@camstack/addon-admin-ui 1.2.421 → 1.2.423

package/dist/server/addon.js

@@ -5388,7 +5388,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-DxJdzHni.mjs
+//#region ../types/dist/sleep--g-h2_c_.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -15887,6 +15887,208 @@ method(object({
 	kind: "mutation",
 	auth: "admin"
 }), method(object({}), array(KeychainSecretMetaSchema).readonly(), { auth: "admin" }), method(object({}), KeychainStateSchema, { auth: "admin" });
+/**
+* device-history — the ONE mechanism for numeric history (D850).
+*
+* A device value is recorded because its capability says so (the `history`
+* block of a `*.cap.ts`, captured hub-side from `DeviceStateChanged`); any
+* other series is DECLARED by the addon that produces it and fed with points
+* (`record`) or closed five-minute buckets (`recordBuckets`). Rollups 5m / 1h /
+* 1d are computed here and nowhere else. Storage is `history.db` (D851).
+*
+* Who the PRODUCER is: `declareSeries`, `record` and `recordBuckets` are owner
+* checked against the `callerAddonId` the transport stamps into a call that
+* crossed a process (never in an input schema, so a session cannot supply it).
+* A call with no stamp is refused `not-owner`. The methods are `admin` so a
+* non-admin session never reaches them; an addon's `ctx.api` call bypasses the
+* tier by design.
+*/
+/** Whose history: a real device, or a cluster node (load, memory). */
+var DeviceHistorySubjectSchema = discriminatedUnion("kind", [object({
+	kind: literal("device"),
+	deviceId: number().int()
+}), object({
+	kind: literal("node"),
+	nodeId: string().min(1)
+})]);
+var DeviceHistoryKindSchema = _enum([
+	"gauge",
+	"counter",
+	"boolean"
+]);
+var DeviceHistoryResolutionSchema = _enum([
+	"raw",
+	"5m",
+	"1h",
+	"1d"
+]);
+/** Why a producer's point or bucket was not stored. Counted, never silent (D391). */
+var DeviceHistoryRefusalReasonSchema = _enum([
+	"undeclared",
+	"not-owner",
+	"opted-out",
+	"not-a-real-device",
+	"rate",
+	"ingest-mismatch",
+	"out-of-range"
+]);
+var RefusalSchema = object({
+	key: string(),
+	reason: DeviceHistoryRefusalReasonSchema,
+	count: number().int()
+});
+var IngestResultSchema = object({
+	accepted: number().int(),
+	refused: array(RefusalSchema).readonly()
+});
+var SeriesInfoSchema = object({
+	key: string(),
+	scope: string(),
+	kind: DeviceHistoryKindSchema,
+	/** `null` is unknown (a `unitFrom` series whose device does not state a unit right now), never a guess. */
+	unit: string().nullable(),
+	displayName: string(),
+	source: _enum(["cap", "addon"]),
+	firstTs: number(),
+	lastTs: number()
+});
+var QueryPointSchema = object({
+	/** Raw: the point's time. Rollup: the bucket start. */
+	t: number(),
+	samples: number().int(),
+	/** `sum / samples`. */
+	mean: number().nullable(),
+	/** Time-weighted mean (`tw_sum / tw_ms`); `null` for bucket-ingested series. For a boolean: the fraction of time true. */
+	twMean: number().nullable(),
+	min: number(),
+	max: number(),
+	/** `null` is unknown, never zero (D393). */
+	last: number().nullable()
+});
+var QuerySeriesSchema = object({
+	scope: string(),
+	/** The last point STRICTLY BEFORE `from` in the chosen tier, so a step chart can start at the held value. */
+	before: object({
+		t: number(),
+		value: number().nullable()
+	}).nullable(),
+	points: array(QueryPointSchema).readonly()
+});
+/** The window part of a query, shared by the device and node forms. */
+var QueryWindowShape = {
+	key: string(),
+	scope: string().optional(),
+	from: number(),
+	to: number(),
+	resolution: union([DeviceHistoryResolutionSchema, literal("auto")]).default("auto"),
+	maxPoints: number().int().positive().max(5e3).default(1e3)
+};
+var QueryResultSchema = object({
+	resolution: DeviceHistoryResolutionSchema,
+	series: array(QuerySeriesSchema).readonly(),
+	truncated: boolean()
+});
+var TierStatusSchema = object({
+	tier: DeviceHistoryResolutionSchema,
+	/** `null` until the first background count answered. */
+	rows: number().int().nullable(),
+	/** `rows` times a fixed per-row estimate — approximate, labelled so. */
+	approxBytes: number().nullable(),
+	countedAt: number().nullable()
+});
+/** Operator/diagnostic view: rows per tier, last runs, refusals and drops since boot. */
+var DeviceHistoryStatusSchema = object({
+	startedAt: number(),
+	/** The store is declared, series loaded and the first reconcile has answered. */
+	ready: boolean(),
+	series: number().int(),
+	metrics: number().int(),
+	optedOutDevices: number().int(),
+	tiers: array(TierStatusSchema).readonly(),
+	capture: object({
+		eventsSeen: number().int(),
+		pointsEmitted: number().int(),
+		pointsWritten: number().int(),
+		pointsDropped: number().int(),
+		bufferDepth: number().int(),
+		trailingEmitted: number().int(),
+		reconciledPoints: number().int(),
+		reconcileRuns: number().int(),
+		reconcileFailures: number().int(),
+		lastReconcileAt: number().nullable(),
+		lastFlushAt: number().nullable(),
+		flushFailures: number().int(),
+		skipped: record(string(), number().int())
+	}),
+	ingest: object({
+		accepted: number().int(),
+		refused: record(string(), number().int())
+	}),
+	rollup: object({
+		last5mAt: number().nullable(),
+		last1hAt: number().nullable(),
+		last1dAt: number().nullable(),
+		errors: number().int(),
+		dirty5m: number().int(),
+		dirty1h: number().int(),
+		dirty1d: number().int()
+	}),
+	retention: object({
+		lastRunAt: number().nullable(),
+		deleted: record(string(), number().int()),
+		purgedSeries: number().int()
+	}),
+	directory: object({
+		devices: number().int(),
+		lastRefreshAt: number().nullable()
+	})
+});
+method(object({ deviceId: number().int() }), array(SeriesInfoSchema).readonly()), method(object({ nodeId: string().min(1) }), array(SeriesInfoSchema).readonly(), { auth: "admin" }), method(object({
+	deviceId: number().int(),
+	...QueryWindowShape
+}), QueryResultSchema), method(object({
+	nodeId: string().min(1),
+	...QueryWindowShape
+}), QueryResultSchema, { auth: "admin" }), method(object({
+	name: string().regex(/^[a-z0-9-]+$/),
+	subjectKind: _enum(["device", "node"]),
+	kind: DeviceHistoryKindSchema,
+	unit: string().optional(),
+	displayName: string().min(1),
+	ingest: _enum(["points", "buckets"])
+}), object({ key: string() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ points: array(object({
+	key: string(),
+	subject: DeviceHistorySubjectSchema,
+	scope: string().default(""),
+	ts: number(),
+	value: number()
+})).max(5e3) }), IngestResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ buckets: array(object({
+	key: string(),
+	subject: DeviceHistorySubjectSchema,
+	scope: string().default(""),
+	bucketStart: number(),
+	samples: number().int().positive(),
+	sum: number(),
+	min: number(),
+	max: number(),
+	last: number().nullable(),
+	lastTs: number().nullable()
+})).max(5e3) }), IngestResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number().int() }), object({ enabled: boolean() })), method(object({
+	deviceId: number().int(),
+	enabled: boolean()
+}), object({ enabled: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), DeviceHistoryStatusSchema, { auth: "admin" });
 var DeviceCaStatusSchema = discriminatedUnion("state", [
 	object({ state: literal("absent") }),
 	object({
@@ -62070,6 +62272,66 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceHistory.declareSeries": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceHistory.getDeviceEnabled": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.getStatus": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.listNodeSeries": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.listSeries": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.query": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.queryNode": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"deviceHistory.record": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceHistory.recordBuckets": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"deviceHistory.setDeviceEnabled": {
+		capName: "device-history",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.addLocation": {
 		capName: "device-manager",
 		capScope: "system",
@@ -68861,6 +69123,26 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceHistory.getDeviceEnabled": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceHistory.listSeries": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceHistory.query": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"deviceHistory.setDeviceEnabled": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"deviceManager.adoptionRelease": [{
 		name: "camDeviceId",
 		form: "single",
@@ -72124,7 +72406,7 @@ var AdminUIAddon = class extends BaseAddon {
 			capability: adminUiCapability,
 			provider: {
 				getStaticDir: async () => ({ staticDir: resolveAdminUiDistDir() }),
-				getVersion: async () => ({ version: "1.2.421" })
+				getVersion: async () => ({ version: "1.2.423" })
 			}
 		}];
 	}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-admin-ui",
-  "version": "1.2.421",
+  "version": "1.2.423",
   "private": false,
   "type": "module",
   "description": "Admin UI — Vite frontend build and server-side addon",

package/dist/assets/Identity-DvZevqOL.js

@@ -1 +0,0 @@
-import{I as e,K as t,Q as n,S as r,W as i,a,b as o,o as s,q as c,t as l,x as u,z as d}from"./_virtual_mf___mfe_internal__admin_ui_host__loadShare___mf_0_tanstack_mf_1_react_mf_2_query__loadShare__.js-DhP-Lgiq.js";import{Ir as f,It as p,On as m,Pn as h,Qt as g,Tt as _,_i as v,ar as y,cn as b,cr as x,dt as S,fi as C,fn as w,nr as T,on as E,ot as D,pr as O,sn as k,yi as A}from"./player-overlays-C20AJTgs.js";import{n as j,r as M,t as N}from"./key-DKkIyX9P.js";import{c as P,o as F,u as I}from"./video-Bkjg9omB.js";import{t as L}from"./history-BThcfo0X.js";import{t as R}from"./key-round-Dzvj04Ko.js";import{t as z}from"./monitor-smartphone-yIys4K1P.js";import{t as B}from"./unlink-2_Gor_ZF.js";import{a as V,bi as H,i as ee,o as te,s as U,vi as ne,yi as re}from"./client-CKGZv6zJ.js";import{Al as ie,An as W,Bl as ae,Bn as G,Dl as oe,Dn as K,Dr as se,El as ce,En as q,Er as le,Fl as ue,Ft as de,G as fe,Gl as pe,Ht as me,Il as he,Kl as ge,L as _e,Ll as ve,Ln as ye,Ml as be,N as xe,Nl as Se,Ol as Ce,P as we,Pl as Te,Qn as Ee,Rl as De,Rn as Oe,Tl as ke,Tn as Ae,X as je,Xl as Me,Z as Ne,Zn as J,ar as Pe,bn as Fe,en as Ie,gu as Y,jl as Le,jn as Re,kl as ze,kn as Be,ma as Ve,nn as He,on as Ue,rn as We,z as Ge,zl as Ke,zn as qe}from"./src-CIIJy_o8.js";import{t as Je}from"./useTranslation-Bc5yH9V9.js";import{C as Ye,J as Xe,Q as Ze,R as X,X as Qe,Y as $e,c as et,h as tt,p as nt,s as rt}from"./index-AsTGrKva.js";import{t as it}from"./AdminSectionedPage-Cwqk3VSC.js";import{t as at}from"./AdminPage-Pnx0mTsE.js";import{_ as ot,a as st,b as ct,c as lt,d as ut,f as dt,g as ft,h as pt,i as mt,l as ht,m as gt,n as _t,o as vt,p as yt,s as bt,t as xt,u as St,v as Ct,x as wt,y as Tt}from"./SessionsList-Dm6Me6Pk.js";import{i as Et,n as Dt,r as Ot,t as kt}from"./IntegrationHub-C--iFSMN.js";import{n as At,t as jt}from"./addon-display-names-BkwMrExv.js";n();function Mt(){let e=J(),t=Y.useUtils(),n=wt(),{data:r,isLoading:a}=Se(),o=i(()=>r??[],[r]),s=Y.useQueries(e=>o.map(t=>e.userManagement.listExternalIdentities({userId:t.id}))),l=Y.auth.listLoginMethods.useQuery(),[d,f]=c(null),p=Ke({onSuccess:()=>void t.userManagement.listExternalIdentities.invalidate(),onError:e=>f(`Remove failed: ${e.message}`)}),m=i(()=>new Map((l.data??[]).flatMap(e=>e.kind===`redirect`?[[e.id,e.label]]:[])),[l.data]),h=o.flatMap((e,t)=>s[t]?.data??[]),g=h.map(e=>({...dt(e,n),kind:m.get(e.provider)??e.provider})),_=async t=>{let n=h.find(e=>ut(e)===t.id);n!==void 0&&await e({title:`Remove sign-in link`,message:`"${t.ownerName}" will no longer be able to sign in with this ${t.kind} account.`,confirmLabel:`Remove`,variant:`danger`})&&(f(null),p.mutate({userId:n.userId,provider:n.provider,subject:n.subject}))};return u(Tt,{notice:ct(d),onDismissNotice:()=>{f(null)},id:`external-identities`,title:`Sign-in links`,icon:I,description:`External accounts (single sign-on) each user linked to their CamStack account. Only the owner can link one, from their profile; an admin can remove it.`,children:u(ft,{rows:g,label:`sign-in links`,isLoading:a||s.some(e=>e.isLoading),loadError:s.find(e=>e.isError)?.error?.message??null,emptyText:`No user has linked a sign-in account.`,expiresNone:`—`,action:{label:`Remove`,icon:B,isAvailable:()=>!0,onRun:e=>void _(e),busyId:null,disabled:p.isPending}})})}n();function Nt(){let e=J(),t=s(),n=wt(),r=ie(),[a,o]=c(null),l=ue({onSuccess:()=>void t.invalidateQueries({queryKey:[[`userManagement`,`listApiKeys`]]}),onError:e=>o(`Revoke failed: ${e.message}`)}),d=i(()=>(r.data??[]).map(e=>St(e,n)),[r.data,n]),f=async t=>{await e({title:`Revoke "${t.name}"?`,message:`Any client using this key loses access immediately. This cannot be undone.`,confirmLabel:`Revoke`,variant:`danger`})&&(o(null),l.mutate({id:t.id}))};return u(Tt,{notice:ct(a),onDismissNotice:()=>{o(null)},id:`legacy-api-keys`,title:`Legacy API keys`,icon:L,description:`Keys from before scoped tokens. Nothing creates them any more; revoke them and issue a scoped token instead.`,children:u(ft,{rows:d,label:`legacy API keys`,isLoading:r.isLoading,loadError:r.isError?r.error?.message??`Request failed`:null,emptyText:`No legacy API keys.`,action:{label:`Revoke`,icon:p,isAvailable:()=>!0,onRun:e=>void f(e),busyId:l.isPending?l.variables?.id??null:null,disabled:l.isPending}})})}n();var Pt={one:`linked app`,many:`linked apps`};function Ft(e){if(e.type===`category`){let t=e.target??