@camstack/addon-admin-ui 1.2.115 → 1.2.118

package/dist/assets/Identity-DeElzcC7.js

@@ -1 +0,0 @@
-import{Q as e,S as t,W as n,a as r,b as i,o as a,q as o,x as s}from"./_virtual_mf___mfe_internal__admin_ui_host__loadShare___mf_0_tanstack_mf_1_react_mf_2_query__loadShare__.js-DhP-Lgiq.js";import{Z as c}from"./player-overlays-BVWg5sq2.js";import{As as l,Cs as u,Ds as d,Es as f,Hr as p,Ms as m,Ns as h,On as g,Os as _,Rt as v,S as y,Ss as b,Ts as x,bs as S,f as C,js as w,kn as T,ks as E,p as D,tt as ee,un as O,ws as k,x as A,xs as te,ys as j}from"./src-B0h87dKs.js";import{c as M,d as N,l as P,u as F}from"./src-CXH7iEed.js";import{t as I}from"./circle-check-big-BFWc5wJh.js";import{t as ne}from"./copy-BML9XMSw.js";import{t as re}from"./key-round-C3b-L-A3.js";import{t as ie}from"./pencil-C6wR4nZ6.js";import{t as ae}from"./plus-QSG2gY1B.js";import{C as L,E as R,I as oe,K as z,R as se,d as B,k as ce,l as V,n as H,o as U,r as W,w as G,z as le}from"./index-Z-wl-d5v.js";import{t as K}from"./AdminPage-CCD07UMs.js";import{t as ue}from"./AdminTabs-BJEXfjyu.js";import{t as de}from"./AddonCollectionPage-CFaF5Vw9.js";import{t as fe}from"./addon-display-names-DvSEQty-.js";var pe=z(`book-open`,[[`path`,{d:`M12 7v14`,key:`1akyts`}],[`path`,{d:`M3 18a1 1 0 0 1-1-1V4a1 1 0 0 1 1-1h5a4 4 0 0 1 4 4 4 4 0 0 1 4-4h5a1 1 0 0 1 1 1v13a1 1 0 0 1-1 1h-6a3 3 0 0 0-3 3 3 3 0 0 0-3-3z`,key:`ruj8y`}]]),me=z(`key-square`,[[`path`,{d:`M12.4 2.7a2.5 2.5 0 0 1 3.4 0l5.5 5.5a2.5 2.5 0 0 1 0 3.4l-3.7 3.7a2.5 2.5 0 0 1-3.4 0L8.7 9.8a2.5 2.5 0 0 1 0-3.4z`,key:`165ttr`}],[`path`,{d:`m14 7 3 3`,key:`1r5n42`}],[`path`,{d:`m9.4 10.6-6.814 6.814A2 2 0 0 0 2 18.828V21a1 1 0 0 0 1 1h3a1 1 0 0 0 1-1v-1a1 1 0 0 1 1-1h1a1 1 0 0 0 1-1v-1a1 1 0 0 1 1-1h.172a2 2 0 0 0 1.414-.586l.814-.814`,key:`1ubxi2`}]]),he=z(`key`,[[`path`,{d:`m15.5 7.5 2.3 2.3a1 1 0 0 0 1.4 0l2.1-2.1a1 1 0 0 0 0-1.4L19 4`,key:`g0fldk`}],[`path`,{d:`m21 2-9.6 9.6`,key:`1j0ho8`}],[`circle`,{cx:`7.5`,cy:`15.5`,r:`5.5`,key:`yqb3hr`}]]),ge=z(`link`,[[`path`,{d:`M10 13a5 5 0 0 0 7.54.54l3-3a5 5 0 0 0-7.07-7.07l-1.72 1.71`,key:`1cjeqo`}],[`path`,{d:`M14 11a5 5 0 0 0-7.54-.54l-3 3a5 5 0 0 0 7.07 7.07l1.71-1.71`,key:`19qd67`}]]),_e=z(`shield-alert`,[[`path`,{d:`M20 13c0 5-3.5 7.5-7.66 8.95a1 1 0 0 1-.67-.01C7.5 20.5 4 18 4 13V6a1 1 0 0 1 1-1c2 0 4.5-1.2 6.24-2.72a1.17 1.17 0 0 1 1.52 0C14.51 3.81 17 5 19 5a1 1 0 0 1 1 1z`,key:`oel41y`}],[`path`,{d:`M12 8v4`,key:`1got3b`}],[`path`,{d:`M12 16h.01`,key:`1drbdi`}]]),ve=z(`users`,[[`path`,{d:`M16 21v-2a4 4 0 0 0-4-4H6a4 4 0 0 0-4 4v2`,key:`1yyitq`}],[`path`,{d:`M16 3.128a4 4 0 0 1 0 7.744`,key:`16gr8j`}],[`path`,{d:`M22 21v-2a4 4 0 0 0-3-3.87`,key:`kshegd`}],[`circle`,{cx:`9`,cy:`7`,r:`4`,key:`nufk8`}]]);e();function ye({userId:e,username:n,onClose:r}){let o=a(),c=O(),l=u({userId:e}),d=l.data,f=()=>o.invalidateQueries({queryKey:[[`userManagement`,`getTotpStatus`]]}),p=b({onSuccess:()=>{f(),r()}}),m=l.isLoading?`loading`:d?.enabled?`enrolled`:`not_enrolled`;return s(`div`,{className:`fixed inset-0 z-50 flex items-center justify-center bg-black/40 backdrop-blur-sm p-4`,children:t(`div`,{className:`w-full max-w-md rounded-xl border border-border bg-surface shadow-2xl overflow-hidden`,children:[t(`div`,{className:`flex items-center justify-between px-4 py-3 border-b border-border`,children:[t(`div`,{className:`flex items-center gap-2`,children:[s(V,{className:`h-4 w-4 text-primary`}),t(`div`,{children:[s(`div`,{className:`text-sm font-medium text-foreground`,children:`Two-factor authentication`}),t(`div`,{className:`text-[11px] text-foreground-subtle`,children:[`User: `,s(`span`,{className:`font-mono`,children:n})]})]})]}),s(`button`,{onClick:r,className:`p-1 rounded hover:bg-foreground-subtle/10 text-foreground-subtle`,children:s(W,{className:`h-4 w-4`})})]}),t(`div`,{className:`p-4 space-y-4`,children:[m===`loading`&&t(`div`,{className:`flex items-center gap-2 text-xs text-foreground-subtle`,children:[s(L,{className:`h-3.5 w-3.5 animate-spin`}),`Checking status…`]}),m===`not_enrolled`&&t(`div`,{className:`rounded-md border border-border bg-surface-hover/30 px-3 py-2.5 flex items-start gap-2.5 text-xs text-foreground-subtle`,children:[s(G,{className:`h-4 w-4 mt-0.5 shrink-0`}),t(`div`,{children:[s(`div`,{className:`font-medium text-foreground`,children:`2FA not enrolled`}),s(`p`,{className:`mt-0.5`,children:`Only the user themselves can enable 2FA, from their own profile page.`})]})]}),m===`enrolled`&&d&&t(i,{children:[t(`div`,{className:`rounded-md border border-emerald-500/30 bg-emerald-500/5 px-3 py-2.5 flex items-start gap-2.5`,children:[s(I,{className:`h-4 w-4 mt-0.5 text-emerald-500 shrink-0`}),t(`div`,{className:`text-xs text-foreground space-y-0.5`,children:[s(`div`,{className:`font-medium`,children:`2FA is active`}),t(`div`,{className:`text-foreground-subtle`,children:[`Enrolled on`,` `,d.confirmedAt?new Date(d.confirmedAt).toLocaleString():`—`]})]})]}),s(`div`,{className:`text-[11px] text-foreground-subtle`,children:`Removing here clears the server-side secret. Use this only when the user has lost access — they'll have to re-enroll from their profile page afterwards.