@burdenoff/microfe-auth 2026.917.2 → 2026.1005.1

package/dist/auth/pages/SsoCallbackPage.js.map

@@ -1 +1 @@
-{"version":3,"file":"SsoCallbackPage.js","names":[],"sources":["../../../src/auth/pages/SsoCallbackPage.tsx"],"sourcesContent":["import { useEffect, useState, useRef } from \"react\";\nimport { useTr } from \"../../shared/hooks/useTr\";\nimport { useNavigate, useSearchParams } from \"react-router\";\nimport { useAuthStore } from \"../store/authStore\";\nimport { useSsoOperations } from \"../hooks/useSsoOperations\";\nimport { Button } from \"@burdenoff/fe-libs/button\";\nimport { SpinnerIcon, AlertIcon } from \"../components/AuthIcons\";\n\n/**\n * SSO Callback Page\n * Handles redirects from:\n * - SAML ACS server (with token/refreshToken in query params)\n * - OIDC Authorization Server (with code/state in query params)\n */\nexport function SsoCallbackPage() {\n  const tr = useTr();\n\n  const navigate = useNavigate();\n  const [searchParams] = useSearchParams();\n  const setAuthTokens = useAuthStore((state) => state.setAuthTokens);\n  const setAuthenticated = useAuthStore((state) => state.setAuthenticated);\n  const {\n    exchangeOidcCode,\n    validateOidcState,\n    isExternalOidcCallback,\n    handleExternalOidcCallback,\n  } = useSsoOperations();\n\n  const [error, setError] = useState<string | null>(null);\n  const [status, setStatus] = useState<\"processing\" | \"success\" | \"error\">(\n    \"processing\",\n  );\n  const [callbackType, setCallbackType] = useState<\"saml\" | \"oidc\" | \"unknown\">(\n    \"unknown\",\n  );\n  const processedRef = useRef(false);\n  const redirectTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);\n\n  useEffect(() => {\n    // Prevent double execution in React StrictMode\n    if (processedRef.current) {\n      return;\n    }\n    processedRef.current = true;\n\n    const processCallback = async () => {\n      try {\n        // Check for error from either SSO provider\n        const errorParam = searchParams.get(\"error\");\n        const errorMessage =\n          searchParams.get(\"message\") || searchParams.get(\"error_description\");\n\n        if (errorParam) {\n          throw new Error(\n            errorMessage || `SSO authentication failed: ${errorParam}`,\n          );\n        }\n\n        // Detect callback type based on query parameters\n        const token = searchParams.get(\"token\");\n        const code = searchParams.get(\"code\");\n        const state = searchParams.get(\"state\");\n\n        if (token) {\n          // SAML callback - token already exchanged by ACS server\n          setCallbackType(\"saml\");\n          await handleSamlCallback(token);\n        } else if (code) {\n          // OIDC callback - need to exchange code for tokens\n          setCallbackType(\"oidc\");\n          await handleOidcCallback(code, state);\n        } else {\n          throw new Error(\n            \"Invalid SSO callback. No token or authorization code received.\",\n          );\n        }\n      } catch (err) {\n        console.error(\"[SSO Callback] Error:\", err);\n        setError(\n          err instanceof Error ? err.message : \"Failed to process SSO response\",\n        );\n        setStatus(\"error\");\n      }\n    };\n\n    /**\n     * Handle SAML callback from ACS server\n     * Token is already exchanged, just store and redirect\n     * Also handles MFA if required\n     */\n    const handleSamlCallback = async (token: string) => {\n      const refreshToken = searchParams.get(\"refreshToken\");\n      const redirect = searchParams.get(\"redirect\");\n      const requiresMFA = searchParams.get(\"requiresMFA\") === \"true\";\n      const mfaChallengeId = searchParams.get(\"mfaChallengeId\");\n\n      // Check if MFA is required\n      if (requiresMFA && mfaChallengeId) {\n        // Store partial auth state and MFA info\n        sessionStorage.setItem(\"mfa_challenge_id\", mfaChallengeId);\n        sessionStorage.setItem(\"mfa_pending_token\", token);\n        sessionStorage.setItem(\"mfa_pending_refresh\", refreshToken || \"\");\n        sessionStorage.setItem(\"mfa_redirect\", redirect || \"/dashboard\");\n\n        // Redirect to MFA verification\n        navigate(\"/auth/mfa-verify\", { replace: true });\n        return;\n      }\n\n      // Store tokens\n      setAuthTokens(token, refreshToken || \"\");\n      setAuthenticated(true);\n\n      setStatus(\"success\");\n\n      // Redirect to the specified URL or default to dashboard\n      redirectTimerRef.current = setTimeout(() => {\n        const redirectUrl = redirect || \"/dashboard\";\n        navigate(redirectUrl, { replace: true });\n      }, 1500);\n    };\n\n    /**\n     * Handle OIDC callback - exchange code for tokens\n     */\n    const handleOidcCallback = async (code: string, state: string | null) => {\n      // Cache the OIDC redirect target — used in both the MFA branch and the\n      // success branch, plus removed once at the end of the flow.