``;return t===`device`?`all devices`:`all ${t}`}if(e.type===`device`)return`device:[${(e.targets??[]).join(`,`)}]`;let t=e;return`${t.type}:${t.target??``}`}function It(){let e=J(),t=s(),n=be(),[r,a]=c(null),o=()=>void t.invalidateQueries({queryKey:[[`userManagement`,`listOauthSessions`]]}),l=he({onSuccess:o,onError:e=>a(`Revoke failed: ${e.message}`)}),d=ot(`oauth-session`,Pt,o),f=i(()=>(n.data??[]).map(e=>yt(e,e.scopes.map(Ft).join(`, `))),[n.data]),m=async t=>{await e({title:`Revoke the "${t.name}" link?`,message:`${t.name} loses access for ${t.ownerName} on its next call. Linking it again needs the account-link flow from the start.`,confirmLabel:`Revoke`,variant:`danger`})&&(a(null),l.mutate({id:t.id}))},h=l.isPending?l.variables?.id??null:null;return u(Tt,{notice:ct(r,d.outcome),onDismissNotice:()=>{a(null),d.dismiss()},id:`linked-apps`,title:`Linked apps`,icon:x,description:`External integrations (Alexa, …) linked to this hub through OAuth. Revoking one stops that integration on its next call. Already-revoked rows can be selected and removed from the list.`,children:u(ft,{rows:f,label:`linked apps`,isLoading:n.isLoading,loadError:n.isError?n.error?.message??`Request failed`:null,emptyText:`No linked apps — an integration appears here once it completes the account-link flow.`,expiresNone:`—`,action:{label:`Revoke`,icon:p,isAvailable:e=>e.status===`active`||e.status===`revoked`,onRun:e=>void m(e),busyId:h,disabled:l.isPending||d.busy},bulk:{revoke:d,noun:Pt,isSelectable:e=>e.status===`active`||e.status===`revoked`,quickSelect:[{label:`Select revoked`,match:e=>e.status===`revoked`}]}})})}n();var Lt={one:`session`,many:`sessions`};function Rt(){let e=J(),t=Y.useUtils(),n=wt(),r=Y.auth.listSessions.useQuery(),[a,o]=c(null),s=()=>void t.auth.listSessions.invalidate(),l=Y.auth.revokeSessions.useMutation({onSuccess:s,onError:e=>o(`Sign out failed: ${e.message}`)}),d=ot(`login-session`,Lt,s),f=i(()=>(r.data??[]).map(e=>gt(e,n,{client:e=>st(e).label,method:vt})),[r.data,n]),p=async t=>{await e({title:`Sign out this session`,message:`${t.ownerName} on ${t.name} will have to sign in again.`,confirmLabel:`Sign out`,variant:`danger`})&&(o(null),l.mutate({id:t.id}))};return u(Tt,{notice:ct(a,d.outcome),onDismissNotice:()=>{o(null),d.dismiss()},id:`login-sessions`,title:`Login sessions`,icon:z,description:`Every browser and app signed in to this hub, for every user. Signing one out ends it at once; it has to sign in again. Your own current session is marked and never included in a bulk sign-out.`,children:u(ft,{rows:f,label:`sessions`,isLoading:r.isLoading,loadError:r.isError?r.error?.message??`Request failed`:null,emptyText:`No active sessions.`,action:{label:`Sign out`,icon:F,isAvailable:e=>e.status===`active`,onRun:e=>void p(e),busyId:l.isPending&&l.variables!==void 0&&`id`in l.variables?l.variables.id:null,disabled:l.isPending||d.busy},bulk:{revoke:d,noun:Lt,isSelectable:e=>e.status===`active`}})})}function zt({token:e,label:t,onClose:n}){return u(Ae,{open:!0,onOpenChange:e=>!e&&n(),children:r(K,{width:`md`,scroll:`body`,children:[u(W,{children:u(Re,{children:`Token: ${t}`})}),r(q,{className:`space-y-3`,children:[u(`div`,{className:`rounded-md border border-warning/30 bg-warning/10 px-3 py-2 text-xs text-warning`,children:`Copy this token now. Once you close this dialog the secret cannot be displayed again.`}),u(`div`,{className:`select-all break-all rounded-md border border-border bg-background p-2 font-mono text-[11px] text-foreground`,children:e})]}),r(Be,{children:[u(de,{value:e,label:`Copy`,srLabel:`token`}),u(G,{type:`button`,variant:`primary`,size:`sm`,onClick:n,children:`Done`})]})]})})}var Bt={token:`newToken`,scoped:`newScoped`,admin:`newAdmin`};n();var Vt=7,Ht=90,Ut=80;function Wt(e){let t=Number(e);return Number.isInteger(t)&&t>=1&&t<=Ht?t:null}function Gt({open:e,users:t,onClose:n,onSubmitScoped:i,onSubmitAdmin:a,submitting:s,formError:l,awaitingProof:f}){let{user:p}=X(),m=p?.isAdmin===!0,h=m?null:p?.scopes??[],[g,_]=c(!1),[v,b]=c(t[0]?.id??``),[x,S]=c(``),[C,w]=c([{type:`capability`,target:``,access:[`view`,`create`]}]),[T,D]=c(``),[O,A]=c(String(Vt));d(()=>{e||(_(!1),b(t[0]?.id??``),S(``),w([{type:`capability`,target:``,access:[`view`,`create`]}]),D(``),A(String(Vt)))},[e,t]);let j=x.trim(),M=we(C),N=Wt(O),P=!g&&v!==``&&j.length>0&&C.length>0&&M===null&&!s,F=g&&m&&j.length>0&&j.length<=Ut&&N!==null&&!s&&!f;return u(Ge,{open:e,onClose:n,title:g?`Create admin token`:`Create token`,icon:g?k:R,error:l,width:`md`,testId:`create-token-dialog`,footer:r(G,{type:`button`,variant:g?`danger`:`primary`,size:`sm`,onClick:()=>{if(g){if(!F||N===null)return;a({name:j,expiresInDays:N});return}if(!P)return;let e=parseInt(T,10),t=Number.isFinite(e)&&e>0?Date.now()+e*864e5:void 0;i({userId:v,name:j,scopes:C,...t===void 0?{}:{expiresAt:t}})},disabled:g?!F:!P,children:[s||f?u(y,{className:`h-3.5 w-3.5 animate-spin`,"aria-hidden":!0}):u(g?k:E,{className:`h-3.5 w-3.5`,"aria-hidden":!0}),g?`Create admin token`:`Issue token`]}),children:r(`div`,{className:`space-y-3`,children:[m?r(`label`,{className:`flex items-start gap-2 text-sm text-foreground`,children:[u(`input`,{type:`checkbox`,className:`mt-0.5`,checked:g,onChange:e=>_(e.target.checked),"data-testid":`token-as-admin`}),r(`span`,{children:[u(`span`,{className:`font-medium`,children:`Administrator`}),u(`span`,{className:`block text-[11px] text-foreground-subtle`,children:`Off = scoped to a surface. On = full admin for scripts (audited, max 90 days).`})]})]}):null,g?u(`div`,{className:`space-y-1 rounded-md border border-danger/30 bg-danger/5 px-3 py-2 text-[11px] leading-relaxed text-foreground`,"data-testid":`admin-token-warning`,children:r(`p`,{children:[`An admin token acts as a `,u(`strong`,{children:`full administrator`}),`. Anyone holding it can do anything an admin can. Creating one asks you to confirm it is you.`]})}):null,g?null:r(`div`,{className:`space-y-1`,children:[u(Ue,{htmlFor:`token-user`,children:`On behalf of user`}),u(pe,{id:`token-user`,value:v,onChange:e=>b(e.target.value),options:t.map(e=>({value:e.id,label:e.username}))})]}),u(fe,{label:`Name`,required:!0,children:u(Me,{id:`token-name`,value:x,maxLength:Ut,onChange:e=>S(e.target.value),placeholder:g?`nightly-backup`:`cloudflare-tunnel-route`,autoFocus:!0})}),g?r(`div`,{className:`space-y-1`,children:[u(Ue,{htmlFor:`token-admin-days`,children:`Expires in (days)`}),u(Me,{id:`token-admin-days`,type:`number`,min:1,max:Ht,value:O,onChange:e=>A(e.target.value),state:N===null?`error`:`default`}),N===null?r(`p`,{className:`text-[11px] text-danger`,children:[`Expiry must be a whole number of days, 1 to `,Ht,`.`]}):r(`p`,{className:`text-[11px] text-foreground-subtle`,children:[`Whole number of days, 1 to `,Ht,`.`]})]}):r(o,{children:[r(`div`,{className:`space-y-1`,children:[u(Ue,{children:`Scopes`}),u(xe,{value:C,onChange:w,clampToParent:h}),M&&u(`p`,{className:`text-[10px] text-danger`,children:M}),u(`p`,{className:`text-[10px] text-foreground-subtle`,children:`Each scope picks a (cap or addon) target + one or more access flavours. The token can access ONLY what's listed.`})]}),r(`div`,{className:`space-y-1`,children:[u(Ue,{htmlFor:`token-scoped-days`,children:`Expires in (days)`}),u(Me,{id:`token-scoped-days`,type:`number`,min:1,value:T,onChange:e=>D(e.target.value),placeholder:`30`}),u(`p`,{className:`text-[10px] text-foreground-subtle`,children:`Leave blank for non-expiring.`})]})]})]})})}n();var Kt={one:`token`,many:`tokens`};function qt(e){return e.type===`device`?`device:[${Ne(e.selector)}]`:`${e.type}:${e.target??``}`}function Jt({createRequested:e=!1,onCreateConsumed:t}){let{user:n}=X(),a=J(),o=s(),l=Y.useUtils(),f=wt(),{data:m,isLoading:h}=Se(),g=i(()=>m??[],[m]),_=Y.useQueries(e=>g.map(t=>e.userManagement.listScopedTokens({userId:t.id}))),v=Y.auth.listAdminTokens.useQuery(void 0,{enabled:n?.isAdmin===!0}),{requestProof:y,dialog:b}=mt(`Creating an admin token`),{state:x,openNew:S,close:C}=_e({newKey:Bt.token}),[w,T]=c(null),[E,D]=c(null),[O,k]=c(!1),[A,j]=c(null),[M,N]=c(null);d(()=>{e&&(S(),t?.())},[e,S,t]);let P=()=>{o.invalidateQueries({queryKey:[[`userManagement`,`listScopedTokens`]]}),l.auth.listAdminTokens.invalidate(),l.auth.listAuthAudit.invalidate()},F=ke({onSuccess:({token:e,record:t})=>{P(),C(),D(null),j({token:e,label:t.name})},onError:e=>{T(`Create failed: ${e.message}`),D(`Create failed: ${e.message}`)}}),I=Y.auth.createAdminToken.useMutation({onSuccess:({token:e,record:t})=>{P(),C(),D(null),k(!1),j({token:e,label:t.name})},onError:e=>{T(`Create failed: ${e.message}`),D(`Create failed: ${e.message}`),k(!1)}}),L=ve({onSuccess:()=>{N(null),P()},onError:e=>{N(null),T(`Revoke failed: ${e.message}`)}}),z=Y.auth.revokeAdminToken.useMutation({onSuccess:()=>{N(null),P()},onError:e=>{N(null),T(`Revoke failed: ${e.message}`)}}),B=Ct(Kt,P),V=Date.now(),H=g.flatMap((e,t)=>(_[t]?.data??[]).map(t=>pt(t,e.id,f,t.scopes.map(qt).join(`, `),V))),ee=n?.isAdmin===!0?(v.data??[]).map(e=>ht(e,f,V)):[],te=[...H,...ee],U=_.find(e=>e.isError)?.error?.message??(v.isError?v.error?.message??`Request failed`:null),ne=async e=>{let t=e.kind===lt;await a({title:`Revoke "${e.name}"?`,message:t?`Every script using it loses access immediately. This cannot be undone.`:`${e.ownerName}'s scoped token stops working on its next use. This cannot be undone.`,confirmLabel:`Revoke`,variant:`danger`})&&(T(null),N(e.id),t?z.mutate({id:e.id}):L.mutate({id:e.id}))},re=F.isPending||I.isPending;return r(`div`,{"data-testid":`tokens`,children:[b,u(Tt,{notice:ct(w,B.outcome),onDismissNotice:()=>{T(null),B.dismiss()},id:`tokens`,title:`Tokens`,icon:R,description:`Scoped tokens for a narrow surface, and admin tokens for full-administrator scripts. Revoking one stops it on its next use.`,children:u(ft,{rows:te,label:`tokens`,isLoading:h||_.some(e=>e.isLoading)||n?.isAdmin===!0&&v.isLoading,loadError:U,emptyText:`No tokens.`,action:{label:`Revoke`,icon:p,isAvailable:e=>e.status===`active`,onRun:e=>void ne(e),busyId:M,disabled:B.busy||M!==null},bulk:{revoke:B,noun:Kt,isSelectable:e=>e.status===`active`}})}),u(Gt,{open:x.mode===`new`,users:g.map(e=>({id:e.id,username:e.username})),onClose:()=>{C(),D(null),k(!1)},submitting:re,formError:E,awaitingProof:O,onSubmitScoped:e=>F.mutate({userId:e.userId,name:e.name,scopes:e.scopes,expiresAt:e.expiresAt}),onSubmitAdmin:e=>{(async()=>{T(null),D(null),k(!0);let t=await y();k(!1),t!==null&&I.mutate({...e,reauthToken:t})})()}}),A&&u(zt,{token:A.token,label:A.label,onClose:()=>j(null)})]})}var Yt={"share-link":`share links`,"admin-token":`admin tokens`,"login-session":`login sessions`};function Z(e,t){let n=e[t];return typeof n==`string`&&n.length>0?n:null}function Xt(e,t){let n=Z(e,`tokenId`);return Z(e,`name`)??(n===null?void 0:t.get(n))??n??`?`}function Zt(e){return e.filter(e=>e!==null)}function Qt(e){let t=Z(e,`prefix`);return t===null?null:`Prefix ${t}…`}function $t(e,t){let n=e.detail??{};switch(e.action){case`admin-token-created`:{let e=n.expiresAt;return{title:`Admin token "${Xt(n,t)}" created`,details:Zt([Qt(n),typeof e==`number`?`Expires ${bt(e)}`:null])}}case`admin-token-used`:{let e=Z(n,`path`);return{title:`Admin token "${Xt(n,t)}" used`,details:Zt([Qt(n),e===null?null:`Call ${e}`])}}case`admin-token-revoked`:return{title:`Admin token "${Xt(n,t)}" revoked`,details:Zt([Qt(n)])};case`credentials-revoked`:{let e=Z(n,`kind`)??`credential`,t=n.revoked,r=n.skipped,i=Yt[e]??`${e}s`;return{title:`${typeof t==`number`?String(t):`?`} ${i} revoked in bulk`,details:Zt([typeof r==`number`&&r>0?`${String(r)} skipped`:null,Z(n,`ids`)===null?null:`Ids ${Z(n,`ids`)??``}`])}}case`second-factor-skipped`:{let e=Z(n,`method`),t=Z(n,`factors`);return{title:`Second factor skipped on a trusted network`,details:Zt([e===null?null:`Signed in with ${vt(e)}`,t===null?null:`Skipped: ${t.split(`,`).join(`, `)}`])}}default:return{title:e.action,details:Object.entries(n).map(([e,t])=>`${e}: ${String(t)}`)}}}n();var en=100;function tn(){let{user:e}=X();return e?.isAdmin?u(rn,{}):null}function nn(){let{data:e}=Se(),{data:t}=Y.auth.listAdminTokens.useQuery();return i(()=>{let n=new Map;for(let t of e??[])n.set(t.id,t.username);let r=new Map;for(let e of t??[])r.set(e.id,e.name);return{userNameById:n,tokenNameById:r}},[e,t])}function rn(){let e=Y.auth.listAuthAudit.useQuery({limit:en}),{userNameById:t,tokenNameById:n}=nn(),i=e.data??[];return r(`div`,{"data-testid":`auth-audit`,className:`rounded-lg border border-border bg-surface overflow-hidden`,children:[r(`div`,{className:`px-4 py-2.5 border-b border-border flex items-center gap-2`,children:[u(w,{className:`h-3.5 w-3.5 text-foreground-subtle`}),u(`div`,{className:`text-xs font-semibold text-foreground`,children:`Authentication audit`}),r(`span`,{className:`ml-auto text-[10px] text-foreground-subtle`,children:[`Latest `,en,`, newest first`]})]}),u(`div`,{className:`p-4`,children:e.isLoading?r(`div`,{className:`flex items-center gap-2 text-xs text-foreground-subtle`,children:[u(y,{className:`h-3.5 w-3.5 animate-spin`}),`Loading audit trail…`]}):e.isError?r(`div`,{className:`text-[11px] text-danger`,children:[`Could not load the audit trail: `,e.error?.message??`Request failed`]}):i.length===0?r(`div`,{className:`rounded border border-dashed border-border px-3 py-4 text-xs text-foreground-subtle text-center space-y-1`,children:[u(`div`,{children:`No authentication events recorded yet.`}),u(`div`,{className:`text-[11px] text-foreground-subtle/90`,children:`This trail records admin-token create/use/revoke, trusted-network 2FA skips, and credential revokes (including single share-link revoke). Browser password logins are not listed here.