@burdenoff/microfe-auth 2026.530.2 → 2026.531.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/dist/auth/hooks/useAuthOperations.js +1 -1
  2. package/dist/auth/hooks/useAuthOperations.js.map +1 -1
  3. package/dist/auth/hooks/useContextSwitcherData.js +64 -52
  4. package/dist/auth/hooks/useContextSwitcherData.js.map +1 -1
  5. package/dist/auth/pages/RegisterPage.js +219 -190
  6. package/dist/auth/pages/RegisterPage.js.map +1 -1
  7. package/package.json +2 -2
package/dist/auth/hooks/useAuthOperations.js CHANGED
@@ -7,7 +7,7 @@ import { useApolloClient as h, useMutation as g, useQuery as _ } from "@apollo/c
7
7
  import { useEventBus as v } from "@burdenoff/fe-libs/shared/events";
8
8
  //#region src/auth/hooks/useAuthOperations.ts
9
9
  function y(e, t) {
10
- return e.includes("email or username already exists") || t === "BAD_USER_INPUT" ? "An account with this email or username already exists. Please sign in or use a different email." : t === "TENANT_CREATION_FAILED" ? "We couldn't finish setting up your account. Please try again in a few moments. If this persists, contact support." : e.includes("Failed to fetch") || e.includes("NetworkError") || e.includes("Load failed") ? "Unable to reach the server. Please check your internet connection and try again." : e.includes("CORS") || e.includes("cross-origin") ? "Unable to reach the server. Please try again or contact support." : t === "INTERNAL_SERVER_ERROR" ? "Something went wrong on our end. Please try again in a few moments." : e && e !== "Sign up failed" ? e : "Sign up failed. Please try again.";
10
+ return t === "ACCOUNT_DEACTIVATED" ? "This email belongs to a deactivated account. You can reactivate it instead of signing up again." : t === "ACCOUNT_REMOVED" ? "This account was removed by an administrator. Please contact support to restore it." : t === "ACCOUNT_SUSPENDED" ? "This account is suspended. Please contact support." : e.includes("email or username already exists") || t === "BAD_USER_INPUT" ? "An account with this email or username already exists. Please sign in or use a different email." : t === "TENANT_CREATION_FAILED" ? "We couldn't finish setting up your account. Please try again in a few moments. If this persists, contact support." : e.includes("Failed to fetch") || e.includes("NetworkError") || e.includes("Load failed") ? "Unable to reach the server. Please check your internet connection and try again." : e.includes("CORS") || e.includes("cross-origin") ? "Unable to reach the server. Please try again or contact support." : t === "INTERNAL_SERVER_ERROR" ? "Something went wrong on our end. Please try again in a few moments." : e && e !== "Sign up failed" ? e : "Sign up failed. Please try again.";
11
11
  }
12
12
  function b(e) {
13
13
  try {
package/dist/auth/hooks/useAuthOperations.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"useAuthOperations.js","names":[],"sources":["../../../src/auth/hooks/useAuthOperations.ts"],"sourcesContent":["import { useEffect, useRef } from \"react\";\nimport { useMutation, useQuery, useApolloClient } from \"@apollo/client/react\";\nimport { useEventBus } from \"@burdenoff/fe-libs/shared/events\";\nimport {\n loginProfile,\n getProfiles,\n getProfileTokens,\n getProfileUser,\n type ProfileUser,\n} from \"@burdenoff/fe-libs/shared/providers/shell/ProfileStorageManager\";\nimport { useAuthStore } from \"../store/authStore\";\nimport { useAuth } from \"../providers/AuthProvider\";\nimport {\n SignInDocument,\n SignUpDocument,\n SignOutDocument,\n RefreshTokenDocument,\n CurrentUserDocument,\n VerifyEmailDocument,\n ResendVerificationEmailDocument,\n} from \"../../generated/global-operations\";\nimport type {\n SignInInput,\n SignUpInput,\n User,\n AuthPayload,\n AuthResult,\n} from \"../types\";\n\n// =============================================================================\n// ERROR MAPPING HELPERS\n// =============================================================================\n\n/**\n * Map raw backend error messages to user-friendly descriptions.\n * Keeps a single source of truth for all sign-up error copy.\n */\nfunction mapSignUpError(rawMessage: string, errorCode?: string): string {\n // Exact matches from the backend\n if (\n rawMessage.includes(\"email or username already exists\") ||\n errorCode === \"BAD_USER_INPUT\"\n ) {\n return \"An account with this email or username already exists. Please sign in or use a different email.\";\n }\n\n if (errorCode === \"TENANT_CREATION_FAILED\") {\n return \"We couldn't finish setting up your account. Please try again in a few moments. If this persists, contact support.\";\n }\n\n // Network / fetch failures (Apollo wraps these)\n if (\n rawMessage.includes(\"Failed to fetch\") ||\n rawMessage.includes(\"NetworkError\") ||\n rawMessage.includes(\"Load failed\")\n ) {\n return \"Unable to reach the server. Please check your internet connection and try again.\";\n }\n\n // CORS or cross-origin issues\n if (rawMessage.includes(\"CORS\") || rawMessage.includes(\"cross-origin\")) {\n return \"Unable to reach the server. Please try again or contact support.\";\n }\n\n // Generic server errors\n if (errorCode === \"INTERNAL_SERVER_ERROR\") {\n return \"Something went wrong on our end. Please try again in a few moments.\";\n }\n\n // Pass through any already-descriptive message, or fall back\n if (rawMessage && rawMessage !== \"Sign up failed\") {\n return rawMessage;\n }\n\n return \"Sign up failed. Please try again.\";\n}\n\nfunction setShellSsoCookie(userId: string): void {\n try {\n const hostname = window.location.hostname;\n const domain = hostname.endsWith(\".local.burdenoff.com\")\n ? \".local.burdenoff.com\"\n : undefined;\n const domainPart = domain ? `; domain=${domain}` : \"\";\n const securePart = window.location.protocol === \"https:\" ? \"; secure\" : \"\";\n const ssoValue = JSON.stringify({\n id: userId,\n origin: window.location.origin,\n });\n document.cookie = `bf-sso=${encodeURIComponent(ssoValue)}${domainPart}; path=/; samesite=lax${securePart}; max-age=86400`;\n document.cookie = `bf-sso-profile=${encodeURIComponent(ssoValue)}${domainPart}; path=/; samesite=lax${securePart}; max-age=86400`;\n } catch {\n // Best effort only.\n }\n}\n\nfunction toProfileUser(user: User): ProfileUser {\n return { ...user };\n}\n\ninterface GraphQLErrorLike {\n message?: string;\n extensions?: Record<string, unknown>;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n return typeof value === \"object\" && value !== null;\n}\n\nfunction asGraphQLErrorArray(value: unknown): GraphQLErrorLike[] {\n if (!Array.isArray(value)) return [];\n return value.filter((item): item is GraphQLErrorLike => isRecord(item));\n}\n\nfunction getGraphQLErrors(error: unknown): GraphQLErrorLike[] {\n if (!isRecord(error)) return [];\n const directErrors = asGraphQLErrorArray(error.errors);\n if (directErrors.length > 0) return directErrors;\n return asGraphQLErrorArray(error.graphQLErrors);\n}\n\nfunction getUnknownErrorMessage(error: unknown): string | undefined {\n if (error instanceof Error) return error.message;\n if (isRecord(error) && typeof error.message === \"string\") {\n return error.message;\n }\n return undefined;\n}\n\nfunction getGraphQLErrorCode(\n error: GraphQLErrorLike | undefined,\n): string | null {\n const code = error?.extensions?.code;\n return typeof code === \"string\" ? code : null;\n}\n\n// =============================================================================\n// GRAPHQL RESPONSE INTERFACES (Apollo Client 4.x)\n// =============================================================================\n\ninterface SignInResponse {\n signIn: AuthPayload;\n}\n\ninterface SignInVariables {\n input: SignInInput;\n}\n\ninterface SignUpResponse {\n signUp: AuthPayload;\n}\n\ninterface SignUpVariables {\n input: SignUpInput;\n}\n\ninterface SignOutResponse {\n signOut: boolean;\n}\n\ninterface RefreshTokenResponse {\n refreshToken: AuthPayload;\n}\n\ninterface RefreshTokenVariables {\n token: string;\n}\n\ninterface CurrentUserResponse {\n currentUser: User | null;\n}\n\ninterface UseAuthOperationsOptions {\n disableCurrentUserQuery?: boolean;\n}\n\ninterface VerifyEmailResponse {\n verifyEmail: {\n success: boolean;\n message: string;\n };\n}\n\ninterface VerifyEmailVariables {\n token: string;\n}\n\ninterface ResendVerificationEmailResponse {\n resendVerificationEmail: {\n success: boolean;\n message: string;\n };\n}\n\ninterface ResendVerificationEmailVariables {\n email: string;\n}\n\n// GraphQL Operations\n\n// SignIn mutation with MFA support\n\n/**\n * Hook for authentication operations\n * Uses Zustand v5 pattern: selectors for state, getState() for actions\n */\nexport function useAuthOperations(options: UseAuthOperationsOptions = {}) {\n // Use selectors for reactive state values\n const isLoading = useAuthStore((state) => state.isLoading);\n const error = useAuthStore((state) => state.error);\n const errorCode = useAuthStore((state) => state.errorCode);\n const isAuthenticated = useAuthStore((state) => state.isAuthenticated);\n const user = useAuthStore((state) => state.user);\n const accessToken = useAuthStore((state) => state.accessToken);\n const disableCurrentUserQuery = options.disableCurrentUserQuery ?? false;\n\n // Track whether signIn just completed — skip the CurrentUser refetch\n // because signIn already returns the full user object.