@camstack/addon-auth 1.2.139 → 1.2.141

package/dist/{dist-CiG_dP05.js → dist-CBTStyBW.js}

@@ -13751,7 +13751,14 @@ var BrokerProviderInfoSchema = object({
 	/** Broker kinds this provider can create, with a display label. */
 	kinds: array(object({
 		kind: string(),
-		label: string()
+		label: string(),
+		/**
+		* Relative hub path to start an interactive account link (OAuth popup).
+		* May include `{{brokerId}}`; admin-ui substitutes and appends `?popup=1`.
+		*/
+		interactiveConnectPath: string().min(1).optional(),
+		/** Relative hub path to disconnect the linked account (same popup pattern). */
+		interactiveDisconnectPath: string().min(1).optional()
 	}))
 });
 var ListInputSchema = object({ 

package/dist/{dist-BOK-Ox5c.mjs → dist-CZ3P7blB.mjs}

@@ -13717,7 +13717,14 @@ var BrokerProviderInfoSchema = object({
 	/** Broker kinds this provider can create, with a display label. */
 	kinds: array(object({
 		kind: string(),
-		label: string()
+		label: string(),
+		/**
+		* Relative hub path to start an interactive account link (OAuth popup).
+		* May include `{{brokerId}}`; admin-ui substitutes and appends `?popup=1`.
+		*/
+		interactiveConnectPath: string().min(1).optional(),
+		/** Relative hub path to disconnect the linked account (same popup pattern). */
+		interactiveDisconnectPath: string().min(1).optional()
 	}))
 });
 var ListInputSchema = object({ 

package/dist/oidc/auth-oidc.addon.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-CiG_dP05.js");
+const require_dist = require("../dist-CBTStyBW.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_dist.__toESM(node_crypto);
 //#region ../../node_modules/jose/dist/webapi/lib/buffer_utils.js
@@ -709,6 +709,7 @@ var DEFAULT_OIDC_ICON = "shield-check";
 var OIDC_CONNECTION_FORM_SCHEMA = { sections: [{
 	id: "identity",
 	title: "Identity",
+	columns: 2,
 	fields: [{
 		type: "text",
 		key: "displayName",
@@ -725,6 +726,7 @@ var OIDC_CONNECTION_FORM_SCHEMA = { sections: [{
 }, {
 	id: "idp",
 	title: "Identity provider",
+	columns: 2,
 	fields: [
 		{
 			type: "text",
@@ -1154,10 +1156,13 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 			},
 			deleteConnection: async (input) => {
 				if (findOidcProvider(this.config, input.id) === null) throw new Error(`Unknown OIDC connection "${input.id}"`);
+				await this.updateGlobalSettings({ providers: this.config.providers.map((p) => p.id === input.id ? {
+					...p,
+					clientSecret: require_dist.SECRET_CLEAR
+				} : p) });
 				const result = deleteOidcConnection(this.config, input.id);
 				if (!result.ok) throw new Error(`Unknown OIDC connection "${input.id}"`);
 				await this.updateGlobalSettings(result.config);
-				await this.clearSecrets([`providers[${input.id}].clientSecret`]);
 				this.rebuildInstances();
 				return { ok: true };
 			}
@@ -1358,6 +1363,8 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 		const inst = this.instances.get(providerId);
 		if (!inst) throw new Error(`OIDC: provider "${providerId}" no longer configured`);
 		const doc = await this.getDiscovery(providerId);
+		const clientSecret = inst.config.clientSecret;
+		if (typeof clientSecret !== "string" || clientSecret.length === 0) throw new Error(`OIDC: client secret for "${providerId}" is unavailable`);
 		const tokenRes = await fetch(doc.token_endpoint, {
 			method: "POST",
 			headers: {
@@ -1369,7 +1376,7 @@ var AuthOidcAddon = class extends require_dist.BaseAddon {
 				code,
 				redirect_uri: pending.redirectUri,
 				client_id: inst.config.clientId,
-				client_secret: inst.config.clientSecret,
+				client_secret: clientSecret,
 				code_verifier: pending.codeVerifier
 			})
 		});

