@classic-homes/auth 1.22.1 → 1.23.0

package/dist/auth.svelte-T4LKTTDZ.js

@@ -0,0 +1,3 @@
+export { authActions, authStore, currentUser, isAuthenticated } from './chunk-KSOYQYUZ.js';
+import './chunk-ETKDIPD2.js';
+import './chunk-2CYGQUUY.js';

package/dist/{chunk-PYCXNOMA.js → chunk-2CYGQUUY.js}

@@ -96,7 +96,13 @@ function isValidRedirectUrl(url) {
       return false;
     }
   } catch {
-    return !url.includes("://") && !url.startsWith("//");
+    if (url.includes("://") || url.startsWith("//")) return false;
+    try {
+      const sentinel = "https://relative.invalid";
+      return new URL(url, sentinel).origin === sentinel;
+    } catch {
+      return false;
+    }
   }
 }
 
@@ -108,8 +114,9 @@ function decodeJWT(token) {
       return null;
     }
     const payload = parts[1];
-    const decoded = atob(payload.replace(/-/g, "+").replace(/_/g, "/"));
-    return JSON.parse(decoded);
+    const binary = atob(payload.replace(/-/g, "+").replace(/_/g, "/"));
+    const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));
+    return JSON.parse(new TextDecoder().decode(bytes));
   } catch {
     return null;
   }
@@ -174,6 +181,7 @@ var ROLE_NAMES = [
   "stormwater_staff",
   "warranty_staff",
   "hotsheet_editor",
+  "office_admin",
   "employee",
   "user",
   "vendor",
@@ -188,7 +196,8 @@ var ROLE_HIERARCHY = {
   customer: 1,
   subcontractor: 1,
   // Staff tier (2): the read-only `employee` floor, the field-app clones of
-  // `agent`, every `<department>_staff` docs role, and `hotsheet_editor`.
+  // `agent`, every `<department>_staff` docs role, `hotsheet_editor` and
+  // `office_admin`.
   employee: 2,
   agent: 2,
   builder: 2,
@@ -209,6 +218,7 @@ var ROLE_HIERARCHY = {
   stormwater_staff: 2,
   warranty_staff: 2,
   hotsheet_editor: 2,
+  office_admin: 2,
   manager: 3,
   admin: 4
 };

package/dist/{chunk-S5LHUKA5.js → chunk-DFCBWKCU.js}

@@ -1,5 +1,5 @@
-import { authApi } from './chunk-LFNG4XAP.js';
-import { getUserRoles, hasAnyRole } from './chunk-PYCXNOMA.js';
+import { authApi } from './chunk-ETKDIPD2.js';
+import { getUserRoles, hasAnyRole } from './chunk-2CYGQUUY.js';
 
 // src/core/guards.ts
 function isMfaChallengeResponse(response) {
@@ -59,7 +59,7 @@ var AuthService = class {
     }
     if (options?.autoSetAuth !== false && !isMfaChallengeResponse(response)) {
       try {
-        const { authStore } = await import('./auth.svelte-64QCTV2B.js');
+        const { authStore } = await import('./auth.svelte-T4LKTTDZ.js');
         authStore.setAuth(
           response.accessToken,
           response.refreshToken,
@@ -245,7 +245,7 @@ var AuthService = class {
     }
     if (options?.autoSetAuth !== false) {
       try {
-        const { authStore } = await import('./auth.svelte-64QCTV2B.js');
+        const { authStore } = await import('./auth.svelte-T4LKTTDZ.js');
         authStore.setAuth(
           response.accessToken,
           response.refreshToken,

package/dist/{chunk-LFNG4XAP.js → chunk-ETKDIPD2.js}

@@ -1,4 +1,4 @@
-import { getConfig, getStorage, isTokenExpired, getFetch, isValidRedirectUrl } from './chunk-PYCXNOMA.js';
+import { getConfig, getStorage, isTokenExpired, getFetch, isValidRedirectUrl } from './chunk-2CYGQUUY.js';
 
