@camstack/addon-admin-ui 1.2.403 → 1.2.405

package/dist/assets/Identity-B1CKXG0c.js

@@ -1 +0,0 @@
-import{I as e,K as t,Q as n,S as r,W as i,a,b as o,o as s,q as c,t as l,x as u,z as d}from"./_virtual_mf___mfe_internal__admin_ui_host__loadShare___mf_0_tanstack_mf_1_react_mf_2_query__loadShare__.js-DhP-Lgiq.js";import{_t as f,ct as p,gt as m,ot as h,yt as g}from"./player-overlays-9CMoB0XN.js";import{$u as _,Ad as v,Al as y,An as b,Bl as x,Dl as S,Ed as C,Fl as w,Fn as T,Ft as E,G as D,Gd as O,Gn as k,Hl as A,Hn as j,Ht as M,Il as N,In as P,Jl as F,Ju as I,L as ee,Ll as L,Md as R,Ml as z,Mn as B,Mr as V,N as H,Nl as te,Od as ne,Ol as re,P as U,Pl as ie,Pn as W,Ql as ae,Rl as oe,Tn as se,Un as ce,Vl as le,Vu as ue,Wn as de,X as fe,Yu as G,Z as pe,cf as me,dd as he,dn as K,en as ge,fu as q,jd as _e,jl as ve,jn as J,jr as ye,kl as be,md as xe,mu as Se,nn as Ce,nr as Y,ql as we,qu as X,rn as Te,rr as Ee,ur as De,va as Oe,wd as ke,wu as Ae,z as je,zl as Me}from"./src-CcDa8abu.js";import{t as Ne}from"./history-B0sqAabA.js";import{t as Pe}from"./monitor-smartphone-J97h7fMI.js";import{S as Fe,_ as Ie,a as Le,b as Re,c as ze,d as Be,f as Ve,g as He,h as Ue,i as We,l as Ge,m as Ke,n as qe,o as Je,p as Ye,s as Xe,t as Ze,u as Qe,v as $e,x as et,y as tt}from"./SessionsList-CRCalm3f.js";import{a as nt,gi as rt,hi as it,i as at,mi as ot,o as st,s as ct}from"./client-1JBRoe76.js";import{t as lt}from"./useTranslation-Bc5yH9V9.js";import{$ as ut,C as dt,R as Z,X as ft,Y as pt,Z as mt,at as ht,c as gt,h as _t,p as vt,rt as yt,s as bt,tt as xt}from"./index-tHW3dkoe.js";import{t as St}from"./AdminSectionedPage-Bw7eNdlM.js";import{t as Ct}from"./AdminPage-CkigJ9wC.js";import{i as wt,n as Tt,r as Et,t as Dt}from"./IntegrationHub-DvUPF3ab.js";import{n as Ot,t as kt}from"./addon-display-names-BkwMrExv.js";var At=g(`book-open`,[[`path`,{d:`M12 7v14`,key:`1akyts`}],[`path`,{d:`M3 18a1 1 0 0 1-1-1V4a1 1 0 0 1 1-1h5a4 4 0 0 1 4 4 4 4 0 0 1 4-4h5a1 1 0 0 1 1 1v13a1 1 0 0 1-1 1h-6a3 3 0 0 0-3 3 3 3 0 0 0-3-3z`,key:`ruj8y`}]]),jt=g(`key-square`,[[`path`,{d:`M12.4 2.7a2.5 2.5 0 0 1 3.4 0l5.5 5.5a2.5 2.5 0 0 1 0 3.4l-3.7 3.7a2.5 2.5 0 0 1-3.4 0L8.7 9.8a2.5 2.5 0 0 1 0-3.4z`,key:`165ttr`}],[`path`,{d:`m14 7 3 3`,key:`1r5n42`}],[`path`,{d:`m9.4 10.6-6.814 6.814A2 2 0 0 0 2 18.828V21a1 1 0 0 0 1 1h3a1 1 0 0 0 1-1v-1a1 1 0 0 1 1-1h1a1 1 0 0 0 1-1v-1a1 1 0 0 1 1-1h.172a2 2 0 0 0 1.414-.586l.814-.814`,key:`1ubxi2`}]]);n();function Mt(){let e=Y(),t=q.useUtils(),n=et(),{data:r,isLoading:a}=w(),o=i(()=>r??[],[r]),s=q.useQueries(e=>o.map(t=>e.userManagement.listExternalIdentities({userId:t.id}))),l=q.auth.listLoginMethods.useQuery(),[d,f]=c(null),p=le({onSuccess:()=>void t.userManagement.listExternalIdentities.invalidate(),onError:e=>f(`Remove failed: ${e.message}`)}),m=i(()=>new Map((l.data??[]).flatMap(e=>e.kind===`redirect`?[[e.id,e.label]]:[])),[l.data]),h=o.flatMap((e,t)=>s[t]?.data??[]),g=h.map(e=>({...Ve(e,n),kind:m.get(e.provider)??e.provider})),_=async t=>{let n=h.find(e=>Be(e)===t.id);n!==void 0&&await e({title:`Remove sign-in link`,message:`"${t.ownerName}" will no longer be able to sign in with this ${t.kind} account.`,confirmLabel:`Remove`,variant:`danger`})&&(f(null),p.mutate({userId:n.userId,provider:n.provider,subject:n.subject}))};return u(tt,{notice:Re(d),onDismissNotice:()=>{f(null)},id:`external-identities`,title:`Sign-in links`,icon:ht,description:`External accounts (single sign-on) each user linked to their CamStack account. Only the owner can link one, from their profile; an admin can remove it.`,children:u(He,{rows:g,label:`sign-in links`,isLoading:a||s.some(e=>e.isLoading),loadError:s.find(e=>e.isError)?.error?.message??null,emptyText:`No user has linked a sign-in account.`,expiresNone:`—`,action:{label:`Remove`,icon:Fe,isAvailable:()=>!0,onRun:e=>void _(e),busyId:null,disabled:p.isPending}})})}n();function Nt(){let e=Y(),t=s(),n=et(),r=z(),[a,o]=c(null),l=L({onSuccess:()=>void t.invalidateQueries({queryKey:[[`userManagement`,`listApiKeys`]]}),onError:e=>o(`Revoke failed: ${e.message}`)}),d=i(()=>(r.data??[]).map(e=>Qe(e,n)),[r.data,n]),f=async t=>{await e({title:`Revoke "${t.name}"?`,message:`Any client using this key loses access immediately. This cannot be undone.`,confirmLabel:`Revoke`,variant:`danger`})&&(o(null),l.mutate({id:t.id}))};return u(tt,{notice:Re(a),onDismissNotice:()=>{o(null)},id:`legacy-api-keys`,title:`Legacy API keys`,icon:Ne,description:`Keys from before scoped tokens. Nothing creates them any more; revoke them and issue a scoped token instead.`,children:u(He,{rows:d,label:`legacy API keys`,isLoading:r.isLoading,loadError:r.isError?r.error?.message??`Request failed`:null,emptyText:`No legacy API keys.`,action:{label:`Revoke`,icon:p,isAvailable:()=>!0,onRun:e=>void f(e),busyId:l.isPending?l.variables?.id??null:null,disabled:l.isPending}})})}n();var Pt={one:`linked app`,many:`linked apps`};function Ft(e){if(e.type===`category`){let t=e.target??``;return t===`device`?`all devices`:`all ${t}`}if(e.type===`device`)return`device:[${(e.targets??[]).join(`,`)}]`;let t=e;return`${t.type}:${t.target??``}`}function It(){let e=Y(),t=s(),n=ie(),[r,a]=c(null),o=()=>void t.invalidateQueries({queryKey:[[`userManagement`,`listOauthSessions`]]}),l=oe({onSuccess:o,onError:e=>a(`Revoke failed: ${e.message}`)}),d=Ie(`oauth-session`,Pt,o),f=i(()=>(n.data??[]).map(e=>Ye(e,e.scopes.map(Ft).join(`, `))),[n.data]),m=async t=>{await e({title:`Revoke the "${t.name}" link?`,message:`${t.name} loses access for ${t.ownerName} on its next call. Linking it again needs the account-link flow from the start.`,confirmLabel:`Revoke`,variant:`danger`})&&(a(null),l.mutate({id:t.id}))},h=l.isPending?l.variables?.id??null:null;return u(tt,{notice:Re(r,d.outcome),onDismissNotice:()=>{a(null),d.dismiss()},id:`linked-apps`,title:`Linked apps`,icon:ne,description:`External integrations (Alexa, …) linked to this hub through OAuth. Revoking one stops that integration on its next call. Already-revoked rows can be selected and removed from the list.`,children:u(He,{rows:f,label:`linked apps`,isLoading:n.isLoading,loadError:n.isError?n.error?.message??`Request failed`:null,emptyText:`No linked apps — an integration appears here once it completes the account-link flow.`,expiresNone:`—`,action:{label:`Revoke`,icon:p,isAvailable:e=>e.status===`active`||e.status===`revoked`,onRun:e=>void m(e),busyId:h,disabled:l.isPending||d.busy},bulk:{revoke:d,noun:Pt,isSelectable:e=>e.status===`active`||e.status===`revoked`,quickSelect:[{label:`Select revoked`,match:e=>e.status===`revoked`}]}})})}n();var Lt={one:`session`,many:`sessions`};function Rt(){let e=Y(),t=q.useUtils(),n=et(),r=q.auth.listSessions.useQuery(),[a,o]=c(null),s=()=>void t.auth.listSessions.invalidate(),l=q.auth.revokeSessions.useMutation({onSuccess:s,onError:e=>o(`Sign out failed: ${e.message}`)}),d=Ie(`login-session`,Lt,s),f=i(()=>(r.data??[]).map(e=>Ke(e,n,{client:e=>Le(e).label,method:Je})),[r.data,n]),p=async t=>{await e({title:`Sign out this session`,message:`${t.ownerName} on ${t.name} will have to sign in again.