@classic-homes/auth 1.22.2 → 1.27.0

package/dist/auth.svelte-WROD55FW.js

@@ -0,0 +1,3 @@
+export { authActions, authStore, currentUser, isAuthenticated } from './chunk-POOONCPP.js';
+import './chunk-FEKQXUPJ.js';
+import './chunk-K6TV3ZVS.js';

package/dist/{chunk-2LRLMSOH.js → chunk-C2UTC5B7.js}

@@ -1,12 +1,12 @@
-import { authApi } from './chunk-SUW4DKKS.js';
-import { getUserRoles, hasAnyRole } from './chunk-UJAJO5QJ.js';
+import { authApi, InvalidAuthResponseError, RoleDeniedError } from './chunk-FEKQXUPJ.js';
+import { hasAnyRole, getUserRoles } from './chunk-K6TV3ZVS.js';
 
 // src/core/guards.ts
 function isMfaChallengeResponse(response) {
   return "requiresMFA" in response && response.requiresMFA === true || "mfaRequired" in response && response.mfaRequired === true;
 }
 function isLoginSuccessResponse(response) {
-  return "accessToken" in response && "user" in response && !isMfaChallengeResponse(response);
+  return typeof response?.accessToken === "string" && response.accessToken !== "" && typeof response.user === "object" && response.user !== null && !isMfaChallengeResponse(response);
 }
 function getMfaToken(response) {
   return response.mfaToken ?? response.mfaChallengeToken;
@@ -15,27 +15,16 @@ function getAvailableMethods(response) {
   return response.availableMethods ?? ["totp"];
 }
 
-// src/core/errors.ts
-var RoleDeniedError = class _RoleDeniedError extends Error {
-  constructor(user, requiredRoles, redirectTo) {
-    const userRoles = getUserRoles(user).join(", ") || "none";
-    super(
-      `User "${user.username}" does not have required role(s). Has: [${userRoles}], Required: [${requiredRoles.join(", ")}]`
-    );
-    this.name = "RoleDeniedError";
-    this.user = user;
-    this.requiredRoles = requiredRoles;
-    this.redirectTo = redirectTo;
-    if (Error.captureStackTrace) {
-      Error.captureStackTrace(this, _RoleDeniedError);
-    }
-  }
-};
-function isRoleDeniedError(error) {
-  return error instanceof RoleDeniedError || error?.name === "RoleDeniedError";
-}
-
 // src/core/service.ts
+async function setStoreAuth(response) {
+  let store;
+  try {
+    store = (await import('./auth.svelte-WROD55FW.js')).authStore;
+  } catch {
+    return;
+  }
+  store.setAuth(response.accessToken, response.refreshToken, response.user, response.sessionToken);
+}
 var AuthService = class {
   // ============================================================================
   // Authentication
@@ -48,7 +37,13 @@ var AuthService = class {
    */
   async login(credentials, options) {
     const response = await authApi.login(credentials);
-    if (options?.allowedRoles?.length && !isMfaChallengeResponse(response)) {
+    if (isMfaChallengeResponse(response)) {
+      return response;
+    }
+    if (!isLoginSuccessResponse(response)) {
+      throw new InvalidAuthResponseError();
+    }
+    if (options?.allowedRoles?.length) {
       if (!hasAnyRole(response.user, options.allowedRoles)) {
         throw new RoleDeniedError(
           response.user,
@@ -57,17 +52,8 @@ var AuthService = class {
         );
       }
     }
-    if (options?.autoSetAuth !== false && !isMfaChallengeResponse(response)) {
-      try {
-        const { authStore } = await import('./auth.svelte-PT27BLWR.js');
-        authStore.setAuth(
-          response.accessToken,
-          response.refreshToken,
-          response.user,
-          response.sessionToken
-        );
-      } catch {
-      }
+    if (options?.autoSetAuth !== false) {
+      await setStoreAuth(response);
     }
     return response;
   }
@@ -234,6 +220,9 @@ var AuthService = class {
    */
   async verifyMFAChallenge(data, options) {
     const response = await authApi.verifyMFAChallenge(data);
+    if (!isLoginSuccessResponse(response)) {
+      throw new InvalidAuthResponseError();
+    }
     if (options?.allowedRoles?.length) {
       if (!hasAnyRole(response.user, options.allowedRoles)) {
         throw new RoleDeniedError(
@@ -244,16 +233,7 @@ var AuthService = class {
       }
     }
     if (options?.autoSetAuth !== false) {
-      try {
-        const { authStore } = await import('./auth.svelte-PT27BLWR.js');
-        authStore.setAuth(
-          response.accessToken,
-          response.refreshToken,
-          response.user,
-          response.sessionToken
-        );
-      } catch {
-      }
+      await setStoreAuth(response);
     }
     return response;
   }
@@ -407,4 +387,4 @@ function formatUserRoles(user, options = {}) {
   return formatted.join(separator);
 }
 
