@camstack/addon-admin-ui 1.2.424 → 1.2.425

package/dist/assets/Identity-Bu6tV79U.js

@@ -1 +0,0 @@
-import{I as e,K as t,Q as n,S as r,W as i,a,b as o,o as s,q as c,t as l,x as u,z as d}from"./_virtual_mf___mfe_internal__admin_ui_host__loadShare___mf_0_tanstack_mf_1_react_mf_2_query__loadShare__.js-DhP-Lgiq.js";import{Hi as f,Hr as p,Ir as m,It as h,Nt as g,On as _,Pn as v,Qt as y,Rn as b,Tt as x,_i as S,ar as C,cn as w,cr as T,dt as E,fi as D,fn as O,nr as k,on as A,ot as j,pr as M,sn as N,yi as P,yn as F}from"./player-overlays-Bthpd_DK.js";import{n as I,r as L,t as ee}from"./key-CA_hxP8X.js";import{c as R,o as z,u as B}from"./video-BYsOgJ3d.js";import{t as V}from"./history-DsADJO4y.js";import{t as te}from"./key-round-ClhiHwZi.js";import{t as ne}from"./monitor-smartphone-DFPo3Yqb.js";import{t as re}from"./unlink-BezflwNM.js";import{a as ie,bi as ae,i as oe,o as H,s as U,vi as se,yi as ce}from"./client-CPAjuyjS.js";import{Al as le,An as W,Ao as ue,Bl as de,Bn as G,Cn as fe,Dl as pe,Dn as me,Dr as he,El as ge,En as _e,Er as ve,Fl as ye,Ft as be,G as xe,Gl as Se,Ht as Ce,Il as we,Kl as Te,L as Ee,Ll as De,Ln as Oe,Ml as ke,N as Ae,Nl as je,Nt as Me,Ol as Ne,P as Pe,Pl as Fe,Pt as Ie,Qn as Le,Rl as Re,Rn as ze,Tl as Be,Tn as Ve,Ut as He,W as Ue,Wt as K,X as We,Xl as Ge,Z as Ke,Zn as q,ar as J,bn as qe,en as Je,gu as Y,in as Ye,jl as Xe,jn as Ze,kl as Qe,kn as $e,ma as et,nn as tt,on as nt,rn as rt,z as it,zl as at,zn as ot}from"./src-ASnW4RHZ.js";import{t as st}from"./useTranslation-Bc5yH9V9.js";import{C as ct,J as lt,Q as ut,R as dt,X as ft,Y as pt,c as mt,h as ht,p as gt,s as _t}from"./index-D6a_-apt.js";import{t as vt}from"./AdminSectionedPage-4SkTwpI5.js";import{t as yt}from"./AdminPage-3IR6Hk67.js";import{A as bt,C as xt,D as St,E as Ct,F as wt,I as X,L as Z,M as Tt,N as Et,O as Dt,P as Ot,R as kt,S as At,T as jt,_ as Mt,a as Nt,c as Pt,d as Ft,f as It,g as Lt,h as Rt,i as zt,j as Bt,k as Vt,l as Ht,m as Ut,n as Wt,o as Gt,p as Kt,r as qt,s as Jt,t as Yt,u as Xt,v as Zt,w as Qt,x as $t,y as en}from"./SessionsList-BwcT1neM.js";import{i as tn,n as nn,r as rn,t as an}from"./IntegrationHub-DA5-5WRz.js";import{n as on,t as sn}from"./addon-display-names-BkwMrExv.js";n();function cn(){let e=q(),t=Y.useUtils(),n=kt(),{data:r,isLoading:a}=je(),o=i(()=>r??[],[r]),s=Y.useQueries(e=>o.map(t=>e.userManagement.listExternalIdentities({userId:t.id}))),l=Y.auth.listLoginMethods.useQuery(),[d,f]=c(null),p=at({onSuccess:()=>void t.userManagement.listExternalIdentities.invalidate(),onError:e=>f(`Remove failed: ${e.message}`)}),m=i(()=>new Map((l.data??[]).flatMap(e=>e.kind===`redirect`?[[e.id,e.label]]:[])),[l.data]),h=o.flatMap((e,t)=>s[t]?.data??[]),g=h.map(e=>({...Vt(e,n),kind:m.get(e.provider)??e.provider})),_=async t=>{let n=h.find(e=>Dt(e)===t.id);n!==void 0&&await e({title:`Remove sign-in link`,message:`"${t.ownerName}" will no longer be able to sign in with this ${t.kind} account.`,confirmLabel:`Remove`,variant:`danger`})&&(f(null),p.mutate({userId:n.userId,provider:n.provider,subject:n.subject}))};return u(X,{notice:Z(d),onDismissNotice:()=>{f(null)},id:`external-identities`,title:`Sign-in links`,icon:B,description:`External accounts (single sign-on) each user linked to their CamStack account. Only the owner can link one, from their profile; an admin can remove it.`,children:u(Et,{rows:g,label:`sign-in links`,isLoading:a||s.some(e=>e.isLoading),loadError:s.find(e=>e.isError)?.error?.message??null,emptyText:`No user has linked a sign-in account.`,expiresNone:`—`,action:{label:`Remove`,icon:re,isAvailable:()=>!0,onRun:e=>void _(e),busyId:null,disabled:p.isPending}})})}n();function ln(){let e=q(),t=s(),n=kt(),r=le(),[a,o]=c(null),l=ye({onSuccess:()=>void t.invalidateQueries({queryKey:[[`userManagement`,`listApiKeys`]]}),onError:e=>o(`Revoke failed: ${e.message}`)}),d=i(()=>(r.data??[]).map(e=>St(e,n)),[r.data,n]),f=async t=>{await e({title:`Revoke "${t.name}"?`,message:`Any client using this key loses access immediately. This cannot be undone.`,confirmLabel:`Revoke`,variant:`danger`})&&(o(null),l.mutate({id:t.id}))};return u(X,{notice:Z(a),onDismissNotice:()=>{o(null)},id:`legacy-api-keys`,title:`Legacy API keys`,icon:V,description:`Keys from before scoped tokens. Nothing creates them any more; revoke them and issue a scoped token instead.`,children:u(Et,{rows:d,label:`legacy API keys`,isLoading:r.isLoading,loadError:r.isError?r.error?.message??`Request failed`:null,emptyText:`No legacy API keys.`,action:{label:`Revoke`,icon:h,isAvailable:()=>!0,onRun:e=>void f(e),busyId:l.isPending?l.variables?.id??null:null,disabled:l.isPending}})})}n();var un={one:`linked app`,many:`linked apps`};function dn(e){if(e.type===`category`){let t=e.target??``;return t===`device`?`all devices`:`all ${t}`}if(e.type===`device`)return`device:[${(e.targets??[]).join(`,`)}]`;let t=e;return`${t.type}:${t.target??``}`}function fn(){let e=q(),t=s(),n=ke(),[r,a]=c(null),o=()=>void t.invalidateQueries({queryKey:[[`userManagement`,`listOauthSessions`]]}),l=we({onSuccess:o,onError:e=>a(`Revoke failed: ${e.message}`)}),d=Ot(`oauth-session`,un,o),f=i(()=>(n.data??[]).map(e=>bt(e,e.scopes.map(dn).join(`, `))),[n.data]),p=async t=>{await e({title:`Revoke the "${t.name}" link?`,message:`${t.name} loses access for ${t.ownerName} on its next call. Linking it again needs the account-link flow from the start.`,confirmLabel:`Revoke`,variant:`danger`})&&(a(null),l.mutate({id:t.id}))},m=l.isPending?l.variables?.id??null:null;return u(X,{notice:Z(r,d.outcome),onDismissNotice:()=>{a(null),d.dismiss()},id:`linked-apps`,title:`Linked apps`,icon:T,description:`External integrations (Alexa, …) linked to this hub through OAuth. Revoking one stops that integration on its next call. Already-revoked rows can be selected and removed from the list.`,children:u(Et,{rows:f,label:`linked apps`,isLoading:n.isLoading,loadError:n.isError?n.error?.message??`Request failed`:null,emptyText:`No linked apps — an integration appears here once it completes the account-link flow.`,expiresNone:`—`,action:{label:`Revoke`,icon:h,isAvailable:e=>e.status===`active`||e.status===`revoked`,onRun:e=>void p(e),busyId:m,disabled:l.isPending||d.busy},bulk:{revoke:d,noun:un,isSelectable:e=>e.status===`active`||e.status===`revoked`,quickSelect:[{label:`Select revoked`,match:e=>e.status===`revoked`}]}})})}n();var pn={one:`session`,many:`sessions`};function mn(){let e=q(),t=Y.useUtils(),n=kt(),r=Y.auth.listSessions.useQuery(),[a,o]=c(null),s=()=>void t.auth.listSessions.invalidate(),l=Y.auth.revokeSessions.useMutation({onSuccess:s,onError:e=>o(`Sign out failed: ${e.message}`)}),d=Ot(`login-session`,pn,s),f=i(()=>(r.data??[]).map(e=>Bt(e,n,{client:e=>At(e).label,method:xt})),[r.data,n]),p=async t=>{await e({title:`Sign out this session`,message:`${t.ownerName} on ${t.name} will have to sign in again.`,confirmLabel:`Sign out`,variant:`danger`})&&(o(null),l.mutate({id:t.id}))};return u(X,{notice:Z(a,d.outcome),onDismissNotice:()=>{o(null),d.dismiss()},id:`login-sessions`,title:`Login sessions`,icon:ne,description:`Every browser and app signed in to this hub, for every user. Signing one out ends it at once; it has to sign in again. Your own current session is marked and never included in a bulk sign-out.`,children:u(Et,{rows:f,label:`sessions`,isLoading:r.isLoading,loadError:r.isError?r.error?.message??`Request failed`:null,emptyText:`No active sessions.`,action:{label:`Sign out`,icon:z,isAvailable:e=>e.status===`active`,onRun:e=>void p(e),busyId:l.isPending&&l.variables!==void 0&&`id`in l.variables?l.variables.id:null,disabled:l.isPending||d.busy},bulk:{revoke:d,noun:pn,isSelectable:e=>e.status===`active`}})})}function hn({token:e,label:t,onClose:n}){return u(Ve,{open:!0,onOpenChange:e=>!e&&n(),children:r(me,{width:`md`,scroll:`body`,children:[u(W,{children:u(Ze,{children:`Token: ${t}`})}),r(_e,{className:`space-y-3`,children:[u(`div`,{className:`rounded-md border border-warning/30 bg-warning/10 px-3 py-2 text-xs text-warning`,children:`Copy this token now. Once you close this dialog the secret cannot be displayed again.`}),u(`div`,{className:`select-all break-all rounded-md border border-border bg-background p-2 font-mono text-[11px] text-foreground`,children:e})]}),r($e,{children:[u(be,{value:e,label:`Copy`,srLabel:`token`}),u(G,{type:`button`,variant:`primary`,size:`sm`,onClick:n,children:`Done`})]})]})})}var gn={token:`newToken`,scoped:`newScoped`,admin:`newAdmin`};n();var _n=7,vn=90,yn=80;function bn(e){let t=Number(e);return Number.isInteger(t)&&t>=1&&t<=vn?t:null}function xn({open:e,users:t,onClose:n,onSubmitScoped:i,onSubmitAdmin:a,submitting:s,formError:l,awaitingProof:f}){let{user:p}=dt(),m=p?.isAdmin===!0,h=m?null:p?.scopes??[],[g,_]=c(!1),[v,y]=c(t[0]?.id??``),[b,x]=c(``),[S,w]=c([{type:`capability`,target:``,access:[`view`,`create`]}]),[T,E]=c(``),[D,O]=c(String(_n));d(()=>{e||(_(!1),y(t[0]?.id??``),x(``),w([{type:`capability`,target:``,access:[`view`,`create`]}]),E(``),O(String(_n)))},[e,t]);let k=b.trim(),j=Pe(S),M=bn(D),P=!g&&v!==``&&k.length>0&&S.length>0&&j===null&&!s,F=g&&m&&k.length>0&&k.length<=yn&&M!==null&&!s&&!f;return u(it,{open:e,onClose:n,title:g?`Create admin token`:`Create token`,icon:g?N:te,error:l,width:`md`,testId:`create-token-dialog`,footer:r(G,{type:`button`,variant:g?`danger`:`primary`,size:`sm`,onClick:()=>{if(g){if(!F||M===null)return;a({name:k,expiresInDays:M});return}if(!P)return;let e=parseInt(T,10),t=Number.isFinite(e)&&e>0?Date.now()+e*864e5:void 0;i({userId:v,name:k,scopes:S,...t===void 0?{}:{expiresAt:t}})},disabled:g?!F:!P,children:[s||f?u(C,{className:`h-3.5 w-3.5 animate-spin`,"aria-hidden":!0}):u(g?N:A,{className:`h-3.5 w-3.5`,"aria-hidden":!0}),g?`Create admin token`:`Issue token`]}),children:r(`div`,{className:`space-y-3`,children:[m?r(`label`,{className:`flex items-start gap-2 text-sm text-foreground`,children:[u(`input`,{type:`checkbox`,className:`mt-0.5`,checked:g,onChange:e=>_(e.target.checked),"data-testid":`token-as-admin`}),r(`span`,{children:[u(`span`,{className:`font-medium`,children:`Administrator`}),u(`span`,{className:`block text-[11px] text-foreground-subtle`,children:`Off = scoped to a surface. On = full admin for scripts (audited, max 90 days).`})]})]}):null,g?u(`div`,{className:`space-y-1 rounded-md border border-danger/30 bg-danger/5 px-3 py-2 text-[11px] leading-relaxed text-foreground`,"data-testid":`admin-token-warning`,children:r(`p`,{children:[`An admin token acts as a `,u(`strong`,{children:`full administrator`}),`. Anyone holding it can do anything an admin can. Creating one asks you to confirm it is you.`]})}):null,g?null:r(`div`,{className:`space-y-1`,children:[u(nt,{htmlFor:`token-user`,children:`On behalf of user`}),u(Se,{id:`token-user`,value:v,onChange:e=>y(e.target.value),options:t.map(e=>({value:e.id,label:e.username}))})]}),u(xe,{label:`Name`,required:!0,children:u(Ge,{id:`token-name`,value:b,maxLength:yn,onChange:e=>x(e.target.value),placeholder:g?`nightly-backup`:`cloudflare-tunnel-route`,autoFocus:!0})}),g?r(`div`,{className:`space-y-1`,children:[u(nt,{htmlFor:`token-admin-days`,children:`Expires in (days)`}),u(Ge,{id:`token-admin-days`,type:`number`,min:1,max:vn,value:D,onChange:e=>O(e.target.value),state:M===null?`error`:`default`}),M===null?r(`p`,{className:`text-[11px] text-danger`,children:[`Expiry must be a whole number of days, 1 to `,vn,`.`]}):r(`p`,{className:`text-[11px] text-foreground-subtle`,children:[`Whole number of days, 1 to `,vn,`.`]})]}):r(o,{children:[r(`div`,{className:`space-y-1`,children:[u(nt,{children:`Scopes`}),u(Ae,{value:S,onChange:w,clampToParent:h}),j&&u(`p`,{className:`text-[10px] text-danger`,children:j}),u(`p`,{className:`text-[10px] text-foreground-subtle`,children:`Each scope picks a (cap or addon) target + one or more access flavours. The token can access ONLY what's listed.`})]}),r(`div`,{className:`space-y-1`,children:[u(nt,{htmlFor:`token-scoped-days`,children:`Expires in (days)`}),u(Ge,{id:`token-scoped-days`,type:`number`,min:1,value:T,onChange:e=>E(e.target.value),placeholder:`30`}),u(`p`,{className:`text-[10px] text-foreground-subtle`,children:`Leave blank for non-expiring.`})]})]})]})})}n();var Sn={one:`token`,many:`tokens`};function Cn(e){return e.type===`device`?`device:[${Ke(e.selector)}]`:`${e.type}:${e.target??``}`}function wn({createRequested:e=!1,onCreateConsumed:t}){let{user:n}=dt(),a=q(),o=s(),l=Y.useUtils(),f=kt(),{data:p,isLoading:m}=je(),g=i(()=>p??[],[p]),_=Y.useQueries(e=>g.map(t=>e.userManagement.listScopedTokens({userId:t.id}))),v=Y.auth.listAdminTokens.useQuery(void 0,{enabled:n?.isAdmin===!0}),{requestProof:y,dialog:b}=$t(`Creating an admin token`),{state:x,openNew:S,close:C}=Ee({newKey:gn.token}),[w,T]=c(null),[E,D]=c(null),[O,k]=c(!1),[A,j]=c(null),[M,N]=c(null);d(()=>{e&&(S(),t?.())},[e,S,t]);let P=()=>{o.invalidateQueries({queryKey:[[`userManagement`,`listScopedTokens`]]}),l.auth.listAdminTokens.invalidate(),l.auth.listAuthAudit.invalidate()},F=Be({onSuccess:({token:e,record:t})=>{P(),C(),D(null),j({token:e,label:t.name})},onError:e=>{T(`Create failed: ${e.message}`),D(`Create failed: ${e.message}`)}}),I=Y.auth.createAdminToken.useMutation({onSuccess:({token:e,record:t})=>{P(),C(),D(null),k(!1),j({token:e,label:t.name})},onError:e=>{T(`Create failed: ${e.message}`),D(`Create failed: ${e.message}`),k(!1)}}),L=De({onSuccess:()=>{N(null),P()},onError:e=>{N(null),T(`Revoke failed: ${e.message}`)}}),ee=Y.auth.revokeAdminToken.useMutation({onSuccess:()=>{N(null),P()},onError:e=>{N(null),T(`Revoke failed: ${e.message}`)}}),R=wt(Sn,P),z=Date.now(),B=g.flatMap((e,t)=>(_[t]?.data??[]).map(t=>Tt(t,e.id,f,t.scopes.map(Cn).join(`, `),z))),V=n?.isAdmin===!0?(v.data??[]).map(e=>Ct(e,f,z)):[],ne=[...B,...V],re=_.find(e=>e.isError)?.error?.message??(v.isError?v.error?.message??`Request failed`:null),ie=async e=>{let t=e.kind===jt;await a({title:`Revoke "${e.name}"?`,message:t?`Every script using it loses access immediately. This cannot be undone.`:`${e.ownerName}'s scoped token stops working on its next use. This cannot be undone.`,confirmLabel:`Revoke`,variant:`danger`})&&(T(null),N(e.id),t?ee.mutate({id:e.id}):L.mutate({id:e.id}))},ae=F.isPending||I.isPending;return r(`div`,{"data-testid":`tokens`,children:[b,u(X,{notice:Z(w,R.outcome),onDismissNotice:()=>{T(null),R.dismiss()},id:`tokens`,title:`Tokens`,icon:te,description:`Scoped tokens for a narrow surface, and admin tokens for full-administrator scripts. Revoking one stops it on its next use.`,children:u(Et,{rows:ne,label:`tokens`,isLoading:m||_.some(e=>e.isLoading)||n?.isAdmin===!0&&v.isLoading,loadError:re,emptyText:`No tokens.`,action:{label:`Revoke`,icon:h,isAvailable:e=>e.status===`active`,onRun:e=>void ie(e),busyId:M,disabled:R.busy||M!==null},bulk:{revoke:R,noun:Sn,isSelectable:e=>e.status===`active`}})}),u(xn,{open:x.mode===`new`,users:g.map(e=>({id:e.id,username:e.username})),onClose:()=>{C(),D(null),k(!1)},submitting:ae,formError:E,awaitingProof:O,onSubmitScoped:e=>F.mutate({userId:e.userId,name:e.name,scopes:e.scopes,expiresAt:e.expiresAt}),onSubmitAdmin:e=>{(async()=>{T(null),D(null),k(!0);let t=await y();k(!1),t!==null&&I.mutate({...e,reauthToken:t})})()}}),A&&u(hn,{token:A.token,label:A.label,onClose:()=>j(null)})]})}var Tn={"share-link":`share links`,"admin-token":`admin tokens`,"login-session":`login sessions`};function Q(e,t){let n=e[t];return typeof n==`string`&&n.length>0?n:null}function En(e,t){let n=Q(e,`tokenId`);return Q(e,`name`)??(n===null?void 0:t.get(n))??n??`?`}function Dn(e){return e.filter(e=>e!==null)}function On(e){let t=Q(e,`prefix`);return t===null?null:`Prefix ${t}…`}function kn(e,t){let n=e.detail??{};switch(e.action){case`admin-token-created`:{let e=n.expiresAt;return{title:`Admin token "${En(n,t)}" created`,details:Dn([On(n),typeof e==`number`?`Expires ${Qt(e)}`:null])}}case`admin-token-used`:{let e=Q(n,`path`);return{title:`Admin token "${En(n,t)}" used`,details:Dn([On(n),e===null?null:`Call ${e}`])}}case`admin-token-revoked`:return{title:`Admin token "${En(n,t)}" revoked`,details:Dn([On(n)])};case`credentials-revoked`:{let e=Q(n,`kind`)??`credential`,t=n.revoked,r=n.skipped,i=Tn[e]??`${e}s`;return{title:`${typeof t==`number`?String(t):`?`} ${i} revoked in bulk`,details:Dn([typeof r==`number`&&r>0?`${String(r)} skipped`:null,Q(n,`ids`)===null?null:`Ids ${Q(n,`ids`)??``}`])}}case`second-factor-skipped`:{let e=Q(n,`method`),t=Q(n,`factors`);return{title:`Second factor skipped on a trusted network`,details:Dn([e===null?null:`Signed in with ${xt(e)}`,t===null?null:`Skipped: ${t.split(`,`).join(`, `)}`])}}default:return{title:e.action,details:Object.entries(n).map(([e,t])=>`${e}: ${String(t)}`)}}}n();var An=100;function jn(){let{user:e}=dt();return e?.isAdmin?u(Nn,{}):null}function Mn(){let{data:e}=je(),{data:t}=Y.auth.listAdminTokens.useQuery();return i(()=>{let n=new Map;for(let t of e??[])n.set(t.id,t.username);let r=new Map;for(let e of t??[])r.set(e.id,e.name);return{userNameById:n,tokenNameById:r}},[e,t])}function Nn(){let e=Y.auth.listAuthAudit.useQuery({limit:An}),{userNameById:t,tokenNameById:n}=Mn(),i=e.data??[];return r(`div`,{"data-testid":`auth-audit`,className:`rounded-lg border border-border bg-surface overflow-hidden`,children:[r(`div`,{className:`px-4 py-2.5 border-b border-border flex items-center gap-2`,children:[u(O,{className:`h-3.5 w-3.5 text-foreground-subtle`}),u(`div`,{className:`text-xs font-semibold text-foreground`,children:`Authentication audit`}),r(`span`,{className:`ml-auto text-[10px] text-foreground-subtle`,children:[`Latest `,An,`, newest first`]})]}),u(`div`,{className:`p-4`,children:e.isLoading?r(`div`,{className:`flex items-center gap-2 text-xs text-foreground-subtle`,children:[u(C,{className:`h-3.5 w-3.5 animate-spin`}),`Loading audit trail…`]}):e.isError?r(`div`,{className:`text-[11px] text-danger`,children:[`Could not load the audit trail: `,e.error?.message??`Request failed`]}):i.length===0?r(`div`,{className:`rounded border border-dashed border-border px-3 py-4 text-xs text-foreground-subtle text-center space-y-1`,children:[u(`div`,{children:`No authentication events recorded yet.`}),u(`div`,{className:`text-[11px] text-foreground-subtle/90`,children:`This trail records admin-token create/use/revoke, trusted-network 2FA skips, and credential revokes (including single share-link revoke). Browser password logins are not listed here.`})]}):u(`ul`,{className:`divide-y divide-border rounded-md border border-border max-h-[420px] overflow-y-auto`,children:i.map(e=>u(Pn,{record:e,userName:e.userId===void 0?null:t.get(e.userId)??e.userId,tokenNameById:n},e.id))})})]})}function Pn({record:e,userName:t,tokenNameById:n}){let i=kn(e,n);return r(`li`,{"data-testid":`auth-audit-row`,className:`px-3 py-2 text-xs space-y-0.5`,children:[r(`div`,{className:`flex flex-wrap items-baseline gap-x-2`,children:[u(`span`,{className:`font-medium text-foreground`,children:i.title}),u(`span`,{className:`ml-auto text-[10px] text-foreground-subtle`,children:Qt(e.at)})]}),r(`div`,{className:`flex flex-wrap gap-x-3 text-[11px] text-foreground-subtle`,children:[t!==null&&u(`span`,{className:`text-foreground`,children:t}),e.ip!==void 0&&u(`span`,{className:`font-mono`,children:e.ip}),i.details.map(e=>u(`span`,{className:`font-mono`,children:e},e))]})]})}n();var $={loginSessions:`login-sessions`,linkedApps:`linked-apps`,tokens:`tokens`,scopedTokens:`scoped-tokens`,adminTokens:`admin-tokens`,shareLinks:`share-links`,legacyApiKeys:`legacy-api-keys`,externalIdentities:`external-identities`,audit:`auth-audit`},Fn={[$.scopedTokens]:$.tokens,[$.adminTokens]:$.tokens};function In(e){return[{id:$.loginSessions,label:`Login sessions`,icon:ne,render:()=>u(mn,{})},{id:$.linkedApps,label:`Linked apps`,icon:T,render:()=>u(fn,{})},{id:$.tokens,label:`Tokens`,icon:te,render:({createRequested:e,onCreateConsumed:t})=>u(wn,{headerOwnsCreate:!0,createRequested:e,onCreateConsumed:t})},{id:$.shareLinks,label:`Share links`,icon:w,render:()=>u(en,{})},...e?[{id:$.legacyApiKeys,label:`Legacy API keys`,icon:V,render:()=>u(ln,{})}]:[],{id:$.externalIdentities,label:`Sign-in links`,icon:B,render:()=>u(cn,{})},{id:$.audit,label:`Audit`,icon:O,render:()=>u(jn,{})}]}function Ln({createRequested:e=!1,onCreateConsumed:t}){let n=le(),a=(n.data??[]).length>0,o=i(()=>In(a),[a]),s=tn({ids:i(()=>o.map(e=>e.id),[o]),answered:!n.isLoading}),c=ft(),[l]=ut(),d=l.get(`integration`),f=d===null?void 0:Fn[d];if(f!==void 0){let e=new URLSearchParams(l);return e.set(`integration`,f),u(pt,{to:`?${e.toString()}`,replace:!0})}let p=o.find(e=>e.id===s.selectedId)??o[0],m=p?.id??