`})]}):u(`ul`,{className:`divide-y divide-border rounded-md border border-border max-h-[420px] overflow-y-auto`,children:i.map(e=>u(an,{record:e,userName:e.userId===void 0?null:t.get(e.userId)??e.userId,tokenNameById:n},e.id))})})]})}function an({record:e,userName:t,tokenNameById:n}){let i=$t(e,n);return r(`li`,{"data-testid":`auth-audit-row`,className:`px-3 py-2 text-xs space-y-0.5`,children:[r(`div`,{className:`flex flex-wrap items-baseline gap-x-2`,children:[u(`span`,{className:`font-medium text-foreground`,children:i.title}),u(`span`,{className:`ml-auto text-[10px] text-foreground-subtle`,children:bt(e.at)})]}),r(`div`,{className:`flex flex-wrap gap-x-3 text-[11px] text-foreground-subtle`,children:[t!==null&&u(`span`,{className:`text-foreground`,children:t}),e.ip!==void 0&&u(`span`,{className:`font-mono`,children:e.ip}),i.details.map(e=>u(`span`,{className:`font-mono`,children:e},e))]})]})}n();var Q={loginSessions:`login-sessions`,linkedApps:`linked-apps`,tokens:`tokens`,scopedTokens:`scoped-tokens`,adminTokens:`admin-tokens`,shareLinks:`share-links`,legacyApiKeys:`legacy-api-keys`,externalIdentities:`external-identities`,audit:`auth-audit`},on={[Q.scopedTokens]:Q.tokens,[Q.adminTokens]:Q.tokens};function sn(e){return[{id:Q.loginSessions,label:`Login sessions`,icon:z,render:()=>u(Rt,{})},{id:Q.linkedApps,label:`Linked apps`,icon:x,render:()=>u(It,{})},{id:Q.tokens,label:`Tokens`,icon:R,render:({createRequested:e,onCreateConsumed:t})=>u(Jt,{headerOwnsCreate:!0,createRequested:e,onCreateConsumed:t})},{id:Q.shareLinks,label:`Share links`,icon:b,render:()=>u(_t,{})},...e?[{id:Q.legacyApiKeys,label:`Legacy API keys`,icon:L,render:()=>u(Nt,{})}]:[],{id:Q.externalIdentities,label:`Sign-in links`,icon:I,render:()=>u(Mt,{})},{id:Q.audit,label:`Audit`,icon:w,render:()=>u(tn,{})}]}function cn({createRequested:e=!1,onCreateConsumed:t}){let n=ie(),a=(n.data??[]).length>0,o=i(()=>sn(a),[a]),s=Et({ids:i(()=>o.map(e=>e.id),[o]),answered:!n.isLoading}),c=Qe(),[l]=Ze(),d=l.get(`integration`),f=d===null?void 0:on[d];if(f!==void 0){let e=new URLSearchParams(l);return e.set(`integration`,f),u($e,{to:`?${e.toString()}`,replace:!0})}let p=o.find(e=>e.id===s.selectedId)??o[0],m=p?.id??Q.loginSessions;return n.isLoading?u(`div`,{className:`text-sm text-foreground-subtle`,"data-testid":`access-page`,children:`Loading…`}):r(`div`,{className:`flex flex-col gap-3`,"data-testid":`access-page`,children:[u(Ie,{appearance:`pills`,value:m,onValueChange:e=>{c(`?${tt(l,e,null,null).toString()}`)},children:u(He,{"aria-label":`Credential kinds`,children:o.map(e=>r(We,{value:e.id,"data-testid":`access-kind-${e.id}`,children:[u(e.icon,{className:`h-3.5 w-3.5 shrink-0`,"aria-hidden":!0}),e.label]},e.id))})}),p===void 0?null:u(`div`,{role:`region`,"aria-label":p.label,"data-testid":`access-kind-body`,children:p.render({createRequested:e&&p.id===Q.tokens,onCreateConsumed:t??(()=>void 0)})},p.id)]})}function ln(e,t){if(e===Q.tokens)return r(G,{size:`sm`,type:`button`,"data-testid":`access-new-token`,onClick:t,children:[u(R,{className:`h-3.5 w-3.5`,"aria-hidden":!0}),`New token`]})}function un(){let[e,t]=c(!1);return{createRequested:e,requestCreate:()=>t(!0),clearCreate:()=>t(!1)}}n();var dn=[`oidcConnections`,`listConnections`],fn=[`oidcConnections`,`connectionFormSchema`],pn={displayName:`OpenID Connect`,icon:`shield-check`,issuerUrl:``,clientId:``,clientSecret:``,redirectUri:``,scopes:`openid profile email`,usernameClaim:`preferred_username`},mn=/^[a-z0-9][a-z0-9-]{0,63}$/;function hn(e){return e instanceof Error?e.message:String(e)}function gn(e,t){if(t)return typeof e==`string`&&e.length>0?e:void 0;if(re(e))return ne;if(typeof e==`string`&&e.length>0)return e;H(e)}function _n(e){return typeof e!=`object`||!e?!1:Array.isArray(Reflect.get(e,`sections`))}function vn({addonId:n}){let f=D(),h=s(),g=J(),_=_e({editKey:`oidcEdit`,newKey:`oidcNew`}),[v,y]=c(!1),[b,x]=c(null),[S,C]=c(``),[w,T]=c({...pn}),O=t(null),k=a({queryKey:[...dn,n],queryFn:async()=>f.trpcClient.oidcConnections.listConnections.query({})}),A=a({queryKey:fn,queryFn:async()=>f.trpcClient.oidcConnections.connectionFormSchema.query({})}),j=k.data??[],M=_n(A.data)?A.data:void 0,N=_.state,P=N.mode===`edit`?j.find(e=>e.id===N.id)??null:null;d(()=>{if(_.state.mode===`edit`&&P!==null){let e=`edit:${P.id}`;if(O.current===e)return;O.current=e,x(null),C(P.id),T(P.formValues===void 0?{...pn}:{...P.formValues});return}if(_.state.mode===`new`){if(O.current===`new`)return;O.current=`new`,x(null),C(``),T({...pn})}},[P,_.state]);let F=e(async()=>{await h.invalidateQueries({queryKey:dn})},[h]),I=l({mutationFn:async e=>f.trpcClient.oidcConnections.deleteConnection.mutate({id:e}),onSuccess:async()=>F()}),L=e(async e=>{await g({title:`Delete OIDC connection?`,message:`Remove “${e.displayName}” (${e.id}). The login button and IdP credentials for this id are dropped.`,confirmLabel:`Delete`,cancelLabel:`Cancel`,variant:`danger`})&&(await I.mutateAsync(e.id),_.state.mode===`edit`&&_.state.id===e.id&&(_.close(),O.current=null))},[g,I,_]),R=e(async()=>{let e=w.displayName,t=typeof e==`string`&&e.trim()!==``?e.trim():``;if(t===``){x(`Display name is required.`);return}let n=_.state.mode===`new`,r=n?S.trim():P?.id??``;if(n&&!mn.test(r)){x(`Instance id must be a lowercase slug (e.g. authentik, google).`);return}if(r===``){x(`That connection is no longer available.`);return}let i=gn(w.clientSecret,n),a=w.icon,o=w.issuerUrl,s=w.clientId,c=w.redirectUri,l=w.scopes,u=w.usernameClaim,d=u===`email`||u===`sub`?u:`preferred_username`;y(!0),x(null);try{n&&await f.trpcClient.oidcConnections.createConnection.mutate({id:r,displayName:t}),await f.trpcClient.oidcConnections.updateConnection.mutate({id:r,displayName:t,icon:typeof a==`string`?a:`shield-check`,issuerUrl:typeof o==`string`?o:``,clientId:typeof s==`string`?s:``,...i===void 0?{}:{clientSecret:i},redirectUri:typeof c==`string`?c:``,scopes:typeof l==`string`?l:`openid profile email`,usernameClaim:d}),await F(),_.close(),O.current=null}catch(e){x(hn(e))}finally{y(!1)}},[S,P?.id,_,w,F,f]),z=i(()=>[{key:`id`,header:`Id`,sortValue:e=>e.id,render:e=>u(`span`,{className:`font-mono text-xs text-foreground`,children:e.id})},{key:`name`,header:`Name`,sortValue:e=>e.displayName,render:e=>u(`span`,{className:`truncate font-medium text-foreground`,children:e.displayName})},{key:`issuer`,header:`Issuer`,sortValue:e=>e.issuerUrl,render:e=>u(`span`,{className:`truncate text-xs text-foreground-muted`,children:e.issuerUrl===``?`—`:e.issuerUrl})},{key:`status`,header:`Status`,notSortableReason:`Badge`,render:e=>u(Pe,{variant:e.configured?`success`:`warning`,children:e.configured?`Configured`:`Not configured`})},{key:`actions`,header:``,align:`right`,notSortableReason:`Row actions`,nowrap:!0,render:e=>r(`div`,{className:`flex justify-end gap-1`,children:[u(G,{type:`button`,size:`sm`,variant:`secondary`,onClick:t=>{t.stopPropagation(),_.openEdit(e.id)},children:`Edit`}),u(G,{type:`button`,size:`sm`,variant:`ghost`,"aria-label":`Delete ${e.displayName}`,title:`Delete`,onClick:t=>{t.stopPropagation(),L(e)},children:u(p,{className:`h-3.5 w-3.5 text-danger`})})]})}],[_,L]),B=_.state.mode===`new`,V=B||P!==null,H=B?`new`:P===null?`closed`:`edit:${P.id}:${P.configured?`cfg`:`empty`}`;return r(`div`,{className:`flex min-h-0 flex-col gap-3`,"data-testid":`oidc-settings-connections`,children:[r(`div`,{className:`flex flex-wrap items-center justify-between gap-2`,children:[r(`p`,{className:`text-sm text-foreground-muted`,children:[`Each row is one IdP. Redirect URI:`,` `,u(`span`,{className:`font-mono text-xs`,children:`/addon/${n}/<id>/callback`})]}),r(G,{type:`button`,size:`sm`,"data-testid":`oidc-connections-add`,onClick:()=>_.openNew(),children:[u(m,{className:`h-3.5 w-3.5`}),`Add connection`]})]}),k.isError?u(`p`,{className:`text-sm text-danger`,children:`Could not load connections.`}):null,k.isPending?u(qe,{className:`h-32 w-full`}):u(me,{columns:z,rows:j,rowKey:e=>e.id,pageSize:25,mobileMode:`scroll`,emptyMessage:`No OIDC connections yet. Add one to register an IdP.`,onRowClick:e=>_.openEdit(e.id),defaultSort:{columnKey:`name`,dir:`asc`}}),u(Ge,{open:V,onClose:()=>{_.close(),x(null),O.current=null},title:B?`Add OIDC connection`:`Edit ${P?.displayName??`connection`}`,icon:E,width:`xl`,testId:`oidc-connection-editor`,error:b,footer:u(G,{type:`button`,size:`sm`,disabled:v||B&&S.trim()===``,onClick:()=>void R(),children:v?`Saving…`:`Save`}),children:V?r(o,{children:[B?r(`div`,{children:[u(Ue,{htmlFor:`oidc-connection-id`,children:`Instance id`}),u(Me,{id:`oidc-connection-id`,value:S,onChange:e=>C(e.target.value),placeholder:`authentik`,autoComplete:`off`}),u(`p`,{className:`mt-1 text-xs text-foreground-muted`,children:`URL slug — appears in /addon/${n}/<id>/callback. Stable; renaming is not supported after save.`})]}):r(`p`,{className:`text-sm text-foreground-muted`,children:[`Instance id: `,u(`span`,{className:`font-mono`,children:P?.id})]}),M===void 0?u(`p`,{className:`text-sm text-foreground-muted`,children:`Loading form…`}):u(Fe,{schema:M,values:w,onChange:T,bare:!0},H)]}):null})]})}n();var yn=3e4,bn=[{capName:`auth-provider`,stageBadge:null},{capName:`user-passkeys`,stageBadge:`Second factor`}],xn={title:`Authentication`,subtitle:`Login providers (local password, OIDC, SAML) and second-factor providers (passkeys / WebAuthn). They run in parallel — enable or disable each independently; disabling one only removes that method, local password login is unaffected.`,emptyTitle:`No authentication providers registered`,emptyDescription:`Local auth should always be available — if this list is empty the local-auth builtin failed to register. Check the Addons page for load errors.`,installLabel:`Add provider`};function Sn(e){return e===`local-auth`?{headline:`Username + password (local).`,icon:j,bullets:[`Users live in the hub’s SQLite database — no IdP roundtrip.`,`TOTP / 2FA is self-enrolled: each user enables it from their own profile page (My access → Two-factor authentication).`,`Scoped tokens, admin tokens and sessions are managed from Identity → Tokens & sessions.`],setupSteps:[`A fresh hub has one account, admin / changeme — the first sign-in asks for a new password. Add users from Users → New user.`,`Hand out either passwords or scoped tokens — both validate through this provider.`]}:e.startsWith(`auth-oidc`)?{headline:`OpenID Connect (Google, Microsoft, Okta, Keycloak, …).`,icon:P,bullets:[`Three-leg redirect flow with PKCE S256 + nonce.`,`id_token is signature-verified against the IdP’s JWKS — no implicit trust.`,`Explicit linking only: an IdP account signs in only the CamStack user who linked it from their profile (My access → Linked sign-in accounts). No auto-created users, no email matching.`,`The linked user’s role, scopes and two-factor authentication apply.`],setupSteps:[`Register a web app at your IdP and copy the client_id + client_secret.`,"Choose a stable instance id (slug). Set the IdP redirect URI to `https://<this-hub>/addon/auth-oidc/<id>/callback`.",`In Settings below, Add connection — enter the id, issuer, and credentials; Save.`,`Each user then links their IdP account from My access → Linked sign-in accounts.`]}:e.startsWith(`auth-saml`)?{headline:`SAML 2.0 — enterprise SSO (Azure AD, Okta, OneLogin).`,icon:P,bullets:[`Heavier handshake than OIDC — exchange metadata XML with your IdP.`,`Group → role mapping via SAML assertions.`]}:e.startsWith(`auth-webauthn`)||e.startsWith(`auth-passkey`)?{headline:`Passkeys / WebAuthn — passwordless second factor.`,icon:g,bullets:[`Enroll a YubiKey, Touch ID, or platform passkey per user.`,`Resistant to phishing — the browser binds the credential to your hub origin.`]}:e.startsWith(`auth-totp`)?{headline:`TOTP — second factor.`,icon:g,bullets:[`Time-based codes from an authenticator app (RFC 6238).`,`Compatible with Google Authenticator, Aegis, 1Password, Bitwarden, etc.`]}:{headline:`Authentication provider.`,icon:E,bullets:[`Generic authentication provider. No additional hints registered.`]}}function Cn(){let e=se({capName:bn[0].capName},{refetchInterval:yn}),t=se({capName:bn[1].capName},{refetchInterval:yn}),n=le(void 0,{refetchInterval:yn}),r=i(()=>jt(n.data??[]),[n.data]),a=i(()=>{let n=[],i=[e.data??[],t.data??[]];for(let[e,t]of bn.entries())for(let a of i[e]??[])n.push({addonId:a.addonId,displayName:r.get(a.addonId)??a.addonId,isActive:a.isActive,capName:t.capName,stageBadge:t.stageBadge});return n},[e.data,t.data,r]),o=[{id:`authentication`,label:`Authentication providers`,install:{capability:bn[0].capName,label:xn.installLabel},entries:a.map(e=>({id:e.addonId,name:e.displayName,fallbackIcon:E,...At(e.isActive),render:()=>u(Dt,{addonId:e.addonId,displayName:e.displayName,capName:e.capName,isActive:e.isActive,badges:e.stageBadge===null?null:u(Pe,{variant:`info`,className:Ot,children:e.stageBadge}),settingsContent:e.addonId.startsWith(`auth-oidc`)?u(vn,{addonId:e.addonId}):void 0,panels:[{id:`about`,title:`About`,icon:Sn(e.addonId).icon,content:u(wn,{addonId:e.addonId})}]})}))}];return u(kt,{embedded:!0,icon:E,title:xn.title,subtitle:xn.subtitle,groups:o,isLoading:e.isLoading||t.isLoading,emptyTitle:xn.emptyTitle,emptyDescription:xn.emptyDescription})}function wn({addonId:e}){let t=Sn(e),n=t.icon;return r(`div`,{className:`space-y-3 rounded-lg border border-border bg-surface p-2 sm:p-4`,children:[r(`div`,{className:`flex items-start gap-2.5`,children:[u(n,{className:`h-4 w-4 mt-0.5 text-primary shrink-0`}),u(`div`,{className:`text-xs text-foreground font-medium`,children:t.headline})]}),u(`ul`,{className:`text-xs text-foreground-subtle space-y-1.5 pl-6 list-disc`,children:t.bullets.map((e,t)=>u(`li`,{children:e},t))}),t.setupSteps&&t.setupSteps.length>0&&r(`div`,{className:`rounded-md border border-border bg-surface-hover/40 px-3 py-2.5 space-y-1.5`,children:[r(`div`,{className:`flex items-center gap-1.5 text-[10px] font-semibold text-foreground-subtle uppercase tracking-wide`,children:[u(M,{className:`h-3 w-3`}),`Setup steps`]}),u(`ol`,{className:`text-xs text-foreground space-y-0.5 pl-4 list-decimal`,children:t.setupSteps.map((e,t)=>u(`li`,{children:e},t))})]}),e===`local-auth`&&r(`div`,{className:`rounded-md border border-info/30 bg-info/5 px-3 py-2 flex items-start gap-2 text-[11px] text-foreground`,children:[u(O,{className:`h-3.5 w-3.5 mt-0.5 text-info shrink-0`}),r(`span`,{children:[`TOTP / 2FA is self-service: each user enrols from their own profile page —`,` `,u(Xe,{to:`/system/my-access`,className:`underline text-primary`,children:`My access`}),` `,`→ “Two-factor authentication” → Enable 2FA. Admins can only remove a user’s active enrollment (lost device) from the`,` `,u(Xe,{to:`/system/identity?tab=users`,className:`underline text-primary`,children:`Users`}),` `,`page via Actions → “Remove 2FA”.