-export { AuthService, RoleDeniedError, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse, isRoleDeniedError };
+export { AuthService, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse };

package/dist/{chunk-SUW4DKKS.js → chunk-FEKQXUPJ.js}

@@ -1,4 +1,33 @@
-import { getConfig, getStorage, isTokenExpired, getFetch, isValidRedirectUrl } from './chunk-UJAJO5QJ.js';
+import { getUserRoles, getConfig, getStorage, isTokenExpired, getFetch, isValidRedirectUrl } from './chunk-K6TV3ZVS.js';
+
+// src/core/errors.ts
+var RoleDeniedError = class _RoleDeniedError extends Error {
+  constructor(user, requiredRoles, redirectTo) {
+    const userRoles = getUserRoles(user).join(", ") || "none";
+    super(
+      `User "${user.username}" does not have required role(s). Has: [${userRoles}], Required: [${requiredRoles.join(", ")}]`
+    );
+    this.name = "RoleDeniedError";
+    this.user = user;
+    this.requiredRoles = requiredRoles;
+    this.redirectTo = redirectTo;
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, _RoleDeniedError);
+    }
+  }
+};
+function isRoleDeniedError(error) {
+  return error instanceof RoleDeniedError || error?.name === "RoleDeniedError";
+}
+var InvalidAuthResponseError = class _InvalidAuthResponseError extends Error {
+  constructor(message = "Unexpected authentication response: no access token or user") {
+    super(message);
+    this.name = "InvalidAuthResponseError";
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, _InvalidAuthResponseError);
+    }
+  }
+};
 