\n const loginJustCompletedRef = useRef(false);\n\n const context = useAuth();\n const eventBus = useEventBus();\n const apolloClient = useApolloClient();\n const [signInMutation] = useMutation<SignInResponse, SignInVariables>(\n SignInDocument,\n );\n const [signUpMutation] = useMutation<SignUpResponse, SignUpVariables>(\n SignUpDocument,\n );\n const [signOutMutation] = useMutation<SignOutResponse>(SignOutDocument);\n const [refreshTokenMutation] = useMutation<\n RefreshTokenResponse,\n RefreshTokenVariables\n >(RefreshTokenDocument);\n const [verifyEmailMutation] = useMutation<\n VerifyEmailResponse,\n VerifyEmailVariables\n >(VerifyEmailDocument);\n const [resendVerificationMutation] = useMutation<\n ResendVerificationEmailResponse,\n ResendVerificationEmailVariables\n >(ResendVerificationEmailDocument);\n\n /**\n * Sign in with email/username and password\n * Uses signIn mutation which returns correct token format (with 'sub' field)\n */\n const signIn = async (input: SignInInput): Promise<AuthResult> => {\n const store = useAuthStore.getState();\n\n try {\n store.setLoading(true);\n store.setError(null);\n\n // rememberMe is sent to the backend so the server can issue\n // longer-lived refresh tokens (30 days instead of 7 days)\n\n // Use signIn mutation (returns correct token format with 'sub' field)\n const result = await signInMutation({\n variables: { input },\n // Override client-level errorPolicy to ensure errors are thrown\n // and caught by our catch block for proper error message extraction\n errorPolicy: \"none\",\n });\n\n // If we reach here, the mutation succeeded (no errors thrown)\n // Check if data.signIn is present\n if (!result.data || !result.data.signIn) {\n const errorMessage =\n \"Sign in failed. Please check your credentials and try again.\";\n store.setError(errorMessage);\n return {\n success: false,\n error: errorMessage,\n } as AuthResult;\n }\n\n const data = result.data;\n\n const authResult = data.signIn;\n\n // Check if MFA is required\n if (authResult.requiresMFA && authResult.mfaChallengeId) {\n store.setMfaRequired(true, authResult.mfaChallengeId);\n\n // Return success but with requiresMFA flag\n return {\n success: true,\n requiresMFA: true,\n mfaChallengeId: authResult.mfaChallengeId,\n metadata: {\n mfaMethod: authResult.mfaMethod,\n },\n } as AuthResult;\n }\n\n // Normal login without MFA - store the authentication result\n if (\n authResult.user &&\n authResult.accessToken &&\n authResult.refreshToken\n ) {\n // Signal that user data is fresh from signIn — skip CurrentUser refetch.\n loginJustCompletedRef.current = true;\n store.setUser(authResult.user);\n store.setAuthTokens(authResult.accessToken, authResult.refreshToken);\n store.setAuthenticated(true);\n store.setMfaRequired(false);\n\n const expiresAt = authResult.expiresIn\n ? Date.now() + authResult.expiresIn * 1000\n : undefined;\n loginProfile(toProfileUser(authResult.user), {\n accessToken: authResult.accessToken,\n refreshToken: authResult.refreshToken,\n expiresAt,\n });\n setShellSsoCookie(authResult.user.id);\n\n eventBus.emit(\n \"auth.signed_in\",\n {\n userId: authResult.user.id,\n tenantId: authResult.user.tenantId,\n workspaceId: authResult.user.defaultWorkspaceId,\n mfaEnabled: authResult.user.mfaEnabled,\n emailVerified: authResult.user.emailVerified,\n },\n { component: \"useAuthOperations\" },\n );\n\n context.onAuthSuccess?.(\n authResult.user,\n authResult.accessToken,\n authResult.refreshToken,\n );\n\n // Convert AuthPayload to AuthResult for consistent return type\n return {\n success: true,\n user: authResult.user,\n token: authResult.accessToken,\n refreshToken: authResult.refreshToken,\n expiresIn: authResult.expiresIn,\n requiresMFA: false,\n } as AuthResult;\n } else {\n const errorMsg = \"Login failed: Invalid response from server\";\n store.setError(errorMsg);\n return {\n success: false,\n error: errorMsg,\n } as AuthResult;\n }\n } catch (err: unknown) {\n // Extract error message and code from GraphQL error responses.\n // The backend sends user-friendly messages in gqlError.message and\n // structured error codes in gqlError.extensions.code (e.g., ACCOUNT_DELETED,\n // ACCOUNT_SUSPENDED, ACCOUNT_INACTIVE, OAUTH_ONLY_ACCOUNT, EMAIL_NOT_VERIFIED,\n // UNAUTHENTICATED, INTERNAL_SERVER_ERROR).\n // IMPORTANT: Never use gqlError.extensions.originalError — it may contain\n // internal details that should not be shown to users.\n let message = \"Sign in failed\";\n let errorCode: string | null = null;\n const graphQLErrors = getGraphQLErrors(err);\n if (graphQLErrors.length > 0) {\n // Apollo v4 CombinedGraphQLErrors\n // Apollo v3 ApolloError — use message only, never originalError\n const gqlError = graphQLErrors[0];\n message = gqlError.message || message;\n errorCode = getGraphQLErrorCode(gqlError);\n } else {\n message = getUnknownErrorMessage(err) ?? message;\n }\n\n console.error(\n \"[SignIn] Error:\",\n message,\n errorCode ? `(${errorCode})` : \"\",\n );\n store.setError(message, errorCode);\n return {\n success: false,\n error: message,\n } as AuthResult;\n } finally {\n store.setLoading(false);\n }\n };\n\n /**\n * Sign up new user\n */\n const signUp = async (input: SignUpInput) => {\n const store = useAuthStore.getState();\n\n try {\n store.setLoading(true);\n store.setError(null);\n\n const mutationResult = await signUpMutation({\n variables: { input },\n });\n\n // With errorPolicy: 'all', errors are returned in result, not thrown\n // Check for GraphQL errors first\n const graphQLErrors = getGraphQLErrors(mutationResult);\n if (graphQLErrors.length > 0) {\n const errorMessage = graphQLErrors[0].message ?? \"Sign up failed\";\n console.error(\"[SignUp] GraphQL error:\", errorMessage);\n store.setError(errorMessage);\n throw new Error(errorMessage);\n }\n\n // Check if data.signUp is null (indicates GraphQL error without explicit error)\n if (!mutationResult.data || !mutationResult.data.signUp) {\n const errorMessage = \"Sign up failed: No response from server\";\n console.error(\"[SignUp] No data:\", errorMessage);\n store.setError(errorMessage);\n throw new Error(errorMessage);\n }\n\n const result = mutationResult.data.signUp;\n\n // Check if user was created\n if (!result.user) {\n throw new Error(\"Sign up failed: No user data returned\");\n }\n\n // Check if email verification is required (empty tokens)\n if (\n !result.accessToken ||\n !result.refreshToken ||\n result.accessToken === \"\" ||\n result.refreshToken === \"\"\n ) {\n // User created successfully but needs to verify email\n // Don't set authenticated state, but store the user for display\n store.setUser(result.user);\n store.setAuthenticated(false);\n\n // Return special result indicating email verification needed\n return {\n ...result,\n requiresEmailVerification: true,\n };\n }\n\n // Normal sign up with immediate access (tokens provided)\n store.setUser(result.user);\n store.setAuthTokens(result.accessToken, result.refreshToken);\n store.setAuthenticated(true);\n\n eventBus.emit(\n \"auth.signed_up\",\n {\n userId: result.user.id,\n tenantId: result.user.tenantId,\n workspaceId: result.user.defaultWorkspaceId,\n mfaEnabled: result.user.mfaEnabled,\n emailVerified: result.user.emailVerified,\n },\n { component: \"useAuthOperations\" },\n );\n\n context.onAuthSuccess?.(\n result.user,\n result.accessToken,\n result.refreshToken,\n );\n\n return result;\n } catch (err: unknown) {\n // Extract error message from Apollo error or regular error\n let message = \"Sign up failed. Please try again.\";\n let errorCode: string | undefined;\n\n const graphQLErrors = getGraphQLErrors(err);\n if (graphQLErrors.length > 0) {\n const gqlError = graphQLErrors[0];\n errorCode = getGraphQLErrorCode(gqlError) ?? undefined;\n const rawMessage = gqlError.message ?? \"\";\n\n // Map backend error codes to user-friendly messages\n message = mapSignUpError(rawMessage, errorCode);\n } else {\n const rawMessage = getUnknownErrorMessage(err);\n if (rawMessage) {\n message = mapSignUpError(rawMessage);\n }\n }\n\n store.setError(message, errorCode ?? null);\n throw new Error(message);\n } finally {\n store.setLoading(false);\n }\n };\n\n /**\n * Sign out current session\n */\n const signOut = async () => {\n const store = useAuthStore.getState();\n const signedOutUser = store.user;\n\n try {\n await signOutMutation();\n } catch (err) {\n console.error(\"Sign out failed:\", err);\n }\n\n // Always clear Apollo cache so stale user data doesn't survive re-login\n await apolloClient.clearStore();\n store.clearAuth();\n eventBus.emit(\n \"auth.signed_out\",\n {\n userId: signedOutUser?.id,\n tenantId: signedOutUser?.tenantId,\n workspaceId: signedOutUser?.defaultWorkspaceId,\n },\n { component: \"useAuthOperations\" },\n );\n\n // If other profiles exist after clearing the current one, switch to the first\n // remaining profile instead of fully logging out.