kBAAf;SACE,kBAAC,OAAD;UAAK,WAAU;oBAAf,CACE,kBAAC,MAAD;WAAI,WAAU;qBACX,EAAQ,aACT,EAAgB,EAAQ,UAAU,KAAK,mBACnC,EAAG,4BAA4B,cAAc,GAC7C,EAAgB,EAAQ,UAAU;WACnC,CAAA,EACJ,EAAQ,aACP,kBAAC,QAAD;WACE,MAAK;WACL,WAAU;qBAET,EACC,gCACA,kBACD;WACI,CAAA,CAEL;;SACN,kBAAC,KAAD;UAAG,WAAU;oBACV,EAAiB,EAAQ,UAAU,KAClC,qBAAqB,EAAQ,YAC3B,EAAG,gCAAgC,kBAAkB,GACrD,EAAiB,EAAQ,UAAU;UACrC,CAAA;SACJ,kBAAC,MAAD;UAAI,WAAU;oBAAd;WACG,EAAQ,aAAa,EAAQ,cAAc,aAC1C,kBAAC,OAAD;YAAK,WAAU;sBAAf;aACE,kBAAC,OAAD;cACE,WAAU;cACV,MAAK;cACL,SAAQ;cACR,QAAO;cACP,eAAY;wBAEZ,kBAAC,QAAD;eACE,eAAc;eACd,gBAAe;eACf,aAAa;eACb,GAAE;eACF,CAAA;cACE,CAAA;aACN,kBAAC,MAAD;cAAI,WAAU;wBAAU;cAAe,CAAA;aACvC,kBAAC,MAAD,EAAA,UAAK,EAAQ,WAAe,CAAA;aACxB;;WAEP,EAAQ,YACP,kBAAC,OAAD;YAAK,WAAU;sBAAf;aACE,kBAAC,OAAD;cACE,WAAU;cACV,MAAK;cACL,SAAQ;cACR,QAAO;cACP,eAAY;wBALd,CAOE,kBAAC,QAAD;eACE,eAAc;eACd,gBAAe;eACf,aAAa;eACb,GAAE;eACF,CAAA,EACF,kBAAC,QAAD;eACE,eAAc;eACd,gBAAe;eACf,aAAa;eACb,GAAE;eACF,CAAA,CACE;;aACN,kBAAC,MAAD;cAAI,WAAU;wBAAU;cAAa,CAAA;aACrC,kBAAC,MAAD,EAAA,UAAK,EAAQ,UAAc,CAAA;aACvB;;WAER,kBAAC,OAAD;YAAK,WAAU;sBAAf;aACE,kBAAC,OAAD;cACE,WAAU;cACV,MAAK;cACL,SAAQ;cACR,QAAO;cACP,eAAY;wBAEZ,kBAAC,QAAD;eACE,eAAc;eACd,gBAAe;eACf,aAAa;eACb,GAAE;eACF,CAAA;cACE,CAAA;aACN,kBAAC,MAAD;cAAI,WAAU;wBAAU;cAAgB,CAAA;aACxC,kBAAC,MAAD,EAAA,UAAA;cACG,EAAG,4BAA4B,cAAc;cAAE;cAC/C,EAAmB,EAAQ,eAAe;cACxC,EAAA,CAAA;aACD;;WACH;;SACD;UACF;UAEL,CAAC,EAAQ,aACR,kBAAC,UAAD;OACE,MAAK;OACL,eAAe,EAAoB,EAAQ,GAAG;OAC9C,cAAY,GAAG,EAAG,wBAAwB,SAAS,CAAC,GAAG,EAAgB,EAAQ,UAAU,CAAC;OAC1F,WAAU;iBAET,EAAG,wBAAwB,SAAS;OAC9B,CAAA,CAEP;;KACF,EAtIC,EAAQ,GAsIT,CACN;IACE,CAAA;GAIP,CAAC,KAAa,IAAa,KAC1B,kBAAC,OAAD;IAAK,WAAU;cAAf;KACE,kBAAC,UAAD;MACE,MAAK;MACL,SAAS;MACT,UAAU,MAAS;MACnB,WAAU;MACV,cAAY,EAAG,0BAA0B,gBAAgB;gBAL3D,CAOE,kBAAC,OAAD;OACE,WAAU;OACV,MAAK;OACL,SAAQ;OACR,QAAO;OACP,eAAY;iBAEZ,kBAAC,QAAD;QACE,eAAc;QACd,gBAAe;QACf,aAAa;QACb,GAAE;QACF,CAAA;OACE,CAAA,EACL,EAAG,sBAAsB,WAAW,CAC9B;;KAET,kBAAC,QAAD;MAAM,WAAU;gBAAhB;OACG,EAAG,wBAAwB,OAAO;OAAE;OACrC,kBAAC,QAAD;QAAM,WAAU;kBAAiC,IAAO;QAAS,CAAA;OAAC;OACjE,EAAG,oBAAoB,KAAK;OAAE;OAC/B,kBAAC,QAAD;QAAM,WAAU;kBAAiC;QAAkB,CAAA;OAC9D;;KAEP,kBAAC,UAAD;MACE,MAAK;MACL,SAAS;MACT,UAAU,CAAC;MACX,WAAU;MACV,cAAY,EAAG,0BAA0B,YAAY;gBALvD,CAOG,EAAG,sBAAsB,OAAO,EACjC,kBAAC,OAAD;OACE,WAAU;OACV,MAAK;OACL,SAAQ;OACR,QAAO;OACP,eAAY;iBAEZ,kBAAC,QAAD;QACE,eAAc;QACd,gBAAe;QACf,aAAa;QACb,GAAE;QACF,CAAA;OACE,CAAA,CACC;;KACL;;GAEJ;MAhaJ,kBAAC,OAAD;EAAK,WAAU;YACb,kBAAC,OAAD;GAAK,WAAU;aAAf;IACE,kBAAC,OAAD;KAAK,WAAU;eACb,kBAAC,GAAD;MACE,WAAU;MACV,eAAY;MACZ,CAAA;KACE,CAAA;IACN,kBAAC,MAAD;KAAI,WAAU;eACX,EAAG,8BAA8B,0BAA0B;KACzD,CAAA;IACL,kBAAC,KAAD;KAAG,WAAU;eACV,EACC,8BACA,8CACD;KACC,CAAA;IACA;;EACF,CAAA"}
+{"version":3,"file":"SessionsPage.js","names":[],"sources":["../../../src/auth/pages/SessionsPage.tsx"],"sourcesContent":["import { useState, useMemo } from \"react\";\nimport { useI18n } from \"@burdenoff/fe-libs/shared/providers/shell\";\nimport { useSessionOperations } from \"../hooks/useSessionOperations\";\nimport { useAuthStore } from \"../store/authStore\";\nimport { ConfirmActionDialog } from \"../components/ConfirmActionDialog\";\nimport {\n  formatRelativeTime,\n  parseDeviceName,\n  parseBrowserName,\n} from \"../utils/formatters\";\nimport { SpinnerIcon, AlertIcon } from \"../components/AuthIcons\";\n\n/**\n * Active sessions management page with professional UI\n *\n * Fragment: SessionCard_Session (src/operations/global/fragments/SessionCard.fragment.graphql)\n * Query: ActiveSessions (src/operations/global/queries/sessions.graphql)\n */\nexport function SessionsPage() {\n  const { t } = useI18n();\n  const tr = (key: string, fallback: string): string => {\n    const translated = t(key);\n    return translated === key ? fallback : translated;\n  };\n\n  const isAuthenticated = useAuthStore((state) => state.isAuthenticated);\n  const {\n    activeSessions,\n    revokeSession,\n    revokeAllSessions,\n    isLoading,\n    page,\n    totalPages,\n    totalCount,\n    hasMore,\n    goToNextPage,\n    goToPrevPage,\n  } = useSessionOperations({ disableTokenInfoQuery: true, pageSize: 20 });\n\n  // One entry per device: keep the most-recently-active session for each device name\n  const dedupedSessions = useMemo(() => {\n    const byDevice = new Map<string, (typeof activeSessions)[number]>();\n    for (const s of activeSessions) {\n      const device = parseDeviceName(s.userAgent ?? \"\");\n      const existing = byDevice.get(device);\n      if (\n        !existing ||\n        new Date(s.lastActivityAt) > new Date(existing.lastActivityAt)\n      ) {\n        byDevice.set(device, s);\n      }\n    }\n    return [...byDevice.values()];\n  }, [activeSessions]);\n\n  const [error, setError] = useState<string | null>(null);\n  const [successMessage, setSuccessMessage] = useState<string | null>(null);\n  const [pendingSessionId, setPendingSessionId] = useState<string | null>(null);\n  const [showRevokeAllDialog, setShowRevokeAllDialog] = useState(false);\n\n  const handleRevokeSession = async (sessionId: string) => {\n    try {\n      await revokeSession(sessionId);\n      setSuccessMessage(\"Session revoked successfully\");\n      setPendingSessionId(null);\n    } catch (err) {\n      setError(err instanceof Error ? err.message : \"Failed to revoke session\");\n    }\n  };\n\n  const handleRevokeAll = async () => {\n    try {\n      await revokeAllSessions();\n      setSuccessMessage(\"All other sessions have been revoked\");\n      setShowRevokeAllDialog(false);\n    } catch (err) {\n      setError(\n        err instanceof Error ? err.message : \"Failed to revoke all sessions\",\n      );\n    }\n  };\n\n  if (!isAuthenticated) {\n    return (\n      <div className=\"max-w-4xl mx-auto p-6\">\n        <div className=\"text-center py-16 border-2 border-dashed border-border-subtle rounded-xl\">\n          <div className=\"size-16 mx-auto mb-4 rounded-full bg-status-warning-bg-subtle flex items-center justify-center\">\n            <AlertIcon\n              className=\"size-8 text-status-warning-text\"\n              aria-hidden=\"true\"\n            />\n          </div>\n          <h2 className=\"text-xl font-semibold text-text-primary mb-2\">\n            {tr(\"auth.sessions.authRequired\", \"Authentication Required\")}\n          </h2>\n          <p className=\"text-text-secondary\">\n            {tr(\n              \"auth.sessions.signInToView\",\n              \"Please sign in to view your active sessions\",\n            )}\n          </p>\n        </div>\n      </div>\n    );\n  }\n\n  return (\n    <div className=\"max-w-4xl mx-auto p-6\">\n      <ConfirmActionDialog\n        open={pendingSessionId !== null}\n        onOpenChange={(open) => {\n          if (!open) {\n            setPendingSessionId(null);\n          }\n        }}\n        title=\"Revoke this session?\"\n        description=\"The selected device will be signed out immediately and will need to authenticate again.\"\n        confirmText=\"Revoke session\"\n        variant=\"danger\"\n        isPending={isLoading}\n        onConfirm={async () => {\n          if (pendingSessionId) {\n            await handleRevokeSession(pendingSessionId);\n          }\n        }}\n      />\n      <ConfirmActionDialog\n        open={showRevokeAllDialog}\n        onOpenChange={setShowRevokeAllDialog}\n        title=\"Revoke every other session?\"\n        description=\"All devices except your current one will be signed out immediately.\"\n        confirmText=\"Revoke all other sessions\"\n        variant=\"warning\"\n        isPending={isLoading}\n        onConfirm={handleRevokeAll}\n      />\n\n      {/* Live regions for screen reader announcements */}\n      <div aria-live=\"polite\" aria-atomic=\"true\" className=\"sr-only\">\n        {successMessage}\n      </div>\n      <div\n        role=\"alert\"\n        aria-live=\"assertive\"\n        aria-atomic=\"true\"\n        className=\"sr-only\"\n      >\n        {error}\n      </div>\n\n      {/* Header */}\n      <div className=\"flex items-center justify-between mb-8\">\n        <div>\n          <h1 className=\"text-3xl font-semibold text-text-primary\">\n            {tr(\"auth.sessions.title\", \"Active Sessions\")}\n          </h1>\n          <p className=\"text-text-secondary mt-2\">\n            {tr(\"auth.sessions.sessionCount\", \"You have\")} {totalCount}{\" \"}\n            {tr(\n              totalCount !== 1\n                ? \"auth.sessions.sessionsPlural\"\n                : \"auth.sessions.sessionsSingular\",\n              totalCount !