\n      const oidcRedirect = sessionStorage.getItem(\"oidc_redirect\");\n      const isExternal = isExternalOidcCallback();\n\n      // Check if this is an external OIDC flow (Azure AD, Google, etc.)\n      if (isExternal) {\n        if (!state) {\n          throw new Error(\"State parameter is required for external OIDC flow\");\n        }\n\n        // Use the external OIDC handler\n        const result = await handleExternalOidcCallback(code, state);\n\n        if (!result.success) {\n          throw new Error(\n            result.error ||\n              \"Failed to authenticate with external OIDC provider\",\n          );\n        }\n\n        setStatus(\"success\");\n\n        // Redirect after brief success message using the redirect path from result\n        const redirectUrl = result.redirectPath || \"/dashboard\";\n        redirectTimerRef.current = setTimeout(() => {\n          navigate(redirectUrl, { replace: true });\n        }, 1500);\n        return;\n      }\n\n      // Internal OIDC flow (our auth service as provider)\n      // Validate state to prevent CSRF\n      if (state && !validateOidcState(state)) {\n        throw new Error(\n          \"Invalid state parameter. This may be a CSRF attack. Please try logging in again.\",\n        );\n      }\n\n      // Get client configuration from session storage\n      const clientId =\n        sessionStorage.getItem(\"oidc_client_id\") || \"default-client\";\n      const redirectUri = window.location.origin + \"/auth/sso/callback\";\n\n      // Exchange code for tokens\n      const result = await exchangeOidcCode(code, clientId, redirectUri);\n\n      if (!result.success) {\n        throw new Error(\n          result.error || \"Failed to exchange authorization code\",\n        );\n      }\n\n      // Check if MFA is required after OIDC authentication\n      if (result.requiresMFA && result.mfaChallengeId) {\n        // Store MFA challenge info for the verification page\n        sessionStorage.setItem(\"mfa_challenge_id\", result.mfaChallengeId);\n        sessionStorage.setItem(\"mfa_redirect\", oidcRedirect || \"/dashboard\");\n\n        // Clean up OIDC session data\n        sessionStorage.removeItem(\"oidc_redirect\");\n        sessionStorage.removeItem(\"oidc_client_id\");\n\n        // Redirect to MFA verification\n        navigate(\"/auth/mfa-verify\", { replace: true });\n        return;\n      }\n\n      setStatus(\"success\");\n\n      // Get redirect URL from state or session storage\n      const redirect = oidcRedirect || \"/dashboard\";\n      sessionStorage.removeItem(\"oidc_redirect\");\n      sessionStorage.removeItem(\"oidc_client_id\");\n\n      // Redirect after brief success message\n      redirectTimerRef.current = setTimeout(() => {\n        navigate(redirect, { replace: true });\n      }, 1500);\n    };\n\n    processCallback();\n    const timerRefCapture = redirectTimerRef;\n    return () => {\n      if (timerRefCapture.current) {\n        clearTimeout(timerRefCapture.current);\n        timerRefCapture.current = null;\n      }\n    };\n  }, [\n    searchParams,\n    navigate,\n    setAuthTokens,\n    setAuthenticated,\n    exchangeOidcCode,\n    validateOidcState,\n    isExternalOidcCallback,\n    handleExternalOidcCallback,\n  ]);\n\n  return (\n    <div className=\"min-h-screen flex items-center justify-center bg-bg-canvas p-4\">\n      <div className=\"w-full max-w-md\">\n        <div className=\"bg-bg-surface rounded-2xl shadow-xl p-8 text-center\">\n          {/* Logo */}\n          <div className=\"mb-6\">\n            <div className=\"auth-brand-badge mx-auto flex size-16 items-center justify-center rounded-xl\">\n              <svg\n                className=\"size-8 text-white\"\n                fill=\"none\"\n                viewBox=\"0 0 24 24\"\n                stroke=\"currentColor\"\n              >\n                <path\n                  strokeLinecap=\"round\"\n                  strokeLinejoin=\"round\"\n                  strokeWidth={2}\n                  d=\"M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z\"\n                />\n              </svg>\n            </div>\n          </div>\n\n          {/* Processing State */}\n          {status === \"processing\" && (\n            <>\n              <h1 className=\"text-2xl font-semibold text-text-primary mb-4\">\n                {tr(\"auth.ssoCallback.completing\", \"Completing Sign In\")}\n              </h1>\n              <p className=\"text-text-secondary mb-6\">\n                {callbackType === \"oidc\"\n                  ? tr(\n                      \"auth.ssoCallback.exchangingCode\",\n                      \"Exchanging authorization code for access tokens...