\n const remainingProfiles = getProfiles().filter(\n (p) => p.id !== signedOutUser?.id,\n );\n if (remainingProfiles.length > 0) {\n const nextProfile = remainingProfiles[0];\n const nextTokens = getProfileTokens(nextProfile.id);\n const nextUser = getProfileUser(nextProfile.id);\n if (nextTokens?.accessToken && nextUser) {\n // Switch to next profile instead of fully logging out\n store.loadFromProfile(nextProfile.id);\n return;\n }\n }\n\n context.onLogout?.();\n };\n\n /**\n * Refresh access token\n */\n const refreshToken = async () => {\n const store = useAuthStore.getState();\n\n try {\n const token = store.refreshToken;\n if (!token) throw new Error(\"No refresh token available\");\n\n const { data } = await refreshTokenMutation({\n variables: { token },\n });\n\n const result = data!.refreshToken;\n\n // Refresh token should always return valid tokens and user\n if (!result.accessToken || !result.refreshToken || !result.user) {\n throw new Error(\"Token refresh failed: Invalid response from server\");\n }\n\n store.setAuthTokens(result.accessToken, result.refreshToken);\n store.setUser(result.user);\n\n eventBus.emit(\n \"auth.token_refreshed\",\n {\n userId: result.user.id,\n tenantId: result.user.tenantId,\n workspaceId: result.user.defaultWorkspaceId,\n mfaEnabled: result.user.mfaEnabled,\n emailVerified: result.user.emailVerified,\n },\n { component: \"useAuthOperations\" },\n );\n\n return result;\n } catch (err) {\n // Refresh failed, logout user\n eventBus.emit(\n \"auth.token_refresh_failed\",\n {\n userId: store.user?.id,\n tenantId: store.user?.tenantId,\n workspaceId: store.user?.defaultWorkspaceId,\n reason: err instanceof Error ? err.message : \"Token refresh failed\",\n },\n { component: \"useAuthOperations\" },\n );\n store.clearAuth();\n throw err;\n }\n };\n\n /**\n * Get current user.\n * Skip when:\n * - Not authenticated\n * - Login just completed (user data is already fresh from signIn response)\n *\n * The loginJustCompletedRef is cleared after the first successful fetch\n * or on the next render cycle after navigation.\n */\n const { data: currentUserData, refetch: refetchCurrentUser } =\n useQuery<CurrentUserResponse>(CurrentUserDocument, {\n skip:\n disableCurrentUserQuery ||\n !isAuthenticated ||\n loginJustCompletedRef.current,\n fetchPolicy: \"network-only\",\n });\n\n // Handle currentUser data updates (replaces onCompleted callback)\n useEffect(() => {\n if (currentUserData?.currentUser) {\n useAuthStore.getState().setUser(currentUserData.currentUser);\n }\n }, [currentUserData]);\n\n // Clear loginJustCompletedRef after navigation away from login page\n // so subsequent CurrentUser queries work normally (e.g., profile page).\n useEffect(() => {\n if (loginJustCompletedRef.current && isAuthenticated) {\n const timer = setTimeout(() => {\n loginJustCompletedRef.current = false;\n }, 2000);\n return () => clearTimeout(timer);\n }\n }, [isAuthenticated]);\n\n /**\n * Verify email with token\n * Returns { success, message, email } on success\n */\n const verifyEmail = async (\n token: string,\n ): Promise<{ success: boolean; message: string; email?: string }> => {\n const store = useAuthStore.getState();\n\n try {\n store.setLoading(true);\n const { data } = await verifyEmailMutation({ variables: { token } });\n\n if (data!.verifyEmail.success && store.user) {\n store.setUser({ ...store.user, emailVerified: true });\n }\n\n return data!.verifyEmail;\n } catch (err) {\n const message =\n err instanceof Error ? err.message : \"Email verification failed\";\n store.setError(message);\n throw err;\n } finally {\n store.setLoading(false);\n }\n };\n\n /**\n * Resend verification email\n */\n const resendVerification = async (email: string) => {\n try {\n const { data } = await resendVerificationMutation({\n variables: { email },\n });\n return data!.resendVerificationEmail;\n } catch (err) {\n console.error(\"Failed to resend verification email:\", err);\n throw err;\n }\n };\n\n // Legacy aliases for backwards compatibility\n const login = signIn;\n const register = signUp;\n const logout = signOut;\n\n return {\n // New API\n signIn,\n signUp,\n signOut,\n refreshToken,\n verifyEmail,\n resendVerification,\n refetchCurrentUser,\n // Legacy aliases\n login,\n register,\n logout,\n // State (reactive via selectors)\n isLoading,\n error,\n errorCode,\n isAuthenticated,\n user,\n accessToken,\n };\n}\n"],"mappings":";;;;;;;;AAqCA,SAAS,EAAe,GAAoB,GAA4B;AAqCtE,QAlCE,EAAW,SAAS,mCAAmC,IACvD,MAAc,mBAEP,oGAGL,MAAc,2BACT,sHAKP,EAAW,SAAS,kBAAkB,IACtC,EAAW,SAAS,eAAe,IACnC,EAAW,SAAS,cAAc,GAE3B,qFAIL,EAAW,SAAS,OAAO,IAAI,EAAW,SAAS,eAAe,GAC7D,qEAIL,MAAc,0BACT,wEAIL,KAAc,MAAe,mBACxB,IAGF;;AAGT,SAAS,EAAkB,GAAsB;AAC/C,KAAI;EAEF,IAAM,IADW,OAAO,SAAS,SACT,SAAS,uBAAuB,GACpD,yBACA,KAAA,GACE,IAAa,IAAS,YAAY,MAAW,IAC7C,IAAa,OAAO,SAAS,aAAa,WAAW,aAAa,IAClE,IAAW,KAAK,UAAU;GAC9B,IAAI;GACJ,QAAQ,OAAO,SAAS;GACzB,CAAC;AAEF,EADA,SAAS,SAAS,UAAU,mBAAmB,EAAS,GAAG,EAAW,wBAAwB,EAAW,kBACzG,SAAS,SAAS,kBAAkB,mBAAmB,EAAS,GAAG,EAAW,wBAAwB,EAAW;SAC3G;;AAKV,SAAS,EAAc,GAAyB;AAC9C,QAAO,EAAE,GAAG,GAAM;;AAQpB,SAAS,EAAS,GAAkD;AAClE,QAAO,OAAO,KAAU,cAAY;;AAGtC,SAAS,EAAoB,GAAoC;AAE/D,QADK,MAAM,QAAQ,EAAM,GAClB,EAAM,QAAQ,MAAmC,EAAS,EAAK,CAAC,GADrC,EAAE;;AAItC,SAAS,EAAiB,GAAoC;AAC5D,KAAI,CAAC,EAAS,EAAM,CAAE,QAAO,EAAE;CAC/B,IAAM,IAAe,EAAoB,EAAM,OAAO;AAEtD,QADI,EAAa,SAAS,IAAU,IAC7B,EAAoB,EAAM,cAAc;;AAGjD,SAAS,EAAuB,GAAoC;AAElE,KADI,aAAiB,SACjB,EAAS,EAAM,IAAI,OAAO,EAAM,WAAY,SAC9C,QAAO,EAAM;;AAKjB,SAAS,EACP,GACe;CACf,IAAM,IAAO,GAAO,YAAY;AAChC,QAAO,OAAO,KAAS,WAAW,IAAO;;AAyE3C,SAAgB,EAAkB,IAAoC,EAAE,EAAE;CAExE,IAAM,IAAY,GAAc,MAAU,EAAM,UAAU,EACpD,IAAQ,GAAc,MAAU,EAAM,MAAM,EAC5C,IAAY,GAAc,MAAU,EAAM,UAAU,EACpD,IAAkB,GAAc,MAAU,EAAM,gBAAgB,EAChE,IAAO,GAAc,MAAU,EAAM,KAAK,EAC1C,IAAc,GAAc,MAAU,EAAM,YAAY,EACxD,IAA0B,EAAQ,2BAA2B,IAI7D,IAAwB,EAAO,GAAM,EAErC,IAAU,GAAS,EACnB,IAAW,GAAa,EACxB,IAAe,GAAiB,EAChC,CAAC,KAAkB,EACvB,EACD,EACK,CAAC,KAAkB,EACvB,EACD,EACK,CAAC,KAAmB,EAA6B,EAAgB,EACjE,CAAC,KAAwB,EAG7B,EAAqB,EACjB,CAAC,KAAuB,EAG5B,EAAoB,EAChB,CAAC,KAA8B,EAGnC,EAAgC,EAM5B,IAAS,OAAO,MAA4C;EAChE,IAAM,IAAQ,EAAa,UAAU;AAErC,MAAI;AAEF,GADA,EAAM,WAAW,GAAK,EACtB,EAAM,SAAS,KAAK;GAMpB,IAAM,IAAS,MAAM,EAAe;IAClC,WAAW,EAAE,UAAO;IAGpB,aAAa;IACd,CAAC;AAIF,OAAI,CAAC,EAAO,QAAQ,CAAC,EAAO,KAAK,QAAQ;IACvC,IAAM,IACJ;AAEF,WADA,EAAM,SAAS,EAAa,EACrB;KACL,SAAS;KACT,OAAO;KACR;;GAKH,IAAM,IAFO,EAAO,KAEI;AAGxB,OAAI,EAAW,eAAe,EAAW,eAIvC,QAHA,EAAM,eAAe,IAAM,EAAW,eAAe,EAG9C;IACL,SAAS;IACT,aAAa;IACb,gBAAgB,EAAW;IAC3B,UAAU,EACR,WAAW,EAAW,WACvB;IACF;AAIH,OACE,EAAW,QACX,EAAW,eACX,EAAW,cACX;AAMA,IAJA,EAAsB,UAAU,IAChC,EAAM,QAAQ,EAAW,KAAK,EAC9B,EAAM,cAAc,EAAW,aAAa,EAAW,aAAa,EACpE,EAAM,iBAAiB,GAAK,EAC5B,EAAM,eAAe,GAAM;IAE3B,IAAM,IAAY,EAAW,YACzB,KAAK,KAAK,GAAG,EAAW,YAAY,MACpC,KAAA;AA2BJ,WA1BA,EAAa,EAAc,EAAW,KAAK,EAAE;KAC3C,aAAa,EAAW;KACxB,cAAc,EAAW;KACzB;KACD,CAAC,EACF,EAAkB,EAAW,KAAK,GAAG,EAErC,EAAS,KACP,kBACA;KACE,QAAQ,EAAW,KAAK;KACxB,UAAU,EAAW,KAAK;KAC1B,aAAa,EAAW,KAAK;KAC7B,YAAY,EAAW,KAAK;KAC5B,eAAe,EAAW,KAAK;KAChC,EACD,EAAE,WAAW,qBAAqB,CACnC,EAED,EAAQ,gBACN,EAAW,MACX,EAAW,aACX,EAAW,aACZ,EAGM;KACL,SAAS;KACT,MAAM,EAAW;KACjB,OAAO,EAAW;KAClB,cAAc,EAAW;KACzB,WAAW,EAAW;KACtB,aAAa;KACd;UACI;IACL,IAAM,IAAW;AAEjB,WADA,EAAM,SAAS,EAAS,EACjB;KACL,SAAS;KACT,OAAO;KACR;;WAEI,GAAc;GAQrB,IAAI,IAAU,kBACV,IAA2B,MACzB,IAAgB,EAAiB,EAAI;AAC3C,OAAI,EAAc,SAAS,GAAG;IAG5B,IAAM,IAAW,EAAc;AAE/B,IADA,IAAU,EAAS,WAAW,GAC9B,IAAY,EAAoB,EAAS;SAEzC,KAAU,EAAuB,EAAI,IAAI;AAS3C,UANA,QAAQ,MACN,mBACA,GACA,IAAY,IAAI,EAAU,KAAK,GAChC,EACD,EAAM,SAAS,GAAS,EAAU,EAC3B;IACL,SAAS;IACT,OAAO;IACR;YACO;AACR,KAAM,WAAW,GAAM;;IAOrB,IAAS,OAAO,MAAuB;EAC3C,IAAM,IAAQ,EAAa,UAAU;AAErC,MAAI;AAEF,GADA,EAAM,WAAW,GAAK,EACtB,EAAM,SAAS,KAAK;GAEpB,IAAM,IAAiB,MAAM,EAAe,EAC1C,WAAW,EAAE,UAAO,EACrB,CAAC,EAII,IAAgB,EAAiB,EAAe;AACtD,OAAI,EAAc,SAAS,GAAG;IAC5B,IAAM,IAAe,EAAc,GAAG,WAAW;AAGjD,UAFA,QAAQ,MAAM,2BAA2B,EAAa,EACtD,EAAM,SAAS,EAAa,EAClB,MAAM,EAAa;;AAI/B,OAAI,CAAC,EAAe,QAAQ,CAAC,EAAe,KAAK,QAAQ;IACvD,IAAM,IAAe;AAGrB,UAFA,QAAQ,MAAM,qBAAqB,EAAa,EAChD,EAAM,SAAS,EAAa,EAClB,MAAM,EAAa;;GAG/B,IAAM,IAAS,EAAe,KAAK;AAGnC,OAAI,CAAC,EAAO,KACV,OAAU,MAAM,wCAAwC;AA6C1D,UAxCE,CAAC,EAAO,eACR,CAAC,EAAO,gBACR,EAAO,gBAAgB,MACvB,EAAO,iBAAiB,MAIxB,EAAM,QAAQ,EAAO,KAAK,EAC1B,EAAM,iBAAiB,GAAM,EAGtB;IACL,GAAG;IACH,2BAA2B;IAC5B,KAIH,EAAM,QAAQ,EAAO,KAAK,EAC1B,EAAM,cAAc,EAAO,aAAa,EAAO,aAAa,EAC5D,EAAM,iBAAiB,GAAK,EAE5B,EAAS,KACP,kBACA;IACE,QAAQ,EAAO,KAAK;IACpB,UAAU,EAAO,KAAK;IACtB,aAAa,EAAO,KAAK;IACzB,YAAY,EAAO,KAAK;IACxB,eAAe,EAAO,KAAK;IAC5B,EACD,EAAE,WAAW,qBAAqB,CACnC,EAED,EAAQ,gBACN,EAAO,MACP,EAAO,aACP,EAAO,aACR,EAEM;WACA,GAAc;GAErB,IAAI,IAAU,qCACV,GAEE,IAAgB,EAAiB,EAAI;AAC3C,OAAI,EAAc,SAAS,GAAG;IAC5B,IAAM,IAAW,EAAc;AAK/B,IAJA,IAAY,EAAoB,EAAS,IAAI,KAAA,GAI7C,IAAU,EAHS,EAAS,WAAW,IAGF,EAAU;UAC1C;IACL,IAAM,IAAa,EAAuB,EAAI;AAC9C,IAAI,MACF,IAAU,EAAe,EAAW;;AAKxC,SADA,EAAM,SAAS,GAAS,KAAa,KAAK,EAChC,MAAM,EAAQ;YAChB;AACR,KAAM,WAAW,GAAM;;IAOrB,IAAU,YAAY;EAC1B,IAAM,IAAQ,EAAa,UAAU,EAC/B,IAAgB,EAAM;AAE5B,MAAI;AACF,SAAM,GAAiB;WAChB,GAAK;AACZ,WAAQ,MAAM,oBAAoB,EAAI;;AAMxC,EAFA,MAAM,EAAa,YAAY,EAC/B,EAAM,WAAW,EACjB,EAAS,KACP,mBACA;GACE,QAAQ,GAAe;GACvB,UAAU,GAAe;GACzB,aAAa,GAAe;GAC7B,EACD,EAAE,WAAW,qBAAqB,CACnC;EAID,IAAM,IAAoB,GAAa,CAAC,QACrC,MAAM,EAAE,OAAO,GAAe,GAChC;AACD,MAAI,EAAkB,SAAS,GAAG;GAChC,IAAM,IAAc,EAAkB,IAChC,IAAa,EAAiB,EAAY,GAAG,EAC7C,IAAW,EAAe,EAAY,GAAG;AAC/C,OAAI,GAAY,eAAe,GAAU;AAEvC,MAAM,gBAAgB,EAAY,GAAG;AACrC;;;AAIJ,IAAQ,YAAY;IAMhB,IAAe,YAAY;EAC/B,IAAM,IAAQ,EAAa,UAAU;AAErC,MAAI;GACF,IAAM,IAAQ,EAAM;AACpB,OAAI,CAAC,EAAO,OAAU,MAAM,6BAA6B;GAEzD,IAAM,EAAE,YAAS,MAAM,EAAqB,EAC1C,WAAW,EAAE,UAAO,EACrB,CAAC,EAEI,IAAS,EAAM;AAGrB,OAAI,CAAC,EAAO,eAAe,CAAC,EAAO,gBAAgB,CAAC,EAAO,KACzD,OAAU,MAAM,qDAAqD;AAkBvE,UAfA,EAAM,cAAc,EAAO,aAAa,EAAO,aAAa,EAC5D,EAAM,QAAQ,EAAO,KAAK,EAE1B,EAAS,KACP,wBACA;IACE,QAAQ,EAAO,KAAK;IACpB,UAAU,EAAO,KAAK;IACtB,aAAa,EAAO,KAAK;IACzB,YAAY,EAAO,KAAK;IACxB,eAAe,EAAO,KAAK;IAC5B,EACD,EAAE,WAAW,qBAAqB,CACnC,EAEM;WACA,GAAK;AAaZ,SAXA,EAAS,KACP,6BACA;IACE,QAAQ,EAAM,MAAM;IACpB,UAAU,EAAM,MAAM;IACtB,aAAa,EAAM,MAAM;IACzB,QAAQ,aAAe,QAAQ,EAAI,UAAU;IAC9C,EACD,EAAE,WAAW,qBAAqB,CACnC,EACD,EAAM,WAAW,EACX;;IAaJ,EAAE,MAAM,GAAiB,SAAS,MACtC,EAA8B,GAAqB;EACjD,MACE,KACA,CAAC,KACD,EAAsB;EACxB,aAAa;EACd,CAAC;AAoEJ,QAjEA,QAAgB;AACd,EAAI,GAAiB,eACnB,EAAa,UAAU,CAAC,QAAQ,EAAgB,YAAY;IAE7D,CAAC,EAAgB,CAAC,EAIrB,QAAgB;AACd,MAAI,EAAsB,WAAW,GAAiB;GACpD,IAAM,IAAQ,iBAAiB;AAC7B,MAAsB,UAAU;MAC/B,IAAK;AACR,gBAAa,aAAa,EAAM;;IAEjC,CAAC,EAAgB,CAAC,EAkDd;EAEL;EACA;EACA;EACA;EACA,aAlDkB,OAClB,MACmE;GACnE,IAAM,IAAQ,EAAa,UAAU;AAErC,OAAI;AACF,MAAM,WAAW,GAAK;IACtB,IAAM,EAAE,YAAS,MAAM,EAAoB,EAAE,WAAW,EAAE,UAAO,EAAE,CAAC;AAMpE,WAJI,EAAM,YAAY,WAAW,EAAM,QACrC,EAAM,QAAQ;KAAE,GAAG,EAAM;KAAM,eAAe;KAAM,CAAC,EAGhD,EAAM;YACN,GAAK;IACZ,IAAM,IACJ,aAAe,QAAQ,EAAI,UAAU;AAEvC,UADA,EAAM,SAAS,EAAQ,EACjB;aACE;AACR,MAAM,WAAW,GAAM;;;EA+BzB,oBAxByB,OAAO,MAAkB;AAClD,OAAI;IACF,IAAM,EAAE,YAAS,MAAM,EAA2B,EAChD,WAAW,EAAE,UAAO,EACrB,CAAC;AACF,WAAO,EAAM;YACN,GAAK;AAEZ,UADA,QAAQ,MAAM,wCAAwC,EAAI,EACpD;;;EAiBR;EAEA,OAdY;EAeZ,UAde;EAef,QAda;EAgBb;EACA;EACA;EACA;EACA;EACA;EACD"}
1
+ {"version":3,"file":"useAuthOperations.js","names":[],"sources":["../../../src/auth/hooks/useAuthOperations.ts"],"sourcesContent":["import { useEffect, useRef } from \"react\";\nimport { useMutation, useQuery, useApolloClient } from \"@apollo/client/react\";\nimport { useEventBus } from \"@burdenoff/fe-libs/shared/events\";\nimport {\n loginProfile,\n getProfiles,\n getProfileTokens,\n getProfileUser,\n type ProfileUser,\n} from \"@burdenoff/fe-libs/shared/providers/shell/ProfileStorageManager\";\nimport { useAuthStore } from \"../store/authStore\";\nimport { useAuth } from \"../providers/AuthProvider\";\nimport {\n SignInDocument,\n SignUpDocument,\n SignOutDocument,\n RefreshTokenDocument,\n CurrentUserDocument,\n VerifyEmailDocument,\n ResendVerificationEmailDocument,\n} from \"../../generated/global-operations\";\nimport type {\n SignInInput,\n SignUpInput,\n User,\n AuthPayload,\n AuthResult,\n} from \"../types\";\n\n// =============================================================================\n// ERROR MAPPING HELPERS\n// =============================================================================\n\n/**\n * Map raw backend error messages to user-friendly descriptions.\n * Keeps a single source of truth for all sign-up error copy.\n */\nfunction mapSignUpError(rawMessage: string, errorCode?: string): string {\n // Non-active accounts on this email — route the user to the right recovery\n // path. RegisterPage reads the errorCode to render the matching CTA.\n if (errorCode === \"ACCOUNT_DEACTIVATED\") {\n return \"This email belongs to a deactivated account. You can reactivate it instead of signing up again.\";\n }\n if (errorCode === \"ACCOUNT_REMOVED\") {\n return \"This account was removed by an administrator. Please contact support to restore it.\";\n }\n if (errorCode === \"ACCOUNT_SUSPENDED\") {\n return \"This account is suspended. Please contact support.\";\n }\n\n // Exact matches from the backend\n if (\n rawMessage.includes(\"email or username already exists\") ||\n errorCode === \"BAD_USER_INPUT\"\n ) {\n return \"An account with this email or username already exists. Please sign in or use a different email.\";\n }\n\n if (errorCode === \"TENANT_CREATION_FAILED\") {\n return \"We couldn't finish setting up your account. Please try again in a few moments. If this persists, contact support.\";\n }\n\n // Network / fetch failures (Apollo wraps these)\n if (\n rawMessage.includes(\"Failed to fetch\") ||\n rawMessage.includes(\"NetworkError\") ||\n rawMessage.includes(\"Load failed\")\n ) {\n return \"Unable to reach the server. Please check your internet connection and try again.\";\n }\n\n // CORS or cross-origin issues\n if (rawMessage.includes(\"CORS\") || rawMessage.includes(\"cross-origin\")) {\n return \"Unable to reach the server. Please try again or contact support.\";\n }\n\n // Generic server errors\n if (errorCode === \"INTERNAL_SERVER_ERROR\") {\n return \"Something went wrong on our end. Please try again in a few moments.\";\n }\n\n // Pass through any already-descriptive message, or fall back\n if (rawMessage && rawMessage !== \"Sign up failed\") {\n return rawMessage;\n }\n\n return \"Sign up failed. Please try again.\";\n}\n\nfunction setShellSsoCookie(userId: string): void {\n try {\n const hostname = window.location.hostname;\n const domain = hostname.endsWith(\".local.burdenoff.com\")\n ? \".local.burdenoff.com\"\n : undefined;\n const domainPart = domain ? `; domain=${domain}` : \"\";\n const securePart = window.location.protocol === \"https:\" ? \"; secure\" : \"\";\n const ssoValue = JSON.stringify({\n id: userId,\n origin: window.location.origin,\n });\n document.cookie = `bf-sso=${encodeURIComponent(ssoValue)}${domainPart}; path=/; samesite=lax${securePart}; max-age=86400`;\n document.cookie = `bf-sso-profile=${encodeURIComponent(ssoValue)}${domainPart}; path=/; samesite=lax${securePart}; max-age=86400`;\n } catch {\n // Best effort only.\n }\n}\n\nfunction toProfileUser(user: User): ProfileUser {\n return { ...user };\n}\n\ninterface GraphQLErrorLike {\n message?: string;\n extensions?: Record<string, unknown>;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n return typeof value === \"object\" && value !== null;\n}\n\nfunction asGraphQLErrorArray(value: unknown): GraphQLErrorLike[] {\n if (!Array.isArray(value)) return [];\n return value.filter((item): item is GraphQLErrorLike => isRecord(item));\n}\n\nfunction getGraphQLErrors(error: unknown): GraphQLErrorLike[] {\n if (!isRecord(error)) return [];\n const directErrors = asGraphQLErrorArray(error.errors);\n if (directErrors.length > 0) return directErrors;\n return asGraphQLErrorArray(error.graphQLErrors);\n}\n\nfunction getUnknownErrorMessage(error: unknown): string | undefined {\n if (error instanceof Error) return error.message;\n if (isRecord(error) && typeof error.message === \"string\") {\n return error.message;\n }\n return undefined;\n}\n\nfunction getGraphQLErrorCode(\n error: GraphQLErrorLike | undefined,\n): string | null {\n const code = error?.extensions?.code;\n return typeof code === \"string\" ? code : null;\n}\n\n// =============================================================================\n// GRAPHQL RESPONSE INTERFACES (Apollo Client 4.x)\n// =============================================================================\n\ninterface SignInResponse {\n signIn: AuthPayload;\n}\n\ninterface SignInVariables {\n input: SignInInput;\n}\n\ninterface SignUpResponse {\n signUp: AuthPayload;\n}\n\ninterface SignUpVariables {\n input: SignUpInput;\n}\n\ninterface SignOutResponse {\n signOut: boolean;\n}\n\ninterface RefreshTokenResponse {\n refreshToken: AuthPayload;\n}\n\ninterface RefreshTokenVariables {\n token: string;\n}\n\ninterface CurrentUserResponse {\n currentUser: User | null;\n}\n\ninterface UseAuthOperationsOptions {\n disableCurrentUserQuery?: boolean;\n}\n\ninterface VerifyEmailResponse {\n verifyEmail: {\n success: boolean;\n message: string;\n };\n}\n\ninterface VerifyEmailVariables {\n token: string;\n}\n\ninterface ResendVerificationEmailResponse {\n resendVerificationEmail: {\n success: boolean;\n message: string;\n };\n}\n\ninterface ResendVerificationEmailVariables {\n email: string;\n}\n\n// GraphQL Operations\n\n// SignIn mutation with MFA support\n\n/**\n * Hook for authentication operations\n * Uses Zustand v5 pattern: selectors for state, getState() for actions\n */\nexport function useAuthOperations(options: UseAuthOperationsOptions = {}) {\n // Use selectors for reactive state values\n const isLoading = useAuthStore((state) => state.isLoading);\n const error = useAuthStore((state) => state.error);\n const errorCode = useAuthStore((state) => state.errorCode);\n const isAuthenticated = useAuthStore((state) => state.isAuthenticated);\n const user = useAuthStore((state) => state.user);\n const accessToken = useAuthStore((state) => state.accessToken);\n const disableCurrentUserQuery = options.disableCurrentUserQuery ?? false;\n\n // Track whether signIn just completed — skip the CurrentUser refetch\n // because signIn already returns the full user object.