== 1 ? \"active sessions\" : \"active session\",\n            )}\n          </p>\n        </div>\n        <div className=\"flex items-center gap-3\">\n          {/* Export button — commented out until wspace-export-svc is wired for auth_sessions\n          <button\n            type=\"button\"\n            onClick={handleExport}\n            disabled={isExporting}\n            aria-label={tr(\n              \"auth.sessions.exportAriaLabel\",\n              \"Export sessions data\",\n            )}\n            className=\"flex items-center gap-2 px-4 py-2.5 rounded-xl border border-border-default text-text-primary font-medium hover:bg-bg-sunken disabled:opacity-50 disabled:cursor-not-allowed transition-colors duration-200\"\n          >\n            {isExporting ? (\n              <>\n                <SpinnerIcon\n                  className=\"size-4 animate-spin\"\n                  aria-hidden=\"true\"\n                />\n                {tr(\"auth.sessions.exporting\", \"Exporting...\")}\n              </>\n            ) : (\n              <>\n                <svg\n                  className=\"size-4\"\n                  fill=\"none\"\n                  viewBox=\"0 0 24 24\"\n                  stroke=\"currentColor\"\n                  aria-hidden=\"true\"\n                >\n                  <path\n                    strokeLinecap=\"round\"\n                    strokeLinejoin=\"round\"\n                    strokeWidth={2}\n                    d=\"M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1m-4-4l-4 4m0 0l-4-4m4 4V4\"\n                  />\n                </svg>\n                {tr(\"auth.sessions.export\", \"Export\")}\n              </>\n            )}\n          </button>\n          */}\n          {totalCount > 1 && (\n            <button\n              type=\"button\"\n              onClick={() => setShowRevokeAllDialog(true)}\n              className=\"px-4 py-2.5 rounded-xl border border-status-error-border text-status-error-text font-medium hover:bg-status-error-bg-subtle transition-colors duration-200\"\n            >\n              {tr(\"auth.sessions.revokeAll\", \"Revoke All Sessions\")}\n            </button>\n          )}\n        </div>\n      </div>\n\n      {/* Success Message */}\n      {successMessage && (\n        <output\n          className=\"block mb-6 p-4 rounded-xl bg-status-success-bg-subtle border border-status-success-border\"\n        >\n          <p className=\"text-status-success-text\">{successMessage}</p>\n          <button\n            type=\"button\"\n            onClick={() => setSuccessMessage(null)}\n            className=\"mt-2 text-sm text-status-success-text hover:underline transition-colors duration-200\"\n          >\n            Dismiss\n          </button>\n        </output>\n      )}\n\n      {/* Error Message */}\n      {error && (\n        <div\n          role=\"alert\"\n          className=\"mb-6 flex items-start gap-3 p-4 rounded-xl bg-status-error-bg-subtle border border-status-error-border\"\n        >\n          <AlertIcon\n            className=\"size-5 text-status-error-text flex-shrink-0 mt-0.5\"\n            aria-hidden=\"true\"\n          />\n          <div className=\"flex-1\">\n            <p className=\"text-sm text-status-error-text\">{error}</p>\n            <button\n              type=\"button\"\n              onClick={() => setError(null)}\n              className=\"mt-2 text-sm text-status-error-text hover:underline transition-colors duration-200\"\n            >\n              Dismiss\n            </button>\n          </div>\n        </div>\n      )}\n\n      {isLoading ? (\n        <div\n          aria-live=\"polite\"\n          aria-busy=\"true\"\n          className=\"flex items-center justify-center py-12\"\n        >\n          <SpinnerIcon\n            className=\"size-8 text-text-link animate-spin\"\n            aria-hidden=\"true\"\n          />\n          <span className=\"ml-3 text-text-secondary\">\n            {tr(\"auth.sessions.loading\", \"Loading sessions...\")}\n          </span>\n        </div>\n      ) : dedupedSessions.length === 0 ? (\n        <output\n          className=\"block text-center py-16 border-2 border-dashed border-border-subtle rounded-xl\"\n        >\n          <div className=\"size-16 mx-auto mb-4 rounded-full bg-bg-muted flex items-center justify-center\">\n            <svg\n              className=\"size-8 text-text-tertiary\"\n              fill=\"none\"\n              viewBox=\"0 0 24 24\"\n              stroke=\"currentColor\"\n              aria-hidden=\"true\"\n            >\n              <path\n                strokeLinecap=\"round\"\n                strokeLinejoin=\"round\"\n                strokeWidth={1.5}\n                d=\"M9.75 17L9 20l-1 1h8l-1-1-.75-3M3 13h18M5 17h14a2 2 0 002-2V5a2 2 0 00-2-2H5a2 2 0 00-2 2v10a2 2 0 002 2z\"\n              />\n            </svg>\n          </div>\n          <p className=\"text-text-secondary\">\n            {tr(\"auth.sessions.noSessions\", \"No active sessions found\")}\n          </p>\n        </output>\n      ) : (\n        <div className=\"space-y-4\" aria-live=\"polite\" aria-busy={isLoading}>\n          {dedupedSessions.map((session) => (\n            <div\n              key={session.id}\n              className=\"p-6 rounded-xl border border-border-default bg-bg-surface shadow-sm hover:shadow-md transition-shadow\"\n            >\n              <div className=\"flex items-start justify-between\">\n                <div className=\"flex items-start gap-4\">\n                  {/* Device Icon */}\n                  <div\n                    className=\"size-12 rounded-xl bg-bg-accent flex items-center justify-center flex-shrink-0\"\n                    aria-hidden=\"true\"\n                  >\n                    <svg\n                      className=\"size-6 text-text-link\"\n                      fill=\"none\"\n                      viewBox=\"0 0 24 24\"\n                      stroke=\"currentColor\"\n                    >\n                      <path\n                        strokeLinecap=\"round\"\n                        strokeLinejoin=\"round\"\n                        strokeWidth={1.5}\n                        d=\"M9.75 17L9 20l-1 1h8l-1-1-.75-3M3 13h18M5 17h14a2 2 0 002-2V5a2 2 0 00-2-2H5a2 2 0 00-2 2v10a2 2 0 002 2z\"\n                      />\n                    </svg>\n                  </div>\n\n                  <div className=\"flex-1\">\n                    <div className=\"flex items-center gap-3 mb-1\">\n                      <h3 className=\"text-lg font-semibold text-text-primary\">\n                        {session.isCurrent &&\n                        parseDeviceName(session.userAgent) === \"Unknown Device\"\n                          ? tr(\"auth.sessions.thisDevice\", \"This Device\")\n                          : parseDeviceName(session.userAgent)}\n                      </h3>\n                      {session.isCurrent && (\n                        <output\n                          className=\"px-2.5 py-1 rounded-full bg-status-success-bg-subtle text-status-success-text text-xs font-medium\"\n                        >\n                          {tr(\n                            \"auth.sessions.currentSession\",\n                            \"Current Session\",\n                          )}\n                        </output>\n                      )}\n                    </div>\n                    <p className=\"text-sm text-text-secondary mb-2\">\n                      {parseBrowserName(session.userAgent) ===\n                        \"Unknown Browser\" && session.isCurrent\n                        ? tr(\"auth.sessions.currentBrowser\", \"Current Browser\")\n                        : parseBrowserName(session.userAgent)}\n                    </p>\n                    <dl className=\"flex flex-wrap gap-4 text-sm text-text-secondary\">\n                      {session.ipAddress && session.ipAddress !== \"unknown\" && (\n                        <div className=\"flex items-center gap-1.5\">\n                          <svg\n                            className=\"size-4\"\n                            fill=\"none\"\n                            viewBox=\"0 0 24 24\"\n                            stroke=\"currentColor\"\n                            aria-hidden=\"true\"\n                          >\n                            <path\n                              strokeLinecap=\"round\"\n                              strokeLinejoin=\"round\"\n                              strokeWidth={2}\n                              d=\"M21 12a9 9 0 01-9 9m9-9a9 9 0 00-9-9m9 9H3m9 9a9 9 0 01-9-9m9 9c1.657 0 3-4.03 3-9s-1.343-9-3-9m0 18c-1.657 0-3-4.03-3-9s1.343-9 3-9m-9 9a9 9 0 019-9\"\n                            />\n                          </svg>\n                          <dt className=\"sr-only\">IP address</dt>\n                          <dd>{session.ipAddress}</dd>\n                        </div>\n                      )}\n                      {session.location && (\n                        <div className=\"flex items-center gap-1.5\">\n                          <svg\n                            className=\"size-4\"\n                            fill=\"none\"\n                            viewBox=\"0 0 24 24\"\n                            stroke=\"currentColor\"\n                            aria-hidden=\"true\"\n                          >\n                            <path\n                              strokeLinecap=\"round\"\n                              strokeLinejoin=\"round\"\n                              strokeWidth={2}\n                              d=\"M17.657 16.657L13.414 20.9a1.998 1.998 0 01-2.827 0l-4.244-4.243a8 8 0 1111.314 0z\"\n                            />\n                            <path\n                              strokeLinecap=\"round\"\n                              strokeLinejoin=\"round\"\n                              strokeWidth={2}\n                              d=\"M15 11a3 3 0 11-6 0 3 3 0 016 0z\"\n                            />\n                          </svg>\n                          <dt className=\"sr-only\">Location</dt>\n                          <dd>{session.location}</dd>\n                        </div>\n                      )}\n                      <div className=\"flex items-center gap-1.5\">\n                        <svg\n                          className=\"size-4\"\n                          fill=\"none\"\n                          viewBox=\"0 0 24 24\"\n                          stroke=\"currentColor\"\n                          aria-hidden=\"true\"\n                        >\n                          <path\n                            strokeLinecap=\"round\"\n                            strokeLinejoin=\"round\"\n                            strokeWidth={2}\n                            d=\"M12 8v4l3 3m6-3a9 9 0 11-18 0 9 9 0 0118 0z\"\n                          />\n                        </svg>\n                        <dt className=\"sr-only\">Last active</dt>\n                        <dd>\n                          {tr(\"auth.sessions.lastActive\", \"Last active\")}{\" \"}\n                          {formatRelativeTime(session.lastActivityAt)}\n                        </dd>\n                      </div>\n                    </dl>\n                  </div>\n                </div>\n\n                {!session.isCurrent && (\n                  <button\n                    type=\"button\"\n                    onClick={() => setPendingSessionId(session.id)}\n                    aria-label={`${tr(\"auth.sessions.revoke\", \"Revoke\")} ${parseDeviceName(session.userAgent)} session`}\n                    className=\"ml-4 px-4 py-2 rounded-lg text-sm font-medium border border-status-error-border text-status-error-text bg-bg-surface hover:bg-status-error-bg-subtle transition-colors duration-200\"\n                  >\n                    {tr(\"auth.sessions.revoke\", \"Revoke\")}\n                  </button>\n                )}\n              </div>\n            </div>\n          ))}\n        </div>\n      )}\n\n      {/* Pagination controls */}\n      {!isLoading && totalPages > 1 && (\n        <div className=\"flex items-center justify-between mt-6 pt-4 border-t border-border-subtle\">\n          <button\n            type=\"button\"\n            onClick={goToPrevPage}\n            disabled={page === 0}\n            className=\"flex items-center gap-2 px-4 py-2 rounded-lg border border-border-default text-text-primary bg-bg-surface hover:bg-bg-sunken disabled:opacity-40 disabled:cursor-not-allowed transition-colors font-medium text-sm\"\n            aria-label={tr(\"auth.sessions.prevPage\", \"Previous page\")}\n          >\n            <svg\n              className=\"size-4\"\n              fill=\"none\"\n              viewBox=\"0 0 24 24\"\n              stroke=\"currentColor\"\n              aria-hidden=\"true\"\n            >\n              <path\n                strokeLinecap=\"round\"\n                strokeLinejoin=\"round\"\n                strokeWidth={2}\n                d=\"M15 19l-7-7 7-7\"\n              />\n            </svg>\n            {tr(\"auth.sessions.prev\", \"Previous\")}\n          </button>\n\n          <span className=\"text-sm text-text-secondary\">\n            {tr(\"auth.sessions.pageOf\", \"Page\")}{\" \"}\n            <span className=\"font-medium text-text-primary\">{page + 1}</span>{\" \"}\n            {tr(\"auth.sessions.of\", \"of\")}{\" \"}\n            <span className=\"font-medium text-text-primary\">{totalPages}</span>\n          </span>\n\n          <button\n            type=\"button\"\n            onClick={goToNextPage}\n            disabled={!hasMore}\n            className=\"flex items-center gap-2 px-4 py-2 rounded-lg border border-border-default text-text-primary bg-bg-surface hover:bg-bg-sunken disabled:opacity-40 disabled:cursor-not-allowed transition-colors font-medium text-sm\"\n            aria-label={tr(\"auth.sessions.nextPage\", \"Next page\")}\n          >\n            {tr(\"auth.sessions.next\", \"Next\")}\n            <svg\n              className=\"size-4\"\n              fill=\"none\"\n              viewBox=\"0 0 24 24\"\n              stroke=\"currentColor\"\n              aria-hidden=\"true\"\n            >\n              <path\n                strokeLinecap=\"round\"\n                strokeLinejoin=\"round\"\n                strokeWidth={2}\n                d=\"M9 5l7 7-7 7\"\n              />\n            </svg>\n          </button>\n        </div>\n      )}\n    </div>\n  );\n}\n"],"mappings":";;;;;;;;;AAkBA,SAAgB,IAAe;CAC7B,IAAM,EAAE,SAAM,GAAS,EACjB,KAAM,GAAa,MAA6B;EACpD,IAAM,IAAa,EAAE,EAAI;AACzB,SAAO,MAAe,IAAM,IAAW;IAGnC,IAAkB,GAAc,MAAU,EAAM,gBAAgB,EAChE,EACJ,mBACA,kBACA,sBACA,cACA,SACA,eACA,eACA,YACA,iBACA,oBACE,EAAqB;EAAE,uBAAuB;EAAM,UAAU;EAAI,CAAC,EAGjE,IAAkB,QAAc;EACpC,IAAM,oBAAW,IAAI,KAA8C;AACnE,OAAK,IAAM,KAAK,GAAgB;GAC9B,IAAM,IAAS,EAAgB,EAAE,aAAa,GAAG,EAC3C,IAAW,EAAS,IAAI,EAAO;AACrC,IACE,CAAC,KACD,IAAI,KAAK,EAAE,eAAe,GAAG,IAAI,KAAK,EAAS,eAAe,KAE9D,EAAS,IAAI,GAAQ,EAAE;;AAG3B,SAAO,CAAC,GAAG,EAAS,QAAQ,CAAC;IAC5B,CAAC,EAAe,CAAC,EAEd,CAAC,GAAO,KAAY,EAAwB,KAAK,EACjD,CAAC,GAAgB,KAAqB,EAAwB,KAAK,EACnE,CAAC,GAAkB,KAAuB,EAAwB,KAAK,EACvE,CAAC,GAAqB,KAA0B,EAAS,GAAM,EAE/D,IAAsB,OAAO,MAAsB;AACvD,MAAI;AAGF,GAFA,MAAM,EAAc,EAAU,EAC9B,EAAkB,+BAA+B,EACjD,EAAoB,KAAK;WAClB,GAAK;AACZ,KAAS,aAAe,QAAQ,EAAI,UAAU,2BAA2B;;;AAwC7E,QAxBK,IAyBH,kBAAC,OAAD;EAAK,WAAU;YAAf;GACE,kBAAC,GAAD;IACE,MAAM,MAAqB;IAC3B,eAAe,MAAS;AACtB,KAAK,KACH,EAAoB,KAAK;;IAG7B,OAAM;IACN,aAAY;IACZ,aAAY;IACZ,SAAQ;IACR,WAAW;IACX,WAAW,YAAY;AACrB,KAAI,KACF,MAAM,EAAoB,EAAiB;;IAG/C,CAAA;GACF,kBAAC,GAAD;IACE,MAAM;IACN,cAAc;IACd,OAAM;IACN,aAAY;IACZ,aAAY;IACZ,SAAQ;IACR,WAAW;IACX,WAhEkB,YAAY;AAClC,SAAI;AAGF,MAFA,MAAM,GAAmB,EACzB,EAAkB,uCAAuC,EACzD,EAAuB,GAAM;cACtB,GAAK;AACZ,QACE,aAAe,QAAQ,EAAI,UAAU,gCACtC;;;IAyDC,CAAA;GAGF,kBAAC,OAAD;IAAK,aAAU;IAAS,eAAY;IAAO,WAAU;cAClD;IACG,CAAA;GACN,kBAAC,OAAD;IACE,MAAK;IACL,aAAU;IACV,eAAY;IACZ,WAAU;cAET;IACG,CAAA;GAGN,kBAAC,OAAD;IAAK,WAAU;cAAf,CACE,kBAAC,OAAD,EAAA,UAAA,CACE,kBAAC,MAAD;KAAI,WAAU;eACX,EAAG,uBAAuB,kBAAkB;KAC1C,CAAA,EACL,kBAAC,KAAD;KAAG,WAAU;eAAb;MACG,EAAG,8BAA8B,WAAW;MAAC;MAAE;MAAY;MAC3D,EACC,MAAe,IAEX,mCADA,gCAEJ,MAAe,IAAwB,mBAApB,kBACpB;MACC;OACA,EAAA,CAAA,EACN,kBAAC,OAAD;KAAK,WAAU;eAyCZ,IAAa,KACZ,kBAAC,UAAD;MACE,MAAK;MACL,eAAe,EAAuB,GAAK;MAC3C,WAAU;gBAET,EAAG,2BAA2B,sBAAsB;MAC9C,CAAA;KAEP,CAAA,CACF;;GAGL,KACC,kBAAC,UAAD;IACE,WAAU;cADZ,CAGE,kBAAC,KAAD;KAAG,WAAU;eAA4B;KAAmB,CAAA,EAC5D,kBAAC,UAAD;KACE,MAAK;KACL,eAAe,EAAkB,KAAK;KACtC,WAAU;eACX;KAEQ,CAAA,CACF;;GAIV,KACC,kBAAC,OAAD;IACE,MAAK;IACL,WAAU;cAFZ,CAIE,kBAAC,GAAD;KACE,WAAU;KACV,eAAY;KACZ,CAAA,EACF,kBAAC,OAAD;KAAK,WAAU;eAAf,CACE,kBAAC,KAAD;MAAG,WAAU;gBAAkC;MAAU,CAAA,EACzD,kBAAC,UAAD;MACE,MAAK;MACL,eAAe,EAAS,KAAK;MAC7B,WAAU;gBACX;MAEQ,CAAA,CACL;OACF;;GAGP,IACC,kBAAC,OAAD;IACE,aAAU;IACV,aAAU;IACV,WAAU;cAHZ,CAKE,kBAAC,GAAD;KACE,WAAU;KACV,eAAY;KACZ,CAAA,EACF,kBAAC,QAAD;KAAM,WAAU;eACb,EAAG,yBAAyB,sBAAsB;KAC9C,CAAA,CACH;QACJ,EAAgB,WAAW,IAC7B,kBAAC,UAAD;IACE,WAAU;cADZ,CAGE,kBAAC,OAAD;KAAK,WAAU;eACb,kBAAC,OAAD;MACE,WAAU;MACV,MAAK;MACL,SAAQ;MACR,QAAO;MACP,eAAY;gBAEZ,kBAAC,QAAD;OACE,eAAc;OACd,gBAAe;OACf,aAAa;OACb,GAAE;OACF,CAAA;MACE,CAAA;KACF,CAAA,EACN,kBAAC,KAAD;KAAG,WAAU;eACV,EAAG,4BAA4B,2BAA2B;KACzD,CAAA,CACG;QAET,kBAAC,OAAD;IAAK,WAAU;IAAY,aAAU;IAAS,aAAW;cACtD,EAAgB,KAAK,MACpB,kBAAC,OAAD;KAEE,WAAU;eAEV,kBAAC,OAAD;MAAK,WAAU;gBAAf,CACE,kBAAC,OAAD;OAAK,WAAU;iBAAf,CAEE,kBAAC,OAAD;QACE,WAAU;QACV,eAAY;kBAEZ,kBAAC,OAAD;SACE,WAAU;SACV,MAAK;SACL,SAAQ;SACR,QAAO;mBAEP,kBAAC,QAAD;UACE,eAAc;UACd,gBAAe;UACf,aAAa;UACb,GAAE;UACF,CAAA;SACE,CAAA;QACF,CAAA,EAEN,kBAAC,OAAD;QAAK,WAAU;kBAAf;SACE,kBAAC,OAAD;UAAK,WAAU;oBAAf,CACE,kBAAC,MAAD;WAAI,WAAU;qBACX,EAAQ,aACT,EAAgB,EAAQ,UAAU,KAAK,mBACnC,EAAG,4BAA4B,cAAc,GAC7C,EAAgB,EAAQ,UAAU;WACnC,CAAA,EACJ,EAAQ,aACP,kBAAC,UAAD;WACE,WAAU;qBAET,EACC,gCACA,kBACD;WACM,CAAA,CAEP;;SACN,kBAAC,KAAD;UAAG,WAAU;oBACV,EAAiB,EAAQ,UAAU,KAClC,qBAAqB,EAAQ,YAC3B,EAAG,gCAAgC,kBAAkB,GACrD,EAAiB,EAAQ,UAAU;UACrC,CAAA;SACJ,kBAAC,MAAD;UAAI,WAAU;oBAAd;WACG,EAAQ,aAAa,EAAQ,cAAc,aAC1C,kBAAC,OAAD;YAAK,WAAU;sBAAf;aACE,kBAAC,OAAD;cACE,WAAU;cACV,MAAK;cACL,SAAQ;cACR,QAAO;cACP,eAAY;wBAEZ,kBAAC,QAAD;eACE,eAAc;eACd,gBAAe;eACf,aAAa;eACb,GAAE;eACF,CAAA;cACE,CAAA;aACN,kBAAC,MAAD;cAAI,WAAU;wBAAU;cAAe,CAAA;aACvC,kBAAC,MAAD,EAAA,UAAK,EAAQ,WAAe,CAAA;aACxB;;WAEP,EAAQ,YACP,kBAAC,OAAD;YAAK,WAAU;sBAAf;aACE,kBAAC,OAAD;cACE,WAAU;cACV,MAAK;cACL,SAAQ;cACR,QAAO;cACP,eAAY;wBALd,CAOE,kBAAC,QAAD;eACE,eAAc;eACd,gBAAe;eACf,aAAa;eACb,GAAE;eACF,CAAA,EACF,kBAAC,QAAD;eACE,eAAc;eACd,gBAAe;eACf,aAAa;eACb,GAAE;eACF,CAAA,CACE;;aACN,kBAAC,MAAD;cAAI,WAAU;wBAAU;cAAa,CAAA;aACrC,kBAAC,MAAD,EAAA,UAAK,EAAQ,UAAc,CAAA;aACvB;;WAER,kBAAC,OAAD;YAAK,WAAU;sBAAf;aACE,kBAAC,OAAD;cACE,WAAU;cACV,MAAK;cACL,SAAQ;cACR,QAAO;cACP,eAAY;wBAEZ,kBAAC,QAAD;eACE,eAAc;eACd,gBAAe;eACf,aAAa;eACb,GAAE;eACF,CAAA;cACE,CAAA;aACN,kBAAC,MAAD;cAAI,WAAU;wBAAU;cAAgB,CAAA;aACxC,kBAAC,MAAD,EAAA,UAAA;cACG,EAAG,4BAA4B,cAAc;cAAE;cAC/C,EAAmB,EAAQ,eAAe;cACxC,EAAA,CAAA;aACD;;WACH;;SACD;UACF;UAEL,CAAC,EAAQ,aACR,kBAAC,UAAD;OACE,MAAK;OACL,eAAe,EAAoB,EAAQ,GAAG;OAC9C,cAAY,GAAG,EAAG,wBAAwB,SAAS,CAAC,GAAG,EAAgB,EAAQ,UAAU,CAAC;OAC1F,WAAU;iBAET,EAAG,wBAAwB,SAAS;OAC9B,CAAA,CAEP;;KACF,EArIC,EAAQ,GAqIT,CACN;IACE,CAAA;GAIP,CAAC,KAAa,IAAa,KAC1B,kBAAC,OAAD;IAAK,WAAU;cAAf;KACE,kBAAC,UAAD;MACE,MAAK;MACL,SAAS;MACT,UAAU,MAAS;MACnB,WAAU;MACV,cAAY,EAAG,0BAA0B,gBAAgB;gBAL3D,CAOE,kBAAC,OAAD;OACE,WAAU;OACV,MAAK;OACL,SAAQ;OACR,QAAO;OACP,eAAY;iBAEZ,kBAAC,QAAD;QACE,eAAc;QACd,gBAAe;QACf,aAAa;QACb,GAAE;QACF,CAAA;OACE,CAAA,EACL,EAAG,sBAAsB,WAAW,CAC9B;;KAET,kBAAC,QAAD;MAAM,WAAU;gBAAhB;OACG,EAAG,wBAAwB,OAAO;OAAE;OACrC,kBAAC,QAAD;QAAM,WAAU;kBAAiC,IAAO;QAAS,CAAA;OAAC;OACjE,EAAG,oBAAoB,KAAK;OAAE;OAC/B,kBAAC,QAAD;QAAM,WAAU;kBAAiC;QAAkB,CAAA;OAC9D;;KAEP,kBAAC,UAAD;MACE,MAAK;MACL,SAAS;MACT,UAAU,CAAC;MACX,WAAU;MACV,cAAY,EAAG,0BAA0B,YAAY;gBALvD,CAOG,EAAG,sBAAsB,OAAO,EACjC,kBAAC,OAAD;OACE,WAAU;OACV,MAAK;OACL,SAAQ;OACR,QAAO;OACP,eAAY;iBAEZ,kBAAC,QAAD;QACE,eAAc;QACd,gBAAe;QACf,aAAa;QACb,GAAE;QACF,CAAA;OACE,CAAA,CACC;;KACL;;GAEJ;MA7ZJ,kBAAC,OAAD;EAAK,WAAU;YACb,kBAAC,OAAD;GAAK,WAAU;aAAf;IACE,kBAAC,OAAD;KAAK,WAAU;eACb,kBAAC,GAAD;MACE,WAAU;MACV,eAAY;MACZ,CAAA;KACE,CAAA;IACN,kBAAC,MAAD;KAAI,WAAU;eACX,EAAG,8BAA8B,0BAA0B;KACzD,CAAA;IACL,kBAAC,KAAD;KAAG,WAAU;eACV,EACC,8BACA,8CACD;KACC,CAAA;IACA;;EACF,CAAA"}

package/dist/auth/pages/SsoCallbackPage.js

@@ -35,6 +35,7 @@ function p() {
 				h(n || "/dashboard", { replace: !0 });
 			}, 1500);
 		}, n = async (e, t) => {
+			let n = sessionStorage.getItem("oidc_redirect");
 			if (x()) {
 				if (!t) throw Error("State parameter is required for external OIDC flow");
 				let n = await S(e, t);
@@ -47,20 +48,22 @@ function p() {
 				return;
 			}
 			if (t && !b(t)) throw Error("Invalid state parameter. This may be a CSRF attack. Please try logging in again.");
-			let n = await y(e, sessionStorage.getItem("oidc_client_id") || "default-client", window.location.origin + "/auth/sso/callback");
-			if (!n.success) throw Error(n.error || "Failed to exchange authorization code");
-			if (n.requiresMFA && n.mfaChallengeId) {
-				sessionStorage.setItem("mfa_challenge_id", n.mfaChallengeId), sessionStorage.setItem("mfa_redirect", sessionStorage.getItem("oidc_redirect") || "/dashboard"), sessionStorage.removeItem("oidc_redirect"), sessionStorage.removeItem("oidc_client_id"), h("/auth/mfa-verify", { replace: !0 });
+			let r = await y(e, sessionStorage.getItem("oidc_client_id") || "default-client", window.location.origin + "/auth/sso/callback");
+			if (!r.success) throw Error(r.error || "Failed to exchange authorization code");
+			if (r.requiresMFA && r.mfaChallengeId) {
+				sessionStorage.setItem("mfa_challenge_id", r.mfaChallengeId), sessionStorage.setItem("mfa_redirect", n || "/dashboard"), sessionStorage.removeItem("oidc_redirect"), sessionStorage.removeItem("oidc_client_id"), h("/auth/mfa-verify", { replace: !0 });
 				return;
 			}
 			E("success");
-			let r = sessionStorage.getItem("oidc_redirect") || "/dashboard";
+			let i = n || "/dashboard";
 			sessionStorage.removeItem("oidc_redirect"), sessionStorage.removeItem("oidc_client_id"), A.current = setTimeout(() => {
-				h(r, { replace: !0 });
+				h(i, { replace: !0 });
 			}, 1500);
 		};
-		return e(), () => {
-			A.current &&= (clearTimeout(A.current), null);
+		e();
+		let r = A;
+		return () => {
+			r.current &&= (clearTimeout(r.current), null);
 		};
 	}, [
 		g,

package/dist/auth/pages/SsoCallbackPage.js.map

@@ -1 +1 @@
-{"version":3,"file":"SsoCallbackPage.js","names":[],"sources":["../../../src/auth/pages/SsoCallbackPage.tsx"],"sourcesContent":["import { useEffect, useState, useRef } from \"react\";\nimport { useI18n } from \"@burdenoff/fe-libs/shared/providers/shell\";\nimport { useNavigate, useSearchParams } from \"react-router-dom\";\nimport { useAuthStore } from \"../store/authStore\";\nimport { useSsoOperations } from \"../hooks/useSsoOperations\";\nimport { SpinnerIcon, AlertIcon } from \"../components/AuthIcons\";\n\n/**\n * SSO Callback Page\n * Handles redirects from:\n * - SAML ACS server (with token/refreshToken in query params)\n * - OIDC Authorization Server (with code/state in query params)\n */\nexport function SsoCallbackPage() {\n  const { t } = useI18n();\n  const tr = (key: string, fallback: string): string => {\n    const translated = t(key);\n    return translated === key ? fallback : translated;\n  };\n\n  const navigate = useNavigate();\n  const [searchParams] = useSearchParams();\n  const setAuthTokens = useAuthStore((state) => state.setAuthTokens);\n  const setAuthenticated = useAuthStore((state) => state.setAuthenticated);\n  const {\n    exchangeOidcCode,\n    validateOidcState,\n    isExternalOidcCallback,\n    handleExternalOidcCallback,\n  } = useSsoOperations();\n\n  const [error, setError] = useState<string | null>(null);\n  const [status, setStatus] = useState<\"processing\" | \"success\" | \"error\">(\n    \"processing\",\n  );\n  const [callbackType, setCallbackType] = useState<\"saml\" | \"oidc\" | \"unknown\">(\n    \"unknown\",\n  );\n  const processedRef = useRef(false);\n  const redirectTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);\n\n  useEffect(() => {\n    // Prevent double execution in React StrictMode\n    if (processedRef.current) {\n      return;\n    }\n    processedRef.current = true;\n\n    const processCallback = async () => {\n      try {\n        // Check for error from either SSO provider\n        const errorParam = searchParams.get(\"error\");\n        const errorMessage =\n          searchParams.get(\"message\") || searchParams.get(\"error_description\");\n\n        if (errorParam) {\n          throw new Error(\n            errorMessage || `SSO authentication failed: ${errorParam}`,\n          );\n        }\n\n        // Detect callback type based on query parameters\n        const token = searchParams.get(\"token\");\n        const code = searchParams.get(\"code\");\n        const state = searchParams.get(\"state\");\n\n        if (token) {\n          // SAML callback - token already exchanged by ACS server\n          setCallbackType(\"saml\");\n          await handleSamlCallback(token);\n        } else if (code) {\n          // OIDC callback - need to exchange code for tokens\n          setCallbackType(\"oidc\");\n          await handleOidcCallback(code, state);\n        } else {\n          throw new Error(\n            \"Invalid SSO callback. No token or authorization code received.\",\n          );\n        }\n      } catch (err) {\n        console.error(\"[SSO Callback] Error:\", err);\n        setError(\n          err instanceof Error ? err.message : \"Failed to process SSO response\",\n        );\n        setStatus(\"error\");\n      }\n    };\n\n    /**\n     * Handle SAML callback from ACS server\n     * Token is already exchanged, just store and redirect\n     * Also handles MFA if required\n     */\n    const handleSamlCallback = async (token: string) => {\n      const refreshToken = searchParams.get(\"refreshToken\");\n      const redirect = searchParams.get(\"redirect\");\n      const requiresMFA = searchParams.get(\"requiresMFA\") === \"true\";\n      const mfaChallengeId = searchParams.get(\"mfaChallengeId\");\n\n      // Check if MFA is required\n      if (requiresMFA && mfaChallengeId) {\n        // Store partial auth state and MFA info\n        sessionStorage.setItem(\"mfa_challenge_id\", mfaChallengeId);\n        sessionStorage.setItem(\"mfa_pending_token\", token);\n        sessionStorage.setItem(\"mfa_pending_refresh\", refreshToken || \"\");\n        sessionStorage.setItem(\"mfa_redirect\", redirect || \"/dashboard\");\n\n        // Redirect to MFA verification\n        navigate(\"/auth/mfa-verify\", { replace: true });\n        return;\n      }\n\n      // Store tokens\n      setAuthTokens(token, refreshToken || \"\");\n      setAuthenticated(true);\n\n      setStatus(\"success\");\n\n      // Redirect to the specified URL or default to dashboard\n      redirectTimerRef.current = setTimeout(() => {\n        const redirectUrl = redirect || \"/dashboard\";\n        navigate(redirectUrl, { replace: true });\n      }, 1500);\n    };\n\n    /**\n     * Handle OIDC callback - exchange code for tokens\n     */\n    const handleOidcCallback = async (code: string, state: string | null) => {\n      const isExternal = isExternalOidcCallback();\n\n      // Check if this is an external OIDC flow (Azure AD, Google, etc.)