 // src/core/client.ts
 var DEFAULT_REFRESH_RETRY_DELAYS = [1e3, 3e3];
@@ -58,7 +87,7 @@ function writeStoredTokens(accessToken, refreshToken) {
 }
 async function syncSvelteStore(apply) {
   try {
-    const { authStore } = await import('./auth.svelte-PT27BLWR.js');
+    const { authStore } = await import('./auth.svelte-WROD55FW.js');
     apply(authStore);
   } catch {
   }
@@ -197,14 +226,41 @@ function extractData(response) {
   }
   return response;
 }
+function isApiOrigin(url, baseUrl) {
+  try {
+    const page = typeof location !== "undefined" ? location.href : void 0;
+    return new URL(url).origin === new URL(baseUrl, page).origin;
+  } catch {
+    return false;
+  }
+}
 function apiRequest(endpoint, options = {}) {
   return apiRequestInternal(endpoint, options, false);
 }
 async function apiRequestInternal(endpoint, options, isRetry) {
-  const { authenticated = false, customFetch, body, timeout, signal, ...fetchOptions } = options;
+  const {
+    authenticated: wantsAuth = false,
+    customFetch,
+    body,
+    timeout,
+    signal,
+    noAuthRetry = false,
+    ...fetchOptions
+  } = options;
   const config = getConfig();
   const fetchFn = customFetch ?? getFetch();
-  const url = endpoint.startsWith("http") ? endpoint : `${config.baseUrl}${endpoint}`;
+  const isAbsolute = /^https?:\/\//i.test(endpoint);
+  const url = isAbsolute ? endpoint : `${config.baseUrl}${endpoint}`;
+  const authenticated = wantsAuth && (!isAbsolute || isApiOrigin(url, config.baseUrl));
+  if (authenticated && noAuthRetry && !isRetry && typeof window !== "undefined") {
+    const accessToken = getAccessToken();
+    if (accessToken && isTokenExpired(accessToken)) {
+      const outcome = await refreshSession({ onlyIfExpired: true });
+      if (outcome === "rejected") {
+        throw new Error("Authentication failed. Please sign in again.");
+      }
+    }
+  }
   const timeoutMs = timeout ?? config.requestTimeout ?? 3e4;
   const controller = new AbortController();
   const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
@@ -238,7 +294,7 @@ async function apiRequestInternal(endpoint, options, isRetry) {
       signal: controller.signal
     });
     clearTimeout(timeoutId);
-    if (response.status === 401 && authenticated && typeof window !== "undefined") {
+    if (response.status === 401 && authenticated && !noAuthRetry && typeof window !== "undefined") {
       if (isRetry) {
         await expireSession();
         throw new Error("Authentication failed. Please sign in again.");
@@ -468,7 +524,12 @@ var authApi = {
    * Change the current user's password.
    */
   async changePassword(data) {
-    await api.put("/auth/change-password", data, true);
+    await apiRequest("/auth/change-password", {
+      method: "PUT",
+      body: data,
+      authenticated: true,
+      noAuthRetry: true
+    });
   },
   // ============================================================================
   // Email Verification
@@ -570,16 +631,20 @@ var authApi = {
    * Disable MFA.
    */
   async disableMFA(password) {
-    await api.delete("/auth/mfa", true, void 0, { password });
+    await apiRequest("/auth/mfa", {
+      method: "DELETE",
+      body: { password },
+      authenticated: true,
+      noAuthRetry: true
+    });
   },
   /**
    * Regenerate MFA backup codes.
    */
   async regenerateBackupCodes(password) {
-    const response = await api.post(
+    const response = await apiRequest(
       "/auth/mfa/regenerate-backup-codes",
-      { password },
-      true
+      { method: "POST", body: { password }, authenticated: true, noAuthRetry: true }
     );
     return extractData(response);
   },
@@ -707,7 +772,12 @@ var authApi = {
    * Unlink an SSO account.
    */
   async unlinkSSOAccount(provider, password) {
-    await api.delete("/auth/sso/unlink", true, void 0, { provider, password });
+    await apiRequest("/auth/sso/unlink", {
+      method: "DELETE",
+      body: { provider, password },
+      authenticated: true,
+      noAuthRetry: true
+    });
   },
   /**
    * Link an SSO account.
@@ -834,4 +904,4 @@ var authApi = {
   }
 };
 
-export { api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, refreshSession, updateStoredTokens };
+export { InvalidAuthResponseError, RoleDeniedError, api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, isRoleDeniedError, refreshSession, updateStoredTokens };

package/dist/{chunk-SY6DG527.js → chunk-JFWZUQGP.js}

@@ -1,6 +1,6 @@
-import { authService } from './chunk-2LRLMSOH.js';
-import { authStore, currentUser, isAuthenticated, authActions } from './chunk-LA5DFBWP.js';
-import { isInitialized, initAuth, getUserRoles } from './chunk-UJAJO5QJ.js';
+import { authService } from './chunk-C2UTC5B7.js';
+import { authStore, currentUser, isAuthenticated, authActions } from './chunk-POOONCPP.js';
+import { isInitialized, initAuth, getUserRoles } from './chunk-K6TV3ZVS.js';
 