\",\n                    )\n                  : callbackType === \"saml\"\n                    ? tr(\n                        \"auth.ssoCallback.validatingSaml\",\n                        \"Validating your SAML credentials...\",\n                      )\n                    : tr(\n                        \"auth.ssoCallback.validatingCreds\",\n                        \"Validating your credentials from your identity provider...\",\n                      )}\n              </p>\n              <div className=\"flex justify-center\">\n                <SpinnerIcon className=\"size-10 text-text-link animate-spin\" />\n              </div>\n            </>\n          )}\n\n          {/* Success State */}\n          {status === \"success\" && (\n            <>\n              <div className=\"size-16 mx-auto mb-4 rounded-full bg-status-success-bg-subtle flex items-center justify-center\">\n                <svg\n                  className=\"size-8 text-status-success-text\"\n                  fill=\"none\"\n                  viewBox=\"0 0 24 24\"\n                  stroke=\"currentColor\"\n                >\n                  <path\n                    strokeLinecap=\"round\"\n                    strokeLinejoin=\"round\"\n                    strokeWidth={2}\n                    d=\"M5 13l4 4L19 7\"\n                  />\n                </svg>\n              </div>\n              <h1 className=\"text-2xl font-semibold text-text-primary mb-4\">\n                {tr(\"auth.ssoCallback.success\", \"Sign In Successful\")}\n              </h1>\n              <p className=\"text-text-secondary mb-6\">\n                {callbackType === \"oidc\"\n                  ? tr(\n                      \"auth.ssoCallback.oidcComplete\",\n                      \"OIDC authentication complete. Redirecting...\",\n                    )\n                  : callbackType === \"saml\"\n                    ? tr(\n                        \"auth.ssoCallback.samlComplete\",\n                        \"SAML authentication complete. Redirecting...\",\n                      )\n                    : tr(\n                        \"auth.ssoCallback.authSuccess\",\n                        \"You have been authenticated successfully. Redirecting...\",\n                      )}\n              </p>\n              <div className=\"flex justify-center\">\n                <SpinnerIcon className=\"size-6 text-status-success-text animate-spin\" />\n              </div>\n            </>\n          )}\n\n          {/* Error State */}\n          {status === \"error\" && (\n            <>\n              <div className=\"size-16 mx-auto mb-4 rounded-full bg-status-error-bg-subtle flex items-center justify-center\">\n                <AlertIcon className=\"size-8 text-status-error-text\" />\n              </div>\n              <h1 className=\"text-2xl font-semibold text-text-primary mb-4\">\n                {tr(\"auth.ssoCallback.failed\", \"Sign In Failed\")}\n              </h1>\n              <p className=\"text-status-error-text mb-6 text-sm\">{error}</p>\n              <div className=\"space-y-3\">\n                <Button\n                  type=\"button\"\n                  onClick={() => navigate(\"/auth/sso/login\", { replace: true })}\n                  variant=\"default\"\n                  size=\"lg\"\n                  className=\"w-full font-semibold\"\n                >\n                  {tr(\"auth.ssoCallback.tryAgain\", \"Try Again\")}\n                </Button>\n                <button\n                  type=\"button\"\n                  onClick={() => navigate(\"/auth/login\", { replace: true })}\n                  className=\"w-full px-6 py-3 rounded-xl border border-border-default text-text-primary font-medium hover:bg-bg-sunken transition-colors\"\n                >\n                  {tr(\"auth.ssoCallback.backToLogin\", \"Back to Login\")}\n                </button>\n              </div>\n            </>\n          )}\n\n          {/* SSO Type Badge */}\n          {callbackType !== \"unknown\" && (\n            <div className=\"mt-6\">\n              <span\n                className={`inline-flex items-center px-3 py-1 rounded-full text-xs font-medium ${\n                  callbackType === \"oidc\"\n                    ? \"bg-accent-purple-subtle text-accent-purple\"\n                    : \"bg-status-info-bg-subtle text-text-linkHover\"\n                }`}\n              >\n                {callbackType === \"oidc\" ? \"OpenID Connect\" : \"SAML 2.0\"}\n              </span>\n            </div>\n          )}\n\n          {/* Help Text */}\n          <div className=\"mt-8 pt-6 border-t border-border-subtle\">\n            <p className=\"text-xs text-text-secondary\">\n              {tr(\n                \"auth.ssoCallback.helpText\",\n                \"Having trouble? Contact your organization's IT administrator for assistance with SSO login.