$.loginSessions;return n.isLoading?u(`div`,{className:`text-sm text-foreground-subtle`,"data-testid":`access-page`,children:`Loading…`}):r(`div`,{className:`flex flex-col gap-3`,"data-testid":`access-page`,children:[u(Je,{appearance:`pills`,value:m,onValueChange:e=>{c(`?${ht(l,e,null,null).toString()}`)},children:u(tt,{"aria-label":`Credential kinds`,children:o.map(e=>r(rt,{value:e.id,"data-testid":`access-kind-${e.id}`,children:[u(e.icon,{className:`h-3.5 w-3.5 shrink-0`,"aria-hidden":!0}),e.label]},e.id))})}),p===void 0?null:u(`div`,{role:`region`,"aria-label":p.label,"data-testid":`access-kind-body`,children:p.render({createRequested:e&&p.id===$.tokens,onCreateConsumed:t??(()=>void 0)})},p.id)]})}function Rn(e,t){if(e===$.tokens)return r(G,{size:`sm`,type:`button`,"data-testid":`access-new-token`,onClick:t,children:[u(te,{className:`h-3.5 w-3.5`,"aria-hidden":!0}),`New token`]})}function zn(){let[e,t]=c(!1);return{createRequested:e,requestCreate:()=>t(!0),clearCreate:()=>t(!1)}}n();var Bn=[`oidcConnections`,`listConnections`],Vn=[`oidcConnections`,`connectionFormSchema`],Hn={displayName:`OpenID Connect`,icon:`shield-check`,issuerUrl:``,clientId:``,clientSecret:``,redirectUri:``,scopes:`openid profile email`,usernameClaim:`preferred_username`},Un=/^[a-z0-9][a-z0-9-]{0,63}$/;function Wn(e){return e instanceof Error?e.message:String(e)}function Gn(e,t){if(t)return typeof e==`string`&&e.length>0?e:void 0;if(ce(e))return se;if(typeof e==`string`&&e.length>0)return e;ae(e)}function Kn(e){return typeof e!=`object`||!e?!1:Array.isArray(Reflect.get(e,`sections`))}function qn({addonId:n}){let f=j(),p=s(),m=q(),g=Ee({editKey:`oidcEdit`,newKey:`oidcNew`}),[v,y]=c(!1),[b,x]=c(null),[S,C]=c(``),[w,T]=c({...Hn}),E=t(null),D=a({queryKey:[...Bn,n],queryFn:async()=>f.trpcClient.oidcConnections.listConnections.query({})}),O=a({queryKey:Vn,queryFn:async()=>f.trpcClient.oidcConnections.connectionFormSchema.query({})}),k=D.data??[],M=Kn(O.data)?O.data:void 0,N=g.state,P=N.mode===`edit`?k.find(e=>e.id===N.id)??null:null;d(()=>{if(g.state.mode===`edit`&&P!==null){let e=`edit:${P.id}`;if(E.current===e)return;E.current=e,x(null),C(P.id),T(P.formValues===void 0?{...Hn}:{...P.formValues});return}if(g.state.mode===`new`){if(E.current===`new`)return;E.current=`new`,x(null),C(``),T({...Hn})}},[P,g.state]);let F=e(async()=>{await p.invalidateQueries({queryKey:Bn})},[p]),I=l({mutationFn:async e=>f.trpcClient.oidcConnections.deleteConnection.mutate({id:e}),onSuccess:async()=>F()}),L=e(async e=>{await m({title:`Delete OIDC connection?`,message:`Remove “${e.displayName}” (${e.id}). The login button and IdP credentials for this id are dropped.`,confirmLabel:`Delete`,cancelLabel:`Cancel`,variant:`danger`})&&(await I.mutateAsync(e.id),g.state.mode===`edit`&&g.state.id===e.id&&(g.close(),E.current=null))},[m,I,g]),ee=e(async()=>{let e=w.displayName,t=typeof e==`string`&&e.trim()!==``?e.trim():``;if(t===``){x(`Display name is required.`);return}let n=g.state.mode===`new`,r=n?S.trim():P?.id??``;if(n&&!Un.test(r)){x(`Instance id must be a lowercase slug (e.g. authentik, google).`);return}if(r===``){x(`That connection is no longer available.`);return}let i=Gn(w.clientSecret,n),a=w.icon,o=w.issuerUrl,s=w.clientId,c=w.redirectUri,l=w.scopes,u=w.usernameClaim,d=u===`email`||u===`sub`?u:`preferred_username`;y(!0),x(null);try{n&&await f.trpcClient.oidcConnections.createConnection.mutate({id:r,displayName:t}),await f.trpcClient.oidcConnections.updateConnection.mutate({id:r,displayName:t,icon:typeof a==`string`?a:`shield-check`,issuerUrl:typeof o==`string`?o:``,clientId:typeof s==`string`?s:``,...i===void 0?{}:{clientSecret:i},redirectUri:typeof c==`string`?c:``,scopes:typeof l==`string`?l:`openid profile email`,usernameClaim:d}),await F(),g.close(),E.current=null}catch(e){x(Wn(e))}finally{y(!1)}},[S,P?.id,g,w,F,f]),R=i(()=>[{key:`id`,header:`Id`,sortValue:e=>e.id,render:e=>u(`span`,{className:`font-mono text-xs text-foreground`,children:e.id})},{key:`name`,header:`Name`,sortValue:e=>e.displayName,render:e=>u(`span`,{className:`truncate font-medium text-foreground`,children:e.displayName})},{key:`issuer`,header:`Issuer`,sortValue:e=>e.issuerUrl,render:e=>u(`span`,{className:`truncate text-xs text-foreground-muted`,children:e.issuerUrl===``?`—`:e.issuerUrl})},{key:`status`,header:`Status`,notSortableReason:`Badge`,render:e=>u(J,{variant:e.configured?`success`:`warning`,children:e.configured?`Configured`:`Not configured`})},{key:`actions`,header:``,align:`right`,notSortableReason:`Row actions`,nowrap:!0,render:e=>r(`div`,{className:`flex justify-end gap-1`,children:[u(G,{type:`button`,size:`sm`,variant:`secondary`,onClick:t=>{t.stopPropagation(),g.openEdit(e.id)},children:`Edit`}),u(G,{type:`button`,size:`sm`,variant:`ghost`,"aria-label":`Delete ${e.displayName}`,title:`Delete`,onClick:t=>{t.stopPropagation(),L(e)},children:u(h,{className:`h-3.5 w-3.5 text-danger`})})]})}],[g,L]),z=g.state.mode===`new`,B=z||P!==null,V=z?`new`:P===null?`closed`:`edit:${P.id}:${P.configured?`cfg`:`empty`}`;return r(`div`,{className:`flex min-h-0 flex-col gap-3`,"data-testid":`oidc-settings-connections`,children:[r(`div`,{className:`flex flex-wrap items-center justify-between gap-2`,children:[r(`p`,{className:`text-sm text-foreground-muted`,children:[`Each row is one IdP. Redirect URI:`,` `,u(`span`,{className:`font-mono text-xs`,children:`/addon/${n}/<id>/callback`})]}),r(G,{type:`button`,size:`sm`,"data-testid":`oidc-connections-add`,onClick:()=>g.openNew(),children:[u(_,{className:`h-3.5 w-3.5`}),`Add connection`]})]}),D.isError?u(`p`,{className:`text-sm text-danger`,children:`Could not load connections.`}):null,D.isPending?u(ot,{className:`h-32 w-full`}):u(Ce,{columns:R,rows:k,rowKey:e=>e.id,pageSize:25,mobileMode:`scroll`,emptyMessage:`No OIDC connections yet. Add one to register an IdP.`,onRowClick:e=>g.openEdit(e.id),defaultSort:{columnKey:`name`,dir:`asc`}}),u(it,{open:B,onClose:()=>{g.close(),x(null),E.current=null},title:z?`Add OIDC connection`:`Edit ${P?.displayName??`connection`}`,icon:A,width:`xl`,testId:`oidc-connection-editor`,error:b,footer:u(G,{type:`button`,size:`sm`,disabled:v||z&&S.trim()===``,onClick:()=>void ee(),children:v?`Saving…`:`Save`}),children:B?r(o,{children:[z?r(`div`,{children:[u(nt,{htmlFor:`oidc-connection-id`,children:`Instance id`}),u(Ge,{id:`oidc-connection-id`,value:S,onChange:e=>C(e.target.value),placeholder:`authentik`,autoComplete:`off`}),u(`p`,{className:`mt-1 text-xs text-foreground-muted`,children:`URL slug — appears in /addon/${n}/<id>/callback. Stable; renaming is not supported after save.`})]}):r(`p`,{className:`text-sm text-foreground-muted`,children:[`Instance id: `,u(`span`,{className:`font-mono`,children:P?.id})]}),M===void 0?u(`p`,{className:`text-sm text-foreground-muted`,children:`Loading form…`}):u(qe,{schema:M,values:w,onChange:T,bare:!0},V)]}):null})]})}n();var Jn=3e4,Yn=[{capName:`auth-provider`,stageBadge:null},{capName:`user-passkeys`,stageBadge:`Second factor`}],Xn={title:`Authentication`,subtitle:`Login providers (local password, OIDC, SAML) and second-factor providers (passkeys / WebAuthn). They run in parallel — enable or disable each independently; disabling one only removes that method, local password login is unaffected.`,emptyTitle:`No authentication providers registered`,emptyDescription:`Local auth should always be available — if this list is empty the local-auth builtin failed to register. Check the Addons page for load errors.`,installLabel:`Add provider`};function Zn(e){return e===`local-auth`?{headline:`Username + password (local).`,icon:I,bullets:[`Users live in the hub’s SQLite database — no IdP roundtrip.`,`TOTP / 2FA is self-enrolled: each user enables it from their own profile page (My access → Two-factor authentication).`,`Scoped tokens, admin tokens and sessions are managed from Identity → Tokens & sessions.`],setupSteps:[`A fresh hub has one account, admin / changeme — the first sign-in asks for a new password. Add users from Users → New user.`,`Hand out either passwords or scoped tokens — both validate through this provider.`]}:e.startsWith(`auth-oidc`)?{headline:`OpenID Connect (Google, Microsoft, Okta, Keycloak, …).`,icon:R,bullets:[`Three-leg redirect flow with PKCE S256 + nonce.`,`id_token is signature-verified against the IdP’s JWKS — no implicit trust.`,`Explicit linking only: an IdP account signs in only the CamStack user who linked it from their profile (My access → Linked sign-in accounts). No auto-created users, no email matching.`,`The linked user’s role, scopes and two-factor authentication apply.`],setupSteps:[`Register a web app at your IdP and copy the client_id + client_secret.`,"Choose a stable instance id (slug). Set the IdP redirect URI to `https://<this-hub>/addon/auth-oidc/<id>/callback`.",`In Settings below, Add connection — enter the id, issuer, and credentials; Save.`,`Each user then links their IdP account from My access → Linked sign-in accounts.`]}:e.startsWith(`auth-saml`)?{headline:`SAML 2.0 — enterprise SSO (Azure AD, Okta, OneLogin).`,icon:R,bullets:[`Heavier handshake than OIDC — exchange metadata XML with your IdP.`,`Group → role mapping via SAML assertions.`]}:e.startsWith(`auth-webauthn`)||e.startsWith(`auth-passkey`)?{headline:`Passkeys / WebAuthn — passwordless second factor.`,icon:y,bullets:[`Enroll a YubiKey, Touch ID, or platform passkey per user.`,`Resistant to phishing — the browser binds the credential to your hub origin.`]}:e.startsWith(`auth-totp`)?{headline:`TOTP — second factor.`,icon:y,bullets:[`Time-based codes from an authenticator app (RFC 6238).`,`Compatible with Google Authenticator, Aegis, 1Password, Bitwarden, etc.`]}:{headline:`Authentication provider.`,icon:A,bullets:[`Generic authentication provider. No additional hints registered.`]}}function Qn(){let e=he({capName:Yn[0].capName},{refetchInterval:Jn}),t=he({capName:Yn[1].capName},{refetchInterval:Jn}),n=ve(void 0,{refetchInterval:Jn}),r=i(()=>sn(n.data??[]),[n.data]),a=i(()=>{let n=[],i=[e.data??[],t.data??[]];for(let[e,t]of Yn.entries())for(let a of i[e]??[])n.push({addonId:a.addonId,displayName:r.get(a.addonId)??a.addonId,isActive:a.isActive,capName:t.capName,stageBadge:t.stageBadge});return n},[e.data,t.data,r]),o=[{id:`authentication`,label:`Authentication providers`,install:{capability:Yn[0].capName,label:Xn.installLabel},entries:a.map(e=>({id:e.addonId,name:e.displayName,fallbackIcon:A,...on(e.isActive),render:()=>u(nn,{addonId:e.addonId,displayName:e.displayName,capName:e.capName,isActive:e.isActive,badges:e.stageBadge===null?null:u(J,{variant:`info`,className:rn,children:e.stageBadge}),settingsContent:e.addonId.startsWith(`auth-oidc`)?u(qn,{addonId:e.addonId}):void 0,panels:[{id:`about`,title:`About`,icon:Zn(e.addonId).icon,content:u($n,{addonId:e.addonId})}]})}))}];return u(an,{embedded:!0,icon:A,title:Xn.title,subtitle:Xn.subtitle,groups:o,isLoading:e.isLoading||t.isLoading,emptyTitle:Xn.emptyTitle,emptyDescription:Xn.emptyDescription})}function $n({addonId:e}){let t=Zn(e),n=t.icon;return r(`div`,{className:`space-y-3 rounded-lg border border-border bg-surface p-2 sm:p-4`,children:[r(`div`,{className:`flex items-start gap-2.5`,children:[u(n,{className:`h-4 w-4 mt-0.5 text-primary shrink-0`}),u(`div`,{className:`text-xs text-foreground font-medium`,children:t.headline})]}),u(`ul`,{className:`text-xs text-foreground-subtle space-y-1.5 pl-6 list-disc`,children:t.bullets.map((e,t)=>u(`li`,{children:e},t))}),t.setupSteps&&t.setupSteps.length>0&&r(`div`,{className:`rounded-md border border-border bg-surface-hover/40 px-3 py-2.5 space-y-1.5`,children:[r(`div`,{className:`flex items-center gap-1.5 text-[10px] font-semibold text-foreground-subtle uppercase tracking-wide`,children:[u(L,{className:`h-3 w-3`}),`Setup steps`]}),u(`ol`,{className:`text-xs text-foreground space-y-0.5 pl-4 list-decimal`,children:t.setupSteps.map((e,t)=>u(`li`,{children:e},t))})]}),e===`local-auth`&&r(`div`,{className:`rounded-md border border-info/30 bg-info/5 px-3 py-2 flex items-start gap-2 text-[11px] text-foreground`,children:[u(M,{className:`h-3.5 w-3.5 mt-0.5 text-info shrink-0`}),r(`span`,{children:[`TOTP / 2FA is self-service: each user enrols from their own profile page —`,` `,u(lt,{to:`/system/my-access`,className:`underline text-primary`,children:`My access`}),` `,`→ “Two-factor authentication” → Enable 2FA. Admins can only remove a user’s active enrollment (lost device) from the`,` `,u(lt,{to:`/system/identity?tab=users`,className:`underline text-primary`,children:`Users`}),` `,`page via Actions → “Remove 2FA”.`]})]})]})}function er(){let e=Y.deviceCredentials.getDeviceCaStatus.useQuery({}),t=e.data;return u(X,{id:`device-ca`,title:`Device certificate authority`,icon:A,description:`Signs the certificate each paired device holds. It is created the first time a device is paired.`,children:u(Zt,{isPending:e.isPending,error:e.error,what:`the device CA`,onRetry:()=>void e.refetch(),children:t!==void 0&&r(`div`,{className:`space-y-1`,"data-testid":`device-ca-status`,children:[r(K,{label:`State`,children:[t.state===`ready`&&u(J,{variant:`success`,children:`Ready`}),t.state===`absent`&&u(J,{variant:`default`,children:`Not created yet`}),t.state===`unavailable`&&u(J,{variant:`danger`,children:`Unavailable`})]}),t.state===`ready`&&r(o,{children:[u(K,{label:`Subject`,valueClassName:`font-mono`,children:t.subject}),u(K,{label:`Fingerprint (SHA-256)`,valueClassName:`font-mono`,children:t.fingerprintSha256}),u(K,{label:`Valid until`,children:t.validTo})]}),t.state===`unavailable`&&u(K,{label:`Reason`,children:u(`span`,{className:`text-danger`,children:t.reason})})]})})})}n();function tr(){let e=Y.useUtils(),t=Y.deviceCredentials.getDeviceCertificateSettings.useQuery({}),[n,i]=c(null),a=Y.deviceCredentials.setDeviceCertificateSettings.useMutation({onSuccess:()=>{i(null),e.deviceCredentials.getDeviceCertificateSettings.invalidate()},onError:e=>i(`Could not save: ${e.message}`)});return u(Zt,{isPending:t.isPending,error:t.error,what:`the enrollment setting`,onRetry:()=>void t.refetch(),children:t.data!==void 0&&r(K,{label:`Users can enroll their own devices`,actions:u(Ye,{checked:t.data.selfEnrollment===`allowed`,disabled:a.isPending,"aria-label":`Users can enroll their own devices`,onCheckedChange:e=>a.mutate({selfEnrollment:e?`allowed`:`disabled`})}),children:[u(`span`,{className:`text-[11px] text-foreground-subtle`,children:t.data.selfEnrollment===`allowed`?`Allowed - a user signed in on a phone can keep it signed in. Pairing by QR works either way.`:`Disabled - only an admin can pair a device, with a QR code.`}),n!==null&&u(`span`,{className:`block text-[11px] text-danger`,children:n})]})})}n();function nr(e){let[t,n]=c(()=>Date.now());return d(()=>{let t=setInterval(()=>n(Date.now()),e);return()=>clearInterval(t)},[e]),t}n();var rr=80,ir=208;function ar({open:e,users:t,onClose:n,onPaired:i}){let a=Y.deviceCredentials.startEnrollment.useMutation({onSuccess:i}),[o,s]=c(``),[l,d]=c(``),f=o===``?t[0]?.id??``:o,p=a.data,m=()=>{a.reset(),d(``),n()};return u(it,{open:e,onClose:m,title:`Pair a device`,icon:y,width:`md`,testId:`pair-device-dialog`,error:a.isError?a.error.message:null,footer:p===void 0?r(G,{type:`button`,onClick:()=>{let e=l.trim();f===``||e===``||a.mutate({userId:f,deviceName:e})},disabled:a.isPending||f===``||l.trim()===``,children:[a.isPending&&u(C,{className:`h-3.5 w-3.5 animate-spin`,"aria-hidden":!0}),`Create pairing code`]}):u(G,{type:`button`,variant:`outline`,onClick:m,children:`Done`}),children:p===void 0?r(`div`,{className:`space-y-3`,children:[u(`p`,{className:`text-[11px] text-foreground-subtle`,children:`Creates a one-time code for a phone you hold. Scan it with the CamStack app on that phone; the phone then stays signed in as the chosen user until you revoke it.`}),u(xe,{label:`User`,required:!0,children:u(Se,{value:f,onChange:e=>s(e.target.value),options:t.map(e=>({value:e.id,label:e.username}))})}),u(xe,{label:`Device name`,required:!0,description:`How this phone is listed, e.g. Anna's iPhone.`,children:u(Ge,{value:l,maxLength:rr,onChange:e=>d(e.target.value),placeholder:`Anna's iPhone`,autoFocus:!0})})]}):u(or,{enrollUrl:p.enrollUrl,expiresAt:p.expiresAt,hubKnown:p.hubOrigin!==null,onRestart:()=>a.reset()})})}function or({enrollUrl:e,expiresAt:t,hubKnown:n,onRestart:i}){let a=Ht(t,nr(1e3));return u(`div`,{className:`space-y-3`,"data-testid":`pair-issued`,children:r(`div`,{className:`flex flex-col items-center gap-3 sm:flex-row sm:items-start`,children:[u(`div`,{className:a.expired?`opacity-30`:void 0,children:u(fe,{value:e,size:ir,alt:`Enrollment QR code`})}),r(`div`,{className:`min-w-0 flex-1 space-y-2`,children:[u(`p`,{className:`text-[11px] text-foreground-subtle`,children:`Open the CamStack app on the phone and scan this code. It works once.`}),u(`div`,{className:`text-sm font-semibold tabular-nums text-foreground`,role:`timer`,"data-testid":`pair-countdown`,children:a.expired?`Expired - create a new code`:`Expires in ${a.label}`}),r(`div`,{className:`flex items-center gap-1 rounded-md border border-border bg-background px-2 py-1`,children:[u(`code`,{className:`min-w-0 flex-1 select-all break-all font-mono text-[11px] text-foreground`,children:e}),u(be,{value:e,srLabel:`Enrollment link`})]}),!n&&r(`div`,{className:`flex items-start gap-2 rounded-md border border-warning/30 bg-warning/5 px-2.5 py-1.5 text-[11px] text-foreground`,children:[u(g,{className:`mt-0.5 h-3.5 w-3.5 shrink-0 text-warning`,"aria-hidden":!0}),u(`span`,{children:`The hub could not name an address for this link, so the app must already know it.`})]}),a.expired&&u(G,{type:`button`,variant:`outline`,size:`sm`,onClick:i,children:`New code`})]})]})})}n();var sr=25,cr={searchText:e=>[e.deviceName,e.username??``,e.platform,e.lastUsedFrom??``],facetValue:e=>e.status};function lr({pairOpen:e,onPairClose:t}){let n=q(),i=Le(),a=Y.useUtils(),o=Y.deviceCredentials.listDeviceCredentials.useQuery({includeRevoked:!0}),s=je(),[l,d]=c(null),f=()=>void a.deviceCredentials.listDeviceCredentials.invalidate(),p=e=>t=>d(`${e} failed: ${t.message}`),m=Y.deviceCredentials.revokeDeviceCredential.useMutation({onSuccess:f,onError:p(`Revoke`)}),h=Y.deviceCredentials.deleteDeviceCredential.useMutation({onSuccess:e=>{e.result!==`deleted`&&d(e.result===`live`?`Only a revoked device can be deleted: revoke it first.`:`That device no longer exists.`),f()},onError:p(`Delete`)}),g=Y.deviceCredentials.renameDeviceCredential.useMutation({onSuccess:f,onError:p(`Rename`)}),_=m.isPending||h.isPending||g.isPending,v=async e=>{await n({title:`Revoke this device`,message:`${e.deviceName} (${e.username??e.userId}) stops signing in at once and its open sessions end. To use it again it has to be paired anew.`,confirmLabel:`Revoke`,variant:`danger`})&&(d(null),m.mutate({id:e.id}))},b=async e=>{await n({title:`Delete this device`,message:`${e.deviceName} is removed from the list. The audit trail keeps the revocation.`,confirmLabel:`Delete`,variant:`danger`})&&(d(null),h.mutate({id:e.id}))},x=async e=>{let t=(await i({title:`Rename device`,label:`Device name`,defaultValue:e.deviceName,confirmLabel:`Rename`}))?.trim()??``;t===``||t===e.deviceName||(d(null),g.mutate({id:e.id,deviceName:t}))},S=Me(o.data??[],cr),C=dr({busy:_,onRename:x,onRevoke:v,onDelete:b});return r(X,{id:`devices`,title:`Devices`,icon:y,description:`Phones that stay signed in with a certificate instead of a login. Revoking one signs it out at once; it has to be paired again.`,notice:Z(l),onDismissNotice:()=>d(null),children:[u(tr,{}),u(Zt,{isPending:o.isPending,error:o.error,what:`devices`,onRetry:()=>void o.refetch(),children:r(`div`,{className:`space-y-3`,children:[u(Ie,{state:S.state,facets:S.facets,labels:{searchPlaceholder:`Search devices…`,searchLabel:`Search devices`,facetsLabel:`Status`,clearLabel:`Clear filters`},onSearch:S.setSearch,onToggleFacet:S.toggleFacet,onClear:S.clear}),u(Ce,{columns:C,rows:S.rows,rowKey:e=>e.id,minWidthPx:1e3,mobileMode:`auto`,maxBodyHeight:He,defaultSort:{columnKey:`status`,dir:`asc`},pageSize:sr,paginationLabels:{navLabel:`Devices pages`,previous:`Previous page`,next:`Next page`,range:(e,t,n)=>`${e}–${t} of ${n}`},emptyMessage:S.active?`No devices match the filters.`:`No devices paired yet.`,rowClassName:e=>e.status===`active`?void 0:`opacity-70`})]})}),u(ar,{open:e,users:s.data??