`]})]})]})}function Tn({userId:e,username:t,onClose:n}){let i=J(),a=Y.useUtils(),o=Le({userId:e}),s=Y.auth.listLoginMethods.useQuery(),c=Ke({onSuccess:()=>void a.userManagement.listExternalIdentities.invalidate()}),l=new Map((s.data??[]).flatMap(e=>e.kind===`redirect`?[[e.id,e.label]]:[])),d=o.data??[],f=async(n,r)=>{await i({title:`Remove sign-in link`,message:`"${t}" will no longer be able to sign in with this ${r} account.`,confirmLabel:`Remove`,variant:`danger`})&&c.mutate({userId:e,provider:n.provider,subject:n.subject})};return u(Ae,{open:!0,onOpenChange:e=>!e&&n(),children:r(K,{width:`md`,placement:`sheet-on-mobile`,scroll:`body`,"data-testid":`external-identities-modal`,children:[u(W,{children:r(Re,{className:`flex items-center gap-2`,children:[u(x,{className:`h-4 w-4 text-primary`}),r(`span`,{children:[`Linked sign-in accounts`,r(`span`,{className:`mt-0.5 block text-[11px] font-normal text-foreground-subtle`,children:[`User: `,u(`span`,{className:`font-mono`,children:t})]})]})]})}),u(q,{className:`space-y-3`,children:o.isLoading?r(`div`,{className:`flex items-center gap-2 text-xs text-foreground-subtle`,children:[u(y,{className:`h-3.5 w-3.5 animate-spin`}),`Loading…`]}):d.length===0?u(`p`,{className:`text-xs text-foreground-subtle`,children:`No linked accounts. Only the user can link one, from their own profile page.`}):u(`ul`,{className:`divide-y divide-border rounded-md border border-border`,children:d.map(e=>{let t=l.get(e.provider),n=t??e.provider;return r(`li`,{className:`flex items-center gap-3 px-3 py-2 text-xs`,children:[r(`div`,{className:`flex-1 min-w-0`,children:[r(`div`,{className:`font-medium text-foreground truncate`,children:[n,t===void 0&&u(`span`,{className:`ml-2 rounded bg-foreground-subtle/15 px-1.5 py-0.5 text-[10px] font-normal text-foreground-subtle`,children:`provider unavailable`})]}),r(`div`,{className:`text-[11px] text-foreground-subtle truncate`,children:[e.label??e.subject,` ·`,` `,new Date(e.linkedAt).toLocaleDateString()]})]}),r(`button`,{onClick:()=>void f(e,n),disabled:c.isPending,className:`inline-flex items-center gap-1 rounded px-2 py-1 text-[10px] text-danger hover:bg-danger/10 disabled:opacity-50`,children:[u(B,{className:`h-3 w-3`}),`Remove`]})]},`${e.provider}|${e.subject}`)})})}),u(Be,{children:u(G,{onClick:n,variant:`secondary`,children:`Close`})})]})})}function En({userId:e,username:t,onClose:n}){let i=s(),a=J(),c=ze({userId:e}),l=c.data,d=()=>i.invalidateQueries({queryKey:[[`userManagement`,`getTotpStatus`]]}),f=Ce({onSuccess:()=>{d(),n()}}),p=c.isLoading?`loading`:l?.enabled?`enrolled`:`not_enrolled`;return u(Ae,{open:!0,onOpenChange:e=>!e&&n(),children:r(K,{width:`md`,placement:`sheet-on-mobile`,scroll:`body`,children:[u(W,{children:r(Re,{className:`flex items-center gap-2`,children:[u(g,{className:`h-4 w-4 text-primary`}),r(`span`,{children:[`Two-factor authentication`,r(`span`,{className:`mt-0.5 block text-[11px] font-normal text-foreground-subtle`,children:[`User: `,u(`span`,{className:`font-mono`,children:t})]})]})]})}),r(q,{className:`space-y-4`,children:[p===`loading`&&r(`div`,{className:`flex items-center gap-2 text-xs text-foreground-subtle`,children:[u(y,{className:`h-3.5 w-3.5 animate-spin`}),`Checking status…`]}),p===`not_enrolled`&&r(`div`,{className:`rounded-md border border-border bg-surface-hover/30 px-3 py-2.5 flex items-start gap-2.5 text-xs text-foreground-subtle`,children:[u(O,{className:`h-4 w-4 mt-0.5 shrink-0`}),r(`div`,{children:[u(`div`,{className:`font-medium text-foreground`,children:`2FA not enrolled`}),u(`p`,{className:`mt-0.5`,children:`Only the user themselves can enable 2FA, from their own profile page.`})]})]}),p===`enrolled`&&l&&r(o,{children:[r(`div`,{className:`rounded-md border border-emerald-500/30 bg-emerald-500/5 px-3 py-2.5 flex items-start gap-2.5`,children:[u(C,{className:`h-4 w-4 mt-0.5 text-emerald-500 shrink-0`}),r(`div`,{className:`text-xs text-foreground space-y-0.5`,children:[u(`div`,{className:`font-medium`,children:`2FA is active`}),r(`div`,{className:`text-foreground-subtle`,children:[`Enrolled on`,` `,l.confirmedAt?new Date(l.confirmedAt).toLocaleString():`—`]})]})]}),u(`div`,{className:`text-[11px] text-foreground-subtle`,children:`Removing here clears the server-side secret. Use this only when the user has lost access — they'll have to re-enroll from their profile page afterwards.`}),r(`div`,{className:`flex justify-end gap-2`,children:[u(G,{onClick:n,variant:`secondary`,children:`Close`}),r(`button`,{onClick:async()=>{await a({title:`Remove 2FA`,message:`Remove two-factor authentication for "${t}"? They'll be able to log in with just their password until they re-enroll from their own profile page.`,confirmLabel:`Remove`,variant:`danger`})&&f.mutate({userId:e})},disabled:f.isPending,className:`rounded bg-danger px-3 py-1.5 text-xs font-medium text-white hover:bg-danger/90 disabled:opacity-50 inline-flex items-center gap-1`,children:[f.isPending?u(y,{className:`h-3 w-3 animate-spin`}):u(S,{className:`h-3 w-3`}),`Remove 2FA`]})]})]})]})]})})}n();function Dn({userId:e,username:t,onClose:n}){let{user:i,logout:a}=X(),o=i?.id===e,s=J(),l=Y.useUtils(),d=Y.auth.listSessions.useQuery({userId:e}),[f,p]=c(null),m=Y.auth.revokeSessions.useMutation({onSuccess:(e,t)=>{if(o&&`userId`in t){a();return}l.auth.listSessions.invalidate()},onError:e=>p(`Sign out failed: ${e.message}`)}),h=async e=>{await s({title:`Sign out this session`,message:`"${t}" on ${st(e.client).label} will have to sign in again.`,confirmLabel:`Sign out`,variant:`danger`})&&(p(null),m.mutate({id:e.id}))},g=async()=>{await s({title:`Sign out everywhere`,message:o?`Every session of your own account ends, this browser included: you will be signed out here too.`:`Every session of "${t}" ends at once; each device has to sign in again.`,confirmLabel:`Sign out everywhere`,variant:`danger`})&&(p(null),m.mutate({userId:e}))},_=m.isPending&&m.variables!==void 0&&`id`in m.variables?m.variables.id:null;return u(Ae,{open:!0,onOpenChange:e=>!e&&n(),children:r(K,{width:`lg`,placement:`sheet-on-mobile`,scroll:`body`,"data-testid":`user-sessions-modal`,children:[u(W,{children:r(Re,{className:`flex items-center gap-2`,children:[u(z,{className:`h-4 w-4 text-primary`}),r(`span`,{children:[`Active sessions`,r(`span`,{className:`mt-0.5 block text-[11px] font-normal text-foreground-subtle`,children:[`User: `,u(`span`,{className:`font-mono`,children:t})]})]})]})}),r(q,{className:`space-y-3`,children:[f!==null&&u(`div`,{className:`text-[11px] text-danger`,children:f}),u(xt,{sessions:d.data??[],isLoading:d.isLoading,loadError:d.isError?d.error?.message??`Request failed`:null,emptyText:`No active sessions.`,onRevoke:e=>void h(e),revokingId:_})]}),r(Be,{className:`justify-between`,children:[r(`button`,{onClick:()=>void g(),disabled:m.isPending||(d.data??[]).length===0,className:`inline-flex items-center gap-1.5 rounded border border-danger/40 px-2.5 py-1 text-[11px] font-medium text-danger hover:bg-danger/10 disabled:opacity-50`,children:[m.isPending&&_===null?u(y,{className:`h-3 w-3 animate-spin`}):u(F,{className:`h-3 w-3`}),`Sign out everywhere`]}),u(G,{onClick:n,variant:`secondary`,children:`Close`})]})]})})}function On({icon:e,label:t,count:n,all:i,total:a}){return r(`div`,{className:`flex items-center gap-2 text-[11px]`,children:[u(e,{className:`h-3 w-3 shrink-0 text-foreground-subtle`}),u(`span`,{className:`min-w-0 flex-1 text-foreground-subtle`,children:t}),u(`span`,{className:n===0?`text-foreground-subtle`:`font-medium text-foreground`,children:n===0?`none`:i?`all ${a}`:`${n} of ${a}`})]})}function kn({scopes:e,isAdmin:t,invalidReason:n}){let i=D(),s=a({queryKey:[`auth`,`previewScope`,e,t],enabled:n===null,queryFn:()=>i.trpcClient.auth.previewScope.query({scopes:[...e],isAdmin:t})}),{data:c}=Ve({projection:`slim`}),l=c?.length??0;if(n!==null)return u(`div`,{className:`rounded-lg border border-border bg-surface p-3`,children:r(`p`,{className:`flex items-center gap-1.5 text-[11px] text-warning`,children:[u(k,{className:`h-3 w-3 shrink-0`}),n]})});if(s.isLoading)return r(`div`,{className:`flex items-center gap-2 rounded-lg border border-border bg-surface p-3 text-[11px] text-foreground-subtle`,children:[u(y,{className:`h-3 w-3 animate-spin`}),`Resolving…`]});if(s.isError||!s.data)return u(`div`,{className:`rounded-lg border border-border bg-surface p-3`,children:u(`p`,{className:`text-[11px] text-danger`,children:`Could not resolve this grant set. Saving is still allowed — the server enforces the same rules either way.`})});let d=s.data;return u(`div`,{className:`space-y-2 rounded-lg border border-border bg-surface p-3`,children:d.isAdmin?r(`p`,{className:`text-[11px] text-foreground`,children:[u(`span`,{className:`font-medium`,children:`Administrator`}),` — unrestricted. Grants are ignored for an admin.`]}):r(o,{children:[u(On,{icon:f,label:`Devices they can see`,count:d.device.view.deviceCount,all:d.device.view.all,total:l}),u(On,{icon:h,label:`Devices they can operate`,count:d.device.create.deviceCount,all:d.device.create.all,total:l}),u(On,{icon:p,label:`Devices they can delete`,count:d.device.delete.deviceCount,all:d.device.delete.all,total:l}),r(`div`,{className:`border-t border-border pt-2 text-[10px] text-foreground-subtle`,children:[`System access: `,d.system.length===0?`none`:d.system.join(`, `),d.capabilities.length>0&&r(o,{children:[` · Extra capabilities: `,d.capabilities.map(e=>e.name).join(`, `)]}),d.addons.length>0&&r(o,{children:[` · Addons: `,d.addons.map(e=>e.name).join(`, `)]})]}),d.device.view.deviceCount===0&&u(`p`,{className:`text-[10px] text-warning`,children:`This user will not be able to see any device.`})]})})}n();function An(e){let t=te(e);return t===null?{mode:e.length===0?`role`:`advanced`,roleId:null,selector:{kind:`all`},includeLinked:!0,advancedScopes:e}:{mode:`role`,roleId:t.roleId,selector:t.selector,includeLinked:t.includeLinked,advancedScopes:e}}function jn(e){return e.mode===`advanced`?e.advancedScopes:e.roleId===null?[]:V({roleId:e.roleId,selector:e.selector,includeLinked:e.includeLinked})}function Mn({user:e,onClose:t,onSubmit:n,submitting:a,callerScopes:s}){let l=i(()=>An(e.scopes??[]),[e.scopes]),[d,f]=c(l),[p,m]=c(l.mode===`advanced`),h=i(()=>jn(d),[d]),g=!e.isAdmin&&d.mode===`role`&&d.roleId===null,_=i(()=>e.isAdmin?null:d.mode===`role`&&d.roleId===null?`Pick what this user can do to see the result.`:we(h),[e.isAdmin,d.mode,d.roleId,h]),b=e=>f({...d,...e});return u(Ae,{open:!0,onOpenChange:e=>!e&&t(),children:r(K,{width:`lg`,placement:`sheet-on-mobile`,scroll:`body`,className:`md:max-w-2xl`,children:[r(W,{children:[r(Re,{children:[`Access — `,e.username]}),u(`p`,{className:`text-[10px] text-foreground-subtle`,children:e.isAdmin?`This user is an administrator — they can do everything, and the settings below are ignored.`:`Choose what they can do, then which devices it applies to.`})]}),r(q,{className:`space-y-4`,children:[g&&r(`div`,{className:`flex items-start gap-2 rounded-lg border border-warning/40 bg-warning/10 p-3`,children:[u(k,{className:`mt-0.5 h-3.5 w-3.5 shrink-0 text-warning`}),r(`p`,{className:`text-[11px] text-foreground`,children:[u(`span`,{className:`font-medium`,children:`No access.`}),` `,r(`span`,{className:`text-foreground-subtle`,children:[e.username,` cannot see or do anything yet. Configure it below.`]})]})]}),r(`section`,{className:`space-y-2`,children:[u(`h3`,{className:`text-[11px] font-semibold uppercase tracking-wide text-foreground-subtle`,children:`1 · What can they do`}),u(`div`,{className:`space-y-1.5`,children:ee.map(e=>{let t=d.mode===`role`&&d.roleId===e.id;return r(`label`,{className:`flex cursor-pointer items-start gap-2 rounded-lg border p-2.5 transition-colors ${t?`border-primary bg-primary/5`:`border-border hover:bg-foreground-subtle/5`}`,children:[u(`input`,{type:`radio`,name:`access-role`,checked:t,onChange:()=>b({mode:`role`,roleId:e.id}),className:`mt-0.5 border-border focus:ring-primary`}),r(`span`,{className:`min-w-0`,children:[u(`span`,{className:`block text-[12px] font-medium text-foreground`,children:e.label}),u(`span`,{className:`mt-0.5 block text-[10px] text-foreground-subtle`,children:e.description})]})]},e.id)})}),r(`button`,{type:`button`,onClick:()=>{if(!p){f({...d,mode:`advanced`,advancedScopes:h}),m(!0);return}m(!1),f(An(d.advancedScopes))},className:`inline-flex items-center gap-1 rounded px-1.5 py-1 text-[10px] text-foreground-subtle transition-colors hover:bg-foreground-subtle/10 hover:text-foreground`,children:[u(p?A:v,{className:`h-3 w-3`}),`Advanced — edit raw grants`]}),p&&r(`div`,{className:`rounded-lg border border-border p-2`,children:[u(`p`,{className:`mb-2 text-[10px] text-foreground-subtle`,children:`One row per grant. Anything expressible here overrides the three roles above; close this section to go back to them.