\n      if (isExternal) {\n        if (!state) {\n          throw new Error(\"State parameter is required for external OIDC flow\");\n        }\n\n        // Use the external OIDC handler\n        const result = await handleExternalOidcCallback(code, state);\n\n        if (!result.success) {\n          throw new Error(\n            result.error ||\n              \"Failed to authenticate with external OIDC provider\",\n          );\n        }\n\n        setStatus(\"success\");\n\n        // Redirect after brief success message using the redirect path from result\n        const redirectUrl = result.redirectPath || \"/dashboard\";\n        redirectTimerRef.current = setTimeout(() => {\n          navigate(redirectUrl, { replace: true });\n        }, 1500);\n        return;\n      }\n\n      // Internal OIDC flow (our auth service as provider)\n      // Validate state to prevent CSRF\n      if (state && !validateOidcState(state)) {\n        throw new Error(\n          \"Invalid state parameter. This may be a CSRF attack. Please try logging in again.\",\n        );\n      }\n\n      // Get client configuration from session storage\n      const clientId =\n        sessionStorage.getItem(\"oidc_client_id\") || \"default-client\";\n      const redirectUri = window.location.origin + \"/auth/sso/callback\";\n\n      // Exchange code for tokens\n      const result = await exchangeOidcCode(code, clientId, redirectUri);\n\n      if (!result.success) {\n        throw new Error(\n          result.error || \"Failed to exchange authorization code\",\n        );\n      }\n\n      // Check if MFA is required after OIDC authentication\n      if (result.requiresMFA && result.mfaChallengeId) {\n        // Store MFA challenge info for the verification page\n        sessionStorage.setItem(\"mfa_challenge_id\", result.mfaChallengeId);\n        sessionStorage.setItem(\n          \"mfa_redirect\",\n          sessionStorage.getItem(\"oidc_redirect\") || \"/dashboard\",\n        );\n\n        // Clean up OIDC session data\n        sessionStorage.removeItem(\"oidc_redirect\");\n        sessionStorage.removeItem(\"oidc_client_id\");\n\n        // Redirect to MFA verification\n        navigate(\"/auth/mfa-verify\", { replace: true });\n        return;\n      }\n\n      setStatus(\"success\");\n\n      // Get redirect URL from state or session storage\n      const redirect = sessionStorage.getItem(\"oidc_redirect\") || \"/dashboard\";\n      sessionStorage.removeItem(\"oidc_redirect\");\n      sessionStorage.removeItem(\"oidc_client_id\");\n\n      // Redirect after brief success message\n      redirectTimerRef.current = setTimeout(() => {\n        navigate(redirect, { replace: true });\n      }, 1500);\n    };\n\n    processCallback();\n    return () => {\n      if (redirectTimerRef.current) {\n        clearTimeout(redirectTimerRef.current);\n        redirectTimerRef.current = null;\n      }\n    };\n  }, [\n    searchParams,\n    navigate,\n    setAuthTokens,\n    setAuthenticated,\n    exchangeOidcCode,\n    validateOidcState,\n    isExternalOidcCallback,\n    handleExternalOidcCallback,\n  ]);\n\n  return (\n    <div className=\"min-h-screen flex items-center justify-center bg-bg-canvas p-4\">\n      <div className=\"w-full max-w-md\">\n        <div className=\"bg-bg-surface rounded-2xl shadow-xl p-8 text-center\">\n          {/* Logo */}\n          <div className=\"mb-6\">\n            <div className=\"auth-brand-badge mx-auto flex size-16 items-center justify-center rounded-xl\">\n              <svg\n                className=\"size-8 text-white\"\n                fill=\"none\"\n                viewBox=\"0 0 24 24\"\n                stroke=\"currentColor\"\n              >\n                <path\n                  strokeLinecap=\"round\"\n                  strokeLinejoin=\"round\"\n                  strokeWidth={2}\n                  d=\"M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z\"\n                />\n              </svg>\n            </div>\n          </div>\n\n          {/* Processing State */}\n          {status === \"processing\" && (\n            <>\n              <h1 className=\"text-2xl font-semibold text-text-primary mb-4\">\n                {tr(\"auth.ssoCallback.completing\", \"Completing Sign In\")}\n              </h1>\n              <p className=\"text-text-secondary mb-6\">\n                {callbackType === \"oidc\"\n                  ? tr(\n                      \"auth.ssoCallback.exchangingCode\",\n                      \"Exchanging authorization code for access tokens...\",\n                    )\n                  : callbackType === \"saml\"\n                    ? tr(\n                        \"auth.ssoCallback.validatingSaml\",\n                        \"Validating your SAML credentials...\",\n                      )\n                    : tr(\n                        \"auth.ssoCallback.validatingCreds\",\n                        \"Validating your credentials from your identity provider...\",\n                      )}\n              </p>\n              <div className=\"flex justify-center\">\n                <SpinnerIcon className=\"size-10 text-text-link animate-spin\" />\n              </div>\n            </>\n          )}\n\n          {/* Success State */}\n          {status === \"success\" && (\n            <>\n              <div className=\"size-16 mx-auto mb-4 rounded-full bg-status-success-bg-subtle flex items-center justify-center\">\n                <svg\n                  className=\"size-8 text-status-success-text\"\n                  fill=\"none\"\n                  viewBox=\"0 0 24 24\"\n                  stroke=\"currentColor\"\n                >\n                  <path\n                    strokeLinecap=\"round\"\n                    strokeLinejoin=\"round\"\n                    strokeWidth={2}\n                    d=\"M5 13l4 4L19 7\"\n                  />\n                </svg>\n              </div>\n              <h1 className=\"text-2xl font-semibold text-text-primary mb-4\">\n                {tr(\"auth.ssoCallback.success\", \"Sign In Successful\")}\n              </h1>\n              <p className=\"text-text-secondary mb-6\">\n                {callbackType === \"oidc\"\n                  ? tr(\n                      \"auth.ssoCallback.oidcComplete\",\n                      \"OIDC authentication complete. Redirecting...\",\n                    )\n                  : callbackType === \"saml\"\n                    ? tr(\n                        \"auth.ssoCallback.samlComplete\",\n                        \"SAML authentication complete. Redirecting...\",\n                      )\n                    : tr(\n                        \"auth.ssoCallback.authSuccess\",\n                        \"You have been authenticated successfully. Redirecting...\",\n                      )}\n              </p>\n              <div className=\"flex justify-center\">\n                <SpinnerIcon className=\"size-6 text-status-success-text animate-spin\" />\n              </div>\n            </>\n          )}\n\n          {/* Error State */}\n          {status === \"error\" && (\n            <>\n              <div className=\"size-16 mx-auto mb-4 rounded-full bg-status-error-bg-subtle flex items-center justify-center\">\n                <AlertIcon className=\"size-8 text-status-error-text\" />\n              </div>\n              <h1 className=\"text-2xl font-semibold text-text-primary mb-4\">\n                {tr(\"auth.ssoCallback.failed\", \"Sign In Failed\")}\n              </h1>\n              <p className=\"text-status-error-text mb-6 text-sm\">{error}</p>\n              <div className=\"space-y-3\">\n                <button type=\"button\"\n                  onClick={() => navigate(\"/auth/sso/login\", { replace: true })}\n                  className=\"auth-primary-button w-full px-6 py-3 font-medium\"\n                >\n                  {tr(\"auth.ssoCallback.tryAgain\", \"Try Again\")}\n                </button>\n                <button type=\"button\"\n                  onClick={() => navigate(\"/auth/login\", { replace: true })}\n                  className=\"w-full px-6 py-3 rounded-xl border border-border-default text-text-primary font-medium hover:bg-bg-sunken transition-colors\"\n                >\n                  {tr(\"auth.ssoCallback.backToLogin\", \"Back to Login\")}\n                </button>\n              </div>\n            </>\n          )}\n\n          {/* SSO Type Badge */}\n          {callbackType !