`,confirmLabel:`Sign out`,variant:`danger`})&&(o(null),l.mutate({id:t.id}))};return u(tt,{notice:Re(a,d.outcome),onDismissNotice:()=>{o(null),d.dismiss()},id:`login-sessions`,title:`Login sessions`,icon:Pe,description:`Every browser and app signed in to this hub, for every user. Signing one out ends it at once; it has to sign in again. Your own current session is marked and never included in a bulk sign-out.`,children:u(He,{rows:f,label:`sessions`,isLoading:r.isLoading,loadError:r.isError?r.error?.message??`Request failed`:null,emptyText:`No active sessions.`,action:{label:`Sign out`,icon:xt,isAvailable:e=>e.status===`active`,onRun:e=>void p(e),busyId:l.isPending&&l.variables!==void 0&&`id`in l.variables?l.variables.id:null,disabled:l.isPending||d.busy},bulk:{revoke:d,noun:Lt,isSelectable:e=>e.status===`active`}})})}function zt({token:e,label:t,onClose:n}){return u(b,{open:!0,onOpenChange:e=>!e&&n(),children:r(B,{width:`md`,scroll:`body`,children:[u(T,{children:u(P,{children:`Token: ${t}`})}),r(J,{className:`space-y-3`,children:[u(`div`,{className:`rounded-md border border-warning/30 bg-warning/10 px-3 py-2 text-xs text-warning`,children:`Copy this token now. Once you close this dialog the secret cannot be displayed again.`}),u(`div`,{className:`select-all break-all rounded-md border border-border bg-background p-2 font-mono text-[11px] text-foreground`,children:e})]}),r(W,{children:[u(E,{value:e,label:`Copy`,srLabel:`token`}),u(k,{type:`button`,variant:`primary`,size:`sm`,onClick:n,children:`Done`})]})]})})}var Bt={token:`newToken`,scoped:`newScoped`,admin:`newAdmin`};n();var Vt=7,Ht=90,Ut=80;function Wt(e){let t=Number(e);return Number.isInteger(t)&&t>=1&&t<=Ht?t:null}function Gt({open:e,users:t,onClose:n,onSubmitScoped:i,onSubmitAdmin:a,submitting:s,formError:l,awaitingProof:f}){let{user:p}=Z(),m=p?.isAdmin===!0,h=m?null:p?.scopes??[],[g,_]=c(!1),[v,y]=c(t[0]?.id??``),[b,x]=c(``),[S,w]=c([{type:`capability`,target:``,access:[`view`,`create`]}]),[T,E]=c(``),[O,A]=c(String(Vt));d(()=>{e||(_(!1),y(t[0]?.id??``),x(``),w([{type:`capability`,target:``,access:[`view`,`create`]}]),E(``),A(String(Vt)))},[e,t]);let j=b.trim(),M=U(S),N=Wt(O),P=!g&&v!==``&&j.length>0&&S.length>0&&M===null&&!s,F=g&&m&&j.length>0&&j.length<=Ut&&N!==null&&!s&&!f;return u(je,{open:e,onClose:n,title:g?`Create admin token`:`Create token`,icon:g?I:_e,error:l,width:`md`,testId:`create-token-dialog`,footer:r(k,{type:`button`,variant:g?`danger`:`primary`,size:`sm`,onClick:()=>{if(g){if(!F||N===null)return;a({name:j,expiresInDays:N});return}if(!P)return;let e=parseInt(T,10),t=Number.isFinite(e)&&e>0?Date.now()+e*864e5:void 0;i({userId:v,name:j,scopes:S,...t===void 0?{}:{expiresAt:t}})},disabled:g?!F:!P,children:[s||f?u(C,{className:`h-3.5 w-3.5 animate-spin`,"aria-hidden":!0}):u(g?I:X,{className:`h-3.5 w-3.5`,"aria-hidden":!0}),g?`Create admin token`:`Issue token`]}),children:r(`div`,{className:`space-y-3`,children:[m?r(`label`,{className:`flex items-start gap-2 text-sm text-foreground`,children:[u(`input`,{type:`checkbox`,className:`mt-0.5`,checked:g,onChange:e=>_(e.target.checked),"data-testid":`token-as-admin`}),r(`span`,{children:[u(`span`,{className:`font-medium`,children:`Administrator`}),u(`span`,{className:`block text-[11px] text-foreground-subtle`,children:`Off = scoped to a surface. On = full admin for scripts (audited, max 90 days).`})]})]}):null,g?u(`div`,{className:`space-y-1 rounded-md border border-danger/30 bg-danger/5 px-3 py-2 text-[11px] leading-relaxed text-foreground`,"data-testid":`admin-token-warning`,children:r(`p`,{children:[`An admin token acts as a `,u(`strong`,{children:`full administrator`}),`. Anyone holding it can do anything an admin can. Creating one asks you to confirm it is you.`]})}):null,g?null:r(`div`,{className:`space-y-1`,children:[u(K,{htmlFor:`token-user`,children:`On behalf of user`}),u(we,{id:`token-user`,value:v,onChange:e=>y(e.target.value),options:t.map(e=>({value:e.id,label:e.username}))})]}),u(D,{label:`Name`,required:!0,children:u(ae,{id:`token-name`,value:b,maxLength:Ut,onChange:e=>x(e.target.value),placeholder:g?`nightly-backup`:`cloudflare-tunnel-route`,autoFocus:!0})}),g?r(`div`,{className:`space-y-1`,children:[u(K,{htmlFor:`token-admin-days`,children:`Expires in (days)`}),u(ae,{id:`token-admin-days`,type:`number`,min:1,max:Ht,value:O,onChange:e=>A(e.target.value),state:N===null?`error`:`default`}),N===null?r(`p`,{className:`text-[11px] text-danger`,children:[`Expiry must be a whole number of days, 1 to `,Ht,`.`]}):r(`p`,{className:`text-[11px] text-foreground-subtle`,children:[`Whole number of days, 1 to `,Ht,`.`]})]}):r(o,{children:[r(`div`,{className:`space-y-1`,children:[u(K,{children:`Scopes`}),u(H,{value:S,onChange:w,clampToParent:h}),M&&u(`p`,{className:`text-[10px] text-danger`,children:M}),u(`p`,{className:`text-[10px] text-foreground-subtle`,children:`Each scope picks a (cap or addon) target + one or more access flavours. The token can access ONLY what's listed.`})]}),r(`div`,{className:`space-y-1`,children:[u(K,{htmlFor:`token-scoped-days`,children:`Expires in (days)`}),u(ae,{id:`token-scoped-days`,type:`number`,min:1,value:T,onChange:e=>E(e.target.value),placeholder:`30`}),u(`p`,{className:`text-[10px] text-foreground-subtle`,children:`Leave blank for non-expiring.`})]})]})]})})}n();var Kt={one:`token`,many:`tokens`};function qt(e){return e.type===`device`?`device:[${pe(e.selector)}]`:`${e.type}:${e.target??``}`}function Jt({createRequested:e=!1,onCreateConsumed:t}){let{user:n}=Z(),a=Y(),o=s(),l=q.useUtils(),f=et(),{data:m,isLoading:h}=w(),g=i(()=>m??[],[m]),_=q.useQueries(e=>g.map(t=>e.userManagement.listScopedTokens({userId:t.id}))),v=q.auth.listAdminTokens.useQuery(void 0,{enabled:n?.isAdmin===!0}),{requestProof:y,dialog:b}=We(`Creating an admin token`),{state:x,openNew:C,close:T}=ee({newKey:Bt.token}),[E,D]=c(null),[O,k]=c(null),[A,j]=c(!1),[M,N]=c(null),[P,F]=c(null);d(()=>{e&&(C(),t?.())},[e,C,t]);let I=()=>{o.invalidateQueries({queryKey:[[`userManagement`,`listScopedTokens`]]}),l.auth.listAdminTokens.invalidate(),l.auth.listAuthAudit.invalidate()},L=S({onSuccess:({token:e,record:t})=>{I(),T(),k(null),N({token:e,label:t.name})},onError:e=>{D(`Create failed: ${e.message}`),k(`Create failed: ${e.message}`)}}),R=q.auth.createAdminToken.useMutation({onSuccess:({token:e,record:t})=>{I(),T(),k(null),j(!1),N({token:e,label:t.name})},onError:e=>{D(`Create failed: ${e.message}`),k(`Create failed: ${e.message}`),j(!1)}}),z=Me({onSuccess:()=>{F(null),I()},onError:e=>{F(null),D(`Revoke failed: ${e.message}`)}}),B=q.auth.revokeAdminToken.useMutation({onSuccess:()=>{F(null),I()},onError:e=>{F(null),D(`Revoke failed: ${e.message}`)}}),V=$e(Kt,I),H=Date.now(),te=g.flatMap((e,t)=>(_[t]?.data??[]).map(t=>Ue(t,e.id,f,t.scopes.map(qt).join(`, `),H))),ne=n?.isAdmin===!0?(v.data??[]).map(e=>Ge(e,f,H)):[],re=[...te,...ne],U=_.find(e=>e.isError)?.error?.message??(v.isError?v.error?.message??`Request failed`:null),ie=async e=>{let t=e.kind===ze;await a({title:`Revoke "${e.name}"?`,message:t?