\",\n              )}\n            </p>\n          </div>\n        </div>\n      </div>\n    </div>\n  );\n}\n"],"mappings":";;;;;;;;;AAcA,SAAgB,IAAkB;CAChC,IAAM,IAAK,GAAO,EAEZ,IAAW,GAAa,EACxB,CAAC,KAAgB,GAAiB,EAClC,IAAgB,GAAc,MAAU,EAAM,cAAc,EAC5D,IAAmB,GAAc,MAAU,EAAM,iBAAiB,EAClE,EACJ,qBACA,sBACA,2BACA,kCACE,GAAkB,EAEhB,CAAC,GAAO,KAAY,EAAwB,KAAK,EACjD,CAAC,GAAQ,KAAa,EAC1B,aACD,EACK,CAAC,GAAc,KAAmB,EACtC,UACD,EACK,IAAe,EAAO,GAAM,EAC5B,IAAmB,EAA6C,KAAK;AA8L3E,QA5LA,QAAgB;AAEd,MAAI,EAAa,QACf;AAEF,IAAa,UAAU;EAEvB,IAAM,IAAkB,YAAY;AAClC,OAAI;IAEF,IAAM,IAAa,EAAa,IAAI,QAAQ,EACtC,IACJ,EAAa,IAAI,UAAU,IAAI,EAAa,IAAI,oBAAoB;AAEtE,QAAI,EACF,OAAU,MACR,KAAgB,8BAA8B,IAC/C;IAIH,IAAM,IAAQ,EAAa,IAAI,QAAQ,EACjC,IAAO,EAAa,IAAI,OAAO,EAC/B,IAAQ,EAAa,IAAI,QAAQ;AAEvC,QAAI,EAGF,CADA,EAAgB,OAAO,EACvB,MAAM,EAAmB,EAAM;aACtB,EAGT,CADA,EAAgB,OAAO,EACvB,MAAM,EAAmB,GAAM,EAAM;QAErC,OAAU,MACR,iEACD;YAEI,GAAK;AAKZ,IAJA,QAAQ,MAAM,yBAAyB,EAAI,EAC3C,EACE,aAAe,QAAQ,EAAI,UAAU,iCACtC,EACD,EAAU,QAAQ;;KAShB,IAAqB,OAAO,MAAkB;GAClD,IAAM,IAAe,EAAa,IAAI,eAAe,EAC/C,IAAW,EAAa,IAAI,WAAW,EACvC,IAAc,EAAa,IAAI,cAAc,KAAK,QAClD,IAAiB,EAAa,IAAI,iBAAiB;AAGzD,OAAI,KAAe,GAAgB;AAQjC,IANA,eAAe,QAAQ,oBAAoB,EAAe,EAC1D,eAAe,QAAQ,qBAAqB,EAAM,EAClD,eAAe,QAAQ,uBAAuB,KAAgB,GAAG,EACjE,eAAe,QAAQ,gBAAgB,KAAY,aAAa,EAGhE,EAAS,oBAAoB,EAAE,SAAS,IAAM,CAAC;AAC/C;;AAUF,GANA,EAAc,GAAO,KAAgB,GAAG,EACxC,EAAiB,GAAK,EAEtB,EAAU,UAAU,EAGpB,EAAiB,UAAU,iBAAiB;AAE1C,MADoB,KAAY,cACV,EAAE,SAAS,IAAM,CAAC;MACvC,KAAK;KAMJ,IAAqB,OAAO,GAAc,MAAyB;GAGvE,IAAM,IAAe,eAAe,QAAQ,gBAAgB;AAI5D,OAHmB,GAAwB,EAG3B;AACd,QAAI,CAAC,EACH,OAAU,MAAM,qDAAqD;IAIvE,IAAM,IAAS,MAAM,EAA2B,GAAM,EAAM;AAE5D,QAAI,CAAC,EAAO,QACV,OAAU,MACR,EAAO,SACL,qDACH;AAGH,MAAU,UAAU;IAGpB,IAAM,IAAc,EAAO,gBAAgB;AAC3C,MAAiB,UAAU,iBAAiB;AAC1C,OAAS,GAAa,EAAE,SAAS,IAAM,CAAC;OACvC,KAAK;AACR;;AAKF,OAAI,KAAS,CAAC,EAAkB,EAAM,CACpC,OAAU,MACR,mFACD;GASH,IAAM,IAAS,MAAM,EAAiB,GAJpC,eAAe,QAAQ,iBAAiB,IAAI,kBAC1B,OAAO,SAAS,SAAS,qBAGqB;AAElE,OAAI,CAAC,EAAO,QACV,OAAU,MACR,EAAO,SAAS,wCACjB;AAIH,OAAI,EAAO,eAAe,EAAO,gBAAgB;AAU/C,IARA,eAAe,QAAQ,oBAAoB,EAAO,eAAe,EACjE,eAAe,QAAQ,gBAAgB,KAAgB,aAAa,EAGpE,eAAe,WAAW,gBAAgB,EAC1C,eAAe,WAAW,iBAAiB,EAG3C,EAAS,oBAAoB,EAAE,SAAS,IAAM,CAAC;AAC/C;;AAGF,KAAU,UAAU;GAGpB,IAAM,IAAW,KAAgB;AAKjC,GAJA,eAAe,WAAW,gBAAgB,EAC1C,eAAe,WAAW,iBAAiB,EAG3C,EAAiB,UAAU,iBAAiB;AAC1C,MAAS,GAAU,EAAE,SAAS,IAAM,CAAC;MACpC,KAAK;;AAGV,KAAiB;EACjB,IAAM,IAAkB;AACxB,eAAa;AACX,GAEE,EAAgB,aADhB,aAAa,EAAgB,QAAQ,EACX;;IAG7B;EACD;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CAAC,EAGA,kBAAC,OAAD;EAAK,WAAU;YACb,kBAAC,OAAD;GAAK,WAAU;aACb,kBAAC,OAAD;IAAK,WAAU;cAAf;KAEE,kBAAC,OAAD;MAAK,WAAU;gBACb,kBAAC,OAAD;OAAK,WAAU;iBACb,kBAAC,OAAD;QACE,WAAU;QACV,MAAK;QACL,SAAQ;QACR,QAAO;kBAEP,kBAAC,QAAD;SACE,eAAc;SACd,gBAAe;SACf,aAAa;SACb,GAAE;SACF,CAAA;QACE,CAAA;OACF,CAAA;MACF,CAAA;KAGL,MAAW,gBACV,kBAAA,GAAA,EAAA,UAAA;MACE,kBAAC,MAAD;OAAI,WAAU;iBACX,EAAG,+BAA+B,qBAAqB;OACrD,CAAA;MACL,kBAAC,KAAD;OAAG,WAAU;iBACV,MAAiB,SACd,EACE,mCACA,qDACD,GACD,MAAiB,SACf,EACE,mCACA,sCACD,GACD,EACE,oCACA,6DACD;OACL,CAAA;MACJ,kBAAC,OAAD;OAAK,WAAU;iBACb,kBAAC,GAAD,EAAa,WAAU,uCAAwC,CAAA;OAC3D,CAAA;MACL,EAAA,CAAA;KAIJ,MAAW,aACV,kBAAA,GAAA,EAAA,UAAA;MACE,kBAAC,OAAD;OAAK,WAAU;iBACb,kBAAC,OAAD;QACE,WAAU;QACV,MAAK;QACL,SAAQ;QACR,QAAO;kBAEP,kBAAC,QAAD;SACE,eAAc;SACd,gBAAe;SACf,aAAa;SACb,GAAE;SACF,CAAA;QACE,CAAA;OACF,CAAA;MACN,kBAAC,MAAD;OAAI,WAAU;iBACX,EAAG,4BAA4B,qBAAqB;OAClD,CAAA;MACL,kBAAC,KAAD;OAAG,WAAU;iBACV,MAAiB,SACd,EACE,iCACA,+CACD,GACD,MAAiB,SACf,EACE,iCACA,+CACD,GACD,EACE,gCACA,2DACD;OACL,CAAA;MACJ,kBAAC,OAAD;OAAK,WAAU;iBACb,kBAAC,GAAD,EAAa,WAAU,gDAAiD,CAAA;OACpE,CAAA;MACL,EAAA,CAAA;KAIJ,MAAW,WACV,kBAAA,GAAA,EAAA,UAAA;MACE,kBAAC,OAAD;OAAK,WAAU;iBACb,kBAAC,GAAD,EAAW,WAAU,iCAAkC,CAAA;OACnD,CAAA;MACN,kBAAC,MAAD;OAAI,WAAU;iBACX,EAAG,2BAA2B,iBAAiB;OAC7C,CAAA;MACL,kBAAC,KAAD;OAAG,WAAU;iBAAuC;OAAU,CAAA;MAC9D,kBAAC,OAAD;OAAK,WAAU;iBAAf,CACE,kBAAC,GAAD;QACE,MAAK;QACL,eAAe,EAAS,mBAAmB,EAAE,SAAS,IAAM,CAAC;QAC7D,SAAQ;QACR,MAAK;QACL,WAAU;kBAET,EAAG,6BAA6B,YAAY;QACtC,CAAA,EACT,kBAAC,UAAD;QACE,MAAK;QACL,eAAe,EAAS,eAAe,EAAE,SAAS,IAAM,CAAC;QACzD,WAAU;kBAET,EAAG,gCAAgC,gBAAgB;QAC7C,CAAA,CACL;;MACL,EAAA,CAAA;KAIJ,MAAiB,aAChB,kBAAC,OAAD;MAAK,WAAU;gBACb,kBAAC,QAAD;OACE,WAAW,uEACT,MAAiB,SACb,+CACA;iBAGL,MAAiB,SAAS,mBAAmB;OACzC,CAAA;MACH,CAAA;KAIR,kBAAC,OAAD;MAAK,WAAU;gBACb,kBAAC,KAAD;OAAG,WAAU;iBACV,EACC,6BACA,8FACD;OACC,CAAA;MACA,CAAA;KACF;;GACF,CAAA;EACF,CAAA"}
