@burdenoff/microfe-auth 2026.531.4 → 2026.601.1

package/dist/auth/AuthRoutes.js

@@ -180,7 +180,7 @@ function B({ basePath: e = "", enableAdminRoutes: c = !1, bypassEnterprisePlanGa
 				defaultValue: !0,
 				children: /* @__PURE__ */ h(s, {
 					fallback: /* @__PURE__ */ h(I, {}),
-					children: /* @__PURE__ */ h(T, {})
+					children: /* @__PURE__ */ h(T, { enableAdminRoutes: c })
 				})
 			}) })
 		}),
@@ -206,13 +206,6 @@ function B({ basePath: e = "", enableAdminRoutes: c = !1, bypassEnterprisePlanGa
 				})
 			}) })
 		}),
-		/* @__PURE__ */ h(f, {
-			path: "api-keys",
-			element: /* @__PURE__ */ h(z, { children: /* @__PURE__ */ h(d, {
-				to: "/devportal/api-keys",
-				replace: !0
-			}) })
-		}),
 		c && u && /* @__PURE__ */ h(f, {
 			path: "audit-log",
 			element: /* @__PURE__ */ h(z, { children: /* @__PURE__ */ h(_, {
@@ -245,17 +238,6 @@ function B({ basePath: e = "", enableAdminRoutes: c = !1, bypassEnterprisePlanGa
 				replace: !0
 			})
 		}),
-		/* @__PURE__ */ h(f, {
-			path: "apps",
-			element: /* @__PURE__ */ h(z, { children: /* @__PURE__ */ h(_, {
-				flag: "auth.apps",
-				defaultValue: !1,
-				children: /* @__PURE__ */ h(d, {
-					to: "/devportal/apps",
-					replace: !0
-				})
-			}) })
-		}),
 		/* @__PURE__ */ h(f, {
 			path: "users",
 			element: c ? /* @__PURE__ */ h(z, { children: /* @__PURE__ */ h(_, {
@@ -295,13 +277,6 @@ function B({ basePath: e = "", enableAdminRoutes: c = !1, bypassEnterprisePlanGa
 				})
 			}) })
 		}),
-		/* @__PURE__ */ h(f, {
-			path: "delegations",
-			element: /* @__PURE__ */ h(z, { children: /* @__PURE__ */ h(d, {
-				to: "/devportal/delegations",
-				replace: !0
-			}) })
-		}),
 		/* @__PURE__ */ h(f, {
 			index: !0,
 			element: /* @__PURE__ */ h(d, {

package/dist/auth/AuthRoutes.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthRoutes.js","names":[],"sources":["../../src/auth/AuthRoutes.tsx"],"sourcesContent":["import { lazy, Suspense, useEffect, useState } from \"react\";\nimport {\n  useFeatureFlagDetails,\n  FeatureGate,\n} from \"@burdenoff/fe-libs/shared/feature-flags\";\nimport { Navigate, Route, Routes } from \"react-router-dom\";\nimport { useAuthStore } from \"./store/authStore\";\n\n// Eager imports - these are the most commonly accessed routes\nimport { LoginPage } from \"./pages/LoginPage\";\nimport { SessionBridgePage } from \"./pages/SessionBridgePage\";\nimport { SSORelayPage } from \"./pages/SSORelayPage\";\nimport { SSORelayCallbackPage } from \"./pages/SSORelayCallbackPage\";\nimport { SSODepositPage } from \"./pages/SSODepositPage\";\nimport { SSOClearPage } from \"./pages/SSOClearPage\";\n\n// Lazy-loaded pages - loaded on demand when their routes are accessed\nconst RegisterPage = lazy(() =>\n  import(\"./pages/RegisterPage\").then((m) => ({ default: m.RegisterPage })),\n);\nconst PasswordResetPage = lazy(() =>\n  import(\"./pages/PasswordResetPage\").then((m) => ({\n    default: m.PasswordResetPage,\n  })),\n);\nconst EmailVerifyPage = lazy(() =>\n  import(\"./pages/EmailVerifyPage\").then((m) => ({\n    default: m.EmailVerifyPage,\n  })),\n);\nconst MfaVerifyPage = lazy(() =>\n  import(\"./pages/MfaVerifyPage\").then((m) => ({ default: m.MfaVerifyPage })),\n);\nconst MagicLinkPage = lazy(() =>\n  import(\"./pages/MagicLinkPage\").then((m) => ({ default: m.MagicLinkPage })),\n);\nconst ReactivatePage = lazy(() =>\n  import(\"./pages/ReactivatePage\").then((m) => ({ default: m.ReactivatePage })),\n);\nconst SecurityPage = lazy(() =>\n  import(\"./pages/SecurityPage\").then((m) => ({ default: m.SecurityPage })),\n);\nconst SessionsPage = lazy(() =>\n  import(\"./pages/SessionsPage\").then((m) => ({ default: m.SessionsPage })),\n);\nconst MfaSetupPage = lazy(() =>\n  import(\"./pages/MfaSetupPage\").then((m) => ({ default: m.MfaSetupPage })),\n);\nconst AuditLogPage = lazy(() =>\n  import(\"./pages/AuditLogPage\").then((m) => ({ default: m.AuditLogPage })),\n);\nconst SsoConfigPage = lazy(() =>\n  import(\"./pages/SsoConfigPage\").then((m) => ({ default: m.SsoConfigPage })),\n);\nconst SsoLoginPage = lazy(() =>\n  import(\"./pages/SsoLoginPage\").then((m) => ({ default: m.SsoLoginPage })),\n);\nconst SsoCallbackPage = lazy(() =>\n  import(\"./pages/SsoCallbackPage\").then((m) => ({\n    default: m.SsoCallbackPage,\n  })),\n);\nconst OAuthCallbackPage = lazy(() =>\n  import(\"./pages/OAuthCallbackPage\").then((m) => ({\n    default: m.OAuthCallbackPage,\n  })),\n);\nconst UsersPage = lazy(() =>\n  import(\"./pages/UsersPage\").then((m) => ({ default: m.UsersPage })),\n);\nconst UserDetailsPage = lazy(() =>\n  import(\"./pages/UserDetailsPage\").then((m) => ({\n    default: m.UserDetailsPage,\n  })),\n);\nconst UserProfilePage = lazy(() =>\n  import(\"./pages/UserProfilePage\").then((m) => ({\n    default: m.UserProfilePage,\n  })),\n);\n/**\n * Simple loading fallback for lazy-loaded pages\n */\nfunction PageLoader() {\n  return (\n    <div className=\"flex min-h-[400px] items-center justify-center\">\n      <div className=\"size-8 animate-spin rounded-full border-4 border-primary border-t-transparent\" />\n    </div>\n  );\n}\n\nfunction decodeJwtExpiry(token: string): number | null {\n  try {\n    const payload = JSON.parse(\n      atob(token.split(\".