`}),t(`div`,{className:`flex justify-end gap-2`,children:[s(v,{onClick:r,variant:`secondary`,children:`Close`}),t(`button`,{onClick:async()=>{await c({title:`Remove 2FA`,message:`Remove two-factor authentication for "${n}"? They'll be able to log in with just their password until they re-enroll from their own profile page.`,confirmLabel:`Remove`,variant:`danger`})&&p.mutate({userId:e})},disabled:p.isPending,className:`rounded bg-danger px-3 py-1.5 text-xs font-medium text-white hover:bg-danger/90 disabled:opacity-50 inline-flex items-center gap-1`,children:[p.isPending?s(L,{className:`h-3 w-3 animate-spin`}):s(W,{className:`h-3 w-3`}),`Remove 2FA`]})]})]})]})]})})}function q({icon:e,label:n,count:r,all:i,total:a}){return t(`div`,{className:`flex items-center gap-2 text-[11px]`,children:[s(e,{className:`h-3 w-3 shrink-0 text-foreground-subtle`}),s(`span`,{className:`min-w-0 flex-1 text-foreground-subtle`,children:n}),s(`span`,{className:r===0?`text-foreground-subtle`:`font-medium text-foreground`,children:r===0?`none`:i?`all ${a}`:`${r} of ${a}`})]})}function be({scopes:e,isAdmin:n,invalidReason:a}){let o=c(),l=r({queryKey:[`auth`,`previewScope`,e,n],enabled:a===null,queryFn:()=>o.trpcClient.auth.previewScope.query({scopes:[...e],isAdmin:n})}),{data:u}=p({projection:`slim`}),d=u?.length??0;if(a!==null)return s(`div`,{className:`rounded-lg border border-border bg-surface p-3`,children:t(`p`,{className:`flex items-center gap-1.5 text-[11px] text-warning`,children:[s(_e,{className:`h-3 w-3 shrink-0`}),a]})});if(l.isLoading)return t(`div`,{className:`flex items-center gap-2 rounded-lg border border-border bg-surface p-3 text-[11px] text-foreground-subtle`,children:[s(L,{className:`h-3 w-3 animate-spin`}),`Resolving…`]});if(l.isError||!l.data)return s(`div`,{className:`rounded-lg border border-border bg-surface p-3`,children:s(`p`,{className:`text-[11px] text-danger`,children:`Could not resolve this grant set. Saving is still allowed — the server enforces the same rules either way.`})});let f=l.data;return s(`div`,{className:`space-y-2 rounded-lg border border-border bg-surface p-3`,children:f.isAdmin?t(`p`,{className:`text-[11px] text-foreground`,children:[s(`span`,{className:`font-medium`,children:`Administrator`}),` — unrestricted. Grants are ignored for an admin.`]}):t(i,{children:[s(q,{icon:ce,label:`Devices they can see`,count:f.device.view.deviceCount,all:f.device.view.all,total:d}),s(q,{icon:ie,label:`Devices they can operate`,count:f.device.create.deviceCount,all:f.device.create.all,total:d}),s(q,{icon:U,label:`Devices they can delete`,count:f.device.delete.deviceCount,all:f.device.delete.all,total:d}),t(`div`,{className:`border-t border-border pt-2 text-[10px] text-foreground-subtle`,children:[`System access: `,f.system.length===0?`none`:f.system.join(`, `),f.capabilities.length>0&&t(i,{children:[` · Extra capabilities: `,f.capabilities.map(e=>e.name).join(`, `)]}),f.addons.length>0&&t(i,{children:[` · Addons: `,f.addons.map(e=>e.name).join(`, `)]})]}),f.device.view.deviceCount===0&&s(`p`,{className:`text-[10px] text-warning`,children:`This user will not be able to see any device.`})]})})}function xe(e){let t=F(e);return t===null?{mode:e.length===0?`role`:`advanced`,roleId:null,selector:{kind:`all`},includeLinked:!0,advancedScopes:e}:{mode:`role`,roleId:t.roleId,selector:t.selector,includeLinked:t.includeLinked,advancedScopes:e}}function Se(e){return e.mode===`advanced`?e.advancedScopes:e.roleId===null?[]:P({roleId:e.roleId,selector:e.selector,includeLinked:e.includeLinked})}function Ce({user:e,onClose:r,onSubmit:a,submitting:c,callerScopes:l}){let u=n(()=>xe(e.scopes??[]),[e.scopes]),[d,f]=o(u),[p,m]=o(u.mode===`advanced`),h=n(()=>Se(d),[d]),g=!e.isAdmin&&d.mode===`role`&&d.roleId===null,_=n(()=>e.isAdmin?null:d.mode===`role`&&d.roleId===null?`Pick what this user can do to see the result.`:D(h),[e.isAdmin,d.mode,d.roleId,h]),v=e=>f({...d,...e});return s(`div`,{className:`fixed inset-0 z-50 flex items-center justify-center bg-black/40 p-4 pt-[calc(1rem+env(safe-area-inset-top))] pb-[calc(1rem+env(safe-area-inset-bottom))]`,children:t(`div`,{className:`flex max-h-full w-full max-w-2xl flex-col rounded-lg border border-border bg-surface shadow-xl`,children:[t(`div`,{className:`flex shrink-0 items-start justify-between border-b border-border px-4 py-3`,children:[t(`div`,{className:`min-w-0`,children:[t(`div`,{className:`text-sm font-semibold text-foreground`,children:[`Access — `,e.username]}),s(`div`,{className:`text-[10px] text-foreground-subtle`,children:e.isAdmin?`This user is an administrator — they can do everything, and the settings below are ignored.`:`Choose what they can do, then which devices it applies to.