@burdenoff/microfe-auth 2026.704.1 → 2026.704.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/auth/pages/SSOClearPage.js +13 -15
- package/dist/auth/pages/SSOClearPage.js.map +1 -1
- package/dist/auth/pages/SSODepositPage.js +16 -18
- package/dist/auth/pages/SSODepositPage.js.map +1 -1
- package/dist/auth/pages/SSORelayCallbackPage.js +12 -14
- package/dist/auth/pages/SSORelayCallbackPage.js.map +1 -1
- package/package.json +2 -2
|
@@ -3,37 +3,35 @@ import { clearLocalAuthState as t } from "@burdenoff/fe-libs/shared/components";
|
|
|
3
3
|
import { useSearchParams as n } from "react-router-dom";
|
|
4
4
|
import { jsx as r } from "react/jsx-runtime";
|
|
5
5
|
import { clearShellSsoCookies as i } from "@burdenoff/fe-libs/shared/utils";
|
|
6
|
-
import {
|
|
6
|
+
import { BrandedSplash as a } from "@burdenoff/fe-libs/ui";
|
|
7
|
+
import { getAuthBridge as o } from "@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient";
|
|
7
8
|
//#region src/auth/pages/SSOClearPage.tsx
|
|
8
|
-
var
|
|
9
|
-
function
|
|
9
|
+
var s = new Set(/* @__PURE__ */ "burdenoff.com,vibecontrols.com,fluidgrids.com,botlit.ai,bigconsole.com,gethealthybowl.com,headshotmarketing.com,timecampus.com,ggnomad.com,movethewheels.com,crewfoundry.com,planmagnet.com,eventfullymanaged.com,kadaikodi.com,assethandler.com,technospam.com,semanticfed.com,manufacturedops.com,theglobalfuel.com,housingvista.com,proserviceworld.com,mybodyshield.com,artistrybase.com,collabkin.com,brainyrich.com,theculturepost.com,comradecircle.com,cosmicintersection.com,govcitizenhub.com,intelwatchtower.com,ecoimpacthub.com,buildmyiq.com,fluidgrids.ai,atheletebridge.com,adaptercloud.com,coolandlovely.com,subscriberbot.com,labsofscience.com,hookmovies.com".split(","));
|
|
10
|
+
function c(e) {
|
|
10
11
|
if (e.hostname === "localhost" || e.hostname === "127.0.0.1" || e.hostname.endsWith(".local.burdenoff.com")) return !0;
|
|
11
12
|
if (e.protocol !== "https:") return !1;
|
|
12
|
-
for (let t of
|
|
13
|
+
for (let t of s) if (e.hostname === t || e.hostname === `app.${t}` || e.hostname === `alphaapp.${t}` || e.hostname === `www.${t}`) return !0;
|
|
13
14
|
return !1;
|
|
14
15
|
}
|
|
15
|
-
function
|
|
16
|
+
function l(e) {
|
|
16
17
|
if (!e) return "/auth/login?reason=logout";
|
|
17
18
|
try {
|
|
18
19
|
let t = new URL(e, window.location.origin);
|
|
19
|
-
if (t.origin === window.location.origin ||
|
|
20
|
+
if (t.origin === window.location.origin || c(t)) return t.href;
|
|
20
21
|
} catch {}
|
|
21
22
|
return "/auth/login?reason=logout";
|
|
22
23
|
}
|
|
23
|
-
function
|
|
24
|
-
let [
|
|
24
|
+
function u() {
|
|
25
|
+
let [s] = n();
|
|
25
26
|
return e(() => {
|
|
26
|
-
let e =
|
|
27
|
+
let e = l(s.get("returnTo"));
|
|
27
28
|
try {
|
|
28
|
-
t(), i(),
|
|
29
|
+
t(), i(), o()?.notifyLogoutAll();
|
|
29
30
|
} catch {}
|
|
30
31
|
window.location.replace(e);
|
|
31
|
-
}, [
|
|
32
|
-
className: "flex items-center justify-center min-h-screen bg-bg-canvas",
|
|
33
|
-
children: /* @__PURE__ */ r("div", { className: "animate-spin rounded-full size-8 border-2 border-action-primary-bg border-t-transparent" })
|
|
34
|
-
});
|
|
32
|
+
}, [s]), /* @__PURE__ */ r(a, { label: "Signing you out…" });
|
|
35
33
|
}
|
|
36
34
|
//#endregion
|
|
37
|
-
export {
|
|
35
|
+
export { u as SSOClearPage };
|
|
38
36
|
|
|
39
37
|
//# sourceMappingURL=SSOClearPage.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"SSOClearPage.js","names":[],"sources":["../../../src/auth/pages/SSOClearPage.tsx"],"sourcesContent":["/**\n * SSOClearPage — Cross-Domain Logout at the Central Bridge Host\n *\n * Companion to SSODepositPage. When a user signs out on a product origin,\n * the product app cleared its own localStorage / cookies but the bridge\n * host (alphaapp/app.burdenoff.com) still held the deposited session in\n * first-party (unpartitioned) localStorage. A later visit to any product\n * would then bridge-host-relay that stale session back, effectively\n * undoing the logout.\n *\n * AuthProvider.logout() / logoutAll() on a non-bridge-host origin redirect\n * here via a top-level navigation:\n *\n * product.com (logout)\n * → app.burdenoff.com/auth/sso-clear?returnTo=<encoded-return-url>\n * — wipes bridge-host localStorage + bf-sso cookie\n * → <returnTo>\n *\n * URL: /auth/sso-clear\n */\n\nimport { useEffect } from \"react\";\nimport { useSearchParams } from \"react-router-dom\";\nimport { clearShellSsoCookies } from \"@burdenoff/fe-libs/shared/utils\";\nimport { clearLocalAuthState } from \"@burdenoff/fe-libs/shared/components\";\nimport { getAuthBridge } from \"@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient\";\n\nconst ALLOWED_RETURN_DOMAINS = new Set([\n \"burdenoff.com\",\n \"vibecontrols.com\",\n \"fluidgrids.com\",\n \"botlit.ai\",\n \"bigconsole.com\",\n \"gethealthybowl.com\",\n \"headshotmarketing.com\",\n \"timecampus.com\",\n \"ggnomad.com\",\n \"movethewheels.com\",\n \"crewfoundry.com\",\n \"planmagnet.com\",\n \"eventfullymanaged.com\",\n \"kadaikodi.com\",\n \"assethandler.com\",\n \"technospam.com\",\n \"semanticfed.com\",\n \"manufacturedops.com\",\n \"theglobalfuel.com\",\n \"housingvista.com\",\n \"proserviceworld.com\",\n \"mybodyshield.com\",\n \"artistrybase.com\",\n \"collabkin.com\",\n \"brainyrich.com\",\n \"theculturepost.com\",\n \"comradecircle.com\",\n \"cosmicintersection.com\",\n \"govcitizenhub.com\",\n \"intelwatchtower.com\",\n \"ecoimpacthub.com\",\n \"buildmyiq.com\",\n \"fluidgrids.ai\",\n \"atheletebridge.com\",\n \"adaptercloud.com\",\n \"coolandlovely.com\",\n \"subscriberbot.com\",\n \"labsofscience.com\",\n \"hookmovies.com\",\n]);\n\nfunction isAllowedReturnUrl(url: URL): boolean {\n if (url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\") return true;\n if (url.hostname.endsWith(\".local.burdenoff.com\")) return true;\n if (url.protocol !== \"https:\") return false;\n for (const domain of ALLOWED_RETURN_DOMAINS) {\n if (\n url.hostname === domain ||\n url.hostname === `app.${domain}` ||\n url.hostname === `alphaapp.${domain}` ||\n url.hostname === `www.${domain}`\n ) {\n return true;\n }\n }\n return false;\n}\n\nfunction resolveSafeReturn(returnTo: string | null): string {\n if (!returnTo) return \"/auth/login?reason=logout\";\n try {\n const url = new URL(returnTo, window.location.origin);\n if (url.origin === window.location.origin || isAllowedReturnUrl(url)) {\n return url.href;\n }\n } catch {\n /* ignore */\n }\n return \"/auth/login?reason=logout\";\n}\n\nexport function SSOClearPage() {\n const [searchParams] = useSearchParams();\n\n useEffect(() => {\n const returnTo = resolveSafeReturn(searchParams.get(\"returnTo\"));\n\n try {\n clearLocalAuthState();\n clearShellSsoCookies();\n // Broadcast to any same-origin shells still listening so they drop the\n // session immediately too (best-effort — only fires on the bridge\n // host's origin, which is the only place where iframe storage isn't\n // partitioned cross-product).\n getAuthBridge()?.notifyLogoutAll();\n } catch {\n /* ignore — proceed with the redirect regardless */\n }\n\n window.location.replace(returnTo);\n }, [searchParams]);\n\n return
|
|
1
|
+
{"version":3,"file":"SSOClearPage.js","names":[],"sources":["../../../src/auth/pages/SSOClearPage.tsx"],"sourcesContent":["/**\n * SSOClearPage — Cross-Domain Logout at the Central Bridge Host\n *\n * Companion to SSODepositPage. When a user signs out on a product origin,\n * the product app cleared its own localStorage / cookies but the bridge\n * host (alphaapp/app.burdenoff.com) still held the deposited session in\n * first-party (unpartitioned) localStorage. A later visit to any product\n * would then bridge-host-relay that stale session back, effectively\n * undoing the logout.\n *\n * AuthProvider.logout() / logoutAll() on a non-bridge-host origin redirect\n * here via a top-level navigation:\n *\n * product.com (logout)\n * → app.burdenoff.com/auth/sso-clear?returnTo=<encoded-return-url>\n * — wipes bridge-host localStorage + bf-sso cookie\n * → <returnTo>\n *\n * URL: /auth/sso-clear\n */\n\nimport { useEffect } from \"react\";\nimport { BrandedSplash } from \"@burdenoff/fe-libs/ui\";\nimport { useSearchParams } from \"react-router-dom\";\nimport { clearShellSsoCookies } from \"@burdenoff/fe-libs/shared/utils\";\nimport { clearLocalAuthState } from \"@burdenoff/fe-libs/shared/components\";\nimport { getAuthBridge } from \"@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient\";\n\nconst ALLOWED_RETURN_DOMAINS = new Set([\n \"burdenoff.com\",\n \"vibecontrols.com\",\n \"fluidgrids.com\",\n \"botlit.ai\",\n \"bigconsole.com\",\n \"gethealthybowl.com\",\n \"headshotmarketing.com\",\n \"timecampus.com\",\n \"ggnomad.com\",\n \"movethewheels.com\",\n \"crewfoundry.com\",\n \"planmagnet.com\",\n \"eventfullymanaged.com\",\n \"kadaikodi.com\",\n \"assethandler.com\",\n \"technospam.com\",\n \"semanticfed.com\",\n \"manufacturedops.com\",\n \"theglobalfuel.com\",\n \"housingvista.com\",\n \"proserviceworld.com\",\n \"mybodyshield.com\",\n \"artistrybase.com\",\n \"collabkin.com\",\n \"brainyrich.com\",\n \"theculturepost.com\",\n \"comradecircle.com\",\n \"cosmicintersection.com\",\n \"govcitizenhub.com\",\n \"intelwatchtower.com\",\n \"ecoimpacthub.com\",\n \"buildmyiq.com\",\n \"fluidgrids.ai\",\n \"atheletebridge.com\",\n \"adaptercloud.com\",\n \"coolandlovely.com\",\n \"subscriberbot.com\",\n \"labsofscience.com\",\n \"hookmovies.com\",\n]);\n\nfunction isAllowedReturnUrl(url: URL): boolean {\n if (url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\") return true;\n if (url.hostname.endsWith(\".local.burdenoff.com\")) return true;\n if (url.protocol !