\")[1].replace(/-/g, \"+\").replace(/_/g, \"/\")),\n    ) as { exp?: number };\n\n    return typeof payload.exp === \"number\" ? payload.exp * 1000 : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction getStoredSessionSnapshot(): {\n  hasValidSession: boolean;\n  expiresAt: number | null;\n} {\n  try {\n    const activeProfileId = sessionStorage.getItem(\"bf-active-profile\");\n    if (!activeProfileId) {\n      return { hasValidSession: false, expiresAt: null };\n    }\n\n    const tokensRaw = localStorage.getItem(`bf-p-${activeProfileId}-tokens`);\n    if (!tokensRaw) {\n      return { hasValidSession: false, expiresAt: null };\n    }\n\n    const tokens = JSON.parse(tokensRaw) as {\n      accessToken?: string;\n      expiresAt?: number;\n    };\n\n    if (!tokens.accessToken) {\n      return { hasValidSession: false, expiresAt: null };\n    }\n\n    const expiresAt =\n      typeof tokens.expiresAt === \"number\"\n        ? tokens.expiresAt\n        : decodeJwtExpiry(tokens.accessToken);\n\n    if (!expiresAt) {\n      return { hasValidSession: false, expiresAt: null };\n    }\n\n    return {\n      hasValidSession: expiresAt > Date.now(),\n      expiresAt,\n    };\n  } catch {\n    return { hasValidSession: false, expiresAt: null };\n  }\n}\n\n/**\n * Protected route wrapper\n */\nfunction ProtectedRoute({ children }: { children: React.ReactNode }) {\n  const isAuthenticated = useAuthStore((state) => state.isAuthenticated);\n  const clearAuth = useAuthStore((state) => state.clearAuth);\n  const [sessionCheckVersion, setSessionCheckVersion] = useState(0);\n  const sessionSnapshot = getStoredSessionSnapshot();\n\n  useEffect(() => {\n    const handleSessionUpdate = () => {\n      setSessionCheckVersion((value) => value + 1);\n    };\n\n    window.addEventListener(\"bf-profile-storage-change\", handleSessionUpdate);\n    window.addEventListener(\"storage\", handleSessionUpdate);\n\n    return () => {\n      window.removeEventListener(\n        \"bf-profile-storage-change\",\n        handleSessionUpdate,\n      );\n      window.removeEventListener(\"storage\", handleSessionUpdate);\n    };\n  }, []);\n\n  useEffect(() => {\n    if (!sessionSnapshot.expiresAt) return;\n\n    const timeoutMs = Math.max(sessionSnapshot.expiresAt - Date.now(), 0) + 50;\n    const timer = window.setTimeout(() => {\n      setSessionCheckVersion((value) => value + 1);\n    }, timeoutMs);\n\n    return () => window.clearTimeout(timer);\n  }, [sessionSnapshot.expiresAt, sessionCheckVersion]);\n\n  useEffect(() => {\n    if (isAuthenticated && !sessionSnapshot.hasValidSession) {\n      clearAuth();\n    }\n  }, [clearAuth, isAuthenticated, sessionSnapshot.hasValidSession]);\n\n  if (!sessionSnapshot.hasValidSession) {\n    return <Navigate to=\"/auth/login\" replace />;\n  }\n\n  return <>{children}</>;\n}\n\n/**\n * Internal router for the Auth microfrontend.\n * This component handles routing within the microfrontend using React Router v7.\n *\n * When used within a parent route (e.g., <Route path=\"/auth/*\">), all paths are relative:\n * - login → Login page (accessible at /auth/login)\n * - register → Registration page (accessible at /auth/register)\n * - reset-password → Password reset page (accessible at /auth/reset-password)\n * - verify-email → Email verification page (accessible at /auth/verify-email)\n * - mfa-verify → MFA verification page (accessible at /auth/mfa-verify)\n * - magic-link → Magic link authentication page (accessible at /auth/magic-link)\n * - sso/login → SSO login page (accessible at /auth/sso/login)\n * - sso/callback → SSO callback handler (accessible at /auth/sso/callback)\n * - oauth/callback → OAuth callback handler (accessible at /auth/oauth/callback)\n * - security → Security settings (protected, accessible at /auth/security)\n * - sessions → Active sessions (protected, accessible at /auth/sessions)\n * - mfa → MFA setup (protected, accessible at /auth/mfa)\n * - api-keys → API keys management (protected, accessible at /auth/api-keys)\n * - apps → Legacy redirect to Developer Portal app creation\n * - users → Users management (protected, admin only, accessible at /auth/users)\n * - profile → User profile page (protected, accessible at /auth/profile)\n * - audit-log → Security audit log (protected, accessible at /auth/audit-log)\n * - sso → SSO configuration (protected, admin only, accessible at /auth/sso)\n */\nexport function AuthRoutes({\n  basePath: _basePath = \"\",\n  // Admin routes (`/auth/users`, `/auth/users/:id`, `/auth/sso`,\n  // `/auth/audit-log`) are opt-in: only the admin app shell should pass\n  // `enableAdminRoutes={true}`. User-facing product hosts (vibecontrols,\n  // workspaces, botlit, healthybowl, etc.) intentionally do not expose\n  // these surfaces — the gateway's RBAC directives still gate the\n  // underlying queries/mutations, but hiding the routes prevents\n  // accidental UI discoverability and reduces the attack surface for\n  // misconfigured permissions.\n  enableAdminRoutes = false,\n  bypassEnterprisePlanGate = false,\n}: {\n  basePath?: string;\n  enableAdminRoutes?: boolean;\n  bypassEnterprisePlanGate?: boolean;\n}) {\n  // Note: basePath is kept for backwards compatibility but not used in route paths\n  // since React Router v7 uses relative paths when nested inside a parent <Route>\n  const auditLogFlag = useFeatureFlagDetails(\"auth.audit-log\");\n  const showAuditLog = auditLogFlag?.value === true;\n  return (\n    <Routes>\n      {/* Public routes (no auth required) */}\n      {/* LoginPage is eager-loaded as it's the most common entry point */}\n      <Route path=\"login\" element={<LoginPage />} />\n      <Route\n        path=\"register\"\n        element={\n          <Suspense fallback={<PageLoader />}>\n            <RegisterPage />\n          </Suspense>\n        }\n      />\n      <Route\n        path=\"reset-password\"\n        element={\n          <Suspense fallback={<PageLoader />}>\n            <PasswordResetPage />\n          </Suspense>\n        }\n      />\n      <Route\n        path=\"verify-email\"\n        element={\n          <Suspense fallback={<PageLoader />}>\n            <EmailVerifyPage />\n          </Suspense>\n        }\n      />\n      <Route\n        path=\"mfa-verify\"\n        element={\n          <Suspense fallback={<PageLoader />}>\n            <MfaVerifyPage />\n          </Suspense>\n        }\n      />\n      <Route\n        path=\"magic-link\"\n        element={\n          <Suspense fallback={<PageLoader />}>\n            <MagicLinkPage />\n          </Suspense>\n        }\n      />\n\n      {/* SSO routes (public) */}\n      <Route\n        path=\"sso/login\"\n        element={\n          <Suspense fallback={<PageLoader />}>\n            <SsoLoginPage />\n          </Suspense>\n        }\n      />\n      <Route\n        path=\"sso/callback\"\n        element={\n          <Suspense fallback={<PageLoader />}>\n            <SsoCallbackPage />\n          </Suspense>\n        }\n      />\n\n      {/* OAuth callback route (public) */}\n      <Route\n        path=\"oauth/callback\"\n        element={\n          <Suspense fallback={<PageLoader />}>\n            <OAuthCallbackPage />\n          </Suspense>\n        }\n      />\n\n      {/* Account reactivation (public) */}\n      <Route\n        path=\"reactivate\"\n        element={\n          <Suspense fallback={<PageLoader />}>\n            <ReactivatePage />\n          </Suspense>\n        }\n      />\n\n      {/* Session bridge (public - embedded as hidden iframe by other app shells) */}\n      <Route path=\"session-bridge\" element={<SessionBridgePage />} />\n\n      {/* Cross-domain SSO relay (reads local tokens, redirects with them to target) */}\n      <Route path=\"sso-relay\" element={<SSORelayPage />} />\n\n      {/* Cross-domain SSO callback (receives tokens from relay, stores locally) */}\n      <Route path=\"sso-callback\" element={<SSORelayCallbackPage />} />\n\n      {/* Cross-domain SSO deposit (bridge host receives tokens on top-level\n          redirect right after login on a product origin, writes first-party\n          localStorage on the bridge origin so other products can discover\n          the session). */}\n      <Route path=\"sso-deposit\" element={<SSODepositPage />} />\n\n      {/* Cross-domain SLO clear (bridge host clears its central session on\n          top-level redirect from a product origin's logout). */}\n      <Route path=\"sso-clear\" element={<SSOClearPage />} />\n\n      {/* Protected routes (auth required) */}\n      <Route\n        path=\"security\"\n        element={\n          <ProtectedRoute>\n            <FeatureGate flag=\"auth.security\" defaultValue={true}>\n              <Suspense fallback={<PageLoader />}>\n                <SecurityPage />\n              </Suspense>\n            </FeatureGate>\n          </ProtectedRoute>\n        }\n      />\n      <Route\n        path=\"sessions\"\n        element={\n          <ProtectedRoute>\n            <FeatureGate flag=\"auth.sessions\" defaultValue={true}>\n              <Suspense fallback={<PageLoader />}>\n                <SessionsPage />\n              </Suspense>\n            </FeatureGate>\n          </ProtectedRoute>\n        }\n      />\n      <Route\n        path=\"mfa\"\n        element={\n          <ProtectedRoute>\n            <FeatureGate flag=\"auth.mfa\" defaultValue={true}>\n              <Suspense fallback={<PageLoader />}>\n                <MfaSetupPage />\n              </Suspense>\n            </FeatureGate>\n          </ProtectedRoute>\n        }\n      />\n      <Route\n        path=\"api-keys\"\n        element={\n          <ProtectedRoute>\n            <Navigate to=\"/devportal/api-keys\" replace />\n          </ProtectedRoute>\n        }\n      />\n      {enableAdminRoutes && showAuditLog && (\n        <Route\n          path=\"audit-log\"\n          element={\n            <ProtectedRoute>\n              <FeatureGate flag=\"auth.audit-log\" defaultValue={false}>\n                <Suspense fallback={<PageLoader />}>\n                  <AuditLogPage />\n                </Suspense>\n              </FeatureGate>\n            </ProtectedRoute>\n          }\n        />\n      )}\n      {!enableAdminRoutes && (\n        <Route\n          path=\"audit-log\"\n          element={<Navigate to=\"/auth/login\" replace />}\n        />\n      )}\n      <Route\n        path=\"sso\"\n        element={\n          enableAdminRoutes ? (\n            <ProtectedRoute>\n              <FeatureGate flag=\"auth.sso\" defaultValue={true}>\n                <Suspense fallback={<PageLoader />}>\n                  <SsoConfigPage\n                    bypassEnterprisePlanGate={bypassEnterprisePlanGate}\n                  />\n                </Suspense>\n              </FeatureGate>\n            </ProtectedRoute>\n          ) : (\n            <Navigate to=\"/auth/login\" replace />\n          )\n        }\n      />\n      <Route\n        path=\"apps\"\n        element={\n          <ProtectedRoute>\n            <FeatureGate flag=\"auth.apps\" defaultValue={false}>\n              <Navigate to=\"/devportal/apps\" replace />\n            </FeatureGate>\n          </ProtectedRoute>\n        }\n      />\n      <Route\n        path=\"users\"\n        element={\n          enableAdminRoutes ? (\n            <ProtectedRoute>\n              <FeatureGate flag=\"auth.users\" defaultValue={true}>\n                <Suspense fallback={<PageLoader />}>\n                  <UsersPage />\n                </Suspense>\n              </FeatureGate>\n            </ProtectedRoute>\n          ) : (\n            <Navigate to=\"/auth/login\" replace />\n          )\n        }\n      />\n      <Route\n        path=\"users/:id\"\n        element={\n          enableAdminRoutes ? (\n            <ProtectedRoute>\n              <FeatureGate flag=\"auth.users\" defaultValue={true}>\n                <Suspense fallback={<PageLoader />}>\n                  <UserDetailsPage />\n                </Suspense>\n              </FeatureGate>\n            </ProtectedRoute>\n          ) : (\n            <Navigate to=\"/auth/login\" replace />\n          )\n        }\n      />\n      <Route\n        path=\"profile\"\n        element={\n          <ProtectedRoute>\n            <FeatureGate flag=\"auth.profile\" defaultValue={true}>\n              <Suspense fallback={<PageLoader />}>\n                <UserProfilePage />\n              </Suspense>\n            </FeatureGate>\n          </ProtectedRoute>\n        }\n      />\n      <Route\n        path=\"delegations\"\n        