`Every script using it loses access immediately. This cannot be undone.`:`${e.ownerName}'s scoped token stops working on its next use. This cannot be undone.`,confirmLabel:`Revoke`,variant:`danger`})&&(D(null),F(e.id),t?B.mutate({id:e.id}):z.mutate({id:e.id}))},W=L.isPending||R.isPending;return r(`div`,{"data-testid":`tokens`,children:[b,u(tt,{notice:Re(E,V.outcome),onDismissNotice:()=>{D(null),V.dismiss()},id:`tokens`,title:`Tokens`,icon:_e,description:`Scoped tokens for a narrow surface, and admin tokens for full-administrator scripts. Revoking one stops it on its next use.`,children:u(He,{rows:re,label:`tokens`,isLoading:h||_.some(e=>e.isLoading)||n?.isAdmin===!0&&v.isLoading,loadError:U,emptyText:`No tokens.`,action:{label:`Revoke`,icon:p,isAvailable:e=>e.status===`active`,onRun:e=>void ie(e),busyId:P,disabled:V.busy||P!==null},bulk:{revoke:V,noun:Kt,isSelectable:e=>e.status===`active`}})}),u(Gt,{open:x.mode===`new`,users:g.map(e=>({id:e.id,username:e.username})),onClose:()=>{T(),k(null),j(!1)},submitting:W,formError:O,awaitingProof:A,onSubmitScoped:e=>L.mutate(e),onSubmitAdmin:e=>{(async()=>{D(null),k(null),j(!0);let t=await y();j(!1),t!==null&&R.mutate({...e,reauthToken:t})})()}}),M&&u(zt,{token:M.token,label:M.label,onClose:()=>N(null)})]})}var Yt={"share-link":`share links`,"admin-token":`admin tokens`,"login-session":`login sessions`};function Q(e,t){let n=e[t];return typeof n==`string`&&n.length>0?n:null}function Xt(e,t){let n=Q(e,`tokenId`);return Q(e,`name`)??(n===null?void 0:t.get(n))??n??`?`}function Zt(e){return e.filter(e=>e!==null)}function Qt(e){let t=Q(e,`prefix`);return t===null?null:`Prefix ${t}…`}function $t(e,t){let n=e.detail??{};switch(e.action){case`admin-token-created`:{let e=n.expiresAt;return{title:`Admin token "${Xt(n,t)}" created`,details:Zt([Qt(n),typeof e==`number`?`Expires ${Xe(e)}`:null])}}case`admin-token-used`:{let e=Q(n,`path`);return{title:`Admin token "${Xt(n,t)}" used`,details:Zt([Qt(n),e===null?null:`Call ${e}`])}}case`admin-token-revoked`:return{title:`Admin token "${Xt(n,t)}" revoked`,details:Zt([Qt(n)])};case`credentials-revoked`:{let e=Q(n,`kind`)??`credential`,t=n.revoked,r=n.skipped,i=Yt[e]??`${e}s`;return{title:`${typeof t==`number`?String(t):`?`} ${i} revoked in bulk`,details:Zt([typeof r==`number`&&r>0?`${String(r)} skipped`:null,Q(n,`ids`)===null?null:`Ids ${Q(n,`ids`)??``}`])}}case`second-factor-skipped`:{let e=Q(n,`method`),t=Q(n,`factors`);return{title:`Second factor skipped on a trusted network`,details:Zt([e===null?null:`Signed in with ${Je(e)}`,t===null?null:`Skipped: ${t.split(`,`).join(`, `)}`])}}default:return{title:e.action,details:Object.entries(n).map(([e,t])=>`${e}: ${String(t)}`)}}}n();var en=100;function tn(){let{user:e}=Z();return e?.isAdmin?u(rn,{}):null}function nn(){let{data:e}=w(),{data:t}=q.auth.listAdminTokens.useQuery();return i(()=>{let n=new Map;for(let t of e??[])n.set(t.id,t.username);let r=new Map;for(let e of t??[])r.set(e.id,e.name);return{userNameById:n,tokenNameById:r}},[e,t])}function rn(){let e=q.auth.listAuthAudit.useQuery({limit:en}),{userNameById:t,tokenNameById:n}=nn(),i=e.data??[];return r(`div`,{"data-testid":`auth-audit`,className:`rounded-lg border border-border bg-surface overflow-hidden`,children:[r(`div`,{className:`px-4 py-2.5 border-b border-border flex items-center gap-2`,children:[u(_,{className:`h-3.5 w-3.5 text-foreground-subtle`}),u(`div`,{className:`text-xs font-semibold text-foreground`,children:`Authentication audit`}),r(`span`,{className:`ml-auto text-[10px] text-foreground-subtle`,children:[`Latest `,en,`, newest first`]})]}),u(`div`,{className:`p-4`,children:e.isLoading?r(`div`,{className:`flex items-center gap-2 text-xs text-foreground-subtle`,children:[u(C,{className:`h-3.5 w-3.5 animate-spin`}),`Loading audit trail…`]}):e.isError?r(`div`,{className:`text-[11px] text-danger`,children:[`Could not load the audit trail: `,e.error?.message??`Request failed`]}):i.length===0?r(`div`,{className:`rounded border border-dashed border-border px-3 py-4 text-xs text-foreground-subtle text-center space-y-1`,children:[u(`div`,{children:`No authentication events recorded yet.`}),u(`div`,{className:`text-[11px] text-foreground-subtle/90`,children:`This trail records admin-token create/use/revoke, trusted-network 2FA skips, and credential revokes (including single share-link revoke). Browser password logins are not listed here.`})]}):u(`ul`,{className:`divide-y divide-border rounded-md border border-border max-h-[420px] overflow-y-auto`,children:i.map(e=>u(an,{record:e,userName:e.userId===void 0?null:t.get(e.userId)??e.userId,tokenNameById:n},e.id))})})]})}function an({record:e,userName:t,tokenNameById:n}){let i=$t(e,n);return r(`li`,{"data-testid":`auth-audit-row`,className:`px-3 py-2 text-xs space-y-0.5`,children:[r(`div`,{className:`flex flex-wrap items-baseline gap-x-2`,children:[u(`span`,{className:`font-medium text-foreground`,children:i.title}),u(`span`,{className:`ml-auto text-[10px] text-foreground-subtle`,children:Xe(e.at)})]}),r(`div`,{className:`flex flex-wrap gap-x-3 text-[11px] text-foreground-subtle`,children:[t!==null&&u(`span`,{className:`text-foreground`,children:t}),e.ip!==void 0&&u(`span`,{className:`font-mono`,children:e.ip}),i.details.map(e=>u(`span`,{className:`font-mono`,children:e},e))]})]})}n();var $={loginSessions:`login-sessions`,linkedApps:`linked-apps`,tokens:`tokens`,scopedTokens:`scoped-tokens`,adminTokens:`admin-tokens`,shareLinks:`share-links`,legacyApiKeys:`legacy-api-keys`,externalIdentities:`external-identities`,audit:`auth-audit`},on={[$.scopedTokens]:$.tokens,[$.adminTokens]:$.tokens};function sn(e){return[{id:$.loginSessions,label:`Login sessions`,icon:Pe,render:()=>u(Rt,{})},{id:$.linkedApps,label:`Linked apps`,icon:ne,render:()=>u(It,{})},{id:$.tokens,label:`Tokens`,icon:_e,render:({createRequested:e,onCreateConsumed:t})=>u(Jt,{headerOwnsCreate:!0,createRequested:e,onCreateConsumed:t})},{id:$.shareLinks,label:`Share links`,icon:G,render:()=>u(qe,{})},...e?[{id:$.legacyApiKeys,label:`Legacy API keys`,icon:Ne,render:()=>u(Nt,{})}]:[],{id:$.externalIdentities,label:`Sign-in links`,icon:ht,render:()=>u(Mt,{})},{id:$.audit,label:`Audit`,icon:_,render:()=>u(tn,{})}]}function cn({createRequested:e=!1,onCreateConsumed:t}){let n=z(),a=(n.data??[]).length>0,o=i(()=>sn(a),[a]),s=wt({ids:i(()=>o.map(e=>e.id),[o]),answered:!n.isLoading}),c=mt(),[l]=ut(),d=l.get(`integration`),f=d===null?void 0:on[d];if(f!==void 0){let e=new URLSearchParams(l);return e.set(`integration`,f),u(ft,{to:`?${e.toString()}`,replace:!0})}let p=o.find(e=>e.id===s.selectedId)??o[0],m=p?.id??$.loginSessions;return n.isLoading?u(`div`,{className:`text-sm text-foreground-subtle`,"data-testid":`access-page`,children:`Loading…`}):r(`div`,{className:`flex flex-col gap-3`,"data-testid":`access-page`,children:[u(ge,{appearance:`pills`,value:m,onValueChange:e=>{c(`?