`}),u(xe,{value:d.advancedScopes,onChange:e=>b({mode:`advanced`,advancedScopes:e}),clampToParent:s,emptyHint:r(o,{children:[`No grants.`,` `,u(`span`,{className:`font-medium text-foreground`,children:e.username}),` cannot call any protected endpoint until one is added.`]})})]})]}),d.mode===`role`&&r(`section`,{className:`space-y-2`,children:[u(`h3`,{className:`text-[11px] font-semibold uppercase tracking-wide text-foreground-subtle`,children:`2 · On which devices`}),u(je,{value:d.selector,onChange:e=>b({selector:e}),includeLinked:d.includeLinked,onIncludeLinkedChange:e=>b({includeLinked:e}),clampToDeviceIds:null})]}),r(`section`,{className:`space-y-2`,children:[u(`h3`,{className:`text-[11px] font-semibold uppercase tracking-wide text-foreground-subtle`,children:d.mode===`role`?`3 · Result`:`2 · Result`}),u(kn,{scopes:h,isAdmin:e.isAdmin,invalidReason:_})]})]}),r(Be,{children:[u(G,{variant:`outline`,size:`sm`,onClick:t,children:`Cancel`}),u(G,{size:`sm`,onClick:()=>n([...h]),disabled:a||_!==null,children:a?u(y,{className:`h-3 w-3 animate-spin`}):`Save access`})]})]})})}n();var $=8;function Nn(){return{username:``,password:``,isAdmin:!1}}function Pn(e){return{id:e.id,username:e.username,password:``,isAdmin:e.isAdmin}}function Fn(e){return e instanceof Error?e.message:`Something went wrong`}function In(){let e=s(),{user:t}=X(),{state:n,openNew:i,openEdit:a,close:l}=_e(),[f,v]=c(null),[b,S]=c(null),[C,w]=c(!1),{data:T,isLoading:D,isError:O,error:k,refetch:A}=Se(),j=J(),M=Ee(),P=()=>e.invalidateQueries({queryKey:[[`userManagement`,`listUsers`]]}),F=ce(),I=oe({onSuccess:P}),L=ae({onSuccess:P}),R=Te({onSuccess:P}),B=De({onSuccess:()=>{P(),H(null)}}),[V,H]=c(null),[ee,te]=c(null),[U,ne]=c(null),[re,ie]=c(null),W=T??[],K=n.mode===`edit`?W.find(e=>e.id===n.id)??null:null,se=()=>{v(null),S(null),w(!1),F.reset(),L.reset(),l()};d(()=>{if(n.mode===`closed`){v(null),S(null),w(!1);return}if(n.mode===`new`){v(e=>e!==null&&e.id===void 0?e:Nn());return}if(K===null){D||l();return}v(e=>e?.id===K.id?e:Pn(K))},[n,K,D,l]);let q=n.mode===`new`&&f!==null&&f.id===void 0||n.mode===`edit`&&f!==null&&K!==null;async function le(e){await j({title:`Delete user`,message:`Permanently delete user "${e.username}"? This cannot be undone — any active sessions will be revoked on next request.`,confirmLabel:`Delete`,variant:`danger`})&&(I.mutate({id:e.id}),n.mode===`edit`&&n.id===e.id&&se())}async function ue(e){let t=await M({title:`Reset password`,message:`Set a new password for "${e.username}".`,label:`New password`,inputType:`password`,placeholder:`At least 8 characters`,confirmLabel:`Continue`,validate:e=>e.length<$?`Password must be at least ${String($)} characters.`:null});t===null||t.length===0||await j({title:`Reset password`,message:`Reset the password for "${e.username}"? They will need to use the new password on their next login.`,confirmLabel:`Reset`})&&R.mutate({id:e.id,newPassword:t})}function de(e,t){t!==e.isAdmin&&L.mutate({id:e.id,isAdmin:t})}async function pe(){if(f!==null){S(null);try{if(f.id===void 0){let e=f.username.trim();if(e===``||f.password.length<$)return;await F.mutateAsync({username:e,password:f.password,isAdmin:f.isAdmin})}else await L.mutateAsync({id:f.id,isAdmin:f.isAdmin});P(),se()}catch(e){S(Fn(e))}}}function he(e){return e?new Date(typeof e==`number`?e:String(e)).toLocaleDateString(`en-GB`,{day:`2-digit`,month:`short`,year:`numeric`}):`—`}let ve=F.isPending||L.isPending,be=f!==null&&f.id===void 0&&f.username.trim()!==``&&f.password.length>=$,xe=f!==null&&f.id!==void 0,Ce=ve||(f?.id===void 0?!be:!xe),we=e=>I.isPending&&I.variables?.id===e.id||L.isPending&&L.variables?.id===e.id||R.isPending&&R.variables?.id===e.id;return r(at,{embedded:!0,icon:_,title:`Users`,subtitle:`Hub accounts, admin flag, access scopes, sessions and sign-in links.`,actions:r(G,{size:`sm`,type:`button`,onClick:()=>{S(null),i()},children:[u(m,{className:`h-3.5 w-3.5`}),`Create User`]}),children:[O&&u(ye,{title:`Could not load users`,message:Fn(k),onRetry:()=>void A()}),D&&r(`div`,{className:`flex items-center gap-2 text-xs text-foreground-subtle`,children:[u(y,{className:`h-3.5 w-3.5 animate-spin`}),`Loading…`]}),!D&&!O&&W.length===0&&u(Oe,{icon:_,title:`No users yet`,description:`Create a user to grant hub access.`}),!D&&!O&&W.length>0&&u(me,{columns:[{key:`username`,header:`Username`,sortValue:e=>e.username,render:e=>u(`span`,{className:`font-medium text-foreground`,"data-testid":`user-open-${e.id}`,children:e.username})},{key:`isAdmin`,header:`Admin`,nowrap:!0,sortValue:e=>+!!e.isAdmin,render:e=>u(`span`,{onClick:e=>e.stopPropagation(),children:r(`label`,{className:`inline-flex items-center gap-1.5 text-xs cursor-pointer`,children:[u(`input`,{type:`checkbox`,checked:e.isAdmin,onChange:t=>de(e,t.target.checked),disabled:we(e),className:`rounded border-border focus:ring-primary disabled:opacity-50`}),u(`span`,{className:e.isAdmin?`text-primary font-medium`:`text-foreground-subtle`,children:e.isAdmin?`Admin`:`Regular`})]})})},{key:`scopes`,header:`Access`,render:e=>e.isAdmin?u(`span`,{className:`text-[10px] italic text-foreground-subtle`,children:`everything (admin)`}):u(`span`,{onClick:e=>e.stopPropagation(),children:r(G,{size:`sm`,variant:`ghost`,type:`button`,onClick:()=>H(e),title:`Configure access`,children:[u(E,{className:`h-3 w-3 shrink-0 text-foreground-subtle`}),u(Ln,{scopes:e.scopes??[]})]})})},{key:`createdAt`,header:`Created`,nowrap:!0,sortValue:e=>e.createdAt,render:e=>u(`span`,{className:`text-foreground-subtle`,children:he(e.createdAt)})},{key:`actions`,header:`Actions`,align:`right`,nowrap:!0,notSortableReason:`Row actions`,render:e=>{let n=we(e),i=e.id!==t?.id&&e.totpEnabled;return r(`div`,{className:`flex items-center justify-end gap-1`,onClick:e=>e.stopPropagation(),children:[r(G,{size:`sm`,variant:`ghost`,type:`button`,onClick:()=>a(e.id),disabled:n,title:`Edit user`,children:[u(h,{className:`h-3 w-3`}),`Edit`]}),i&&r(G,{size:`sm`,variant:`ghost`,type:`button`,onClick:()=>te(e),disabled:n,title:`Remove two-factor authentication`,children:[u(g,{className:`h-3 w-3`}),`Remove 2FA`]}),r(G,{size:`sm`,variant:`ghost`,type:`button`,onClick:()=>ne(e),disabled:n,title:`Linked sign-in accounts`,children:[u(x,{className:`h-3 w-3`}),`Sign-in links`]}),r(G,{size:`sm`,variant:`ghost`,type:`button`,onClick:()=>ie(e),disabled:n,title:`Active sessions`,children:[u(z,{className:`h-3 w-3`}),`Sessions`]}),r(G,{size:`sm`,variant:`ghost`,type:`button`,onClick:()=>void ue(e),disabled:n,title:`Reset password`,children:[u(N,{className:`h-3 w-3`}),`Reset password`]}),r(G,{size:`sm`,variant:`ghost`,type:`button`,onClick:()=>void le(e),disabled:n,title:`Delete user`,className:`text-danger hover:bg-danger/10`,children:[n?u(y,{className:`h-3 w-3 animate-spin`}):u(p,{className:`h-3 w-3`}),`Delete`]})]})}}],rows:W,rowKey:e=>e.id,minWidthPx:560,maxBodyHeight:`max-h-[60vh]`,mobileMode:`scroll`,onRowClick:e=>a(e.id)}),u(Ge,{open:q,onClose:se,title:f?.id===void 0?`Create User`:`Edit ${f.username||`user`}`,icon:_,error:b,testId:`user-form-dialog`,footer:u(G,{size:`sm`,type:`button`,disabled:Ce,onClick:()=>void pe(),children:ve?r(o,{children:[u(y,{className:`h-3.5 w-3.5 animate-spin`}),`Saving…`]}):f?.id===void 0?`Create`:`Save`}),children:f!==null&&r(`div`,{className:`space-y-3`,children:[u(fe,{label:`Username`,required:f.id===void 0,children:u(Me,{value:f.username,onChange:e=>v({...f,username:e.target.value}),placeholder:`john`,autoFocus:f.id===void 0,disabled:f.id!==void 0,"data-testid":`user-form-username`})}),f.id===void 0&&u(fe,{label:`Password`,required:!0,description:`At least ${String($)} characters.`,children:u(ge,{value:f.password,onValueChange:e=>v({...f,password:e}),shown:C,onToggleShown:()=>w(e=>!e),placeholder:`••••••••`,"data-testid":`user-form-password`})}),u(fe,{label:`Admin`,description:`Unrestricted access to every capability and device.`,children:r(`label`,{className:`inline-flex items-center gap-2 text-xs text-foreground cursor-pointer`,children:[u(`input`,{type:`checkbox`,checked:f.isAdmin,onChange:e=>v({...f,isAdmin:e.target.checked}),className:`rounded border-border focus:ring-primary`,"data-testid":`user-form-admin`}),u(`span`,{children:`Admin`})]})}),f.id!==void 0&&u(`p`,{className:`text-[11px] text-foreground-subtle`,children:`To change the password, use Reset password on the user's row. Access scopes are configured from the Access column.`})]})}),ee&&u(En,{userId:ee.id,username:ee.username,onClose:()=>te(null)}),U&&u(Tn,{userId:U.id,username:U.username,onClose:()=>ne(null)}),re&&u(Dn,{userId:re.id,username:re.username,onClose:()=>ie(null)}),V&&u(Rn,{user:V,onClose:()=>H(null),onSubmit:e=>B.mutate({userId:V.id,scopes:e}),submitting:B.isPending})]})}function Ln({scopes:e}){if(e.length===0)return u(`span`,{className:`font-medium text-warning`,children:`No access`});let t=te(e);return t===null?r(`span`,{className:`text-foreground-subtle`,children:[`Custom · `,e.length,` grant`,e.length===1?``:`s`]}):r(`span`,{className:`text-foreground-subtle`,children:[u(`span`,{className:`font-medium text-foreground`,children:U(t.roleId).label}),` ·`,` `,Ne(t.selector)]})}function Rn(e){let{user:t}=X(),n=t?.isAdmin===!0;return u(Mn,{...e,callerScopes:n?null:t?.scopes??[]})}var zn={"api-keys":Q.tokens,"linked-sessions":Q.linkedApps};function Bn(){let{t:e}=Je(),[t]=Ze(),n=un(),r=zn[t.get(`tab`)??``];if(r!==void 0)return u($e,{to:nt(`access`,{integration:r}),replace:!0});let i=Ye(`/system/identity`,{t:e,isAdmin:!0})??{icon:T,title:e(`system.identity`,`Identity & Access`)},a=t.get(`tab`)??`users`,o=t.get(`integration`),s=a===et.access.tab?ln(o,n.requestCreate):void 0;return u(it,{icon:i.icon,title:i.title,defaultSection:`users`,sectionsLabel:`${i.title} sections`,actions:s,sections:[{id:`users`,label:`Users`,content:u(In,{})},{id:et.access.tab,label:`Tokens & sessions`,content:u(cn,{createRequested:n.createRequested,onCreateConsumed:n.clearCreate}),ownedParams:rt.concat([Bt.token,Bt.scoped,Bt.admin])},{id:et.authentication.tab,label:`Authentication`,content:u(Cn,{}),ownedParams:rt}]})}export{Bn as IdentityPage};

package/dist/assets/MyAccess-BvJqlxVR.js

@@ -1,2 +0,0 @@
-const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["./browser-BHo8W_uH.js","./rolldown-runtime-Cyuzqnbw.js"])))=>i.map(i=>d[i]);
-import{a as e}from"./rolldown-runtime-Cyuzqnbw.js";import{t}from"./vite-preload-helper-kNaey6uv.js";import{K as n,Q as r,S as i,W as a,a as o,b as s,q as c,t as l,x as u,z as d}from"./_virtual_mf___mfe_internal__admin_ui_host__loadShare___mf_0_tanstack_mf_1_react_mf_2_query__loadShare__.js-DhP-Lgiq.js";import{Ir as f,It as p,Nt as m,Pn as h,Q as g,Qt as _,Yr as v,ar as y,cr as b,fi as x,nr as S,ot as C,pi as w,pr as T}from"./player-overlays-C20AJTgs.js";import{o as E}from"./video-Bkjg9omB.js";import{t as D}from"./key-round-Dzvj04Ko.js";import{t as O}from"./monitor-smartphone-yIys4K1P.js";import{t as k}from"./unlink-2_Gor_ZF.js";import{Kn as A,qn as j}from"./client-CKGZv6zJ.js";import{Bn as ee,Cn as te,Do as ne,Ft as M,Gl as re,Wn as ie,Z as ae,Zn as N,gu as P,ko as F,wn as I}from"./src-CIIJy_o8.js";import{t as L}from"./useTranslation-Bc5yH9V9.js";import"./mount-C-bu65w9.js";import{R,i as z,n as oe,r as B,t as V}from"./index-AsTGrKva.js";import{t as H}from"./AdminPage-Pnx0mTsE.js";import{a as U,i as W,r as G,t as K}from"./SessionsList-Dm6Me6Pk.js";r();function q({value:n,size:r=192}){let[a,o]=c(null),[s,l]=c(null);if(d(()=>{let r=!1;return t(()=>import(`./browser-BHo8W_uH.js`).then(t=>e(t.default,1)).then(async e=>{if(r)return;let t=e.create;if(typeof t!=`function`){l(`qrcode.create() unavailable in installed version`);return}try{let e=t(n,{errorCorrectionLevel:`M`});r||o(e)}catch(e){r||l(e instanceof Error?e.message:`QR generation failed`)}}),__vite__mapDeps([0,1]),import.meta.url).catch(()=>{r||l(`qrcode library not installed`)}),()=>{r=!0}},[n]),s)return u(`div`,{className:`flex items-center justify-center text-[10px] text-foreground-subtle text-center p-4`,style:{width:r,height:r},children:`QR rendering unavailable — use the secret below.`});if(!a)return u(`div`,{className:`flex items-center justify-center text-[10px] text-foreground-subtle animate-pulse`,style:{width:r,height:r},children:`Generating…`});let f=a.modules.size,p=r/f,m=[];for(let e=0;e<f;e++)for(let t=0;t<f;t++)a.modules.data[e*f+t]&&m.push(u(`rect`,{x:t*p,y:e*p,width:p,height:p,fill:`currentColor`},`${t}-${e}`));return i(`svg`,{width:r,height:r,viewBox:`0 0 ${r} ${r}`,className:`text-black`,children:[u(`rect`,{x:0,y:0,width:r,height:r,fill:`white`}),m]})}var se=`${A}/connect`,J={public:0,mesh:1,lan:2,"lan-ipv6":3};function ce(e){switch(e.kind){case`public`:return e.interfaceKind===`vpn`?`mesh`:`public`;case`lan-ipv4`:return`lan`;case`lan-ipv6`:return`lan-ipv6`;case`custom`:return`public`;case`loopback`:case`app-link`:return null}}function Y(e){return j(e)}function le(e){return e.startsWith(`https://`)}function ue(e){let t=e.flatMap(e=>{let t=ce(e),n=Y(e.baseUrl);return t===null||n===null?[]:[{endpoint:e,tier:t,origin:n}]}).toSorted((e,t)=>J[e.tier]-J[t.tier]||Number(t.endpoint.plausible)-Number(e.endpoint.plausible)||e.endpoint.priority-t.endpoint.priority),n=new Set;return t.flatMap(({endpoint:e,tier:t,origin:r})=>n.has(r)?