element={\n          <ProtectedRoute>\n            <Navigate to=\"/devportal/delegations\" replace />\n          </ProtectedRoute>\n        }\n      />\n\n      {/* Default redirect - when visiting /auth or /auth/ with no subpath */}\n      <Route index element={<Navigate to=\"login\" replace />} />\n    </Routes>\n  );\n}\n"],"mappings":";;;;;;;;;;;;AAiBA,IAAM,IAAe,QACnB,OAAO,2BAAwB,MAAM,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,CAC1E,EACK,IAAoB,QACxB,OAAO,gCAA6B,MAAM,OAAO,EAC/C,SAAS,EAAE,mBACZ,EAAE,CACJ,EACK,IAAkB,QACtB,OAAO,8BAA2B,MAAM,OAAO,EAC7C,SAAS,EAAE,iBACZ,EAAE,CACJ,EACK,IAAgB,QACpB,OAAO,4BAAyB,MAAM,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,CAC5E,EACK,IAAgB,QACpB,OAAO,4BAAyB,MAAM,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,CAC5E,EACK,IAAiB,QACrB,OAAO,6BAA0B,MAAM,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAC9E,EACK,IAAe,QACnB,OAAO,2BAAwB,MAAM,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,CAC1E,EACK,IAAe,QACnB,OAAO,2BAAwB,MAAM,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,CAC1E,EACK,IAAe,QACnB,OAAO,2BAAwB,MAAM,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,CAC1E,EACK,IAAe,QACnB,OAAO,2BAAwB,MAAM,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,CAC1E,EACK,IAAgB,QACpB,OAAO,4BAAyB,MAAM,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,CAC5E,EACK,IAAe,QACnB,OAAO,2BAAwB,MAAM,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,CAC1E,EACK,IAAkB,QACtB,OAAO,8BAA2B,MAAM,OAAO,EAC7C,SAAS,EAAE,iBACZ,EAAE,CACJ,EACK,IAAoB,QACxB,OAAO,gCAA6B,MAAM,OAAO,EAC/C,SAAS,EAAE,mBACZ,EAAE,CACJ,EACK,IAAY,QAChB,OAAO,wBAAqB,MAAM,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CACpE,EACK,IAAkB,QACtB,OAAO,8BAA2B,MAAM,OAAO,EAC7C,SAAS,EAAE,iBACZ,EAAE,CACJ,EACK,IAAkB,QACtB,OAAO,8BAA2B,MAAM,OAAO,EAC7C,SAAS,EAAE,iBACZ,EAAE,CACJ;AAID,SAAS,IAAa;AACpB,QACE,kBAAC,OAAD;EAAK,WAAU;YACb,kBAAC,OAAD,EAAK,WAAU,iFAAkF,CAAA;EAC7F,CAAA;;AAIV,SAAS,EAAgB,GAA8B;AACrD,KAAI;EACF,IAAM,IAAU,KAAK,MACnB,KAAK,EAAM,MAAM,IAAI,CAAC,GAAG,QAAQ,MAAM,IAAI,CAAC,QAAQ,MAAM,IAAI,CAAC,CAChE;AAED,SAAO,OAAO,EAAQ,OAAQ,WAAW,EAAQ,MAAM,MAAO;SACxD;AACN,SAAO;;;AAIX,SAAS,IAGP;AACA,KAAI;EACF,IAAM,IAAkB,eAAe,QAAQ,oBAAoB;AACnE,MAAI,CAAC,EACH,QAAO;GAAE,iBAAiB;GAAO,WAAW;GAAM;EAGpD,IAAM,IAAY,aAAa,QAAQ,QAAQ,EAAgB,SAAS;AACxE,MAAI,CAAC,EACH,QAAO;GAAE,iBAAiB;GAAO,WAAW;GAAM;EAGpD,IAAM,IAAS,KAAK,MAAM,EAAU;AAKpC,MAAI,CAAC,EAAO,YACV,QAAO;GAAE,iBAAiB;GAAO,WAAW;GAAM;EAGpD,IAAM,IACJ,OAAO,EAAO,aAAc,WACxB,EAAO,YACP,EAAgB,EAAO,YAAY;AAMzC,SAJK,IAIE;GACL,iBAAiB,IAAY,KAAK,KAAK;GACvC;GACD,GANQ;GAAE,iBAAiB;GAAO,WAAW;GAAM;SAO9C;AACN,SAAO;GAAE,iBAAiB;GAAO,WAAW;GAAM;;;AAOtD,SAAS,EAAe,EAAE,eAA2C;CACnE,IAAM,IAAkB,GAAc,MAAU,EAAM,gBAAgB,EAChE,IAAY,GAAc,MAAU,EAAM,UAAU,EACpD,CAAC,GAAqB,KAA0B,EAAS,EAAE,EAC3D,IAAkB,GAA0B;AAwClD,QAtCA,QAAgB;EACd,IAAM,UAA4B;AAChC,MAAwB,MAAU,IAAQ,EAAE;;AAM9C,SAHA,OAAO,iBAAiB,6BAA6B,EAAoB,EACzE,OAAO,iBAAiB,WAAW,EAAoB,QAE1C;AAKX,GAJA,OAAO,oBACL,6BACA,EACD,EACD,OAAO,oBAAoB,WAAW,EAAoB;;IAE3D,EAAE,CAAC,EAEN,QAAgB;AACd,MAAI,CAAC,EAAgB,UAAW;EAEhC,IAAM,IAAY,KAAK,IAAI,EAAgB,YAAY,KAAK,KAAK,EAAE,EAAE,GAAG,IAClE,IAAQ,OAAO,iBAAiB;AACpC,MAAwB,MAAU,IAAQ,EAAE;KAC3C,EAAU;AAEb,eAAa,OAAO,aAAa,EAAM;IACtC,CAAC,EAAgB,WAAW,EAAoB,CAAC,EAEpD,QAAgB;AACd,EAAI,KAAmB,CAAC,EAAgB,mBACtC,GAAW;IAEZ;EAAC;EAAW;EAAiB,EAAgB;EAAgB,CAAC,EAE5D,EAAgB,kBAId,kBAAA,GAAA,EAAG,aAAY,CAAA,GAHb,kBAAC,GAAD;EAAU,IAAG;EAAc,SAAA;EAAU,CAAA;;AA8BhD,SAAgB,EAAW,EACzB,UAAU,IAAY,IAStB,uBAAoB,IACpB,8BAA2B,MAK1B;CAID,IAAM,IADe,EAAsB,iBAAiB,EACzB,UAAU;AAC7C,QACE,kBAAC,GAAD,EAAA,UAAA;EAGE,kBAAC,GAAD;GAAO,MAAK;GAAQ,SAAS,kBAAC,GAAD,EAAa,CAAA;GAAI,CAAA;EAC9C,kBAAC,GAAD;GACE,MAAK;GACL,SACE,kBAAC,GAAD;IAAU,UAAU,kBAAC,GAAD,EAAc,CAAA;cAChC,kBAAC,GAAD,EAAgB,CAAA;IACP,CAAA;GAEb,CAAA;EACF,kBAAC,GAAD;GACE,MAAK;GACL,SACE,kBAAC,GAAD;IAAU,UAAU,kBAAC,GAAD,EAAc,CAAA;cAChC,kBAAC,GAAD,EAAqB,CAAA;IACZ,CAAA;GAEb,CAAA;EACF,kBAAC,GAAD;GACE,MAAK;GACL,SACE,kBAAC,GAAD;IAAU,UAAU,kBAAC,GAAD,EAAc,CAAA;cAChC,kBAAC,GAAD,EAAmB,CAAA;IACV,CAAA;GAEb,CAAA;EACF,kBAAC,GAAD;GACE,MAAK;GACL,SACE,kBAAC,GAAD;IAAU,UAAU,kBAAC,GAAD,EAAc,CAAA;cAChC,kBAAC,GAAD,EAAiB,CAAA;IACR,CAAA;GAEb,CAAA;EACF,kBAAC,GAAD;GACE,MAAK;GACL,SACE,kBAAC,GAAD;IAAU,UAAU,kBAAC,GAAD,EAAc,CAAA;cAChC,kBAAC,GAAD,EAAiB,CAAA;IACR,CAAA;GAEb,CAAA;EAGF,kBAAC,GAAD;GACE,MAAK;GACL,SACE,kBAAC,GAAD;IAAU,UAAU,kBAAC,GAAD,EAAc,CAAA;cAChC,kBAAC,GAAD,EAAgB,CAAA;IACP,CAAA;GAEb,CAAA;EACF,kBAAC,GAAD;GACE,MAAK;GACL,SACE,kBAAC,GAAD;IAAU,UAAU,kBAAC,GAAD,EAAc,CAAA;cAChC,kBAAC,GAAD,EAAmB,CAAA;IACV,CAAA;GAEb,CAAA;EAGF,kBAAC,GAAD;GACE,MAAK;GACL,SACE,kBAAC,GAAD;IAAU,UAAU,kBAAC,GAAD,EAAc,CAAA;cAChC,kBAAC,GAAD,EAAqB,CAAA;IACZ,CAAA;GAEb,CAAA;EAGF,kBAAC,GAAD;GACE,MAAK;GACL,SACE,kBAAC,GAAD;IAAU,UAAU,kBAAC,GAAD,EAAc,CAAA;cAChC,kBAAC,GAAD,EAAkB,CAAA;IACT,CAAA;GAEb,CAAA;EAGF,kBAAC,GAAD;GAAO,MAAK;GAAiB,SAAS,kBAAC,GAAD,EAAqB,CAAA;GAAI,CAAA;EAG/D,kBAAC,GAAD;GAAO,MAAK;GAAY,SAAS,kBAAC,GAAD,EAAgB,CAAA;GAAI,CAAA;EAGrD,kBAAC,GAAD;GAAO,MAAK;GAAe,SAAS,kBAAC,GAAD,EAAwB,CAAA;GAAI,CAAA;EAMhE,kBAAC,GAAD;GAAO,MAAK;GAAc,SAAS,kBAAC,GAAD,EAAkB,CAAA;GAAI,CAAA;EAIzD,kBAAC,GAAD;GAAO,MAAK;GAAY,SAAS,kBAAC,GAAD,EAAgB,CAAA;GAAI,CAAA;EAGrD,kBAAC,GAAD;GACE,MAAK;GACL,SACE,kBAAC,GAAD,EAAA,UACE,kBAAC,GAAD;IAAa,MAAK;IAAgB,cAAc;cAC9C,kBAAC,GAAD;KAAU,UAAU,kBAAC,GAAD,EAAc,CAAA;eAChC,kBAAC,GAAD,EAAgB,CAAA;KACP,CAAA;IACC,CAAA,EACC,CAAA;GAEnB,CAAA;EACF,kBAAC,GAAD;GACE,MAAK;GACL,SACE,kBAAC,GAAD,EAAA,UACE,kBAAC,GAAD;IAAa,MAAK;IAAgB,cAAc;cAC9C,kBAAC,GAAD;KAAU,UAAU,kBAAC,GAAD,EAAc,CAAA;eAChC,kBAAC,GAAD,EAAgB,CAAA;KACP,CAAA;IACC,CAAA,EACC,CAAA;GAEnB,CAAA;EACF,kBAAC,GAAD;GACE,MAAK;GACL,SACE,kBAAC,GAAD,EAAA,UACE,kBAAC,GAAD;IAAa,MAAK;IAAW,cAAc;cACzC,kBAAC,GAAD;KAAU,UAAU,kBAAC,GAAD,EAAc,CAAA;eAChC,kBAAC,GAAD,EAAgB,CAAA;KACP,CAAA;IACC,CAAA,EACC,CAAA;GAEnB,CAAA;EACF,kBAAC,GAAD;GACE,MAAK;GACL,SACE,kBAAC,GAAD,EAAA,UACE,kBAAC,GAAD;IAAU,IAAG;IAAsB,SAAA;IAAU,CAAA,EAC9B,CAAA;GAEnB,CAAA;EACD,KAAqB,KACpB,kBAAC,GAAD;GACE,MAAK;GACL,SACE,kBAAC,GAAD,EAAA,UACE,kBAAC,GAAD;IAAa,MAAK;IAAiB,cAAc;cAC/C,kBAAC,GAAD;KAAU,UAAU,kBAAC,GAAD,EAAc,CAAA;eAChC,kBAAC,GAAD,EAAgB,CAAA;KACP,CAAA;IACC,CAAA,EACC,CAAA;GAEnB,CAAA;EAEH,CAAC,KACA,kBAAC,GAAD;GACE,MAAK;GACL,SAAS,kBAAC,GAAD;IAAU,IAAG;IAAc,SAAA;IAAU,CAAA;GAC9C,CAAA;EAEJ,kBAAC,GAAD;GACE,MAAK;GACL,SACE,IACE,kBAAC,GAAD,EAAA,UACE,kBAAC,GAAD;IAAa,MAAK;IAAW,cAAc;cACzC,kBAAC,GAAD;KAAU,UAAU,kBAAC,GAAD,EAAc,CAAA;eAChC,kBAAC,GAAD,EAC4B,6BAC1B,CAAA;KACO,CAAA;IACC,CAAA,EACC,CAAA,GAEjB,kBAAC,GAAD;IAAU,IAAG;IAAc,SAAA;IAAU,CAAA;GAGzC,CAAA;EACF,kBAAC,GAAD;GACE,MAAK;GACL,SACE,kBAAC,GAAD,EAAA,UACE,kBAAC,GAAD;IAAa,MAAK;IAAY,cAAc;cAC1C,kBAAC,GAAD;KAAU,IAAG;KAAkB,SAAA;KAAU,CAAA;IAC7B,CAAA,EACC,CAAA;GAEnB,CAAA;EACF,kBAAC,GAAD;GACE,MAAK;GACL,SACE,IACE,kBAAC,GAAD,EAAA,UACE,kBAAC,GAAD;IAAa,MAAK;IAAa,cAAc;cAC3C,kBAAC,GAAD;KAAU,UAAU,kBAAC,GAAD,EAAc,CAAA;eAChC,kBAAC,GAAD,EAAa,CAAA;KACJ,CAAA;IACC,CAAA,EACC,CAAA,GAEjB,kBAAC,GAAD;IAAU,IAAG;IAAc,SAAA;IAAU,CAAA;GAGzC,CAAA;EACF,kBAAC,GAAD;GACE,MAAK;GACL,SACE,IACE,kBAAC,GAAD,EAAA,UACE,kBAAC,GAAD;IAAa,MAAK;IAAa,cAAc;cAC3C,kBAAC,GAAD;KAAU,UAAU,kBAAC,GAAD,EAAc,CAAA;eAChC,kBAAC,GAAD,EAAmB,CAAA;KACV,CAAA;IACC,CAAA,EACC,CAAA,GAEjB,kBAAC,GAAD;IAAU,IAAG;IAAc,SAAA;IAAU,CAAA;GAGzC,CAAA;EACF,kBAAC,GAAD;GACE,MAAK;GACL,SACE,kBAAC,GAAD,EAAA,UACE,kBAAC,GAAD;IAAa,MAAK;IAAe,cAAc;cAC7C,kBAAC,GAAD;KAAU,UAAU,kBAAC,GAAD,EAAc,CAAA;eAChC,kBAAC,GAAD,EAAmB,CAAA;KACV,CAAA;IACC,CAAA,EACC,CAAA;GAEnB,CAAA;EACF,kBAAC,GAAD;GACE,MAAK;GACL,SACE,kBAAC,GAAD,EAAA,UACE,kBAAC,GAAD;IAAU,IAAG;IAAyB,SAAA;IAAU,CAAA,EACjC,CAAA;GAEnB,CAAA;EAGF,kBAAC,GAAD;GAAO,OAAA;GAAM,SAAS,kBAAC,GAAD;IAAU,IAAG;IAAQ,SAAA;IAAU,CAAA;GAAI,CAAA;EAClD,EAAA,CAAA"}
+{"version":3,"file":"AuthRoutes.js","names":[],"sources":["../../src/auth/AuthRoutes.tsx"],"sourcesContent":["import { lazy, Suspense, useEffect, useState } from \"react\";\nimport {\n  useFeatureFlagDetails,\n  FeatureGate,\n} from \"@burdenoff/fe-libs/shared/feature-flags\";\nimport { Navigate, Route, Routes } from \"react-router-dom\";\nimport { useAuthStore } from \"./store/authStore\";\n\n// Eager imports - these are the most commonly accessed routes\nimport { LoginPage } from \"./pages/LoginPage\";\nimport { SessionBridgePage } from \"./pages/SessionBridgePage\";\nimport { SSORelayPage } from \"./pages/SSORelayPage\";\nimport { SSORelayCallbackPage } from \"./pages/SSORelayCallbackPage\";\nimport { SSODepositPage } from \"./pages/SSODepositPage\";\nimport { SSOClearPage } from \"./pages/SSOClearPage\";\n\n// Lazy-loaded pages - loaded on demand when their routes are accessed\nconst RegisterPage = lazy(() =>\n  import(\"./pages/RegisterPage\").then((m) => ({ default: m.RegisterPage })),\n);\nconst PasswordResetPage = lazy(() =>\n  import(\"./pages/PasswordResetPage\").then((m) => ({\n    default: m.PasswordResetPage,\n  })),\n);\nconst EmailVerifyPage = lazy(() =>\n  import(\"./pages/EmailVerifyPage\").then((m) => ({\n    default: m.EmailVerifyPage,\n  })),\n);\nconst MfaVerifyPage = lazy(() =>\n  import(\"./pages/MfaVerifyPage\").then((m) => ({ default: m.MfaVerifyPage })),\n);\nconst MagicLinkPage = lazy(() =>\n  import(\"./pages/MagicLinkPage\").then((m) => ({ default: m.MagicLinkPage })),\n);\nconst ReactivatePage = lazy(() =>\n  import(\"./pages/ReactivatePage\").then((m) => ({ default: m.ReactivatePage })),\n);\nconst SecurityPage = lazy(() =>\n  import(\"./pages/SecurityPage\").then((m) => ({ default: m.SecurityPage })),\n);\nconst SessionsPage = lazy(() =>\n  import(\"./pages/SessionsPage\").then((m) => ({ default: m.SessionsPage })),\n);\nconst MfaSetupPage = lazy(() =>\n  import(\"./pages/MfaSetupPage\").then((m) => ({ default: m.MfaSetupPage })),\n);\nconst AuditLogPage = lazy(() =>\n  import(\"./pages/AuditLogPage\").then((m) => ({ default: m.AuditLogPage })),\n);\nconst SsoConfigPage = lazy(() =>\n  import(\"./pages/SsoConfigPage\").then((m) => ({ default: m.SsoConfigPage })),\n);\nconst SsoLoginPage = lazy(() =>\n  import(\"./pages/SsoLoginPage\").then((m) => ({ default: m.SsoLoginPage })),\n);\nconst SsoCallbackPage = lazy(() =>\n  import(\"./pages/SsoCallbackPage\").then((m) => ({\n    default: m.SsoCallbackPage,\n  })),\n);\nconst OAuthCallbackPage = lazy(() =>\n  import(\"./pages/OAuthCallbackPage\").then((m) => ({\n    default: m.OAuthCallbackPage,\n  })),\n);\nconst UsersPage = lazy(() =>\n  import(\"./pages/UsersPage\").then((m) => ({ default: m.UsersPage })),\n);\nconst UserDetailsPage = lazy(() =>\n  import(\"./pages/UserDetailsPage\").then((m) => ({\n    default: m.UserDetailsPage,\n  })),\n);\nconst UserProfilePage = lazy(() =>\n  import(\"./pages/UserProfilePage\").then((m) => ({\n    default: m.UserProfilePage,\n  })),\n);\n/**\n * Simple loading fallback for lazy-loaded pages\n */\nfunction PageLoader() {\n  return (\n    <div className=\"flex min-h-[400px] items-center justify-center\">\n      <div className=\"size-8 animate-spin rounded-full border-4 border-primary border-t-transparent\" />\n    </div>\n  );\n}\n\nfunction decodeJwtExpiry(token: string): number | null {\n  try {\n    const payload = JSON.parse(\n      atob(token.split(\".\")[1].replace(/-/g, \"+\").replace(/_/g, \"/\")),\n    ) as { exp?: number };\n\n    return typeof payload.exp === \"number\" ? payload.exp * 1000 : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction getStoredSessionSnapshot(): {\n  hasValidSession: boolean;\n  expiresAt: number | null;\n} {\n  try {\n    const activeProfileId = sessionStorage.getItem(\"bf-active-profile\");\n    if (!activeProfileId) {\n      return { hasValidSession: false, expiresAt: null };\n    }\n\n    const tokensRaw = localStorage.getItem(`bf-p-${activeProfileId}-tokens`);\n    if (!tokensRaw) {\n      return { hasValidSession: false, expiresAt: null };\n    }\n\n    const tokens = JSON.parse(tokensRaw) as {\n      accessToken?: string;\n      expiresAt?: number;\n    };\n\n    if (!tokens.accessToken) {\n      return { hasValidSession: false, expiresAt: null };\n    }\n\n    const expiresAt =\n      typeof tokens.expiresAt === \"number\"\n        ? tokens.expiresAt\n        : decodeJwtExpiry(tokens.accessToken);\n\n    