[],onClose:t,onPaired:f})]})}function ur(e,t){return[{id:`rename`,label:`Rename`,icon:v,disabled:t.busy,onClick:()=>void t.onRename(e)},{id:`revoke`,label:`Revoke`,icon:f,hidden:!Pt(e),disabled:t.busy,onClick:()=>void t.onRevoke(e)},{id:`delete`,label:`Delete`,icon:h,hidden:!Jt(e),disabled:t.busy,onClick:()=>void t.onDelete(e)}]}function dr(e){return[{key:`user`,header:`User`,sortValue:e=>(e.username??e.userId).toLowerCase(),render:e=>u(`span`,{className:`text-foreground`,children:e.username??e.userId})},{key:`device`,header:`Device`,sortValue:e=>e.deviceName.toLowerCase(),render:e=>r(`div`,{className:`min-w-0 max-w-[16rem]`,children:[u(`div`,{className:`truncate font-medium text-foreground`,title:e.deviceName,children:e.deviceName}),u(`div`,{className:`truncate font-mono text-[10px] text-foreground-subtle`,title:e.fingerprint,children:e.fingerprint.slice(0,11)})]})},{key:`platform`,header:`Platform`,sortValue:e=>Gt[e.platform],render:e=>Gt[e.platform]},{key:`via`,header:`Enrolled via`,sortValue:e=>e.enrolledVia,render:e=>Nt[e.enrolledVia]},{key:`issued`,header:`Issued`,sortValue:e=>e.issuedAt,render:e=>Ut(e.issuedAt)},{key:`expires`,header:`Expires`,sortValue:e=>e.expiresAt,render:e=>Ut(e.expiresAt)},{key:`lastUsed`,header:`Last used`,sortValue:e=>e.lastUsedAt,render:e=>e.lastUsedAt===null?u(`span`,{className:`text-foreground-subtle`,children:`Never`}):r(`div`,{children:[u(`div`,{children:Ut(e.lastUsedAt)}),e.lastUsedFrom!==null&&u(`div`,{className:`font-mono text-[10px] text-foreground-subtle`,children:e.lastUsedFrom})]})},{key:`status`,header:`Status`,sortValue:e=>qt[e.status],render:e=>u(J,{variant:zt[e.status],className:`text-[10px]`,children:Wt[e.status]})},{key:`actions`,header:`Actions`,align:`right`,notSortableReason:`Actions have no order.`,render:t=>u(Ue,{items:ur(t,e),title:`Actions for ${t.deviceName}`})}]}n();var fr={ok:`text-foreground-subtle`,soon:`text-warning`,expired:`text-danger`,unknown:`text-foreground-subtle`};function pr(){let e=q(),t=Y.useUtils(),n=nr(6e4),r=Y.certificates.listHttpsCertificates.useQuery(),i=ue(),[a,o]=c(null),[s,l]=c(null),d=Y.certificates.renewHttpsOnNode.useMutation({onSuccess:(e,n)=>{l({tone:`success`,message:e.restartRequired?`${n.nodeId}: new certificate issued. Restart the node to serve it.`:`${n.nodeId}: new certificate issued and served.`}),t.certificates.listHttpsCertificates.invalidate()},onError:(e,t)=>o(`${t.nodeId}: renewal failed - ${e.message}`)}),f=async t=>{await e({title:`Renew the HTTPS certificate on ${t.nodeId}`,message:t.isHub?`A new certificate is issued from the local CA. Clients that trust the CA keep working.`:`The node makes a new key, the hub signs it and the node switches over without a restart. It keeps serving what it had if anything fails.`,confirmLabel:`Renew`})&&(o(null),l(null),d.mutate({nodeId:t.nodeId}))},p=()=>{let e=i.data?.caCertPem;if(e==null||e===``)return;let t=URL.createObjectURL(new Blob([e],{type:`application/x-pem-file`})),n=document.createElement(`a`);n.href=t,n.download=`camstack-ca.crt`,n.click(),URL.revokeObjectURL(t)},m=(i.data?.caCertPem??``)!==``,h=_r({now:n,renewingNodeId:d.isPending?d.variables?.nodeId??null:null,busy:d.isPending,hubCaAvailable:m,onRenew:f,onDownloadCa:p});return u(X,{id:`https`,title:`HTTPS`,icon:k,description:`The certificate each node serves this interface and its API with. The hub's is generated by its own CA (or uploaded by you); an agent serves one the hub issued for it, on the same port.`,notice:Z(a,s),onDismissNotice:()=>{o(null),l(null)},children:u(Zt,{isPending:r.isPending,error:r.error,what:`HTTPS certificates`,onRetry:()=>void r.refetch(),children:u(Ce,{columns:h,rows:r.data??[],rowKey:e=>e.nodeId,minWidthPx:960,mobileMode:`auto`,maxBodyHeight:He,defaultSort:{columnKey:`node`,dir:`asc`},emptyMessage:`No nodes reported.`})})})}function mr(e){return e.https.kind===`served`?Xt(e.https.status.validTo):null}function hr({row:e}){let{https:t}=e;return t.kind===`served`?u(J,{variant:`success`,children:`Served`}):r(`div`,{className:`max-w-[16rem]`,children:[u(J,{variant:t.kind===`unreadable`?`danger`:`warning`,children:t.kind===`unreadable`?`Unreadable`:`Not served`}),u(`div`,{className:`mt-1 whitespace-normal text-[10px] text-foreground-subtle`,children:t.reason})]})}function gr({row:e,o:t}){let n=Rt(e),i=t.renewingNodeId===e.nodeId;return r(`div`,{className:`flex flex-col items-end gap-1`,children:[r(`div`,{className:`flex items-center gap-1`,children:[e.isHub&&t.hubCaAvailable&&r(G,{type:`button`,variant:`ghost`,size:`sm`,onClick:t.onDownloadCa,children:[u(p,{className:`h-3 w-3`,"aria-hidden":!0}),`Download CA`]}),r(G,{type:`button`,variant:`outline`,size:`sm`,disabled:!n.allowed||t.busy,title:n.reason??void 0,"aria-label":`Renew the certificate on ${e.nodeId}`,onClick:()=>void t.onRenew(e),children:[i?u(C,{className:`h-3 w-3 animate-spin`,"aria-hidden":!0}):u(F,{className:`h-3 w-3`,"aria-hidden":!0}),`Renew`]})]}),n.reason!==null&&u(`div`,{className:`max-w-[18rem] whitespace-normal text-right text-[10px] text-foreground-subtle`,"data-testid":`renew-reason-${e.nodeId}`,children:n.reason})]})}function _r(e){return[{key:`node`,header:`Node`,sortValue:e=>e.isHub?``:e.nodeId.toLowerCase(),render:e=>r(`div`,{className:`flex items-center gap-1.5`,children:[u(`span`,{className:`font-medium text-foreground`,children:e.nodeId}),e.isHub&&u(J,{variant:`info`,children:`hub`}),!e.online&&u(J,{variant:`default`,children:`offline`})]})},{key:`state`,header:`State`,notSortableReason:`A state with a reason has no single order.`,render:e=>u(hr,{row:e})},{key:`mode`,header:`Mode`,sortValue:e=>e.https.kind===`served`?e.https.status.mode:null,render:e=>e.https.kind===`served`?e.https.status.mode===`uploaded`?`Uploaded`:e.https.status.mode===`generated`?`Generated`:`Disabled`:`—`},{key:`fingerprint`,header:`Fingerprint`,sortValue:e=>e.https.kind===`served`?e.https.status.leafFingerprintSha256:null,render:e=>u(`span`,{className:`font-mono text-[11px]`,title:e.https.kind===`served`?e.https.status.leafFingerprintSha256??``:``,children:e.https.kind===`served`?Lt(e.https.status.leafFingerprintSha256):`—`})},{key:`expires`,header:`Expires`,sortValue:e=>mr(e),render:t=>{let n=mr(t);return n===null?`—`:r(`div`,{children:[u(`div`,{children:Ut(n)}),u(`div`,{className:`text-[10px] ${fr[Kt(n,e.now)]}`,children:Ft(n,e.now)})]})}},{key:`sans`,header:`Names`,nowrap:!1,notSortableReason:`A list of names has no single value.`,render:e=>e.https.kind===`served`&&e.https.status.sans.length>0?u(`div`,{className:`max-w-[16rem] break-words font-mono text-[10px] text-foreground-subtle`,children:e.https.status.sans.join(`, `)}):`—`},{key:`actions`,header:`Actions`,align:`right`,notSortableReason:`Actions have no order.`,render:t=>u(gr,{row:t,o:e})}]}n();var vr=`hub`,yr={ok:`text-foreground-subtle`,soon:`text-warning`,expired:`text-danger`,unknown:`text-foreground-subtle`},br={enroll:`Issued at enrollment`,renewal:`Issued by a renewal`,boot:`Issued at boot`,observed:`Observed on its connection`,pairing:`Issued at pairing`};function xr(){let e=q(),t=Y.useUtils(),n=nr(6e4),i=Y.certificates.getMeshCertificates.useQuery(),[a,o]=c(null),[s,l]=c(null),d=()=>void t.certificates.getMeshCertificates.invalidate(),f=Y.certificates.renewMeshOnNode.useMutation({onSuccess:e=>{o(It(e)),d()},onError:(e,t)=>l(`${t.nodeId}: renewal could not start - ${e.message}`)}),p=Y.certificates.revokeMeshOnNode.useMutation({onSuccess:e=>{o({tone:`success`,message:`${e.nodeId}: ${e.next}`}),d()},onError:(e,t)=>l(`${t.nodeId}: revoke failed - ${e.message}`)}),m=Er({now:n,busy:f.isPending||p.isPending,renewingNodeId:f.isPending?f.variables?.nodeId??null:null,revokingNodeId:p.isPending?p.variables?.nodeId??null:null,onRenew:e=>{l(null),o(null),f.mutate({nodeId:e.nodeId})},onRevoke:async t=>{await e({title:`Revoke the cluster certificate of ${t.nodeId}`,message:`${t.nodeId} is disconnected at once and can no longer connect. To bring it back it must re-join the cluster with a new join token. It stays in the node list until you forget it on the Cluster page.`,confirmLabel:`Revoke and disconnect`,variant:`danger`})&&(l(null),o(null),p.mutate({nodeId:t.nodeId}))}});return u(X,{id:`mesh`,title:`Cluster certificates`,icon:b,description:`The certificates the nodes use to join this hub's cluster. Renewing replaces a node's certificate without a gap; revoking cuts the node off until it re-joins.`,notice:Z(s,a),onDismissNotice:()=>{l(null),o(null)},children:u(Zt,{isPending:i.isPending,error:i.error,what:`cluster certificates`,onRetry:()=>void i.refetch(),children:i.data!==void 0&&r(`div`,{className:`space-y-3`,children:[u(Sr,{inventory:i.data,now:n}),u(Ce,{columns:m,rows:i.data.nodes,rowKey:e=>e.nodeId,minWidthPx:980,mobileMode:`auto`,maxBodyHeight:`max-h-[60vh]`,defaultSort:{columnKey:`node`,dir:`asc`},emptyMessage:i.data.registryAvailable?`No nodes have joined this cluster yet.`:`The certificate registry is not available yet, so nodes cannot be listed.`})]})})})}function Sr({inventory:e,now:t}){let{ca:n,listener:i}=e,a=n.state===`ready`?Date.parse(n.validTo):null;return r(`div`,{className:`space-y-1`,"data-testid":`mesh-summary`,children:[u(K,{label:`Certificate authority`,children:n.state===`ready`?u(J,{variant:`success`,children:`Ready`}):r(`span`,{className:`text-danger`,children:[`Unavailable - `,n.reason]})}),n.state===`ready`&&r(o,{children:[u(K,{label:`CA fingerprint (SHA-256)`,valueClassName:`font-mono`,children:n.fingerprintSha256}),r(K,{label:`CA valid until`,children:[n.validTo,a!==null&&!Number.isNaN(a)&&r(`span`,{className:`ml-2 text-[10px] ${yr[Kt(a,t)]}`,children:[`(`,Ft(a,t),`)`]})]})]}),r(K,{label:`Node listener`,children:[i.state===`open`&&u(J,{variant:`success`,children:`Open`}),i.state===`not-started`&&u(J,{variant:`default`,children:`Not started`}),i.state===`closed`&&r(`span`,{className:`text-danger`,children:[`Closed since `,Ut(i.since),` - every node is refused. `,i.reason]})]}),u(K,{label:`Revoked certificates`,children:String(e.revokedSerials.length)}),!e.registryAvailable&&r(`div`,{className:`flex items-start gap-2 rounded-md border border-warning/30 bg-warning/5 px-2.5 py-1.5 text-[11px] text-foreground`,children:[u(g,{className:`mt-0.5 h-3.5 w-3.5 shrink-0 text-warning`,"aria-hidden":!0}),u(`span`,{children:`The certificate registry is not up, so the node list below is incomplete.`})]})]})}function Cr(e){return e.nodeId===vr?`The hub's own certificate is re-issued at every boot; there is nothing to renew or revoke.`:e.online?null:`The node is offline - it cannot be renewed now.`}function wr({row:e}){return e.presentingCurrent===null?u(`span`,{className:`text-foreground-subtle`,children:e.online?`—`:`Offline`}):e.presentingCurrent?u(J,{variant:`success`,children:`Yes`}):u(J,{variant:`warning`,children:`No - presents another`})}function Tr({row:e,o:t}){let n=e.nodeId===vr,i=Cr(e);return r(`div`,{className:`flex flex-col items-end gap-1`,children:[r(`div`,{className:`flex items-center justify-end gap-1`,children:[r(G,{type:`button`,variant:`outline`,size:`sm`,disabled:i!==null||t.busy,title:i??void 0,"aria-label":`Renew the cluster certificate of ${e.nodeId}`,onClick:()=>t.onRenew(e),children:[t.renewingNodeId===e.nodeId?u(C,{className:`h-3 w-3 animate-spin`,"aria-hidden":!0}):u(F,{className:`h-3 w-3`,"aria-hidden":!0}),t.renewingNodeId===e.nodeId?`Renewing…`:`Renew`]}),r(G,{type:`button`,variant:`ghost`,size:`sm`,className:`text-danger hover:bg-danger/10`,disabled:n||t.busy,title:n?i??void 0:void 0,"aria-label":`Revoke the cluster certificate of ${e.nodeId}`,onClick:()=>void t.onRevoke(e),children:[t.revokingNodeId===e.nodeId?u(C,{className:`h-3 w-3 animate-spin`,"aria-hidden":!0}):u(f,{className:`h-3 w-3`,"aria-hidden":!0}),`Revoke`]})]}),i!==null&&u(`div`,{className:`max-w-[18rem] whitespace-normal text-right text-[10px] text-foreground-subtle`,"data-testid":`mesh-reason-${e.nodeId}`,children:i})]})}function Er(e){return[{key:`node`,header:`Node`,sortValue:e=>e.nodeId===vr?``:e.nodeId.toLowerCase(),render:e=>r(`div`,{className:`flex items-center gap-1.5`,children:[u(`span`,{className:`font-medium text-foreground`,children:e.nodeId}),e.nodeId===vr&&u(J,{variant:`info`,children:`hub`}),!e.online&&u(J,{variant:`default`,children:`offline`})]})},{key:`serial`,header:`Current certificate`,sortValue:e=>e.current?.serial??null,render:e=>e.current===null?u(`span`,{className:`text-foreground-subtle`,children:`None recorded`}):r(`div`,{children:[u(`div`,{className:`font-mono text-[11px]`,title:e.current.serial,children:Mt(e.current.serial)}),u(`div`,{className:`font-mono text-[10px] text-foreground-subtle`,title:e.current.fingerprintSha256,children:Lt(e.current.fingerprintSha256)})]})},{key:`via`,header:`Issued via`,sortValue:e=>e.current?.issuedVia??null,render:e=>e.current===null?`—`:br[e.current.issuedVia]},{key:`expires`,header:`Expires`,sortValue:e=>e.current?.notAfter??null,render:t=>t.current===null?`—`:r(`div`,{children:[u(`div`,{children:Ut(t.current.notAfter)}),u(`div`,{className:`text-[10px] ${yr[Kt(t.current.notAfter,e.now)]}`,children:Ft(t.current.notAfter,e.now)})]})},{key:`presenting`,header:`Presenting current`,notSortableReason:`Offline nodes have no answer to order by.`,render:e=>u(wr,{row:e})},{key:`history`,header:`Earlier certificates`,align:`right`,sortValue:e=>e.history.length,render:e=>String(e.history.length)},{key:`actions`,header:`Actions`,align:`right`,notSortableReason:`Actions have no order.`,render:t=>u(Tr,{row:t,o:e})}]}function Dr({pairOpen:e,onPairClose:t}){return r(`div`,{className:`space-y-4`,"data-testid":`certificates-page`,children:[u(lr,{pairOpen:e,onPairClose:t}),u(er,{}),u(pr,{}),u(xr,{})]})}function Or({userId:e,username:t,onClose:n}){let i=q(),a=Y.useUtils(),o=Xe({userId:e}),s=Y.auth.listLoginMethods.useQuery(),c=at({onSuccess:()=>void a.userManagement.listExternalIdentities.invalidate()}),l=new Map((s.data??[]).flatMap(e=>e.kind===`redirect`?[[e.id,e.label]]:[])),d=o.data??[],f=async(n,r)=>{await i({title:`Remove sign-in link`,message:`"${t}" will no longer be able to sign in with this ${r} account.`,confirmLabel:`Remove`,variant:`danger`})&&c.mutate({userId:e,provider:n.provider,subject:n.subject})};return u(Ve,{open:!0,onOpenChange:e=>!e&&n(),children:r(me,{width:`md`,placement:`sheet-on-mobile`,scroll:`body`,"data-testid":`external-identities-modal`,children:[u(W,{children:r(Ze,{className:`flex items-center gap-2`,children:[u(T,{className:`h-4 w-4 text-primary`}),r(`span`,{children:[`Linked sign-in accounts`,r(`span`,{className:`mt-0.5 block text-[11px] font-normal text-foreground-subtle`,children:[`User: `,u(`span`,{className:`font-mono`,children:t})]})]})]})}),u(_e,{className:`space-y-3`,children:o.isLoading?r(`div`,{className:`flex items-center gap-2 text-xs text-foreground-subtle`,children:[u(C,{className:`h-3.5 w-3.5 animate-spin`}),`Loading…`]}):d.length===0?u(`p`,{className:`text-xs text-foreground-subtle`,children:`No linked accounts. Only the user can link one, from their own profile page.`}):u(`ul`,{className:`divide-y divide-border rounded-md border border-border`,children:d.map(e=>{let t=l.get(e.provider),n=t??e.provider;return r(`li`,{className:`flex items-center gap-3 px-3 py-2 text-xs`,children:[r(`div`,{className:`flex-1 min-w-0`,children:[r(`div`,{className:`font-medium text-foreground truncate`,children:[n,t===void 0&&u(`span`,{className:`ml-2 rounded bg-foreground-subtle/15 px-1.5 py-0.5 text-[10px] font-normal text-foreground-subtle`,children:`provider unavailable`})]}),r(`div`,{className:`text-[11px] text-foreground-subtle truncate`,children:[e.label??e.subject,` ·`,` `,new Date(e.linkedAt).toLocaleDateString()]})]}),r(`button`,{onClick:()=>void f(e,n),disabled:c.isPending,className:`inline-flex items-center gap-1 rounded px-2 py-1 text-[10px] text-danger hover:bg-danger/10 disabled:opacity-50`,children:[u(re,{className:`h-3 w-3`}),`Remove`]})]},`${e.provider}|${e.subject}`)})})}),u($e,{children:u(G,{onClick:n,variant:`secondary`,children:`Close`})})]})})}function kr({userId:e,username:t,onClose:n}){let i=s(),a=q(),c=Qe({userId:e}),l=c.data,d=()=>i.invalidateQueries({queryKey:[[`userManagement`,`getTotpStatus`]]}),f=Ne({onSuccess:()=>{d(),n()}}),p=c.isLoading?`loading`:l?.enabled?`enrolled`:`not_enrolled`;return u(Ve,{open:!0,onOpenChange:e=>!e&&n(),children:r(me,{width:`md`,placement:`sheet-on-mobile`,scroll:`body`,children:[u(W,{children:r(Ze,{className:`flex items-center gap-2`,children:[u(y,{className:`h-4 w-4 text-primary`}),r(`span`,{children:[`Two-factor authentication`,r(`span`,{className:`mt-0.5 block text-[11px] font-normal text-foreground-subtle`,children:[`User: `,u(`span`,{className:`font-mono`,children:t})]})]})]})}),r(_e,{className:`space-y-4`,children:[p===`loading`&&r(`div`,{className:`flex items-center gap-2 text-xs text-foreground-subtle`,children:[u(C,{className:`h-3.5 w-3.5 animate-spin`}),`Checking status…`]}),p===`not_enrolled`&&r(`div`,{className:`rounded-md border border-border bg-surface-hover/30 px-3 py-2.5 flex items-start gap-2.5 text-xs text-foreground-subtle`,children:[u(M,{className:`h-4 w-4 mt-0.5 shrink-0`}),r(`div`,{children:[u(`div`,{className:`font-medium text-foreground`,children:`2FA not enrolled`}),u(`p`,{className:`mt-0.5`,children:`Only the user themselves can enable 2FA, from their own profile page.`})]})]}),p===`enrolled`&&l&&r(o,{children:[r(`div`,{className:`rounded-md border border-emerald-500/30 bg-emerald-500/5 px-3 py-2.5 flex items-start gap-2.5`,children:[u(D,{className:`h-4 w-4 mt-0.5 text-emerald-500 shrink-0`}),r(`div`,{className:`text-xs text-foreground space-y-0.5`,children:[u(`div`,{className:`font-medium`,children:`2FA is active`}),r(`div`,{className:`text-foreground-subtle`,children:[`Enrolled on`,` `,l.confirmedAt?new Date(l.confirmedAt).toLocaleString():`—`]})]})]}),u(`div`,{className:`text-[11px] text-foreground-subtle`,children:`Removing here clears the server-side secret. Use this only when the user has lost access — they'll have to re-enroll from their profile page afterwards.`}),r(`div`,{className:`flex justify-end gap-2`,children:[u(G,{onClick:n,variant:`secondary`,children:`Close`}),r(`button`,{onClick:async()=>{await a({title:`Remove 2FA`,message:`Remove two-factor authentication for "${t}"? They'll be able to log in with just their password until they re-enroll from their own profile page.`,confirmLabel:`Remove`,variant:`danger`})&&f.mutate({userId:e})},disabled:f.isPending,className:`rounded bg-danger px-3 py-1.5 text-xs font-medium text-white hover:bg-danger/90 disabled:opacity-50 inline-flex items-center gap-1`,children:[f.isPending?u(C,{className:`h-3 w-3 animate-spin`}):u(E,{className:`h-3 w-3`}),`Remove 2FA`]})]})]})]})]})})}n();function Ar({userId:e,username:t,onClose:n}){let{user:i,logout:a}=dt(),o=i?.id===e,s=q(),l=Y.useUtils(),d=Y.auth.listSessions.useQuery({userId:e}),[f,p]=c(null),m=Y.auth.revokeSessions.useMutation({onSuccess:(e,t)=>{if(o&&`userId`in t){a();return}l.auth.listSessions.invalidate()},onError:e=>p(`Sign out failed: ${e.message}`)}),h=async e=>{await s({title:`Sign out this session`,message:`"${t}" on ${At(e.client).label} will have to sign in again.`,confirmLabel:`Sign out`,variant:`danger`})&&(p(null),m.mutate({id:e.id}))},g=async()=>{await s({title:`Sign out everywhere`,message:o?`Every session of your own account ends, this browser included: you will be signed out here too.`:`Every session of "${t}" ends at once; each device has to sign in again.`,confirmLabel:`Sign out everywhere`,variant:`danger`})&&(p(null),m.mutate({userId:e}))},_=m.isPending&&m.variables!==void 0&&`id`in m.variables?m.variables.id:null;return u(Ve,{open:!0,onOpenChange:e=>!e&&n(),children:r(me,{width:`lg`,placement:`sheet-on-mobile`,scroll:`body`,"data-testid":`user-sessions-modal`,children:[u(W,{children:r(Ze,{className:`flex items-center gap-2`,children:[u(ne,{className:`h-4 w-4 text-primary`}),r(`span`,{children:[`Active sessions`,r(`span`,{className:`mt-0.5 block text-[11px] font-normal text-foreground-subtle`,children:[`User: `,u(`span`,{className:`font-mono`,children:t})]})]})]})}),r(_e,{className:`space-y-3`,children:[f!==null&&u(`div`,{className:`text-[11px] text-danger`,children:f}),u(Yt,{sessions:d.data??[],isLoading:d.isLoading,loadError:d.isError?d.error?.message??`Request failed`:null,emptyText:`No active sessions.`,onRevoke:e=>void h(e),revokingId:_})]}),r($e,{className:`justify-between`,children:[r(`button`,{onClick:()=>void g(),disabled:m.isPending||(d.data??