[]:(n.add(r),[{origin:r,label:e.label,tier:t,secure:le(r),plausible:e.plausible}]))}function de(e,t,n=null){for(let r of[t,n]){if(r===null)continue;let t=Y(r),n=e.find(e=>e.origin===t);if(n!==void 0)return n}return e[0]??null}function fe(e){let t=new URL(se);return t.searchParams.set(`hub`,e),t.toString()}r();var pe=176,X={scheme:`https`};function me(){let{t:e}=L(),t=F(X),n=ne(X).data?.roles.publicEndpoint.resolved??null;return i(`div`,{className:`rounded-lg border border-border bg-surface overflow-hidden`,children:[i(`div`,{className:`px-4 py-2.5 border-b border-border flex items-center gap-2`,children:[u(_,{className:`h-3.5 w-3.5 text-foreground-subtle`}),u(`div`,{className:`text-xs font-semibold text-foreground`,children:e(`connectPhone.title`)})]}),i(`div`,{className:`p-4 space-y-3`,children:[u(`p`,{className:`text-[11px] text-foreground-subtle`,children:e(`connectPhone.description`)}),t.isPending?i(`div`,{className:`flex items-center gap-2 text-[11px] text-foreground-subtle`,children:[u(y,{className:`h-3.5 w-3.5 animate-spin`}),e(`connectPhone.loading`)]}):t.isError?i(`div`,{className:`flex items-start gap-2 text-[11px] text-danger`,children:[u(m,{className:`h-3.5 w-3.5 mt-0.5 shrink-0`}),i(`div`,{className:`flex-1 min-w-0 space-y-1.5`,children:[u(`div`,{className:`break-words`,children:e(`connectPhone.error`,{message:t.error.message})}),u(ee,{size:`sm`,variant:`ghost`,onClick:()=>void t.refetch(),children:e(`connectPhone.retry`)})]})]}):u(he,{candidates:ue(t.data.endpoints),preferredOrigin:n})]})]})}function he({candidates:e,preferredOrigin:t}){let{t:n}=L(),[r,o]=c(null),s=de(e,r,t),l=a(()=>s?fe(s.origin):null,[s]);if(s===null||l===null)return u(`p`,{className:`text-[11px] text-foreground-subtle`,children:n(`connectPhone.empty`)});let d=e=>n(`connectPhone.tier.${e}`),f=e.map(e=>({value:e.origin,label:`${d(e.tier)} — ${e.origin}`}));return i(`div`,{className:`flex flex-col sm:flex-row gap-4`,children:[u(te,{value:l,size:pe,alt:n(`connectPhone.qrAlt`),className:`self-start`}),i(`div`,{className:`flex-1 min-w-0 space-y-3`,children:[i(`label`,{className:`block space-y-1`,children:[u(`span`,{className:`text-[11px] font-medium text-foreground`,children:n(`connectPhone.addressLabel`)}),u(re,{value:s.origin,options:f,onChange:e=>o(e.target.value)}),i(`span`,{className:`block text-[10px] text-foreground-subtle`,children:[d(s.tier),` · `,s.label]})]}),!s.secure&&u(Z,{text:n(`connectPhone.insecure`)}),!s.plausible&&u(Z,{text:n(`connectPhone.implausible`)}),i(`div`,{className:`space-y-1`,children:[u(`span`,{className:`text-[11px] font-medium text-foreground`,children:n(`connectPhone.linkLabel`)}),i(`div`,{className:`flex items-center gap-1 rounded-md border border-border bg-background px-2 py-1`,children:[u(`code`,{className:`flex-1 min-w-0 font-mono text-[11px] text-foreground break-all select-all`,children:l}),u(M,{value:l,srLabel:n(`connectPhone.linkLabel`)})]})]}),u(`p`,{className:`text-[11px] text-foreground-subtle`,children:n(`connectPhone.signInHint`)})]})]})}function Z({text:e}){return i(`div`,{className:`flex items-start gap-2 rounded-md border border-warning/30 bg-warning/5 px-2.5 py-1.5 text-[11px] text-foreground`,children:[u(m,{className:`h-3.5 w-3.5 text-warning mt-0.5 shrink-0`}),u(`span`,{children:e})]})}r();function ge(e){return new Date(e).toLocaleDateString()}function _e(){let e=N(),t=P.useUtils(),r=P.auth.listLinkableProviders.useQuery(),a=P.auth.listOwnExternalIdentities.useQuery(),[o,s]=c(null),[l,f]=c(()=>z(window.location.search)),p=n(null),m=W(`Linking a sign-in account`),h=n(null);d(()=>()=>h.current?.(),[]);let[_,v]=c(null);d(()=>{if(l===null)return;let e=new URL(window.location.href);e.searchParams.delete(`linked`),e.searchParams.delete(`linkError`),window.history.replaceState({},``,e.pathname+e.search+e.hash)},[l]);let S=P.auth.beginExternalLink.useMutation({onSuccess:({url:e})=>{let n=p.current;if(p.current=null,n===null||n.closed){window.location.assign(e);return}let r=e=>{v(null),f(z(`?${e}`)),t.auth.listOwnExternalIdentities.invalidate()};h.current?.(),h.current=oe(n,{onReturn:e=>{e.target===`profile`&&r(e.query)},onDone:e=>{e.target===`profile`&&r(e.query)},onClosed:()=>{h.current?.(),h.current=null,t.auth.listOwnExternalIdentities.invalidate()}}),n.location.href=g(B(e))},onError:e=>{p.current?.close(),p.current=null,v(null),s(e.message)}}),C=P.auth.unlinkOwnExternalIdentity.useMutation({onSuccess:()=>void t.auth.listOwnExternalIdentities.invalidate(),onError:e=>s(e.message)}),T=r.data??[],E=a.data??[],D=_!==null&&E.some(e=>e.provider===_);if(d(()=>{!D||_===null||(v(null),f({kind:`linked`,provider:_}))},[D,_]),T.length===0&&E.length===0)return null;let O=new Set(E.map(e=>e.provider)),A=e=>T.find(t=>t.provider===e)?.label??e,j=async(t,n)=>{await e({title:`Unlink sign-in account`,message:`Stop signing in with this ${n} account?`,confirmLabel:`Unlink`,variant:`danger`})&&(s(null),C.mutate({provider:t.provider,subject:t.subject}))};return i(`div`,{"data-testid":`linked-sign-ins`,className:`rounded-lg border border-border bg-surface overflow-hidden`,children:[m.dialog,i(`div`,{className:`px-4 py-2.5 border-b border-border flex items-center gap-2`,children:[u(b,{className:`h-3.5 w-3.5 text-foreground-subtle`}),u(`div`,{className:`text-xs font-semibold text-foreground`,children:`Linked sign-in accounts`})]}),i(`div`,{className:`p-4 space-y-3`,children:[u(`p`,{className:`text-[11px] text-foreground-subtle`,children:`Sign in with an external account instead of your password. Only accounts you link here can sign you in; your two-factor authentication still applies.`}),l?.kind===`linked`&&i(`div`,{className:`flex items-center gap-2 rounded-md border border-emerald-500/30 bg-emerald-500/5 px-3 py-2 text-xs text-foreground`,children:[u(x,{className:`h-3.5 w-3.5 text-emerald-500 shrink-0`}),`Linked your `,A(l.provider),` account.`]}),(l?.kind===`error`||o)&&i(`div`,{className:`flex items-center gap-2 rounded-md border border-danger/20 bg-danger/10 px-3 py-2 text-xs text-danger`,children:[u(w,{className:`h-3.5 w-3.5 shrink-0`}),o??(l?.kind===`error`?l.message:``)]}),E.length>0&&u(`ul`,{className:`divide-y divide-border rounded-md border border-border`,children:E.map(e=>{let t=e.providerLabel??e.provider;return i(`li`,{className:`flex items-center gap-3 px-3 py-2 text-xs`,children:[i(`div`,{className:`flex-1 min-w-0`,children:[i(`div`,{className:`font-medium text-foreground truncate`,children:[t,!e.available&&u(`span`,{className:`ml-2 rounded bg-foreground-subtle/15 px-1.5 py-0.5 text-[10px] font-normal text-foreground-subtle`,children:`provider unavailable`})]}),i(`div`,{className:`text-[11px] text-foreground-subtle truncate`,children:[e.label??e.subject,` · linked `,ge(e.linkedAt)]})]}),i(`button`,{onClick:()=>void j(e,t),disabled:C.isPending,className:`inline-flex items-center gap-1 rounded px-2 py-1 text-[10px] text-danger hover:bg-danger/10 disabled:opacity-50`,children:[u(k,{className:`h-3 w-3`}),`Unlink`]})]},`${e.provider}|${e.subject}`)})}),u(`div`,{className:`flex flex-wrap gap-2`,children:T.filter(e=>!O.has(e.provider)).map(e=>i(`button`,{onClick:()=>{s(null),f(null),m.requestProof().then(t=>{t!==null&&(p.current=V(null),v(p.current===null?null:e.provider),S.mutate({provider:e.provider,reauthToken:t}))})},disabled:S.isPending,className:`inline-flex items-center gap-1.5 rounded border border-border px-2.5 py-1 text-[11px] font-medium text-foreground hover:bg-surface-hover disabled:opacity-50`,children:[S.isPending&&S.variables?.provider===e.provider?u(y,{className:`h-3 w-3 animate-spin`}):u(b,{className:`h-3 w-3`}),`Link `,e.label]},e.provider))})]})]})}r();function Q(e){return e.message.length>0?e.message:`Request failed`}function ve(){let{logout:e}=R(),t=N(),n=P.useUtils(),r=P.auth.listOwnSessions.useQuery(),[a,o]=c(null),s=P.auth.revokeOwnSession.useMutation({onSuccess:()=>void n.auth.listOwnSessions.invalidate(),onError:e=>o(`Sign out failed: ${Q(e)}`)}),l=P.auth.logout.useMutation({onSuccess:()=>e(),onError:e=>o(`Sign out failed: ${Q(e)}`)}),d=async e=>{await t({title:`Sign out this session`,message:`${U(e.client).label} will have to sign in again.`,confirmLabel:`Sign out`,variant:`danger`})&&(o(null),s.mutate({id:e.id}))},f=async()=>{await t({title:`Sign out everywhere`,message:`Every session of your account ends, this browser included: you will be signed out here too and every device has to sign in again.`,confirmLabel:`Sign out everywhere`,variant:`danger`})&&(o(null),l.mutate({everywhere:!0}))};return i(`div`,{"data-testid":`my-sessions`,className:`rounded-lg border border-border bg-surface overflow-hidden`,children:[i(`div`,{className:`px-4 py-2.5 border-b border-border flex items-center gap-2`,children:[u(O,{className:`h-3.5 w-3.5 text-foreground-subtle`}),u(`div`,{className:`text-xs font-semibold text-foreground`,children:`Active sessions`})]}),i(`div`,{className:`p-4 space-y-3`,children:[u(`p`,{className:`text-[11px] text-foreground-subtle`,children:`The browsers and apps signed in to your account. Signing one out ends it at once.`}),a!==null&&u(`div`,{className:`text-[11px] text-danger`,children:a}),u(K,{sessions:r.data??[],isLoading:r.isLoading,loadError:r.isError?r.error?.message??`Request failed`:null,emptyText:`No active sessions.`,onRevoke:e=>void d(e),revokingId:s.isPending?s.variables?.id??null:null}),u(`div`,{className:`flex justify-end`,children:i(`button`,{onClick:()=>void f(),disabled:l.isPending,className:`inline-flex items-center gap-1.5 rounded border border-danger/40 px-2.5 py-1 text-[11px] font-medium text-danger hover:bg-danger/10 disabled:opacity-50`,children:[l.isPending?u(y,{className:`h-3 w-3 animate-spin`}):u(E,{className:`h-3 w-3`}),`Sign out everywhere`]})})]})]})}r();var ye={view:{icon:f,cls:`bg-foreground-subtle/15 text-foreground-subtle`},create:{icon:h,cls:`bg-primary/15 text-primary`},delete:{icon:p,cls:`bg-danger/15 text-danger`}};function be(){let{user:e,logout:t}=R();if(!e)return u(H,{children:u(`div`,{className:`text-xs text-foreground-subtle`,children:`Not signed in.`})});let n=e.isAdmin,r=e.scopes??[];return i(H,{children:[i(`div`,{className:`rounded-lg border border-border bg-surface px-4 py-3 flex items-center gap-3`,children:[u(`div`,{className:`flex h-10 w-10 items-center justify-center rounded-full bg-primary/10 text-primary font-semibold text-base`,children:e.username.slice(0,1).toUpperCase()}),i(`div`,{className:`flex-1 min-w-0`,children:[u(`div`,{className:`text-sm font-semibold text-foreground truncate`,children:e.username}),i(`div`,{className:`text-[11px] text-foreground-subtle`,children:[n?`Administrator`:`User`,` · session id`,` `,i(`span`,{className:`font-mono`,children:[e.id.slice(0,8),`…`]})]})]})]}),n&&i(`div`,{className:`rounded-lg border border-primary/30 bg-primary/5 px-4 py-3 text-xs text-foreground flex items-start gap-2.5`,children:[u(T,{className:`h-4 w-4 text-primary mt-0.5 shrink-0`}),i(`div`,{children:[u(`div`,{className:`font-semibold text-foreground`,children:`Unrestricted access`}),u(`p`,{className:`text-foreground-subtle mt-0.5`,children:`Admin sessions bypass the per-call scope check. Every protected endpoint is reachable regardless of the list below.`})]})]}),u(xe,{}),u(Se,{username:e.username}),u(Ce,{}),u(_e,{}),u(G,{}),u(ve,{}),u(me,{}),r.length>0&&i(`div`,{className:`rounded-lg border border-border bg-surface overflow-hidden`,children:[i(`div`,{className:`px-4 py-2 border-b border-border`,children:[u(`div`,{className:`text-xs font-semibold text-foreground`,children:`Granted scopes`}),u(`div`,{className:`text-[10px] text-foreground-subtle`,children:`Baked into your session token at login; sign out + back in to refresh after changes.`})]}),i(`div`,{className:`grid grid-cols-[100px_1fr_240px] gap-3 px-4 py-2 text-[10px] uppercase tracking-wide text-foreground-subtle border-b border-border`,children:[u(`div`,{children:`Type`}),u(`div`,{children:`Target`}),u(`div`,{children:`Access`})]}),u(`ul`,{className:`divide-y divide-border`,children:r.map((e,t)=>i(`li`,{className:`grid grid-cols-[100px_1fr_240px] gap-3 px-4 py-2.5 items-center text-xs`,children:[u(`span`,{className:`font-mono text-foreground-subtle`,children:e.type}),u(`span`,{className:`font-mono text-foreground`,children:e.type===`device`?ae(e.selector):e.target}),u(`div`,{className:`flex items-center gap-1`,children:[`view`,`create`,`delete`].map(t=>{let n=e.access.includes(t),{icon:r,cls:a}=ye[t];return i(`span`,{className:`inline-flex items-center gap-1 rounded px-1.5 py-0.5 text-[10px] font-medium ${n?a:`bg-transparent text-foreground-subtle/40 line-through`}`,title:n?`Can ${t}`:`Cannot ${t}`,children:[u(r,{className:`h-3 w-3`}),t]},t)})})]},t))})]}),u(`div`,{className:`flex justify-end`,children:i(`button`,{onClick:t,className:`inline-flex items-center gap-1.5 rounded border border-border px-2.5 py-1 text-[11px] font-medium text-foreground-subtle hover:bg-foreground-subtle/10 hover:text-foreground transition-colors`,children:[u(E,{className:`h-3 w-3`}),`Sign out`]})})]})}function xe(){let e=C(),[t,n]=c(``),[r,a]=c(``),[o,s]=c(``),[d,f]=c(null),p=l({mutationFn:t=>e.changeOwnPassword(t),onSuccess:()=>{f({kind:`success`,msg:`Password updated.`}),n(``),a(``),s(``)},onError:e=>{f({kind:`error`,msg:e instanceof Error?e.message:`Update failed`})}}),m=r.length>0&&o.length>0&&r!