`})]}),s(`button`,{onClick:r,className:`shrink-0 text-foreground-subtle hover:text-foreground`,title:`Close`,children:s(W,{className:`h-4 w-4`})})]}),t(`div`,{className:`min-h-0 flex-1 space-y-4 overflow-y-auto px-4 py-4`,children:[g&&t(`div`,{className:`flex items-start gap-2 rounded-lg border border-warning/40 bg-warning/10 p-3`,children:[s(_e,{className:`mt-0.5 h-3.5 w-3.5 shrink-0 text-warning`}),t(`p`,{className:`text-[11px] text-foreground`,children:[s(`span`,{className:`font-medium`,children:`No access.`}),` `,t(`span`,{className:`text-foreground-subtle`,children:[e.username,` cannot see or do anything yet. Configure it below.`]})]})]}),t(`section`,{className:`space-y-2`,children:[s(`h3`,{className:`text-[11px] font-semibold uppercase tracking-wide text-foreground-subtle`,children:`1 · What can they do`}),s(`div`,{className:`space-y-1.5`,children:M.map(e=>{let n=d.mode===`role`&&d.roleId===e.id;return t(`label`,{className:`flex cursor-pointer items-start gap-2 rounded-lg border p-2.5 transition-colors ${n?`border-primary bg-primary/5`:`border-border hover:bg-foreground-subtle/5`}`,children:[s(`input`,{type:`radio`,name:`access-role`,checked:n,onChange:()=>v({mode:`role`,roleId:e.id}),className:`mt-0.5 border-border focus:ring-primary`}),t(`span`,{className:`min-w-0`,children:[s(`span`,{className:`block text-[12px] font-medium text-foreground`,children:e.label}),s(`span`,{className:`mt-0.5 block text-[10px] text-foreground-subtle`,children:e.description})]})]},e.id)})}),t(`button`,{type:`button`,onClick:()=>{if(!p){f({...d,mode:`advanced`,advancedScopes:h}),m(!0);return}m(!1),f(xe(d.advancedScopes))},className:`inline-flex items-center gap-1 rounded px-1.5 py-1 text-[10px] text-foreground-subtle transition-colors hover:bg-foreground-subtle/10 hover:text-foreground`,children:[s(p?se:oe,{className:`h-3 w-3`}),`Advanced — edit raw grants`]}),p&&t(`div`,{className:`rounded-lg border border-border p-2`,children:[s(`p`,{className:`mb-2 text-[10px] text-foreground-subtle`,children:`One row per grant. Anything expressible here overrides the three roles above; close this section to go back to them.`}),s(C,{value:d.advancedScopes,onChange:e=>v({mode:`advanced`,advancedScopes:e}),clampToParent:l,emptyHint:t(i,{children:[`No grants.`,` `,s(`span`,{className:`font-medium text-foreground`,children:e.username}),` cannot call any protected endpoint until one is added.`]})})]})]}),d.mode===`role`&&t(`section`,{className:`space-y-2`,children:[s(`h3`,{className:`text-[11px] font-semibold uppercase tracking-wide text-foreground-subtle`,children:`2 · On which devices`}),s(A,{value:d.selector,onChange:e=>v({selector:e}),includeLinked:d.includeLinked,onIncludeLinkedChange:e=>v({includeLinked:e}),clampToDeviceIds:null})]}),t(`section`,{className:`space-y-2`,children:[s(`h3`,{className:`text-[11px] font-semibold uppercase tracking-wide text-foreground-subtle`,children:d.mode===`role`?`3 · Result`:`2 · Result`}),s(be,{scopes:h,isAdmin:e.isAdmin,invalidReason:_})]})]}),t(`div`,{className:`flex shrink-0 items-center justify-end gap-2 border-t border-border px-4 py-3`,children:[s(`button`,{onClick:r,className:`rounded border border-border px-3 py-1.5 text-xs text-foreground-subtle hover:text-foreground`,children:`Cancel`}),s(`button`,{onClick:()=>a([...h]),disabled:c||_!==null,className:`rounded bg-primary px-3 py-1.5 text-xs font-medium text-primary-foreground hover:bg-primary/90 disabled:opacity-50`,children:c?s(L,{className:`h-3 w-3 animate-spin`}):`Save access`})]})]})})}e();function we(){let e=a(),{user:n}=H(),[r,i]=o(!1),[c,l]=o(``),[u,f]=o(``),[p,g]=o(!1),[v,y]=o(null),{data:b,isLoading:x,isError:C}=d(),w=O(),T=()=>e.invalidateQueries({queryKey:[[`userManagement`,`listUsers`]]}),E=S({onSuccess:()=>{T(),i(!1),l(``),f(``),g(!1),y(null)},onError:e=>{y(e instanceof Error?e.message:`Failed to create user`)}}),D=te({onSuccess:T}),k=h({onSuccess:T}),A=_({onSuccess:T}),j=m({onSuccess:()=>{T(),N(null)}}),[M,N]=o(null),[P,F]=o(null),I=b??[];async function ne(e){await w({title:`Delete user`,message:`Permanently delete user "${e.username}"? This cannot be undone — any active sessions will be revoked on next request.`,confirmLabel:`Delete`,variant:`danger`})&&D.mutate({id:e.id})}async function re(e){let t=window.prompt(`New password for "${e.username}":`);if(t){if(t.length<8){window.alert(`Password must be at least 8 characters.`);return}await w({title:`Reset password`,message:`Reset the password for "${e.username}"? They will need to use the new password on their next login.`,confirmLabel:`Reset`})&&A.mutate({id:e.id,newPassword:t})}}function ie(e,t){t!