[]).length===0,className:`inline-flex items-center gap-1.5 rounded border border-danger/40 px-2.5 py-1 text-[11px] font-medium text-danger hover:bg-danger/10 disabled:opacity-50`,children:[m.isPending&&_===null?u(C,{className:`h-3 w-3 animate-spin`}):u(z,{className:`h-3 w-3`}),`Sign out everywhere`]}),u(G,{onClick:n,variant:`secondary`,children:`Close`})]})]})})}function jr({icon:e,label:t,count:n,all:i,total:a}){return r(`div`,{className:`flex items-center gap-2 text-[11px]`,children:[u(e,{className:`h-3 w-3 shrink-0 text-foreground-subtle`}),u(`span`,{className:`min-w-0 flex-1 text-foreground-subtle`,children:t}),u(`span`,{className:n===0?`text-foreground-subtle`:`font-medium text-foreground`,children:n===0?`none`:i?`all ${a}`:`${n} of ${a}`})]})}function Mr({scopes:e,isAdmin:t,invalidReason:n}){let i=j(),s=a({queryKey:[`auth`,`previewScope`,e,t],enabled:n===null,queryFn:()=>i.trpcClient.auth.previewScope.query({scopes:[...e],isAdmin:t})}),{data:c}=et({projection:`slim`}),l=c?.length??0;if(n!==null)return u(`div`,{className:`rounded-lg border border-border bg-surface p-3`,children:r(`p`,{className:`flex items-center gap-1.5 text-[11px] text-warning`,children:[u(N,{className:`h-3 w-3 shrink-0`}),n]})});if(s.isLoading)return r(`div`,{className:`flex items-center gap-2 rounded-lg border border-border bg-surface p-3 text-[11px] text-foreground-subtle`,children:[u(C,{className:`h-3 w-3 animate-spin`}),`Resolving…`]});if(s.isError||!s.data)return u(`div`,{className:`rounded-lg border border-border bg-surface p-3`,children:u(`p`,{className:`text-[11px] text-danger`,children:`Could not resolve this grant set. Saving is still allowed — the server enforces the same rules either way.`})});let d=s.data;return u(`div`,{className:`space-y-2 rounded-lg border border-border bg-surface p-3`,children:d.isAdmin?r(`p`,{className:`text-[11px] text-foreground`,children:[u(`span`,{className:`font-medium`,children:`Administrator`}),` — unrestricted. Grants are ignored for an admin.`]}):r(o,{children:[u(jr,{icon:m,label:`Devices they can see`,count:d.device.view.deviceCount,all:d.device.view.all,total:l}),u(jr,{icon:v,label:`Devices they can operate`,count:d.device.create.deviceCount,all:d.device.create.all,total:l}),u(jr,{icon:h,label:`Devices they can delete`,count:d.device.delete.deviceCount,all:d.device.delete.all,total:l}),r(`div`,{className:`border-t border-border pt-2 text-[10px] text-foreground-subtle`,children:[`System access: `,d.system.length===0?`none`:d.system.join(`, `),d.capabilities.length>0&&r(o,{children:[` · Extra capabilities: `,d.capabilities.map(e=>e.name).join(`, `)]}),d.addons.length>0&&r(o,{children:[` · Addons: `,d.addons.map(e=>e.name).join(`, `)]})]}),d.device.view.deviceCount===0&&u(`p`,{className:`text-[10px] text-warning`,children:`This user will not be able to see any device.`})]})})}n();function Nr(e){let t=H(e);return t===null?{mode:e.length===0?`role`:`advanced`,roleId:null,selector:{kind:`all`},includeLinked:!0,advancedScopes:e}:{mode:`role`,roleId:t.roleId,selector:t.selector,includeLinked:t.includeLinked,advancedScopes:e}}function Pr(e){return e.mode===`advanced`?e.advancedScopes:e.roleId===null?[]:ie({roleId:e.roleId,selector:e.selector,includeLinked:e.includeLinked})}function Fr({user:e,onClose:t,onSubmit:n,submitting:a,callerScopes:s}){let l=i(()=>Nr(e.scopes??[]),[e.scopes]),[d,f]=c(l),[p,m]=c(l.mode===`advanced`),h=i(()=>Pr(d),[d]),g=!e.isAdmin&&d.mode===`role`&&d.roleId===null,_=i(()=>e.isAdmin?null:d.mode===`role`&&d.roleId===null?`Pick what this user can do to see the result.`:Pe(h),[e.isAdmin,d.mode,d.roleId,h]),v=e=>f({...d,...e});return u(Ve,{open:!0,onOpenChange:e=>!e&&t(),children:r(me,{width:`lg`,placement:`sheet-on-mobile`,scroll:`body`,className:`md:max-w-2xl`,children:[r(W,{children:[r(Ze,{children:[`Access — `,e.username]}),u(`p`,{className:`text-[10px] text-foreground-subtle`,children:e.isAdmin?`This user is an administrator — they can do everything, and the settings below are ignored.`:`Choose what they can do, then which devices it applies to.`})]}),r(_e,{className:`space-y-4`,children:[g&&r(`div`,{className:`flex items-start gap-2 rounded-lg border border-warning/40 bg-warning/10 p-3`,children:[u(N,{className:`mt-0.5 h-3.5 w-3.5 shrink-0 text-warning`}),r(`p`,{className:`text-[11px] text-foreground`,children:[u(`span`,{className:`font-medium`,children:`No access.`}),` `,r(`span`,{className:`text-foreground-subtle`,children:[e.username,` cannot see or do anything yet. Configure it below.`]})]})]}),r(`section`,{className:`space-y-2`,children:[u(`h3`,{className:`text-[11px] font-semibold uppercase tracking-wide text-foreground-subtle`,children:`1 · What can they do`}),u(`div`,{className:`space-y-1.5`,children:oe.map(e=>{let t=d.mode===`role`&&d.roleId===e.id;return r(`label`,{className:`flex cursor-pointer items-start gap-2 rounded-lg border p-2.5 transition-colors ${t?`border-primary bg-primary/5`:`border-border hover:bg-foreground-subtle/5`}`,children:[u(`input`,{type:`radio`,name:`access-role`,checked:t,onChange:()=>v({mode:`role`,roleId:e.id}),className:`mt-0.5 border-border focus:ring-primary`}),r(`span`,{className:`min-w-0`,children:[u(`span`,{className:`block text-[12px] font-medium text-foreground`,children:e.label}),u(`span`,{className:`mt-0.5 block text-[10px] text-foreground-subtle`,children:e.description})]})]},e.id)})}),r(`button`,{type:`button`,onClick:()=>{if(!p){f({...d,mode:`advanced`,advancedScopes:h}),m(!0);return}m(!1),f(Nr(d.advancedScopes))},className:`inline-flex items-center gap-1 rounded px-1.5 py-1 text-[10px] text-foreground-subtle transition-colors hover:bg-foreground-subtle/10 hover:text-foreground`,children:[u(p?P:S,{className:`h-3 w-3`}),`Advanced — edit raw grants`]}),p&&r(`div`,{className:`rounded-lg border border-border p-2`,children:[u(`p`,{className:`mb-2 text-[10px] text-foreground-subtle`,children:`One row per grant. Anything expressible here overrides the three roles above; close this section to go back to them.`}),u(Ae,{value:d.advancedScopes,onChange:e=>v({mode:`advanced`,advancedScopes:e}),clampToParent:s,emptyHint:r(o,{children:[`No grants.`,` `,u(`span`,{className:`font-medium text-foreground`,children:e.username}),` cannot call any protected endpoint until one is added.`]})})]})]}),d.mode===`role`&&r(`section`,{className:`space-y-2`,children:[u(`h3`,{className:`text-[11px] font-semibold uppercase tracking-wide text-foreground-subtle`,children:`2 · On which devices`}),u(We,{value:d.selector,onChange:e=>v({selector:e}),includeLinked:d.includeLinked,onIncludeLinkedChange:e=>v({includeLinked:e}),clampToDeviceIds:null})]}),r(`section`,{className:`space-y-2`,children:[u(`h3`,{className:`text-[11px] font-semibold uppercase tracking-wide text-foreground-subtle`,children:d.mode===`role`?`3 · Result`:`2 · Result`}),u(Mr,{scopes:h,isAdmin:e.isAdmin,invalidReason:_})]})]}),r($e,{children:[u(G,{variant:`outline`,size:`sm`,onClick:t,children:`Cancel`}),u(G,{size:`sm`,onClick:()=>n([...h]),disabled:a||_!==null,children:a?u(C,{className:`h-3 w-3 animate-spin`}):`Save access`})]})]})})}n();var Ir=8;function Lr(){return{username:``,password:``,isAdmin:!1}}function Rr(e){return{id:e.id,username:e.username,password:``,isAdmin:e.isAdmin}}function zr(e){return e instanceof Error?e.message:`Something went wrong`}function Br(){let e=s(),{user:t}=dt(),{state:n,openNew:i,openEdit:a,close:l}=Ee(),[f,p]=c(null),[m,g]=c(null),[b,S]=c(!1),{data:w,isLoading:E,isError:D,error:O,refetch:k}=je(),j=q(),M=Le(),N=()=>e.invalidateQueries({queryKey:[[`userManagement`,`listUsers`]]}),P=ge(),F=pe({onSuccess:N}),I=de({onSuccess:N}),L=Fe({onSuccess:N}),R=Re({onSuccess:()=>{N(),B(null)}}),[z,B]=c(null),[V,te]=c(null),[re,ie]=c(null),[ae,oe]=c(null),H=w??[],U=n.mode===`edit`?H.find(e=>e.id===n.id)??null:null,se=()=>{p(null),g(null),S(!1),P.reset(),I.reset(),l()};d(()=>{if(n.mode===`closed`){p(null),g(null),S(!1);return}if(n.mode===`new`){p(e=>e!==null&&e.id===void 0?e:Lr());return}if(U===null){E||l();return}p(e=>e?.id===U.id?e:Rr(U))},[n,U,E,l]);let ce=n.mode===`new`&&f!==null&&f.id===void 0||n.mode===`edit`&&f!==null&&U!==null;async function le(e){await j({title:`Delete user`,message:`Permanently delete user "${e.username}"? This cannot be undone — any active sessions will be revoked on next request.`,confirmLabel:`Delete`,variant:`danger`})&&(F.mutate({id:e.id}),n.mode===`edit`&&n.id===e.id&&se())}async function W(e){let t=await M({title:`Reset password`,message:`Set a new password for "${e.username}".`,label:`New password`,inputType:`password`,placeholder:`At least 8 characters`,confirmLabel:`Continue`,validate:e=>e.length<Ir?`Password must be at least ${String(Ir)} characters.`:null});t===null||t.length===0||await j({title:`Reset password`,message:`Reset the password for "${e.username}"? They will need to use the new password on their next login.`,confirmLabel:`Reset`})&&L.mutate({id:e.id,newPassword:t})}function ue(e,t){t!==e.isAdmin&&I.mutate({id:e.id,isAdmin:t})}async function fe(){if(f!==null){g(null);try{if(f.id===void 0){let e=f.username.trim();if(e===``||f.password.length<Ir)return;await P.mutateAsync({username:e,password:f.password,isAdmin:f.isAdmin})}else await I.mutateAsync({id:f.id,isAdmin:f.isAdmin});N(),se()}catch(e){g(zr(e))}}}function me(e){return e?new Date(typeof e==`number`?e:String(e)).toLocaleDateString(`en-GB`,{day:`2-digit`,month:`short`,year:`numeric`}):`—`}let he=P.isPending||I.isPending,_e=f!==null&&f.id===void 0&&f.username.trim()!==``&&f.password.length>=Ir,ve=f!==null&&f.id!==void 0,ye=he||(f?.id===void 0?!_e:!ve),be=e=>F.isPending&&F.variables?.id===e.id||I.isPending&&I.variables?.id===e.id||L.isPending&&L.variables?.id===e.id;return r(yt,{embedded:!0,icon:x,title:`Users`,subtitle:`Hub accounts, admin flag, access scopes, sessions and sign-in links.`,actions:r(G,{size:`sm`,type:`button`,onClick:()=>{g(null),i()},children:[u(_,{className:`h-3.5 w-3.5`}),`Create User`]}),children:[D&&u(Oe,{title:`Could not load users`,message:zr(O),onRetry:()=>void k()}),E&&r(`div`,{className:`flex items-center gap-2 text-xs text-foreground-subtle`,children:[u(C,{className:`h-3.5 w-3.5 animate-spin`}),`Loading…`]}),!E&&!D&&H.length===0&&u(ze,{icon:x,title:`No users yet`,description:`Create a user to grant hub access.`}),!E&&!D&&H.length>0&&u(Ce,{columns:[{key:`username`,header:`Username`,sortValue:e=>e.username,render:e=>u(`span`,{className:`font-medium text-foreground`,"data-testid":`user-open-${e.id}`,children:e.username})},{key:`isAdmin`,header:`Admin`,nowrap:!0,sortValue:e=>+!!e.isAdmin,render:e=>u(`span`,{onClick:e=>e.stopPropagation(),children:r(`label`,{className:`inline-flex items-center gap-1.5 text-xs cursor-pointer`,children:[u(`input`,{type:`checkbox`,checked:e.isAdmin,onChange:t=>ue(e,t.target.checked),disabled:be(e),className:`rounded border-border focus:ring-primary disabled:opacity-50`}),u(`span`,{className:e.isAdmin?`text-primary font-medium`:`text-foreground-subtle`,children:e.isAdmin?`Admin`:`Regular`})]})})},{key:`scopes`,header:`Access`,render:e=>e.isAdmin?u(`span`,{className:`text-[10px] italic text-foreground-subtle`,children:`everything (admin)`}):u(`span`,{onClick:e=>e.stopPropagation(),children:r(G,{size:`sm`,variant:`ghost`,type:`button`,onClick:()=>B(e),title:`Configure access`,children:[u(A,{className:`h-3 w-3 shrink-0 text-foreground-subtle`}),u(Vr,{scopes:e.scopes??[]})]})})},{key:`createdAt`,header:`Created`,nowrap:!0,sortValue:e=>e.createdAt,render:e=>u(`span`,{className:`text-foreground-subtle`,children:me(e.createdAt)})},{key:`actions`,header:`Actions`,align:`right`,nowrap:!0,notSortableReason:`Row actions`,render:e=>{let n=be(e),i=e.id!==t?.id&&e.totpEnabled;return r(`div`,{className:`flex items-center justify-end gap-1`,onClick:e=>e.stopPropagation(),children:[r(G,{size:`sm`,variant:`ghost`,type:`button`,onClick:()=>a(e.id),disabled:n,title:`Edit user`,children:[u(v,{className:`h-3 w-3`}),`Edit`]}),i&&r(G,{size:`sm`,variant:`ghost`,type:`button`,onClick:()=>te(e),disabled:n,title:`Remove two-factor authentication`,children:[u(y,{className:`h-3 w-3`}),`Remove 2FA`]}),r(G,{size:`sm`,variant:`ghost`,type:`button`,onClick:()=>ie(e),disabled:n,title:`Linked sign-in accounts`,children:[u(T,{className:`h-3 w-3`}),`Sign-in links`]}),r(G,{size:`sm`,variant:`ghost`,type:`button`,onClick:()=>oe(e),disabled:n,title:`Active sessions`,children:[u(ne,{className:`h-3 w-3`}),`Sessions`]}),r(G,{size:`sm`,variant:`ghost`,type:`button`,onClick:()=>void W(e),disabled:n,title:`Reset password`,children:[u(ee,{className:`h-3 w-3`}),`Reset password`]}),r(G,{size:`sm`,variant:`ghost`,type:`button`,onClick:()=>void le(e),disabled:n,title:`Delete user`,className:`text-danger hover:bg-danger/10`,children:[n?u(C,{className:`h-3 w-3 animate-spin`}):u(h,{className:`h-3 w-3`}),`Delete`]})]})}}],rows:H,rowKey:e=>e.id,minWidthPx:560,maxBodyHeight:`max-h-[60vh]`,mobileMode:`scroll`,onRowClick:e=>a(e.id)}),u(it,{open:ce,onClose:se,title:f?.id===void 0?`Create User`:`Edit ${f.username||`user`}`,icon:x,error:m,testId:`user-form-dialog`,footer:u(G,{size:`sm`,type:`button`,disabled:ye,onClick:()=>void fe(),children:he?r(o,{children:[u(C,{className:`h-3.5 w-3.5 animate-spin`}),`Saving…`]}):f?.id===void 0?`Create`:`Save`}),children:f!==null&&r(`div`,{className:`space-y-3`,children:[u(xe,{label:`Username`,required:f.id===void 0,children:u(Ge,{value:f.username,onChange:e=>p({...f,username:e.target.value}),placeholder:`john`,autoFocus:f.id===void 0,disabled:f.id!==void 0,"data-testid":`user-form-username`})}),f.id===void 0&&u(xe,{label:`Password`,required:!0,description:`At least ${String(Ir)} characters.`,children:u(Te,{value:f.password,onValueChange:e=>p({...f,password:e}),shown:b,onToggleShown:()=>S(e=>!e),placeholder:`••••••••`,"data-testid":`user-form-password`})}),u(xe,{label:`Admin`,description:`Unrestricted access to every capability and device.`,children:r(`label`,{className:`inline-flex items-center gap-2 text-xs text-foreground cursor-pointer`,children:[u(`input`,{type:`checkbox`,checked:f.isAdmin,onChange:e=>p({...f,isAdmin:e.target.checked}),className:`rounded border-border focus:ring-primary`,"data-testid":`user-form-admin`}),u(`span`,{children:`Admin`})]})}),f.id!==void 0&&u(`p`,{className:`text-[11px] text-foreground-subtle`,children:`To change the password, use Reset password on the user's row. Access scopes are configured from the Access column.`})]})}),V&&u(kr,{userId:V.id,username:V.username,onClose:()=>te(null)}),re&&u(Or,{userId:re.id,username:re.username,onClose:()=>ie(null)}),ae&&u(Ar,{userId:ae.id,username:ae.username,onClose:()=>oe(null)}),z&&u(Hr,{user:z,onClose:()=>B(null),onSubmit:e=>R.mutate({userId:z.id,scopes:e}),submitting:R.isPending})]})}function Vr({scopes:e}){if(e.length===0)return u(`span`,{className:`font-medium text-warning`,children:`No access`});let t=H(e);return t===null?r(`span`,{className:`text-foreground-subtle`,children:[`Custom · `,e.length,` grant`,e.length===1?``:`s`]}):r(`span`,{className:`text-foreground-subtle`,children:[u(`span`,{className:`font-medium text-foreground`,children:U(t.roleId).label}),` ·`,` `,Ke(t.selector)]})}function Hr(e){let{user:t}=dt(),n=t?.isAdmin===!0;return u(Fr,{...e,callerScopes:n?null:t?.scopes??[]})}n();var Ur={"api-keys":$.tokens,"linked-sessions":$.linkedApps},Wr=`certificates`;function Gr(e){return r(G,{size:`sm`,type:`button`,"data-testid":`certificates-pair-device`,onClick:e,children:[u(y,{className:`h-3.5 w-3.5`,"aria-hidden":!0}),`Pair a device`]})}function Kr(){let{t:e}=st(),[t]=ut(),n=zn(),[r,i]=c(!1),a=Ur[t.get(`tab`)??``];if(a!==void 0)return u(pt,{to:gt(`access`,{integration:a}),replace:!0});let o=ct(`/system/identity`,{t:e,isAdmin:!0})??{icon:k,title:e(`system.identity`,`Identity & Access`)},s=t.get(`tab`)??`users`,l=t.get(`integration`),d=s===mt.access.tab?Rn(l,n.requestCreate):s===`certificates`?Gr(()=>i(!0)):void 0;return u(vt,{icon:o.icon,title:o.title,defaultSection:`users`,sectionsLabel:`${o.title} sections`,actions:d,sections:[{id:`users`,label:`Users`,content:u(Br,{})},{id:mt.access.tab,label:`Tokens & sessions`,content:u(Ln,{createRequested:n.createRequested,onCreateConsumed:n.clearCreate}),ownedParams:_t.concat([gn.token,gn.scoped,gn.admin])},{id:Wr,label:`Certificates`,content:u(Dr,{pairOpen:r,onPairClose:()=>i(!1)})},{id:mt.authentication.tab,label:`Authentication`,content:u(Qn,{}),ownedParams:_t}]})}export{Kr as IdentityPage};

package/dist/assets/MyAccess-DNUWFuuc.js

@@ -1,2 +0,0 @@
-const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["./browser-BHo8W_uH.js","./rolldown-runtime-Cyuzqnbw.js"])))=>i.map(i=>d[i]);
-import{a as e}from"./rolldown-runtime-Cyuzqnbw.js";import{t}from"./vite-preload-helper-kNaey6uv.js";import{K as n,Q as r,S as i,W as a,a as o,b as s,q as c,t as l,x as u,z as d}from"./_virtual_mf___mfe_internal__admin_ui_host__loadShare___mf_0_tanstack_mf_1_react_mf_2_query__loadShare__.js-DhP-Lgiq.js";import{Hi as f,Ir as p,It as m,Nt as h,Pn as g,Q as _,Qt as v,Yr as y,ar as b,cr as x,fi as S,nr as C,ot as w,pi as T,pr as E}from"./player-overlays-Bthpd_DK.js";import{o as D}from"./video-BYsOgJ3d.js";import{t as O}from"./key-round-ClhiHwZi.js";import{t as k}from"./monitor-smartphone-DFPo3Yqb.js";import{t as A}from"./unlink-BezflwNM.js";import{Kn as j,qn as ee}from"./client-CPAjuyjS.js";import{Bn as M,Cn as te,Do as ne,Ft as re,Gl as ie,Ht as N,Wn as ae,Z as oe,Zn as P,ar as se,gu as F,ko as ce,wn as le}from"./src-ASnW4RHZ.js";import{t as I}from"./useTranslation-Bc5yH9V9.js";import"./mount-BviOkzyX.js";import{R as L,i as R,n as ue,r as z,t as B}from"./index-D6a_-apt.js";import{t as V}from"./AdminPage-3IR6Hk67.js";import{I as H,L as U,S as de,b as fe,c as pe,i as me,m as W,n as he,o as G,r as ge,t as _e,v as ve,x as K}from"./SessionsList-BwcT1neM.js";r();function ye({value:n,size:r=192}){let[a,o]=c(null),[s,l]=c(null);if(d(()=>{let r=!1;return t(()=>import(`./browser-BHo8W_uH.js`).then(t=>e(t.default,1)).then(async e=>{if(r)return;let t=e.create;if(typeof t!=`function`){l(`qrcode.create() unavailable in installed version`);return}try{let e=t(n,{errorCorrectionLevel:`M`});r||o(e)}catch(e){r||l(e instanceof Error?e.message:`QR generation failed`)}}),__vite__mapDeps([0,1]),import.meta.url).catch(()=>{r||l(`qrcode library not installed`)}),()=>{r=!0}},[n]),s)return u(`div`,{className:`flex items-center justify-center text-[10px] text-foreground-subtle text-center p-4`,style:{width:r,height:r},children:`QR rendering unavailable — use the secret below.`});if(!a)return u(`div`,{className:`flex items-center justify-center text-[10px] text-foreground-subtle animate-pulse`,style:{width:r,height:r},children:`Generating…`});let f=a.modules.size,p=r/f,m=[];for(let e=0;e<f;e++)for(let t=0;t<f;t++)a.modules.data[e*f+t]&&m.push(u(`rect`,{x:t*p,y:e*p,width:p,height:p,fill:`currentColor`},`${t}-${e}`));return i(`svg`,{width:r,height:r,viewBox:`0 0 ${r} ${r}`,className:`text-black`,children:[u(`rect`,{x:0,y:0,width:r,height:r,fill:`white`}),m]})}var be=`${j}/connect`,q={public:0,mesh:1,lan:2,"lan-ipv6":3};function xe(e){switch(e.kind){case`public`:return e.interfaceKind===`vpn`?`mesh`:`public`;case`lan-ipv4`:return`lan`;case`lan-ipv6`:return`lan-ipv6`;case`custom`:return`public`;case`loopback`:case`app-link`:return null}}function J(e){return ee(e)}function Se(e){return e.startsWith(`https://`)}function Ce(e){let t=e.flatMap(e=>{let t=xe(e),n=J(e.baseUrl);return t===null||n===null?[]:[{endpoint:e,tier:t,origin:n}]}).toSorted((e,t)=>q[e.tier]-q[t.tier]||Number(t.endpoint.plausible)-Number(e.endpoint.plausible)||e.endpoint.priority-t.endpoint.priority),n=new Set;return t.flatMap(({endpoint:e,tier:t,origin:r})=>n.has(r)?[]:(n.add(r),[{origin:r,label:e.label,tier:t,secure:Se(r),plausible:e.plausible}]))}function we(e,t,n=null){for(let r of[t,n]){if(r===null)continue;let t=J(r),n=e.find(e=>e.origin===t);if(n!==void 0)return n}return e[0]??null}function Te(e){let t=new URL(be);return t.searchParams.set(`hub`,e),t.toString()}r();var Ee=176,Y={scheme:`https`};function De(){let{t:e}=I(),t=ce(Y),n=ne(Y).data?.roles.publicEndpoint.resolved??null;return i(`div`,{className:`rounded-lg border border-border bg-surface overflow-hidden`,children:[i(`div`,{className:`px-4 py-2.5 border-b border-border flex items-center gap-2`,children:[u(v,{className:`h-3.5 w-3.5 text-foreground-subtle`}),u(`div`,{className:`text-xs font-semibold text-foreground`,children:e(`connectPhone.title`)})]}),i(`div`,{className:`p-4 space-y-3`,children:[u(`p`,{className:`text-[11px] text-foreground-subtle`,children:e(`connectPhone.description`)}),t.isPending?i(`div`,{className:`flex items-center gap-2 text-[11px] text-foreground-subtle`,children:[u(b,{className:`h-3.5 w-3.5 animate-spin`}),e(`connectPhone.loading`)]}):t.isError?i(`div`,{className:`flex items-start gap-2 text-[11px] text-danger`,children:[u(h,{className:`h-3.5 w-3.5 mt-0.5 shrink-0`}),i(`div`,{className:`flex-1 min-w-0 space-y-1.5`,children:[u(`div`,{className:`break-words`,children:e(`connectPhone.error`,{message:t.error.message})}),u(M,{size:`sm`,variant:`ghost`,onClick:()=>void t.refetch(),children:e(`connectPhone.retry`)})]})]}):u(Oe,{candidates:Ce(t.data.endpoints),preferredOrigin:n})]})]})}function Oe({candidates:e,preferredOrigin:t}){let{t:n}=I(),[r,o]=c(null),s=we(e,r,t),l=a(()=>s?Te(s.origin):null,[s]);if(s===null||l===null)return u(`p`,{className:`text-[11px] text-foreground-subtle`,children:n(`connectPhone.empty`)});let d=e=>n(`connectPhone.tier.