 // src/svelte/guards/auth-guard.ts
 function checkAuth(options = {}) {
@@ -175,7 +175,12 @@ function createAuthHook(options = {}) {
     event,
     resolve
   }) => {
-    const { pathname } = event.url;
+    let pathname;
+    try {
+      pathname = decodePathname(event.url.pathname);
+    } catch {
+      return new Response("Malformed URI", { status: 400 });
+    }
     const isLoginPage = pathname.replace(/(.)\/+$/, "$1") === loginPathname;
     const isPublic = isLoginPage || publicRoutes.some((r) => r.test(pathname));
     if (isPublic) {
@@ -198,7 +203,7 @@ function createAuthHook(options = {}) {
         return onUnauthenticated(event);
       }
       const loginUrl = new URL(loginPath, event.url.origin);
-      loginUrl.searchParams.set(redirectParam, pathname + event.url.search);
+      loginUrl.searchParams.set(redirectParam, event.url.pathname + event.url.search);
       return new Response(null, {
         status: 302,
         headers: { Location: loginUrl.pathname + loginUrl.search }
@@ -207,6 +212,9 @@ function createAuthHook(options = {}) {
     return resolve(event);
   };
 }
+function decodePathname(pathname) {
+  return pathname.split("%25").map(decodeURI).join("%25");
+}
 function matchesRoute(pathname, patterns) {
   return patterns.some((pattern) => pattern.test(pathname));
 }

package/dist/{chunk-UJAJO5QJ.js → chunk-K6TV3ZVS.js}

@@ -97,13 +97,48 @@ function isValidRedirectUrl(url) {
     }
   } catch {
     if (url.includes("://") || url.startsWith("//")) return false;
+    return isSameOriginRelative(url);
+  }
+}
+function isSameOriginRelative(url) {
+  const sentinel = "https://relative.invalid";
+  let current = url;
+  for (let round = 0; round < 4; round++) {
+    try {
+      if (new URL(current, sentinel).origin !== sentinel) return false;
+    } catch {
+      return false;
+    }
+    let decoded;
     try {
-      const sentinel = "https://relative.invalid";
-      return new URL(url, sentinel).origin === sentinel;
+      decoded = decodeURIComponent(current);
     } catch {
       return false;
     }
+    if (decoded === current) return true;
+    current = decoded;
   }
+  return false;
+}
+function isValidSSOLogoutUrl(url) {
+  if (isValidRedirectUrl(url)) return true;
+  const cfg = getConfig();
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return false;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return false;
+  const origins = [...cfg.sso?.logoutOrigins ?? []];
+  if (cfg.sso?.authorizeUrl) origins.push(cfg.sso.authorizeUrl);
+  return origins.some((origin) => {
+    try {
+      return new URL(origin).origin === parsed.origin;
+    } catch {
+      return false;
+    }
+  });
 }
 
 // src/core/jwt.ts
@@ -181,6 +216,7 @@ var ROLE_NAMES = [
   "stormwater_staff",
   "warranty_staff",
   "hotsheet_editor",
+  "office_admin",
   "employee",
   "user",
   "vendor",
@@ -195,7 +231,8 @@ var ROLE_HIERARCHY = {
   customer: 1,
   subcontractor: 1,
   // Staff tier (2): the read-only `employee` floor, the field-app clones of
-  // `agent`, every `<department>_staff` docs role, and `hotsheet_editor`.
+  // `agent`, every `<department>_staff` docs role, `hotsheet_editor` and
+  // `office_admin`.
   employee: 2,
   agent: 2,
   builder: 2,
@@ -216,6 +253,7 @@ var ROLE_HIERARCHY = {
   stormwater_staff: 2,
   warranty_staff: 2,
   hotsheet_editor: 2,
+  office_admin: 2,
   manager: 3,
   admin: 4
 };
@@ -248,4 +286,4 @@ function hasAllRoles(user, roles) {
   return roles.every((role) => held.includes(role));
 }
 
-export { ROLE_HIERARCHY, ROLE_NAMES, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isInitialized, isTokenExpired, isValidRedirectUrl, resetConfig };
+export { ROLE_HIERARCHY, ROLE_NAMES, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isInitialized, isTokenExpired, isValidRedirectUrl, isValidSSOLogoutUrl, resetConfig };

package/dist/{chunk-LA5DFBWP.js → chunk-POOONCPP.js}

@@ -1,5 +1,5 @@
-import { authApi } from './chunk-SUW4DKKS.js';
-import { isInitialized, getConfig, hasRole, hasAnyRole, hasAllRoles, decodeJWT, getStorage, getDefaultStorage } from './chunk-UJAJO5QJ.js';
+import { InvalidAuthResponseError, authApi } from './chunk-FEKQXUPJ.js';
+import { isInitialized, getConfig, isValidSSOLogoutUrl, hasRole, hasAnyRole, hasAllRoles, decodeJWT, getStorage, getDefaultStorage } from './chunk-K6TV3ZVS.js';
 