==e.isAdmin&&k.mutate({id:e.id,isAdmin:t})}function R(e){return e?new Date(typeof e==`number`?e:String(e)).toLocaleDateString(`en-GB`,{day:`2-digit`,month:`short`,year:`numeric`}):`—`}return t(K,{children:[s(`div`,{className:`flex items-center justify-end`,children:t(`button`,{onClick:()=>i(!0),className:`inline-flex items-center gap-1.5 rounded-lg bg-primary px-3 py-1.5 text-xs font-medium text-primary-foreground shadow-sm hover:bg-primary/90`,children:[s(ae,{className:`h-3.5 w-3.5`}),`Create User`]})}),r&&t(`div`,{className:`rounded-lg border border-border bg-surface p-4 space-y-3`,children:[t(`div`,{className:`flex items-center justify-between`,children:[s(`span`,{className:`text-xs font-medium text-foreground`,children:`New User`}),s(`button`,{onClick:()=>i(!1),className:`text-foreground-subtle hover:text-foreground`,children:s(W,{className:`h-4 w-4`})})]}),t(`div`,{className:`grid grid-cols-3 gap-3`,children:[t(`div`,{className:`space-y-1`,children:[s(`label`,{className:`text-[10px] text-foreground-subtle uppercase tracking-wide`,children:`Username`}),s(`input`,{type:`text`,value:c,onChange:e=>l(e.target.value),placeholder:`john`,className:`w-full rounded border border-border bg-background px-2 py-1.5 text-xs text-foreground placeholder:text-foreground-subtle focus:outline-none focus:ring-1 focus:ring-primary`})]}),t(`div`,{className:`space-y-1`,children:[s(`label`,{className:`text-[10px] text-foreground-subtle uppercase tracking-wide`,children:`Password`}),s(`input`,{type:`password`,value:u,onChange:e=>f(e.target.value),placeholder:`••••••••`,className:`w-full rounded border border-border bg-background px-2 py-1.5 text-xs text-foreground placeholder:text-foreground-subtle focus:outline-none focus:ring-1 focus:ring-primary`})]}),t(`div`,{className:`space-y-1`,children:[s(`label`,{className:`text-[10px] text-foreground-subtle uppercase tracking-wide`,children:`Admin`}),t(`label`,{className:`flex items-center gap-2 rounded border border-border bg-background px-2 py-1.5 text-xs text-foreground cursor-pointer`,children:[s(`input`,{type:`checkbox`,checked:p,onChange:e=>g(e.target.checked),className:`rounded border-border focus:ring-primary`}),s(`span`,{className:`text-foreground-subtle`,children:`Unrestricted access`})]})]})]}),v&&s(`p`,{className:`text-[10px] text-danger`,children:v}),t(`div`,{className:`flex justify-end gap-2`,children:[s(`button`,{onClick:()=>i(!1),className:`rounded px-3 py-1.5 text-xs text-foreground-subtle border border-border hover:text-foreground`,children:`Cancel`}),s(`button`,{onClick:()=>E.mutate({username:c,password:u,isAdmin:p}),disabled:E.isPending||!c||!u,className:`rounded bg-primary px-3 py-1.5 text-xs font-medium text-primary-foreground hover:bg-primary/90 disabled:opacity-50`,children:E.isPending?`Creating...`:`Create`})]})]}),x&&s(`div`,{className:`text-xs text-foreground-subtle animate-pulse`,children:`Loading...`}),C&&s(`div`,{className:`text-xs text-danger`,children:`Failed to load`}),!x&&!C&&I.length===0&&s(`div`,{className:`text-xs text-foreground-subtle`,children:`No data`}),(()=>{let e=e=>D.isPending&&D.variables?.id===e.id||k.isPending&&k.variables?.id===e.id||A.isPending&&A.variables?.id===e.id;return s(ee,{columns:[{key:`username`,header:`Username`,render:e=>e.username},{key:`isAdmin`,header:`Admin`,render:n=>t(`label`,{className:`inline-flex items-center gap-1.5 text-xs cursor-pointer`,children:[s(`input`,{type:`checkbox`,checked:n.isAdmin,onChange:e=>ie(n,e.target.checked),disabled:e(n),className:`rounded border-border focus:ring-primary disabled:opacity-50`}),s(`span`,{className:n.isAdmin?`text-primary font-medium`:`text-foreground-subtle`,children:n.isAdmin?`Admin`:`Regular`})]})},{key:`scopes`,header:`Access`,render:e=>e.isAdmin?s(`span`,{className:`text-[10px] italic text-foreground-subtle`,children:`everything (admin)`}):t(`button`,{onClick:()=>N(e),className:`inline-flex items-center gap-1 rounded px-1.5 py-0.5 text-[10px] hover:bg-foreground-subtle/10`,title:`Configure access`,children:[s(B,{className:`h-3 w-3 shrink-0 text-foreground-subtle`}),s(Te,{scopes:e.scopes??[]})]})},{key:`createdAt`,header:`Created`,render:e=>s(`span`,{className:`text-foreground-subtle`,children:R(e.createdAt)})},{key:`actions`,header:`Actions`,align:`right`,render:r=>{let i=e(r);return t(`div`,{className:`flex items-center justify-end gap-1`,children:[r.id!==n?.id&&r.totpEnabled&&t(`button`,{onClick:()=>F(r),disabled:i,className:`inline-flex items-center gap-1 rounded px-2 py-1 text-[10px] text-foreground-subtle hover:bg-foreground-subtle/10 hover:text-foreground disabled:opacity-50`,title:`Remove two-factor authentication`,children:[s(V,{className:`h-3 w-3`}),`Remove 2FA`]}),t(`button`,{onClick:()=>re(r),disabled:i,className:`inline-flex items-center gap-1 rounded px-2 py-1 text-[10px] text-foreground-subtle hover:bg-foreground-subtle/10 hover:text-foreground disabled:opacity-50`,title:`Reset password`,children:[s(he,{className:`h-3 w-3`}),`Reset password`]}),t(`button`,{onClick:()=>ne(r),disabled:i,className:`inline-flex items-center gap-1 rounded px-2 py-1 text-[10px] text-danger hover:bg-danger/10 disabled:opacity-50`,title:`Delete user`,children:[i?s(L,{className:`h-3 w-3 animate-spin`}):s(U,{className:`h-3 w-3`}),`Delete`]})]})}}],rows:I,rowKey:e=>e.id,minWidthPx:560})})(),P&&s(ye,{userId:P.id,username:P.username,onClose:()=>F(null)}),M&&s(Ee,{user:M,onClose:()=>N(null),onSubmit:e=>j.mutate({userId:M.id,scopes:e}),submitting:j.isPending})]})}function Te({scopes:e}){if(e.length===0)return s(`span`,{className:`font-medium text-warning`,children:`No access`});let n=F(e);return n===null?t(`span`,{className:`text-foreground-subtle`,children:[`Custom · `,e.length,` grant`,e.length===1?