${e}`),f=e.map(e=>({value:e.origin,label:`${d(e.tier)} — ${e.origin}`}));return i(`div`,{className:`flex flex-col sm:flex-row gap-4`,children:[u(te,{value:l,size:Ee,alt:n(`connectPhone.qrAlt`),className:`self-start`}),i(`div`,{className:`flex-1 min-w-0 space-y-3`,children:[i(`label`,{className:`block space-y-1`,children:[u(`span`,{className:`text-[11px] font-medium text-foreground`,children:n(`connectPhone.addressLabel`)}),u(ie,{value:s.origin,options:f,onChange:e=>o(e.target.value)}),i(`span`,{className:`block text-[10px] text-foreground-subtle`,children:[d(s.tier),` · `,s.label]})]}),!s.secure&&u(X,{text:n(`connectPhone.insecure`)}),!s.plausible&&u(X,{text:n(`connectPhone.implausible`)}),i(`div`,{className:`space-y-1`,children:[u(`span`,{className:`text-[11px] font-medium text-foreground`,children:n(`connectPhone.linkLabel`)}),i(`div`,{className:`flex items-center gap-1 rounded-md border border-border bg-background px-2 py-1`,children:[u(`code`,{className:`flex-1 min-w-0 font-mono text-[11px] text-foreground break-all select-all`,children:l}),u(re,{value:l,srLabel:n(`connectPhone.linkLabel`)})]})]}),u(`p`,{className:`text-[11px] text-foreground-subtle`,children:n(`connectPhone.signInHint`)})]})]})}function X({text:e}){return i(`div`,{className:`flex items-start gap-2 rounded-md border border-warning/30 bg-warning/5 px-2.5 py-1.5 text-[11px] text-foreground`,children:[u(h,{className:`h-3.5 w-3.5 text-warning mt-0.5 shrink-0`}),u(`span`,{children:e})]})}r();function ke(e){return new Date(e).toLocaleDateString()}function Z(){let e=P(),t=F.useUtils(),r=F.auth.listLinkableProviders.useQuery(),a=F.auth.listOwnExternalIdentities.useQuery(),[o,s]=c(null),[l,f]=c(()=>R(window.location.search)),p=n(null),m=K(`Linking a sign-in account`),h=n(null);d(()=>()=>h.current?.(),[]);let[g,v]=c(null);d(()=>{if(l===null)return;let e=new URL(window.location.href);e.searchParams.delete(`linked`),e.searchParams.delete(`linkError`),window.history.replaceState({},``,e.pathname+e.search+e.hash)},[l]);let y=F.auth.beginExternalLink.useMutation({onSuccess:({url:e})=>{let n=p.current;if(p.current=null,n===null||n.closed){window.location.assign(e);return}let r=e=>{v(null),f(R(`?${e}`)),t.auth.listOwnExternalIdentities.invalidate()};h.current?.(),h.current=ue(n,{onReturn:e=>{e.target===`profile`&&r(e.query)},onDone:e=>{e.target===`profile`&&r(e.query)},onClosed:()=>{h.current?.(),h.current=null,t.auth.listOwnExternalIdentities.invalidate()}}),n.location.href=_(z(e))},onError:e=>{p.current?.close(),p.current=null,v(null),s(e.message)}}),C=F.auth.unlinkOwnExternalIdentity.useMutation({onSuccess:()=>void t.auth.listOwnExternalIdentities.invalidate(),onError:e=>s(e.message)}),w=r.data??[],E=a.data??[],D=g!==null&&E.some(e=>e.provider===g);if(d(()=>{!D||g===null||(v(null),f({kind:`linked`,provider:g}))},[D,g]),w.length===0&&E.length===0)return null;let O=new Set(E.map(e=>e.provider)),k=e=>w.find(t=>t.provider===e)?.label??e,j=async(t,n)=>{await e({title:`Unlink sign-in account`,message:`Stop signing in with this ${n} account?`,confirmLabel:`Unlink`,variant:`danger`})&&(s(null),C.mutate({provider:t.provider,subject:t.subject}))};return i(`div`,{"data-testid":`linked-sign-ins`,className:`rounded-lg border border-border bg-surface overflow-hidden`,children:[m.dialog,i(`div`,{className:`px-4 py-2.5 border-b border-border flex items-center gap-2`,children:[u(x,{className:`h-3.5 w-3.5 text-foreground-subtle`}),u(`div`,{className:`text-xs font-semibold text-foreground`,children:`Linked sign-in accounts`})]}),i(`div`,{className:`p-4 space-y-3`,children:[u(`p`,{className:`text-[11px] text-foreground-subtle`,children:`Sign in with an external account instead of your password. Only accounts you link here can sign you in; your two-factor authentication still applies.`}),l?.kind===`linked`&&i(`div`,{className:`flex items-center gap-2 rounded-md border border-emerald-500/30 bg-emerald-500/5 px-3 py-2 text-xs text-foreground`,children:[u(S,{className:`h-3.5 w-3.5 text-emerald-500 shrink-0`}),`Linked your `,k(l.provider),` account.`]}),(l?.kind===`error`||o)&&i(`div`,{className:`flex items-center gap-2 rounded-md border border-danger/20 bg-danger/10 px-3 py-2 text-xs text-danger`,children:[u(T,{className:`h-3.5 w-3.5 shrink-0`}),o??(l?.kind===`error`?l.message:``)]}),E.length>0&&u(`ul`,{className:`divide-y divide-border rounded-md border border-border`,children:E.map(e=>{let t=e.providerLabel??e.provider;return i(`li`,{className:`flex items-center gap-3 px-3 py-2 text-xs`,children:[i(`div`,{className:`flex-1 min-w-0`,children:[i(`div`,{className:`font-medium text-foreground truncate`,children:[t,!e.available&&u(`span`,{className:`ml-2 rounded bg-foreground-subtle/15 px-1.5 py-0.5 text-[10px] font-normal text-foreground-subtle`,children:`provider unavailable`})]}),i(`div`,{className:`text-[11px] text-foreground-subtle truncate`,children:[e.label??e.subject,` · linked `,ke(e.linkedAt)]})]}),i(`button`,{onClick:()=>void j(e,t),disabled:C.isPending,className:`inline-flex items-center gap-1 rounded px-2 py-1 text-[10px] text-danger hover:bg-danger/10 disabled:opacity-50`,children:[u(A,{className:`h-3 w-3`}),`Unlink`]})]},`${e.provider}|${e.subject}`)})}),u(`div`,{className:`flex flex-wrap gap-2`,children:w.filter(e=>!O.has(e.provider)).map(e=>i(`button`,{onClick:()=>{s(null),f(null),m.requestProof().then(t=>{t!==null&&(p.current=B(null),v(p.current===null?null:e.provider),y.mutate({provider:e.provider,reauthToken:t}))})},disabled:y.isPending,className:`inline-flex items-center gap-1.5 rounded border border-border px-2.5 py-1 text-[11px] font-medium text-foreground hover:bg-surface-hover disabled:opacity-50`,children:[y.isPending&&y.variables?.provider===e.provider?u(b,{className:`h-3 w-3 animate-spin`}):u(x,{className:`h-3 w-3`}),`Link `,e.label]},e.provider))})]})]})}r();function Q(e){return e.message.length>0?e.message:`Request failed`}function Ae(){let{logout:e}=L(),t=P(),n=F.useUtils(),r=F.auth.listOwnSessions.useQuery(),[a,o]=c(null),s=F.auth.revokeOwnSession.useMutation({onSuccess:()=>void n.auth.listOwnSessions.invalidate(),onError:e=>o(`Sign out failed: ${Q(e)}`)}),l=F.auth.logout.useMutation({onSuccess:()=>e(),onError:e=>o(`Sign out failed: ${Q(e)}`)}),d=async e=>{await t({title:`Sign out this session`,message:`${de(e.client).label} will have to sign in again.`,confirmLabel:`Sign out`,variant:`danger`})&&(o(null),s.mutate({id:e.id}))},f=async()=>{await t({title:`Sign out everywhere`,message:`Every session of your account ends, this browser included: you will be signed out here too and every device has to sign in again.`,confirmLabel:`Sign out everywhere`,variant:`danger`})&&(o(null),l.mutate({everywhere:!0}))};return i(`div`,{"data-testid":`my-sessions`,className:`rounded-lg border border-border bg-surface overflow-hidden`,children:[i(`div`,{className:`px-4 py-2.5 border-b border-border flex items-center gap-2`,children:[u(k,{className:`h-3.5 w-3.5 text-foreground-subtle`}),u(`div`,{className:`text-xs font-semibold text-foreground`,children:`Active sessions`})]}),i(`div`,{className:`p-4 space-y-3`,children:[u(`p`,{className:`text-[11px] text-foreground-subtle`,children:`The browsers and apps signed in to your account. Signing one out ends it at once.`}),a!==null&&u(`div`,{className:`text-[11px] text-danger`,children:a}),u(_e,{sessions:r.data??[],isLoading:r.isLoading,loadError:r.isError?r.error?.message??`Request failed`:null,emptyText:`No active sessions.`,onRevoke:e=>void d(e),revokingId:s.isPending?s.variables?.id??null:null}),u(`div`,{className:`flex justify-end`,children:i(`button`,{onClick:()=>void f(),disabled:l.isPending,className:`inline-flex items-center gap-1.5 rounded border border-danger/40 px-2.5 py-1 text-[11px] font-medium text-danger hover:bg-danger/10 disabled:opacity-50`,children:[l.isPending?u(b,{className:`h-3 w-3 animate-spin`}):u(D,{className:`h-3 w-3`}),`Sign out everywhere`]})})]})]})}r();function je(){let e=P(),t=F.useUtils(),n=F.auth.listOwnDeviceCredentials.useQuery(),[r,a]=c(null),o=F.auth.revokeOwnDeviceCredential.useMutation({onSuccess:e=>{e.revoked||a(`That device could not be revoked - it may already be gone.`),t.auth.listOwnDeviceCredentials.invalidate()},onError:e=>a(`Revoke failed: ${e.message}`)}),s=async t=>{await e({title:`Revoke this device`,message:`${t.deviceName} stops signing in at once and its open sessions end. To use it again you have to pair it anew.`,confirmLabel:`Revoke`,variant:`danger`})&&(a(null),o.mutate({id:t.id}))},l=o.isPending?o.variables?.id??null:null;return u(H,{id:`my-devices`,title:`My devices`,icon:v,description:`Phones that stay signed in to your account with a certificate. If one is lost, revoke it here and it is signed out at once.`,notice:U(r),onDismissNotice:()=>a(null),children:u(ve,{isPending:n.isPending,error:n.error,what:`your devices`,onRetry:()=>void n.refetch(),children:u(N,{columns:[{key:`device`,header:`Device`,sortValue:e=>e.deviceName.toLowerCase(),render:e=>u(`span`,{className:`font-medium text-foreground`,title:e.deviceName,children:e.deviceName})},{key:`platform`,header:`Platform`,sortValue:e=>G[e.platform],render:e=>G[e.platform]},{key:`issued`,header:`Issued`,sortValue:e=>e.issuedAt,render:e=>W(e.issuedAt)},{key:`lastUsed`,header:`Last used`,sortValue:e=>e.lastUsedAt,render:e=>e.lastUsedAt===null?u(`span`,{className:`text-foreground-subtle`,children:`Never`}):W(e.lastUsedAt)},{key:`status`,header:`Status`,sortValue:e=>ge[e.status],render:e=>u(se,{variant:me[e.status],className:`text-[10px]`,children:he[e.status]})},{key:`actions`,header:`Actions`,align:`right`,notSortableReason:`Actions have no order.`,render:e=>pe(e)?i(M,{type:`button`,variant:`ghost`,size:`sm`,className:`text-danger hover:bg-danger/10`,disabled:o.isPending,"aria-label":`Revoke ${e.deviceName}`,onClick:()=>void s(e),children:[l===e.id?u(b,{className:`h-3 w-3 animate-spin`,"aria-hidden":!0}):u(f,{className:`h-3 w-3`,"aria-hidden":!0}),`Revoke`]}):null}],rows:n.data??[],rowKey:e=>e.id,minWidthPx:640,mobileMode:`auto`,defaultSort:{columnKey:`status`,dir:`asc`},emptyMessage:`No devices are signed in with a certificate.`})})})}r();var Me={view:{icon:p,cls:`bg-foreground-subtle/15 text-foreground-subtle`},create:{icon:g,cls:`bg-primary/15 text-primary`},delete:{icon:m,cls:`bg-danger/15 text-danger`}};function Ne(){let{user:e,logout:t}=L();if(!e)return u(V,{children:u(`div`,{className:`text-xs text-foreground-subtle`,children:`Not signed in.`})});let n=e.isAdmin,r=e.scopes??[];return i(V,{children:[i(`div`,{className:`rounded-lg border border-border bg-surface px-4 py-3 flex items-center gap-3`,children:[u(`div`,{className:`flex h-10 w-10 items-center justify-center rounded-full bg-primary/10 text-primary font-semibold text-base`,children:e.username.slice(0,1).toUpperCase()}),i(`div`,{className:`flex-1 min-w-0`,children:[u(`div`,{className:`text-sm font-semibold text-foreground truncate`,children:e.username}),i(`div`,{className:`text-[11px] text-foreground-subtle`,children:[n?`Administrator`:`User`,` · session id`,` `,i(`span`,{className:`font-mono`,children:[e.id.slice(0,8),`…`]})]})]})]}),n&&i(`div`,{className:`rounded-lg border border-primary/30 bg-primary/5 px-4 py-3 text-xs text-foreground flex items-start gap-2.5`,children:[u(E,{className:`h-4 w-4 text-primary mt-0.5 shrink-0`}),i(`div`,{children:[u(`div`,{className:`font-semibold text-foreground`,children:`Unrestricted access`}),u(`p`,{className:`text-foreground-subtle mt-0.5`,children:`Admin sessions bypass the per-call scope check. Every protected endpoint is reachable regardless of the list below.`})]})]}),u(Pe,{}),u(Fe,{username:e.username}),u(Ie,{}),u(Z,{}),u(fe,{}),u(Ae,{}),u(je,{}),u(De,{}),r.length>0&&i(`div`,{className:`rounded-lg border border-border bg-surface overflow-hidden`,children:[i(`div`,{className:`px-4 py-2 border-b border-border`,children:[u(`div`,{className:`text-xs font-semibold text-foreground`,children:`Granted scopes`}),u(`div`,{className:`text-[10px] text-foreground-subtle`,children:`Baked into your session token at login; sign out + back in to refresh after changes.`})]}),i(`div`,{className:`grid grid-cols-[100px_1fr_240px] gap-3 px-4 py-2 text-[10px] uppercase tracking-wide text-foreground-subtle border-b border-border`,children:[u(`div`,{children:`Type`}),u(`div`,{children:`Target`}),u(`div`,{children:`Access`})]}),u(`ul`,{className:`divide-y divide-border`,children:r.map((e,t)=>i(`li`,{className:`grid grid-cols-[100px_1fr_240px] gap-3 px-4 py-2.5 items-center text-xs`,children:[u(`span`,{className:`font-mono text-foreground-subtle`,children:e.type}),u(`span`,{className:`font-mono text-foreground`,children:e.type===`device`?oe(e.selector):e.target}),u(`div`,{className:`flex items-center gap-1`,children:[`view`,`create`,`delete`].map(t=>{let n=e.access.includes(t),{icon:r,cls:a}=Me[t];return i(`span`,{className:`inline-flex items-center gap-1 rounded px-1.5 py-0.5 text-[10px] font-medium ${n?a:`bg-transparent text-foreground-subtle/40 line-through`}`,title:n?`Can ${t}`:`Cannot ${t}`,children:[u(r,{className:`h-3 w-3`}),t]},t)})})]},t))})]}),u(`div`,{className:`flex justify-end`,children:i(`button`,{onClick:t,className:`inline-flex items-center gap-1.5 rounded border border-border px-2.5 py-1 text-[11px] font-medium text-foreground-subtle hover:bg-foreground-subtle/10 hover:text-foreground transition-colors`,children:[u(D,{className:`h-3 w-3`}),`Sign out`]})})]})}function Pe(){let e=w(),[t,n]=c(``),[r,a]=c(``),[o,s]=c(``),[d,f]=c(null),p=l({mutationFn:t=>e.changeOwnPassword(t),onSuccess:()=>{f({kind:`success`,msg:`Password updated.`}),n(``),a(``),s(``)},onError:e=>{f({kind:`error`,msg:e instanceof Error?e.message:`Update failed`})}}),m=r.length>0&&o.length>0&&r!==o,h=r.length>0&&r.length<8,g=t.length>=1&&r.length>=8&&r===o;return i(`div`,{className:`rounded-lg border border-border bg-surface overflow-hidden`,children:[i(`div`,{className:`px-4 py-2.5 border-b border-border flex items-center gap-2`,children:[u(O,{className:`h-3.5 w-3.5 text-foreground-subtle`}),u(`div`,{className:`text-xs font-semibold text-foreground`,children:`Change password`})]}),i(`div`,{className:`p-4 space-y-3`,children:[u($,{label:`Current password`,value:t,onChange:n,autoComplete:`current-password`}),u($,{label:`New password`,value:r,onChange:a,autoComplete:`new-password`,hint:`At least 8 characters.`}),u($,{label:`Confirm new password`,value:o,onChange:s,autoComplete:`new-password`}),(m||h)&&u(`div`,{className:`text-[11px] text-danger`,children:m?`Passwords do not match.`:`New password must be at least 8 characters.`}),d&&i(`div`,{className:`text-[11px] flex items-center gap-1 ${d.kind===`success`?`text-emerald-500`:`text-danger`}`,children:[d.kind===`success`?u(S,{className:`h-3 w-3`}):u(T,{className:`h-3 w-3`}),d.msg]}),u(`div`,{className:`flex justify-end`,children:i(`button`,{onClick:()=>{f(null),p.mutate({currentPassword:t,newPassword:r})},disabled:!g||p.isPending,className:`inline-flex items-center gap-1 rounded bg-primary px-3 py-1.5 text-xs font-medium text-primary-foreground hover:bg-primary/90 disabled:opacity-50`,children:[p.isPending?u(b,{className:`h-3 w-3 animate-spin`}):u(C,{className:`h-3 w-3`}),`Update password`]})})]})]})}function $({label:e,value:t,onChange:n,autoComplete:r,hint:a}){return i(`div`,{className:`space-y-1`,children:[u(`label`,{className:`text-[10px] uppercase tracking-wide text-foreground-subtle`,children:e}),u(`input`,{type:`password`,value:t,onChange:e=>n(e.target.value),autoComplete:r,className:`w-full rounded border border-border bg-background px-2 py-1.5 text-xs text-foreground focus:outline-none focus:ring-1 focus:ring-primary`}),a&&u(`div`,{className:`text-[10px] text-foreground-subtle`,children:a})]})}function Fe({username:e}){let t=w(),n=o({queryKey:[`auth`,`getOwnTotpStatus`],queryFn:()=>t.getOwnTotpStatus()}),r=n.data,[f,p]=c(null),[m,h]=c(``),[g,_]=c(null),[x,C]=c(!1),E=l({mutationFn:()=>t.setupOwnTotp(),onSuccess:e=>{p({secret:e.secret,otpauthUrl:e.otpauthUrl}),h(``),_(null)},onError:e=>_(e instanceof Error?e.message:`Setup failed`)}),D=l({mutationFn:e=>t.confirmOwnTotp(e),onSuccess:()=>{p(null),h(``),_(null),n.refetch()},onError:e=>_(e instanceof Error?e.message:`Confirmation failed — code did not match`)}),O=K(`Turning off two-factor authentication`),k=l({mutationFn:async()=>{let e=await O.requestProof();return e===null?null:t.disableOwnTotp({reauthToken:e})},onSuccess:()=>{_(null),n.refetch()},onError:e=>_(e instanceof Error?e.message:`Disable failed`)});d(()=>{if(!x)return;let e=setTimeout(()=>C(!1),1500);return()=>clearTimeout(e)},[x]);let A=a(()=>n.isLoading?`loading`:f?`setup_in_progress`:r?.enabled?`enrolled`:`not_enrolled`,[n.isLoading,r?.enabled,f]);return i(`div`,{className:`rounded-lg border border-border bg-surface overflow-hidden`,children:[O.dialog,i(`div`,{className:`px-4 py-2.5 border-b border-border flex items-center gap-2`,children:[u(v,{className:`h-3.5 w-3.5 text-foreground-subtle`}),u(`div`,{className:`text-xs font-semibold text-foreground`,children:`Two-factor authentication`})]}),i(`div`,{className:`p-4 space-y-3`,children:[A===`loading`&&i(`div`,{className:`flex items-center gap-2 text-xs text-foreground-subtle`,children:[u(b,{className:`h-3.5 w-3.5 animate-spin`}),`Checking status…`]}),A===`not_enrolled`&&i(s,{children:[u(`div`,{className:`text-xs text-foreground-subtle`,children:`2FA isn't active on your account. Enable it to require a 6-digit code from your authenticator app at every login.`}),u(`div`,{className:`flex justify-end`,children:i(`button`,{onClick:()=>{_(null),E.mutate()},disabled:E.isPending,className:`inline-flex items-center gap-1 rounded bg-primary px-3 py-1.5 text-xs font-medium text-primary-foreground hover:bg-primary/90 disabled:opacity-50`,children:[E.isPending?u(b,{className:`h-3 w-3 animate-spin`}):u(v,{className:`h-3 w-3`}),`Enable 2FA`]})})]}),A===`setup_in_progress`&&f&&i(s,{children:[i(`div`,{className:`text-[11px] text-foreground-subtle`,children:[`Scan the QR code (or enter the secret manually) into your authenticator app for`,` `,u(`span`,{className:`font-mono`,children:e}),`, then enter the 6-digit code below to confirm.`]}),i(`div`,{className:`flex flex-col items-center gap-3`,children:[u(`div`,{className:`rounded-lg border border-border bg-white p-3`,children:u(ye,{value:f.otpauthUrl,size:180})}),i(`div`,{className:`w-full`,children:[u(`div`,{className:`text-[10px] uppercase tracking-wide text-foreground-subtle mb-1`,children:`Secret (manual entry)`}),i(`div`,{className:`flex items-center gap-2 rounded border border-border bg-surface-hover/30 px-2 py-1.5`,children:[u(`code`,{className:`text-[11px] font-mono text-foreground break-all flex-1`,children:f.secret}),i(`button`,{onClick:()=>{f&&navigator.clipboard.writeText(f.secret).then(()=>C(!0))},className:`inline-flex items-center gap-1 text-[10px] text-foreground-subtle hover:text-foreground`,children:[x?u(S,{className:`h-3 w-3 text-emerald-500`}):u(y,{className:`h-3 w-3`}),x?`Copied`:`Copy`]})]})]})]}),i(`div`,{className:`space-y-1`,children:[u(`label`,{className:`text-[10px] uppercase tracking-wide text-foreground-subtle`,children:`6-digit code`}),u(`input`,{type:`text`,inputMode:`numeric`,autoComplete:`one-time-code`,placeholder:`123456`,value:m,onChange:e=>h(e.target.value.replace(/\D/g,``).slice(0,6)),className:`w-full rounded-md border border-border bg-surface px-3 py-2 text-center text-lg font-mono tracking-widest text-foreground focus:outline-none focus:ring-2 focus:ring-primary`})]}),g&&i(`div`,{className:`text-[11px] text-danger flex items-center gap-1`,children:[u(T,{className:`h-3 w-3`}),g]}),i(`div`,{className:`flex justify-end gap-2`,children:[u(`button`,{onClick:()=>{p(null),_(null),h(``)},className:`rounded px-3 py-1.5 text-xs text-foreground-subtle border border-border hover:text-foreground`,children:`Cancel`}),i(`button`,{onClick:()=>{_(null),D.mutate({code:m})},disabled:D.isPending||m.length!==6,className:`inline-flex items-center gap-1 rounded bg-primary px-3 py-1.5 text-xs font-medium text-primary-foreground hover:bg-primary/90 disabled:opacity-50`,children:[D.isPending?u(b,{className:`h-3 w-3 animate-spin`}):u(S,{className:`h-3 w-3`}),`Confirm`]})]})]}),A===`enrolled`&&r&&i(s,{children:[i(`div`,{className:`rounded-md border border-emerald-500/30 bg-emerald-500/5 px-3 py-2.5 flex items-start gap-2.5`,children:[u(S,{className:`h-4 w-4 mt-0.5 text-emerald-500 shrink-0`}),i(`div`,{className:`text-xs text-foreground space-y-0.5`,children:[u(`div`,{className:`font-medium`,children:`2FA is active`}),i(`div`,{className:`text-foreground-subtle`,children:[`Enrolled on`,` `,r.confirmedAt?new Date(r.confirmedAt).toLocaleString():`—`]})]})]}),g&&i(`div`,{className:`text-[11px] text-danger flex items-center gap-1`,children:[u(T,{className:`h-3 w-3`}),g]}),u(`div`,{className:`flex justify-end`,children:i(`button`,{onClick:()=>{_(null),k.mutate()},disabled:k.isPending,className:`rounded bg-danger px-3 py-1.5 text-xs font-medium text-white hover:bg-danger/90 disabled:opacity-50 inline-flex items-center gap-1`,children:[k.isPending?u(b,{className:`h-3 w-3 animate-spin`}):u(v,{className:`h-3 w-3`}),`Disable 2FA`]})})]})]})]})}function Ie(){return ae(`auth-webauthn/passkey-enrollment`)?u(le,{widgetId:`auth-webauthn/passkey-enrollment`,host:`dashboard`}):null}export{Ne as MyAccessPage};