+{"version":3,"file":"SsoCallbackPage.js","names":[],"sources":["../../../src/auth/pages/SsoCallbackPage.tsx"],"sourcesContent":["import { useEffect, useState, useRef } from \"react\";\nimport { useTr } from \"../../shared/hooks/useTr\";\nimport { useNavigate, useSearchParams } from \"react-router\";\nimport { useAuthStore } from \"../store/authStore\";\nimport { useSsoOperations } from \"../hooks/useSsoOperations\";\nimport { Button } from \"@burdenoff/fe-libs/button\";\nimport { SpinnerIcon, AlertIcon } from \"../components/AuthIcons\";\n\n/**\n * SSO Callback Page\n * Handles redirects from:\n * - SAML ACS server (with token/refreshToken in query params)\n * - OIDC Authorization Server (with code/state in query params)\n */\nexport function SsoCallbackPage() {\n  const tr = useTr();\n\n  const navigate = useNavigate();\n  const [searchParams] = useSearchParams();\n  const setAuthTokens = useAuthStore((state) => state.setAuthTokens);\n  const setAuthenticated = useAuthStore((state) => state.setAuthenticated);\n  const {\n    exchangeOidcCode,\n    validateOidcState,\n    isExternalOidcCallback,\n    handleExternalOidcCallback,\n  } = useSsoOperations();\n\n  const [error, setError] = useState<string | null>(null);\n  const [status, setStatus] = useState<\"processing\" | \"success\" | \"error\">(\n    \"processing\",\n  );\n  const [callbackType, setCallbackType] = useState<\"saml\" | \"oidc\" | \"unknown\">(\n    \"unknown\",\n  );\n  const processedRef = useRef(false);\n  const redirectTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);\n\n  useEffect(() => {\n    // Prevent double execution in React StrictMode\n    if (processedRef.current) {\n      return;\n    }\n    processedRef.current = true;\n\n    const processCallback = async () => {\n      try {\n        // Check for error from either SSO provider\n        const errorParam = searchParams.get(\"error\");\n        const errorMessage =\n          searchParams.get(\"message\") || searchParams.get(\"error_description\");\n\n        if (errorParam) {\n          throw new Error(\n            errorMessage || `SSO authentication failed: ${errorParam}`,\n          );\n        }\n\n        // Detect callback type based on query parameters\n        const token = searchParams.get(\"token\");\n        const code = searchParams.get(\"code\");\n        const state = searchParams.get(\"state\");\n\n        if (token) {\n          // SAML callback - token already exchanged by ACS server\n          setCallbackType(\"saml\");\n          await handleSamlCallback(token);\n        } else if (code) {\n          // OIDC callback - need to exchange code for tokens\n          setCallbackType(\"oidc\");\n          await handleOidcCallback(code, state);\n        } else {\n          throw new Error(\n            \"Invalid SSO callback. No token or authorization code received.\",\n          );\n        }\n      } catch (err) {\n        console.error(\"[SSO Callback] Error:\", err);\n        setError(\n          err instanceof Error ? err.message : \"Failed to process SSO response\",\n        );\n        setStatus(\"error\");\n      }\n    };\n\n    /**\n     * Handle SAML callback from ACS server\n     * Token is already exchanged, just store and redirect\n     * Also handles MFA if required\n     */\n    const handleSamlCallback = async (token: string) => {\n      const refreshToken = searchParams.get(\"refreshToken\");\n      const redirect = searchParams.get(\"redirect\");\n      const requiresMFA = searchParams.get(\"requiresMFA\") === \"true\";\n      const mfaChallengeId = searchParams.get(\"mfaChallengeId\");\n\n      // Check if MFA is required\n      if (requiresMFA && mfaChallengeId) {\n        // Store partial auth state and MFA info\n        sessionStorage.setItem(\"mfa_challenge_id\", mfaChallengeId);\n        sessionStorage.setItem(\"mfa_pending_token\", token);\n        sessionStorage.setItem(\"mfa_pending_refresh\", refreshToken || \"\");\n        sessionStorage.setItem(\"mfa_redirect\", redirect || \"/dashboard\");\n\n        // Redirect to MFA verification\n        navigate(\"/auth/mfa-verify\", { replace: true });\n        return;\n      }\n\n      // Store tokens\n      setAuthTokens(token, refreshToken || \"\");\n      setAuthenticated(true);\n\n      setStatus(\"success\");\n\n      // Redirect to the specified URL or default to dashboard\n      redirectTimerRef.current = setTimeout(() => {\n        const redirectUrl = redirect || \"/dashboard\";\n        navigate(redirectUrl, { replace: true });\n      }, 1500);\n    };\n\n    /**\n     * Handle OIDC callback - exchange code for tokens\n     */\n    const handleOidcCallback = async (code: string, state: string | null) => {\n      // Cache the OIDC redirect target — used in both the MFA branch and the\n      // success branch, plus removed once at the end of the flow.\n      const oidcRedirect = sessionStorage.getItem(\"oidc_redirect\");\n      const isExternal = isExternalOidcCallback();\n\n      // Check if this is an external OIDC flow (Azure AD, Google, etc.)