``:`s`]}):t(`span`,{className:`text-foreground-subtle`,children:[s(`span`,{className:`font-medium text-foreground`,children:N(n.roleId).label}),` ·`,` `,y(n.selector)]})}function Ee(e){let{user:t}=H(),n=t?.isAdmin===!0;return s(Ce,{...e,callerScopes:n?null:t?.scopes??[]})}e();var De=`bg-primary/10 text-primary`,Oe=`bg-foreground-subtle/10 text-foreground-subtle`;function J(e){if(!e)return`—`;let t=new Date(e);return Number.isNaN(t.getTime())?`—`:t.toLocaleString()}function ke(e){return e?e===`*`?`*`:e.join(`, `):``}function Ae(){let e=a(),r=O(),{data:i,isLoading:c}=k(),{data:l}=d(),u=n(()=>i??[],[i]),f=n(()=>l??[],[l]),p=()=>e.invalidateQueries({queryKey:[[`userManagement`,`listApiKeys`]]}),m=()=>e.invalidateQueries({queryKey:[[`userManagement`,`listScopedTokens`]]}),[h,g]=o(!1),[_,v]=o(null),y=E({onSuccess:p}),b=j({onSuccess:({token:e,record:t})=>{m(),g(!1),v({token:e,label:t.name})}}),x=w({onSuccess:m}),S=async(e,t)=>{await r({title:`Revoke "${t}"?`,message:`Any client using this token will lose access immediately. This cannot be undone.`,confirmLabel:`Revoke`,variant:`danger`})&&y.mutate({id:e})},C=async(e,t)=>{await r({title:`Revoke "${t}"?`,message:`The scoped token will be invalid on its next use.`,confirmLabel:`Revoke`,variant:`danger`})&&x.mutate({id:e})};return t(K,{children:[t(`div`,{className:`flex items-center justify-between gap-3 flex-wrap`,children:[s(`p`,{className:`text-xs text-foreground-subtle max-w-2xl`,children:`Issue scoped tokens to grant a user a narrow surface — a specific addon, integration, or capability. Every token MUST be scoped: revoking it has predictable blast radius.`}),t(`button`,{onClick:()=>g(!0),className:`inline-flex items-center gap-1.5 rounded-lg bg-primary px-3 py-1.5 text-xs font-medium text-primary-foreground hover:bg-primary/90 disabled:opacity-50`,disabled:f.length===0,title:f.length===0?`Create a user first`:`Issue a scoped token`,children:[s(B,{className:`h-3.5 w-3.5`}),`New token`]})]}),t(je,{title:`Scoped tokens`,subtitle:`Grouped per user`,children:[f.length===0&&s(Ne,{text:`No users yet — scoped tokens are issued on behalf of an existing user.`}),f.map(e=>s(Fe,{userId:e.id,username:e.username,onRevoke:(e,t)=>{C(e,t)},revokePending:x.isPending,revokeId:x.variables?.id},e.id))]}),u.length>0&&s(je,{title:`Legacy API keys`,subtitle:`${u.length} pre-existing — revoke only`,children:s(Pe,{headers:[`Label`,`Admin`,`Prefix`,`Allowed providers`,`Created`,`Last used`,``],rows:u.map(e=>{let n=!!e.isAdmin,r=y.isPending&&y.variables?.id===e.id;return t(`tr`,{className:`hover:bg-primary/5`,children:[s(`td`,{className:`px-3 py-2 text-foreground border-b border-border font-medium`,children:e.label}),s(`td`,{className:`px-3 py-2 text-foreground border-b border-border`,children:s(`span`,{className:`inline-block rounded px-2 py-0.5 text-[10px] uppercase tracking-wide ${n?De:Oe}`,children:n?`admin`:`regular`})}),t(`td`,{className:`px-3 py-2 text-foreground border-b border-border font-mono text-[11px]`,children:[e.tokenPrefix,`…`]}),s(`td`,{className:`px-3 py-2 text-foreground border-b border-border text-foreground-subtle`,children:ke(e.allowedProviders)||`all`}),s(`td`,{className:`px-3 py-2 text-foreground-subtle border-b border-border`,children:J(e.createdAt)}),s(`td`,{className:`px-3 py-2 text-foreground-subtle border-b border-border`,children:J(e.lastUsedAt)}),s(`td`,{className:`px-3 py-2 border-b border-border text-right`,children:t(`button`,{onClick:()=>{S(e.id,e.label)},disabled:r,className:`inline-flex items-center gap-1 rounded px-2 py-1 text-[10px] text-danger hover:bg-danger/10 disabled:opacity-50`,title:`Revoke`,children:[r?s(L,{className:`h-3 w-3 animate-spin`}):s(U,{className:`h-3 w-3`}),`Revoke`]})})]},e.id)})})}),c&&s(Me,{}),h&&s(Ie,{users:f.map(e=>({id:e.id,username:e.username})),onClose:()=>g(!1),onSubmit:e=>b.mutate({userId:e.userId,name:e.name,scopes:e.scopes,...e.expiresAt===void 0?{}:{expiresAt:e.expiresAt}}),submitting:b.isPending}),_&&s(Le,{token:_.token,label:_.label,onClose:()=>v(null)})]})}function je({title:e,subtitle:n,children:r}){return t(`div`,{className:`space-y-2`,children:[t(`div`,{className:`flex items-baseline justify-between`,children:[s(`h2`,{className:`text-sm font-semibold text-foreground`,children:e}),n&&s(`span`,{className:`text-[10px] text-foreground-subtle`,children:n})]}),r]})}function Me(){return s(`div`,{className:`space-y-2`,children:[1,2].map(e=>s(`div`,{className:`h-10 rounded border border-border bg-surface animate-pulse`},e))})}function Ne({text:e}){return s(`div`,{className:`rounded border border-dashed border-border bg-surface px-3 py-4 text-xs text-foreground-subtle text-center`,children:e})}function Pe({headers:e,rows:n}){return s(`div`,{className:`rounded-lg border border-border bg-surface overflow-x-auto`,children:t(`table`,{className:`w-full text-xs min-w-[640px]`,children:[s(`thead`,{children:s(`tr`,{children:e.map((t,n)=>s(`th`,{className:`px-3 py-2 text-foreground-subtle font-medium bg-surface border-b border-border whitespace-nowrap ${n===e.length-1?