== \"unknown\" && (\n            <div className=\"mt-6\">\n              <span\n                className={`inline-flex items-center px-3 py-1 rounded-full text-xs font-medium ${\n                  callbackType === \"oidc\"\n                    ? \"bg-accent-purple-subtle text-accent-purple\"\n                    : \"bg-status-info-bg-subtle text-text-linkHover\"\n                }`}\n              >\n                {callbackType === \"oidc\" ? \"OpenID Connect\" : \"SAML 2.0\"}\n              </span>\n            </div>\n          )}\n\n          {/* Help Text */}\n          <div className=\"mt-8 pt-6 border-t border-border-subtle\">\n            <p className=\"text-xs text-text-secondary\">\n              {tr(\n                \"auth.ssoCallback.helpText\",\n                \"Having trouble? Contact your organization's IT administrator for assistance with SSO login.\",\n              )}\n            </p>\n          </div>\n        </div>\n      </div>\n    </div>\n  );\n}\n"],"mappings":";;;;;;;;AAaA,SAAgB,IAAkB;CAChC,IAAM,EAAE,SAAM,GAAS,EACjB,KAAM,GAAa,MAA6B;EACpD,IAAM,IAAa,EAAE,EAAI;AACzB,SAAO,MAAe,IAAM,IAAW;IAGnC,IAAW,GAAa,EACxB,CAAC,KAAgB,GAAiB,EAClC,IAAgB,GAAc,MAAU,EAAM,cAAc,EAC5D,IAAmB,GAAc,MAAU,EAAM,iBAAiB,EAClE,EACJ,qBACA,sBACA,2BACA,kCACE,GAAkB,EAEhB,CAAC,GAAO,KAAY,EAAwB,KAAK,EACjD,CAAC,GAAQ,KAAa,EAC1B,aACD,EACK,CAAC,GAAc,KAAmB,EACtC,UACD,EACK,IAAe,EAAO,GAAM,EAC5B,IAAmB,EAA6C,KAAK;AA6L3E,QA3LA,QAAgB;AAEd,MAAI,EAAa,QACf;AAEF,IAAa,UAAU;EAEvB,IAAM,IAAkB,YAAY;AAClC,OAAI;IAEF,IAAM,IAAa,EAAa,IAAI,QAAQ,EACtC,IACJ,EAAa,IAAI,UAAU,IAAI,EAAa,IAAI,oBAAoB;AAEtE,QAAI,EACF,OAAU,MACR,KAAgB,8BAA8B,IAC/C;IAIH,IAAM,IAAQ,EAAa,IAAI,QAAQ,EACjC,IAAO,EAAa,IAAI,OAAO,EAC/B,IAAQ,EAAa,IAAI,QAAQ;AAEvC,QAAI,EAGF,CADA,EAAgB,OAAO,EACvB,MAAM,EAAmB,EAAM;aACtB,EAGT,CADA,EAAgB,OAAO,EACvB,MAAM,EAAmB,GAAM,EAAM;QAErC,OAAU,MACR,iEACD;YAEI,GAAK;AAKZ,IAJA,QAAQ,MAAM,yBAAyB,EAAI,EAC3C,EACE,aAAe,QAAQ,EAAI,UAAU,iCACtC,EACD,EAAU,QAAQ;;KAShB,IAAqB,OAAO,MAAkB;GAClD,IAAM,IAAe,EAAa,IAAI,eAAe,EAC/C,IAAW,EAAa,IAAI,WAAW,EACvC,IAAc,EAAa,IAAI,cAAc,KAAK,QAClD,IAAiB,EAAa,IAAI,iBAAiB;AAGzD,OAAI,KAAe,GAAgB;AAQjC,IANA,eAAe,QAAQ,oBAAoB,EAAe,EAC1D,eAAe,QAAQ,qBAAqB,EAAM,EAClD,eAAe,QAAQ,uBAAuB,KAAgB,GAAG,EACjE,eAAe,QAAQ,gBAAgB,KAAY,aAAa,EAGhE,EAAS,oBAAoB,EAAE,SAAS,IAAM,CAAC;AAC/C;;AAUF,GANA,EAAc,GAAO,KAAgB,GAAG,EACxC,EAAiB,GAAK,EAEtB,EAAU,UAAU,EAGpB,EAAiB,UAAU,iBAAiB;AAE1C,MADoB,KAAY,cACV,EAAE,SAAS,IAAM,CAAC;MACvC,KAAK;KAMJ,IAAqB,OAAO,GAAc,MAAyB;AAIvE,OAHmB,GAAwB,EAG3B;AACd,QAAI,CAAC,EACH,OAAU,MAAM,qDAAqD;IAIvE,IAAM,IAAS,MAAM,EAA2B,GAAM,EAAM;AAE5D,QAAI,CAAC,EAAO,QACV,OAAU,MACR,EAAO,SACL,qDACH;AAGH,MAAU,UAAU;IAGpB,IAAM,IAAc,EAAO,gBAAgB;AAC3C,MAAiB,UAAU,iBAAiB;AAC1C,OAAS,GAAa,EAAE,SAAS,IAAM,CAAC;OACvC,KAAK;AACR;;AAKF,OAAI,KAAS,CAAC,EAAkB,EAAM,CACpC,OAAU,MACR,mFACD;GASH,IAAM,IAAS,MAAM,EAAiB,GAJpC,eAAe,QAAQ,iBAAiB,IAAI,kBAC1B,OAAO,SAAS,SAAS,qBAGqB;AAElE,OAAI,CAAC,EAAO,QACV,OAAU,MACR,EAAO,SAAS,wCACjB;AAIH,OAAI,EAAO,eAAe,EAAO,gBAAgB;AAa/C,IAXA,eAAe,QAAQ,oBAAoB,EAAO,eAAe,EACjE,eAAe,QACb,gBACA,eAAe,QAAQ,gBAAgB,IAAI,aAC5C,EAGD,eAAe,WAAW,gBAAgB,EAC1C,eAAe,WAAW,iBAAiB,EAG3C,EAAS,oBAAoB,EAAE,SAAS,IAAM,CAAC;AAC/C;;AAGF,KAAU,UAAU;GAGpB,IAAM,IAAW,eAAe,QAAQ,gBAAgB,IAAI;AAK5D,GAJA,eAAe,WAAW,gBAAgB,EAC1C,eAAe,WAAW,iBAAiB,EAG3C,EAAiB,UAAU,iBAAiB;AAC1C,MAAS,GAAU,EAAE,SAAS,IAAM,CAAC;MACpC,KAAK;;AAIV,SADA,GAAiB,QACJ;AACX,GAEE,EAAiB,aADjB,aAAa,EAAiB,QAAQ,EACX;;IAG9B;EACD;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CAAC,EAGA,kBAAC,OAAD;EAAK,WAAU;YACb,kBAAC,OAAD;GAAK,WAAU;aACb,kBAAC,OAAD;IAAK,WAAU;cAAf;KAEE,kBAAC,OAAD;MAAK,WAAU;gBACb,kBAAC,OAAD;OAAK,WAAU;iBACb,kBAAC,OAAD;QACE,WAAU;QACV,MAAK;QACL,SAAQ;QACR,QAAO;kBAEP,kBAAC,QAAD;SACE,eAAc;SACd,gBAAe;SACf,aAAa;SACb,GAAE;SACF,CAAA;QACE,CAAA;OACF,CAAA;MACF,CAAA;KAGL,MAAW,gBACV,kBAAA,GAAA,EAAA,UAAA;MACE,kBAAC,MAAD;OAAI,WAAU;iBACX,EAAG,+BAA+B,qBAAqB;OACrD,CAAA;MACL,kBAAC,KAAD;OAAG,WAAU;iBACV,MAAiB,SACd,EACE,mCACA,qDACD,GACD,MAAiB,SACf,EACE,mCACA,sCACD,GACD,EACE,oCACA,6DACD;OACL,CAAA;MACJ,kBAAC,OAAD;OAAK,WAAU;iBACb,kBAAC,GAAD,EAAa,WAAU,uCAAwC,CAAA;OAC3D,CAAA;MACL,EAAA,CAAA;KAIJ,MAAW,aACV,kBAAA,GAAA,EAAA,UAAA;MACE,kBAAC,OAAD;OAAK,WAAU;iBACb,kBAAC,OAAD;QACE,WAAU;QACV,MAAK;QACL,SAAQ;QACR,QAAO;kBAEP,kBAAC,QAAD;SACE,eAAc;SACd,gBAAe;SACf,aAAa;SACb,GAAE;SACF,CAAA;QACE,CAAA;OACF,CAAA;MACN,kBAAC,MAAD;OAAI,WAAU;iBACX,EAAG,4BAA4B,qBAAqB;OAClD,CAAA;MACL,kBAAC,KAAD;OAAG,WAAU;iBACV,MAAiB,SACd,EACE,iCACA,+CACD,GACD,MAAiB,SACf,EACE,iCACA,+CACD,GACD,EACE,gCACA,2DACD;OACL,CAAA;MACJ,kBAAC,OAAD;OAAK,WAAU;iBACb,kBAAC,GAAD,EAAa,WAAU,gDAAiD,CAAA;OACpE,CAAA;MACL,EAAA,CAAA;KAIJ,MAAW,WACV,kBAAA,GAAA,EAAA,UAAA;MACE,kBAAC,OAAD;OAAK,WAAU;iBACb,kBAAC,GAAD,EAAW,WAAU,iCAAkC,CAAA;OACnD,CAAA;MACN,kBAAC,MAAD;OAAI,WAAU;iBACX,EAAG,2BAA2B,iBAAiB;OAC7C,CAAA;MACL,kBAAC,KAAD;OAAG,WAAU;iBAAuC;OAAU,CAAA;MAC9D,kBAAC,OAAD;OAAK,WAAU;iBAAf,CACE,kBAAC,UAAD;QAAQ,MAAK;QACX,eAAe,EAAS,mBAAmB,EAAE,SAAS,IAAM,CAAC;QAC7D,WAAU;kBAET,EAAG,6BAA6B,YAAY;QACtC,CAAA,EACT,kBAAC,UAAD;QAAQ,MAAK;QACX,eAAe,EAAS,eAAe,EAAE,SAAS,IAAM,CAAC;QACzD,WAAU;kBAET,EAAG,gCAAgC,gBAAgB;QAC7C,CAAA,CACL;;MACL,EAAA,CAAA;KAIJ,MAAiB,aAChB,kBAAC,OAAD;MAAK,WAAU;gBACb,kBAAC,QAAD;OACE,WAAW,uEACT,MAAiB,SACb,+CACA;iBAGL,MAAiB,SAAS,mBAAmB;OACzC,CAAA;MACH,CAAA;KAIR,kBAAC,OAAD;MAAK,WAAU;gBACb,kBAAC,KAAD;OAAG,WAAU;iBACV,EACC,6BACA,8FACD;OACC,CAAA;MACA,CAAA;KACF;;GACF,CAAA;EACF,CAAA"}
+{"version":3,"file":"SsoCallbackPage.js","names":[],"sources":["../../../src/auth/pages/SsoCallbackPage.tsx"],"sourcesContent":["import { useEffect, useState, useRef } from \"react\";\nimport { useI18n } from \"@burdenoff/fe-libs/shared/providers/shell\";\nimport { useNavigate, useSearchParams } from \"react-router-dom\";\nimport { useAuthStore } from \"../store/authStore\";\nimport { useSsoOperations } from \"../hooks/useSsoOperations\";\nimport { SpinnerIcon, AlertIcon } from \"../components/AuthIcons\";\n\n/**\n * SSO Callback Page\n * Handles redirects from:\n * - SAML ACS server (with token/refreshToken in query params)\n * - OIDC Authorization Server (with code/state in query params)\n */\nexport function SsoCallbackPage() {\n  const { t } = useI18n();\n  const tr = (key: string, fallback: string): string => {\n    const translated = t(key);\n    return translated === key ? fallback : translated;\n  };\n\n  const navigate = useNavigate();\n  const [searchParams] = useSearchParams();\n  const setAuthTokens = useAuthStore((state) => state.setAuthTokens);\n  const setAuthenticated = useAuthStore((state) => state.setAuthenticated);\n  const {\n    exchangeOidcCode,\n    validateOidcState,\n    isExternalOidcCallback,\n    handleExternalOidcCallback,\n  } = useSsoOperations();\n\n  const [error, setError] = useState<string | null>(null);\n  const [status, setStatus] = useState<\"processing\" | \"success\" | \"error\">(\n    \"processing\",\n  );\n  const [callbackType, setCallbackType] = useState<\"saml\" | \"oidc\" | \"unknown\">(\n    \"unknown\",\n  );\n  const processedRef = useRef(false);\n  const redirectTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);\n\n  useEffect(() => {\n    // Prevent double execution in React StrictMode\n    if (processedRef.current) {\n      return;\n    }\n    processedRef.current = true;\n\n    const processCallback = async () => {\n      try {\n        // Check for error from either SSO provider\n        const errorParam = searchParams.get(\"error\");\n        const errorMessage =\n          searchParams.get(\"message\") || searchParams.get(\"error_description\");\n\n        if (errorParam) {\n          throw new Error(\n            errorMessage || `SSO authentication failed: ${errorParam}`,\n          );\n        }\n\n        // Detect callback type based on query parameters\n        const token = searchParams.get(\"token\");\n        const code = searchParams.get(\"code\");\n        const state = searchParams.get(\"state\");\n\n        if (token) {\n          // SAML callback - token already exchanged by ACS server\n          setCallbackType(\"saml\");\n          await handleSamlCallback(token);\n        } else if (code) {\n          // OIDC callback - need to exchange code for tokens\n          setCallbackType(\"oidc\");\n          await handleOidcCallback(code, state);\n        } else {\n          throw new Error(\n            \"Invalid SSO callback. No token or authorization code received.\",\n          );\n        }\n      } catch (err) {\n        console.error(\"[SSO Callback] Error:\", err);\n        setError(\n          err instanceof Error ? err.message : \"Failed to process SSO response\",\n        );\n        setStatus(\"error\");\n      }\n    };\n\n    /**\n     * Handle SAML callback from ACS server\n     * Token is already exchanged, just store and redirect\n     * Also handles MFA if required\n     */\n    const handleSamlCallback = async (token: string) => {\n      const refreshToken = searchParams.get(\"refreshToken\");\n      const redirect = searchParams.get(\"redirect\");\n      const requiresMFA = searchParams.get(\"requiresMFA\") === \"true\";\n      const mfaChallengeId = searchParams.get(\"mfaChallengeId\");\n\n      // Check if MFA is required\n      if (requiresMFA && mfaChallengeId) {\n        // Store partial auth state and MFA info\n        sessionStorage.setItem(\"mfa_challenge_id\", mfaChallengeId);\n        sessionStorage.setItem(\"mfa_pending_token\", token);\n        sessionStorage.setItem(\"mfa_pending_refresh\", refreshToken || \"\");\n        sessionStorage.setItem(\"mfa_redirect\", redirect || \"/dashboard\");\n\n        // Redirect to MFA verification\n        navigate(\"/auth/mfa-verify\", { replace: true });\n        return;\n      }\n\n      // Store tokens\n      setAuthTokens(token, refreshToken || \"\");\n      setAuthenticated(true);\n\n      setStatus(\"success\");\n\n      // Redirect to the specified URL or default to dashboard\n      redirectTimerRef.current = setTimeout(() => {\n        const redirectUrl = redirect || \"/dashboard\";\n        navigate(redirectUrl, { replace: true });\n      }, 1500);\n    };\n\n    /**\n     * Handle OIDC callback - exchange code for tokens\n     */\n    const handleOidcCallback = async (code: string, state: string | null) => {\n      // Cache the OIDC redirect target — used in both the MFA branch and the\n      // success branch, plus removed once at the end of the flow.