\n      if (isExternal) {\n        if (!state) {\n          throw new Error(\"State parameter is required for external OIDC flow\");\n        }\n\n        // Use the external OIDC handler\n        const result = await handleExternalOidcCallback(code, state);\n\n        if (!result.success) {\n          throw new Error(\n            result.error ||\n              \"Failed to authenticate with external OIDC provider\",\n          );\n        }\n\n        setStatus(\"success\");\n\n        // Redirect after brief success message using the redirect path from result\n        const redirectUrl = result.redirectPath || \"/dashboard\";\n        redirectTimerRef.current = setTimeout(() => {\n          navigate(redirectUrl, { replace: true });\n        }, 1500);\n        return;\n      }\n\n      // Internal OIDC flow (our auth service as provider)\n      // Validate state to prevent CSRF\n      if (state && !validateOidcState(state)) {\n        throw new Error(\n          \"Invalid state parameter. This may be a CSRF attack. Please try logging in again.\",\n        );\n      }\n\n      // Get client configuration from session storage\n      const clientId =\n        sessionStorage.getItem(\"oidc_client_id\") || \"default-client\";\n      const redirectUri = window.location.origin + \"/auth/sso/callback\";\n\n      // Exchange code for tokens\n      const result = await exchangeOidcCode(code, clientId, redirectUri);\n\n      if (!result.success) {\n        throw new Error(\n          result.error || \"Failed to exchange authorization code\",\n        );\n      }\n\n      // Check if MFA is required after OIDC authentication\n      if (result.requiresMFA && result.mfaChallengeId) {\n        // Store MFA challenge info for the verification page\n        sessionStorage.setItem(\"mfa_challenge_id\", result.mfaChallengeId);\n        sessionStorage.setItem(\"mfa_redirect\", oidcRedirect || \"/dashboard\");\n\n        // Clean up OIDC session data\n        sessionStorage.removeItem(\"oidc_redirect\");\n        sessionStorage.removeItem(\"oidc_client_id\");\n\n        // Redirect to MFA verification\n        navigate(\"/auth/mfa-verify\", { replace: true });\n        return;\n      }\n\n      setStatus(\"success\");\n\n      // Get redirect URL from state or session storage\n      const redirect = oidcRedirect || \"/dashboard\";\n      sessionStorage.removeItem(\"oidc_redirect\");\n      sessionStorage.removeItem(\"oidc_client_id\");\n\n      // Redirect after brief success message\n      redirectTimerRef.current = setTimeout(() => {\n        navigate(redirect, { replace: true });\n      }, 1500);\n    };\n\n    processCallback();\n    const timerRefCapture = redirectTimerRef;\n    return () => {\n      if (timerRefCapture.current) {\n        clearTimeout(timerRefCapture.current);\n        timerRefCapture.current = null;\n      }\n    };\n  }, [\n    searchParams,\n    navigate,\n    setAuthTokens,\n    setAuthenticated,\n    exchangeOidcCode,\n    validateOidcState,\n    isExternalOidcCallback,\n    handleExternalOidcCallback,\n  ]);\n\n  return (\n    <div className=\"min-h-screen flex items-center justify-center bg-bg-canvas p-4\">\n      <div className=\"w-full max-w-md\">\n        <div className=\"bg-bg-surface rounded-2xl shadow-xl p-8 text-center\">\n          {/* Logo */}\n          <div className=\"mb-6\">\n            <div className=\"auth-brand-badge mx-auto flex size-16 items-center justify-center rounded-xl\">\n              <svg\n                className=\"size-8 text-white\"\n                fill=\"none\"\n                viewBox=\"0 0 24 24\"\n                stroke=\"currentColor\"\n              >\n                <path\n                  strokeLinecap=\"round\"\n                  strokeLinejoin=\"round\"\n                  strokeWidth={2}\n                  d=\"M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z\"\n                />\n              </svg>\n            </div>\n          </div>\n\n          {/* Processing State */}\n          {status === \"processing\" && (\n            <>\n              <h1 className=\"text-2xl font-semibold text-text-primary mb-4\">\n                {tr(\"auth.ssoCallback.completing\", \"Completing Sign In\")}\n              </h1>\n              <p className=\"text-text-secondary mb-6\">\n                {callbackType === \"oidc\"\n                  ? tr(\n                      \"auth.ssoCallback.exchangingCode\",\n                      \"Exchanging authorization code for access tokens...\",\n                    )\n                  : callbackType === \"saml\"\n                    ? tr(\n                        \"auth.ssoCallback.validatingSaml\",\n                        \"Validating your SAML credentials...