 // src/core/client.ts
 var DEFAULT_REFRESH_RETRY_DELAYS = [1e3, 3e3];
@@ -58,7 +58,7 @@ function writeStoredTokens(accessToken, refreshToken) {
 }
 async function syncSvelteStore(apply) {
   try {
-    const { authStore } = await import('./auth.svelte-64QCTV2B.js');
+    const { authStore } = await import('./auth.svelte-T4LKTTDZ.js');
     apply(authStore);
   } catch {
   }
@@ -164,6 +164,12 @@ async function runRefresh(options) {
       attempt = await refreshOnce(current);
     }
     if (attempt.outcome === "refreshed") {
+      const stored = getRefreshToken();
+      if (stored !== current) {
+        if (!stored) return "rejected";
+        await syncSvelteStore((authStore) => authStore.rehydrate());
+        return "refreshed";
+      }
       await writeStoredTokens(attempt.accessToken, attempt.refreshToken);
       return "refreshed";
     }
@@ -202,11 +208,12 @@ async function apiRequestInternal(endpoint, options, isRetry) {
   const timeoutMs = timeout ?? config.requestTimeout ?? 3e4;
   const controller = new AbortController();
   const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
+  const onCallerAbort = () => controller.abort();
   if (signal) {
     if (signal.aborted) {
       controller.abort();
     } else {
-      signal.addEventListener("abort", () => controller.abort(), { once: true });
+      signal.addEventListener("abort", onCallerAbort, { once: true });
     }
   }
   const headers = {
@@ -290,12 +297,15 @@ async function apiRequestInternal(endpoint, options, isRetry) {
   } catch (error) {
     clearTimeout(timeoutId);
     if (error instanceof DOMException && error.name === "AbortError") {
+      if (signal?.aborted) throw error;
       throw new Error(`Request timed out after ${timeoutMs}ms`);
     }
     if (error instanceof Error) {
       throw error;
     }
     throw new Error("API request failed");
+  } finally {
+    signal?.removeEventListener("abort", onCallerAbort);
   }
 }
 function initCrossTabSync() {
@@ -496,7 +506,7 @@ var authApi = {
    * Revoke a specific session.
    */
   async revokeSession(sessionId) {
-    await api.delete(`/auth/sessions/${sessionId}`, true);
+    await api.delete(`/auth/sessions/${encodeURIComponent(sessionId)}`, true);
   },
   /**
    * Revoke all sessions except the current one.
@@ -525,13 +535,13 @@ var authApi = {
    * Revoke an API key.
    */
   async revokeApiKey(keyId) {
-    await api.delete(`/auth/api-keys/${keyId}`, true);
+    await api.delete(`/auth/api-keys/${encodeURIComponent(keyId)}`, true);
   },
   /**
    * Update an API key's name, description, role, or permissions.
    */
   async updateApiKey(keyId, data) {
-    await api.put(`/auth/api-keys/${keyId}`, data, true);
+    await api.put(`/auth/api-keys/${encodeURIComponent(keyId)}`, data, true);
   },
   // ============================================================================
   // MFA Management
@@ -616,19 +626,19 @@ var authApi = {
    * Trust a device.
    */
   async trustDevice(deviceId) {
-    await api.put(`/auth/devices/${deviceId}/trust`, {}, true);
+    await api.put(`/auth/devices/${encodeURIComponent(deviceId)}/trust`, {}, true);
   },
   /**
    * Revoke device trust.
    */
   async revokeDevice(deviceId) {
-    await api.delete(`/auth/devices/${deviceId}/revoke`, true);
+    await api.delete(`/auth/devices/${encodeURIComponent(deviceId)}/revoke`, true);
   },
   /**
    * Remove a device completely.
    */
   async removeDevice(deviceId) {
-    await api.delete(`/auth/devices/${deviceId}`, true);
+    await api.delete(`/auth/devices/${encodeURIComponent(deviceId)}`, true);
   },
   /**
    * Approve a device with a token.
@@ -773,7 +783,7 @@ var authApi = {
    */
   async getUserRoles(userId, customFetch) {
     const response = await api.get(
-      `/users/${userId}/roles`,
+      `/users/${encodeURIComponent(userId)}/roles`,
       true,
       customFetch
     );
@@ -787,7 +797,7 @@ var authApi = {
    */
   async grantUserRole(userId, role) {
     const response = await api.put(
-      `/users/${userId}/roles/${role}`,
+      `/users/${encodeURIComponent(userId)}/roles/${encodeURIComponent(role)}`,
       {},
       true
     );
@@ -802,7 +812,7 @@ var authApi = {
    */
   async revokeUserRole(userId, role) {
     const response = await api.delete(
-      `/users/${userId}/roles/${role}`,
+      `/users/${encodeURIComponent(userId)}/roles/${encodeURIComponent(role)}`,
       true
     );
     return extractData(response);
@@ -815,7 +825,11 @@ var authApi = {
    * Use {@link grantUserRole} / {@link revokeUserRole} for additive changes.
    */
   async setUserRoles(userId, roles) {
-    const response = await api.put(`/users/${userId}`, { roles }, true);
+    const response = await api.put(
+      `/users/${encodeURIComponent(userId)}`,
+      { roles },
+      true
+    );
     return extractData(response);
   }
 };