== \"https:\") return false;\n for (const domain of ALLOWED_RETURN_DOMAINS) {\n if (\n url.hostname === domain ||\n url.hostname === `app.${domain}` ||\n url.hostname === `alphaapp.${domain}` ||\n url.hostname === `www.${domain}`\n ) {\n return true;\n }\n }\n return false;\n}\n\nfunction resolveSafeReturn(returnTo: string | null): string {\n if (!returnTo) return \"/auth/login?reason=logout\";\n try {\n const url = new URL(returnTo, window.location.origin);\n if (url.origin === window.location.origin || isAllowedReturnUrl(url)) {\n return url.href;\n }\n } catch {\n /* ignore */\n }\n return \"/auth/login?reason=logout\";\n}\n\nexport function SSOClearPage() {\n const [searchParams] = useSearchParams();\n\n useEffect(() => {\n const returnTo = resolveSafeReturn(searchParams.get(\"returnTo\"));\n\n try {\n clearLocalAuthState();\n clearShellSsoCookies();\n // Broadcast to any same-origin shells still listening so they drop the\n // session immediately too (best-effort — only fires on the bridge\n // host's origin, which is the only place where iframe storage isn't\n // partitioned cross-product).\n getAuthBridge()?.notifyLogoutAll();\n } catch {\n /* ignore — proceed with the redirect regardless */\n }\n\n window.location.replace(returnTo);\n }, [searchParams]);\n\n return <BrandedSplash label=\"Signing you out…\" />;\n}\n"],"mappings":";;;;;;;;AA4BA,IAAM,IAAyB,IAAI,IAAI,8qBAwCtC,CAAC;AAEF,SAAS,EAAmB,GAAmB;AAE7C,KADI,EAAI,aAAa,eAAe,EAAI,aAAa,eACjD,EAAI,SAAS,SAAS,uBAAuB,CAAE,QAAO;AAC1D,KAAI,EAAI,aAAa,SAAU,QAAO;AACtC,MAAK,IAAM,KAAU,EACnB,KACE,EAAI,aAAa,KACjB,EAAI,aAAa,OAAO,OACxB,EAAI,aAAa,YAAY,OAC7B,EAAI,aAAa,OAAO,IAExB,QAAO;AAGX,QAAO;;AAGT,SAAS,EAAkB,GAAiC;AAC1D,KAAI,CAAC,EAAU,QAAO;AACtB,KAAI;EACF,IAAM,IAAM,IAAI,IAAI,GAAU,OAAO,SAAS,OAAO;AACrD,MAAI,EAAI,WAAW,OAAO,SAAS,UAAU,EAAmB,EAAI,CAClE,QAAO,EAAI;SAEP;AAGR,QAAO;;AAGT,SAAgB,IAAe;CAC7B,IAAM,CAAC,KAAgB,GAAiB;AAoBxC,QAlBA,QAAgB;EACd,IAAM,IAAW,EAAkB,EAAa,IAAI,WAAW,CAAC;AAEhE,MAAI;AAOF,GANA,GAAqB,EACrB,GAAsB,EAKtB,GAAe,EAAE,iBAAiB;UAC5B;AAIR,SAAO,SAAS,QAAQ,EAAS;IAChC,CAAC,EAAa,CAAC,EAEX,kBAAC,GAAD,EAAe,OAAM,oBAAqB,CAAA"}
|
|
@@ -3,52 +3,50 @@ import { useEffect as t } from "react";
|
|
|
3
3
|
import { useSearchParams as n } from "react-router-dom";
|
|
4
4
|
import { jsx as r } from "react/jsx-runtime";
|
|
5
5
|
import { setSSoCookie as i } from "@burdenoff/fe-libs/shared/utils";
|
|
6
|
-
import {
|
|
6
|
+
import { BrandedSplash as a } from "@burdenoff/fe-libs/ui";
|
|
7
|
+
import { getAuthBridge as o } from "@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient";
|
|
7
8
|
//#region src/auth/pages/SSODepositPage.tsx
|
|
8
|
-
var
|
|
9
|
-
function
|
|
9
|
+
var s = new Set(/* @__PURE__ */ "burdenoff.com,vibecontrols.com,fluidgrids.com,botlit.ai,bigconsole.com,gethealthybowl.com,headshotmarketing.com,timecampus.com,ggnomad.com,movethewheels.com,crewfoundry.com,planmagnet.com,eventfullymanaged.com,kadaikodi.com,assethandler.com,technospam.com,semanticfed.com,manufacturedops.com,theglobalfuel.com,housingvista.com,proserviceworld.com,mybodyshield.com,artistrybase.com,collabkin.com,brainyrich.com,theculturepost.com,comradecircle.com,cosmicintersection.com,govcitizenhub.com,intelwatchtower.com,ecoimpacthub.com,buildmyiq.com,fluidgrids.ai,atheletebridge.com,adaptercloud.com,coolandlovely.com,subscriberbot.com,labsofscience.com,hookmovies.com".split(","));
|
|
10
|
+
function c(e) {
|
|
10
11
|
if (e.hostname === "localhost" || e.hostname === "127.0.0.1" || e.hostname.endsWith(".local.burdenoff.com")) return !0;
|
|
11
12
|
if (e.protocol !== "https:") return !1;
|
|
12
|
-
for (let t of
|
|
13
|
+
for (let t of s) if (e.hostname === t || e.hostname === `app.${t}` || e.hostname === `alphaapp.${t}` || e.hostname === `admin.${t}` || e.hostname === `alphaadmin.${t}` || e.hostname === `www.${t}`) return !0;
|
|
13
14
|
return !1;
|
|
14
15
|
}
|
|
15
|
-
function
|
|
16
|
+
function l(e) {
|
|
16
17
|
if (!e) return "/";
|
|
17
18
|
try {
|
|
18
19
|
let t = new URL(e, window.location.origin);
|
|
19
|
-
if (t.origin === window.location.origin ||
|
|
20
|
+
if (t.origin === window.location.origin || c(t)) return t.href;
|
|
20
21
|
} catch {}
|
|
21
22
|
return "/";
|
|
22
23
|
}
|
|
23
|
-
function
|
|
24
|
-
let [
|
|
24
|
+
function u() {
|
|
25
|
+
let [s] = n();
|
|
25
26
|
return t(() => {
|
|
26
|
-
let t =
|
|
27
|
+
let t = l(s.get("returnTo")), n = window.location.hash;
|
|
27
28
|
if (!n.startsWith("#sso=")) {
|
|
28
29
|
window.location.replace(t);
|
|
29
30
|
return;
|
|
30
31
|
}
|
|
31
32
|
try {
|
|
32
|
-
let r = n.slice(5), { profileId:
|
|
33
|
-
if (!