 // src/svelte/stores/auth.svelte.ts
 var STORAGE_VERSION = 2;
@@ -107,6 +107,9 @@ var AuthStore = class {
    * Set auth data after successful login.
    */
   setAuth(accessToken, refreshToken, user, sessionToken) {
+    if (typeof accessToken !== "string" || accessToken === "" || !user) {
+      throw new InvalidAuthResponseError("setAuth requires an access token and a user");
+    }
     const userWithPermissions = normalizeUser(user, accessToken);
     this.state = {
       accessToken,
@@ -198,7 +201,12 @@ var AuthStore = class {
       const response = await authApi.logout();
       this.logout();
       if (response?.ssoLogout && response?.logoutUrl) {
-        return { ssoLogoutUrl: response.logoutUrl };
+        if (isValidSSOLogoutUrl(response.logoutUrl)) {
+          return { ssoLogoutUrl: response.logoutUrl };
+        }
+        getConfig().onAuthError?.(
+          new Error("Ignored SSO logout URL: origin is not allowed (see sso.logoutOrigins)")
+        );
       }
     } catch {
       this.logout();

package/dist/core/index.d.ts

@@ -1,6 +1,6 @@
-import { e as LoginCredentials, f as LoginResponse, g as LogoutResponse, R as RegisterData, k as RegisterResponse, p as User, j as ProfileUpdateData, C as ChangePasswordData, n as Session, A as ApiKey, c as CreateApiKeyRequest, d as CreateApiKeyResponse, U as UpdateApiKeyRequest, i as MFAStatus, h as MFASetupResponse, M as MFAChallengeData, D as Device, q as UserPreferences, L as LinkedAccount, m as SecurityEvent, P as Pagination, r as UserRolesResponse } from '../types-Bqh2gkvu.js';
-export { a as AuthConfig, b as AuthState, l as ResetPasswordData, S as SSOConfig, o as StorageAdapter, s as createMemoryStorage, t as createSessionStorage, u as getConfig, v as getDefaultStorage, w as getFetch, x as getStorage, y as initAuth, z as isInitialized, B as resetConfig } from '../types-Bqh2gkvu.js';
-export { A as AuthService, L as LoginOptions, M as MFAVerifyOptions, R as RoleDeniedError, a as authService, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from '../user-utils-92PeSjcw.js';
+import { e as LoginCredentials, f as LoginResponse, g as LogoutResponse, R as RegisterData, k as RegisterResponse, p as User, j as ProfileUpdateData, C as ChangePasswordData, n as Session, A as ApiKey, c as CreateApiKeyRequest, d as CreateApiKeyResponse, U as UpdateApiKeyRequest, i as MFAStatus, h as MFASetupResponse, M as MFAChallengeData, D as Device, q as UserPreferences, L as LinkedAccount, m as SecurityEvent, P as Pagination, r as UserRolesResponse } from '../types-D_5ze47z.js';
+export { a as AuthConfig, b as AuthState, l as ResetPasswordData, S as SSOConfig, o as StorageAdapter, s as createMemoryStorage, t as createSessionStorage, u as getConfig, v as getDefaultStorage, w as getFetch, x as getStorage, y as initAuth, z as isInitialized, B as resetConfig } from '../types-D_5ze47z.js';
+export { A as AuthService, I as InvalidAuthResponseError, L as LoginOptions, M as MFAVerifyOptions, R as RoleDeniedError, a as authService, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from '../user-utils-Tc6yv4-Q.js';
 