`text-right`:`text-left`}`,children:t},n))})}),s(`tbody`,{children:n})]})})}function Fe({userId:e,username:n,onRevoke:r,revokePending:i,revokeId:a}){let{data:o,isLoading:c}=f({userId:e}),l=o??[];return c||l.length===0?null:t(`div`,{className:`space-y-1.5`,children:[s(`div`,{className:`text-[11px] font-medium text-foreground`,children:n}),s(Pe,{headers:[`Name`,`Prefix`,`Scopes`,`Expires`,`Last used`,`Created`,``],rows:l.map(e=>{let n=i&&a===e.id;return t(`tr`,{className:`hover:bg-primary/5`,children:[s(`td`,{className:`px-3 py-2 text-foreground border-b border-border font-medium`,children:e.name}),t(`td`,{className:`px-3 py-2 text-foreground border-b border-border font-mono text-[11px]`,children:[e.tokenPrefix,`…`]}),s(`td`,{className:`px-3 py-2 text-foreground border-b border-border`,children:s(`div`,{className:`flex flex-wrap gap-1`,children:e.scopes.map((e,n)=>t(`span`,{className:`inline-block rounded bg-foreground-subtle/10 px-1.5 py-0.5 text-[10px] font-mono`,children:[e.type,`:`,e.type===`device`?`[${y(e.selector)}]`:e.target]},n))})}),s(`td`,{className:`px-3 py-2 text-foreground-subtle border-b border-border`,children:J(e.expiresAt)}),s(`td`,{className:`px-3 py-2 text-foreground-subtle border-b border-border`,children:J(e.lastUsedAt)}),s(`td`,{className:`px-3 py-2 text-foreground-subtle border-b border-border`,children:J(e.createdAt)}),s(`td`,{className:`px-3 py-2 border-b border-border text-right`,children:t(`button`,{onClick:()=>r(e.id,e.name),disabled:n,className:`inline-flex items-center gap-1 rounded px-2 py-1 text-[10px] text-danger hover:bg-danger/10 disabled:opacity-50`,children:[n?s(L,{className:`h-3 w-3 animate-spin`}):s(U,{className:`h-3 w-3`}),`Revoke`]})})]},e.id)})})]})}function Ie({users:e,onClose:n,onSubmit:r,submitting:i}){let{user:a}=H(),c=a?.isAdmin===!0?null:a?.scopes??[],[l,u]=o(e[0]?.id??``),[d,f]=o(``),[p,m]=o([{type:`capability`,target:``,access:[`view`,`create`]}]),[h,g]=o(``),_=D(p),v=l!==``&&d.trim().length>0&&p.length>0&&_===null&&!i;return t(Re,{title:`Create scoped token`,onClose:n,children:[t(`div`,{className:`space-y-3`,children:[s(Y,{label:`On behalf of user`,children:s(`select`,{value:l,onChange:e=>u(e.target.value),className:`w-full rounded border border-border bg-background px-2 py-1.5 text-xs focus:outline-none focus:ring-1 focus:ring-primary`,children:e.map(e=>s(`option`,{value:e.id,children:e.username},e.id))})}),s(Y,{label:`Name`,children:s(`input`,{value:d,onChange:e=>f(e.target.value),placeholder:`cloudflare-tunnel-route`,className:`w-full rounded border border-border bg-background px-2 py-1.5 text-xs focus:outline-none focus:ring-1 focus:ring-primary`})}),t(Y,{label:`Scopes`,hint:`Each scope picks a (cap or addon) target + one or more access flavours. The token can access ONLY what's listed.`,children:[s(C,{value:p,onChange:m,clampToParent:c}),_&&s(`p`,{className:`mt-1 text-[10px] text-danger`,children:_})]}),s(Y,{label:`Expires in (days)`,hint:`Leave blank for non-expiring.`,children:s(`input`,{type:`number`,min:1,value:h,onChange:e=>g(e.target.value),placeholder:`30`,className:`w-full rounded border border-border bg-background px-2 py-1.5 text-xs focus:outline-none focus:ring-1 focus:ring-primary`})})]}),t(ze,{children:[s(`button`,{onClick:n,className:`rounded px-3 py-1.5 text-xs text-foreground-subtle border border-border hover:text-foreground`,children:`Cancel`}),t(`button`,{onClick:()=>{let e=parseInt(h,10),t=Number.isFinite(e)&&e>0?Date.now()+e*864e5:void 0;r({userId:l,name:d.trim(),scopes:p,expiresAt:t})},disabled:!v,className:`inline-flex items-center gap-1.5 rounded bg-primary px-3 py-1.5 text-xs font-medium text-primary-foreground hover:bg-primary/90 disabled:opacity-50`,children:[i?s(L,{className:`h-3.5 w-3.5 animate-spin`}):s(B,{className:`h-3.5 w-3.5`}),`Issue token`]})]})]})}function Le({token:e,label:n,onClose:r}){let[i,a]=o(!1),c=async()=>{try{await navigator.clipboard.writeText(e),a(!0)}catch{}};return t(Re,{title:`Token: ${n}`,onClose:r,children:[t(`div`,{className:`space-y-3`,children:[s(`div`,{className:`rounded border border-warning/30 bg-warning/10 px-3 py-2 text-xs text-warning`,children:`Copy this token now. Once you close this dialog the secret cannot be displayed again.`}),s(`div`,{className:`rounded border border-border bg-background p-2 font-mono text-[11px] break-all select-all`,children:e})]}),t(ze,{children:[t(`button`,{onClick:()=>{c()},className:`inline-flex items-center gap-1.5 rounded bg-surface border border-border px-3 py-1.5 text-xs font-medium text-foreground hover:bg-primary/5 hover:border-primary/30`,children:[i?s(le,{className:`h-3.5 w-3.5 text-primary`}):s(ne,{className:`h-3.5 w-3.5`}),i?