|
|
33
|
+
let r = n.slice(5), { profileId: a, tokens: s, user: c, profiles: l } = JSON.parse(atob(r));
|
|
34
|
+
if (!a || !s) {
|
|
34
35
|
window.location.replace(t);
|
|
35
36
|
return;
|
|
36
37
|
}
|
|
37
|
-
localStorage.setItem(`bf-p-${
|
|
38
|
+
localStorage.setItem(`bf-p-${a}-tokens`, s), c && localStorage.setItem(`bf-p-${a}-user`, c), l && localStorage.setItem("bf-profiles", l), sessionStorage.setItem("bf-active-profile", a), i(a), e.getState().loadFromProfile(a), window.dispatchEvent(new Event("bf-profile-storage-change")), o()?.notifyLogin({
|
|
38
39
|
user: c ? JSON.parse(c) : null,
|
|
39
40
|
tokens: s ? JSON.parse(s) : null,
|
|
40
|
-
activeProfileId:
|
|
41
|
+
activeProfileId: a,
|
|
41
42
|
profiles: l ? JSON.parse(l) : []
|
|
42
43
|
}), window.location.replace(t);
|
|
43
44
|
} catch {
|
|
44
45
|
window.location.replace(t);
|
|
45
46
|
}
|
|
46
|
-
}, [
|
|
47
|
-
className: "flex items-center justify-center min-h-screen bg-bg-canvas",
|
|
48
|
-
children: /* @__PURE__ */ r("div", { className: "animate-spin rounded-full size-8 border-2 border-action-primary-bg border-t-transparent" })
|
|
49
|
-
});
|
|
47
|
+
}, [s]), /* @__PURE__ */ r(a, { label: "Signing you in…" });
|
|
50
48
|
}
|
|
51
49
|
//#endregion
|
|
52
|
-
export {
|
|
50
|
+
export { u as SSODepositPage };
|
|
53
51
|
|
|
54
52
|
//# sourceMappingURL=SSODepositPage.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"SSODepositPage.js","names":[],"sources":["../../../src/auth/pages/SSODepositPage.tsx"],"sourcesContent":["/**\n * SSODepositPage — Cross-Domain Token Deposit at the Central Bridge Host\n *\n * Loaded as a top-level navigation (NOT an iframe) on the bridge host\n * (alphaapp/app.burdenoff.com) right after a user signs in on any other\n * product origin. It receives the freshly-issued tokens in the URL fragment\n * (`#sso=<base64>` — fragments are never sent to servers) and stores them\n * in this origin's first-party (unpartitioned) localStorage so that:\n *\n * 1. A later top-level visit to the bridge host renders authenticated.\n * 2. Other product origins can discover the session via\n * `/auth/sso-relay?returnTo=...` against this host.\n *\n * Flow:\n * product.com/auth/login → user signs in\n * product.com → POST-success redirect to:\n * app.burdenoff.com/auth/sso-deposit?returnTo=<encoded-return-url>#sso=<base64>\n * → writes tokens here, sets bf-sso cookie\n * <returnTo> → user lands back at intended dashboard\n *\n * URL: /auth/sso-deposit\n */\n\nimport { useEffect } from \"react\";\nimport { useSearchParams } from \"react-router-dom\";\nimport { getAuthBridge } from \"@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient\";\nimport { setSSoCookie } from \"@burdenoff/fe-libs/shared/utils\";\nimport { useAuthStore } from \"../store/authStore\";\n\nconst ALLOWED_RETURN_DOMAINS = new Set([\n \"burdenoff.com\",\n \"vibecontrols.com\",\n \"fluidgrids.com\",\n \"botlit.ai\",\n \"bigconsole.com\",\n \"gethealthybowl.com\",\n \"headshotmarketing.com\",\n \"timecampus.com\",\n \"ggnomad.com\",\n \"movethewheels.com\",\n \"crewfoundry.com\",\n \"planmagnet.com\",\n \"eventfullymanaged.com\",\n \"kadaikodi.com\",\n \"assethandler.com\",\n \"technospam.com\",\n \"semanticfed.com\",\n \"manufacturedops.com\",\n \"theglobalfuel.com\",\n \"housingvista.com\",\n \"proserviceworld.com\",\n \"mybodyshield.com\",\n \"artistrybase.com\",\n \"collabkin.com\",\n \"brainyrich.com\",\n \"theculturepost.com\",\n \"comradecircle.com\",\n \"cosmicintersection.com\",\n \"govcitizenhub.com\",\n \"intelwatchtower.com\",\n \"ecoimpacthub.com\",\n \"buildmyiq.com\",\n \"fluidgrids.ai\",\n \"atheletebridge.com\",\n \"adaptercloud.com\",\n \"coolandlovely.com\",\n \"subscriberbot.com\",\n \"labsofscience.com\",\n \"hookmovies.com\",\n]);\n\nfunction isAllowedReturnUrl(url: URL): boolean {\n if (url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\") return true;\n if (url.hostname.endsWith(\".local.burdenoff.com\")) return true;\n if (url.protocol !== \"https:\") return false;\n for (const domain of ALLOWED_RETURN_DOMAINS) {\n if (\n url.hostname === domain ||\n url.hostname === `app.${domain}` ||\n url.hostname === `alphaapp.${domain}` ||\n // Admin app shells (admin.burdenoff.com / alphaadmin.burdenoff.com) are\n // valid post-deposit return targets. Without these, a login that lands on\n // the bridge host falls back to \"/\" instead of returning to the admin app.\n url.hostname === `admin.${domain}` ||\n url.hostname === `alphaadmin.${domain}` ||\n url.hostname === `www.