if (!expiresAt) {\n      return { hasValidSession: false, expiresAt: null };\n    }\n\n    return {\n      hasValidSession: expiresAt > Date.now(),\n      expiresAt,\n    };\n  } catch {\n    return { hasValidSession: false, expiresAt: null };\n  }\n}\n\n/**\n * Protected route wrapper\n */\nfunction ProtectedRoute({ children }: { children: React.ReactNode }) {\n  const isAuthenticated = useAuthStore((state) => state.isAuthenticated);\n  const clearAuth = useAuthStore((state) => state.clearAuth);\n  const [sessionCheckVersion, setSessionCheckVersion] = useState(0);\n  const sessionSnapshot = getStoredSessionSnapshot();\n\n  useEffect(() => {\n    const handleSessionUpdate = () => {\n      setSessionCheckVersion((value) => value + 1);\n    };\n\n    window.addEventListener(\"bf-profile-storage-change\", handleSessionUpdate);\n    window.addEventListener(\"storage\", handleSessionUpdate);\n\n    return () => {\n      window.removeEventListener(\n        \"bf-profile-storage-change\",\n        handleSessionUpdate,\n      );\n      window.removeEventListener(\"storage\", handleSessionUpdate);\n    };\n  }, []);\n\n  useEffect(() => {\n    if (!sessionSnapshot.expiresAt) return;\n\n    const timeoutMs = Math.max(sessionSnapshot.expiresAt - Date.now(), 0) + 50;\n    const timer = window.setTimeout(() => {\n      setSessionCheckVersion((value) => value + 1);\n    }, timeoutMs);\n\n    return () => window.clearTimeout(timer);\n  }, [sessionSnapshot.expiresAt, sessionCheckVersion]);\n\n  useEffect(() => {\n    if (isAuthenticated && !sessionSnapshot.hasValidSession) {\n      clearAuth();\n    }\n  }, [clearAuth, isAuthenticated, sessionSnapshot.hasValidSession]);\n\n  if (!sessionSnapshot.hasValidSession) {\n    return <Navigate to=\"/auth/login\" replace />;\n  }\n\n  return <>{children}</>;\n}\n\n/**\n * Internal router for the Auth microfrontend.\n * This component handles routing within the microfrontend using React Router v7.\n *\n * When used within a parent route (e.g., <Route path=\"/auth/*\">), all paths are relative:\n * - login → Login page (accessible at /auth/login)\n * - register → Registration page (accessible at /auth/register)\n * - reset-password → Password reset page (accessible at /auth/reset-password)\n * - verify-email → Email verification page (accessible at /auth/verify-email)\n * - mfa-verify → MFA verification page (accessible at /auth/mfa-verify)\n * - magic-link → Magic link authentication page (accessible at /auth/magic-link)\n * - sso/login → SSO login page (accessible at /auth/sso/login)\n * - sso/callback → SSO callback handler (accessible at /auth/sso/callback)\n * - oauth/callback → OAuth callback handler (accessible at /auth/oauth/callback)\n * - security → Security settings (protected, accessible at /auth/security)\n * - sessions → Active sessions (protected, accessible at /auth/sessions)\n * - mfa → MFA setup (protected, accessible at /auth/mfa)\n * - users → Users management (protected, admin only, accessible at /auth/users)\n * - profile → User profile page (protected, accessible at /auth/profile)\n * - audit-log → Security audit log (protected, accessible at /auth/audit-log)\n * - sso → SSO configuration (protected, admin only, accessible at /auth/sso)\n */\nexport function AuthRoutes({\n  basePath: _basePath = \"\",\n  // Admin routes (`/auth/users`, `/auth/users/:id`, `/auth/sso`,\n  // `/auth/audit-log`) are opt-in: only the admin app shell should pass\n  // `enableAdminRoutes={true}`. User-facing product hosts (vibecontrols,\n  // workspaces, botlit, healthybowl, etc.) intentionally do not expose\n  // these surfaces — the gateway's RBAC directives still gate the\n  // underlying queries/mutations, but hiding the routes prevents\n  // accidental UI discoverability and reduces the attack surface for\n  // misconfigured permissions.\n  enableAdminRoutes = false,\n  bypassEnterprisePlanGate = false,\n}: {\n  basePath?: string;\n  enableAdminRoutes?: boolean;\n  bypassEnterprisePlanGate?: boolean;\n}) {\n  // Note: basePath is kept for backwards compatibility but not used in route paths\n  // since React Router v7 uses relative paths when nested inside a parent <Route>\n  const auditLogFlag = useFeatureFlagDetails(\"auth.audit-log\");\n  const showAuditLog = auditLogFlag?.value === true;\n  return (\n    <Routes>\n      {/* Public routes (no auth required) */}\n      {/* LoginPage is eager-loaded as it's the most common entry point */}\n      <Route path=\"login\" element={<LoginPage />} />\n      <Route\n        path=\"register\"\n        element={\n          <Suspense fallback={<PageLoader />}>\n            <RegisterPage />\n          </Suspense>\n        }\n      />\n      <Route\n        path=\"reset-password\"\n        element={\n          <Suspense fallback={<PageLoader />}>\n            <PasswordResetPage />\n          </Suspense>\n        }\n      />\n      <Route\n        path=\"verify-email\"\n        element={\n          <Suspense fallback={<PageLoader />}>\n            <EmailVerifyPage />\n          </Suspense>\n        }\n      />\n      <Route\n        path=\"mfa-verify\"\n        element={\n          <Suspense fallback={<PageLoader />}>\n            <MfaVerifyPage />\n          </Suspense>\n        }\n      />\n      <Route\n        path=\"magic-link\"\n        element={\n          <Suspense fallback={<PageLoader />}>\n            <MagicLinkPage />\n          </Suspense>\n        }\n      />\n\n      {/* SSO routes (public) */}\n      <Route\n        path=\"sso/login\"\n        element={\n          <Suspense fallback={<PageLoader />}>\n            <SsoLoginPage />\n          </Suspense>\n        }\n      />\n      <Route\n        path=\"sso/callback\"\n        element={\n          <Suspense fallback={<PageLoader />}>\n            <SsoCallbackPage />\n          </Suspense>\n        }\n      />\n\n      {/* OAuth callback route (public) */}\n      <Route\n        