${_t(l,e,null,null).toString()}`)},children:u(Ce,{"aria-label":`Credential kinds`,children:o.map(e=>r(Te,{value:e.id,"data-testid":`access-kind-${e.id}`,children:[u(e.icon,{className:`h-3.5 w-3.5 shrink-0`,"aria-hidden":!0}),e.label]},e.id))})}),p===void 0?null:u(`div`,{role:`region`,"aria-label":p.label,"data-testid":`access-kind-body`,children:p.render({createRequested:e&&p.id===$.tokens,onCreateConsumed:t??(()=>void 0)})},p.id)]})}function ln(e,t){if(e===$.tokens)return r(k,{size:`sm`,type:`button`,"data-testid":`access-new-token`,onClick:t,children:[u(_e,{className:`h-3.5 w-3.5`,"aria-hidden":!0}),`New token`]})}function un(){let[e,t]=c(!1);return{createRequested:e,requestCreate:()=>t(!0),clearCreate:()=>t(!1)}}n();var dn=[`oidcConnections`,`listConnections`],fn=[`oidcConnections`,`connectionFormSchema`],pn={displayName:`OpenID Connect`,icon:`shield-check`,issuerUrl:``,clientId:``,clientSecret:``,redirectUri:``,scopes:`openid profile email`,usernameClaim:`preferred_username`},mn=/^[a-z0-9][a-z0-9-]{0,63}$/;function hn(e){return e instanceof Error?e.message:String(e)}function gn(e,t){if(t)return typeof e==`string`&&e.length>0?e:void 0;if(it(e))return ot;if(typeof e==`string`&&e.length>0)return e;rt(e)}function _n(e){return typeof e!=`object`||!e?!1:Array.isArray(Reflect.get(e,`sections`))}function vn({addonId:n}){let f=h(),m=s(),g=Y(),_=ee({editKey:`oidcEdit`,newKey:`oidcNew`}),[v,y]=c(!1),[b,x]=c(null),[S,C]=c(``),[w,T]=c({...pn}),E=t(null),D=a({queryKey:[...dn,n],queryFn:async()=>f.trpcClient.oidcConnections.listConnections.query({})}),O=a({queryKey:fn,queryFn:async()=>f.trpcClient.oidcConnections.connectionFormSchema.query({})}),A=D.data??[],j=_n(O.data)?O.data:void 0,N=_.state,P=N.mode===`edit`?A.find(e=>e.id===N.id)??null:null;d(()=>{if(_.state.mode===`edit`&&P!==null){let e=`edit:${P.id}`;if(E.current===e)return;E.current=e,x(null),C(P.id),T(P.formValues===void 0?{...pn}:{...P.formValues});return}if(_.state.mode===`new`){if(E.current===`new`)return;E.current=`new`,x(null),C(``),T({...pn})}},[P,_.state]);let F=e(async()=>{await m.invalidateQueries({queryKey:dn})},[m]),I=l({mutationFn:async e=>f.trpcClient.oidcConnections.deleteConnection.mutate({id:e}),onSuccess:async()=>F()}),L=e(async e=>{await g({title:`Delete OIDC connection?`,message:`Remove “${e.displayName}” (${e.id}). The login button and IdP credentials for this id are dropped.`,confirmLabel:`Delete`,cancelLabel:`Cancel`,variant:`danger`})&&(await I.mutateAsync(e.id),_.state.mode===`edit`&&_.state.id===e.id&&(_.close(),E.current=null))},[g,I,_]),R=e(async()=>{let e=w.displayName,t=typeof e==`string`&&e.trim()!==``?e.trim():``;if(t===``){x(`Display name is required.`);return}let n=_.state.mode===`new`,r=n?S.trim():P?.id??``;if(n&&!mn.test(r)){x(`Instance id must be a lowercase slug (e.g. authentik, google).`);return}if(r===``){x(`That connection is no longer available.`);return}let i=gn(w.clientSecret,n),a=w.icon,o=w.issuerUrl,s=w.clientId,c=w.redirectUri,l=w.scopes,u=w.usernameClaim,d=u===`email`||u===`sub`?u:`preferred_username`;y(!0),x(null);try{n&&await f.trpcClient.oidcConnections.createConnection.mutate({id:r,displayName:t}),await f.trpcClient.oidcConnections.updateConnection.mutate({id:r,displayName:t,icon:typeof a==`string`?a:`shield-check`,issuerUrl:typeof o==`string`?o:``,clientId:typeof s==`string`?s:``,...i===void 0?{}:{clientSecret:i},redirectUri:typeof c==`string`?c:``,scopes:typeof l==`string`?l:`openid profile email`,usernameClaim:d}),await F(),_.close(),E.current=null}catch(e){x(hn(e))}finally{y(!1)}},[S,P?.id,_,w,F,f]),z=i(()=>[{key:`id`,header:`Id`,sortValue:e=>e.id,render:e=>u(`span`,{className:`font-mono text-xs text-foreground`,children:e.id})},{key:`name`,header:`Name`,sortValue:e=>e.displayName,render:e=>u(`span`,{className:`truncate font-medium text-foreground`,children:e.displayName})},{key:`issuer`,header:`Issuer`,sortValue:e=>e.issuerUrl,render:e=>u(`span`,{className:`truncate text-xs text-foreground-muted`,children:e.issuerUrl===``?`—`:e.issuerUrl})},{key:`status`,header:`Status`,notSortableReason:`Badge`,render:e=>u(De,{variant:e.configured?`success`:`warning`,children:e.configured?`Configured`:`Not configured`})},{key:`actions`,header:``,align:`right`,notSortableReason:`Row actions`,nowrap:!0,render:e=>r(`div`,{className:`flex justify-end gap-1`,children:[u(k,{type:`button`,size:`sm`,variant:`secondary`,onClick:t=>{t.stopPropagation(),_.openEdit(e.id)},children:`Edit`}),u(k,{type:`button`,size:`sm`,variant:`ghost`,"aria-label":`Delete ${e.displayName}`,title:`Delete`,onClick:t=>{t.stopPropagation(),L(e)},children:u(p,{className:`h-3.5 w-3.5 text-danger`})})]})}],[_,L]),B=_.state.mode===`new`,V=B||P!==null,H=B?`new`:P===null?`closed`:`edit:${P.id}:${P.configured?`cfg`:`empty`}`;return r(`div`,{className:`flex min-h-0 flex-col gap-3`,"data-testid":`oidc-settings-connections`,children:[r(`div`,{className:`flex flex-wrap items-center justify-between gap-2`,children:[r(`p`,{className:`text-sm text-foreground-muted`,children:[`Each row is one IdP. Redirect URI:`,` `,u(`span`,{className:`font-mono text-xs`,children:`/addon/${n}/<id>/callback`})]}),r(k,{type:`button`,size:`sm`,"data-testid":`oidc-connections-add`,onClick:()=>_.openNew(),children:[u(he,{className:`h-3.5 w-3.5`}),`Add connection`]})]}),D.isError?u(`p`,{className:`text-sm text-danger`,children:`Could not load connections.`}):null,D.isPending?u(de,{className:`h-32 w-full`}):u(M,{columns:z,rows:A,rowKey:e=>e.id,pageSize:25,mobileMode:`scroll`,emptyMessage:`No OIDC connections yet. Add one to register an IdP.`,onRowClick:e=>_.openEdit(e.id),defaultSort:{columnKey:`name`,dir:`asc`}}),u(je,{open:V,onClose:()=>{_.close(),x(null),E.current=null},title:B?`Add OIDC connection`:`Edit ${P?.displayName??`connection`}`,icon:X,width:`xl`,testId:`oidc-connection-editor`,error:b,footer:u(k,{type:`button`,size:`sm`,disabled:v||B&&S.trim()===``,onClick:()=>void R(),children:v?`Saving…`:`Save`}),children:V?r(o,{children:[B?r(`div`,{children:[u(K,{htmlFor:`oidc-connection-id`,children:`Instance id`}),u(ae,{id:`oidc-connection-id`,value:S,onChange:e=>C(e.target.value),placeholder:`authentik`,autoComplete:`off`}),u(`p`,{className:`mt-1 text-xs text-foreground-muted`,children:`URL slug — appears in /addon/${n}/<id>/callback. Stable; renaming is not supported after save.`})]}):r(`p`,{className:`text-sm text-foreground-muted`,children:[`Instance id: `,u(`span`,{className:`font-mono`,children:P?.id})]}),j===void 0?u(`p`,{className:`text-sm text-foreground-muted`,children:`Loading form…`}):u(se,{schema:j,values:w,onChange:T,bare:!0},H)]}):null})]})}n();var yn=3e4,bn=[{capName:`auth-provider`,stageBadge:null},{capName:`user-passkeys`,stageBadge:`Second factor`}],xn={title:`Authentication`,subtitle:`Login providers (local password, OIDC, SAML) and second-factor providers (passkeys / WebAuthn). They run in parallel — enable or disable each independently; disabling one only removes that method, local password login is unaffected.`,emptyTitle:`No authentication providers registered`,emptyDescription:`Local auth should always be available — if this list is empty the local-auth builtin failed to register. Check the Addons page for load errors.