package/dist/{chunk-B6MOGO74.js → chunk-KSOYQYUZ.js}

@@ -1,5 +1,5 @@
-import { authApi } from './chunk-LFNG4XAP.js';
-import { isInitialized, getConfig, hasRole, hasAnyRole, hasAllRoles, decodeJWT, getStorage, getDefaultStorage } from './chunk-PYCXNOMA.js';
+import { authApi } from './chunk-ETKDIPD2.js';
+import { isInitialized, getConfig, hasRole, hasAnyRole, hasAllRoles, decodeJWT, getStorage, getDefaultStorage } from './chunk-2CYGQUUY.js';
 
 // src/svelte/stores/auth.svelte.ts
 var STORAGE_VERSION = 2;
@@ -115,8 +115,12 @@ var AuthStore = class {
       isAuthenticated: true
     };
     saveAuthToStorage(this.state);
-    if (sessionToken && typeof window !== "undefined") {
-      getStorageAdapter().setItem(getSessionTokenKey(), sessionToken);
+    if (typeof window !== "undefined") {
+      if (sessionToken) {
+        getStorageAdapter().setItem(getSessionTokenKey(), sessionToken);
+      } else {
+        getStorageAdapter().removeItem(getSessionTokenKey());
+      }
     }
     if (typeof window !== "undefined") {
       window.dispatchEvent(

package/dist/{chunk-WHNMH73M.js → chunk-NLG6NSE4.js}

@@ -1,6 +1,6 @@
-import { authService } from './chunk-S5LHUKA5.js';
-import { authStore, currentUser, isAuthenticated, authActions } from './chunk-B6MOGO74.js';
-import { isInitialized, initAuth, getUserRoles } from './chunk-PYCXNOMA.js';
+import { authService } from './chunk-DFCBWKCU.js';
+import { authStore, currentUser, isAuthenticated, authActions } from './chunk-KSOYQYUZ.js';
+import { isInitialized, initAuth, getUserRoles } from './chunk-2CYGQUUY.js';
 