package/dist/assets/Network-CON3pH6E.js

@@ -1 +0,0 @@
-import{I as e,K as t,Q as n,S as r,W as i,b as a,o,q as s,x as c,z as l}from"./_virtual_mf___mfe_internal__admin_ui_host__loadShare___mf_0_tanstack_mf_1_react_mf_2_query__loadShare__.js-DhP-Lgiq.js";import{D as u,It as d,Jt as f,L as p,Nt as m,On as h,Rn as g,Rr as _,Xt as v,Yr as y,Z as b,an as x,ar as S,bi as C,dt as w,ht as T,in as E,kn as ee,mn as te,nr as ne,ot as re,un as D,vn as ie,yn as ae}from"./player-overlays-Bthpd_DK.js";import{t as O}from"./boxes-1pLz5hUM.js";import{c as k,o as oe}from"./video-BYsOgJ3d.js";import{t as se}from"./file-up-_ULNp_05.js";import{t as ce}from"./log-in-BdBi9Cme.js";import{Gn as le,Hn as ue,Wn as de,gn as fe}from"./client-CPAjuyjS.js";import{Ao as pe,Bn as A,Bo as me,Bt as he,Do as ge,Dr as j,Eo as _e,Er as M,Fo as ve,Gl as ye,Ho as be,Ht as xe,Io as Se,It as Ce,Jo as we,Ko as Te,Ln as N,Lo as Ee,Mo as De,No as Oe,Oo as ke,Pn as Ae,Po as je,Ro as Me,Rt as Ne,Uo as Pe,Vo as Fe,Vt as P,Xl as Ie,an as Le,ar as F,jo as Re,ma as ze,qo as Be,wl as Ve,zo as He}from"./src-ASnW4RHZ.js";import{t as Ue}from"./useTranslation-Bc5yH9V9.js";import"./mount-BviOkzyX.js";import{C as We,c as I,s as L}from"./index-D6a_-apt.js";import{t as Ge}from"./AdminSectionedPage-4SkTwpI5.js";import{t as R}from"./AdminPage-3IR6Hk67.js";import{t as Ke}from"./NodeAddonsSettingsPanel-BJZk7zTu.js";import{n as z,r as qe,t as B}from"./IntegrationHub-DA5-5WRz.js";import{n as V,t as H}from"./addon-display-names-BkwMrExv.js";n();var U=5e3,W=`network-access`,Je={connected:!1,endpoint:null};function Ye(){let e=o(),t=j({capName:`network-access`},{refetchInterval:U}),n=M(void 0,{refetchInterval:U}),r=i(()=>H(n.data??[]),[n.data]),a=i(()=>(t.data??[]).map(e=>({addonId:e.addonId,displayName:r.get(e.addonId)??e.addonId,isActive:e.isActive})),[t.data,r]),[l,u]=s(null),[d,f]=s({}),p=(t,n)=>{let r=n?.addonId;e.invalidateQueries({queryKey:[[`networkAccess`,`getStatus`],{input:{addonId:r},type:`query`}]}),u(null),f(e=>{if(r===void 0||!(r in e))return e;let t={...e};return delete t[r],t})},m=(e,t)=>{u(null);let n=t?.addonId;if(n===void 0)return;let r=e instanceof Error?e.message:String(e);f(e=>({...e,[n]:r}))},h=Be({onSuccess:p,onError:m}),g=we({onSuccess:p,onError:m});return c(B,{embedded:!0,icon:k,title:`Remote Access`,subtitle:`Public-facing tunnels that expose this hub to the internet (Cloudflare Tunnel, ngrok, …).`,groups:[{id:W,label:`Remote access`,install:{capability:W,label:`Add tunnel`},entries:a.map(e=>({id:e.addonId,name:e.displayName,fallbackIcon:k,...V(e.isActive),render:()=>c(z,{addonId:e.addonId,displayName:e.displayName,capName:W,isActive:e.isActive,badges:c(Ze,{addonId:e.addonId}),error:d[e.addonId]??null,primaryAction:c(Qe,{addonId:e.addonId,busyId:l,onStart:e=>{u(e),h.mutate({addonId:e})},onStop:e=>{u(e),g.mutate({addonId:e})}})})}))}],isLoading:t.isLoading,emptyTitle:`No remote-access providers installed`,emptyDescription:`Install a tunnel addon (e.g. @camstack/addon-cloudflare) to expose this hub publicly.`})}function Xe(e){let{data:t}=Te({addonId:e},{refetchInterval:U,retry:!1}),n=t?ue.safeParse(t):null;return n?.success?n.data:Je}function Ze({addonId:e}){let t=Xe(e);return r(a,{children:[c(F,{variant:t.connected?`success`:`default`,className:qe,children:t.connected?`Connected`:`Disconnected`}),t.endpoint&&r(`a`,{href:t.endpoint.url,target:`_blank`,rel:`noopener noreferrer`,className:`flex min-w-0 items-center gap-1 break-all text-[11px] text-success hover:underline`,children:[c(_,{className:`h-3 w-3`}),t.endpoint.url]})]})}function Qe({addonId:e,busyId:t,onStart:n,onStop:i}){let a=Xe(e),o=t===e;return a.connected?r(A,{size:`sm`,variant:`secondary`,disabled:o,onClick:()=>i(e),children:[o?c(S,{className:`h-3 w-3 animate-spin`}):c(f,{className:`h-3 w-3`}),`Stop`]}):r(A,{size:`sm`,variant:`primary`,disabled:o,onClick:()=>n(e),children:[o?c(S,{className:`h-3 w-3 animate-spin`}):c(ee,{className:`h-3 w-3`}),`Start`]})}n();var $e=3e4,G=`turn-provider`;function et(e){let t=[];for(let n of e)typeof n.urls==`string`?t.push(n.urls):t.push(...n.urls);return t}function tt(){let e=j({capName:`turn-provider`},{refetchInterval:$e}),t=M(void 0,{refetchInterval:$e}),n=Ve(),a=n.data??[],o=i(()=>H(t.data??[]),[t.data]),s=i(()=>(e.data??[]).map(e=>({addonId:e.addonId,displayName:o.get(e.addonId)??e.addonId,isActive:e.isActive})),[e.data,o]);return c(B,{embedded:!0,icon:g,title:`TURN Servers`,subtitle:`ICE servers used for WebRTC NAT traversal. Multiple providers can coexist — the WebRTC layer concatenates servers from all enabled providers per session.`,groups:[{id:G,label:`TURN providers`,install:{capability:G,label:`Add provider`},entries:s.map(e=>({id:e.addonId,name:e.displayName,fallbackIcon:g,...V(e.isActive),render:()=>c(z,{addonId:e.addonId,displayName:e.displayName,capName:G,isActive:e.isActive,panels:[{id:`ice-servers`,title:`Discovered ICE servers`,icon:g,content:c(nt,{addonId:e.addonId,enabled:e.isActive})}]})}))}],isLoading:e.isLoading,emptyTitle:`No TURN providers installed`,emptyDescription:`Install a TURN addon (e.g. @camstack/addon-cloudflare) to enable WebRTC behind restrictive NATs.`,trailing:c(P,{headingId:`turn-combined-ice`,title:`Combined ICE server list — all enabled providers`,icon:g,actions:c(A,{size:`sm`,variant:`secondary`,onClick:()=>n.refetch(),disabled:n.isFetching,children:`Refresh`}),children:c(`div`,{className:u,children:a.length===0?c(`div`,{className:`text-xs text-foreground-subtle`,children:`No servers from enabled providers.`}):c(`div`,{className:`flex flex-col gap-3`,children:a.map((e,t)=>{let n=Array.isArray(e.urls)?e.urls:[e.urls];return r(`div`,{className:`rounded border border-border bg-surface`,children:[(e.username||e.credential)&&r(`div`,{className:`px-3 py-1.5 border-b border-border text-[10px] font-mono text-foreground-subtle flex items-center gap-3`,children:[e.username&&r(`span`,{children:[c(`span`,{className:`text-foreground-subtle`,children:`user:`}),` `,c(`span`,{className:`text-foreground`,children:e.username})]}),e.credential&&r(`span`,{children:[c(`span`,{className:`text-foreground-subtle`,children:`credential:`}),` `,c(`span`,{className:`text-foreground`,children:`••••••••`})]})]}),c(`ul`,{className:`divide-y divide-border`,children:n.map(e=>c(`li`,{className:`px-3 py-1.5 font-mono text-xs text-foreground break-all`,children:e},e))})]},t)})})})})})}function nt({addonId:e,enabled:t}){let n=Ve({addonId:e},{enabled:t,retry:!1}),r=i(()=>et(n.data??[]),[n.data]),a=t?n.isLoading?`Loading…`:r.length===0?`This provider returned no servers.`:null:`Disabled — enable the provider to fetch its servers.`;return c(`div`,{className:`rounded-lg border border-border bg-surface p-2 sm:p-3`,children:a===null?c(`div`,{className:`flex flex-wrap gap-1`,children:r.map(e=>c(`span`,{className:`inline-block break-all rounded bg-foreground-subtle/10 px-1.5 py-0.5 font-mono text-[10px] text-foreground`,children:e},e))}):c(`div`,{className:`text-xs text-foreground-subtle`,children:a})})}n();var rt={lan:g,wifi:T,docker:O,vpn:ne,loopback:D,other:D},it={lan:`LAN`,wifi:`Wi-Fi`,docker:`Docker`,vpn:`VPN`,loopback:`Loopback`,other:`Other`},at=[`lan`,`wifi`,`vpn`,`docker`,`other`,`loopback`];function ot(e){let{interfaces:t,disabled:n,hideLoopback:a,ipv4Only:o,emptyMessage:s}=e,l=i(()=>t.filter(e=>!(a&&e.kind===`loopback`||o&&e.family!==`IPv4`)),[t,a,o]),u=i(()=>{let e=new Map;for(let t of l){let n=e.get(t.kind)??[];n.push(t),e.set(t.kind,n)}return at.filter(t=>e.has(t)).map(t=>({kind:t,items:e.get(t)}))},[l]),d=t=>e.mode===`single`?e.value===t:e.value.includes(t),f=t=>{if(n||t.kind===`loopback`)return;if(e.mode===`single`){e.onChange(e.value===t.address?null:t.address);return}let r=new Set(e.value);r.has(t.address)?r.delete(t.address):r.add(t.address),e.onChange([...r])};return l.length===0?c(`div`,{className:`text-xs text-foreground-subtle italic`,children:s??`No addresses available.`}):c(`div`,{className:`flex flex-col gap-3`,children:u.map(({kind:t,items:i})=>r(`div`,{className:`rounded-md border border-border overflow-hidden`,children:[r(`div`,{className:`flex items-center gap-2 px-3 py-1.5 bg-surface-hover/30 border-b border-border`,children:[c(rt[t]??D,{className:`h-3.5 w-3.5 text-foreground-subtle`}),c(`span`,{className:`text-[11px] font-semibold uppercase tracking-wide text-foreground-subtle`,children:it[t]??t}),r(`span`,{className:`text-[10px] text-foreground-subtle`,children:[`· `,i.length]})]}),c(`ul`,{className:`divide-y divide-border`,children:i.map(t=>{let i=d(t.address),a=t.kind===`loopback`,o=!t.plausible&&!a;return r(`li`,{className:`flex items-center gap-3 px-3 py-2 ${a?`opacity-60 cursor-not-allowed`:n?`opacity-60`:o?`cursor-pointer hover:bg-surface-hover/30 bg-amber-500/[0.04]`:`cursor-pointer hover:bg-surface-hover/30`}`,onClick:()=>f(t),children:[c(`span`,{className:`flex items-center justify-center h-4 w-4 rounded ${e.mode===`single`?`rounded-full`:`rounded`} border ${i?`border-primary bg-primary text-primary-foreground`:`border-border bg-surface`}`,children:i&&c(C,{className:`h-3 w-3`})}),r(`div`,{className:`flex-1 min-w-0 ${o?`text-foreground-subtle`:``}`,children:[r(`div`,{className:`flex items-center gap-2 flex-wrap`,children:[c(`span`,{className:`font-mono text-xs font-semibold ${o?`text-foreground-subtle`:`text-foreground`}`,children:t.name}),c(`span`,{className:`text-[10px] rounded px-1.5 py-0.5 bg-foreground-subtle/10 text-foreground-subtle font-mono`,children:t.family}),t.preferred&&c(`span`,{className:`text-[10px] rounded-full px-2 py-0.5 font-medium bg-primary/15 text-primary`,children:`Auto-preferred`}),a&&c(`span`,{className:`text-[10px] rounded-full px-2 py-0.5 font-medium bg-foreground-subtle/15 text-foreground-subtle`,children:`Always included`}),o&&r(`span`,{className:`inline-flex items-center gap-1 text-[10px] rounded-full px-2 py-0.5 font-medium bg-amber-500/15 text-amber-700 dark:text-amber-300`,title:t.plausibleReason||void 0,children:[c(m,{className:`h-2.5 w-2.5`}),`Unlikely usable`]})]}),r(`div`,{className:`text-xs text-foreground-subtle mt-0.5 font-mono break-all`,children:[t.address,t.cidr&&t.cidr!==t.address?` (${t.cidr})`:``]})]})]},`${t.name}-${t.family}-${t.address}`)})})]},t))})}var K=[{role:`appConnections`,title:`App connections`,single:!1,help:`Addresses the CamStack apps try when connecting; tick several. Automatic: LAN addresses plus your public tunnel.`},{role:`notificationTaps`,title:`Notification taps`,single:!0,help:`Only where tapping a notification opens; one address. Automatic: the CamStack app link (opens the app if installed, otherwise the web app).`},{role:`publicEndpoint`,title:`Public endpoint`,single:!0,help:`Every link that must work away from home: sign-in, single sign-on and account linking, passkeys, and the buttons, attachments and admin links in notifications; one address. Automatic: your public tunnel, then Tailscale, then the LAN. Changing it invalidates registered passkeys.`},{role:`internal`,title:`Internal`,single:!0,help:`Where other CamStack machines and LAN devices download addons, models and media from; one address. Automatic: the hub's LAN address.`}],st=`A role with nothing ticked is automatic. Add a custom address when the hub is reached at an address it cannot see itself (NAT, reverse proxy, VPN, Docker bridge).`;function q(e,t){return e.inUse.includes(t)}function ct(e,t){if(!e.eligible.includes(t))return{kind:`none`};if(e.kind===`app-link`)return q(e,t)?{kind:`none`}:{kind:`set`,input:{role:t,baseUrl:null,enabled:!0}};if(e.flags.includes(t)||t===`appConnections`&&q(e,t))return{kind:`set`,input:{role:t,baseUrl:e.baseUrl,enabled:!1}};let n={role:t,baseUrl:e.baseUrl,enabled:!0};return t===`publicEndpoint`&&e.baseUrl.startsWith(`http:`)?{kind:`confirm-http`,input:n,reason:de}:{kind:`set`,input:n}}function lt(e){return K.map(({role:t,title:n})=>{if(t===`appConnections`){let r=e.roles.appConnections;return{role:t,title:n,inUse:r.resolved.length===0?`nothing reachable`:r.resolved.join(`, `),automatic:r.source!==`flagged`}}let r=e.roles[t];return{role:t,title:n,inUse:r.resolved===null?`nothing reachable`:t===`notificationTaps`&&r.source===`auto`?`CamStack app link`:r.resolved,automatic:r.source!==`flagged`}})}n();var ut={"lan-ipv4":{label:`IPv4`,className:`bg-emerald-500/15 text-emerald-700 dark:text-emerald-300`},"lan-ipv6":{label:`IPv6`,className:`bg-violet-500/15 text-violet-700 dark:text-violet-300`},public:{label:`Public`,className:`bg-blue-500/15 text-blue-700 dark:text-blue-300`},"app-link":{label:`App link`,className:`bg-amber-500/15 text-amber-700 dark:text-amber-300`},custom:{label:`Custom`,className:`bg-sky-500/15 text-sky-700 dark:text-sky-300`},loopback:{label:`Loopback`,className:`bg-foreground-subtle/15 text-foreground-subtle`}};function dt({book:e,loading:t,saving:n,error:i,onSetRole:a,onAdd:o,onRemove:l}){let[u,f]=s(``),[p,g]=s(``),[_,v]=s(null),[y,b]=s(null),x=()=>{let e=le(u);if(!e.ok){v(e.reason);return}v(null),f(``),g(``),o(e.baseUrl,p.trim())},S=(e,t)=>{let n=ct(e,t.role);if(n.kind!==`none`){if(n.kind===`confirm-http`){b({input:n.input,reason:n.reason});return}b(null),a(n.input)}},C=[{key:`url`,header:`Address`,render:t=>r(`div`,{className:`min-w-0 py-0.5`,children:[c(`div`,{className:`font-mono text-[12px] break-all ${t.plausible?`text-foreground`:`text-foreground-subtle`}`,children:t.baseUrl}),r(`div`,{className:`mt-0.5 flex flex-wrap items-center gap-1.5 text-[11px] text-foreground-subtle`,children:[c(`span`,{children:t.label}),t.kind===`app-link`&&r(`span`,{className:`font-mono`,children:[`hub= `,e?.appLinkHub??`none (no tunnel or Tailscale)`]}),t.custom&&t.detected&&c(`span`,{children:`also added as a custom address`}),t.kind!==`custom`&&t.interfaceKind!==`lan`&&t.interfaceKind!==`public`&&t.interfaceKind!==`other`&&c(`span`,{className:`uppercase tracking-wide`,children:t.interfaceKind}),!t.plausible&&t.interfaceKind!==`loopback`&&r(`span`,{className:`inline-flex items-center gap-1 text-amber-700 dark:text-amber-300`,title:t.plausibleReason||void 0,children:[c(m,{className:`h-2.5 w-2.5`}),`Unlikely usable`]})]})]})},{key:`kind`,header:`Kind`,nowrap:!0,render:e=>{let t=ut[e.kind]??ut.loopback;return c(`span`,{className:`text-[10px] rounded-full px-2 py-0.5 font-medium ${t.className}`,children:t.label})}},...K.map(e=>({key:e.role,headerRender:()=>c(`span`,{title:e.help,children:e.title}),align:`center`,nowrap:!0,width:`w-24`,render:t=>{let i=t.eligible.includes(e.role),a=t.flags.includes(e.role),o=q(t,e.role);return r(`label`,{className:`inline-flex items-center justify-center gap-1 ${i?`cursor-pointer`:`cursor-not-allowed opacity-40`}`,title:i?o&&!a?`${e.title}: in use automatically. ${e.help}`:e.help:`This address cannot be used for this.`,children:[c(Le,{checked:i&&o,disabled:!i||n,onChange:()=>S(t,e),"aria-label":`${e.title}: ${t.baseUrl}`}),o&&!a&&i&&c(`span`,{className:`text-[9px] text-foreground-subtle`,children:`auto`})]})}})),{key:`actions`,header:``,align:`right`,nowrap:!0,render:e=>e.custom?c(A,{size:`sm`,variant:`ghost`,disabled:n,onClick:()=>l(e.baseUrl),"aria-label":`Remove ${e.baseUrl}`,title:`Remove this custom address (its roles turn automatic)`,children:c(d,{className:`h-3 w-3`})}):null}],w=e===void 0?[]:lt(e);return r(Ae,{children:[r(`div`,{className:`px-4 py-3 border-b border-border flex flex-col gap-2`,children:[r(`div`,{children:[c(`div`,{className:`text-sm font-semibold`,children:`Addresses`}),c(`div`,{className:`text-xs text-foreground-subtle max-w-3xl`,children:`Every address this hub is reached at, detected or added by you. Tick what each one is used for.`}),r(`details`,{className:`mt-1.5 text-xs max-w-3xl`,"data-testid":`address-roles-help`,children:[c(`summary`,{className:`cursor-pointer select-none text-foreground-subtle hover:text-foreground`,children:`What are roles?`}),c(`dl`,{className:`mt-1.5 grid grid-cols-[auto_1fr] gap-x-3 gap-y-1`,children:K.map(e=>r(`div`,{className:`contents`,children:[c(`dt`,{className:`font-medium`,children:e.title}),c(`dd`,{className:`text-foreground-subtle`,children:e.help})]},e.role))}),c(`p`,{className:`mt-1.5 text-foreground-subtle`,children:st})]})]}),w.length>0&&c(`div`,{className:`grid grid-cols-[auto_1fr_auto] gap-x-3 gap-y-1 items-baseline text-xs`,"data-testid":`address-roles-summary`,children:w.map(e=>r(`div`,{className:`contents`,children:[c(`span`,{className:`text-foreground-subtle`,children:e.title}),r(`span`,{className:`font-mono break-all`,"data-testid":`address-role-${e.role}`,children:[e.inUse,c(`span`,{className:`ml-1.5 font-sans text-foreground-subtle`,children:e.automatic?`(automatic)`:`(set by you)`})]}),e.automatic?c(`span`,{}):c(A,{size:`sm`,variant:`secondary`,disabled:n,onClick:()=>a({role:e.role,baseUrl:null,enabled:!1}),children:`Use automatic`})]},e.role))}),y!==null&&r(`div`,{className:`rounded-md border border-amber-500/40 bg-amber-500/10 px-3 py-2 text-xs flex flex-wrap items-center gap-2`,children:[c(m,{className:`h-3.5 w-3.5 text-amber-600`}),c(`span`,{className:`flex-1 min-w-[220px]`,children:y.reason}),c(A,{size:`sm`,variant:`secondary`,onClick:()=>{a({...y.input,acceptInsecureHttp:!0}),b(null)},children:`Use http anyway`}),c(A,{size:`sm`,variant:`ghost`,onClick:()=>b(null),children:`Cancel`})]}),i!==null&&c(`div`,{className:`text-[11px] text-red-600 dark:text-red-400`,role:`alert`,children:i})]}),c(xe,{columns:C,rows:e?.rows??[],rowKey:e=>`${e.kind}-${e.baseUrl}`,minWidthPx:760,bordered:!1,mobileMode:`scroll`,emptyMessage:t?`Loading…`:`No addresses available.`,rowClassName:e=>e.plausible?void 0:`opacity-80`}),r(`div`,{className:`px-4 py-3 border-t border-border flex flex-wrap items-start gap-2`,children:[r(`div`,{className:`flex-1 min-w-[220px]`,children:[c(Ie,{value:u,onChange:e=>{f(e.target.value),v(null)},placeholder:`https://cams.example.com or https://192.168.1.50:4443`,"aria-label":`Custom address`,disabled:n}),_!==null&&c(`div`,{className:`mt-1 text-[11px] text-red-600 dark:text-red-400`,children:_})]}),c(`div`,{className:`w-48`,children:c(Ie,{value:p,onChange:e=>g(e.target.value),placeholder:`Label (optional)`,"aria-label":`Custom address label`,maxLength:80,disabled:n})}),r(A,{size:`sm`,variant:`secondary`,disabled:n||u.trim()===``,onClick:x,children:[c(h,{className:`h-3 w-3`}),`Add custom address`]})]})]})}n();function ft(){let e=o(),t=()=>{e.invalidateQueries({queryKey:[[`localNetwork`]]})},n=Re(void 0,{refetchInterval:3e4}),a=ke(void 0),d=Ee({onSuccess:t}),f=je({onSuccess:e=>{S(e.addresses),t()}}),p=i(()=>n.data?.interfaces??[],[n.data]),m=ge({scheme:typeof window<`u`&&window.location.protocol===`https:`?`https`:`http`},{refetchInterval:3e4}),h=Se({onSuccess:t}),g=_e({onSuccess:t}),_=Oe({onSuccess:t}),y=h.error?.message??g.error?.message??_.error?.message??null,b=h.isPending||g.isPending||_.isPending,[x,S]=s([]),[C,w]=s(!1);l(()=>{!C&&a.data&&(S(a.data.addresses),w(!0))},[a.data,C]);let T=a.data?.addresses??[],E=i(()=>{if(x.length!==T.length)return!0;let e=[...x].toSorted(),t=[...T].toSorted();return e.some((e,n)=>e!