${domain}`\n ) {\n return true;\n }\n }\n return false;\n}\n\nfunction resolveSafeReturn(returnTo: string | null): string {\n if (!returnTo) return \"/\";\n try {\n const url = new URL(returnTo, window.location.origin);\n if (url.origin === window.location.origin || isAllowedReturnUrl(url)) {\n return url.href;\n }\n } catch {\n /* ignore */\n }\n return \"/\";\n}\n\nexport function SSODepositPage() {\n const [searchParams] = useSearchParams();\n\n useEffect(() => {\n const returnTo = resolveSafeReturn(searchParams.get(\"returnTo\"));\n const hash = window.location.hash;\n\n if (!hash.startsWith(\"#sso=\")) {\n window.location.replace(returnTo);\n return;\n }\n\n try {\n const encoded = hash.slice(5);\n const payload = JSON.parse(atob(encoded)) as {\n profileId?: string;\n tokens?: string;\n user?: string;\n profiles?: string;\n };\n const { profileId, tokens, user, profiles } = payload;\n\n if (!profileId || !tokens) {\n window.location.replace(returnTo);\n return;\n }\n\n // First-party (unpartitioned) writes on the bridge host origin —\n // future top-level visits here see the session.\n localStorage.setItem(`bf-p-${profileId}-tokens`, tokens);\n if (user) {\n localStorage.setItem(`bf-p-${profileId}-user`, user);\n }\n if (profiles) {\n localStorage.setItem(\"bf-profiles\", profiles);\n }\n sessionStorage.setItem(\"bf-active-profile\", profileId);\n setSSoCookie(profileId);\n useAuthStore.getState().loadFromProfile(profileId);\n window.dispatchEvent(new Event(\"bf-profile-storage-change\"));\n\n // Notify the same-origin auth bridge so any other open shells on\n // this origin pick up the new session immediately.\n getAuthBridge()?.notifyLogin({\n user: user ? (JSON.parse(user) as Record<string, unknown>) : null,\n tokens: tokens ? (JSON.parse(tokens) as { accessToken: string }) : null,\n activeProfileId: profileId,\n profiles: profiles\n ? (JSON.parse(profiles) as Array<Record<string, unknown>>)\n : [],\n });\n\n window.location.replace(returnTo);\n } catch {\n window.location.replace(returnTo);\n }\n }, [searchParams]);\n\n return
|
|
1
|
+
{"version":3,"file":"SSODepositPage.js","names":[],"sources":["../../../src/auth/pages/SSODepositPage.tsx"],"sourcesContent":["/**\n * SSODepositPage — Cross-Domain Token Deposit at the Central Bridge Host\n *\n * Loaded as a top-level navigation (NOT an iframe) on the bridge host\n * (alphaapp/app.burdenoff.com) right after a user signs in on any other\n * product origin. It receives the freshly-issued tokens in the URL fragment\n * (`#sso=<base64>` — fragments are never sent to servers) and stores them\n * in this origin's first-party (unpartitioned) localStorage so that:\n *\n * 1. A later top-level visit to the bridge host renders authenticated.\n * 2. Other product origins can discover the session via\n * `/auth/sso-relay?returnTo=...` against this host.\n *\n * Flow:\n * product.com/auth/login → user signs in\n * product.com → POST-success redirect to:\n * app.burdenoff.com/auth/sso-deposit?returnTo=<encoded-return-url>#sso=<base64>\n * → writes tokens here, sets bf-sso cookie\n * <returnTo> → user lands back at intended dashboard\n *\n * URL: /auth/sso-deposit\n */\n\nimport { useEffect } from \"react\";\nimport { BrandedSplash } from \"@burdenoff/fe-libs/ui\";\nimport { useSearchParams } from \"react-router-dom\";\nimport { getAuthBridge } from \"@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient\";\nimport { setSSoCookie } from \"@burdenoff/fe-libs/shared/utils\";\nimport { useAuthStore } from \"../store/authStore\";\n\nconst ALLOWED_RETURN_DOMAINS = new Set([\n \"burdenoff.com\",\n \"vibecontrols.com\",\n \"fluidgrids.com\",\n \"botlit.ai\",\n \"bigconsole.com\",\n \"gethealthybowl.com\",\n \"headshotmarketing.com\",\n \"timecampus.com\",\n \"ggnomad.com\",\n \"movethewheels.com\",\n \"crewfoundry.com\",\n \"planmagnet.com\",\n \"eventfullymanaged.com\",\n \"kadaikodi.com\",\n \"assethandler.com\",\n \"technospam.com\",\n \"semanticfed.com\",\n \"manufacturedops.com\",\n \"theglobalfuel.com\",\n \"housingvista.com\",\n \"proserviceworld.com\",\n \"mybodyshield.com\",\n \"artistrybase.com\",\n \"collabkin.com\",\n \"brainyrich.com\",\n \"theculturepost.com\",\n \"comradecircle.com\",\n \"cosmicintersection.com\",\n \"govcitizenhub.com\",\n \"intelwatchtower.com\",\n \"ecoimpacthub.com\",\n \"buildmyiq.com\",\n \"fluidgrids.ai\",\n \"atheletebridge.com\",\n \"adaptercloud.com\",\n \"coolandlovely.com\",\n \"subscriberbot.com\",\n \"labsofscience.com\",\n \"hookmovies.com\",\n]);\n\nfunction isAllowedReturnUrl(url: URL): boolean {\n if (url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\") return true;\n if (url.hostname.endsWith(\".local.burdenoff.com\")) return true;\n if (url.protocol !== \"https:\") return false;\n for (const domain of ALLOWED_RETURN_DOMAINS) {\n if (\n url.hostname === domain ||\n url.hostname === `app.${domain}` ||\n url.hostname === `alphaapp.${domain}` ||\n // Admin app shells (admin.burdenoff.com / alphaadmin.burdenoff.com) are\n // valid post-deposit return targets. Without these, a login that lands on\n // the bridge host falls back to \"/\" instead of returning to the admin app.