\n      const oidcRedirect = sessionStorage.getItem(\"oidc_redirect\");\n      const isExternal = isExternalOidcCallback();\n\n      // Check if this is an external OIDC flow (Azure AD, Google, etc.)\n      if (isExternal) {\n        if (!state) {\n          throw new Error(\"State parameter is required for external OIDC flow\");\n        }\n\n        // Use the external OIDC handler\n        const result = await handleExternalOidcCallback(code, state);\n\n        if (!result.success) {\n          throw new Error(\n            result.error ||\n              \"Failed to authenticate with external OIDC provider\",\n          );\n        }\n\n        setStatus(\"success\");\n\n        // Redirect after brief success message using the redirect path from result\n        const redirectUrl = result.redirectPath || \"/dashboard\";\n        redirectTimerRef.current = setTimeout(() => {\n          navigate(redirectUrl, { replace: true });\n        }, 1500);\n        return;\n      }\n\n      // Internal OIDC flow (our auth service as provider)\n      // Validate state to prevent CSRF\n      if (state && !validateOidcState(state)) {\n        throw new Error(\n          \"Invalid state parameter. This may be a CSRF attack. Please try logging in again.\",\n        );\n      }\n\n      // Get client configuration from session storage\n      const clientId =\n        sessionStorage.getItem(\"oidc_client_id\") || \"default-client\";\n      const redirectUri = window.location.origin + \"/auth/sso/callback\";\n\n      // Exchange code for tokens\n      const result = await exchangeOidcCode(code, clientId, redirectUri);\n\n      if (!result.success) {\n        throw new Error(\n          result.error || \"Failed to exchange authorization code\",\n        );\n      }\n\n      // Check if MFA is required after OIDC authentication\n      if (result.requiresMFA && result.mfaChallengeId) {\n        // Store MFA challenge info for the verification page\n        sessionStorage.setItem(\"mfa_challenge_id\", result.mfaChallengeId);\n        sessionStorage.setItem(\n          \"mfa_redirect\",\n          oidcRedirect || \"/dashboard\",\n        );\n\n        // Clean up OIDC session data\n        sessionStorage.removeItem(\"oidc_redirect\");\n        sessionStorage.removeItem(\"oidc_client_id\");\n\n        // Redirect to MFA verification\n        navigate(\"/auth/mfa-verify\", { replace: true });\n        return;\n      }\n\n      setStatus(\"success\");\n\n      // Get redirect URL from state or session storage\n      const redirect = oidcRedirect || \"/dashboard\";\n      sessionStorage.removeItem(\"oidc_redirect\");\n      sessionStorage.removeItem(\"oidc_client_id\");\n\n      // Redirect after brief success message\n      redirectTimerRef.current = setTimeout(() => {\n        navigate(redirect, { replace: true });\n      }, 1500);\n    };\n\n    processCallback();\n    const timerRefCapture = redirectTimerRef;\n    return () => {\n      if (timerRefCapture.current) {\n        clearTimeout(timerRefCapture.current);\n        timerRefCapture.current = null;\n      }\n    };\n  }, [\n    searchParams,\n    navigate,\n    setAuthTokens,\n    setAuthenticated,\n    exchangeOidcCode,\n    validateOidcState,\n    isExternalOidcCallback,\n    handleExternalOidcCallback,\n  ]);\n\n  return (\n    <div className=\"min-h-screen flex items-center justify-center bg-bg-canvas p-4\">\n      <div className=\"w-full max-w-md\">\n        <div className=\"bg-bg-surface rounded-2xl shadow-xl p-8 text-center\">\n          {/* Logo */}\n          <div className=\"mb-6\">\n            <div className=\"auth-brand-badge mx-auto flex size-16 items-center justify-center rounded-xl\">\n              <svg\n                className=\"size-8 text-white\"\n                fill=\"none\"\n                viewBox=\"0 0 24 24\"\n                stroke=\"currentColor\"\n              >\n                <path\n                  strokeLinecap=\"round\"\n                  strokeLinejoin=\"round\"\n                  strokeWidth={2}\n                  d=\"M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z\"\n                />\n              </svg>\n            </div>\n          </div>\n\n          {/* Processing State */}\n          {status === \"processing\" && (\n            <>\n              <h1 className=\"text-2xl font-semibold text-text-primary mb-4\">\n                {tr(\"auth.ssoCallback.completing\", \"Completing Sign In\")}\n              </h1>\n              <p className=\"text-text-secondary mb-6\">\n                {callbackType === \"oidc\"\n                  ? tr(\n                      \"auth.ssoCallback.exchangingCode\",\n                      \"Exchanging authorization code for access tokens...\",\n                    )\n                  : callbackType === \"saml\"\n                    ? tr(\n                        \"auth.ssoCallback.validatingSaml\",\n                        \"Validating your SAML credentials...\",\n                      )\n                    : tr(\n                        \"auth.ssoCallback.validatingCreds\",\n                        \"Validating your credentials from your identity provider...\",\n                      )}\n              </p>\n              <div className=\"flex justify-center\">\n                <SpinnerIcon className=\"size-10 text-text-link animate-spin\" />\n              </div>\n            </>\n          )}\n\n          {/* Success State */}\n          {status === \"success\" && (\n            <>\n              <div className=\"size-16 mx-auto mb-4 rounded-full bg-status-success-bg-subtle flex items-center justify-center\">\n                <svg\n                  className=\"size-8 text-status-success-text\"\n                  fill=\"none\"\n                  viewBox=\"0 0 24 24\"\n                  stroke=\"currentColor\"\n                >\n                  <path\n                    strokeLinecap=\"round\"\n                    strokeLinejoin=\"round\"\n                    strokeWidth={2}\n                    d=\"M5 13l4 4L19 7\"\n                  />\n                </svg>\n              </div>\n              <h1 className=\"text-2xl font-semibold text-text-primary mb-4\">\n                {tr(\"auth.ssoCallback.success\", \"Sign In Successful\")}\n              </h1>\n              <p className=\"text-text-secondary mb-6\">\n                {callbackType === \"oidc\"\n                  ? tr(\n                      \"auth.ssoCallback.oidcComplete\",\n                      \"OIDC authentication complete. Redirecting...\",\n                    )\n                  : callbackType === \"saml\"\n                    ? tr(\n                        \"auth.ssoCallback.samlComplete\",\n                        \"SAML authentication complete. Redirecting...\",\n                      )\n                    : tr(\n                        \"auth.ssoCallback.authSuccess\",\n                        \"You have been authenticated successfully. Redirecting...\",\n                      )}\n              </p>\n              <div className=\"flex justify-center\">\n                <SpinnerIcon className=\"size-6 text-status-success-text animate-spin\" />\n              </div>\n            </>\n          )}\n\n          {/* Error State */}\n          {status === \"error\" && (\n            <>\n              <div className=\"size-16 mx-auto mb-4 rounded-full bg-status-error-bg-subtle flex items-center justify-center\">\n                <AlertIcon className=\"size-8 text-status-error-text\" />\n              </div>\n              <h1 className=\"text-2xl font-semibold text-text-primary mb-4\">\n                {tr(\"auth.ssoCallback.failed\", \"Sign In Failed\")}\n              </h1>\n              <p className=\"text-status-error-text mb-6 text-sm\">{error}</p>\n              <div className=\"space-y-3\">\n                <button type=\"button\"\n                  onClick={() => navigate(\"/auth/sso/login\", { replace: true })}\n                  className=\"auth-primary-button w-full px-6 py-3 font-medium\"\n                >\n                  {tr(\"auth.ssoCallback.tryAgain\", \"Try Again\")}\n                </button>\n                <button type=\"button\"\n                  onClick={() => navigate(\"/auth/login\", { replace: true })}\n                  className=\"w-full px-6 py-3 rounded-xl border border-border-default text-text-primary font-medium hover:bg-bg-sunken transition-colors\"\n                >\n                  {tr(\"auth.ssoCallback.backToLogin\", \"Back to Login\")}\n                </button>\n              </div>\n            </>\n          )}\n\n          {/* SSO Type Badge */}\n          {callbackType !