path=\"oauth/callback\"\n        element={\n          <Suspense fallback={<PageLoader />}>\n            <OAuthCallbackPage />\n          </Suspense>\n        }\n      />\n\n      {/* Account reactivation (public) */}\n      <Route\n        path=\"reactivate\"\n        element={\n          <Suspense fallback={<PageLoader />}>\n            <ReactivatePage />\n          </Suspense>\n        }\n      />\n\n      {/* Session bridge (public - embedded as hidden iframe by other app shells) */}\n      <Route path=\"session-bridge\" element={<SessionBridgePage />} />\n\n      {/* Cross-domain SSO relay (reads local tokens, redirects with them to target) */}\n      <Route path=\"sso-relay\" element={<SSORelayPage />} />\n\n      {/* Cross-domain SSO callback (receives tokens from relay, stores locally) */}\n      <Route path=\"sso-callback\" element={<SSORelayCallbackPage />} />\n\n      {/* Cross-domain SSO deposit (bridge host receives tokens on top-level\n          redirect right after login on a product origin, writes first-party\n          localStorage on the bridge origin so other products can discover\n          the session). */}\n      <Route path=\"sso-deposit\" element={<SSODepositPage />} />\n\n      {/* Cross-domain SLO clear (bridge host clears its central session on\n          top-level redirect from a product origin's logout). */}\n      <Route path=\"sso-clear\" element={<SSOClearPage />} />\n\n      {/* Protected routes (auth required) */}\n      <Route\n        path=\"security\"\n        element={\n          <ProtectedRoute>\n            <FeatureGate flag=\"auth.security\" defaultValue={true}>\n              <Suspense fallback={<PageLoader />}>\n                <SecurityPage enableAdminRoutes={enableAdminRoutes} />\n              </Suspense>\n            </FeatureGate>\n          </ProtectedRoute>\n        }\n      />\n      <Route\n        path=\"sessions\"\n        element={\n          <ProtectedRoute>\n            <FeatureGate flag=\"auth.sessions\" defaultValue={true}>\n              <Suspense fallback={<PageLoader />}>\n                <SessionsPage />\n              </Suspense>\n            </FeatureGate>\n          </ProtectedRoute>\n        }\n      />\n      <Route\n        path=\"mfa\"\n        element={\n          <ProtectedRoute>\n            <FeatureGate flag=\"auth.mfa\" defaultValue={true}>\n              <Suspense fallback={<PageLoader />}>\n                <MfaSetupPage />\n              </Suspense>\n            </FeatureGate>\n          </ProtectedRoute>\n        }\n      />\n      {enableAdminRoutes && showAuditLog && (\n        <Route\n          path=\"audit-log\"\n          element={\n            <ProtectedRoute>\n              <FeatureGate flag=\"auth.audit-log\" defaultValue={false}>\n                <Suspense fallback={<PageLoader />}>\n                  <AuditLogPage />\n                </Suspense>\n              </FeatureGate>\n            </ProtectedRoute>\n          }\n        />\n      )}\n      {!enableAdminRoutes && (\n        <Route\n          path=\"audit-log\"\n          element={<Navigate to=\"/auth/login\" replace />}\n        />\n      )}\n      <Route\n        path=\"sso\"\n        element={\n          enableAdminRoutes ? (\n            <ProtectedRoute>\n              <FeatureGate flag=\"auth.sso\" defaultValue={true}>\n                <Suspense fallback={<PageLoader />}>\n                  <SsoConfigPage\n                    bypassEnterprisePlanGate={bypassEnterprisePlanGate}\n                  />\n                </Suspense>\n              </FeatureGate>\n            </ProtectedRoute>\n          ) : (\n            <Navigate to=\"/auth/login\" replace />\n          )\n        }\n      />\n      <Route\n        path=\"users\"\n        element={\n          enableAdminRoutes ? (\n            <ProtectedRoute>\n              <FeatureGate flag=\"auth.users\" defaultValue={true}>\n                <Suspense fallback={<PageLoader />}>\n                  <UsersPage />\n                </Suspense>\n              </FeatureGate>\n            </ProtectedRoute>\n          ) : (\n            <Navigate to=\"/auth/login\" replace />\n          )\n        }\n      />\n      <Route\n        path=\"users/:id\"\n        element={\n          enableAdminRoutes ? (\n            <ProtectedRoute>\n              <FeatureGate flag=\"auth.users\" defaultValue={true}>\n                <Suspense fallback={<PageLoader />}>\n                  <UserDetailsPage />\n                </Suspense>\n              </FeatureGate>\n            </ProtectedRoute>\n          ) : (\n            <Navigate to=\"/auth/login\" replace />\n          )\n        }\n      />\n      <Route\n        path=\"profile\"\n        element={\n          <ProtectedRoute>\n            <FeatureGate flag=\"auth.profile\" defaultValue={true}>\n              <Suspense fallback={<PageLoader />}>\n                <UserProfilePage />\n              </Suspense>\n            </FeatureGate>\n          </ProtectedRoute>\n        }\n      />\n\n      {/* Default redirect - when visiting /auth or /auth/ with no subpath */}\n      <Route index element={<Navigate to=\"login\" replace />} />\n    </Routes>\n  );\n}\n"],"mappings":";;;;;;;;;;;;AAiBA,IAAM,IAAe,QACnB,OAAO,2BAAwB,MAAM,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,CAC1E,EACK,IAAoB,QACxB,OAAO,gCAA6B,MAAM,OAAO,EAC/C,SAAS,EAAE,mBACZ,EAAE,CACJ,EACK,IAAkB,QACtB,OAAO,8BAA2B,MAAM,OAAO,EAC7C,SAAS,EAAE,iBACZ,EAAE,CACJ,EACK,IAAgB,QACpB,OAAO,4BAAyB,MAAM,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,CAC5E,EACK,IAAgB,QACpB,OAAO,4BAAyB,MAAM,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,CAC5E,EACK,IAAiB,QACrB,OAAO,6BAA0B,MAAM,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAC9E,EACK,IAAe,QACnB,OAAO,2BAAwB,MAAM,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,CAC1E,EACK,IAAe,QACnB,OAAO,2BAAwB,MAAM,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,CAC1E,EACK,IAAe,QACnB,OAAO,2BAAwB,MAAM,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,CAC1E,EACK,IAAe,QACnB,OAAO,2BAAwB,MAAM,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,CAC1E,EACK,IAAgB,QACpB,OAAO,4BAAyB,MAAM,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,CAC5E,EACK,IAAe,QACnB,OAAO,2BAAwB,MAAM,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,CAC1E,EACK,IAAkB,QACtB,OAAO,8BAA2B,MAAM,OAAO,EAC7C,SAAS,EAAE,iBACZ,EAAE,CACJ,EACK,IAAoB,QACxB,OAAO,gCAA6B,MAAM,OAAO,EAC/C,SAAS,EAAE,mBACZ,EAAE,CACJ,EACK,IAAY,QAChB,OAAO,wBAAqB,MAAM,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CACpE,EACK,IAAkB,QACtB,OAAO,8BAA2B,MAAM,OAAO,EAC7C,SAAS,EAAE,iBACZ,EAAE,CACJ,EACK,IAAkB,QACtB,OAAO,8BAA2B,MAAM,OAAO,EAC7C,SAAS,EAAE,iBACZ,EAAE,CACJ;AAID,SAAS,IAAa;AACpB,QACE,kBAAC,OAAD;EAAK,WAAU;YACb,kBAAC,OAAD,EAAK,WAAU,iFAAkF,CAAA;EAC7F,CAAA;;AAIV,SAAS,EAAgB,GAA8B;AACrD,KAAI;EACF,IAAM,IAAU,KAAK,MACnB,KAAK,EAAM,MAAM,IAAI,CAAC,GAAG,QAAQ,MAAM,IAAI,CAAC,QAAQ,MAAM,IAAI,CAAC,CAChE;AAED,SAAO,OAAO,EAAQ,OAAQ,WAAW,EAAQ,MAAM,MAAO;SACxD;AACN,SAAO;;;AAIX,SAAS,IAGP;AACA,KAAI;EACF,IAAM,IAAkB,eAAe,QAAQ,oBAAoB;AACnE,MAAI,CAAC,EACH,QAAO;GAAE,iBAAiB;GAAO,WAAW;GAAM;EAGpD,IAAM,IAAY,aAAa,QAAQ,QAAQ,EAAgB,SAAS;AACxE,MAAI,CAAC,EACH,QAAO;GAAE,iBAAiB;GAAO,WAAW;GAAM;EAGpD,IAAM,IAAS,KAAK,MAAM,EAAU;AAKpC,MAAI,CAAC,EAAO,YACV,QAAO;GAAE,iBAAiB;GAAO,WAAW;GAAM;EAGpD,IAAM,IACJ,OAAO,EAAO,aAAc,WACxB,EAAO,YACP,EAAgB,EAAO,YAAY;AAMzC,SAJK,IAIE;GACL,iBAAiB,IAAY,KAAK,KAAK;GACvC;GACD,GANQ;GAAE,iBAAiB;GAAO,WAAW;GAAM;SAO9C;AACN,SAAO;GAAE,iBAAiB;GAAO,WAAW;GAAM;;;AAOtD,SAAS,EAAe,EAAE,eAA2C;CACnE,IAAM,IAAkB,GAAc,MAAU,EAAM,gBAAgB,EAChE,IAAY,GAAc,MAAU,EAAM,UAAU,EACpD,CAAC,GAAqB,KAA0B,EAAS,EAAE,EAC3D,IAAkB,GAA0B;AAwClD,QAtCA,QAAgB;EACd,IAAM,UAA4B;AAChC,MAAwB,MAAU,IAAQ,EAAE;;AAM9C,SAHA,OAAO,iBAAiB,6BAA6B,EAAoB,EACzE,OAAO,iBAAiB,WAAW,EAAoB,QAE1C;AAKX,GAJA,OAAO,oBACL,6BACA,EACD,EACD,OAAO,oBAAoB,WAAW,EAAoB;;IAE3D,EAAE,CAAC,EAEN,QAAgB;AACd,MAAI,CAAC,EAAgB,UAAW;EAEhC,IAAM,IAAY,KAAK,IAAI,EAAgB,YAAY,KAAK,KAAK,EAAE,EAAE,GAAG,IAClE,IAAQ,OAAO,iBAAiB;AACpC,MAAwB,MAAU,IAAQ,EAAE;KAC3C,EAAU;AAEb,eAAa,OAAO,aAAa,EAAM;IACtC,CAAC,EAAgB,WAAW,EAAoB,CAAC,EAEpD,QAAgB;AACd,EAAI,KAAmB,CAAC,EAAgB,mBACtC,GAAW;IAEZ;EAAC;EAAW;EAAiB,EAAgB;EAAgB,CAAC,EAE5D,EAAgB,kBAId,kBAAA,GAAA,EAAG,aAAY,CAAA,GAHb,kBAAC,GAAD;EAAU,IAAG;EAAc,SAAA;EAAU,CAAA;;AA4BhD,SAAgB,EAAW,EACzB,UAAU,IAAY,IAStB,uBAAoB,IACpB,8BAA2B,MAK1B;CAID,IAAM,IADe,EAAsB,iBAAiB,EACzB,UAAU;AAC7C,QACE,kBAAC,GAAD,EAAA,UAAA;EAGE,kBAAC,GAAD;GAAO,MAAK;GAAQ,SAAS,kBAAC,GAAD,EAAa,CAAA;GAAI,CAAA;EAC9C,kBAAC,GAAD;GACE,MAAK;GACL,SACE,kBAAC,GAAD;IAAU,UAAU,kBAAC,GAAD,EAAc,CAAA;cAChC,kBAAC,GAAD,EAAgB,CAAA;IACP,CAAA;GAEb,CAAA;EACF,kBAAC,GAAD;GACE,MAAK;GACL,SACE,kBAAC,GAAD;IAAU,UAAU,kBAAC,GAAD,EAAc,CAAA;cAChC,kBAAC,GAAD,EAAqB,CAAA;IACZ,CAAA;GAEb,CAAA;EACF,kBAAC,GAAD;GACE,MAAK;GACL,SACE,kBAAC,GAAD;IAAU,UAAU,kBAAC,GAAD,EAAc,CAAA;cAChC,kBAAC,GAAD,EAAmB,CAAA;IACV,CAAA;GAEb,CAAA;EACF,kBAAC,GAAD;GACE,MAAK;GACL,SACE,kBAAC,GAAD;IAAU,UAAU,kBAAC,GAAD,EAAc,CAAA;cAChC,kBAAC,GAAD,EAAiB,CAAA;IACR,CAAA;GAEb,CAAA;EACF,kBAAC,GAAD;GACE,MAAK;GACL,SACE,kBAAC,GAAD;IAAU,UAAU,kBAAC,GAAD,EAAc,CAAA;cAChC,kBAAC,GAAD,EAAiB,CAAA;IACR,CAAA;GAEb,CAAA;EAGF,kBAAC,GAAD;GACE,MAAK;GACL,SACE,kBAAC,GAAD;IAAU,UAAU,kBAAC,GAAD,EAAc,CAAA;cAChC,kBAAC,GAAD,EAAgB,CAAA;IACP,CAAA;GAEb,CAAA;EACF,kBAAC,GAAD;GACE,MAAK;GACL,SACE,kBAAC,GAAD;IAAU,UAAU,kBAAC,GAAD,EAAc,CAAA;cAChC,kBAAC,GAAD,EAAmB,CAAA;IACV,CAAA;GAEb,CAAA;EAGF,kBAAC,GAAD;GACE,MAAK;GACL,SACE,kBAAC,GAAD;IAAU,UAAU,kBAAC,GAAD,EAAc,CAAA;cAChC,kBAAC,GAAD,EAAqB,CAAA;IACZ,CAAA;GAEb,CAAA;EAGF,kBAAC,GAAD;GACE,MAAK;GACL,SACE,kBAAC,GAAD;IAAU,UAAU,kBAAC,GAAD,EAAc,CAAA;cAChC,kBAAC,GAAD,EAAkB,CAAA;IACT,CAAA;GAEb,CAAA;EAGF,kBAAC,GAAD;GAAO,MAAK;GAAiB,SAAS,kBAAC,GAAD,EAAqB,CAAA;GAAI,CAAA;EAG/D,kBAAC,GAAD;GAAO,MAAK;GAAY,SAAS,kBAAC,GAAD,EAAgB,CAAA;GAAI,CAAA;EAGrD,kBAAC,GAAD;GAAO,MAAK;GAAe,SAAS,kBAAC,GAAD,EAAwB,CAAA;GAAI,CAAA;EAMhE,kBAAC,GAAD;GAAO,MAAK;GAAc,SAAS,kBAAC,GAAD,EAAkB,CAAA;GAAI,CAAA;EAIzD,kBAAC,GAAD;GAAO,MAAK;GAAY,SAAS,kBAAC,GAAD,EAAgB,CAAA;GAAI,CAAA;EAGrD,kBAAC,GAAD;GACE,MAAK;GACL,SACE,kBAAC,GAAD,EAAA,UACE,kBAAC,GAAD;IAAa,MAAK;IAAgB,cAAc;cAC9C,kBAAC,GAAD;KAAU,UAAU,kBAAC,GAAD,EAAc,CAAA;eAChC,kBAAC,GAAD,EAAiC,sBAAqB,CAAA;KAC7C,CAAA;IACC,CAAA,EACC,CAAA;GAEnB,CAAA;EACF,kBAAC,GAAD;GACE,MAAK;GACL,SACE,kBAAC,GAAD,EAAA,UACE,kBAAC,GAAD;IAAa,MAAK;IAAgB,cAAc;cAC9C,kBAAC,GAAD;KAAU,UAAU,kBAAC,GAAD,EAAc,CAAA;eAChC,kBAAC,GAAD,EAAgB,CAAA;KACP,CAAA;IACC,CAAA,EACC,CAAA;GAEnB,CAAA;EACF,kBAAC,GAAD;GACE,MAAK;GACL,SACE,kBAAC,GAAD,EAAA,UACE,kBAAC,GAAD;IAAa,MAAK;IAAW,cAAc;cACzC,kBAAC,GAAD;KAAU,UAAU,kBAAC,GAAD,EAAc,CAAA;eAChC,kBAAC,GAAD,EAAgB,CAAA;KACP,CAAA;IACC,CAAA,EACC,CAAA;GAEnB,CAAA;EACD,KAAqB,KACpB,kBAAC,GAAD;GACE,MAAK;GACL,SACE,kBAAC,GAAD,EAAA,UACE,kBAAC,GAAD;IAAa,MAAK;IAAiB,cAAc;cAC/C,kBAAC,GAAD;KAAU,UAAU,kBAAC,GAAD,EAAc,CAAA;eAChC,kBAAC,GAAD,EAAgB,CAAA;KACP,CAAA;IACC,CAAA,EACC,CAAA;GAEnB,CAAA;EAEH,CAAC,KACA,kBAAC,GAAD;GACE,MAAK;GACL,SAAS,kBAAC,GAAD;IAAU,IAAG;IAAc,SAAA;IAAU,CAAA;GAC9C,CAAA;EAEJ,kBAAC,GAAD;GACE,MAAK;GACL,SACE,IACE,kBAAC,GAAD,EAAA,UACE,kBAAC,GAAD;IAAa,MAAK;IAAW,cAAc;cACzC,kBAAC,GAAD;KAAU,UAAU,kBAAC,GAAD,EAAc,CAAA;eAChC,kBAAC,GAAD,EAC4B,6BAC1B,CAAA;KACO,CAAA;IACC,CAAA,EACC,CAAA,GAEjB,kBAAC,GAAD;IAAU,IAAG;IAAc,SAAA;IAAU,CAAA;GAGzC,CAAA;EACF,kBAAC,GAAD;GACE,MAAK;GACL,SACE,IACE,kBAAC,GAAD,EAAA,UACE,kBAAC,GAAD;IAAa,MAAK;IAAa,cAAc;cAC3C,kBAAC,GAAD;KAAU,UAAU,kBAAC,GAAD,EAAc,CAAA;eAChC,kBAAC,GAAD,EAAa,CAAA;KACJ,CAAA;IACC,CAAA,EACC,CAAA,GAEjB,kBAAC,GAAD;IAAU,IAAG;IAAc,SAAA;IAAU,CAAA;GAGzC,CAAA;EACF,kBAAC,GAAD;GACE,MAAK;GACL,SACE,IACE,kBAAC,GAAD,EAAA,UACE,kBAAC,GAAD;IAAa,MAAK;IAAa,cAAc;cAC3C,kBAAC,GAAD;KAAU,UAAU,kBAAC,GAAD,EAAc,CAAA;eAChC,kBAAC,GAAD,EAAmB,CAAA;KACV,CAAA;IACC,CAAA,EACC,CAAA,GAEjB,kBAAC,GAAD;IAAU,IAAG;IAAc,SAAA;IAAU,CAAA;GAGzC,CAAA;EACF,kBAAC,GAAD;GACE,MAAK;GACL,SACE,kBAAC,GAAD,EAAA,UACE,kBAAC,GAAD;IAAa,MAAK;IAAe,cAAc;cAC7C,kBAAC,GAAD;KAAU,UAAU,kBAAC,GAAD,EAAc,CAAA;eAChC,kBAAC,GAAD,EAAmB,CAAA;KACV,CAAA;IACC,CAAA,EACC,CAAA;GAEnB,CAAA;EAGF,kBAAC,GAAD;GAAO,OAAA;GAAM,SAAS,kBAAC,GAAD;IAAU,IAAG;IAAQ,SAAA;IAAU,CAAA;GAAI,CAAA;EAClD,EAAA,CAAA"}