`,installLabel:`Add provider`};function Sn(e){return e===`local-auth`?{headline:`Username + password (local).`,icon:jt,bullets:[`Users live in the hub’s SQLite database — no IdP roundtrip.`,`TOTP / 2FA is self-enrolled: each user enables it from their own profile page (My access → Two-factor authentication).`,`Scoped tokens, admin tokens and sessions are managed from Identity → Tokens & sessions.`],setupSteps:[`A fresh hub has one account, admin / changeme — the first sign-in asks for a new password. Add users from Users → New user.`,`Hand out either passwords or scoped tokens — both validate through this provider.`]}:e.startsWith(`auth-oidc`)?{headline:`OpenID Connect (Google, Microsoft, Okta, Keycloak, …).`,icon:yt,bullets:[`Three-leg redirect flow with PKCE S256 + nonce.`,`id_token is signature-verified against the IdP’s JWKS — no implicit trust.`,`Explicit linking only: an IdP account signs in only the CamStack user who linked it from their profile (My access → Linked sign-in accounts). No auto-created users, no email matching.`,`The linked user’s role, scopes and two-factor authentication apply.`],setupSteps:[`Register a web app at your IdP and copy the client_id + client_secret.`,"Choose a stable instance id (slug). Set the IdP redirect URI to `https://<this-hub>/addon/auth-oidc/<id>/callback`.",`In Settings below, Add connection — enter the id, issuer, and credentials; Save.`,`Each user then links their IdP account from My access → Linked sign-in accounts.`]}:e.startsWith(`auth-saml`)?{headline:`SAML 2.0 — enterprise SSO (Azure AD, Okta, OneLogin).`,icon:yt,bullets:[`Heavier handshake than OIDC — exchange metadata XML with your IdP.`,`Group → role mapping via SAML assertions.`]}:e.startsWith(`auth-webauthn`)||e.startsWith(`auth-passkey`)?{headline:`Passkeys / WebAuthn — passwordless second factor.`,icon:ue,bullets:[`Enroll a YubiKey, Touch ID, or platform passkey per user.`,`Resistant to phishing — the browser binds the credential to your hub origin.`]}:e.startsWith(`auth-totp`)?{headline:`TOTP — second factor.`,icon:ue,bullets:[`Time-based codes from an authenticator app (RFC 6238).`,`Compatible with Google Authenticator, Aegis, 1Password, Bitwarden, etc.`]}:{headline:`Authentication provider.`,icon:X,bullets:[`Generic authentication provider. No additional hints registered.`]}}function Cn(){let e=V({capName:bn[0].capName},{refetchInterval:yn}),t=V({capName:bn[1].capName},{refetchInterval:yn}),n=ye(void 0,{refetchInterval:yn}),r=i(()=>kt(n.data??[]),[n.data]),a=i(()=>{let n=[],i=[e.data??[],t.data??[]];for(let[e,t]of bn.entries())for(let a of i[e]??[])n.push({addonId:a.addonId,displayName:r.get(a.addonId)??a.addonId,isActive:a.isActive,capName:t.capName,stageBadge:t.stageBadge});return n},[e.data,t.data,r]),o=[{id:`authentication`,label:`Authentication providers`,install:{capability:bn[0].capName,label:xn.installLabel},entries:a.map(e=>({id:e.addonId,name:e.displayName,fallbackIcon:X,...Ot(e.isActive),render:()=>u(Tt,{addonId:e.addonId,displayName:e.displayName,capName:e.capName,isActive:e.isActive,badges:e.stageBadge===null?null:u(De,{variant:`info`,className:Et,children:e.stageBadge}),settingsContent:e.addonId.startsWith(`auth-oidc`)?u(vn,{addonId:e.addonId}):void 0,panels:[{id:`about`,title:`About`,icon:Sn(e.addonId).icon,content:u(wn,{addonId:e.addonId})}]})}))}];return u(Dt,{embedded:!0,icon:X,title:xn.title,subtitle:xn.subtitle,groups:o,isLoading:e.isLoading||t.isLoading,emptyTitle:xn.emptyTitle,emptyDescription:xn.emptyDescription})}function wn({addonId:e}){let t=Sn(e),n=t.icon;return r(`div`,{className:`space-y-3 rounded-lg border border-border bg-surface p-2 sm:p-4`,children:[r(`div`,{className:`flex items-start gap-2.5`,children:[u(n,{className:`h-4 w-4 mt-0.5 text-primary shrink-0`}),u(`div`,{className:`text-xs text-foreground font-medium`,children:t.headline})]}),u(`ul`,{className:`text-xs text-foreground-subtle space-y-1.5 pl-6 list-disc`,children:t.bullets.map((e,t)=>u(`li`,{children:e},t))}),t.setupSteps&&t.setupSteps.length>0&&r(`div`,{className:`rounded-md border border-border bg-surface-hover/40 px-3 py-2.5 space-y-1.5`,children:[r(`div`,{className:`flex items-center gap-1.5 text-[10px] font-semibold text-foreground-subtle uppercase tracking-wide`,children:[u(At,{className:`h-3 w-3`}),`Setup steps`]}),u(`ol`,{className:`text-xs text-foreground space-y-0.5 pl-4 list-decimal`,children:t.setupSteps.map((e,t)=>u(`li`,{children:e},t))})]}),e===`local-auth`&&r(`div`,{className:`rounded-md border border-info/30 bg-info/5 px-3 py-2 flex items-start gap-2 text-[11px] text-foreground`,children:[u(R,{className:`h-3.5 w-3.5 mt-0.5 text-info shrink-0`}),r(`span`,{children:[`TOTP / 2FA is self-service: each user enrols from their own profile page —`,` `,u(pt,{to:`/system/my-access`,className:`underline text-primary`,children:`My access`}),` `,`→ “Two-factor authentication” → Enable 2FA. Admins can only remove a user’s active enrollment (lost device) from the`,` `,u(pt,{to:`/system/identity?tab=users`,className:`underline text-primary`,children:`Users`}),` `,`page via Actions → “Remove 2FA”.`]})]})]})}function Tn({userId:e,username:t,onClose:n}){let i=Y(),a=q.useUtils(),o=te({userId:e}),s=q.auth.listLoginMethods.useQuery(),c=le({onSuccess:()=>void a.userManagement.listExternalIdentities.invalidate()}),l=new Map((s.data??[]).flatMap(e=>e.kind===`redirect`?[[e.id,e.label]]:[])),d=o.data??[],f=async(n,r)=>{await i({title:`Remove sign-in link`,message:`"${t}" will no longer be able to sign in with this ${r} account.`,confirmLabel:`Remove`,variant:`danger`})&&c.mutate({userId:e,provider:n.provider,subject:n.subject})};return u(b,{open:!0,onOpenChange:e=>!e&&n(),children:r(B,{width:`md`,placement:`sheet-on-mobile`,scroll:`body`,"data-testid":`external-identities-modal`,children:[u(T,{children:r(P,{className:`flex items-center gap-2`,children:[u(ne,{className:`h-4 w-4 text-primary`}),r(`span`,{children:[`Linked sign-in accounts`,r(`span`,{className:`mt-0.5 block text-[11px] font-normal text-foreground-subtle`,children:[`User: `,u(`span`,{className:`font-mono`,children:t})]})]})]})}),u(J,{className:`space-y-3`,children:o.isLoading?r(`div`,{className:`flex items-center gap-2 text-xs text-foreground-subtle`,children:[u(C,{className:`h-3.5 w-3.5 animate-spin`}),`Loading…`]}):d.length===0?u(`p`,{className:`text-xs text-foreground-subtle`,children:`No linked accounts. Only the user can link one, from their own profile page.`}):u(`ul`,{className:`divide-y divide-border rounded-md border border-border`,children:d.map(e=>{let t=l.get(e.provider),n=t??e.provider;return r(`li`,{className:`flex items-center gap-3 px-3 py-2 text-xs`,children:[r(`div`,{className:`flex-1 min-w-0`,children:[r(`div`,{className:`font-medium text-foreground truncate`,children:[n,t===void 0&&u(`span`,{className:`ml-2 rounded bg-foreground-subtle/15 px-1.5 py-0.5 text-[10px] font-normal text-foreground-subtle`,children:`provider unavailable`})]}),r(`div`,{className:`text-[11px] text-foreground-subtle truncate`,children:[e.label??e.subject,` ·`,` `,new Date(e.linkedAt).toLocaleDateString()]})]}),r(`button`,{onClick:()=>void f(e,n),disabled:c.isPending,className:`inline-flex items-center gap-1 rounded px-2 py-1 text-[10px] text-danger hover:bg-danger/10 disabled:opacity-50`,children:[u(Fe,{className:`h-3 w-3`}),`Remove`]})]},`${e.provider}|${e.subject}`)})})}),u(W,{children:u(k,{onClick:n,variant:`secondary`,children:`Close`})})]})})}function En({userId:e,username:t,onClose:n}){let i=s(),a=Y(),c=ve({userId:e}),l=c.data,d=()=>i.invalidateQueries({queryKey:[[`userManagement`,`getTotpStatus`]]}),f=y({onSuccess:()=>{d(),n()}}),p=c.isLoading?