\n url.hostname === `admin.${domain}` ||\n url.hostname === `alphaadmin.${domain}` ||\n url.hostname === `www.${domain}`\n ) {\n return true;\n }\n }\n return false;\n}\n\nfunction resolveSafeReturn(returnTo: string | null): string {\n if (!returnTo) return \"/\";\n try {\n const url = new URL(returnTo, window.location.origin);\n if (url.origin === window.location.origin || isAllowedReturnUrl(url)) {\n return url.href;\n }\n } catch {\n /* ignore */\n }\n return \"/\";\n}\n\nexport function SSODepositPage() {\n const [searchParams] = useSearchParams();\n\n useEffect(() => {\n const returnTo = resolveSafeReturn(searchParams.get(\"returnTo\"));\n const hash = window.location.hash;\n\n if (!hash.startsWith(\"#sso=\")) {\n window.location.replace(returnTo);\n return;\n }\n\n try {\n const encoded = hash.slice(5);\n const payload = JSON.parse(atob(encoded)) as {\n profileId?: string;\n tokens?: string;\n user?: string;\n profiles?: string;\n };\n const { profileId, tokens, user, profiles } = payload;\n\n if (!profileId || !tokens) {\n window.location.replace(returnTo);\n return;\n }\n\n // First-party (unpartitioned) writes on the bridge host origin —\n // future top-level visits here see the session.\n localStorage.setItem(`bf-p-${profileId}-tokens`, tokens);\n if (user) {\n localStorage.setItem(`bf-p-${profileId}-user`, user);\n }\n if (profiles) {\n localStorage.setItem(\"bf-profiles\", profiles);\n }\n sessionStorage.setItem(\"bf-active-profile\", profileId);\n setSSoCookie(profileId);\n useAuthStore.getState().loadFromProfile(profileId);\n window.dispatchEvent(new Event(\"bf-profile-storage-change\"));\n\n // Notify the same-origin auth bridge so any other open shells on\n // this origin pick up the new session immediately.\n getAuthBridge()?.notifyLogin({\n user: user ? (JSON.parse(user) as Record<string, unknown>) : null,\n tokens: tokens ? (JSON.parse(tokens) as { accessToken: string }) : null,\n activeProfileId: profileId,\n profiles: profiles\n ? (JSON.parse(profiles) as Array<Record<string, unknown>>)\n : [],\n });\n\n window.location.replace(returnTo);\n } catch {\n window.location.replace(returnTo);\n }\n }, [searchParams]);\n\n return <BrandedSplash label=\"Signing you in…\" />;\n}\n"],"mappings":";;;;;;;;AA8BA,IAAM,IAAyB,IAAI,IAAI,8qBAwCtC,CAAC;AAEF,SAAS,EAAmB,GAAmB;AAE7C,KADI,EAAI,aAAa,eAAe,EAAI,aAAa,eACjD,EAAI,SAAS,SAAS,uBAAuB,CAAE,QAAO;AAC1D,KAAI,EAAI,aAAa,SAAU,QAAO;AACtC,MAAK,IAAM,KAAU,EACnB,KACE,EAAI,aAAa,KACjB,EAAI,aAAa,OAAO,OACxB,EAAI,aAAa,YAAY,OAI7B,EAAI,aAAa,SAAS,OAC1B,EAAI,aAAa,cAAc,OAC/B,EAAI,aAAa,OAAO,IAExB,QAAO;AAGX,QAAO;;AAGT,SAAS,EAAkB,GAAiC;AAC1D,KAAI,CAAC,EAAU,QAAO;AACtB,KAAI;EACF,IAAM,IAAM,IAAI,IAAI,GAAU,OAAO,SAAS,OAAO;AACrD,MAAI,EAAI,WAAW,OAAO,SAAS,UAAU,EAAmB,EAAI,CAClE,QAAO,EAAI;SAEP;AAGR,QAAO;;AAGT,SAAgB,IAAiB;CAC/B,IAAM,CAAC,KAAgB,GAAiB;AAyDxC,QAvDA,QAAgB;EACd,IAAM,IAAW,EAAkB,EAAa,IAAI,WAAW,CAAC,EAC1D,IAAO,OAAO,SAAS;AAE7B,MAAI,CAAC,EAAK,WAAW,QAAQ,EAAE;AAC7B,UAAO,SAAS,QAAQ,EAAS;AACjC;;AAGF,MAAI;GACF,IAAM,IAAU,EAAK,MAAM,EAAE,EAOvB,EAAE,cAAW,WAAQ,SAAM,gBANjB,KAAK,MAAM,KAAK,EAAQ,CAAC;AAQzC,OAAI,CAAC,KAAa,CAAC,GAAQ;AACzB,WAAO,SAAS,QAAQ,EAAS;AACjC;;AA4BF,GAvBA,aAAa,QAAQ,QAAQ,EAAU,UAAU,EAAO,EACpD,KACF,aAAa,QAAQ,QAAQ,EAAU,QAAQ,EAAK,EAElD,KACF,aAAa,QAAQ,eAAe,EAAS,EAE/C,eAAe,QAAQ,qBAAqB,EAAU,EACtD,EAAa,EAAU,EACvB,EAAa,UAAU,CAAC,gBAAgB,EAAU,EAClD,OAAO,cAAc,IAAI,MAAM,4BAA4B,CAAC,EAI5D,GAAe,EAAE,YAAY;IAC3B,MAAM,IAAQ,KAAK,MAAM,EAAK,GAA+B;IAC7D,QAAQ,IAAU,KAAK,MAAM,EAAO,GAA+B;IACnE,iBAAiB;IACjB,UAAU,IACL,KAAK,MAAM,EAAS,GACrB,EAAE;IACP,CAAC,EAEF,OAAO,SAAS,QAAQ,EAAS;UAC3B;AACN,UAAO,SAAS,QAAQ,EAAS;;IAElC,CAAC,EAAa,CAAC,EAEX,kBAAC,GAAD,EAAe,OAAM,mBAAoB,CAAA"}
|
|
@@ -3,9 +3,10 @@ import { useEffect as t } from "react";
|
|
|
3
3
|
import { useSearchParams as n } from "react-router-dom";
|
|
4
4
|
import { jsx as r } from "react/jsx-runtime";
|
|
5
5
|
import { setSSoCookie as i } from "@burdenoff/fe-libs/shared/utils";
|
|
6
|
-
import {
|
|
6
|
+
import { BrandedSplash as a } from "@burdenoff/fe-libs/ui";
|
|
7
|
+
import { getAuthBridge as o } from "@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient";
|
|
7
8
|
//#region src/auth/pages/SSORelayCallbackPage.tsx
|
|
8
|
-
function
|
|
9
|
+
function s(e) {
|
|
9
10
|
if (!e) return "/dashboard";
|
|
10
11
|
try {
|
|
11
12
|
let t = new URL(e, window.location.origin);
|
|
@@ -14,35 +15,32 @@ function o(e) {
|
|
|
14
15
|
return "/dashboard";
|
|
15
16
|
}
|
|
16
17
|
}
|
|
17
|
-
function
|
|
18
|
-
let [
|
|
18
|
+
function c() {
|
|
19
|
+
let [c] = n();
|
|
19
20
|
return t(() => {
|
|
20
|
-
let t =
|
|
21
|
+
let t = s(c.get("returnTo")), n = window.location.hash;
|
|
21
22
|
if (!n.startsWith("#sso=")) {
|
|
22
23
|
window.location.replace("/auth/login");
|
|
23
24
|
return;
|
|
24
25
|
}
|
|
25
26
|
try {
|
|
26
|
-
let r = n.slice(5), { profileId:
|
|
27
|
-
if (!