\",\n                      )\n                    : tr(\n                        \"auth.ssoCallback.validatingCreds\",\n                        \"Validating your credentials from your identity provider...\",\n                      )}\n              </p>\n              <div className=\"flex justify-center\">\n                <SpinnerIcon className=\"size-10 text-text-link animate-spin\" />\n              </div>\n            </>\n          )}\n\n          {/* Success State */}\n          {status === \"success\" && (\n            <>\n              <div className=\"size-16 mx-auto mb-4 rounded-full bg-status-success-bg-subtle flex items-center justify-center\">\n                <svg\n                  className=\"size-8 text-status-success-text\"\n                  fill=\"none\"\n                  viewBox=\"0 0 24 24\"\n                  stroke=\"currentColor\"\n                >\n                  <path\n                    strokeLinecap=\"round\"\n                    strokeLinejoin=\"round\"\n                    strokeWidth={2}\n                    d=\"M5 13l4 4L19 7\"\n                  />\n                </svg>\n              </div>\n              <h1 className=\"text-2xl font-semibold text-text-primary mb-4\">\n                {tr(\"auth.ssoCallback.success\", \"Sign In Successful\")}\n              </h1>\n              <p className=\"text-text-secondary mb-6\">\n                {callbackType === \"oidc\"\n                  ? tr(\n                      \"auth.ssoCallback.oidcComplete\",\n                      \"OIDC authentication complete. Redirecting...\",\n                    )\n                  : callbackType === \"saml\"\n                    ? tr(\n                        \"auth.ssoCallback.samlComplete\",\n                        \"SAML authentication complete. Redirecting...\",\n                      )\n                    : tr(\n                        \"auth.ssoCallback.authSuccess\",\n                        \"You have been authenticated successfully. Redirecting...\",\n                      )}\n              </p>\n              <div className=\"flex justify-center\">\n                <SpinnerIcon className=\"size-6 text-status-success-text animate-spin\" />\n              </div>\n            </>\n          )}\n\n          {/* Error State */}\n          {status === \"error\" && (\n            <>\n              <div className=\"size-16 mx-auto mb-4 rounded-full bg-status-error-bg-subtle flex items-center justify-center\">\n                <AlertIcon className=\"size-8 text-status-error-text\" />\n              </div>\n              <h1 className=\"text-2xl font-semibold text-text-primary mb-4\">\n                {tr(\"auth.ssoCallback.failed\", \"Sign In Failed\")}\n              </h1>\n              <p className=\"text-status-error-text mb-6 text-sm\">{error}</p>\n              <div className=\"space-y-3\">\n                <Button\n                  type=\"button\"\n                  onClick={() => navigate(\"/auth/sso/login\", { replace: true })}\n                  variant=\"default\"\n                  size=\"lg\"\n                  className=\"w-full font-semibold\"\n                >\n                  {tr(\"auth.ssoCallback.tryAgain\", \"Try Again\")}\n                </Button>\n                <button\n                  type=\"button\"\n                  onClick={() => navigate(\"/auth/login\", { replace: true })}\n                  className=\"w-full px-6 py-3 rounded-xl border border-border-default text-text-primary font-medium hover:bg-bg-sunken transition-colors\"\n                >\n                  {tr(\"auth.ssoCallback.backToLogin\", \"Back to Login\")}\n                </button>\n              </div>\n            </>\n          )}\n\n          {/* SSO Type Badge */}\n          {callbackType !== \"unknown\" && (\n            <div className=\"mt-6\">\n              <span\n                className={`inline-flex items-center px-3 py-1 rounded-full text-xs font-medium ${\n                  callbackType === \"oidc\"\n                    ? \"bg-accent-purple-subtle text-accent-purple\"\n                    : \"bg-status-info-bg-subtle text-text-linkHover\"\n                }`}\n              >\n                {callbackType === \"oidc\" ? \"OpenID Connect\" : \"SAML 2.0\"}\n              </span>\n            </div>\n          )}\n\n          {/* Help Text */}\n          <div className=\"mt-8 pt-6 border-t border-border-subtle\">\n            <p className=\"text-xs text-text-secondary\">\n              {tr(\n                \"auth.ssoCallback.helpText\",\n                \"Having trouble? Contact your organization's IT administrator for assistance with SSO login.