`loading`:l?.enabled?`enrolled`:`not_enrolled`;return u(b,{open:!0,onOpenChange:e=>!e&&n(),children:r(B,{width:`md`,placement:`sheet-on-mobile`,scroll:`body`,children:[u(T,{children:r(P,{className:`flex items-center gap-2`,children:[u(ue,{className:`h-4 w-4 text-primary`}),r(`span`,{children:[`Two-factor authentication`,r(`span`,{className:`mt-0.5 block text-[11px] font-normal text-foreground-subtle`,children:[`User: `,u(`span`,{className:`font-mono`,children:t})]})]})]})}),r(J,{className:`space-y-4`,children:[p===`loading`&&r(`div`,{className:`flex items-center gap-2 text-xs text-foreground-subtle`,children:[u(C,{className:`h-3.5 w-3.5 animate-spin`}),`Checking status…`]}),p===`not_enrolled`&&r(`div`,{className:`rounded-md border border-border bg-surface-hover/30 px-3 py-2.5 flex items-start gap-2.5 text-xs text-foreground-subtle`,children:[u(R,{className:`h-4 w-4 mt-0.5 shrink-0`}),r(`div`,{children:[u(`div`,{className:`font-medium text-foreground`,children:`2FA not enrolled`}),u(`p`,{className:`mt-0.5`,children:`Only the user themselves can enable 2FA, from their own profile page.`})]})]}),p===`enrolled`&&l&&r(o,{children:[r(`div`,{className:`rounded-md border border-emerald-500/30 bg-emerald-500/5 px-3 py-2.5 flex items-start gap-2.5`,children:[u(me,{className:`h-4 w-4 mt-0.5 text-emerald-500 shrink-0`}),r(`div`,{className:`text-xs text-foreground space-y-0.5`,children:[u(`div`,{className:`font-medium`,children:`2FA is active`}),r(`div`,{className:`text-foreground-subtle`,children:[`Enrolled on`,` `,l.confirmedAt?new Date(l.confirmedAt).toLocaleString():`—`]})]})]}),u(`div`,{className:`text-[11px] text-foreground-subtle`,children:`Removing here clears the server-side secret. Use this only when the user has lost access — they'll have to re-enroll from their profile page afterwards.`}),r(`div`,{className:`flex justify-end gap-2`,children:[u(k,{onClick:n,variant:`secondary`,children:`Close`}),r(`button`,{onClick:async()=>{await a({title:`Remove 2FA`,message:`Remove two-factor authentication for "${t}"? They'll be able to log in with just their password until they re-enroll from their own profile page.`,confirmLabel:`Remove`,variant:`danger`})&&f.mutate({userId:e})},disabled:f.isPending,className:`rounded bg-danger px-3 py-1.5 text-xs font-medium text-white hover:bg-danger/90 disabled:opacity-50 inline-flex items-center gap-1`,children:[f.isPending?u(C,{className:`h-3 w-3 animate-spin`}):u(Se,{className:`h-3 w-3`}),`Remove 2FA`]})]})]})]})]})})}n();function Dn({userId:e,username:t,onClose:n}){let{user:i,logout:a}=Z(),o=i?.id===e,s=Y(),l=q.useUtils(),d=q.auth.listSessions.useQuery({userId:e}),[f,p]=c(null),m=q.auth.revokeSessions.useMutation({onSuccess:(e,t)=>{if(o&&`userId`in t){a();return}l.auth.listSessions.invalidate()},onError:e=>p(`Sign out failed: ${e.message}`)}),h=async e=>{await s({title:`Sign out this session`,message:`"${t}" on ${Le(e.client).label} will have to sign in again.`,confirmLabel:`Sign out`,variant:`danger`})&&(p(null),m.mutate({id:e.id}))},g=async()=>{await s({title:`Sign out everywhere`,message:o?`Every session of your own account ends, this browser included: you will be signed out here too.`:`Every session of "${t}" ends at once; each device has to sign in again.`,confirmLabel:`Sign out everywhere`,variant:`danger`})&&(p(null),m.mutate({userId:e}))},_=m.isPending&&m.variables!==void 0&&`id`in m.variables?m.variables.id:null;return u(b,{open:!0,onOpenChange:e=>!e&&n(),children:r(B,{width:`lg`,placement:`sheet-on-mobile`,scroll:`body`,"data-testid":`user-sessions-modal`,children:[u(T,{children:r(P,{className:`flex items-center gap-2`,children:[u(Pe,{className:`h-4 w-4 text-primary`}),r(`span`,{children:[`Active sessions`,r(`span`,{className:`mt-0.5 block text-[11px] font-normal text-foreground-subtle`,children:[`User: `,u(`span`,{className:`font-mono`,children:t})]})]})]})}),r(J,{className:`space-y-3`,children:[f!==null&&u(`div`,{className:`text-[11px] text-danger`,children:f}),u(Ze,{sessions:d.data??[],isLoading:d.isLoading,loadError:d.isError?d.error?.message??`Request failed`:null,emptyText:`No active sessions.`,onRevoke:e=>void h(e),revokingId:_})]}),r(W,{className:`justify-between`,children:[r(`button`,{onClick:()=>void g(),disabled:m.isPending||(d.data??[]).length===0,className:`inline-flex items-center gap-1.5 rounded border border-danger/40 px-2.5 py-1 text-[11px] font-medium text-danger hover:bg-danger/10 disabled:opacity-50`,children:[m.isPending&&_===null?u(C,{className:`h-3 w-3 animate-spin`}):u(xt,{className:`h-3 w-3`}),`Sign out everywhere`]}),u(k,{onClick:n,variant:`secondary`,children:`Close`})]})]})})}function On({icon:e,label:t,count:n,all:i,total:a}){return r(`div`,{className:`flex items-center gap-2 text-[11px]`,children:[u(e,{className:`h-3 w-3 shrink-0 text-foreground-subtle`}),u(`span`,{className:`min-w-0 flex-1 text-foreground-subtle`,children:t}),u(`span`,{className:n===0?`text-foreground-subtle`:`font-medium text-foreground`,children:n===0?`none`:i?`all ${a}`:`${n} of ${a}`})]})}function kn({scopes:e,isAdmin:t,invalidReason:n}){let i=h(),s=a({queryKey:[`auth`,`previewScope`,e,t],enabled:n===null,queryFn:()=>i.trpcClient.auth.previewScope.query({scopes:[...e],isAdmin:t})}),{data:c}=Oe({projection:`slim`}),l=c?.length??0;if(n!==null)return u(`div`,{className:`rounded-lg border border-border bg-surface p-3`,children:r(`p`,{className:`flex items-center gap-1.5 text-[11px] text-warning`,children:[u(I,{className:`h-3 w-3 shrink-0`}),n]})});if(s.isLoading)return r(`div`,{className:`flex items-center gap-2 rounded-lg border border-border bg-surface p-3 text-[11px] text-foreground-subtle`,children:[u(C,{className:`h-3 w-3 animate-spin`}),`Resolving…`]});if(s.isError||!s.data)return u(`div`,{className:`rounded-lg border border-border bg-surface p-3`,children:u(`p`,{className:`text-[11px] text-danger`,children:`Could not resolve this grant set. Saving is still allowed — the server enforces the same rules either way.`})});let d=s.data;return u(`div`,{className:`space-y-2 rounded-lg border border-border bg-surface p-3`,children:d.isAdmin?r(`p`,{className:`text-[11px] text-foreground`,children:[u(`span`,{className:`font-medium`,children:`Administrator`}),` — unrestricted. Grants are ignored for an admin.