`Copied`:`Copy`]}),s(`button`,{onClick:r,className:`rounded bg-primary px-3 py-1.5 text-xs font-medium text-primary-foreground hover:bg-primary/90`,children:`Done`})]})]})}function Re({title:e,onClose:n,children:r}){return s(`div`,{className:`fixed inset-0 z-50 flex items-center justify-center bg-background/80 backdrop-blur-sm`,onClick:n,children:t(`div`,{className:`w-full max-w-md rounded-xl border border-border bg-surface shadow-2xl`,onClick:e=>e.stopPropagation(),children:[t(`div`,{className:`flex items-start justify-between border-b border-border px-4 py-3`,children:[s(`h2`,{className:`text-sm font-semibold text-foreground`,children:e}),s(`button`,{onClick:n,className:`text-foreground-subtle hover:text-foreground`,children:s(W,{className:`h-4 w-4`})})]}),s(`div`,{className:`p-4`,children:r})]})})}function ze({children:e}){return s(`div`,{className:`flex justify-end gap-2 border-t border-border px-4 py-3`,children:e})}function Y({label:e,hint:n,children:r}){return t(`div`,{className:`space-y-1`,children:[s(`label`,{className:`text-[10px] text-foreground-subtle uppercase tracking-wide`,children:e}),r,n&&s(`p`,{className:`text-[10px] text-foreground-subtle`,children:n})]})}e();function X(e){if(!e)return`—`;let t=new Date(e);return Number.isNaN(t.getTime())?`—`:t.toLocaleString()}function Be(e){if(e.type===`category`){let t=e.target??``;return t===`device`?`all devices`:`all ${t}`}if(e.type===`device`)return`device:[${(e.targets??[]).join(`,`)}]`;let t=e;return`${t.type}:${t.target??``}`}function Ve(){return s(`div`,{className:`space-y-2`,children:[1,2].map(e=>s(`div`,{className:`h-10 rounded border border-border bg-surface animate-pulse`},e))})}function He({text:e}){return s(`div`,{className:`rounded border border-dashed border-border bg-surface px-3 py-4 text-xs text-foreground-subtle text-center`,children:e})}function Ue({headers:e,rows:n}){return s(`div`,{className:`rounded-lg border border-border bg-surface overflow-x-auto`,children:t(`table`,{className:`w-full text-xs min-w-[640px]`,children:[s(`thead`,{children:s(`tr`,{children:e.map((t,n)=>s(`th`,{className:`px-3 py-2 text-foreground-subtle font-medium bg-surface border-b border-border whitespace-nowrap ${n===e.length-1?`text-right`:`text-left`}`,children:t},n))})}),s(`tbody`,{children:n})]})})}function We(){let e=a(),r=O(),{data:i,isLoading:o}=x(),c=n(()=>i??[],[i]),u=l({onSuccess:()=>e.invalidateQueries({queryKey:[[`userManagement`,`listOauthSessions`]]})}),d=async(e,t)=>{await r({title:`Revoke "${t}" session?`,message:`This integration will lose access immediately on its next API call. This cannot be undone.`,confirmLabel:`Revoke`,variant:`danger`})&&u.mutate({id:e})};return t(K,{icon:ge,title:`Linked Sessions`,subtitle:`External integrations (Alexa, …) linked to this hub via OAuth. Revoke a session to immediately invalidate that integration's access.`,children:[o&&s(Ve,{}),!o&&c.length===0&&s(He,{text:`No linked sessions — once an external integration completes the OAuth flow its session will appear here.`}),!o&&c.length>0&&s(Ue,{headers:[`Integration`,`User`,`Scopes`,`Created`,`Last used`,`Status`,``],rows:c.map(e=>{let n=e.revokedAt!==null,r=(u.isPending?u.variables?.id:void 0)===e.id;return t(`tr`,{className:`hover:bg-primary/5`,children:[s(`td`,{className:`px-3 py-2 text-foreground border-b border-border font-medium`,children:e.integrationId}),s(`td`,{className:`px-3 py-2 text-foreground border-b border-border`,children:e.username}),s(`td`,{className:`px-3 py-2 text-foreground border-b border-border`,children:s(`div`,{className:`flex flex-wrap gap-1`,children:e.scopes.map((e,t)=>s(`span`,{className:`inline-block rounded bg-foreground-subtle/10 px-1.5 py-0.5 text-[10px] font-mono`,children:Be(e)},t))})}),s(`td`,{className:`px-3 py-2 text-foreground-subtle border-b border-border`,children:X(e.createdAt)}),s(`td`,{className:`px-3 py-2 text-foreground-subtle border-b border-border`,children:X(e.lastUsedAt)}),s(`td`,{className:`px-3 py-2 border-b border-border`,children:n?t(`span`,{className:`inline-block rounded bg-foreground-subtle/10 px-2 py-0.5 text-[10px] text-foreground-subtle`,children:[`Revoked `,X(e.revokedAt)]}):s(`span`,{className:`inline-block rounded bg-emerald-500/15 px-2 py-0.5 text-[10px] text-emerald-700 dark:text-emerald-300`,children:`Active`})}),s(`td`,{className:`px-3 py-2 border-b border-border text-right`,children:!n&&t(`button`,{onClick:()=>{d(e.id,e.integrationId)},disabled:r,className:`inline-flex items-center gap-1 rounded px-2 py-1 text-[10px] text-danger hover:bg-danger/10 disabled:opacity-50`,title:`Revoke`,children:[r?s(L,{className:`h-3 w-3 animate-spin`}):s(U,{className:`h-3 w-3`}),`Revoke`]})})]},e.id)})})]})}e();var Z=3e4,Q=[{capName:`auth-provider`,stageBadge:null},{capName:`user-passkeys`,stageBadge:`Second factor`}],$={title:`Authentication providers`,subtitle:`Every registered authentication surface in one list: login providers (local password, OIDC, SAML, magic-link) and second-factor providers (passkeys / WebAuthn — configure the relying-party RP ID + origin inline; users enroll from My access → Passkeys). Multiple providers run in parallel — enable/disable each independently. Disabling one only removes that method; local password login is unaffected.