\n const loginJustCompletedRef = useRef(false);\n\n const context = useAuth();\n const eventBus = useEventBus();\n const apolloClient = useApolloClient();\n const [signInMutation] = useMutation<SignInResponse, SignInVariables>(\n SignInDocument,\n );\n const [signUpMutation] = useMutation<SignUpResponse, SignUpVariables>(\n SignUpDocument,\n );\n const [signOutMutation] = useMutation<SignOutResponse>(SignOutDocument);\n const [refreshTokenMutation] = useMutation<\n RefreshTokenResponse,\n RefreshTokenVariables\n >(RefreshTokenDocument);\n const [verifyEmailMutation] = useMutation<\n VerifyEmailResponse,\n VerifyEmailVariables\n >(VerifyEmailDocument);\n const [resendVerificationMutation] = useMutation<\n ResendVerificationEmailResponse,\n ResendVerificationEmailVariables\n >(ResendVerificationEmailDocument);\n\n /**\n * Sign in with email/username and password\n * Uses signIn mutation which returns correct token format (with 'sub' field)\n */\n const signIn = async (input: SignInInput): Promise<AuthResult> => {\n const store = useAuthStore.getState();\n\n try {\n store.setLoading(true);\n store.setError(null);\n\n // rememberMe is sent to the backend so the server can issue\n // longer-lived refresh tokens (30 days instead of 7 days)\n\n // Use signIn mutation (returns correct token format with 'sub' field)\n const result = await signInMutation({\n variables: { input },\n // Override client-level errorPolicy to ensure errors are thrown\n // and caught by our catch block for proper error message extraction\n errorPolicy: \"none\",\n });\n\n // If we reach here, the mutation succeeded (no errors thrown)\n // Check if data.signIn is present\n if (!result.data || !result.data.signIn) {\n const errorMessage =\n \"Sign in failed. Please check your credentials and try again.\";\n store.setError(errorMessage);\n return {\n success: false,\n error: errorMessage,\n } as AuthResult;\n }\n\n const data = result.data;\n\n const authResult = data.signIn;\n\n // Check if MFA is required\n if (authResult.requiresMFA && authResult.mfaChallengeId) {\n store.setMfaRequired(true, authResult.mfaChallengeId);\n\n // Return success but with requiresMFA flag\n return {\n success: true,\n requiresMFA: true,\n mfaChallengeId: authResult.mfaChallengeId,\n metadata: {\n mfaMethod: authResult.mfaMethod,\n },\n } as AuthResult;\n }\n\n // Normal login without MFA - store the authentication result\n if (\n authResult.user &&\n authResult.accessToken &&\n authResult.refreshToken\n ) {\n // Signal that user data is fresh from signIn — skip CurrentUser refetch.\n loginJustCompletedRef.current = true;\n store.setUser(authResult.user);\n store.setAuthTokens(authResult.accessToken, authResult.refreshToken);\n store.setAuthenticated(true);\n store.setMfaRequired(false);\n\n const expiresAt = authResult.expiresIn\n ? Date.now() + authResult.expiresIn * 1000\n : undefined;\n loginProfile(toProfileUser(authResult.user), {\n accessToken: authResult.accessToken,\n refreshToken: authResult.refreshToken,\n expiresAt,\n });\n setShellSsoCookie(authResult.user.id);\n\n eventBus.emit(\n \"auth.signed_in\",\n {\n userId: authResult.user.id,\n tenantId: authResult.user.tenantId,\n workspaceId: authResult.user.defaultWorkspaceId,\n mfaEnabled: authResult.user.mfaEnabled,\n emailVerified: authResult.user.emailVerified,\n },\n { component: \"useAuthOperations\" },\n );\n\n context.onAuthSuccess?.(\n authResult.user,\n authResult.accessToken,\n authResult.refreshToken,\n );\n\n // Convert AuthPayload to AuthResult for consistent return type\n return {\n success: true,\n user: authResult.user,\n token: authResult.accessToken,\n refreshToken: authResult.refreshToken,\n expiresIn: authResult.expiresIn,\n requiresMFA: false,\n } as AuthResult;\n } else {\n const errorMsg = \"Login failed: Invalid response from server\";\n store.setError(errorMsg);\n return {\n success: false,\n error: errorMsg,\n } as AuthResult;\n }\n } catch (err: unknown) {\n // Extract error message and code from GraphQL error responses.\n // The backend sends user-friendly messages in gqlError.message and\n // structured error codes in gqlError.extensions.code (e.g., ACCOUNT_DELETED,\n // ACCOUNT_SUSPENDED, ACCOUNT_INACTIVE, OAUTH_ONLY_ACCOUNT, EMAIL_NOT_VERIFIED,\n // UNAUTHENTICATED, INTERNAL_SERVER_ERROR).\n // IMPORTANT: Never use gqlError.extensions.originalError — it may contain\n // internal details that should not be shown to users.\n let message = \"Sign in failed\";\n let errorCode: string | null = null;\n const graphQLErrors = getGraphQLErrors(err);\n if (graphQLErrors.length > 0) {\n // Apollo v4 CombinedGraphQLErrors\n // Apollo v3 ApolloError — use message only, never originalError\n const gqlError = graphQLErrors[0];\n message = gqlError.message || message;\n errorCode = getGraphQLErrorCode(gqlError);\n } else {\n message = getUnknownErrorMessage(err) ?? message;\n }\n\n console.error(\n \"[SignIn] Error:\",\n message,\n errorCode ? `(${errorCode})` : \"\",\n );\n store.setError(message, errorCode);\n return {\n success: false,\n error: message,\n } as AuthResult;\n } finally {\n store.setLoading(false);\n }\n };\n\n /**\n * Sign up new user\n */\n const signUp = async (input: SignUpInput) => {\n const store = useAuthStore.getState();\n\n try {\n store.setLoading(true);\n store.setError(null);\n\n const mutationResult = await signUpMutation({\n variables: { input },\n });\n\n // With errorPolicy: 'all', errors are returned in result, not thrown\n // Check for GraphQL errors first\n const graphQLErrors = getGraphQLErrors(mutationResult);\n if (graphQLErrors.length > 0) {\n const errorMessage = graphQLErrors[0].message ?? \"Sign up failed\";\n console.error(\"[SignUp] GraphQL error:\", errorMessage);\n store.setError(errorMessage);\n throw new Error(errorMessage);\n }\n\n // Check if data.signUp is null (indicates GraphQL error without explicit error)\n if (!mutationResult.data || !mutationResult.data.signUp) {\n const errorMessage = \"Sign up failed: No response from server\";\n console.error(\"[SignUp] No data:\", errorMessage);\n store.setError(errorMessage);\n throw new Error(errorMessage);\n }\n\n const result = mutationResult.data.signUp;\n\n // Check if user was created\n if (!result.user) {\n throw new Error(\"Sign up failed: No user data returned\");\n }\n\n // Check if email verification is required (empty tokens)\n if (\n !result.accessToken ||\n !result.refreshToken ||\n result.accessToken === \"\" ||\n result.refreshToken === \"\"\n ) {\n // User created successfully but needs to verify email\n // Don't set authenticated state, but store the user for display\n store.setUser(result.user);\n store.setAuthenticated(false);\n\n // Return special result indicating email verification needed\n return {\n ...result,\n requiresEmailVerification: true,\n };\n }\n\n // Normal sign up with immediate access (tokens provided)\n store.setUser(result.user);\n store.setAuthTokens(result.accessToken, result.refreshToken);\n store.setAuthenticated(true);\n\n eventBus.emit(\n \"auth.signed_up\",\n {\n userId: result.user.id,\n tenantId: result.user.tenantId,\n workspaceId: result.user.defaultWorkspaceId,\n mfaEnabled: result.user.mfaEnabled,\n emailVerified: result.user.emailVerified,\n },\n { component: \"useAuthOperations\" },\n );\n\n context.onAuthSuccess?.(\n result.user,\n result.accessToken,\n result.refreshToken,\n );\n\n return result;\n } catch (err: unknown) {\n // Extract error message from Apollo error or regular error\n let message = \"Sign up failed. Please try again.