 /**
  * HTTP Client
@@ -19,6 +19,14 @@ interface ApiRequestOptions extends Omit<RequestInit, 'body' | 'signal'> {
     timeout?: number;
     /** AbortSignal for manual cancellation */
     signal?: AbortSignal;
+    /**
+     * Treat a 401 as an ordinary request error: no token refresh, no retry
+     * and no session expiry. For endpoints where a 401 means a wrong password
+     * rather than a dead token (change password, disable MFA, ...), so a typo
+     * does not sign the user out. An already-expired access token is still
+     * refreshed before the request is sent.
+     */
+    noAuthRetry?: boolean;
 }
 /**
  * The CHAPI envelope shape, for endpoints that wrap their payload in `data`.
@@ -389,7 +397,9 @@ declare const authApi: {
 declare function isMfaChallengeResponse(response: LoginResponse): boolean;
 /**
  * Check if a login response is a successful login (with tokens and user).
- * Returns true if the response contains valid authentication data.
+ * Returns true only for a non-empty access token plus a user object, so an
+ * MFA challenge in a shape isMfaChallengeResponse doesn't recognise is never
+ * mistaken for a login.
  */
 declare function isLoginSuccessResponse(response: LoginResponse): boolean;
 /**
@@ -532,7 +542,9 @@ declare function extractClaims<T extends string>(token: string, claims: T[]): Pi
  * `<department>_staff` roles are grant-on-top docs roles held alongside another
  * role, one per department the API lists in `DEPARTMENT_SCOPES`;
  * `hotsheet_editor` is a grant-on-top role for the Hotsheet hub's write
- * surface; `employee` is the read-only base staff
+ * surface; `office_admin` is a grant-on-top role for the office
+ * administrative assistant (home closing & financing fields, permits, walks,
+ * lenders); `employee` is the read-only base staff
  * floor (default for Authentik SSO); `vendor`/`customer`/`subcontractor` are
  * clones of `user`, row-scoped to their own homes.
  *
@@ -540,7 +552,7 @@ declare function extractClaims<T extends string>(token: string, claims: T[]): Pi
  * field app's clone of `agent`, the second is that department's docs role.
  * Someone on the stormwater team who also reads the docs holds both.
  */
-declare const ROLE_NAMES: readonly ["admin", "manager", "agent", "builder", "customer_service", "demo", "stormwater", "accounting_staff", "architecture_staff", "construction_staff", "crl_staff", "design_staff", "hr_staff", "it_staff", "landdev_staff", "marketing_staff", "purchasing_staff", "sales_staff", "stormwater_staff", "warranty_staff", "hotsheet_editor", "employee", "user", "vendor", "customer", "subcontractor", "guest"];
+declare const ROLE_NAMES: readonly ["admin", "manager", "agent", "builder", "customer_service", "demo", "stormwater", "accounting_staff", "architecture_staff", "construction_staff", "crl_staff", "design_staff", "hr_staff", "it_staff", "landdev_staff", "marketing_staff", "purchasing_staff", "sales_staff", "stormwater_staff", "warranty_staff", "hotsheet_editor", "office_admin", "employee", "user", "vendor", "customer", "subcontractor", "guest"];
 /**
  * A known role name.
  *

package/dist/core/index.js

@@ -1,3 +1,3 @@
-export { AuthService, RoleDeniedError, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse, isRoleDeniedError } from '../chunk-2LRLMSOH.js';
-export { api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, refreshSession, updateStoredTokens } from '../chunk-SUW4DKKS.js';
-export { ROLE_HIERARCHY, ROLE_NAMES, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isInitialized, isTokenExpired, resetConfig } from '../chunk-UJAJO5QJ.js';
+export { AuthService, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse } from '../chunk-C2UTC5B7.js';
+export { InvalidAuthResponseError, RoleDeniedError, api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, isRoleDeniedError, refreshSession, updateStoredTokens } from '../chunk-FEKQXUPJ.js';
+export { ROLE_HIERARCHY, ROLE_NAMES, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isInitialized, isTokenExpired, resetConfig } from '../chunk-K6TV3ZVS.js';