==o,h=r.length>0&&r.length<8,g=t.length>=1&&r.length>=8&&r===o;return i(`div`,{className:`rounded-lg border border-border bg-surface overflow-hidden`,children:[i(`div`,{className:`px-4 py-2.5 border-b border-border flex items-center gap-2`,children:[u(D,{className:`h-3.5 w-3.5 text-foreground-subtle`}),u(`div`,{className:`text-xs font-semibold text-foreground`,children:`Change password`})]}),i(`div`,{className:`p-4 space-y-3`,children:[u($,{label:`Current password`,value:t,onChange:n,autoComplete:`current-password`}),u($,{label:`New password`,value:r,onChange:a,autoComplete:`new-password`,hint:`At least 8 characters.`}),u($,{label:`Confirm new password`,value:o,onChange:s,autoComplete:`new-password`}),(m||h)&&u(`div`,{className:`text-[11px] text-danger`,children:m?`Passwords do not match.`:`New password must be at least 8 characters.`}),d&&i(`div`,{className:`text-[11px] flex items-center gap-1 ${d.kind===`success`?`text-emerald-500`:`text-danger`}`,children:[d.kind===`success`?u(x,{className:`h-3 w-3`}):u(w,{className:`h-3 w-3`}),d.msg]}),u(`div`,{className:`flex justify-end`,children:i(`button`,{onClick:()=>{f(null),p.mutate({currentPassword:t,newPassword:r})},disabled:!g||p.isPending,className:`inline-flex items-center gap-1 rounded bg-primary px-3 py-1.5 text-xs font-medium text-primary-foreground hover:bg-primary/90 disabled:opacity-50`,children:[p.isPending?u(y,{className:`h-3 w-3 animate-spin`}):u(S,{className:`h-3 w-3`}),`Update password`]})})]})]})}function $({label:e,value:t,onChange:n,autoComplete:r,hint:a}){return i(`div`,{className:`space-y-1`,children:[u(`label`,{className:`text-[10px] uppercase tracking-wide text-foreground-subtle`,children:e}),u(`input`,{type:`password`,value:t,onChange:e=>n(e.target.value),autoComplete:r,className:`w-full rounded border border-border bg-background px-2 py-1.5 text-xs text-foreground focus:outline-none focus:ring-1 focus:ring-primary`}),a&&u(`div`,{className:`text-[10px] text-foreground-subtle`,children:a})]})}function Se({username:e}){let t=C(),n=o({queryKey:[`auth`,`getOwnTotpStatus`],queryFn:()=>t.getOwnTotpStatus()}),r=n.data,[f,p]=c(null),[m,h]=c(``),[g,b]=c(null),[S,T]=c(!1),E=l({mutationFn:()=>t.setupOwnTotp(),onSuccess:e=>{p({secret:e.secret,otpauthUrl:e.otpauthUrl}),h(``),b(null)},onError:e=>b(e instanceof Error?e.message:`Setup failed`)}),D=l({mutationFn:e=>t.confirmOwnTotp(e),onSuccess:()=>{p(null),h(``),b(null),n.refetch()},onError:e=>b(e instanceof Error?e.message:`Confirmation failed — code did not match`)}),O=W(`Turning off two-factor authentication`),k=l({mutationFn:async()=>{let e=await O.requestProof();return e===null?null:t.disableOwnTotp({reauthToken:e})},onSuccess:()=>{b(null),n.refetch()},onError:e=>b(e instanceof Error?e.message:`Disable failed`)});d(()=>{if(!S)return;let e=setTimeout(()=>T(!1),1500);return()=>clearTimeout(e)},[S]);let A=a(()=>n.isLoading?`loading`:f?`setup_in_progress`:r?.enabled?`enrolled`:`not_enrolled`,[n.isLoading,r?.enabled,f]);return i(`div`,{className:`rounded-lg border border-border bg-surface overflow-hidden`,children:[O.dialog,i(`div`,{className:`px-4 py-2.5 border-b border-border flex items-center gap-2`,children:[u(_,{className:`h-3.5 w-3.5 text-foreground-subtle`}),u(`div`,{className:`text-xs font-semibold text-foreground`,children:`Two-factor authentication`})]}),i(`div`,{className:`p-4 space-y-3`,children:[A===`loading`&&i(`div`,{className:`flex items-center gap-2 text-xs text-foreground-subtle`,children:[u(y,{className:`h-3.5 w-3.5 animate-spin`}),`Checking status…`]}),A===`not_enrolled`&&i(s,{children:[u(`div`,{className:`text-xs text-foreground-subtle`,children:`2FA isn't active on your account. Enable it to require a 6-digit code from your authenticator app at every login.`}),u(`div`,{className:`flex justify-end`,children:i(`button`,{onClick:()=>{b(null),E.mutate()},disabled:E.isPending,className:`inline-flex items-center gap-1 rounded bg-primary px-3 py-1.5 text-xs font-medium text-primary-foreground hover:bg-primary/90 disabled:opacity-50`,children:[E.isPending?u(y,{className:`h-3 w-3 animate-spin`}):u(_,{className:`h-3 w-3`}),`Enable 2FA`]})})]}),A===`setup_in_progress`&&f&&i(s,{children:[i(`div`,{className:`text-[11px] text-foreground-subtle`,children:[`Scan the QR code (or enter the secret manually) into your authenticator app for`,` `,u(`span`,{className:`font-mono`,children:e}),`, then enter the 6-digit code below to confirm.`]}),i(`div`,{className:`flex flex-col items-center gap-3`,children:[u(`div`,{className:`rounded-lg border border-border bg-white p-3`,children:u(q,{value:f.otpauthUrl,size:180})}),i(`div`,{className:`w-full`,children:[u(`div`,{className:`text-[10px] uppercase tracking-wide text-foreground-subtle mb-1`,children:`Secret (manual entry)`}),i(`div`,{className:`flex items-center gap-2 rounded border border-border bg-surface-hover/30 px-2 py-1.5`,children:[u(`code`,{className:`text-[11px] font-mono text-foreground break-all flex-1`,children:f.secret}),i(`button`,{onClick:()=>{f&&navigator.clipboard.writeText(f.secret).then(()=>T(!0))},className:`inline-flex items-center gap-1 text-[10px] text-foreground-subtle hover:text-foreground`,children:[S?u(x,{className:`h-3 w-3 text-emerald-500`}):u(v,{className:`h-3 w-3`}),S?`Copied`:`Copy`]})]})]})]}),i(`div`,{className:`space-y-1`,children:[u(`label`,{className:`text-[10px] uppercase tracking-wide text-foreground-subtle`,children:`6-digit code`}),u(`input`,{type:`text`,inputMode:`numeric`,autoComplete:`one-time-code`,placeholder:`123456`,value:m,onChange:e=>h(e.target.value.replace(/\D/g,``).slice(0,6)),className:`w-full rounded-md border border-border bg-surface px-3 py-2 text-center text-lg font-mono tracking-widest text-foreground focus:outline-none focus:ring-2 focus:ring-primary`})]}),g&&i(`div`,{className:`text-[11px] text-danger flex items-center gap-1`,children:[u(w,{className:`h-3 w-3`}),g]}),i(`div`,{className:`flex justify-end gap-2`,children:[u(`button`,{onClick:()=>{p(null),b(null),h(``)},className:`rounded px-3 py-1.5 text-xs text-foreground-subtle border border-border hover:text-foreground`,children:`Cancel`}),i(`button`,{onClick:()=>{b(null),D.mutate({code:m})},disabled:D.isPending||m.length!==6,className:`inline-flex items-center gap-1 rounded bg-primary px-3 py-1.5 text-xs font-medium text-primary-foreground hover:bg-primary/90 disabled:opacity-50`,children:[D.isPending?u(y,{className:`h-3 w-3 animate-spin`}):u(x,{className:`h-3 w-3`}),`Confirm`]})]})]}),A===`enrolled`&&r&&i(s,{children:[i(`div`,{className:`rounded-md border border-emerald-500/30 bg-emerald-500/5 px-3 py-2.5 flex items-start gap-2.5`,children:[u(x,{className:`h-4 w-4 mt-0.5 text-emerald-500 shrink-0`}),i(`div`,{className:`text-xs text-foreground space-y-0.5`,children:[u(`div`,{className:`font-medium`,children:`2FA is active`}),i(`div`,{className:`text-foreground-subtle`,children:[`Enrolled on`,` `,r.confirmedAt?new Date(r.confirmedAt).toLocaleString():`—`]})]})]}),g&&i(`div`,{className:`text-[11px] text-danger flex items-center gap-1`,children:[u(w,{className:`h-3 w-3`}),g]}),u(`div`,{className:`flex justify-end`,children:i(`button`,{onClick:()=>{b(null),k.mutate()},disabled:k.isPending,className:`rounded bg-danger px-3 py-1.5 text-xs font-medium text-white hover:bg-danger/90 disabled:opacity-50 inline-flex items-center gap-1`,children:[k.isPending?u(y,{className:`h-3 w-3 animate-spin`}):u(_,{className:`h-3 w-3`}),`Disable 2FA`]})})]})]})]})}function Ce(){return ie(`auth-webauthn/passkey-enrollment`)?u(I,{widgetId:`auth-webauthn/passkey-enrollment`,host:`dashboard`}):null}export{be as MyAccessPage};

package/dist/assets/SessionsList-Dm6Me6Pk.js

@@ -1,2 +0,0 @@
-import{I as e,K as t,Q as n,S as r,W as i,q as a,x as o}from"./_virtual_mf___mfe_internal__admin_ui_host__loadShare___mf_0_tanstack_mf_1_react_mf_2_query__loadShare__.js-DhP-Lgiq.js";import{D as s,It as c,ar as l,cn as u,di as d,dt as f,ot as p}from"./player-overlays-C20AJTgs.js";import{i as m,o as h}from"./video-Bkjg9omB.js";import{t as g}from"./key-round-Dzvj04Ko.js";import{t as _}from"./octagon-alert-B71ohghx.js";import{An as v,Bn as y,Dn as b,Ht as x,Ln as S,Nl as C,Nt as w,On as ee,Pt as T,Qn as E,Tn as te,Ut as ne,Vt as re,Xl as ie,Zl as ae,Zn as oe,ar as D,gu as O,iu as k,jn as se,kn as ce,ma as le}from"./src-CIIJy_o8.js";import{R as ue,a as de}from"./index-AsTGrKva.js";n();function A({id:e,title:t,icon:n,description:i,actions:a,tone:c=`default`,notice:l=null,onDismissNotice:u,children:d}){return o(re,{headingId:`access-${e}`,title:t,icon:n,actions:a,testId:`access-${e}`,children:r(`div`,{className:`${s} space-y-3`,children:[o(`div`,{className:k(`text-[11px] leading-relaxed`,c===`danger`?`rounded-md border border-danger/30 bg-danger/5 px-3 py-2 text-foreground`:`text-foreground-subtle`),children:i}),l!==null&&o(pe,{notice:l,onDismiss:u}),d]})})}var fe={success:{icon:d,line:`border-success/30 text-foreground`,mark:`text-success`},danger:{icon:_,line:`border-danger/40 text-danger`,mark:`text-danger`}};function pe({notice:e,onDismiss:t}){let n=fe[e.tone],i=n.icon;return r(`div`,{role:e.tone===`danger`?`alert`:`status`,className:k(`flex items-start gap-2 rounded-md border bg-surface px-3 py-2 text-[11px]`,n.line),children:[o(i,{className:k(`mt-0.5 h-3.5 w-3.5 shrink-0`,n.mark),"aria-hidden":!0}),o(`span`,{className:`min-w-0 flex-1`,children:e.message}),t!==void 0&&o(ae,{type:`button`,variant:`ghost`,size:`sm`,icon:f,"aria-label":`Dismiss`,onClick:t,className:`-my-1 h-5 w-5`})]})}function j(){let{data:e}=C();return i(()=>{let t=new Map;for(let n of e??[])t.set(n.id,n.username);return t},[e])}function M(e,t=null){return e===null?t:{tone:`danger`,message:e}}var N={active:`Active`,expired:`Expired`,revoked:`Revoked`,current:`This session`},me={active:`success`,expired:`warning`,revoked:`default`,current:`info`},he={current:0,active:1,expired:2,revoked:3};function P(e,t){if(e===null)return t;let n=new Date(e);return Number.isNaN(n.getTime())?`—`:n.toLocaleString()}function ge({status:e}){return o(D,{variant:me[e],className:`text-[10px]`,children:N[e]})}function _e({row:e,action:t}){if(!t.isAvailable(e))return null;let n=t.icon,i=t.busyId===e.id;return r(y,{type:`button`,variant:`ghost`,size:`sm`,onClick:()=>t.onRun(e),disabled:t.disabled,"aria-label":`${t.label} ${e.name}`,className:`text-danger hover:bg-danger/10`,children:[i?o(l,{className:`h-3 w-3 animate-spin`,"aria-hidden":!0}):o(n,{className:`h-3 w-3`,"aria-hidden":!0}),t.label]})}function ve(e){return[{key:`name`,header:`Name`,sortValue:e=>e.name.toLowerCase(),render:e=>r(`div`,{className:`min-w-0 max-w-[18rem]`,children:[o(`div`,{className:`truncate font-medium text-foreground`,title:e.name,children:e.name}),e.detail!==null&&o(`div`,{className:`truncate font-mono text-[10px] text-foreground-subtle`,title:e.detail,children:e.detail})]})},e.hideOwner?null:{key:`owner`,header:`Owner`,sortValue:e=>e.ownerName.toLowerCase(),render:e=>e.ownerName},{key:`kind`,header:`Kind / scope`,sortValue:e=>e.kind.toLowerCase(),nowrap:!1,render:e=>r(`div`,{className:`min-w-[8rem] max-w-[16rem]`,children:[o(`div`,{className:`text-foreground`,children:e.kind}),e.scope!==null&&o(`div`,{className:`line-clamp-2 text-[10px] text-foreground-subtle`,title:e.scope,children:e.scope})]})},{key:`status`,header:`Status`,sortValue:e=>he[e.status],render:e=>o(ge,{status:e.status})},{key:`created`,header:`Created`,sortValue:e=>e.createdAt,render:e=>o(`span`,{className:`text-foreground-subtle`,children:P(e.createdAt,`—`)})},{key:`lastUsed`,header:`Last used`,sortValue:e=>e.lastUsedAt,render:e=>o(`span`,{className:`text-foreground-subtle`,children:P(e.lastUsedAt,`Never`)})},{key:`expires`,header:`Expires`,sortValue:e=>e.expiresAt,render:t=>o(`span`,{className:`text-foreground-subtle`,children:P(t.expiresAt,e.expiresNone)})},e.action===null?null:{key:`actions`,header:``,align:`right`,notSortableReason:`Actions`,render:t=>e.action===null?null:o(_e,{row:t,action:e.action})}].filter(e=>e!==null)}n();var F=6,I={"current-session":`your current session`,"not-active":`already gone`};function L(e,t){return`${String(e)} ${e===1?t.one:t.many}`}function ye(e){let t=new Map;for(let n of e)t.set(n.status,(t.get(n.status)??0)+1);return[...t.entries()].map(([e,t])=>`${String(t)} ${N[e].toLowerCase()}`).join(`, `)}function R(e,t){let n=e.slice(0,F).map(e=>`• ${e.name} — ${e.ownerName}`),r=e.length>F?[`…and ${String(e.length-F)} more`]:[];return[`${L(e.length,t)} (${ye(e)}) stop working at once. This cannot be undone.`,``,...n,...r].join(`