\";\n let errorCode: string | undefined;\n\n const graphQLErrors = getGraphQLErrors(err);\n if (graphQLErrors.length > 0) {\n const gqlError = graphQLErrors[0];\n errorCode = getGraphQLErrorCode(gqlError) ?? undefined;\n const rawMessage = gqlError.message ?? \"\";\n\n // Map backend error codes to user-friendly messages\n message = mapSignUpError(rawMessage, errorCode);\n } else {\n const rawMessage = getUnknownErrorMessage(err);\n if (rawMessage) {\n message = mapSignUpError(rawMessage);\n }\n }\n\n store.setError(message, errorCode ?? null);\n throw new Error(message);\n } finally {\n store.setLoading(false);\n }\n };\n\n /**\n * Sign out current session\n */\n const signOut = async () => {\n const store = useAuthStore.getState();\n const signedOutUser = store.user;\n\n try {\n await signOutMutation();\n } catch (err) {\n console.error(\"Sign out failed:\", err);\n }\n\n // Always clear Apollo cache so stale user data doesn't survive re-login\n await apolloClient.clearStore();\n store.clearAuth();\n eventBus.emit(\n \"auth.signed_out\",\n {\n userId: signedOutUser?.id,\n tenantId: signedOutUser?.tenantId,\n workspaceId: signedOutUser?.defaultWorkspaceId,\n },\n { component: \"useAuthOperations\" },\n );\n\n // If other profiles exist after clearing the current one, switch to the first\n // remaining profile instead of fully logging out.\n const remainingProfiles = getProfiles().filter(\n (p) => p.id !== signedOutUser?.id,\n );\n if (remainingProfiles.length > 0) {\n const nextProfile = remainingProfiles[0];\n const nextTokens = getProfileTokens(nextProfile.id);\n const nextUser = getProfileUser(nextProfile.id);\n if (nextTokens?.accessToken && nextUser) {\n // Switch to next profile instead of fully logging out\n store.loadFromProfile(nextProfile.id);\n return;\n }\n }\n\n context.onLogout?.();\n };\n\n /**\n * Refresh access token\n */\n const refreshToken = async () => {\n const store = useAuthStore.getState();\n\n try {\n const token = store.refreshToken;\n if (!token) throw new Error(\"No refresh token available\");\n\n const { data } = await refreshTokenMutation({\n variables: { token },\n });\n\n const result = data!.refreshToken;\n\n // Refresh token should always return valid tokens and user\n if (!result.accessToken || !result.refreshToken || !result.user) {\n throw new Error(\"Token refresh failed: Invalid response from server\");\n }\n\n store.setAuthTokens(result.accessToken, result.refreshToken);\n store.setUser(result.user);\n\n eventBus.emit(\n \"auth.token_refreshed\",\n {\n userId: result.user.id,\n tenantId: result.user.tenantId,\n workspaceId: result.user.defaultWorkspaceId,\n mfaEnabled: result.user.mfaEnabled,\n emailVerified: result.user.emailVerified,\n },\n { component: \"useAuthOperations\" },\n );\n\n return result;\n } catch (err) {\n // Refresh failed, logout user\n eventBus.emit(\n \"auth.token_refresh_failed\",\n {\n userId: store.user?.id,\n tenantId: store.user?.tenantId,\n workspaceId: store.user?.defaultWorkspaceId,\n reason: err instanceof Error ? err.message : \"Token refresh failed\",\n },\n { component: \"useAuthOperations\" },\n );\n store.clearAuth();\n throw err;\n }\n };\n\n /**\n * Get current user.\n * Skip when:\n * - Not authenticated\n * - Login just completed (user data is already fresh from signIn response)\n *\n * The loginJustCompletedRef is cleared after the first successful fetch\n * or on the next render cycle after navigation.\n */\n const { data: currentUserData, refetch: refetchCurrentUser } =\n useQuery<CurrentUserResponse>(CurrentUserDocument, {\n skip:\n disableCurrentUserQuery ||\n !isAuthenticated ||\n loginJustCompletedRef.current,\n fetchPolicy: \"network-only\",\n });\n\n // Handle currentUser data updates (replaces onCompleted callback)\n useEffect(() => {\n if (currentUserData?.currentUser) {\n useAuthStore.getState().setUser(currentUserData.currentUser);\n }\n }, [currentUserData]);\n\n // Clear loginJustCompletedRef after navigation away from login page\n // so subsequent CurrentUser queries work normally (e.g., profile page).\n useEffect(() => {\n if (loginJustCompletedRef.current && isAuthenticated) {\n const timer = setTimeout(() => {\n loginJustCompletedRef.current = false;\n }, 2000);\n return () => clearTimeout(timer);\n }\n }, [isAuthenticated]);\n\n /**\n * Verify email with token\n * Returns { success, message, email } on success\n */\n const verifyEmail = async (\n token: string,\n ): Promise<{ success: boolean; message: string; email?: string }> => {\n const store = useAuthStore.getState();\n\n try {\n store.setLoading(true);\n const { data } = await verifyEmailMutation({ variables: { token } });\n\n if (data!.verifyEmail.success && store.user) {\n store.setUser({ ...store.user, emailVerified: true });\n }\n\n return data!.verifyEmail;\n } catch (err) {\n const message =\n err instanceof Error ? err.message : \"Email verification failed\";\n store.setError(message);\n throw err;\n } finally {\n store.setLoading(false);\n }\n };\n\n /**\n * Resend verification email\n */\n const resendVerification = async (email: string) => {\n try {\n const { data } = await resendVerificationMutation({\n variables: { email },\n });\n return data!.resendVerificationEmail;\n } catch (err) {\n console.error(\"Failed to resend verification email:\", err);\n throw err;\n }\n };\n\n // Legacy aliases for backwards compatibility\n const login = signIn;\n const register = signUp;\n const logout = signOut;\n\n return {\n // New API\n signIn,\n signUp,\n signOut,\n refreshToken,\n verifyEmail,\n resendVerification,\n refetchCurrentUser,\n // Legacy aliases\n login,\n register,\n logout,\n // State (reactive via selectors)\n isLoading,\n error,\n errorCode,\n isAuthenticated,\n user,\n accessToken,\n };\n}\n"],"mappings":";;;;;;;;AAqCA,SAAS,EAAe,GAAoB,GAA4B;AAiDtE,QA9CI,MAAc,wBACT,oGAEL,MAAc,oBACT,wFAEL,MAAc,sBACT,uDAKP,EAAW,SAAS,mCAAmC,IACvD,MAAc,mBAEP,oGAGL,MAAc,2BACT,sHAKP,EAAW,SAAS,kBAAkB,IACtC,EAAW,SAAS,eAAe,IACnC,EAAW,SAAS,cAAc,GAE3B,qFAIL,EAAW,SAAS,OAAO,IAAI,EAAW,SAAS,eAAe,GAC7D,qEAIL,MAAc,0BACT,wEAIL,KAAc,MAAe,mBACxB,IAGF;;AAGT,SAAS,EAAkB,GAAsB;AAC/C,KAAI;EAEF,IAAM,IADW,OAAO,SAAS,SACT,SAAS,uBAAuB,GACpD,yBACA,KAAA,GACE,IAAa,IAAS,YAAY,MAAW,IAC7C,IAAa,OAAO,SAAS,aAAa,WAAW,aAAa,IAClE,IAAW,KAAK,UAAU;GAC9B,IAAI;GACJ,QAAQ,OAAO,SAAS;GACzB,CAAC;AAEF,EADA,SAAS,SAAS,UAAU,mBAAmB,EAAS,GAAG,EAAW,wBAAwB,EAAW,kBACzG,SAAS,SAAS,kBAAkB,mBAAmB,EAAS,GAAG,EAAW,wBAAwB,EAAW;SAC3G;;AAKV,SAAS,EAAc,GAAyB;AAC9C,QAAO,EAAE,GAAG,GAAM;;AAQpB,SAAS,EAAS,GAAkD;AAClE,QAAO,OAAO,KAAU,cAAY;;AAGtC,SAAS,EAAoB,GAAoC;AAE/D,QADK,MAAM,QAAQ,EAAM,GAClB,EAAM,QAAQ,MAAmC,EAAS,EAAK,CAAC,GADrC,EAAE;;AAItC,SAAS,EAAiB,GAAoC;AAC5D,KAAI,CAAC,EAAS,EAAM,CAAE,QAAO,EAAE;CAC/B,IAAM,IAAe,EAAoB,EAAM,OAAO;AAEtD,QADI,EAAa,SAAS,IAAU,IAC7B,EAAoB,EAAM,cAAc;;AAGjD,SAAS,EAAuB,GAAoC;AAElE,KADI,aAAiB,SACjB,EAAS,EAAM,IAAI,OAAO,EAAM,WAAY,SAC9C,QAAO,EAAM;;AAKjB,SAAS,EACP,GACe;CACf,IAAM,IAAO,GAAO,YAAY;AAChC,QAAO,OAAO,KAAS,WAAW,IAAO;;AAyE3C,SAAgB,EAAkB,IAAoC,EAAE,EAAE;CAExE,IAAM,IAAY,GAAc,MAAU,EAAM,UAAU,EACpD,IAAQ,GAAc,MAAU,EAAM,MAAM,EAC5C,IAAY,GAAc,MAAU,EAAM,UAAU,EACpD,IAAkB,GAAc,MAAU,EAAM,gBAAgB,EAChE,IAAO,GAAc,MAAU,EAAM,KAAK,EAC1C,IAAc,GAAc,MAAU,EAAM,YAAY,EACxD,IAA0B,EAAQ,2BAA2B,IAI7D,IAAwB,EAAO,GAAM,EAErC,IAAU,GAAS,EACnB,IAAW,GAAa,EACxB,IAAe,GAAiB,EAChC,CAAC,KAAkB,EACvB,EACD,EACK,CAAC,KAAkB,EACvB,EACD,EACK,CAAC,KAAmB,EAA6B,EAAgB,EACjE,CAAC,KAAwB,EAG7B,EAAqB,EACjB,CAAC,KAAuB,EAG5B,EAAoB,EAChB,CAAC,KAA8B,EAGnC,EAAgC,EAM5B,IAAS,OAAO,MAA4C;EAChE,IAAM,IAAQ,EAAa,UAAU;AAErC,MAAI;AAEF,GADA,EAAM,WAAW,GAAK,EACtB,EAAM,SAAS,KAAK;GAMpB,IAAM,IAAS,MAAM,EAAe;IAClC,WAAW,EAAE,UAAO;IAGpB,aAAa;IACd,CAAC;AAIF,OAAI,CAAC,EAAO,QAAQ,CAAC,EAAO,KAAK,QAAQ;IACvC,IAAM,IACJ;AAEF,WADA,EAAM,SAAS,EAAa,EACrB;KACL,SAAS;KACT,OAAO;KACR;;GAKH,IAAM,IAFO,EAAO,KAEI;AAGxB,OAAI,EAAW,eAAe,EAAW,eAIvC,QAHA,EAAM,eAAe,IAAM,EAAW,eAAe,EAG9C;IACL,SAAS;IACT,aAAa;IACb,gBAAgB,EAAW;IAC3B,UAAU,EACR,WAAW,EAAW,WACvB;IACF;AAIH,OACE,EAAW,QACX,EAAW,eACX,EAAW,cACX;AAMA,IAJA,EAAsB,UAAU,IAChC,EAAM,QAAQ,EAAW,KAAK,EAC9B,EAAM,cAAc,EAAW,aAAa,EAAW,aAAa,EACpE,EAAM,iBAAiB,GAAK,EAC5B,EAAM,eAAe,GAAM;IAE3B,IAAM,IAAY,EAAW,YACzB,KAAK,KAAK,GAAG,EAAW,YAAY,MACpC,KAAA;AA2BJ,WA1BA,EAAa,EAAc,EAAW,KAAK,EAAE;KAC3C,aAAa,EAAW;KACxB,cAAc,EAAW;KACzB;KACD,CAAC,EACF,EAAkB,EAAW,KAAK,GAAG,EAErC,EAAS,KACP,kBACA;KACE,QAAQ,EAAW,KAAK;KACxB,UAAU,EAAW,KAAK;KAC1B,aAAa,EAAW,KAAK;KAC7B,YAAY,EAAW,KAAK;KAC5B,eAAe,EAAW,KAAK;KAChC,EACD,EAAE,WAAW,qBAAqB,CACnC,EAED,EAAQ,gBACN,EAAW,MACX,EAAW,aACX,EAAW,aACZ,EAGM;KACL,SAAS;KACT,MAAM,EAAW;KACjB,OAAO,EAAW;KAClB,cAAc,EAAW;KACzB,WAAW,EAAW;KACtB,aAAa;KACd;UACI;IACL,IAAM,IAAW;AAEjB,WADA,EAAM,SAAS,EAAS,EACjB;KACL,SAAS;KACT,OAAO;KACR;;WAEI,GAAc;GAQrB,IAAI,IAAU,kBACV,IAA2B,MACzB,IAAgB,EAAiB,EAAI;AAC3C,OAAI,EAAc,SAAS,GAAG;IAG5B,IAAM,IAAW,EAAc;AAE/B,IADA,IAAU,EAAS,WAAW,GAC9B,IAAY,EAAoB,EAAS;SAEzC,KAAU,EAAuB,EAAI,IAAI;AAS3C,UANA,QAAQ,MACN,mBACA,GACA,IAAY,IAAI,EAAU,KAAK,GAChC,EACD,EAAM,SAAS,GAAS,EAAU,EAC3B;IACL,SAAS;IACT,OAAO;IACR;YACO;AACR,KAAM,WAAW,GAAM;;IAOrB,IAAS,OAAO,MAAuB;EAC3C,IAAM,IAAQ,EAAa,UAAU;AAErC,MAAI;AAEF,GADA,EAAM,WAAW,GAAK,EACtB,EAAM,SAAS,KAAK;GAEpB,IAAM,IAAiB,MAAM,EAAe,EAC1C,WAAW,EAAE,UAAO,EACrB,CAAC,EAII,IAAgB,EAAiB,EAAe;AACtD,OAAI,EAAc,SAAS,GAAG;IAC5B,IAAM,IAAe,EAAc,GAAG,WAAW;AAGjD,UAFA,QAAQ,MAAM,2BAA2B,EAAa,EACtD,EAAM,SAAS,EAAa,EAClB,MAAM,EAAa;;AAI/B,OAAI,CAAC,EAAe,QAAQ,CAAC,EAAe,KAAK,QAAQ;IACvD,IAAM,IAAe;AAGrB,UAFA,QAAQ,MAAM,qBAAqB,EAAa,EAChD,EAAM,SAAS,EAAa,EAClB,MAAM,EAAa;;GAG/B,IAAM,IAAS,EAAe,KAAK;AAGnC,OAAI,CAAC,EAAO,KACV,OAAU,MAAM,wCAAwC;AA6C1D,UAxCE,CAAC,EAAO,eACR,CAAC,EAAO,gBACR,EAAO,gBAAgB,MACvB,EAAO,iBAAiB,MAIxB,EAAM,QAAQ,EAAO,KAAK,EAC1B,EAAM,iBAAiB,GAAM,EAGtB;IACL,GAAG;IACH,2BAA2B;IAC5B,KAIH,EAAM,QAAQ,EAAO,KAAK,EAC1B,EAAM,cAAc,EAAO,aAAa,EAAO,aAAa,EAC5D,EAAM,iBAAiB,GAAK,EAE5B,EAAS,KACP,kBACA;IACE,QAAQ,EAAO,KAAK;IACpB,UAAU,EAAO,KAAK;IACtB,aAAa,EAAO,KAAK;IACzB,YAAY,EAAO,KAAK;IACxB,eAAe,EAAO,KAAK;IAC5B,EACD,EAAE,WAAW,qBAAqB,CACnC,EAED,EAAQ,gBACN,EAAO,MACP,EAAO,aACP,EAAO,aACR,EAEM;WACA,GAAc;GAErB,IAAI,IAAU,qCACV,GAEE,IAAgB,EAAiB,EAAI;AAC3C,OAAI,EAAc,SAAS,GAAG;IAC5B,IAAM,IAAW,EAAc;AAK/B,IAJA,IAAY,EAAoB,EAAS,IAAI,KAAA,GAI7C,IAAU,EAHS,EAAS,WAAW,IAGF,EAAU;UAC1C;IACL,IAAM,IAAa,EAAuB,EAAI;AAC9C,IAAI,MACF,IAAU,EAAe,EAAW;;AAKxC,SADA,EAAM,SAAS,GAAS,KAAa,KAAK,EAChC,MAAM,EAAQ;YAChB;AACR,KAAM,WAAW,GAAM;;IAOrB,IAAU,YAAY;EAC1B,IAAM,IAAQ,EAAa,UAAU,EAC/B,IAAgB,EAAM;AAE5B,MAAI;AACF,SAAM,GAAiB;WAChB,GAAK;AACZ,WAAQ,MAAM,oBAAoB,EAAI;;AAMxC,EAFA,MAAM,EAAa,YAAY,EAC/B,EAAM,WAAW,EACjB,EAAS,KACP,mBACA;GACE,QAAQ,GAAe;GACvB,UAAU,GAAe;GACzB,aAAa,GAAe;GAC7B,EACD,EAAE,WAAW,qBAAqB,CACnC;EAID,IAAM,IAAoB,GAAa,CAAC,QACrC,MAAM,EAAE,OAAO,GAAe,GAChC;AACD,MAAI,EAAkB,SAAS,GAAG;GAChC,IAAM,IAAc,EAAkB,IAChC,IAAa,EAAiB,EAAY,GAAG,EAC7C,IAAW,EAAe,EAAY,GAAG;AAC/C,OAAI,GAAY,eAAe,GAAU;AAEvC,MAAM,gBAAgB,EAAY,GAAG;AACrC;;;AAIJ,IAAQ,YAAY;IAMhB,IAAe,YAAY;EAC/B,IAAM,IAAQ,EAAa,UAAU;AAErC,MAAI;GACF,IAAM,IAAQ,EAAM;AACpB,OAAI,CAAC,EAAO,OAAU,MAAM,6BAA6B;GAEzD,IAAM,EAAE,YAAS,MAAM,EAAqB,EAC1C,WAAW,EAAE,UAAO,EACrB,CAAC,EAEI,IAAS,EAAM;AAGrB,OAAI,CAAC,EAAO,eAAe,CAAC,EAAO,gBAAgB,CAAC,EAAO,KACzD,OAAU,MAAM,qDAAqD;AAkBvE,UAfA,EAAM,cAAc,EAAO,aAAa,EAAO,aAAa,EAC5D,EAAM,QAAQ,EAAO,KAAK,EAE1B,EAAS,KACP,wBACA;IACE,QAAQ,EAAO,KAAK;IACpB,UAAU,EAAO,KAAK;IACtB,aAAa,EAAO,KAAK;IACzB,YAAY,EAAO,KAAK;IACxB,eAAe,EAAO,KAAK;IAC5B,EACD,EAAE,WAAW,qBAAqB,CACnC,EAEM;WACA,GAAK;AAaZ,SAXA,EAAS,KACP,6BACA;IACE,QAAQ,EAAM,MAAM;IACpB,UAAU,EAAM,MAAM;IACtB,aAAa,EAAM,MAAM;IACzB,QAAQ,aAAe,QAAQ,EAAI,UAAU;IAC9C,EACD,EAAE,WAAW,qBAAqB,CACnC,EACD,EAAM,WAAW,EACX;;IAaJ,EAAE,MAAM,GAAiB,SAAS,MACtC,EAA8B,GAAqB;EACjD,MACE,KACA,CAAC,KACD,EAAsB;EACxB,aAAa;EACd,CAAC;AAoEJ,QAjEA,QAAgB;AACd,EAAI,GAAiB,eACnB,EAAa,UAAU,CAAC,QAAQ,EAAgB,YAAY;IAE7D,CAAC,EAAgB,CAAC,EAIrB,QAAgB;AACd,MAAI,EAAsB,WAAW,GAAiB;GACpD,IAAM,IAAQ,iBAAiB;AAC7B,MAAsB,UAAU;MAC/B,IAAK;AACR,gBAAa,aAAa,EAAM;;IAEjC,CAAC,EAAgB,CAAC,EAkDd;EAEL;EACA;EACA;EACA;EACA,aAlDkB,OAClB,MACmE;GACnE,IAAM,IAAQ,EAAa,UAAU;AAErC,OAAI;AACF,MAAM,WAAW,GAAK;IACtB,IAAM,EAAE,YAAS,MAAM,EAAoB,EAAE,WAAW,EAAE,UAAO,EAAE,CAAC;AAMpE,WAJI,EAAM,YAAY,WAAW,EAAM,QACrC,EAAM,QAAQ;KAAE,GAAG,EAAM;KAAM,eAAe;KAAM,CAAC,EAGhD,EAAM;YACN,GAAK;IACZ,IAAM,IACJ,aAAe,QAAQ,EAAI,UAAU;AAEvC,UADA,EAAM,SAAS,EAAQ,EACjB;aACE;AACR,MAAM,WAAW,GAAM;;;EA+BzB,oBAxByB,OAAO,MAAkB;AAClD,OAAI;IACF,IAAM,EAAE,YAAS,MAAM,EAA2B,EAChD,WAAW,EAAE,UAAO,EACrB,CAAC;AACF,WAAO,EAAM;YACN,GAAK;AAEZ,UADA,QAAQ,MAAM,wCAAwC,EAAI,EACpD;;;EAiBR;EAEA,OAdY;EAeZ,UAde;EAef,QAda;EAgBb;EACA;EACA;EACA;EACA;EACA;EACD"}
package/dist/auth/hooks/useContextSwitcherData.js CHANGED
@@ -4,7 +4,7 @@ import { useCallback as n, useEffect as r, useRef as i, useState as a } from "re
4
4
  import { getStoredAuthToken as o, graphqlFetch as s } from "@burdenoff/fe-libs/shared/graphql";
5
5
  import { useActiveContext as c } from "@burdenoff/fe-libs/shared/providers/shell/ActiveContextProvider";
6
6
  //#region src/auth/hooks/useContextSwitcherData.ts
7
- var l = "\n query MyOrganizations {\n myOrganizations {\n total\n items {\n id\n name\n slug\n tenantId\n description\n logo\n website\n status\n type\n createdAt\n updatedAt\n }\n }\n }\n", u = "\n query MyWorkspacesForContext {\n workspaces: myWorkspaces {\n total\n items {\n id\n name\n slug\n tenantId\n organizationId\n type\n status\n region\n createdAt\n updatedAt\n }\n }\n }\n", d = "\n query ContextSwitcherBootstrap {\n myOrganizations {\n total\n items {\n id\n name\n slug\n tenantId\n description\n logo\n website\n status\n type\n createdAt\n updatedAt\n }\n }\n workspaces: myWorkspaces {\n total\n items {\n id\n name\n slug\n tenantId\n organizationId\n type\n status\n region\n createdAt\n updatedAt\n }\n }\n }\n", f = "\n mutation IssueWorkspaceToken($input: IssueWorkspaceTokenInput!) {\n issueWorkspaceToken(input: $input) {\n success\n token\n expiresAt\n organizationId\n workspaceId\n projectId\n scopes\n error {\n code\n message\n }\n }\n }\n", p = "\n query MyProjectsForContext {\n projects: myProjects {\n total\n items {\n id\n name\n key\n workspaceId\n status\n archived\n createdAt\n updatedAt\n }\n }\n }\n", m = "\n mutation CreateDefaultProject($input: CreateProjectInput!) {\n createProject(input: $input) {\n id\n name\n key\n workspaceId\n status\n archived\n createdAt\n updatedAt\n }\n }\n";
7
+ var l = "\n query MyOrganizations {\n myOrganizations {\n total\n items {\n id\n name\n slug\n tenantId\n description\n logo\n website\n status\n type\n createdAt\n updatedAt\n }\n }\n }\n", u = "\n query WorkspacesByOrg {\n workspaces: myWorkspaces(limit: 100) {\n total\n items {\n id\n name\n slug\n tenantId\n organizationId\n type\n status\n region\n createdAt\n updatedAt\n }\n }\n }\n", d = "\n query ContextSwitcherBootstrap {\n myOrganizations {\n total\n items {\n id\n name\n slug\n tenantId\n description\n logo\n website\n status\n type\n createdAt\n updatedAt\n }\n }\n workspaces: myWorkspaces(limit: 100) {\n total\n items {\n id\n name\n slug\n tenantId\n organizationId\n type\n status\n region\n createdAt\n updatedAt\n }\n }\n }\n", f = "\n mutation IssueWorkspaceToken($input: IssueWorkspaceTokenInput!) {\n issueWorkspaceToken(input: $input) {\n success\n token\n expiresAt\n organizationId\n workspaceId\n projectId\n scopes\n error {\n code\n message\n }\n }\n }\n", p = "\n query MyProjectsForContext {\n projects: myProjects {\n total\n items {\n id\n name\n key\n workspaceId\n status\n archived\n createdAt\n updatedAt\n }\n }\n }\n", m = "\n mutation CreateDefaultProject($input: CreateProjectInput!) {\n createProject(input: $input) {\n id\n name\n key\n workspaceId\n status\n archived\n createdAt\n updatedAt\n }\n }\n";
8
8
  async function h({ authToken: e, workspaceBaseUrl: t, workspaceToken: n }) {
9
9
  let r = await s({
10
10
  gateway: "workspace",
@@ -30,6 +30,7 @@ function _(e) {
30
30
  return {
31
31
  workspaceId: typeof t.workspaceId == "string" ? t.workspaceId : void 0,
32
32
  organizationId: typeof t.organizationId == "string" ? t.organizationId : void 0,
33
+ projectId: typeof t.projectId == "string" ? t.projectId : void 0,
33
34
  exp: typeof t.exp == "number" ? t.exp : void 0
34
35
  };
35
36
  } catch {
@@ -39,7 +40,7 @@ function _(e) {
39
40
  function v(e, t) {
40
41
  if (!e || g(e)) return !1;
41
42
  let n = _(e);
42
- return !(!n || t.workspaceId && n.workspaceId !== t.workspaceId || t.organizationId && n.organizationId !== t.organizationId);
43
+ return !(!n || t.workspaceId && n.workspaceId !== t.workspaceId || t.organizationId && n.organizationId !== t.organizationId || t.projectId && n.projectId !== t.projectId);
43
44
  }
44
45
  var y = class extends Error {
45
46
  constructor(e) {
@@ -73,7 +74,8 @@ function C(o) {
73
74
  let t = e.getState();
74
75
  if (m && m !== t.currentOrganizationId && m !== W.current && (W.current = m, t.setCurrentOrganizationId(m), t.workspaces.length > 0 && !t.workspaces.some((e) => e.organizationId === m) && t.setWorkspaces([])), _ && _ !== t.currentWorkspaceId && _ !== G.current && (G.current = _, t.setCurrentWorkspaceId(_), t.projects.length > 0 && !t.projects.some((e) => e.workspaceId === _) && (t.setProjects([]), t.setCurrentProjectId(null))), C && C !== t.currentProjectId && C !== K.current && (K.current = C, t.setCurrentProjectId(C)), t.workspaceToken && !v(t.workspaceToken, {
75
76
  workspaceId: _,
76
- organizationId: m
77
+ organizationId: m,
78
+ projectId: C
77
79
  })) {
78
80
  let e = `${m ?? ""}|${_ ?? ""}|${C ?? ""}`;
79
81
  q.current !== e && (q.current = e, t.setWorkspaceToken(null));
@@ -91,6 +93,7 @@ function C(o) {
91
93
  let r = B.current ?? t.currentOrganizationId, i = await s({
92
94
  gateway: "global",
93
95
  query: r ? d : l,
96
+ variables: void 0,
94
97
  authToken: n,
95
98
  baseUrl: H
96
99
  });
@@ -129,12 +132,12 @@ function C(o) {
129
132