\",\n              )}\n            </p>\n          </div>\n        </div>\n      </div>\n    </div>\n  );\n}\n"],"mappings":";;;;;;;;;AAcA,SAAgB,IAAkB;CAChC,IAAM,IAAK,EAAM,GAEX,IAAW,EAAY,GACvB,CAAC,KAAgB,EAAgB,GACjC,IAAgB,GAAc,MAAU,EAAM,aAAa,GAC3D,IAAmB,GAAc,MAAU,EAAM,gBAAgB,GACjE,EACJ,qBACA,sBACA,2BACA,kCACE,EAAiB,GAEf,CAAC,GAAO,KAAY,EAAwB,IAAI,GAChD,CAAC,GAAQ,KAAa,EAC1B,YACF,GACM,CAAC,GAAc,KAAmB,EACtC,SACF,GACM,IAAe,EAAO,EAAK,GAC3B,IAAmB,EAA6C,IAAI;CA8L1E,OA5LA,QAAgB;EAEd,IAAI,EAAa,SACf;EAEF,EAAa,UAAU;EAEvB,IAAM,IAAkB,YAAY;GAClC,IAAI;IAEF,IAAM,IAAa,EAAa,IAAI,OAAO,GACrC,IACJ,EAAa,IAAI,SAAS,KAAK,EAAa,IAAI,mBAAmB;IAErE,IAAI,GACF,MAAU,MACR,KAAgB,8BAA8B,GAChD;IAIF,IAAM,IAAQ,EAAa,IAAI,OAAO,GAChC,IAAO,EAAa,IAAI,MAAM,GAC9B,IAAQ,EAAa,IAAI,OAAO;IAEtC,IAAI,GAGF,AADA,EAAgB,MAAM,GACtB,MAAM,EAAmB,CAAK;SACzB,IAAI,GAGT,AADA,EAAgB,MAAM,GACtB,MAAM,EAAmB,GAAM,CAAK;SAEpC,MAAU,MACR,gEACF;GAEJ,SAAS,GAAK;IAKZ,AAJA,QAAQ,MAAM,yBAAyB,CAAG,GAC1C,EACE,aAAe,QAAQ,EAAI,UAAU,gCACvC,GACA,EAAU,OAAO;GACnB;EACF,GAOM,IAAqB,OAAO,MAAkB;GAClD,IAAM,IAAe,EAAa,IAAI,cAAc,GAC9C,IAAW,EAAa,IAAI,UAAU,GACtC,IAAc,EAAa,IAAI,aAAa,MAAM,QAClD,IAAiB,EAAa,IAAI,gBAAgB;GAGxD,IAAI,KAAe,GAAgB;IAQjC,AANA,eAAe,QAAQ,oBAAoB,CAAc,GACzD,eAAe,QAAQ,qBAAqB,CAAK,GACjD,eAAe,QAAQ,uBAAuB,KAAgB,EAAE,GAChE,eAAe,QAAQ,gBAAgB,KAAY,YAAY,GAG/D,EAAS,oBAAoB,EAAE,SAAS,GAAK,CAAC;IAC9C;GACF;GASA,AANA,EAAc,GAAO,KAAgB,EAAE,GACvC,EAAiB,EAAI,GAErB,EAAU,SAAS,GAGnB,EAAiB,UAAU,iBAAiB;IAE1C,EADoB,KAAY,cACV,EAAE,SAAS,GAAK,CAAC;GACzC,GAAG,IAAI;EACT,GAKM,IAAqB,OAAO,GAAc,MAAyB;GAGvE,IAAM,IAAe,eAAe,QAAQ,eAAe;GAI3D,IAHmB,EAGf,GAAY;IACd,IAAI,CAAC,GACH,MAAU,MAAM,oDAAoD;IAItE,IAAM,IAAS,MAAM,EAA2B,GAAM,CAAK;IAE3D,IAAI,CAAC,EAAO,SACV,MAAU,MACR,EAAO,SACL,oDACJ;IAGF,EAAU,SAAS;IAGnB,IAAM,IAAc,EAAO,gBAAgB;IAC3C,EAAiB,UAAU,iBAAiB;KAC1C,EAAS,GAAa,EAAE,SAAS,GAAK,CAAC;IACzC,GAAG,IAAI;IACP;GACF;GAIA,IAAI,KAAS,CAAC,EAAkB,CAAK,GACnC,MAAU,MACR,kFACF;GASF,IAAM,IAAS,MAAM,EAAiB,GAJpC,eAAe,QAAQ,gBAAgB,KAAK,kBAC1B,OAAO,SAAS,SAAS,oBAGoB;GAEjE,IAAI,CAAC,EAAO,SACV,MAAU,MACR,EAAO,SAAS,uCAClB;GAIF,IAAI,EAAO,eAAe,EAAO,gBAAgB;IAU/C,AARA,eAAe,QAAQ,oBAAoB,EAAO,cAAc,GAChE,eAAe,QAAQ,gBAAgB,KAAgB,YAAY,GAGnE,eAAe,WAAW,eAAe,GACzC,eAAe,WAAW,gBAAgB,GAG1C,EAAS,oBAAoB,EAAE,SAAS,GAAK,CAAC;IAC9C;GACF;GAEA,EAAU,SAAS;GAGnB,IAAM,IAAW,KAAgB;GAKjC,AAJA,eAAe,WAAW,eAAe,GACzC,eAAe,WAAW,gBAAgB,GAG1C,EAAiB,UAAU,iBAAiB;IAC1C,EAAS,GAAU,EAAE,SAAS,GAAK,CAAC;GACtC,GAAG,IAAI;EACT;EAEA,EAAgB;EAChB,IAAM,IAAkB;EACxB,aAAa;GACX,AAEE,EAAgB,aADhB,aAAa,EAAgB,OAAO,GACV;EAE9B;CACF,GAAG;EACD;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF,CAAC,GAGC,kBAAC,OAAD;EAAK,WAAU;YACb,kBAAC,OAAD;GAAK,WAAU;aACb,kBAAC,OAAD;IAAK,WAAU;cAAf;KAEE,kBAAC,OAAD;MAAK,WAAU;gBACb,kBAAC,OAAD;OAAK,WAAU;iBACb,kBAAC,OAAD;QACE,WAAU;QACV,MAAK;QACL,SAAQ;QACR,QAAO;kBAEP,kBAAC,QAAD;SACE,eAAc;SACd,gBAAe;SACf,aAAa;SACb,GAAE;QACH,CAAA;OACE,CAAA;MACF,CAAA;KACF,CAAA;KAGJ,MAAW,gBACV,kBAAA,GAAA,EAAA,UAAA;MACE,kBAAC,MAAD;OAAI,WAAU;iBACX,EAAG,+BAA+B,oBAAoB;MACrD,CAAA;MACJ,kBAAC,KAAD;OAAG,WAAU;iBACV,MAAiB,SACd,EACE,mCACA,oDACF,IACA,MAAiB,SACf,EACE,mCACA,qCACF,IACA,EACE,oCACA,4DACF;MACL,CAAA;MACH,kBAAC,OAAD;OAAK,WAAU;iBACb,kBAAC,GAAD,EAAa,WAAU,sCAAuC,CAAA;MAC3D,CAAA;KACL,EAAA,CAAA;KAIH,MAAW,aACV,kBAAA,GAAA,EAAA,UAAA;MACE,kBAAC,OAAD;OAAK,WAAU;iBACb,kBAAC,OAAD;QACE,WAAU;QACV,MAAK;QACL,SAAQ;QACR,QAAO;kBAEP,kBAAC,QAAD;SACE,eAAc;SACd,gBAAe;SACf,aAAa;SACb,GAAE;QACH,CAAA;OACE,CAAA;MACF,CAAA;MACL,kBAAC,MAAD;OAAI,WAAU;iBACX,EAAG,4BAA4B,oBAAoB;MAClD,CAAA;MACJ,kBAAC,KAAD;OAAG,WAAU;iBACV,MAAiB,SACd,EACE,iCACA,8CACF,IACA,MAAiB,SACf,EACE,iCACA,8CACF,IACA,EACE,gCACA,0DACF;MACL,CAAA;MACH,kBAAC,OAAD;OAAK,WAAU;iBACb,kBAAC,GAAD,EAAa,WAAU,+CAAgD,CAAA;MACpE,CAAA;KACL,EAAA,CAAA;KAIH,MAAW,WACV,kBAAA,GAAA,EAAA,UAAA;MACE,kBAAC,OAAD;OAAK,WAAU;iBACb,kBAAC,GAAD,EAAW,WAAU,gCAAiC,CAAA;MACnD,CAAA;MACL,kBAAC,MAAD;OAAI,WAAU;iBACX,EAAG,2BAA2B,gBAAgB;MAC7C,CAAA;MACJ,kBAAC,KAAD;OAAG,WAAU;iBAAuC;MAAS,CAAA;MAC7D,kBAAC,OAAD;OAAK,WAAU;iBAAf,CACE,kBAAC,GAAD;QACE,MAAK;QACL,eAAe,EAAS,mBAAmB,EAAE,SAAS,GAAK,CAAC;QAC5D,SAAQ;QACR,MAAK;QACL,WAAU;kBAET,EAAG,6BAA6B,WAAW;OACtC,CAAA,GACR,kBAAC,UAAD;QACE,MAAK;QACL,eAAe,EAAS,eAAe,EAAE,SAAS,GAAK,CAAC;QACxD,WAAU;kBAET,EAAG,gCAAgC,eAAe;OAC7C,CAAA,CACL;;KACL,EAAA,CAAA;KAIH,MAAiB,aAChB,kBAAC,OAAD;MAAK,WAAU;gBACb,kBAAC,QAAD;OACE,WAAW,uEACT,MAAiB,SACb,+CACA;iBAGL,MAAiB,SAAS,mBAAmB;MAC1C,CAAA;KACH,CAAA;KAIP,kBAAC,OAAD;MAAK,WAAU;gBACb,kBAAC,KAAD;OAAG,WAAU;iBACV,EACC,6BACA,6FACF;MACC,CAAA;KACA,CAAA;IACF;;EACF,CAAA;CACF,CAAA;AAET"}

package/dist/auth/pages/SsoConfigPage.d.ts

@@ -8,5 +8,5 @@ interface SsoConfigPageProps {
  * In admin-app context, bypassEnterprisePlanGate=true and tenant/org/workspace
  * scoping is read from URL search params (?tenant=&org=&workspace=).
  */
-export declare function SsoConfigPage({ bypassEnterprisePlanGate, }: SsoConfigPageProps): import("react").JSX.Element;
+export declare function SsoConfigPage({ bypassEnterprisePlanGate, }: SsoConfigPageProps): import('react').JSX.Element;
 export {};