|
|
27
|
+
let r = n.slice(5), { profileId: a, tokens: s, user: c, profiles: l } = JSON.parse(atob(r));
|
|
28
|
+
if (!a || !s) {
|
|
28
29
|
window.location.replace("/auth/login");
|
|
29
30
|
return;
|
|
30
31
|
}
|
|
31
|
-
localStorage.setItem(`bf-p-${
|
|
32
|
+
localStorage.setItem(`bf-p-${a}-tokens`, s), c && localStorage.setItem(`bf-p-${a}-user`, c), l && localStorage.setItem("bf-profiles", l), sessionStorage.setItem("bf-active-profile", a), i(a), e.getState().loadFromProfile(a), window.dispatchEvent(new Event("bf-profile-storage-change")), o()?.notifyLogin({
|
|
32
33
|
user: c ? JSON.parse(c) : null,
|
|
33
34
|
tokens: s ? JSON.parse(s) : null,
|
|
34
|
-
activeProfileId:
|
|
35
|
+
activeProfileId: a,
|
|
35
36
|
profiles: l ? JSON.parse(l) : []
|
|
36
37
|
}), window.location.replace(t);
|
|
37
38
|
} catch {
|
|
38
39
|
window.location.replace("/auth/login");
|
|
39
40
|
}
|
|
40
|
-
}, [
|
|
41
|
-
className: "flex items-center justify-center min-h-screen bg-bg-canvas",
|
|
42
|
-
children: /* @__PURE__ */ r("div", { className: "animate-spin rounded-full size-8 border-2 border-action-primary-bg border-t-transparent" })
|
|
43
|
-
});
|
|
41
|
+
}, [c]), /* @__PURE__ */ r(a, { label: "Signing you in…" });
|
|
44
42
|
}
|
|
45
43
|
//#endregion
|
|
46
|
-
export {
|
|
44
|
+
export { c as SSORelayCallbackPage };
|
|
47
45
|
|
|
48
46
|
//# sourceMappingURL=SSORelayCallbackPage.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"SSORelayCallbackPage.js","names":[],"sources":["../../../src/auth/pages/SSORelayCallbackPage.tsx"],"sourcesContent":["/**\n * SSORelayCallbackPage — Receives tokens from the SSO relay and stores them locally.\n *\n * Tokens arrive in the URL fragment (#sso=<base64>) which is never sent to servers.\n * After storing in localStorage, redirects to the returnTo path.\n */\n\nimport { useEffect } from \"react\";\nimport { useSearchParams } from \"react-router-dom\";\nimport { getAuthBridge } from \"@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient\";\nimport { setSSoCookie } from \"@burdenoff/fe-libs/shared/utils\";\nimport { useAuthStore } from \"../store/authStore\";\n\nfunction getSafeReturnTo(returnTo: string | null): string {\n if (!returnTo) return \"/dashboard\";\n\n try {\n const url = new URL(returnTo, window.location.origin);\n if (url.origin !== window.location.origin) return \"/dashboard\";\n return `${url.pathname}${url.search}${url.hash}`;\n } catch {\n return \"/dashboard\";\n }\n}\n\nexport function SSORelayCallbackPage() {\n const [searchParams] = useSearchParams();\n\n useEffect(() => {\n const returnTo = getSafeReturnTo(searchParams.get(\"returnTo\"));\n const hash = window.location.hash;\n\n if (!hash.startsWith(\"#sso=\")) {\n // No SSO data — redirect to login\n window.location.replace(\"/auth/login\");\n return;\n }\n\n try {\n const encoded = hash.slice(5); // Remove \"#sso=\"\n const payload = JSON.parse(atob(encoded));\n const { profileId, tokens, user, profiles } = payload;\n\n if (!profileId || !tokens) {\n window.location.replace(\"/auth/login\");\n return;\n }\n\n // Store tokens in localStorage\n localStorage.setItem(`bf-p-${profileId}-tokens`, tokens);\n if (user) {\n localStorage.setItem(`bf-p-${profileId}-user`, user);\n }\n if (profiles) {\n localStorage.setItem(\"bf-profiles\", profiles);\n }\n sessionStorage.setItem(\"bf-active-profile\", profileId);\n setSSoCookie(profileId);\n useAuthStore.getState().loadFromProfile(profileId);\n\n // Dispatch event so AuthProvider picks up the new state\n window.dispatchEvent(new Event(\"bf-profile-storage-change\"));\n\n // Notify the auth bridge so other open shells can pick up the new session\n getAuthBridge()?.notifyLogin({\n user: user ? JSON.parse(user) : null,\n tokens: tokens ? JSON.parse(tokens) : null,\n activeProfileId: profileId,\n profiles: profiles ? JSON.parse(profiles) : [],\n });\n\n // Clear the hash and redirect\n window.location.replace(returnTo);\n } catch {\n window.location.replace(\"/auth/login\");\n }\n }, [searchParams]);\n\n return
|
|
1
|
+