==t[n])},[x,T]);return r(R,{embedded:!0,children:[r(`div`,{className:`flex items-center justify-between gap-3 flex-wrap`,children:[c(`p`,{className:`text-xs text-foreground-subtle max-w-2xl`,children:`Pin which host interfaces exist, then tick what each address is used for. Add a custom address when this hub is reached at one it cannot detect.`}),c(`div`,{className:`flex items-center gap-2 shrink-0`,children:r(A,{size:`sm`,variant:`secondary`,onClick:()=>{n.refetch(),a.refetch(),m.refetch()},disabled:n.isLoading,children:[c(ae,{className:`h-3 w-3 ${n.isLoading?`animate-spin`:``}`}),`Refresh`]})})]}),c(P,{headingId:`network-allowed-addresses`,title:`Allowed addresses`,actions:r(`div`,{className:`flex flex-wrap items-center gap-1`,children:[r(A,{size:`sm`,variant:`secondary`,onClick:()=>f.mutate(void 0),disabled:f.isPending||d.isPending,title:`Re-run the auto-detection heuristic + overwrite the current allowlist with the best matches.`,children:[c(v,{className:`h-3 w-3`}),f.isPending?`Detecting…`:`Best match`]}),r(A,{size:`sm`,variant:`secondary`,onClick:()=>{S([])},disabled:x.length===0||d.isPending,children:[c(ie,{className:`h-3 w-3`}),`Clear`]}),E&&c(A,{size:`sm`,variant:`secondary`,onClick:()=>{S(T)},disabled:d.isPending,children:`Discard`}),r(A,{size:`sm`,variant:`primary`,onClick:()=>{d.mutate({addresses:[...x]})},disabled:!E||d.isPending,children:[c(te,{className:`h-3 w-3`}),d.isPending?`Saving…`:`Save`]})]}),children:r(`div`,{className:u,children:[c(`p`,{className:`mb-3 text-xs text-foreground-subtle`,children:x.length===0?`Auto — every non-loopback / non-link-local interface participates.`:`${String(x.length)} pinned`}),c(ot,{mode:`multiple`,interfaces:p,value:x,onChange:S,disabled:d.isPending,emptyMessage:n.isLoading?`Loading interfaces…`:`No interfaces detected.`})]})}),c(dt,{book:m.data,loading:m.isLoading,saving:b,error:y,onSetRole:e=>h.mutate({...e}),onAdd:(e,t)=>g.mutate({baseUrl:e,label:t}),onRemove:e=>_.mutate({baseUrl:e})})]})}n();var pt={mesh:`bg-violet-500/15 text-violet-700 dark:text-violet-300`,public:`bg-blue-500/15 text-blue-700 dark:text-blue-300`},J=5e3,Y=`mesh-network`,mt=3e4,ht={joined:!1,meshIp:``,magicDnsHostname:``,peerCount:0,endpoints:[],tenantName:``,magicDnsSuffix:``,userLogin:null,controlPlaneUrl:``,keyExpiry:null};function gt(){let e=j({capName:`mesh-network`},{refetchInterval:J}),t=M(void 0,{refetchInterval:J}),n=i(()=>H(t.data??[]),[t.data]),r=i(()=>(e.data??[]).map(e=>({addonId:e.addonId,displayName:n.get(e.addonId)??e.addonId,isActive:e.isActive})),[e.data,n]);return c(B,{embedded:!0,icon:O,title:`Mesh Networks`,subtitle:`Private VPN meshes that connect CamStack to your other devices (Tailscale, Headscale, …). Each provider can also expose this hub publicly via its ingress (Tailscale Funnel).`,groups:[{id:Y,label:`Mesh networks`,install:{capability:Y,label:`Add mesh`},entries:r.map(e=>({id:e.addonId,name:e.displayName,fallbackIcon:g,...V(e.isActive),render:()=>c(z,{addonId:e.addonId,displayName:e.displayName,capName:Y,isActive:e.isActive,badges:c(_t,{addonId:e.addonId}),primaryAction:c(vt,{addonId:e.addonId}),panels:[{id:`status`,title:`Status`,icon:O,content:c(yt,{addonId:e.addonId})}]})}))}],isLoading:e.isLoading,emptyTitle:`No mesh-network providers installed`,emptyDescription:`Install a mesh addon (e.g. @camstack/addon-tailscale) to join this hub into a private VPN mesh.`})}function X(e){let{data:t,isLoading:n}=He({addonId:e},{refetchInterval:J,retry:!1}),r=t?fe.safeParse(t):null;return{status:r?.success?r.data:ht,isLoading:n}}function _t({addonId:e}){let{status:t}=X(e);return r(a,{children:[c(F,{variant:t.joined?`success`:`default`,className:qe,children:t.joined?`Joined`:`Not joined`}),t.joined&&r(F,{className:`text-[10px]`,children:[t.peerCount,` peer`,t.peerCount===1?``:`s`]})]})}function vt({addonId:t}){let n=o(),[i,l]=s(!1),[u,d]=s(null),f=re(),{status:p}=X(t),m=e(()=>{n.invalidateQueries({queryKey:[[`meshNetwork`]]})},[n]),h=Pe(),g=me({onSuccess:m}),_=be({onSuccess:m}),v=e(async()=>{l(!0);let e={cancelled:!1};d(e);try{let n=await h.mutateAsync({addonId:t});if(e.cancelled)return;n.loginUrl&&window.open(n.loginUrl,`_blank`,`noopener,noreferrer`);let r=Date.now();for(;!e.cancelled&&(await Et(2e3),!e.cancelled);){let e=await f.trpcClient.meshNetwork.getStatus.query({addonId:t}).catch(()=>null),n=e?fe.safeParse(e):null;if(n?.success&&n.data.joined){m();break}if(Date.now()-r>6e5)break}}finally{l(!1),d(null)}},[t,m,h,f]),y=e(()=>{u&&(u.cancelled=!0),l(!1),d(null)},[u]);return c(a,{children:p.joined?r(a,{children:[r(A,{size:`sm`,variant:`secondary`,disabled:g.isPending,onClick:()=>g.mutate({addonId:t}),children:[g.isPending?c(S,{className:`h-3 w-3 animate-spin`}):c(oe,{className:`h-3 w-3`}),`Disconnect`]}),r(A,{size:`sm`,variant:`ghost`,disabled:_.isPending,onClick:()=>_.mutate({addonId:t}),children:[_.isPending?c(S,{className:`h-3 w-3 animate-spin`}):c(x,{className:`h-3 w-3`}),`Log out`]})]}):i?r(A,{size:`sm`,variant:`ghost`,onClick:y,children:[c(w,{className:`h-3 w-3 mr-1`}),` Cancel`]}):r(a,{children:[r(A,{size:`sm`,variant:`primary`,onClick:()=>void v(),children:[c(ce,{className:`h-3 w-3`}),`Connect`]}),r(A,{size:`sm`,variant:`ghost`,disabled:_.isPending,onClick:()=>_.mutate({addonId:t}),children:[_.isPending?c(S,{className:`h-3 w-3 animate-spin`}):c(x,{className:`h-3 w-3`}),`Log out`]})]})})}function yt({addonId:e}){let{status:t}=X(e),n=Fe({addonId:e},{refetchInterval:mt,retry:!1});return r(`div`,{className:`rounded-lg border border-border bg-surface`,children:[r(`div`,{className:`space-y-4 p-2 sm:p-4`,children:[t.error&&c(N,{message:t.error}),c(bt,{status:t}),t.endpoints.length>0&&r(`div`,{className:`space-y-1.5`,children:[c(`div`,{className:`text-[11px] font-semibold text-foreground-subtle uppercase tracking-wide`,children:`Endpoints`}),t.endpoints.map(e=>r(`div`,{className:`flex items-center gap-2 text-xs flex-wrap`,children:[r(`span`,{className:`text-[10px] rounded-full px-2 py-0.5 font-medium ${pt[e.scope]??`bg-foreground-subtle/15 text-foreground-subtle`}`,children:[e.scope===`public`?c(k,{className:`inline h-2.5 w-2.5 mr-0.5`}):null,e.label]}),r(`a`,{href:e.url,target:`_blank`,rel:`noopener noreferrer`,className:`text-emerald-700 dark:text-emerald-300 hover:underline break-all flex items-center gap-1`,children:[c(_,{className:`h-3 w-3 shrink-0`}),e.url]})]},e.id))]})]}),c(`div`,{className:`border-t border-border`,children:c(St,{peers:n.data?.peers??[],loading:n.isLoading})})]})}function bt({status:e}){return c(`div`,{className:`grid grid-cols-1 sm:grid-cols-2 gap-x-6 gap-y-1.5`,children:[{label:`Tenant`,value:e.tenantName||`—`},{label:`User`,value:e.userLogin??`—`},{label:`Control plane`,value:e.controlPlaneUrl||`—`},{label:`Mesh IP`,value:e.meshIp||`—`,mono:!0},{label:`MagicDNS`,value:e.magicDnsHostname||`—`,mono:!0},{label:`DNS suffix`,value:e.magicDnsSuffix||`—`,mono:!0},{label:`Peers`,value:String(e.peerCount)},{label:`Key expiry`,value:e.keyExpiry?xt(e.keyExpiry):`—`}].map(e=>r(`div`,{className:`flex items-baseline justify-between gap-3 text-xs`,children:[c(`span`,{className:`text-foreground-subtle shrink-0`,children:e.label}),c(`span`,{className:`text-foreground truncate ${e.mono?`font-mono`:``}`,children:e.value})]},e.label))})}function xt(e){let t=e-Date.now();if(t<0)return`Expired ${Tt(e)}`;let n=Math.floor(t/864e5);if(n>60)return new Date(e).toLocaleDateString();if(n>1)return`in ${n} days`;let r=Math.floor(t/36e5);return r>1?`in ${r}h`:`in ${Math.max(1,Math.floor(t/6e4))} min`}function St({peers:t,loading:n}){let a=i(()=>t.map(e=>({...e,_id:e.id})),[t]),o=e(e=>{e&&navigator.clipboard?.writeText(e)},[]),s=i(()=>[{key:`hostname`,header:`Hostname`,render:e=>r(`div`,{className:`flex flex-col`,children:[r(`div`,{className:`flex items-center gap-1.5`,children:[c(`span`,{className:`font-medium text-foreground`,children:e.hostname||`(unknown)`}),e.isSelf&&c(F,{variant:`info`,children:`self`}),e.exitNodeOption&&c(F,{variant:`warning`,children:`exit-node`})]}),e.userLogin&&c(`div`,{className:`text-[10px] text-foreground-subtle truncate`,children:e.userLogin})]})},{key:`magicDns`,header:`MagicDNS`,render:e=>e.magicDns?r(`div`,{className:`flex items-center gap-1`,children:[c(`span`,{className:`font-mono text-xs truncate`,children:e.magicDns}),c(`button`,{onClick:()=>o(e.magicDns),className:`p-0.5 hover:bg-foreground-subtle/10 rounded`,"aria-label":`Copy MagicDNS`,children:c(y,{className:`h-3 w-3 text-foreground-subtle`})})]}):c(`span`,{className:`text-foreground-subtle`,children:`—`})},{key:`addresses`,header:`IP`,render:e=>{let t=e.addresses[0]??``;return t?r(`div`,{className:`flex items-center gap-1`,children:[c(`span`,{className:`font-mono text-xs`,children:t}),c(`button`,{onClick:()=>o(t),className:`p-0.5 hover:bg-foreground-subtle/10 rounded`,"aria-label":`Copy IP`,children:c(y,{className:`h-3 w-3 text-foreground-subtle`})})]}):c(`span`,{className:`text-foreground-subtle`,children:`—`})}},{key:`connection`,header:`Connection`,render:e=>r(`div`,{className:`flex items-center gap-1.5`,children:[c(F,{variant:Ct(e.connection),children:e.connection}),e.relay&&c(`span`,{className:`text-[10px] text-foreground-subtle font-mono`,children:e.relay})]})},{key:`routes`,header:`Routes`,render:e=>e.advertisedRoutes.length>0?c(`span`,{className:`text-[10px] font-mono text-foreground-subtle truncate`,children:e.advertisedRoutes.join(`, `)}):c(`span`,{className:`text-foreground-subtle`,children:`—`})},{key:`tx`,header:`TX / RX`,render:e=>r(`span`,{className:`text-[10px] text-foreground-subtle font-mono`,children:[`↑ `,wt(e.txBytes),` · ↓ `,wt(e.rxBytes)]})},{key:`lastSeen`,header:`Last seen`,render:e=>c(`span`,{className:`text-[10px] text-foreground-subtle`,children:e.lastSeenMs>0?Tt(e.lastSeenMs):`—`})}],[o]);return n&&t.length===0?r(`div`,{className:`p-4 text-xs text-foreground-subtle`,children:[c(S,{className:`h-3 w-3 animate-spin inline mr-1`}),` Loading peers…`]}):t.length===0?c(`div`,{className:`p-4 text-xs text-foreground-subtle`,children:`No peers visible — your tailnet may be empty or the host is not joined.`}):c(`div`,{className:`p-4`,children:c(xe,{columns:s,rows:a,rowKey:e=>e._id,minWidthPx:820})})}function Ct(e){return e===`direct`?`success`:e===`relay`?`warning`:`info`}function wt(e){return e<1024?`${e}B`:e<1024*1024?`${(e/1024).toFixed(1)}KB`:e<1024*1024*1024?`${(e/1024/1024).toFixed(1)}MB`:`${(e/1024/1024/1024).toFixed(2)}GB`}function Tt(e){let t=Date.now()-e;return t<6e4?`just now`:t<36e5?`${Math.round(t/6e4)}m ago`:t<864e5?`${Math.round(t/36e5)}h ago`:`${Math.round(t/864e5)}d ago`}function Et(e){return new Promise(t=>setTimeout(t,e))}var Dt=/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/,Z=/-----BEGIN ((?:RSA |EC |ENCRYPTED )?PRIVATE KEY)-----[\s\S]+?-----END \1-----/,Ot={certificate:`.pem,.crt,.cer`,privateKey:`.pem,.key`,ca:`.pem,.crt,.cer`};function Q(e,t){if(t.trim()===``)return null;if(e===`privateKey`){let e=Z.exec(t);return e===null?Dt.test(t)?`This is a certificate, not a private key.`:`Not a PEM private key — expected -----BEGIN … PRIVATE KEY-----.`:e[1]===`ENCRYPTED PRIVATE KEY`?`The private key is password-protected. Export it without a passphrase.`:null}return Dt.test(t)?e===`certificate`&&Z.test(t)?`This file also contains a private key. Pick the certificate file, and the key in its own field.`:null:Z.test(t)?`This is a private key, not a certificate.`:`Not a PEM certificate — expected -----BEGIN CERTIFICATE-----.`}function kt(e){return e.text()}n();function $({kind:e,label:n,value:i,onChange:a,rows:o=6}){let l=t(null),[u,d]=s(null),[f,p]=s(null),m=f??Q(e,i),h=`pem-${e}`,g=async e=>{let t=e.target.files?.[0];if(e.target.value=``,t!==void 0){d(t.name);try{let e=await kt(t);p(null),a(e)}catch(e){p(`Could not read ${t.name}: ${e instanceof Error?e.message:String(e)}`)}}};return r(`div`,{className:`space-y-1`,children:[r(`div`,{className:`flex items-center justify-between gap-2`,children:[c(`label`,{htmlFor:h,className:`text-[11px] text-foreground-subtle`,children:n}),r(`div`,{className:`flex min-w-0 items-center gap-2`,children:[u!==null&&c(`span`,{className:`truncate font-mono text-[10px] text-foreground-subtle`,"data-testid":`${h}-file-name`,children:u}),c(`input`,{ref:l,type:`file`,accept:Ot[e],onChange:e=>void g(e),className:`hidden`,"data-testid":`${h}-file`}),r(A,{size:`sm`,variant:`outline`,type:`button`,onClick:()=>l.current?.click(),children:[c(se,{className:`mr-1 h-3 w-3`}),`Choose file`]})]})]}),c(`textarea`,{id:h,value:i,onChange:e=>{d(null),p(null),a(e.target.value)},rows:o,"aria-invalid":m!==null,className:`w-full rounded border border-border bg-surface px-2 py-1 font-mono text-[11px]`}),m!==null&&c(`p`,{className:`text-[11px] text-danger`,role:`alert`,children:m})]})}n();function At(e){if(e===null||e===``)return`—`;let t=e.replace(/:/g,``);return t.length<=16?e:`${t.slice(0,8)}…${t.slice(-8)}`}function jt(){let e=o(),t=pe(void 0,{refetchInterval:15e3}),n=De({onSuccess:()=>void e.invalidateQueries({queryKey:[[`localNetwork`]]})}),i=ve({onSuccess:()=>void e.invalidateQueries({queryKey:[[`localNetwork`]]})}),a=Me({onSuccess:()=>{f(!1),h(``),_(``),y(``),e.invalidateQueries({queryKey:[[`localNetwork`]]})}}),l=t.data,[d,f]=s(!1),[m,h]=s(``),[g,_]=s(``),[v,y]=s(``),b=()=>{if(!l?.caCertPem)return;let e=new Blob([l.caCertPem],{type:`application/x-pem-file`}),t=URL.createObjectURL(e),n=document.createElement(`a`);n.href=t,n.download=`camstack-ca.crt`,n.click(),URL.revokeObjectURL(t)},x=l?.mode===`uploaded`?`Uploaded`:l?.mode===`generated`?`Generated local CA`:`TLS disabled`;return c(R,{embedded:!0,children:r(`div`,{className:p,children:[c(Ke,{nodeId:`hub`,addonIds:[`local-network`],level:`global`,title:`LAN HTTP`,description:`Native apps on this Wi-Fi use http:// and skip the private certificate. The tunnel and this admin UI stay on HTTPS.`}),c(P,{headingId:`local-access-certificate`,title:`Certificate`,icon:E,children:r(`div`,{className:`${u} space-y-3`,children:[t.isError&&c(`p`,{className:`text-xs text-danger`,children:`Could not read TLS status.`}),l?.reissueError&&c(N,{variant:`warning`,title:`Certificate reissue`,message:l.reissueError}),l?.restartRequired&&c(N,{variant:`warning`,title:`Restart required`,message:`The HTTPS listener still serves the previous certificate. Restart the hub to apply it.`}),r(`dl`,{className:`grid grid-cols-1 gap-2 text-xs sm:grid-cols-2`,children:[r(`div`,{children:[c(`dt`,{className:`text-foreground-subtle`,children:`Mode`}),c(`dd`,{className:`font-medium`,children:x})]}),r(`div`,{children:[c(`dt`,{className:`text-foreground-subtle`,children:`Valid to`}),c(`dd`,{className:`font-mono`,children:l?.validTo?new Date(l.validTo).toLocaleString():`—`})]}),r(`div`,{children:[c(`dt`,{className:`text-foreground-subtle`,children:`Leaf SHA-256`}),c(`dd`,{className:`font-mono`,title:l?.leafFingerprintSha256??void 0,children:At(l?.leafFingerprintSha256??null)})]}),r(`div`,{children:[c(`dt`,{className:`text-foreground-subtle`,children:`CA SHA-256`}),c(`dd`,{className:`font-mono`,title:l?.caFingerprintSha256??void 0,children:l?.mode===`uploaded`&&l.caFingerprintSha256===null?c(`span`,{className:`font-sans text-foreground-subtle`,children:`Issuer not included in the upload (not the local CA)`}):At(l?.caFingerprintSha256??null)})]})]}),l&&l.sans.length>0&&c(`div`,{className:`flex flex-wrap gap-1`,children:l.sans.map(e=>c(`span`,{className:`rounded border border-border bg-surface px-1.5 py-0.5 font-mono text-[10px] text-foreground-subtle`,children:e},e))}),r(`div`,{className:`flex flex-wrap gap-2`,children:[c(Ce,{label:`Regenerate`,title:`Issue a new leaf?`,description:`Issues a new leaf under the current local CA. Clients that trust the CA keep working. The HTTPS listener reloads.`,confirmLabel:`Regenerate`,disabled:l?.mode===`uploaded`||n.isPending,action:()=>n.mutateAsync({})}),c(A,{size:`sm`,variant:`outline`,onClick:()=>f(e=>!e),children:`Upload`}),l?.caCertPem&&c(A,{size:`sm`,variant:`outline`,onClick:b,children:`Download CA`}),l?.mode===`uploaded`&&c(Ce,{label:`Revert to generated`,title:`Drop the uploaded certificate?`,description:`Deletes the uploaded pair and returns to the generated local CA.`,confirmLabel:`Revert`,confirmVariant:`danger`,disabled:i.isPending,action:()=>i.mutateAsync({})})]}),d&&r(`div`,{className:`space-y-2 border-t border-border pt-3`,children:[c($,{kind:`certificate`,label:`Certificate or full chain (PEM)`,value:m,onChange:h}),c($,{kind:`privateKey`,label:`Private key (PEM)`,value:g,onChange:_}),c($,{kind:`ca`,label:`CA (PEM, optional)`,value:v,onChange:y,rows:4}),c(A,{size:`sm`,disabled:!m.trim()||!g.trim()||Q(`certificate`,m)!==null||Q(`privateKey`,g)!==null||Q(`ca`,v)!==null||a.isPending,onClick:()=>a.mutate({certPem:m,keyPem:g,...v.trim()?{caPem:v}:{}}),children:`Save certificate`}),a.isError&&c(`p`,{className:`text-xs text-danger`,children:a.error instanceof Error?a.error.message:`Upload failed`})]})]})})]})})}n();function Mt({value:e,onChange:t}){let{data:n}=ze({isCamera:!0,projection:`slim`}),a=i(()=>n===void 0?[{value:``,label:`Loading cameras…`}]:n.length===0?[{value:``,label:`No cameras`}]:[{value:``,label:`Pick a camera`},...n.toSorted((e,t)=>e.name.localeCompare(t.name)).map(e=>({value:String(e.id),label:`${e.name} (#${String(e.id)})`}))],[n]);return r(`label`,{className:`flex min-w-0 flex-col gap-1`,children:[c(`span`,{className:`text-[11px] text-foreground-subtle`,children:`Camera`}),c(ye,{value:e===null?``:String(e),disabled:n===void 0||n.length===0,onChange:e=>t(e.target.value===``?null:Number(e.target.value)),options:a})]})}function Nt(){let t=re(),[n,i]=s(null);return c(R,{embedded:!0,children:r(`div`,{className:p,"data-testid":`network-diagnostics`,children:[c(he,{loadServers:e(async()=>t.trpcClient.turnProvider.getTurnServers.query(),[t])}),c(Ne,{trpc:t.trpcClient,serverUrl:b(),deviceId:n,cameraField:c(Mt,{value:n,onChange:i})})]})})}function Pt(){let{t:e}=Ue(),t=We(`/system/network`,{t:e,isAdmin:!0})??{icon:k,title:e(`system.network`,`Network`)};return c(Ge,{icon:t.icon,title:t.title,defaultSection:`addresses`,sectionsLabel:`${t.title} sections`,sections:[{id:`local-access`,label:`Local access`,content:c(jt,{})},{id:`addresses`,label:`Network Addresses`,content:c(ft,{})},{id:I.remoteAccess.tab,label:`Remote Access`,content:c(Ye,{}),ownedParams:L},{id:I.mesh.tab,label:`Mesh Networks`,content:c(gt,{}),ownedParams:L},{id:I.turn.tab,label:`TURN Servers`,content:c(tt,{}),ownedParams:L},{id:`diagnostics`,label:`Diagnostics`,content:c(Nt,{})}]})}export{Pt as NetworkPage};

package/dist/assets/SessionsList-BwcT1neM.js

@@ -1,2 +0,0 @@