`]}):r(o,{children:[u(On,{icon:O,label:`Devices they can see`,count:d.device.view.deviceCount,all:d.device.view.all,total:l}),u(On,{icon:xe,label:`Devices they can operate`,count:d.device.create.deviceCount,all:d.device.create.all,total:l}),u(On,{icon:p,label:`Devices they can delete`,count:d.device.delete.deviceCount,all:d.device.delete.all,total:l}),r(`div`,{className:`border-t border-border pt-2 text-[10px] text-foreground-subtle`,children:[`System access: `,d.system.length===0?`none`:d.system.join(`, `),d.capabilities.length>0&&r(o,{children:[` · Extra capabilities: `,d.capabilities.map(e=>e.name).join(`, `)]}),d.addons.length>0&&r(o,{children:[` · Addons: `,d.addons.map(e=>e.name).join(`, `)]})]}),d.device.view.deviceCount===0&&u(`p`,{className:`text-[10px] text-warning`,children:`This user will not be able to see any device.`})]})})}n();function An(e){let t=st(e);return t===null?{mode:e.length===0?`role`:`advanced`,roleId:null,selector:{kind:`all`},includeLinked:!0,advancedScopes:e}:{mode:`role`,roleId:t.roleId,selector:t.selector,includeLinked:t.includeLinked,advancedScopes:e}}function jn(e){return e.mode===`advanced`?e.advancedScopes:e.roleId===null?[]:nt({roleId:e.roleId,selector:e.selector,includeLinked:e.includeLinked})}function Mn({user:e,onClose:t,onSubmit:n,submitting:a,callerScopes:s}){let l=i(()=>An(e.scopes??[]),[e.scopes]),[d,p]=c(l),[h,g]=c(l.mode===`advanced`),_=i(()=>jn(d),[d]),v=!e.isAdmin&&d.mode===`role`&&d.roleId===null,y=i(()=>e.isAdmin?null:d.mode===`role`&&d.roleId===null?`Pick what this user can do to see the result.`:U(_),[e.isAdmin,d.mode,d.roleId,_]),x=e=>p({...d,...e});return u(b,{open:!0,onOpenChange:e=>!e&&t(),children:r(B,{width:`lg`,placement:`sheet-on-mobile`,scroll:`body`,className:`md:max-w-2xl`,children:[r(T,{children:[r(P,{children:[`Access — `,e.username]}),u(`p`,{className:`text-[10px] text-foreground-subtle`,children:e.isAdmin?`This user is an administrator — they can do everything, and the settings below are ignored.`:`Choose what they can do, then which devices it applies to.`})]}),r(J,{className:`space-y-4`,children:[v&&r(`div`,{className:`flex items-start gap-2 rounded-lg border border-warning/40 bg-warning/10 p-3`,children:[u(I,{className:`mt-0.5 h-3.5 w-3.5 shrink-0 text-warning`}),r(`p`,{className:`text-[11px] text-foreground`,children:[u(`span`,{className:`font-medium`,children:`No access.`}),` `,r(`span`,{className:`text-foreground-subtle`,children:[e.username,` cannot see or do anything yet. Configure it below.`]})]})]}),r(`section`,{className:`space-y-2`,children:[u(`h3`,{className:`text-[11px] font-semibold uppercase tracking-wide text-foreground-subtle`,children:`1 · What can they do`}),u(`div`,{className:`space-y-1.5`,children:at.map(e=>{let t=d.mode===`role`&&d.roleId===e.id;return r(`label`,{className:`flex cursor-pointer items-start gap-2 rounded-lg border p-2.5 transition-colors ${t?`border-primary bg-primary/5`:`border-border hover:bg-foreground-subtle/5`}`,children:[u(`input`,{type:`radio`,name:`access-role`,checked:t,onChange:()=>x({mode:`role`,roleId:e.id}),className:`mt-0.5 border-border focus:ring-primary`}),r(`span`,{className:`min-w-0`,children:[u(`span`,{className:`block text-[12px] font-medium text-foreground`,children:e.label}),u(`span`,{className:`mt-0.5 block text-[10px] text-foreground-subtle`,children:e.description})]})]},e.id)})}),r(`button`,{type:`button`,onClick:()=>{if(!h){p({...d,mode:`advanced`,advancedScopes:_}),g(!0);return}g(!1),p(An(d.advancedScopes))},className:`inline-flex items-center gap-1 rounded px-1.5 py-1 text-[10px] text-foreground-subtle transition-colors hover:bg-foreground-subtle/10 hover:text-foreground`,children:[u(h?f:m,{className:`h-3 w-3`}),`Advanced — edit raw grants`]}),h&&r(`div`,{className:`rounded-lg border border-border p-2`,children:[u(`p`,{className:`mb-2 text-[10px] text-foreground-subtle`,children:`One row per grant. Anything expressible here overrides the three roles above; close this section to go back to them.`}),u(H,{value:d.advancedScopes,onChange:e=>x({mode:`advanced`,advancedScopes:e}),clampToParent:s,emptyHint:r(o,{children:[`No grants.`,` `,u(`span`,{className:`font-medium text-foreground`,children:e.username}),` cannot call any protected endpoint until one is added.`]})})]})]}),d.mode===`role`&&r(`section`,{className:`space-y-2`,children:[u(`h3`,{className:`text-[11px] font-semibold uppercase tracking-wide text-foreground-subtle`,children:`2 · On which devices`}),u(fe,{value:d.selector,onChange:e=>x({selector:e}),includeLinked:d.includeLinked,onIncludeLinkedChange:e=>x({includeLinked:e}),clampToDeviceIds:null})]}),r(`section`,{className:`space-y-2`,children:[u(`h3`,{className:`text-[11px] font-semibold uppercase tracking-wide text-foreground-subtle`,children:d.mode===`role`?`3 · Result`:`2 · Result`}),u(kn,{scopes:_,isAdmin:e.isAdmin,invalidReason:y})]})]}),r(W,{children:[u(k,{variant:`outline`,size:`sm`,onClick:t,children:`Cancel`}),u(k,{size:`sm`,onClick:()=>n([..._]),disabled:a||y!==null,children:a?u(C,{className:`h-3 w-3 animate-spin`}):`Save access`})]})]})})}n();var Nn=8;function Pn(){return{username:``,password:``,isAdmin:!1}}function Fn(e){return{id:e.id,username:e.username,password:``,isAdmin:e.isAdmin}}function In(e){return e instanceof Error?e.message:`Something went wrong`}function Ln(){let e=s(),{user:t}=Z(),{state:n,openNew:i,openEdit:a,close:l}=ee(),[f,m]=c(null),[h,g]=c(null),[_,y]=c(!1),{data:b,isLoading:S,isError:T,error:E,refetch:O}=w(),P=Y(),I=Ee(),L=()=>e.invalidateQueries({queryKey:[[`userManagement`,`listUsers`]]}),R=re(),z=be({onSuccess:L}),B=A({onSuccess:L}),V=N({onSuccess:L}),H=x({onSuccess:()=>{L(),U(null)}}),[te,U]=c(null),[ie,W]=c(null),[oe,se]=c(null),[le,de]=c(null),fe=b??[],G=n.mode===`edit`?fe.find(e=>e.id===n.id)??null:null,pe=()=>{m(null),g(null),y(!1),R.reset(),B.reset(),l()};d(()=>{if(n.mode===`closed`){m(null),g(null),y(!1);return}if(n.mode===`new`){m(e=>e!==null&&e.id===void 0?e:Pn());return}if(G===null){S||l();return}m(e=>e?.id===G.id?e:Fn(G))},[n,G,S,l]);let me=n.mode===`new`&&f!==null&&f.id===void 0||n.mode===`edit`&&f!==null&&G!==null;async function K(e){await P({title:`Delete user`,message:`Permanently delete user "${e.username}"? This cannot be undone — any active sessions will be revoked on next request.`,confirmLabel:`Delete`,variant:`danger`})&&(z.mutate({id:e.id}),n.mode===`edit`&&n.id===e.id&&pe())}async function ge(e){let t=await I({title:`Reset password`,message:`Set a new password for "${e.username}".`,label:`New password`,inputType:`password`,placeholder:`At least 8 characters`,confirmLabel:`Continue`,validate:e=>e.length<Nn?`Password must be at least ${String(Nn)} characters.`:null});t===null||t.length===0||await P({title:`Reset password`,message:`Reset the password for "${e.username}"? They will need to use the new password on their next login.`,confirmLabel:`Reset`})&&V.mutate({id:e.id,newPassword:t})}function q(e,t){t!==e.isAdmin&&B.mutate({id:e.id,isAdmin:t})}async function _e(){if(f!==null){g(null);try{if(f.id===void 0){let e=f.username.trim();if(e===``||f.password.length<Nn)return;await R.mutateAsync({username:e,password:f.password,isAdmin:f.isAdmin})}else await B.mutateAsync({id:f.id,isAdmin:f.isAdmin});L(),pe()}catch(e){g(In(e))}}}function ve(e){return e?new Date(typeof e==`number`?e:String(e)).toLocaleDateString(`en-GB`,{day:`2-digit`,month:`short`,year:`numeric`}):`—`}let J=R.isPending||B.isPending,ye=f!