== \"unknown\" && (\n            <div className=\"mt-6\">\n              <span\n                className={`inline-flex items-center px-3 py-1 rounded-full text-xs font-medium ${\n                  callbackType === \"oidc\"\n                    ? \"bg-accent-purple-subtle text-accent-purple\"\n                    : \"bg-status-info-bg-subtle text-text-linkHover\"\n                }`}\n              >\n                {callbackType === \"oidc\" ? \"OpenID Connect\" : \"SAML 2.0\"}\n              </span>\n            </div>\n          )}\n\n          {/* Help Text */}\n          <div className=\"mt-8 pt-6 border-t border-border-subtle\">\n            <p className=\"text-xs text-text-secondary\">\n              {tr(\n                \"auth.ssoCallback.helpText\",\n                \"Having trouble? Contact your organization's IT administrator for assistance with SSO login.\",\n              )}\n            </p>\n          </div>\n        </div>\n      </div>\n    </div>\n  );\n}\n"],"mappings":";;;;;;;;AAaA,SAAgB,IAAkB;CAChC,IAAM,EAAE,SAAM,GAAS,EACjB,KAAM,GAAa,MAA6B;EACpD,IAAM,IAAa,EAAE,EAAI;AACzB,SAAO,MAAe,IAAM,IAAW;IAGnC,IAAW,GAAa,EACxB,CAAC,KAAgB,GAAiB,EAClC,IAAgB,GAAc,MAAU,EAAM,cAAc,EAC5D,IAAmB,GAAc,MAAU,EAAM,iBAAiB,EAClE,EACJ,qBACA,sBACA,2BACA,kCACE,GAAkB,EAEhB,CAAC,GAAO,KAAY,EAAwB,KAAK,EACjD,CAAC,GAAQ,KAAa,EAC1B,aACD,EACK,CAAC,GAAc,KAAmB,EACtC,UACD,EACK,IAAe,EAAO,GAAM,EAC5B,IAAmB,EAA6C,KAAK;AAiM3E,QA/LA,QAAgB;AAEd,MAAI,EAAa,QACf;AAEF,IAAa,UAAU;EAEvB,IAAM,IAAkB,YAAY;AAClC,OAAI;IAEF,IAAM,IAAa,EAAa,IAAI,QAAQ,EACtC,IACJ,EAAa,IAAI,UAAU,IAAI,EAAa,IAAI,oBAAoB;AAEtE,QAAI,EACF,OAAU,MACR,KAAgB,8BAA8B,IAC/C;IAIH,IAAM,IAAQ,EAAa,IAAI,QAAQ,EACjC,IAAO,EAAa,IAAI,OAAO,EAC/B,IAAQ,EAAa,IAAI,QAAQ;AAEvC,QAAI,EAGF,CADA,EAAgB,OAAO,EACvB,MAAM,EAAmB,EAAM;aACtB,EAGT,CADA,EAAgB,OAAO,EACvB,MAAM,EAAmB,GAAM,EAAM;QAErC,OAAU,MACR,iEACD;YAEI,GAAK;AAKZ,IAJA,QAAQ,MAAM,yBAAyB,EAAI,EAC3C,EACE,aAAe,QAAQ,EAAI,UAAU,iCACtC,EACD,EAAU,QAAQ;;KAShB,IAAqB,OAAO,MAAkB;GAClD,IAAM,IAAe,EAAa,IAAI,eAAe,EAC/C,IAAW,EAAa,IAAI,WAAW,EACvC,IAAc,EAAa,IAAI,cAAc,KAAK,QAClD,IAAiB,EAAa,IAAI,iBAAiB;AAGzD,OAAI,KAAe,GAAgB;AAQjC,IANA,eAAe,QAAQ,oBAAoB,EAAe,EAC1D,eAAe,QAAQ,qBAAqB,EAAM,EAClD,eAAe,QAAQ,uBAAuB,KAAgB,GAAG,EACjE,eAAe,QAAQ,gBAAgB,KAAY,aAAa,EAGhE,EAAS,oBAAoB,EAAE,SAAS,IAAM,CAAC;AAC/C;;AAUF,GANA,EAAc,GAAO,KAAgB,GAAG,EACxC,EAAiB,GAAK,EAEtB,EAAU,UAAU,EAGpB,EAAiB,UAAU,iBAAiB;AAE1C,MADoB,KAAY,cACV,EAAE,SAAS,IAAM,CAAC;MACvC,KAAK;KAMJ,IAAqB,OAAO,GAAc,MAAyB;GAGvE,IAAM,IAAe,eAAe,QAAQ,gBAAgB;AAI5D,OAHmB,GAAwB,EAG3B;AACd,QAAI,CAAC,EACH,OAAU,MAAM,qDAAqD;IAIvE,IAAM,IAAS,MAAM,EAA2B,GAAM,EAAM;AAE5D,QAAI,CAAC,EAAO,QACV,OAAU,MACR,EAAO,SACL,qDACH;AAGH,MAAU,UAAU;IAGpB,IAAM,IAAc,EAAO,gBAAgB;AAC3C,MAAiB,UAAU,iBAAiB;AAC1C,OAAS,GAAa,EAAE,SAAS,IAAM,CAAC;OACvC,KAAK;AACR;;AAKF,OAAI,KAAS,CAAC,EAAkB,EAAM,CACpC,OAAU,MACR,mFACD;GASH,IAAM,IAAS,MAAM,EAAiB,GAJpC,eAAe,QAAQ,iBAAiB,IAAI,kBAC1B,OAAO,SAAS,SAAS,qBAGqB;AAElE,OAAI,CAAC,EAAO,QACV,OAAU,MACR,EAAO,SAAS,wCACjB;AAIH,OAAI,EAAO,eAAe,EAAO,gBAAgB;AAa/C,IAXA,eAAe,QAAQ,oBAAoB,EAAO,eAAe,EACjE,eAAe,QACb,gBACA,KAAgB,aACjB,EAGD,eAAe,WAAW,gBAAgB,EAC1C,eAAe,WAAW,iBAAiB,EAG3C,EAAS,oBAAoB,EAAE,SAAS,IAAM,CAAC;AAC/C;;AAGF,KAAU,UAAU;GAGpB,IAAM,IAAW,KAAgB;AAKjC,GAJA,eAAe,WAAW,gBAAgB,EAC1C,eAAe,WAAW,iBAAiB,EAG3C,EAAiB,UAAU,iBAAiB;AAC1C,MAAS,GAAU,EAAE,SAAS,IAAM,CAAC;MACpC,KAAK;;AAGV,KAAiB;EACjB,IAAM,IAAkB;AACxB,eAAa;AACX,GAEE,EAAgB,aADhB,aAAa,EAAgB,QAAQ,EACX;;IAG7B;EACD;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CAAC,EAGA,kBAAC,OAAD;EAAK,WAAU;YACb,kBAAC,OAAD;GAAK,WAAU;aACb,kBAAC,OAAD;IAAK,WAAU;cAAf;KAEE,kBAAC,OAAD;MAAK,WAAU;gBACb,kBAAC,OAAD;OAAK,WAAU;iBACb,kBAAC,OAAD;QACE,WAAU;QACV,MAAK;QACL,SAAQ;QACR,QAAO;kBAEP,kBAAC,QAAD;SACE,eAAc;SACd,gBAAe;SACf,aAAa;SACb,GAAE;SACF,CAAA;QACE,CAAA;OACF,CAAA;MACF,CAAA;KAGL,MAAW,gBACV,kBAAA,GAAA,EAAA,UAAA;MACE,kBAAC,MAAD;OAAI,WAAU;iBACX,EAAG,+BAA+B,qBAAqB;OACrD,CAAA;MACL,kBAAC,KAAD;OAAG,WAAU;iBACV,MAAiB,SACd,EACE,mCACA,qDACD,GACD,MAAiB,SACf,EACE,mCACA,sCACD,GACD,EACE,oCACA,6DACD;OACL,CAAA;MACJ,kBAAC,OAAD;OAAK,WAAU;iBACb,kBAAC,GAAD,EAAa,WAAU,uCAAwC,CAAA;OAC3D,CAAA;MACL,EAAA,CAAA;KAIJ,MAAW,aACV,kBAAA,GAAA,EAAA,UAAA;MACE,kBAAC,OAAD;OAAK,WAAU;iBACb,kBAAC,OAAD;QACE,WAAU;QACV,MAAK;QACL,SAAQ;QACR,QAAO;kBAEP,kBAAC,QAAD;SACE,eAAc;SACd,gBAAe;SACf,aAAa;SACb,GAAE;SACF,CAAA;QACE,CAAA;OACF,CAAA;MACN,kBAAC,MAAD;OAAI,WAAU;iBACX,EAAG,4BAA4B,qBAAqB;OAClD,CAAA;MACL,kBAAC,KAAD;OAAG,WAAU;iBACV,MAAiB,SACd,EACE,iCACA,+CACD,GACD,MAAiB,SACf,EACE,iCACA,+CACD,GACD,EACE,gCACA,2DACD;OACL,CAAA;MACJ,kBAAC,OAAD;OAAK,WAAU;iBACb,kBAAC,GAAD,EAAa,WAAU,gDAAiD,CAAA;OACpE,CAAA;MACL,EAAA,CAAA;KAIJ,MAAW,WACV,kBAAA,GAAA,EAAA,UAAA;MACE,kBAAC,OAAD;OAAK,WAAU;iBACb,kBAAC,GAAD,EAAW,WAAU,iCAAkC,CAAA;OACnD,CAAA;MACN,kBAAC,MAAD;OAAI,WAAU;iBACX,EAAG,2BAA2B,iBAAiB;OAC7C,CAAA;MACL,kBAAC,KAAD;OAAG,WAAU;iBAAuC;OAAU,CAAA;MAC9D,kBAAC,OAAD;OAAK,WAAU;iBAAf,CACE,kBAAC,UAAD;QAAQ,MAAK;QACX,eAAe,EAAS,mBAAmB,EAAE,SAAS,IAAM,CAAC;QAC7D,WAAU;kBAET,EAAG,6BAA6B,YAAY;QACtC,CAAA,EACT,kBAAC,UAAD;QAAQ,MAAK;QACX,eAAe,EAAS,eAAe,EAAE,SAAS,IAAM,CAAC;QACzD,WAAU;kBAET,EAAG,gCAAgC,gBAAgB;QAC7C,CAAA,CACL;;MACL,EAAA,CAAA;KAIJ,MAAiB,aAChB,kBAAC,OAAD;MAAK,WAAU;gBACb,kBAAC,QAAD;OACE,WAAW,uEACT,MAAiB,SACb,+CACA;iBAGL,MAAiB,SAAS,mBAAmB;OACzC,CAAA;MACH,CAAA;KAIR,kBAAC,OAAD;MAAK,WAAU;gBACb,kBAAC,KAAD;OAAG,WAAU;iBACV,EACC,6BACA,8FACD;OACC,CAAA;MACA,CAAA;KACF;;GACF,CAAA;EACF,CAAA"}

package/dist/auth/pages/SsoConfigPage.js

@@ -352,7 +352,8 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 												}
 											},
 											className: "hidden",
-											id: "metadata-file"
+											id: "metadata-file",
+											"aria-label": j("auth.sso.uploadFile", "Upload Metadata File")
 										}),
 										/* @__PURE__ */ m("label", {
 											htmlFor: "metadata-file",
@@ -522,6 +523,7 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 										/* @__PURE__ */ p("input", {
 											id: "sso-entity-id",
 											type: "url",
+											"aria-label": j("auth.sso.idpEntityId", "IdP Entity ID"),
 											value: Q.entityId,
 											onChange: (e) => $({
 												...Q,
@@ -557,6 +559,7 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 										/* @__PURE__ */ p("input", {
 											id: "sso-sso-url",
 											type: "url",
+											"aria-label": j("auth.sso.ssoUrl", "SSO URL"),
 											value: Q.ssoUrl,
 											onChange: (e) => $({
 												...Q,
@@ -584,6 +587,7 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 										/* @__PURE__ */ p("input", {
 											id: "sso-slo-url",
 											type: "url",
+											"aria-label": j("auth.sso.sloUrl", "Single Logout (SLO) URL"),
 											value: Q.sloUrl,
 											onChange: (e) => $({
 												...Q,
@@ -616,6 +620,7 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 										}),
 										/* @__PURE__ */ p("textarea", {
 											id: "sso-certificate",
+											"aria-label": j("auth.sso.certificate", "X.509 Certificate"),
 											value: Q.certificate,
 											onChange: (e) => $({
 												...Q,
@@ -834,6 +839,7 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 							})] }), /* @__PURE__ */ p("button", {
 								type: "button",
 								onClick: () => Z(null),
+								"aria-label": j("auth.sso.dismissClientCredentials", "Dismiss"),
 								className: "text-status-success-text hover:text-status-success-text",
 								children: /* @__PURE__ */ p("svg", {
 									className: "size-5",
@@ -933,6 +939,7 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 								}), /* @__PURE__ */ p("input", {
 									id: "oidc-client-name",
 									type: "text",
+									"aria-label": j("auth.sso.oidcClientName", "Client Name"),
 									value: K.client_name,
 									onChange: (e) => q({
 										...K,
@@ -959,6 +966,7 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 									/* @__PURE__ */ p("input", {
 										id: "oidc-redirect-uris",
 										type: "text",
+										"aria-label": j("auth.sso.oidcRedirectUris", "Redirect URIs"),
 										value: K.redirect_uris,
 										onChange: (e) => q({
 											...K,
@@ -988,6 +996,7 @@ function _({ bypassEnterprisePlanGate: a = !1 }) {
 										className: "flex items-center gap-2 cursor-pointer",
 										children: [/* @__PURE__ */ p("input", {
 											type: "checkbox",
+											"aria-label": e,
 											checked: K.grant_types.includes(e),
 											onChange: (t) => {
 												t.target.checked ? q({