  }), t.setWorkspaces([]), t.setProjects([]), t.setCurrentWorkspaceId(null), t.setCurrentProjectId(null), t.setWorkspaceToken(null)), f && f !== t.currentOrganizationId && t.setCurrentOrganizationId(f), c.length > 0 && !f && (t.setCurrentOrganizationId(c[0].id), f = c[0].id), f && e.getState().workspaces.length === 0) {
130
133
  t.setLoadingWorkspaces(!0);
131
134
  try {
132
- let e = (r === f ? i.data?.workspaces?.items : void 0) || await s({
135
+ let e = (r === f ? i.data?.workspaces?.items?.filter((e) => e.organizationId === f) : void 0) || await s({
133
136
  gateway: "global",
134
137
  query: u,
135
138
  authToken: n,
136
139
  baseUrl: H
137
- }).then((e) => e.errors?.length ? null : e.data?.workspaces?.items ?? []);
140
+ }).then((e) => e.errors?.length ? null : (e.data?.workspaces?.items ?? []).filter((e) => e.organizationId === f));
138
141
  if (e) {
139
142
  t.setWorkspaces(e);
140
143
  let n = z.current ? e.find((e) => e.id === z.current) : null;
@@ -174,7 +177,7 @@ function C(o) {
174
177
  authToken: i,
175
178
  baseUrl: H
176
179
  });
177
- if (e.errors?.length) {
180
+ if (e.data?.workspaces?.items && (e.data.workspaces.items = e.data.workspaces.items.filter((e) => e.organizationId === t)), e.errors?.length) {
178
181
  let t = e.errors[0]?.message ?? "GraphQL error";
179
182
  throw b(e.errors) ? new y(t) : (console.error("Failed to fetch workspaces:", e.errors), Error(t));
180
183
  }
@@ -189,9 +192,9 @@ function C(o) {
189
192
  }
190
193
  })();
191
194
  return R.current.set(t, a), a;
192
- }, [H]), X = n(async (t, n) => {
193
- let r = e.getState(), i = x();
194
- if (!i || g(i)) return {
195
+ }, [H]), X = n(async (t, n, r) => {
196
+ let i = e.getState(), a = x();
197
+ if (!a || g(a)) return {
195
198
  success: !1,
196
199
  error: "No valid access token available"
197
200
  };
@@ -202,9 +205,10 @@ function C(o) {
202
205
  query: f,
203
206
  variables: { input: {
204
207
  organizationId: t,
205
- ...n && { workspaceId: n }
208
+ ...n && { workspaceId: n },
209
+ ...r && { projectId: r }
206
210
  } },
207
- authToken: i,
211
+ authToken: a,
208
212
  baseUrl: U
209
213
  });
210
214
  if (e.errors?.length) {
@@ -214,18 +218,18 @@ function C(o) {
214
218
  error: t
215
219
  };
216
220
  }
217
- let a = e.data?.issueWorkspaceToken;
218
- if (a?.success && a.token) {
219
- let e = a.workspaceId || n;
220
- return e && r.setCurrentWorkspaceId(e), r.setWorkspaceToken(a.token), {
221
+ let o = e.data?.issueWorkspaceToken;
222
+ if (o?.success && o.token) {
223
+ let e = o.workspaceId || n;
224
+ return e && i.setCurrentWorkspaceId(e), i.setWorkspaceToken(o.token), {
221
225
  success: !0,
222
- token: a.token,
226
+ token: o.token,
223
227
  resolvedWorkspaceId: e || void 0
224
228
  };
225
229
  }
226
230
  return {
227
231
  success: !1,
228
- error: a?.error?.message ?? "Failed to issue workspace token"
232
+ error: o?.error?.message ?? "Failed to issue workspace token"
229
233
  };
230
234
  } catch (e) {
231
235
  let t = e instanceof Error ? e.message : "Failed to issue workspace token";
@@ -294,7 +298,12 @@ function C(o) {
294
298
  Z,
295
299
  U
296
300
  ]), ee = n((t) => {
297
- e.getState().setCurrentProjectId(t.id);
301
+ let n = e.getState();
302
+ n.setCurrentProjectId(t.id), n.workspaceToken && !v(n.workspaceToken, {
303
+ workspaceId: n.currentWorkspaceId,
304
+ organizationId: n.currentOrganizationId,
305
+ projectId: t.id
306
+ }) && n.setWorkspaceToken(null);
298
307
  }, []);
299
308
  return {
300
309
  organizations: T,
@@ -334,7 +343,7 @@ function w(n) {
334
343
  authToken: o,
335
344
  baseUrl: d
336
345
  }).then((e) => {
337
- if (!e.errors?.length) {
346
+ if (e.data?.workspaces?.items && (e.data.workspaces.items = e.data.workspaces.items.filter((e) => e.organizationId === i)), !e.errors?.length) {
338
347
  let n = (e.data?.workspaces?.items ?? []).filter((e) => e.organizationId === i);
339
348
  t.setWorkspaces(n);
340
349
  }
@@ -352,60 +361,62 @@ function w(n) {
352
361
  ]);
353
362
  }
354
363
  function T(n) {
355
- let a = e((e) => e.currentWorkspaceId), o = e((e) => e.currentOrganizationId), c = e((e) => e.workspaces), l = e((e) => e.projects), u = e((e) => e.workspaceToken), d = e((e) => e.accessToken), m = t(), _ = n?.workspaceBaseUrl ?? m.workspaceBaseUrl, y = n?.disableProjectSync ?? !1, b = n?.skipProjectFetch ?? !1, x = i(!1), S = i(/* @__PURE__ */ new Map()), C = i(/* @__PURE__ */ new Map()), w = 3e4;
364
+ let a = e((e) => e.currentWorkspaceId), o = e((e) => e.currentOrganizationId), c = e((e) => e.workspaces), l = e((e) => e.projects), u = e((e) => e.currentProjectId), d = e((e) => e.workspaceToken), m = e((e) => e.accessToken), _ = t(), y = n?.workspaceBaseUrl ?? _.workspaceBaseUrl, b = n?.disableProjectSync ?? !1, x = n?.skipProjectFetch ?? !1, S = i(!1), C = i(/* @__PURE__ */ new Map()), w = i(/* @__PURE__ */ new Map()), T = 3e4;
356
365
  r(() => {
357
- if (y || !a || !d || x.current) return;
358
- let t = C.current.get(a);
359
- if (t && t.count >= 8 && Date.now() - t.lastFailureAt < w) return;
360
- t && Date.now() - t.lastFailureAt >= w && C.current.delete(a);
366
+ if (b || !a || !m || S.current) return;
367
+ let t = w.current.get(a);
368
+ if (t && t.count >= 8 && Date.now() - t.lastFailureAt < T) return;
369
+ t && Date.now() - t.lastFailureAt >= T && w.current.delete(a);
361
370
  let n = c.find((e) => e.id === a);
362
371
  if (n && o && n.organizationId !== o) return;
363
372
  let r = n?.organizationId ?? o;
364
373
  if (!r) return;
365
- let i = e.getState(), m = !u || g(u) || !v(u, {
374
+ let i = e.getState(), _ = !d || g(d) || !v(d, {
366
375
  workspaceId: a,
367
- organizationId: o
368
- }), T = l.some((e) => e.workspaceId === a);
369
- if (T && !m) {
376
+ organizationId: o,
377
+ projectId: u
378
+ }), E = l.some((e) => e.workspaceId === a);
379
+ if (E && !_) {
370
380
  if (!i.currentProjectId) {
371
381
  let e = l.find((e) => e.workspaceId === a);
372
382
  e && i.setCurrentProjectId(e.id);
373
383
  }
374
384
  return;
375
385
  }
376
- let E = async () => {
377
- x.current = !0, i.setLoadingProjects(!0);
386
+ let D = async () => {
387
+ S.current = !0, i.setLoadingProjects(!0);
378
388
  let t = !1;
379
389
  try {
380
- let e = u;
381
- if (m) {
390
+ let e = d;
391
+ if (_) {
382
392
  let t = await s({
383
393
  gateway: "workspace",
384
394
  query: f,
385
395
  variables: { input: {
386
396
  organizationId: r,
387
- workspaceId: a
397
+ workspaceId: a,
398
+ ...u ? { projectId: u } : {}
388
399
  } },
389
- authToken: d,
390
- baseUrl: _
400
+ authToken: m,
401
+ baseUrl: y
391
402
  });
392
403
  if (t.data?.issueWorkspaceToken?.success && t.data.issueWorkspaceToken.token) e = t.data.issueWorkspaceToken.token, i.setWorkspaceToken(e);
393
404
  else return;
394
405
  }
395
- if (e && !T && !b) {
406
+ if (e && !E && !x) {
396
407
  let t = await s({
397
408
  gateway: "workspace",
398
409
  query: p,
399
- authToken: d,
410
+ authToken: m,
400
411
  workspaceToken: e,
401
- baseUrl: _
412
+ baseUrl: y
402
413
  });
403
414
  if (t.errors?.length) return;
404
415
  let n = t.data?.projects?.items ?? [];
405
416
  if (n.length === 0) {
406
417
  let t = await h({
407
- authToken: d,
408
- workspaceBaseUrl: _,
418
+ authToken: m,
419
+ workspaceBaseUrl: y,
409
420
  workspaceToken: e
410
421
  });
411
422
  if (t) n = [t];
@@ -415,31 +426,31 @@ function T(n) {
415
426
  }
416
427
  t = !0;
417
428
  } catch {} finally {
418
- i.setLoadingProjects(!1), x.current = !1;
419
- let n = C.current;
429
+ i.setLoadingProjects(!1), S.current = !1;
430
+ let n = w.current;
420
431
  if (t) {
421
432
  n.delete(a);
422
- let e = S.current.get(a);
423
- e && (clearTimeout(e), S.current.delete(a));
433
+ let e = C.current.get(a);
434
+ e && (clearTimeout(e), C.current.delete(a));
424
435
  } else {
425
436
  let t = (n.get(a)?.count ?? 0) + 1;
426
437
  if (n.set(a, {
427
438
  count: t,
428
439
  lastFailureAt: Date.now()
429
440
  }), t < 8) {
430
- let n = S.current.get(a);
441
+ let n = C.current.get(a);
431
442
  n && clearTimeout(n);
432
443
  let r = Math.min(1e3 * 2 ** (t - 1), 8e3), i = setTimeout(() => {
433
- S.current.delete(a);
444
+ C.current.delete(a);
434
445
  let t = e.getState();
435
- t.currentWorkspaceId === a && !t.projects.some((e) => e.workspaceId === a) && !x.current && E();
446
+ t.currentWorkspaceId === a && !t.projects.some((e) => e.workspaceId === a) && !S.current && D();
436
447
  }, r);
437
- S.current.set(a, i);
448
+ C.current.set(a, i);
438
449
  }
439
450
  }
440
451
  }
441
452
  };
442
- E();
453
+ D();
443
454
  }, [
444
455
  a,
445
456
  o,
@@ -447,11 +458,12 @@ function T(n) {
447
458
  l,
448
459
  u,
449
460
  d,
450
- _,
461
+ m,
451
462
  y,
452
- b
463
+ b,
464
+ x
453
465
  ]), r(() => {
454
- let e = S.current;
466
+ let e = C.current;
455
467
  return () => {
456
468
  e.forEach((e) => clearTimeout(e)), e.clear();
457
469
  };