 // src/svelte/guards/auth-guard.ts
 function checkAuth(options = {}) {
@@ -170,12 +170,14 @@ function createAuthHook(options = {}) {
     onUnauthenticated,
     onAuthCheck
   } = options;
+  const loginPathname = new URL(loginPath, "http://localhost").pathname.replace(/(.)\/+$/, "$1");
   return async ({
     event,
     resolve
   }) => {
     const { pathname } = event.url;
-    const isPublic = publicRoutes.some((r) => r.test(pathname));
+    const isLoginPage = pathname.replace(/(.)\/+$/, "$1") === loginPathname;
+    const isPublic = isLoginPage || publicRoutes.some((r) => r.test(pathname));
     if (isPublic) {
       return resolve(event);
     }
@@ -195,9 +197,8 @@ function createAuthHook(options = {}) {
       if (onUnauthenticated) {
         return onUnauthenticated(event);
       }
-      const redirectUrl = encodeURIComponent(pathname + event.url.search);
       const loginUrl = new URL(loginPath, event.url.origin);
-      loginUrl.searchParams.set(redirectParam, redirectUrl);
+      loginUrl.searchParams.set(redirectParam, pathname + event.url.search);
       return new Response(null, {
         status: 302,
         headers: { Location: loginUrl.pathname + loginUrl.search }
@@ -209,6 +210,9 @@ function createAuthHook(options = {}) {
 function matchesRoute(pathname, patterns) {
   return patterns.some((pattern) => pattern.test(pathname));
 }
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&");
+}
 var routePatterns = {
   /** Match all /auth/* routes */
   auth: /^\/auth\//,
@@ -225,15 +229,16 @@ var routePatterns = {
   /** Match health check endpoints */
   health: /^\/(api\/)?(health|healthz|ready|live)\/?$/,
   /**
-   * Create a pattern for a specific path prefix.
+   * Create a pattern for a specific path prefix. Matches whole path segments:
+   * '/admin' matches '/admin' and '/admin/users' but not '/administrator'.
    * @param prefix - Path prefix (e.g., '/dashboard')
    */
-  prefix: (prefix) => new RegExp(`^${prefix.replace(/\//g, "\\/")}`),
+  prefix: (prefix) => new RegExp(`^${escapeRegExp(prefix)}${prefix.endsWith("/") ? "" : "(?:/|$)"}`),
   /**
    * Create a pattern for exact path match.
    * @param path - Exact path (e.g., '/about')
    */
-  exact: (path) => new RegExp(`^${path.replace(/\//g, "\\/")}$`)
+  exact: (path) => new RegExp(`^${escapeRegExp(path)}$`)
 };
 
 export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns };

package/dist/core/index.d.ts

@@ -532,7 +532,9 @@ declare function extractClaims<T extends string>(token: string, claims: T[]): Pi
  * `<department>_staff` roles are grant-on-top docs roles held alongside another
  * role, one per department the API lists in `DEPARTMENT_SCOPES`;
  * `hotsheet_editor` is a grant-on-top role for the Hotsheet hub's write
- * surface; `employee` is the read-only base staff
+ * surface; `office_admin` is a grant-on-top role for the office
+ * administrative assistant (home closing & financing fields, permits, walks,
+ * lenders); `employee` is the read-only base staff
  * floor (default for Authentik SSO); `vendor`/`customer`/`subcontractor` are
  * clones of `user`, row-scoped to their own homes.
  *
@@ -540,7 +542,7 @@ declare function extractClaims<T extends string>(token: string, claims: T[]): Pi
  * field app's clone of `agent`, the second is that department's docs role.
  * Someone on the stormwater team who also reads the docs holds both.
  */
-declare const ROLE_NAMES: readonly ["admin", "manager", "agent", "builder", "customer_service", "demo", "stormwater", "accounting_staff", "architecture_staff", "construction_staff", "crl_staff", "design_staff", "hr_staff", "it_staff", "landdev_staff", "marketing_staff", "purchasing_staff", "sales_staff", "stormwater_staff", "warranty_staff", "hotsheet_editor", "employee", "user", "vendor", "customer", "subcontractor", "guest"];
+declare const ROLE_NAMES: readonly ["admin", "manager", "agent", "builder", "customer_service", "demo", "stormwater", "accounting_staff", "architecture_staff", "construction_staff", "crl_staff", "design_staff", "hr_staff", "it_staff", "landdev_staff", "marketing_staff", "purchasing_staff", "sales_staff", "stormwater_staff", "warranty_staff", "hotsheet_editor", "office_admin", "employee", "user", "vendor", "customer", "subcontractor", "guest"];
 /**
  * A known role name.
  *

package/dist/core/index.js

@@ -1,3 +1,3 @@
-export { AuthService, RoleDeniedError, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse, isRoleDeniedError } from '../chunk-S5LHUKA5.js';
-export { api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, refreshSession, updateStoredTokens } from '../chunk-LFNG4XAP.js';
-export { ROLE_HIERARCHY, ROLE_NAMES, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isInitialized, isTokenExpired, resetConfig } from '../chunk-PYCXNOMA.js';
+export { AuthService, RoleDeniedError, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse, isRoleDeniedError } from '../chunk-DFCBWKCU.js';
+export { api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, refreshSession, updateStoredTokens } from '../chunk-ETKDIPD2.js';
+export { ROLE_HIERARCHY, ROLE_NAMES, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isInitialized, isTokenExpired, resetConfig } from '../chunk-2CYGQUUY.js';