==null&&f.id===void 0&&f.username.trim()!==``&&f.password.length>=Nn,Se=f!==null&&f.id!==void 0,Ce=J||(f?.id===void 0?!ye:!Se),we=e=>z.isPending&&z.variables?.id===e.id||B.isPending&&B.variables?.id===e.id||V.isPending&&V.variables?.id===e.id;return r(Ct,{embedded:!0,icon:Ae,title:`Users`,subtitle:`Hub accounts, admin flag, access scopes, sessions and sign-in links.`,actions:r(k,{size:`sm`,type:`button`,onClick:()=>{g(null),i()},children:[u(he,{className:`h-3.5 w-3.5`}),`Create User`]}),children:[T&&u(j,{title:`Could not load users`,message:In(E),onRetry:()=>void O()}),S&&r(`div`,{className:`flex items-center gap-2 text-xs text-foreground-subtle`,children:[u(C,{className:`h-3.5 w-3.5 animate-spin`}),`Loading…`]}),!S&&!T&&fe.length===0&&u(ce,{icon:Ae,title:`No users yet`,description:`Create a user to grant hub access.`}),!S&&!T&&fe.length>0&&u(M,{columns:[{key:`username`,header:`Username`,sortValue:e=>e.username,render:e=>u(`span`,{className:`font-medium text-foreground`,"data-testid":`user-open-${e.id}`,children:e.username})},{key:`isAdmin`,header:`Admin`,nowrap:!0,sortValue:e=>+!!e.isAdmin,render:e=>u(`span`,{onClick:e=>e.stopPropagation(),children:r(`label`,{className:`inline-flex items-center gap-1.5 text-xs cursor-pointer`,children:[u(`input`,{type:`checkbox`,checked:e.isAdmin,onChange:t=>q(e,t.target.checked),disabled:we(e),className:`rounded border-border focus:ring-primary disabled:opacity-50`}),u(`span`,{className:e.isAdmin?`text-primary font-medium`:`text-foreground-subtle`,children:e.isAdmin?`Admin`:`Regular`})]})})},{key:`scopes`,header:`Access`,render:e=>e.isAdmin?u(`span`,{className:`text-[10px] italic text-foreground-subtle`,children:`everything (admin)`}):u(`span`,{onClick:e=>e.stopPropagation(),children:r(k,{size:`sm`,variant:`ghost`,type:`button`,onClick:()=>U(e),title:`Configure access`,children:[u(X,{className:`h-3 w-3 shrink-0 text-foreground-subtle`}),u(Rn,{scopes:e.scopes??[]})]})})},{key:`createdAt`,header:`Created`,nowrap:!0,sortValue:e=>e.createdAt,render:e=>u(`span`,{className:`text-foreground-subtle`,children:ve(e.createdAt)})},{key:`actions`,header:`Actions`,align:`right`,nowrap:!0,notSortableReason:`Row actions`,render:e=>{let n=we(e),i=e.id!==t?.id&&e.totpEnabled;return r(`div`,{className:`flex items-center justify-end gap-1`,onClick:e=>e.stopPropagation(),children:[r(k,{size:`sm`,variant:`ghost`,type:`button`,onClick:()=>a(e.id),disabled:n,title:`Edit user`,children:[u(xe,{className:`h-3 w-3`}),`Edit`]}),i&&r(k,{size:`sm`,variant:`ghost`,type:`button`,onClick:()=>W(e),disabled:n,title:`Remove two-factor authentication`,children:[u(ue,{className:`h-3 w-3`}),`Remove 2FA`]}),r(k,{size:`sm`,variant:`ghost`,type:`button`,onClick:()=>se(e),disabled:n,title:`Linked sign-in accounts`,children:[u(ne,{className:`h-3 w-3`}),`Sign-in links`]}),r(k,{size:`sm`,variant:`ghost`,type:`button`,onClick:()=>de(e),disabled:n,title:`Active sessions`,children:[u(Pe,{className:`h-3 w-3`}),`Sessions`]}),r(k,{size:`sm`,variant:`ghost`,type:`button`,onClick:()=>void ge(e),disabled:n,title:`Reset password`,children:[u(v,{className:`h-3 w-3`}),`Reset password`]}),r(k,{size:`sm`,variant:`ghost`,type:`button`,onClick:()=>void K(e),disabled:n,title:`Delete user`,className:`text-danger hover:bg-danger/10`,children:[n?u(C,{className:`h-3 w-3 animate-spin`}):u(p,{className:`h-3 w-3`}),`Delete`]})]})}}],rows:fe,rowKey:e=>e.id,minWidthPx:560,maxBodyHeight:`max-h-[60vh]`,mobileMode:`scroll`,onRowClick:e=>a(e.id)}),u(je,{open:me,onClose:pe,title:f?.id===void 0?`Create User`:`Edit ${f.username||`user`}`,icon:Ae,error:h,testId:`user-form-dialog`,footer:u(k,{size:`sm`,type:`button`,disabled:Ce,onClick:()=>void _e(),children:J?r(o,{children:[u(C,{className:`h-3.5 w-3.5 animate-spin`}),`Saving…`]}):f?.id===void 0?`Create`:`Save`}),children:f!==null&&r(`div`,{className:`space-y-3`,children:[u(D,{label:`Username`,required:f.id===void 0,children:u(ae,{value:f.username,onChange:e=>m({...f,username:e.target.value}),placeholder:`john`,autoFocus:f.id===void 0,disabled:f.id!==void 0,"data-testid":`user-form-username`})}),f.id===void 0&&u(D,{label:`Password`,required:!0,description:`At least ${String(Nn)} characters.`,children:u(F,{value:f.password,onValueChange:e=>m({...f,password:e}),shown:_,onToggleShown:()=>y(e=>!e),placeholder:`••••••••`,"data-testid":`user-form-password`})}),u(D,{label:`Admin`,description:`Unrestricted access to every capability and device.`,children:r(`label`,{className:`inline-flex items-center gap-2 text-xs text-foreground cursor-pointer`,children:[u(`input`,{type:`checkbox`,checked:f.isAdmin,onChange:e=>m({...f,isAdmin:e.target.checked}),className:`rounded border-border focus:ring-primary`,"data-testid":`user-form-admin`}),u(`span`,{children:`Admin`})]})}),f.id!==void 0&&u(`p`,{className:`text-[11px] text-foreground-subtle`,children:`To change the password, use Reset password on the user's row. Access scopes are configured from the Access column.`})]})}),ie&&u(En,{userId:ie.id,username:ie.username,onClose:()=>W(null)}),oe&&u(Tn,{userId:oe.id,username:oe.username,onClose:()=>se(null)}),le&&u(Dn,{userId:le.id,username:le.username,onClose:()=>de(null)}),te&&u(zn,{user:te,onClose:()=>U(null),onSubmit:e=>H.mutate({userId:te.id,scopes:e}),submitting:H.isPending})]})}function Rn({scopes:e}){if(e.length===0)return u(`span`,{className:`font-medium text-warning`,children:`No access`});let t=st(e);return t===null?r(`span`,{className:`text-foreground-subtle`,children:[`Custom · `,e.length,` grant`,e.length===1?``:`s`]}):r(`span`,{className:`text-foreground-subtle`,children:[u(`span`,{className:`font-medium text-foreground`,children:ct(t.roleId).label}),` ·`,` `,pe(t.selector)]})}function zn(e){let{user:t}=Z(),n=t?.isAdmin===!0;return u(Mn,{...e,callerScopes:n?null:t?.scopes??[]})}var Bn={"api-keys":$.tokens,"linked-sessions":$.linkedApps};function Vn(){let{t:e}=lt(),[t]=ut(),n=un(),r=Bn[t.get(`tab`)??``];if(r!==void 0)return u(ft,{to:vt(`access`,{integration:r}),replace:!0});let i=dt(`/system/identity`,{t:e,isAdmin:!0})??{icon:ke,title:e(`system.identity`,`Identity & Access`)},a=t.get(`tab`)??`users`,o=t.get(`integration`),s=a===gt.access.tab?ln(o,n.requestCreate):void 0;return u(St,{icon:i.icon,title:i.title,defaultSection:`users`,sectionsLabel:`${i.title} sections`,actions:s,sections:[{id:`users`,label:`Users`,content:u(Ln,{})},{id:gt.access.tab,label:`Tokens & sessions`,content:u(cn,{createRequested:n.createRequested,onCreateConsumed:n.clearCreate}),ownedParams:bt.concat([Bt.token,Bt.scoped,Bt.admin])},{id:gt.authentication.tab,label:`Authentication`,content:u(Cn,{}),ownedParams:bt}]})}export{Vn as IdentityPage};

package/dist/assets/circle-slash-BOrPYytm.js

@@ -1 +0,0 @@
-import{yt as e}from"./player-overlays-9CMoB0XN.js";var t=e(`circle-slash`,[[`circle`,{cx:`12`,cy:`12`,r:`10`,key:`1mglay`}],[`line`,{x1:`9`,x2:`15`,y1:`15`,y2:`9`,key:`1dfufj`}]]);export{t};