-`)}function z(e,t,n){let r=E(),i=O.auth.revokeCredentials.useMutation(),[o,s]=a(null);return{run:async a=>{if(a.length===0)return!1;let o=String(a.length),c=await r({title:`Revoke ${L(a.length,t)}?`,message:R(a,t),label:`Type ${o} to confirm`,placeholder:o,confirmLabel:`Revoke ${o}`,variant:`danger`,validate:e=>e.trim()===o?null:`Type ${o} — the number of ${t.many} selected`});if(c===null||c.trim()!==o)return!1;s(null);try{let n=await i.mutateAsync({kind:e,ids:a.map(e=>e.id),confirmCount:a.length}),r=n.skipped.map(e=>I[e.reason]??e.reason);return s({tone:`success`,message:`Revoked ${L(n.revoked.length,t)}.`+(r.length>0?` Skipped ${String(r.length)}: ${[...new Set(r)].join(`, `)}.`:``)}),!0}catch(e){return s({tone:`danger`,message:`The revoke failed: ${e instanceof Error?e.message:`request failed`}. The list below is reloaded — check what is left.`}),!1}finally{n()}},busy:i.isPending,outcome:o,dismiss:()=>s(null)}}function be(e,t){let n=E(),r=O.auth.revokeCredentials.useMutation(),[i,o]=a(null);return{run:async i=>{if(i.length===0)return!1;let a=String(i.length),s=await n({title:`Revoke ${L(i.length,e)}?`,message:R(i,e),label:`Type ${a} to confirm`,placeholder:a,confirmLabel:`Revoke ${a}`,variant:`danger`,validate:t=>t.trim()===a?null:`Type ${a} — the number of ${e.many} selected`});if(s===null||s.trim()!==a)return!1;o(null);let c=i.filter(e=>e.kind===`Scoped`).map(e=>e.id),l=i.filter(e=>e.kind===`Admin`).map(e=>e.id);try{let t=[],n=[];if(c.length>0){let e=await r.mutateAsync({kind:`scoped-token`,ids:c,confirmCount:c.length});t.push(...e.revoked),n.push(...e.skipped)}if(l.length>0){let e=await r.mutateAsync({kind:`admin-token`,ids:l,confirmCount:l.length});t.push(...e.revoked),n.push(...e.skipped)}let i=n.map(e=>I[e.reason]??e.reason);return o({tone:`success`,message:`Revoked ${L(t.length,e)}.`+(i.length>0?` Skipped ${String(i.length)}: ${[...new Set(i)].join(`, `)}.`:``)}),!0}catch(e){return o({tone:`danger`,message:`The revoke failed: ${e instanceof Error?e.message:`request failed`}. The list below is reloaded — check what is left.`}),!1}finally{t()}},busy:r.isPending,outcome:i,dismiss:()=>o(null)}}n();var xe={searchText:e=>[e.name,e.detail??``,e.ownerName,e.kind,e.scope??``],facetGroups:[{id:`status`,value:e=>e.status},{id:`owner`,value:e=>e.ownerName},{id:`kind`,value:e=>e.kind}]},Se={status:`Status`,owner:`Owner`,kind:`Kind`},Ce=e=>e.status!==`current`,we=[`active`,`current`];function B({rows:e,label:t,isLoading:n,loadError:s,emptyText:c,hideOwner:u=!1,expiresNone:d=`Never`,action:f,bulk:p,defaultStatus:m=we}){let[h]=a(()=>m.length===0?{search:``,facets:[]}:{search:``,facets:[],groups:{status:[...m]}}),g=w(e,xe,h),[_,v]=a(()=>new Set),y=i(()=>ve({hideOwner:u,expiresNone:d,action:f??null}),[u,d,f]),b=i(()=>p===void 0?()=>!1:e=>Ce(e)&&p.isSelectable(e),[p]),C=i(()=>g.rows.filter(e=>_.has(e.id)&&b(e)),[g.rows,_,b]);return n?r(`div`,{className:`flex items-center gap-2 py-4 text-xs text-foreground-subtle`,children:[o(l,{className:`h-3.5 w-3.5 animate-spin`,"aria-hidden":!0}),`Loading `,t,`…`]}):s===null?r(`div`,{className:`space-y-3`,children:[o(T,{state:g.state,facets:g.facets,groups:g.groups.filter(e=>!(u&&e.id===`owner`)).map(e=>({...e,label:Se[e.id]??e.id,...e.id===`status`?{facetLabel:e=>N[e]??e}:{}})),labels:{searchPlaceholder:`Search ${t}…`,searchLabel:`Search ${t}`,facetsLabel:`Filter ${t}`,clearLabel:`Clear filters`},onSearch:g.setSearch,onToggleFacet:g.toggleFacet,onToggleGroupFacet:g.toggleGroupFacet,onClear:g.clear}),p!==void 0&&o(Te,{bulk:p,shown:g.rows.filter(b),targets:C,onSelect:v}),o(x,{columns:y,rows:g.rows,rowKey:e=>e.id,minWidthPx:u?760:860,mobileMode:`scroll`,maxBodyHeight:ne,defaultSort:{columnKey:`created`,dir:`desc`},pageSize:25,paginationLabels:{navLabel:`${t} pages`,previous:`Previous page`,next:`Next page`,range:(e,t,n)=>`${e}–${t} of ${n}`},emptyMessage:g.active?`No ${t} match the filters.`:c,rowClassName:e=>e.status===`revoked`||e.status===`expired`?`opacity-70`:void 0,...p===void 0?{}:{selection:{selected:_,onChange:v,isSelectable:b,rowLabel:e=>`Select ${e.name} (${e.ownerName})`,pageLabel:`Select every ${p.noun.one} on this page`}}})]}):o(S,{title:`Could not load ${t}`,message:s})}function Te({bulk:e,shown:t,targets:n,onSelect:i}){let{revoke:a,noun:s}=e,u=(e.quickSelect??[]).map(e=>({...e,rows:t.filter(e.match)})).filter(e=>e.rows.length>0),d=async()=>{await a.run(n)&&i(new Set)};return r(`div`,{className:`flex flex-wrap items-center gap-2`,"data-testid":`bulk-bar`,children:[t.length>0&&r(y,{type:`button`,variant:`outline`,size:`sm`,onClick:()=>i(new Set(t.map(e=>e.id))),children:[`Select all `,String(t.length),` shown`]}),u.map(e=>r(y,{type:`button`,variant:`outline`,size:`sm`,onClick:()=>i(new Set(e.rows.map(e=>e.id))),children:[e.label,` (`,String(e.rows.length),`)`]},e.label)),n.length>0&&r(`div`,{className:`ml-auto flex flex-wrap items-center gap-2`,children:[r(`span`,{className:`text-[11px] tabular-nums text-foreground`,"aria-live":`polite`,children:[L(n.length,s),` selected`]}),r(y,{type:`button`,variant:`ghost`,size:`sm`,onClick:()=>i(new Set),children:[o(f,{className:`h-3 w-3`,"aria-hidden":!0}),`Clear selection`]}),r(y,{type:`button`,variant:`danger`,size:`sm`,disabled:a.busy,onClick:()=>void d(),children:[a.busy?o(l,{className:`h-3 w-3 animate-spin`,"aria-hidden":!0}):o(c,{className:`h-3 w-3`,"aria-hidden":!0}),`Revoke `,L(n.length,s),`…`]})]})]})}var V=(e,t)=>t===null?`—`:e.get(t)??t;function H(e,t){return e!=null&&e<=t?`expired`:`active`}function Ee(e,t,n){return{id:e.id,name:n.client(e.client),detail:e.ip,ownerId:e.userId,ownerName:V(t,e.userId),kind:n.method(e.method),scope:null,status:e.current?`current`:`active`,createdAt:e.createdAt,lastUsedAt:e.lastUsedAt,expiresAt:e.expiresAt}}function De(e,t){return{id:e.id,name:e.integrationId,detail:null,ownerId:e.userId,ownerName:e.username,kind:e.integrationId,scope:t,status:e.revokedAt===null?`active`:`revoked`,createdAt:e.createdAt,lastUsedAt:e.lastUsedAt,expiresAt:null}}var Oe=`Scoped`,U=`Admin`;function ke(e,t,n,r,i){return{id:e.id,name:e.name,detail:`${e.tokenPrefix}…`,ownerId:t,ownerName:V(n,t),kind:Oe,scope:r,status:H(e.expiresAt,i),createdAt:e.createdAt,lastUsedAt:e.lastUsedAt??null,expiresAt:e.expiresAt??null}}function Ae(e,t,n){return{id:e.id,name:e.name,detail:`${e.tokenPrefix}…`,ownerId:e.createdBy,ownerName:V(t,e.createdBy),kind:U,scope:`Full administrator`,status:e.revokedAt===null?H(e.expiresAt,n):`revoked`,createdAt:e.createdAt,lastUsedAt:e.lastUsedAt,expiresAt:e.expiresAt}}var je={"grid-view":`Grid`,"events-view":`Events`};function Me(e,t){return e.map(e=>t.get(e)??`#${String(e)}`).join(`, `)}function Ne(e,t,n,r){let i=je[e.scope.kind];return{id:e.id,name:`${i} · ${String(e.scope.deviceIds.length)} camera${e.scope.deviceIds.length===1?``:`s`}`,detail:`${e.tokenPrefix}…`,ownerId:e.userId,ownerName:V(t,e.userId),kind:e.scope.talk===!0?`${i} + talk`:i,scope:Me(e.scope.deviceIds,n),status:H(e.expiresAt,r),createdAt:e.createdAt,lastUsedAt:e.lastUsedAt??null,expiresAt:e.expiresAt}}function W(e){return`${e.provider}\u0000${e.subject}`}function Pe(e,t){return{id:W(e),name:e.label??e.subject,detail:e.issuer,ownerId:e.userId,ownerName:V(t,e.userId),kind:e.provider,scope:null,status:`active`,createdAt:e.linkedAt,lastUsedAt:null,expiresAt:null}}function Fe(e,t){let n=e.allowedProviders;return{id:e.id,name:e.label,detail:`${e.tokenPrefix}…`,ownerId:e.userId??null,ownerName:V(t,e.userId??null),kind:e.isAdmin===!0?`Admin`:`Regular`,scope:n===void 0||n===`*`?`All providers`:n.join(`, `)||`All providers`,status:`active`,createdAt:e.createdAt??null,lastUsedAt:e.lastUsedAt??null,expiresAt:null}}var G=40,Ie=[{test:/Electron\//,name:`CamStack desktop`},{test:/Edg(e|A|iOS)?\//,name:`Edge`},{test:/OPR\/|Opera/,name:`Opera`},{test:/Firefox\/|FxiOS\//,name:`Firefox`},{test:/Chrome\/|CriOS\//,name:`Chrome`},{test:/Version\/[\d.]+.*Safari\//,name:`Safari`}],Le=[{test:/iPhone/,name:`iPhone`},{test:/iPad/,name:`iPad`},{test:/Android/,name:`Android`},{test:/Mac OS X|Macintosh/,name:`macOS`},{test:/Windows/,name:`Windows`},{test:/CrOS/,name:`ChromeOS`},{test:/Linux/,name:`Linux`}],Re=[{test:/CFNetwork\/.*Darwin\//,name:`CamStack app on iOS`},{test:/^okhttp\//i,name:`CamStack app on Android`},{test:/^(node|undici)\b/i,name:`Script (Node.js)`},{test:/^curl\//i,name:`curl`}];function K(e,t){return e.find(e=>e.test.test(t))?.name??null}function ze(e){return e.length<=G?e:`${e.slice(0,G)}…`}function q(e){if(e===null||e.trim().length===0)return{label:`Unknown device`,raw:null};let t=e.trim(),n=K(Re,t);if(n!==null)return{label:n,raw:t};let r=K(Ie,t),i=K(Le,t);return r!==null&&i!==null?{label:`${r} on ${i}`,raw:t}:r===null?{label:ze(t),raw:t}:{label:r,raw:t}}var J={password:`Password`,passkey:`Passkey`,sso:`Single sign-on`,handoff:`App hand-off`,exchange:`Session exchange`};function Y(e){return J[e]??e}function X(e){if(e==null)return`—`;let t=new Date(e);return Number.isNaN(t.getTime())?`—`:t.toLocaleString()}n();function Z(e,t){return e instanceof Error&&e.message.length>0?e.message:t}function Be(n){let i=p(),[s,c]=a(!1),[u,d]=a(``),[f,m]=a(null),[h,_]=a(null),x=t(null),S=e(e=>{x.current?.(e),x.current=null,c(!1),d(``),m(null),_(null)},[]),C=e(()=>new Promise(e=>{x.current?.(null),x.current=e,_(null),c(!0)}),[]),w=async()=>{m(`password`),_(null);try{let{reauthToken:e}=await i.reauthenticate({password:u});S(e)}catch(e){_(Z(e,`Password is incorrect`)),m(null)}},T=async()=>{m(`passkey`),_(null);try{let{optionsJSON:e}=await i.reauthBeginPasskey(),t=await de({optionsJSON:e}),{reauthToken:n}=await i.reauthenticate({passkeyResponse:Object.fromEntries(Object.entries(t))});S(n)}catch(e){_(Z(e,`Passkey verification failed`)),m(null)}};return{requestProof:C,dialog:o(te,{open:s,onOpenChange:e=>!e&&S(null),children:r(b,{children:[r(v,{children:[o(se,{children:`Confirm it’s you`}),r(ee,{children:[n,` needs your password or a passkey, even though you are signed in.`]})]}),r(`form`,{className:`space-y-3`,onSubmit:e=>{e.preventDefault(),u.length>0&&f===null&&w()},children:[o(ie,{type:`password`,autoComplete:`current-password`,placeholder:`Current password`,value:u,onChange:e=>d(e.target.value),"aria-label":`Current password`}),h!==null&&o(`p`,{role:`alert`,className:`text-xs text-danger`,children:h}),r(ce,{className:`flex flex-wrap gap-2`,children:[r(y,{type:`button`,variant:`outline`,disabled:f!==null,onClick:()=>void T(),children:[f===`passkey`?o(l,{className:`h-4 w-4 animate-spin`}):o(g,{className:`h-4 w-4`}),`Use a passkey`]}),r(y,{type:`submit`,disabled:u.length===0||f!==null,children:[f===`password`&&o(l,{className:`h-4 w-4 animate-spin`}),`Confirm`]})]})]})]})})}}n();var Q={one:`share link`,many:`share links`};function $(e){let t=oe(),n=O.useUtils(),r=O.auth.listShareTokens.useQuery({owner:e}),o=j(),{data:s}=le({isCamera:!0,projection:`slim`}),[l,u]=a(null),d=()=>void n.auth.listShareTokens.invalidate(),f=O.auth.revokeShareToken.useMutation({onSuccess:d,onError:e=>u(`Revoke failed: ${e.message}`)}),p=i(()=>{let e=new Map;for(let t of s??[])e.set(t.id,t.name);return e},[s]),m=Date.now(),h=(r.data??[]).map(e=>Ne(e,o,p,m)),g=async e=>{await t({title:`Revoke share link`,message:`Anyone holding this link to ${e.scope??e.name} loses access immediately. This cannot be undone.`,confirmLabel:`Revoke`,variant:`danger`})&&(u(null),f.mutate({id:e.id}))};return{rows:h,refresh:d,error:l,clearError:()=>u(null),isLoading:r.isLoading,loadError:r.isError?r.error?.message??`Request failed`:null,action:{label:`Revoke`,icon:c,isAvailable:()=>!0,onRun:e=>void g(e),busyId:f.isPending?f.variables?.id??null:null,disabled:f.isPending}}}function Ve(){let e=$(`self`);return o(A,{notice:M(e.error),onDismissNotice:e.clearError,id:`my-share-links`,title:`Share links`,icon:u,description:`View-only links you created in the viewer app to share a grid or the events of some cameras. Revoking a link stops it working everywhere it was sent.`,children:o(B,{rows:e.rows,label:`share links`,isLoading:e.isLoading,loadError:e.loadError,emptyText:`You have no share links.`,hideOwner:!0,action:e.action})})}function He(){let{user:e}=ue();return e?.isAdmin?o(Ue,{}):null}function Ue(){let e=$(`all`),t=z(`share-link`,Q,e.refresh);return o(A,{notice:M(e.error,t.outcome),onDismissNotice:()=>{e.clearError(),t.dismiss()},id:`share-links`,title:`Share links`,icon:u,description:`Every user's view-only share links. Revoking one stops it working for whoever it was sent to — a revoked link is deleted and cannot be restored.`,children:o(B,{rows:e.rows,label:`share links`,isLoading:e.isLoading,loadError:e.loadError,emptyText:`No user has any share links.`,action:{...e.action,disabled:e.action.disabled||t.busy},bulk:{revoke:t,noun:Q,isSelectable:()=>!0,quickSelect:[{label:`Select expired`,match:e=>e.status===`expired`}]}})})}function We({sessions:e,isLoading:t,loadError:n,emptyText:i,onRevoke:a,revokingId:s}){return t?r(`div`,{className:`flex items-center gap-2 text-xs text-foreground-subtle`,children:[o(l,{className:`h-3.5 w-3.5 animate-spin`}),`Loading sessions…`]}):n===null?e.length===0?o(`div`,{className:`rounded border border-dashed border-border px-3 py-4 text-xs text-foreground-subtle text-center`,children:i}):o(`ul`,{className:`divide-y divide-border rounded-md border border-border`,children:e.map(e=>o(Ge,{session:e,revoking:s===e.id,onRevoke:()=>a(e)},e.id))}):r(`div`,{className:`text-[11px] text-danger`,children:[`Could not load sessions: `,n]})}function Ge({session:e,revoking:t,onRevoke:n}){let i=q(e.client);return r(`li`,{"data-testid":`session-row`,className:`flex items-start gap-3 px-3 py-2 text-xs`,children:[o(m,{className:`h-3.5 w-3.5 mt-0.5 shrink-0 text-foreground-subtle`}),r(`div`,{className:`flex-1 min-w-0 space-y-0.5`,children:[r(`div`,{className:`flex flex-wrap items-center gap-1.5`,children:[o(`span`,{className:`font-medium text-foreground truncate`,title:i.raw??void 0,children:i.label}),e.current&&o(`span`,{className:`rounded bg-primary/10 px-1.5 py-0.5 text-[10px] font-medium text-primary`,children:`This device`})]}),r(`div`,{className:`flex flex-wrap gap-x-3 text-[11px] text-foreground-subtle`,children:[o(`span`,{children:Y(e.method)}),o(`span`,{className:`font-mono`,children:e.ip??`IP unknown`}),r(`span`,{children:[`Last active `,X(e.lastUsedAt)]}),r(`span`,{children:[`Expires `,X(e.expiresAt)]})]})]}),!e.current&&r(`button`,{onClick:n,disabled:t,className:`inline-flex items-center gap-1 rounded px-2 py-1 text-[10px] text-danger hover:bg-danger/10 disabled:opacity-50`,children:[t?o(l,{className:`h-3 w-3 animate-spin`}):o(h,{className:`h-3 w-3`}),`Sign out`]})]})}export{z as _,q as a,M as b,U as c,W as d,Pe as f,B as g,ke as h,Be as i,Ae as l,Ee as m,He as n,Y as o,De as p,Ve as r,X as s,We as t,Fe as u,be as v,j as x,A as y};

package/dist/assets/circle-slash-Blsoe4DV.js

@@ -1 +0,0 @@
-import{$i as e}from"./player-overlays-C20AJTgs.js";var t=e(`circle-slash`,[[`circle`,{cx:`12`,cy:`12`,r:`10`,key:`1mglay`}],[`line`,{x1:`9`,x2:`15`,y1:`15`,y2:`9`,key:`1dfufj`}]]);export{t};