package/dist/oidc/auth-oidc.addon.mjs

@@ -1,4 +1,4 @@
-import { _ as toSecretFieldView, a as buildAddonRouteProvider, c as oidcConnectionsCapability, d as BaseAddon, f as SECRET_CLEAR, g as isSecretMarker, h as isSecretClear, i as authProviderCapability, m as globalSecretScope, n as addonRoutesCapability, o as isDisplayIconKey, p as arrayItemFieldPath, s as loginMethodCapability, t as SSO_STATE_COOKIE, u as errMsg } from "../dist-BOK-Ox5c.mjs";
+import { _ as toSecretFieldView, a as buildAddonRouteProvider, c as oidcConnectionsCapability, d as BaseAddon, f as SECRET_CLEAR, g as isSecretMarker, h as isSecretClear, i as authProviderCapability, m as globalSecretScope, n as addonRoutesCapability, o as isDisplayIconKey, p as arrayItemFieldPath, s as loginMethodCapability, t as SSO_STATE_COOKIE, u as errMsg } from "../dist-CZ3P7blB.mjs";
 import * as crypto$1 from "node:crypto";
 //#region ../../node_modules/jose/dist/webapi/lib/buffer_utils.js
 var encoder = new TextEncoder(), decoder = new TextDecoder(), strictDecoder = new TextDecoder("utf-8", { fatal: !0 });
@@ -704,6 +704,7 @@ var DEFAULT_OIDC_ICON = "shield-check";
 var OIDC_CONNECTION_FORM_SCHEMA = { sections: [{
 	id: "identity",
 	title: "Identity",
+	columns: 2,
 	fields: [{
 		type: "text",
 		key: "displayName",
@@ -720,6 +721,7 @@ var OIDC_CONNECTION_FORM_SCHEMA = { sections: [{
 }, {
 	id: "idp",
 	title: "Identity provider",
+	columns: 2,
 	fields: [
 		{
 			type: "text",
@@ -1149,10 +1151,13 @@ var AuthOidcAddon = class extends BaseAddon {
 			},
 			deleteConnection: async (input) => {
 				if (findOidcProvider(this.config, input.id) === null) throw new Error(`Unknown OIDC connection "${input.id}"`);
+				await this.updateGlobalSettings({ providers: this.config.providers.map((p) => p.id === input.id ? {
+					...p,
+					clientSecret: SECRET_CLEAR
+				} : p) });
 				const result = deleteOidcConnection(this.config, input.id);
 				if (!result.ok) throw new Error(`Unknown OIDC connection "${input.id}"`);
 				await this.updateGlobalSettings(result.config);
-				await this.clearSecrets([`providers[${input.id}].clientSecret`]);
 				this.rebuildInstances();
 				return { ok: true };
 			}
@@ -1353,6 +1358,8 @@ var AuthOidcAddon = class extends BaseAddon {
 		const inst = this.instances.get(providerId);
 		if (!inst) throw new Error(`OIDC: provider "${providerId}" no longer configured`);
 		const doc = await this.getDiscovery(providerId);
+		const clientSecret = inst.config.clientSecret;
+		if (typeof clientSecret !== "string" || clientSecret.length === 0) throw new Error(`OIDC: client secret for "${providerId}" is unavailable`);
 		const tokenRes = await fetch(doc.token_endpoint, {
 			method: "POST",
 			headers: {
@@ -1364,7 +1371,7 @@ var AuthOidcAddon = class extends BaseAddon {
 				code,
 				redirect_uri: pending.redirectUri,
 				client_id: inst.config.clientId,
-				client_secret: inst.config.clientSecret,
+				client_secret: clientSecret,
 				code_verifier: pending.codeVerifier
 			})
 		});

package/dist/webauthn/{_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-WMEN28JY.mjs → _virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-Cp81tyGI.mjs}

@@ -18,7 +18,7 @@ var e = {
 	},
 	"@camstack/types": {
 		name: "@camstack/types",
-		version: "1.2.350",
+		version: "1.2.351",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",
@@ -33,7 +33,7 @@ var e = {
 	},
 	"@camstack/ui-library": {
 		name: "@camstack/ui-library",
-		version: "1.2.277",
+		version: "1.2.279",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_auth_webauthn_widgets",

package/dist/webauthn/auth-webauthn.addon.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-CiG_dP05.js");
+const require_dist = require("../dist-CBTStyBW.js");
 let stream = require("stream");
 stream = require_dist.__toESM(stream, 1);
 let http = require("http");

package/dist/webauthn/auth-webauthn.addon.mjs

@@ -1,4 +1,4 @@
-import { S as string, b as number, d as BaseAddon, l as userPasskeysCapability, r as addonWidgetsSourceCapability, s as loginMethodCapability, v as array, x as object, y as boolean } from "../dist-BOK-Ox5c.mjs";
+import { S as string, b as number, d as BaseAddon, l as userPasskeysCapability, r as addonWidgetsSourceCapability, s as loginMethodCapability, v as array, x as object, y as boolean } from "../dist-CZ3P7blB.mjs";
 import { createRequire } from "node:module";
 import Stream from "stream";
 import http from "http";

package/dist/webauthn/{hostInit-B3K6bvzW.mjs → hostInit-COK9XKtP.mjs}

@@ -36,7 +36,7 @@ async function r() {
 				}
 			},
 			"@camstack/types": {
-				version: "1.2.350",
+				version: "1.2.351",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,
@@ -81,7 +81,7 @@ async function r() {
 				}
 			},
 			"@camstack/ui-library": {
-				version: "1.2.277",
+				version: "1.2.279",
 				scope: "default",
 				shareConfig: {
 					singleton: !0,

package/dist/webauthn/remoteEntry.js

@@ -30,7 +30,7 @@ async function d(e) {
 	}
 }
 async function f() {
-	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-WMEN28JY.mjs")).catch((e) => {
+	return l ||= d(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_auth_webauthn_widgets-Cp81tyGI.mjs")).catch((e) => {
 		throw l = void 0, e;
 	}), l;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-auth",
-  "version": "1.2.139",
+  "version": "1.2.141",
   "description": "Authentication bundle — OIDC and WebAuthn/passkey. Multi-entry npm package shipping 2 addons under a single bundle; each addon keeps its own id, capabilities, and runner.",
   "keywords": [
     "camstack",