package/dist/index.js

@@ -1,5 +1,5 @@
-export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './chunk-WHNMH73M.js';
-export { AuthService, RoleDeniedError, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse, isRoleDeniedError } from './chunk-S5LHUKA5.js';
-export { authActions, authStore, currentUser, isAuthenticated } from './chunk-B6MOGO74.js';
-export { api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, refreshSession, updateStoredTokens } from './chunk-LFNG4XAP.js';
-export { ROLE_HIERARCHY, ROLE_NAMES, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isInitialized, isTokenExpired, resetConfig } from './chunk-PYCXNOMA.js';
+export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './chunk-NLG6NSE4.js';
+export { AuthService, RoleDeniedError, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse, isRoleDeniedError } from './chunk-DFCBWKCU.js';
+export { authActions, authStore, currentUser, isAuthenticated } from './chunk-KSOYQYUZ.js';
+export { api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, refreshSession, updateStoredTokens } from './chunk-ETKDIPD2.js';
+export { ROLE_HIERARCHY, ROLE_NAMES, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isInitialized, isTokenExpired, resetConfig } from './chunk-2CYGQUUY.js';

package/dist/svelte/index.d.ts

@@ -584,7 +584,9 @@ type Handle = (input: {
  */
 interface AuthHookOptions {
     /**
-     * Path to redirect unauthenticated users.
+     * Path to redirect unauthenticated users. This exact path is always public
+     * (to avoid a redirect loop); paths below it are not, so list e.g. an SSO
+     * callback under it in publicRoutes if it must be reachable signed out.
      * @default '/login'
      */
     loginPath?: string;
@@ -709,7 +711,8 @@ declare const routePatterns: {
     /** Match health check endpoints */
     health: RegExp;
     /**
-     * Create a pattern for a specific path prefix.
+     * Create a pattern for a specific path prefix. Matches whole path segments:
+     * '/admin' matches '/admin' and '/admin/users' but not '/administrator'.
      * @param prefix - Path prefix (e.g., '/dashboard')
      */
     prefix: (prefix: string) => RegExp;

package/dist/svelte/index.js

@@ -1,5 +1,5 @@
-export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from '../chunk-WHNMH73M.js';
-export { RoleDeniedError, formatUserRoles, getAvatarFallback, getDisplayName, getGreeting, getUserEmail, getUserInitials, isRoleDeniedError } from '../chunk-S5LHUKA5.js';
-export { authActions, authStore, currentUser, isAuthenticated } from '../chunk-B6MOGO74.js';
-import '../chunk-LFNG4XAP.js';
-export { initAuth, isInitialized } from '../chunk-PYCXNOMA.js';
+export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from '../chunk-NLG6NSE4.js';
+export { RoleDeniedError, formatUserRoles, getAvatarFallback, getDisplayName, getGreeting, getUserEmail, getUserInitials, isRoleDeniedError } from '../chunk-DFCBWKCU.js';
+export { authActions, authStore, currentUser, isAuthenticated } from '../chunk-KSOYQYUZ.js';
+import '../chunk-ETKDIPD2.js';
+export { initAuth, isInitialized } from '../chunk-2CYGQUUY.js';

package/dist/testing/index.js

@@ -1,4 +1,4 @@
-import { hasRole, hasAnyRole, hasAllRoles, initAuth, resetConfig, getUserRoles, isTokenExpired, decodeJWT } from '../chunk-PYCXNOMA.js';
+import { hasRole, hasAnyRole, hasAllRoles, initAuth, resetConfig, getUserRoles, isTokenExpired, decodeJWT } from '../chunk-2CYGQUUY.js';
 
 // src/testing/fixtures/users.ts
 var mockUser = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@classic-homes/auth",
-  "version": "1.22.1",
+  "version": "1.23.0",
   "description": "Authentication services and Svelte bindings for Classic Theme apps",
   "type": "module",
   "main": "dist/index.js",

package/dist/auth.svelte-64QCTV2B.js

@@ -1,3 +0,0 @@
-export { authActions, authStore, currentUser, isAuthenticated } from './chunk-B6MOGO74.js';
-import './chunk-LFNG4XAP.js';
-import './chunk-PYCXNOMA.js';