`,emptyTitle:`No authentication providers registered`,emptyDescription:`Local auth should always be available — if this list is empty the local-auth builtin failed to register. Check the Addons page for load errors.`,installLabel:`Add provider`};function Ge(e){return e===`local-auth`?{headline:`Username + password (local).`,icon:me,bullets:[`Users live in the hub’s SQLite database — no IdP roundtrip.`,`TOTP / 2FA is self-enrolled: each user enables it from their own profile page (My access → Two-factor authentication).`,`API keys + scoped tokens are managed from the API Keys page.`],setupSteps:[`Add users from Users → New user (or seed via CAMSTACK_ADMIN_USER / CAMSTACK_ADMIN_PASS).`,`Hand out either passwords or scoped tokens — both validate through this provider.`]}:e.startsWith(`auth-oidc`)?{headline:`OpenID Connect (Google, Microsoft, Okta, Keycloak, …).`,icon:R,bullets:[`Three-leg redirect flow with PKCE S256 + nonce.`,`id_token is signature-verified against the IdP’s JWKS — no implicit trust.`,`First-time sign-ins are auto-provisioned with the configured Default Role.`],setupSteps:[`Register a web app at your IdP and copy the client_id + client_secret.`,"Set the redirect URI to `https://<this-hub>/addon/<addon-id>/callback`.",`Paste issuer + credentials in the Settings panel below — saves on every change.`]}:e.startsWith(`auth-saml`)?{headline:`SAML 2.0 — enterprise SSO (Azure AD, Okta, OneLogin).`,icon:R,bullets:[`Heavier handshake than OIDC — exchange metadata XML with your IdP.`,`Group → role mapping via SAML assertions.`]}:e.startsWith(`auth-webauthn`)||e.startsWith(`auth-passkey`)?{headline:`Passkeys / WebAuthn — passwordless second factor.`,icon:V,bullets:[`Enroll a YubiKey, Touch ID, or platform passkey per user.`,`Resistant to phishing — the browser binds the credential to your hub origin.`]}:e.startsWith(`auth-totp`)||e.startsWith(`auth-magic-link`)?{headline:`TOTP / magic-link — second factor or passwordless sign-in.`,icon:V,bullets:[`Codes / links delivered out-of-band (RFC 6238 for TOTP).`,`Compatible with Google Authenticator, Aegis, 1Password, Bitwarden, etc.`]}:{headline:`Authentication provider.`,icon:B,bullets:[`Generic authentication provider. No additional hints registered.`]}}function Ke(){let e=T({capName:Q[0].capName},{refetchInterval:Z}),t=T({capName:Q[1].capName},{refetchInterval:Z}),r=g(void 0,{refetchInterval:Z}),i=n(()=>fe(r.data??[]),[r.data]),a=n(()=>{let n=[],r=[e.data??[],t.data??[]];for(let[e,t]of Q.entries())for(let a of r[e]??[])n.push({addonId:a.addonId,displayName:i.get(a.addonId)??a.addonId,isActive:a.isActive,capName:t.capName,stageBadge:t.stageBadge});return n},[e.data,t.data,i]);return s(de,{title:$.title,subtitle:$.subtitle,pageIcon:B,itemIcon:B,capability:Q[0].capName,installButtonLabel:$.installLabel,items:a,isLoading:e.isLoading||t.isLoading,emptyTitle:$.emptyTitle,emptyDescription:$.emptyDescription,renderStatusBadges:e=>e.stageBadge===null?null:s(`span`,{className:`inline-flex items-center rounded-full border border-primary/30 bg-primary/10 px-2 py-0.5 text-[10px] font-medium text-primary`,children:e.stageBadge}),renderExpandedPanel:e=>s(qe,{addonId:e.addonId})})}function qe({addonId:e}){let n=Ge(e),r=n.icon;return t(`div`,{className:`rounded-lg border border-border bg-surface p-4 space-y-3`,children:[t(`div`,{className:`flex items-start gap-2.5`,children:[s(r,{className:`h-4 w-4 mt-0.5 text-primary shrink-0`}),s(`div`,{className:`text-xs text-foreground font-medium`,children:n.headline})]}),s(`ul`,{className:`text-xs text-foreground-subtle space-y-1.5 pl-6 list-disc`,children:n.bullets.map((e,t)=>s(`li`,{children:e},t))}),n.setupSteps&&n.setupSteps.length>0&&t(`div`,{className:`rounded-md border border-border bg-surface-hover/40 px-3 py-2.5 space-y-1.5`,children:[t(`div`,{className:`flex items-center gap-1.5 text-[10px] font-semibold text-foreground-subtle uppercase tracking-wide`,children:[s(pe,{className:`h-3 w-3`}),`Setup steps`]}),s(`ol`,{className:`text-xs text-foreground space-y-0.5 pl-4 list-decimal`,children:n.setupSteps.map((e,t)=>s(`li`,{children:e},t))})]}),e===`local-auth`&&t(`div`,{className:`rounded-md border border-blue-500/30 bg-blue-500/5 px-3 py-2 flex items-start gap-2 text-[11px] text-foreground`,children:[s(G,{className:`h-3.5 w-3.5 mt-0.5 text-blue-500 shrink-0`}),t(`span`,{children:[`TOTP / 2FA is self-service: each user enrols from their own profile page —`,` `,s(`a`,{href:`/system/my-access`,className:`underline text-primary`,children:`My access`}),` `,`→ “Two-factor authentication” → Enable 2FA. Admins can only remove a user’s active enrollment (lost device) from the`,` `,s(`a`,{href:`/system/users`,className:`underline text-primary`,children:`Users`}),` `,`page via Actions → “Remove 2FA”.`]})]})]})}function Je(){return s(`div`,{className:`flex flex-col p-4`,children:s(ue,{tabs:[{id:`users`,label:`Users`,icon:ve,content:s(we,{})},{id:`api-keys`,label:`Tokens`,icon:re,content:s(Ae,{})},{id:`linked-sessions`,label:`Linked Sessions`,icon:ge,content:s(We,{})},{id:`authentication`,label:`Authentication`,icon:B,content:s(Ke,{})}]})})}export{Je as IdentityPage};