-import{I as e,K as t,Q as n,S as r,W as i,q as a,x as o}from"./_virtual_mf___mfe_internal__admin_ui_host__loadShare___mf_0_tanstack_mf_1_react_mf_2_query__loadShare__.js-DhP-Lgiq.js";import{D as s,It as c,ar as l,cn as u,di as d,dt as f,ot as p}from"./player-overlays-Bthpd_DK.js";import{i as m,o as h}from"./video-BYsOgJ3d.js";import{t as g}from"./key-round-ClhiHwZi.js";import{t as _}from"./octagon-alert-CLNUgI7g.js";import{An as v,Bn as y,Dn as b,Ht as x,Ln as S,Nl as C,Nt as w,On as ee,Pt as T,Qn as E,Tn as te,Ut as ne,Vt as re,Xl as ie,Zl as ae,Zn as oe,ar as se,gu as D,iu as O,jn as ce,kn as le,ma as ue}from"./src-ASnW4RHZ.js";import{R as de,a as fe}from"./index-D6a_-apt.js";n();function k({id:e,title:t,icon:n,description:i,actions:a,tone:c=`default`,notice:l=null,onDismissNotice:u,children:d}){return o(re,{headingId:`access-${e}`,title:t,icon:n,actions:a,testId:`access-${e}`,children:r(`div`,{className:`${s} space-y-3`,children:[o(`div`,{className:O(`text-[11px] leading-relaxed`,c===`danger`?`rounded-md border border-danger/30 bg-danger/5 px-3 py-2 text-foreground`:`text-foreground-subtle`),children:i}),l!==null&&o(me,{notice:l,onDismiss:u}),d]})})}var pe={success:{icon:d,line:`border-success/30 text-foreground`,mark:`text-success`},danger:{icon:_,line:`border-danger/40 text-danger`,mark:`text-danger`}};function me({notice:e,onDismiss:t}){let n=pe[e.tone],i=n.icon;return r(`div`,{role:e.tone===`danger`?`alert`:`status`,className:O(`flex items-start gap-2 rounded-md border bg-surface px-3 py-2 text-[11px]`,n.line),children:[o(i,{className:O(`mt-0.5 h-3.5 w-3.5 shrink-0`,n.mark),"aria-hidden":!0}),o(`span`,{className:`min-w-0 flex-1`,children:e.message}),t!==void 0&&o(ae,{type:`button`,variant:`ghost`,size:`sm`,icon:f,"aria-label":`Dismiss`,onClick:t,className:`-my-1 h-5 w-5`})]})}function A(){let{data:e}=C();return i(()=>{let t=new Map;for(let n of e??[])t.set(n.id,n.username);return t},[e])}function j(e,t=null){return e===null?t:{tone:`danger`,message:e}}var M={active:`Active`,expired:`Expired`,revoked:`Revoked`,current:`This session`},he={active:`success`,expired:`warning`,revoked:`default`,current:`info`},ge={current:0,active:1,expired:2,revoked:3};function N(e,t){if(e===null)return t;let n=new Date(e);return Number.isNaN(n.getTime())?`—`:n.toLocaleString()}function _e({status:e}){return o(se,{variant:he[e],className:`text-[10px]`,children:M[e]})}function ve({row:e,action:t}){if(!t.isAvailable(e))return null;let n=t.icon,i=t.busyId===e.id;return r(y,{type:`button`,variant:`ghost`,size:`sm`,onClick:()=>t.onRun(e),disabled:t.disabled,"aria-label":`${t.label} ${e.name}`,className:`text-danger hover:bg-danger/10`,children:[i?o(l,{className:`h-3 w-3 animate-spin`,"aria-hidden":!0}):o(n,{className:`h-3 w-3`,"aria-hidden":!0}),t.label]})}function ye(e){return[{key:`name`,header:`Name`,sortValue:e=>e.name.toLowerCase(),render:e=>r(`div`,{className:`min-w-0 max-w-[18rem]`,children:[o(`div`,{className:`truncate font-medium text-foreground`,title:e.name,children:e.name}),e.detail!==null&&o(`div`,{className:`truncate font-mono text-[10px] text-foreground-subtle`,title:e.detail,children:e.detail})]})},e.hideOwner?null:{key:`owner`,header:`Owner`,sortValue:e=>e.ownerName.toLowerCase(),render:e=>e.ownerName},{key:`kind`,header:`Kind / scope`,sortValue:e=>e.kind.toLowerCase(),nowrap:!1,render:e=>r(`div`,{className:`min-w-[8rem] max-w-[16rem]`,children:[o(`div`,{className:`text-foreground`,children:e.kind}),e.scope!==null&&o(`div`,{className:`line-clamp-2 text-[10px] text-foreground-subtle`,title:e.scope,children:e.scope})]})},{key:`status`,header:`Status`,sortValue:e=>ge[e.status],render:e=>o(_e,{status:e.status})},{key:`created`,header:`Created`,sortValue:e=>e.createdAt,render:e=>o(`span`,{className:`text-foreground-subtle`,children:N(e.createdAt,`—`)})},{key:`lastUsed`,header:`Last used`,sortValue:e=>e.lastUsedAt,render:e=>o(`span`,{className:`text-foreground-subtle`,children:N(e.lastUsedAt,`Never`)})},{key:`expires`,header:`Expires`,sortValue:e=>e.expiresAt,render:t=>o(`span`,{className:`text-foreground-subtle`,children:N(t.expiresAt,e.expiresNone)})},e.action===null?null:{key:`actions`,header:``,align:`right`,notSortableReason:`Actions`,render:t=>e.action===null?null:o(ve,{row:t,action:e.action})}].filter(e=>e!==null)}n();var P=6,F={"current-session":`your current session`,"not-active":`already gone`};function I(e,t){return`${String(e)} ${e===1?t.one:t.many}`}function be(e){let t=new Map;for(let n of e)t.set(n.status,(t.get(n.status)??0)+1);return[...t.entries()].map(([e,t])=>`${String(t)} ${M[e].toLowerCase()}`).join(`, `)}function L(e,t){let n=e.slice(0,P).map(e=>`• ${e.name} — ${e.ownerName}`),r=e.length>P?[`…and ${String(e.length-P)} more`]:[];return[`${I(e.length,t)} (${be(e)}) stop working at once. This cannot be undone.`,``,...n,...r].join(`
-`)}function R(e,t,n){let r=E(),i=D.auth.revokeCredentials.useMutation(),[o,s]=a(null);return{run:async a=>{if(a.length===0)return!1;let o=String(a.length),c=await r({title:`Revoke ${I(a.length,t)}?`,message:L(a,t),label:`Type ${o} to confirm`,placeholder:o,confirmLabel:`Revoke ${o}`,variant:`danger`,validate:e=>e.trim()===o?null:`Type ${o} — the number of ${t.many} selected`});if(c===null||c.trim()!==o)return!1;s(null);try{let n=await i.mutateAsync({kind:e,ids:a.map(e=>e.id),confirmCount:a.length}),r=n.skipped.map(e=>F[e.reason]??e.reason);return s({tone:`success`,message:`Revoked ${I(n.revoked.length,t)}.`+(r.length>0?` Skipped ${String(r.length)}: ${[...new Set(r)].join(`, `)}.`:``)}),!0}catch(e){return s({tone:`danger`,message:`The revoke failed: ${e instanceof Error?e.message:`request failed`}. The list below is reloaded — check what is left.`}),!1}finally{n()}},busy:i.isPending,outcome:o,dismiss:()=>s(null)}}function xe(e,t){let n=E(),r=D.auth.revokeCredentials.useMutation(),[i,o]=a(null);return{run:async i=>{if(i.length===0)return!1;let a=String(i.length),s=await n({title:`Revoke ${I(i.length,e)}?`,message:L(i,e),label:`Type ${a} to confirm`,placeholder:a,confirmLabel:`Revoke ${a}`,variant:`danger`,validate:t=>t.trim()===a?null:`Type ${a} — the number of ${e.many} selected`});if(s===null||s.trim()!==a)return!1;o(null);let c=i.filter(e=>e.kind===`Scoped`).map(e=>e.id),l=i.filter(e=>e.kind===`Admin`).map(e=>e.id);try{let t=[],n=[];if(c.length>0){let e=await r.mutateAsync({kind:`scoped-token`,ids:c,confirmCount:c.length});t.push(...e.revoked),n.push(...e.skipped)}if(l.length>0){let e=await r.mutateAsync({kind:`admin-token`,ids:l,confirmCount:l.length});t.push(...e.revoked),n.push(...e.skipped)}let i=n.map(e=>F[e.reason]??e.reason);return o({tone:`success`,message:`Revoked ${I(t.length,e)}.`+(i.length>0?` Skipped ${String(i.length)}: ${[...new Set(i)].join(`, `)}.`:``)}),!0}catch(e){return o({tone:`danger`,message:`The revoke failed: ${e instanceof Error?e.message:`request failed`}. The list below is reloaded — check what is left.`}),!1}finally{t()}},busy:r.isPending,outcome:i,dismiss:()=>o(null)}}n();var Se={searchText:e=>[e.name,e.detail??``,e.ownerName,e.kind,e.scope??``],facetGroups:[{id:`status`,value:e=>e.status},{id:`owner`,value:e=>e.ownerName},{id:`kind`,value:e=>e.kind}]},Ce={status:`Status`,owner:`Owner`,kind:`Kind`},we=e=>e.status!==`current`,Te=[`active`,`current`];function z({rows:e,label:t,isLoading:n,loadError:s,emptyText:c,hideOwner:u=!1,expiresNone:d=`Never`,action:f,bulk:p,defaultStatus:m=Te}){let[h]=a(()=>m.length===0?{search:``,facets:[]}:{search:``,facets:[],groups:{status:[...m]}}),g=w(e,Se,h),[_,v]=a(()=>new Set),y=i(()=>ye({hideOwner:u,expiresNone:d,action:f??null}),[u,d,f]),b=i(()=>p===void 0?()=>!1:e=>we(e)&&p.isSelectable(e),[p]),C=i(()=>g.rows.filter(e=>_.has(e.id)&&b(e)),[g.rows,_,b]);return n?r(`div`,{className:`flex items-center gap-2 py-4 text-xs text-foreground-subtle`,children:[o(l,{className:`h-3.5 w-3.5 animate-spin`,"aria-hidden":!0}),`Loading `,t,`…`]}):s===null?r(`div`,{className:`space-y-3`,children:[o(T,{state:g.state,facets:g.facets,groups:g.groups.filter(e=>!(u&&e.id===`owner`)).map(e=>({...e,label:Ce[e.id]??e.id,...e.id===`status`?{facetLabel:e=>M[e]??e}:{}})),labels:{searchPlaceholder:`Search ${t}…`,searchLabel:`Search ${t}`,facetsLabel:`Filter ${t}`,clearLabel:`Clear filters`},onSearch:g.setSearch,onToggleFacet:g.toggleFacet,onToggleGroupFacet:g.toggleGroupFacet,onClear:g.clear}),p!==void 0&&o(Ee,{bulk:p,shown:g.rows.filter(b),targets:C,onSelect:v}),o(x,{columns:y,rows:g.rows,rowKey:e=>e.id,minWidthPx:u?760:860,mobileMode:`scroll`,maxBodyHeight:ne,defaultSort:{columnKey:`created`,dir:`desc`},pageSize:25,paginationLabels:{navLabel:`${t} pages`,previous:`Previous page`,next:`Next page`,range:(e,t,n)=>`${e}–${t} of ${n}`},emptyMessage:g.active?`No ${t} match the filters.`:c,rowClassName:e=>e.status===`revoked`||e.status===`expired`?`opacity-70`:void 0,...p===void 0?{}:{selection:{selected:_,onChange:v,isSelectable:b,rowLabel:e=>`Select ${e.name} (${e.ownerName})`,pageLabel:`Select every ${p.noun.one} on this page`}}})]}):o(S,{title:`Could not load ${t}`,message:s})}function Ee({bulk:e,shown:t,targets:n,onSelect:i}){let{revoke:a,noun:s}=e,u=(e.quickSelect??[]).map(e=>({...e,rows:t.filter(e.match)})).filter(e=>e.rows.length>0),d=async()=>{await a.run(n)&&i(new Set)};return r(`div`,{className:`flex flex-wrap items-center gap-2`,"data-testid":`bulk-bar`,children:[t.length>0&&r(y,{type:`button`,variant:`outline`,size:`sm`,onClick:()=>i(new Set(t.map(e=>e.id))),children:[`Select all `,String(t.length),` shown`]}),u.map(e=>r(y,{type:`button`,variant:`outline`,size:`sm`,onClick:()=>i(new Set(e.rows.map(e=>e.id))),children:[e.label,` (`,String(e.rows.length),`)`]},e.label)),n.length>0&&r(`div`,{className:`ml-auto flex flex-wrap items-center gap-2`,children:[r(`span`,{className:`text-[11px] tabular-nums text-foreground`,"aria-live":`polite`,children:[I(n.length,s),` selected`]}),r(y,{type:`button`,variant:`ghost`,size:`sm`,onClick:()=>i(new Set),children:[o(f,{className:`h-3 w-3`,"aria-hidden":!0}),`Clear selection`]}),r(y,{type:`button`,variant:`danger`,size:`sm`,disabled:a.busy,onClick:()=>void d(),children:[a.busy?o(l,{className:`h-3 w-3 animate-spin`,"aria-hidden":!0}):o(c,{className:`h-3 w-3`,"aria-hidden":!0}),`Revoke `,I(n.length,s),`…`]})]})]})}var B=(e,t)=>t===null?`—`:e.get(t)??t;function V(e,t){return e!=null&&e<=t?`expired`:`active`}function De(e,t,n){return{id:e.id,name:n.client(e.client),detail:e.ip,ownerId:e.userId,ownerName:B(t,e.userId),kind:n.method(e.method),scope:null,status:e.current?`current`:`active`,createdAt:e.createdAt,lastUsedAt:e.lastUsedAt,expiresAt:e.expiresAt}}function Oe(e,t){return{id:e.id,name:e.integrationId,detail:null,ownerId:e.userId,ownerName:e.username,kind:e.integrationId,scope:t,status:e.revokedAt===null?`active`:`revoked`,createdAt:e.createdAt,lastUsedAt:e.lastUsedAt,expiresAt:null}}var ke=`Scoped`,H=`Admin`;function Ae(e,t,n,r,i){return{id:e.id,name:e.name,detail:`${e.tokenPrefix}…`,ownerId:t,ownerName:B(n,t),kind:ke,scope:r,status:V(e.expiresAt,i),createdAt:e.createdAt,lastUsedAt:e.lastUsedAt??null,expiresAt:e.expiresAt??null}}function je(e,t,n){return{id:e.id,name:e.name,detail:`${e.tokenPrefix}…`,ownerId:e.createdBy,ownerName:B(t,e.createdBy),kind:H,scope:`Full administrator`,status:e.revokedAt===null?V(e.expiresAt,n):`revoked`,createdAt:e.createdAt,lastUsedAt:e.lastUsedAt,expiresAt:e.expiresAt}}var Me={"grid-view":`Grid`,"events-view":`Events`};function Ne(e,t){return e.map(e=>t.get(e)??`#${String(e)}`).join(`, `)}function Pe(e,t,n,r){let i=Me[e.scope.kind];return{id:e.id,name:`${i} · ${String(e.scope.deviceIds.length)} camera${e.scope.deviceIds.length===1?``:`s`}`,detail:`${e.tokenPrefix}…`,ownerId:e.userId,ownerName:B(t,e.userId),kind:e.scope.talk===!0?`${i} + talk`:i,scope:Ne(e.scope.deviceIds,n),status:V(e.expiresAt,r),createdAt:e.createdAt,lastUsedAt:e.lastUsedAt??null,expiresAt:e.expiresAt}}function U(e){return`${e.provider}\u0000${e.subject}`}function Fe(e,t){return{id:U(e),name:e.label??e.subject,detail:e.issuer,ownerId:e.userId,ownerName:B(t,e.userId),kind:e.provider,scope:null,status:`active`,createdAt:e.linkedAt,lastUsedAt:null,expiresAt:null}}function Ie(e,t){let n=e.allowedProviders;return{id:e.id,name:e.label,detail:`${e.tokenPrefix}…`,ownerId:e.userId??null,ownerName:B(t,e.userId??null),kind:e.isAdmin===!0?`Admin`:`Regular`,scope:n===void 0||n===`*`?`All providers`:n.join(`, `)||`All providers`,status:`active`,createdAt:e.createdAt??null,lastUsedAt:e.lastUsedAt??null,expiresAt:null}}var W=40,Le=[{test:/Electron\//,name:`CamStack desktop`},{test:/Edg(e|A|iOS)?\//,name:`Edge`},{test:/OPR\/|Opera/,name:`Opera`},{test:/Firefox\/|FxiOS\//,name:`Firefox`},{test:/Chrome\/|CriOS\//,name:`Chrome`},{test:/Version\/[\d.]+.*Safari\//,name:`Safari`}],Re=[{test:/iPhone/,name:`iPhone`},{test:/iPad/,name:`iPad`},{test:/Android/,name:`Android`},{test:/Mac OS X|Macintosh/,name:`macOS`},{test:/Windows/,name:`Windows`},{test:/CrOS/,name:`ChromeOS`},{test:/Linux/,name:`Linux`}],ze=[{test:/CFNetwork\/.*Darwin\//,name:`CamStack app on iOS`},{test:/^okhttp\//i,name:`CamStack app on Android`},{test:/^(node|undici)\b/i,name:`Script (Node.js)`},{test:/^curl\//i,name:`curl`}];function G(e,t){return e.find(e=>e.test.test(t))?.name??null}function Be(e){return e.length<=W?e:`${e.slice(0,W)}…`}function K(e){if(e===null||e.trim().length===0)return{label:`Unknown device`,raw:null};let t=e.trim(),n=G(ze,t);if(n!==null)return{label:n,raw:t};let r=G(Le,t),i=G(Re,t);return r!==null&&i!==null?{label:`${r} on ${i}`,raw:t}:r===null?{label:Be(t),raw:t}:{label:r,raw:t}}var Ve={password:`Password`,passkey:`Passkey`,sso:`Single sign-on`,handoff:`App hand-off`,exchange:`Session exchange`};function q(e){return Ve[e]??e}function J(e){if(e==null)return`—`;let t=new Date(e);return Number.isNaN(t.getTime())?`—`:t.toLocaleString()}n();function Y(e,t){return e instanceof Error&&e.message.length>0?e.message:t}function He(n){let i=p(),[s,c]=a(!1),[u,d]=a(``),[f,m]=a(null),[h,_]=a(null),x=t(null),S=e(e=>{x.current?.(e),x.current=null,c(!1),d(``),m(null),_(null)},[]),C=e(()=>new Promise(e=>{x.current?.(null),x.current=e,_(null),c(!0)}),[]),w=async()=>{m(`password`),_(null);try{let{reauthToken:e}=await i.reauthenticate({password:u});S(e)}catch(e){_(Y(e,`Password is incorrect`)),m(null)}},T=async()=>{m(`passkey`),_(null);try{let{optionsJSON:e}=await i.reauthBeginPasskey(),t=await fe({optionsJSON:e}),{reauthToken:n}=await i.reauthenticate({passkeyResponse:Object.fromEntries(Object.entries(t))});S(n)}catch(e){_(Y(e,`Passkey verification failed`)),m(null)}};return{requestProof:C,dialog:o(te,{open:s,onOpenChange:e=>!e&&S(null),children:r(b,{children:[r(v,{children:[o(ce,{children:`Confirm it’s you`}),r(ee,{children:[n,` needs your password or a passkey, even though you are signed in.`]})]}),r(`form`,{className:`space-y-3`,onSubmit:e=>{e.preventDefault(),u.length>0&&f===null&&w()},children:[o(ie,{type:`password`,autoComplete:`current-password`,placeholder:`Current password`,value:u,onChange:e=>d(e.target.value),"aria-label":`Current password`}),h!==null&&o(`p`,{role:`alert`,className:`text-xs text-danger`,children:h}),r(le,{className:`flex flex-wrap gap-2`,children:[r(y,{type:`button`,variant:`outline`,disabled:f!==null,onClick:()=>void T(),children:[f===`passkey`?o(l,{className:`h-4 w-4 animate-spin`}):o(g,{className:`h-4 w-4`}),`Use a passkey`]}),r(y,{type:`submit`,disabled:u.length===0||f!==null,children:[f===`password`&&o(l,{className:`h-4 w-4 animate-spin`}),`Confirm`]})]})]})]})})}}n();var X={one:`share link`,many:`share links`};function Z(e){let t=oe(),n=D.useUtils(),r=D.auth.listShareTokens.useQuery({owner:e}),o=A(),{data:s}=ue({isCamera:!0,projection:`slim`}),[l,u]=a(null),d=()=>void n.auth.listShareTokens.invalidate(),f=D.auth.revokeShareToken.useMutation({onSuccess:d,onError:e=>u(`Revoke failed: ${e.message}`)}),p=i(()=>{let e=new Map;for(let t of s??[])e.set(t.id,t.name);return e},[s]),m=Date.now(),h=(r.data??[]).map(e=>Pe(e,o,p,m)),g=async e=>{await t({title:`Revoke share link`,message:`Anyone holding this link to ${e.scope??e.name} loses access immediately. This cannot be undone.`,confirmLabel:`Revoke`,variant:`danger`})&&(u(null),f.mutate({id:e.id}))};return{rows:h,refresh:d,error:l,clearError:()=>u(null),isLoading:r.isLoading,loadError:r.isError?r.error?.message??`Request failed`:null,action:{label:`Revoke`,icon:c,isAvailable:()=>!0,onRun:e=>void g(e),busyId:f.isPending?f.variables?.id??null:null,disabled:f.isPending}}}function Ue(){let e=Z(`self`);return o(k,{notice:j(e.error),onDismissNotice:e.clearError,id:`my-share-links`,title:`Share links`,icon:u,description:`View-only links you created in the viewer app to share a grid or the events of some cameras. Revoking a link stops it working everywhere it was sent.`,children:o(z,{rows:e.rows,label:`share links`,isLoading:e.isLoading,loadError:e.loadError,emptyText:`You have no share links.`,hideOwner:!0,action:e.action})})}function We(){let{user:e}=de();return e?.isAdmin?o(Ge,{}):null}function Ge(){let e=Z(`all`),t=R(`share-link`,X,e.refresh);return o(k,{notice:j(e.error,t.outcome),onDismissNotice:()=>{e.clearError(),t.dismiss()},id:`share-links`,title:`Share links`,icon:u,description:`Every user's view-only share links. Revoking one stops it working for whoever it was sent to — a revoked link is deleted and cannot be restored.`,children:o(z,{rows:e.rows,label:`share links`,isLoading:e.isLoading,loadError:e.loadError,emptyText:`No user has any share links.`,action:{...e.action,disabled:e.action.disabled||t.busy},bulk:{revoke:t,noun:X,isSelectable:()=>!0,quickSelect:[{label:`Select expired`,match:e=>e.status===`expired`}]}})})}function Ke({isPending:e,error:t,what:n,onRetry:i,children:a}){return e?r(`div`,{className:`flex items-center gap-2 py-3 text-xs text-foreground-subtle`,role:`status`,"data-testid":`query-pending`,children:[o(l,{className:`h-3.5 w-3.5 animate-spin`,"aria-hidden":!0}),`Reading `,n,`…`]}):t===null?a:o(S,{title:`Could not read ${n}`,message:t.message.length>0?t.message:`Request failed`,onRetry:i})}var qe=864e5,Je={active:`Valid`,expired:`Expired`,revoked:`Revoked`},Ye={active:`success`,expired:`warning`,revoked:`default`},Xe={active:0,expired:1,revoked:2},Ze={qr:`QR (by an admin)`,self:`Self-enrolled`},Qe={ios:`iOS`,android:`Android`,web:`Web`,other:`Other`};function $e(e){return e.status===`revoked`}function et(e){return e.status!==`revoked`}function tt(e,t=`—`){if(e===null)return t;let n=new Date(e);return Number.isNaN(n.getTime())?t:n.toLocaleString()}function Q(e,t){return e===null||Number.isNaN(e)?null:Math.floor((e-t)/qe)}function nt(e,t){let n=Q(e,t);return n===null?`unknown`:n<0?`expired`:n<30?`soon`:`ok`}function rt(e,t){let n=Q(e,t);if(n===null)return`Unknown`;if(n===0)return`today`;if(n>0)return`in ${String(n)} day${n===1?``:`s`}`;let r=-n;return`${String(r)} day${r===1?``:`s`} ago`}function it(e){if(e===null)return null;let t=Date.parse(e);return Number.isNaN(t)?null:t}function at(e){return e===null||e.length===0?`—`:e.length<=17?e:`${e.slice(0,8)}…${e.slice(-8)}`}function $(e){return e.length<=10?e:`${e.slice(0,10)}…`}function ot(e){if(!e.online)return{allowed:!1,reason:`The node is offline - it cannot be renewed now.`};if(e.isHub&&e.https.kind===`served`){if(e.https.status.mode===`uploaded`)return{allowed:!1,reason:`This certificate was uploaded by an operator. Replace it where it was uploaded (Network → Local access), or revert to the generated one there.`};if(e.https.status.mode===`disabled`)return{allowed:!1,reason:`TLS is disabled on the hub - there is no certificate.`}}return{allowed:!0,reason:null}}var st={prepare:`asking the node for a key`,issue:`issuing the new certificate`,install:`installing it on the node`,reconnect:`waiting for the node to reconnect`,confirm:`confirming the node presents the new certificate`};function ct(e){if(e.ok)return{tone:`success`,message:`${e.nodeId}: new cluster certificate ${$(e.newSerial)} installed; the previous one was revoked.`};let t=e.keptPreviousLeaf?`The node keeps its previous certificate - nothing was broken.`:`The node may be without a valid certificate: check it and renew again.`;return{tone:`danger`,message:`${e.nodeId}: renewal failed while ${st[e.stage]} - ${e.reason}. ${t}`}}function lt(e,t){let n=Math.max(0,e-t),r=Math.ceil(n/1e3),i=Math.floor(r/60),a=r%60;return{expired:n===0,label:`${String(i)}:${String(a).padStart(2,`0`)}`}}function ut({sessions:e,isLoading:t,loadError:n,emptyText:i,onRevoke:a,revokingId:s}){return t?r(`div`,{className:`flex items-center gap-2 text-xs text-foreground-subtle`,children:[o(l,{className:`h-3.5 w-3.5 animate-spin`}),`Loading sessions…`]}):n===null?e.length===0?o(`div`,{className:`rounded border border-dashed border-border px-3 py-4 text-xs text-foreground-subtle text-center`,children:i}):o(`ul`,{className:`divide-y divide-border rounded-md border border-border`,children:e.map(e=>o(dt,{session:e,revoking:s===e.id,onRevoke:()=>a(e)},e.id))}):r(`div`,{className:`text-[11px] text-danger`,children:[`Could not load sessions: `,n]})}function dt({session:e,revoking:t,onRevoke:n}){let i=K(e.client);return r(`li`,{"data-testid":`session-row`,className:`flex items-start gap-3 px-3 py-2 text-xs`,children:[o(m,{className:`h-3.5 w-3.5 mt-0.5 shrink-0 text-foreground-subtle`}),r(`div`,{className:`flex-1 min-w-0 space-y-0.5`,children:[r(`div`,{className:`flex flex-wrap items-center gap-1.5`,children:[o(`span`,{className:`font-medium text-foreground truncate`,title:i.raw??void 0,children:i.label}),e.current&&o(`span`,{className:`rounded bg-primary/10 px-1.5 py-0.5 text-[10px] font-medium text-primary`,children:`This device`})]}),r(`div`,{className:`flex flex-wrap gap-x-3 text-[11px] text-foreground-subtle`,children:[o(`span`,{children:q(e.method)}),o(`span`,{className:`font-mono`,children:e.ip??`IP unknown`}),r(`span`,{children:[`Last active `,J(e.lastUsedAt)]}),r(`span`,{children:[`Expires `,J(e.expiresAt)]})]})]}),!e.current&&r(`button`,{onClick:n,disabled:t,className:`inline-flex items-center gap-1 rounded px-2 py-1 text-[10px] text-danger hover:bg-danger/10 disabled:opacity-50`,children:[t?o(l,{className:`h-3 w-3 animate-spin`}):o(h,{className:`h-3 w-3`}),`Sign out`]})]})}export{Oe as A,q as C,Ie as D,je as E,xe as F,k as I,j as L,Ae as M,z as N,U as O,R as P,A as R,K as S,H as T,$ as _,Ze as a,Ue as b,et as c,rt as d,ct as f,at as g,ot as h,Ye as i,De as j,Fe as k,lt as l,tt as m,Je as n,Qe as o,nt as p,Xe as r,$e as s,ut as t,it as u,Ke as v,J as w,He as x,We as y};

package/dist/assets/circle-slash-DdZfDqQG.js

@@ -1 +0,0 @@
-import{$i as e}from"./player-overlays-Bthpd_DK.js";var t=e(`circle-slash`,[[`circle`,{cx:`12`,cy:`12`,r:`10`,key:`1mglay`}],[`line`,{x1:`9`,x2:`15`,y1:`15`,y2:`9`,key:`1dfufj`}]]);export{t};