{"version":3,"file":"SSORelayCallbackPage.js","names":[],"sources":["../../../src/auth/pages/SSORelayCallbackPage.tsx"],"sourcesContent":["/**\n * SSORelayCallbackPage — Receives tokens from the SSO relay and stores them locally.\n *\n * Tokens arrive in the URL fragment (#sso=<base64>) which is never sent to servers.\n * After storing in localStorage, redirects to the returnTo path.\n */\n\nimport { useEffect } from \"react\";\nimport { BrandedSplash } from \"@burdenoff/fe-libs/ui\";\nimport { useSearchParams } from \"react-router-dom\";\nimport { getAuthBridge } from \"@burdenoff/fe-libs/shared/providers/shell/AuthBridgeClient\";\nimport { setSSoCookie } from \"@burdenoff/fe-libs/shared/utils\";\nimport { useAuthStore } from \"../store/authStore\";\n\nfunction getSafeReturnTo(returnTo: string | null): string {\n if (!returnTo) return \"/dashboard\";\n\n try {\n const url = new URL(returnTo, window.location.origin);\n if (url.origin !== window.location.origin) return \"/dashboard\";\n return `${url.pathname}${url.search}${url.hash}`;\n } catch {\n return \"/dashboard\";\n }\n}\n\nexport function SSORelayCallbackPage() {\n const [searchParams] = useSearchParams();\n\n useEffect(() => {\n const returnTo = getSafeReturnTo(searchParams.get(\"returnTo\"));\n const hash = window.location.hash;\n\n if (!hash.startsWith(\"#sso=\")) {\n // No SSO data — redirect to login\n window.location.replace(\"/auth/login\");\n return;\n }\n\n try {\n const encoded = hash.slice(5); // Remove \"#sso=\"\n const payload = JSON.parse(atob(encoded));\n const { profileId, tokens, user, profiles } = payload;\n\n if (!profileId || !tokens) {\n window.location.replace(\"/auth/login\");\n return;\n }\n\n // Store tokens in localStorage\n localStorage.setItem(`bf-p-${profileId}-tokens`, tokens);\n if (user) {\n localStorage.setItem(`bf-p-${profileId}-user`, user);\n }\n if (profiles) {\n localStorage.setItem(\"bf-profiles\", profiles);\n }\n sessionStorage.setItem(\"bf-active-profile\", profileId);\n setSSoCookie(profileId);\n useAuthStore.getState().loadFromProfile(profileId);\n\n // Dispatch event so AuthProvider picks up the new state\n window.dispatchEvent(new Event(\"bf-profile-storage-change\"));\n\n // Notify the auth bridge so other open shells can pick up the new session\n getAuthBridge()?.notifyLogin({\n user: user ? JSON.parse(user) : null,\n tokens: tokens ? JSON.parse(tokens) : null,\n activeProfileId: profileId,\n profiles: profiles ? JSON.parse(profiles) : [],\n });\n\n // Clear the hash and redirect\n window.location.replace(returnTo);\n } catch {\n window.location.replace(\"/auth/login\");\n }\n }, [searchParams]);\n\n return <BrandedSplash label=\"Signing you in…\" />;\n}\n"],"mappings":";;;;;;;;AAcA,SAAS,EAAgB,GAAiC;AACxD,KAAI,CAAC,EAAU,QAAO;AAEtB,KAAI;EACF,IAAM,IAAM,IAAI,IAAI,GAAU,OAAO,SAAS,OAAO;AAErD,SADI,EAAI,WAAW,OAAO,SAAS,SAC5B,GAAG,EAAI,WAAW,EAAI,SAAS,EAAI,SADQ;SAE5C;AACN,SAAO;;;AAIX,SAAgB,IAAuB;CACrC,IAAM,CAAC,KAAgB,GAAiB;AAoDxC,QAlDA,QAAgB;EACd,IAAM,IAAW,EAAgB,EAAa,IAAI,WAAW,CAAC,EACxD,IAAO,OAAO,SAAS;AAE7B,MAAI,CAAC,EAAK,WAAW,QAAQ,EAAE;AAE7B,UAAO,SAAS,QAAQ,cAAc;AACtC;;AAGF,MAAI;GACF,IAAM,IAAU,EAAK,MAAM,EAAE,EAEvB,EAAE,cAAW,WAAQ,SAAM,gBADjB,KAAK,MAAM,KAAK,EAAQ,CAAC;AAGzC,OAAI,CAAC,KAAa,CAAC,GAAQ;AACzB,WAAO,SAAS,QAAQ,cAAc;AACtC;;AA2BF,GAvBA,aAAa,QAAQ,QAAQ,EAAU,UAAU,EAAO,EACpD,KACF,aAAa,QAAQ,QAAQ,EAAU,QAAQ,EAAK,EAElD,KACF,aAAa,QAAQ,eAAe,EAAS,EAE/C,eAAe,QAAQ,qBAAqB,EAAU,EACtD,EAAa,EAAU,EACvB,EAAa,UAAU,CAAC,gBAAgB,EAAU,EAGlD,OAAO,cAAc,IAAI,MAAM,4BAA4B,CAAC,EAG5D,GAAe,EAAE,YAAY;IAC3B,MAAM,IAAO,KAAK,MAAM,EAAK,GAAG;IAChC,QAAQ,IAAS,KAAK,MAAM,EAAO,GAAG;IACtC,iBAAiB;IACjB,UAAU,IAAW,KAAK,MAAM,EAAS,GAAG,EAAE;IAC/C,CAAC,EAGF,OAAO,SAAS,QAAQ,EAAS;UAC3B;AACN,UAAO,SAAS,QAAQ,cAAc;;IAEvC,CAAC,EAAa,CAAC,EAEX,kBAAC,GAAD,EAAe,OAAM,mBAAoB,CAAA"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@burdenoff/microfe-auth",
|
|
3
|
-
"version": "2026.704.
|
|
3
|
+
"version": "2026.704.2",
|
|
4
4
|
"description": "Auth microfrontend for Burdenoff products",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"imports": {
|
|
@@ -44,7 +44,7 @@
|
|
|
44
44
|
},
|
|
45
45
|
"dependencies": {
|
|
46
46
|
"@apollo/client": "^4.0.9",
|
|
47
|
-
"@burdenoff/fe-libs": "2026.
|
|
47
|
+
"@burdenoff/fe-libs": "2026.704.2",
|
|
48
48
|
"@types/qrcode.react": "^3.0.0",
|
|
49
49
|
"clsx": "^2.1.1",
|
|
50
50
|
"graphql": "^16.12.0",
|