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { A as ApiKey, a as AuthConfig, b as AuthState, C as ChangePasswordData, c as CreateApiKeyRequest, d as CreateApiKeyResponse, D as Device, L as LinkedAccount, e as LoginCredentials, f as LoginResponse, g as LogoutResponse, M as MFAChallengeData, h as MFASetupResponse, i as MFAStatus, P as Pagination, j as ProfileUpdateData, R as RegisterData, k as RegisterResponse, l as ResetPasswordData, S as SSOConfig, m as SecurityEvent, n as Session, o as StorageAdapter, U as UpdateApiKeyRequest, p as User, q as UserPreferences, r as UserRolesResponse, s as createMemoryStorage, t as createSessionStorage, u as getConfig, v as getDefaultStorage, w as getFetch, x as getStorage, y as initAuth, z as isInitialized, B as resetConfig } from './types-Bqh2gkvu.js';
+export { A as ApiKey, a as AuthConfig, b as AuthState, C as ChangePasswordData, c as CreateApiKeyRequest, d as CreateApiKeyResponse, D as Device, L as LinkedAccount, e as LoginCredentials, f as LoginResponse, g as LogoutResponse, M as MFAChallengeData, h as MFASetupResponse, i as MFAStatus, P as Pagination, j as ProfileUpdateData, R as RegisterData, k as RegisterResponse, l as ResetPasswordData, S as SSOConfig, m as SecurityEvent, n as Session, o as StorageAdapter, U as UpdateApiKeyRequest, p as User, q as UserPreferences, r as UserRolesResponse, s as createMemoryStorage, t as createSessionStorage, u as getConfig, v as getDefaultStorage, w as getFetch, x as getStorage, y as initAuth, z as isInitialized, B as resetConfig } from './types-D_5ze47z.js';
 export { ApiRequestOptions, ApiResponse, JWTPayload, ROLE_HIERARCHY, ROLE_NAMES, RefreshOutcome, RefreshSessionOptions, RoleName, api, apiRequest, authApi, clearStoredAuth, computePrimaryRole, decodeJWT, extractClaims, extractData, getAccessToken, getAvailableMethods, getEffectiveLevel, getMfaToken, getRefreshToken, getSessionToken, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initCrossTabSync, isLoginSuccessResponse, isMfaChallengeResponse, isTokenExpired, refreshSession, updateStoredTokens } from './core/index.js';
-export { A as AuthService, L as LoginOptions, M as MFAVerifyOptions, R as RoleDeniedError, a as authService, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from './user-utils-92PeSjcw.js';
+export { A as AuthService, I as InvalidAuthResponseError, L as LoginOptions, M as MFAVerifyOptions, R as RoleDeniedError, a as authService, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from './user-utils-Tc6yv4-Q.js';
 export { AuthClient, AuthGuardOptions, AuthGuardResult, AuthHookOptions, CreateAuthClientOptions, NavFilterOptions, RoleRestrictedItem, authActions, authStore, canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, currentUser, filterByAccess, filterNavSections, isAuthenticated, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './svelte/index.js';

package/dist/index.js

@@ -1,5 +1,5 @@
-export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './chunk-SY6DG527.js';
-export { AuthService, RoleDeniedError, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse, isRoleDeniedError } from './chunk-2LRLMSOH.js';
-export { authActions, authStore, currentUser, isAuthenticated } from './chunk-LA5DFBWP.js';
-export { api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, refreshSession, updateStoredTokens } from './chunk-SUW4DKKS.js';
-export { ROLE_HIERARCHY, ROLE_NAMES, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isInitialized, isTokenExpired, resetConfig } from './chunk-UJAJO5QJ.js';
+export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './chunk-JFWZUQGP.js';
+export { AuthService, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse } from './chunk-C2UTC5B7.js';
+export { authActions, authStore, currentUser, isAuthenticated } from './chunk-POOONCPP.js';
+export { InvalidAuthResponseError, RoleDeniedError, api, apiRequest, authApi, clearStoredAuth, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, isRoleDeniedError, refreshSession, updateStoredTokens } from './chunk-FEKQXUPJ.js';
+export { ROLE_HIERARCHY, ROLE_NAMES, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isInitialized, isTokenExpired, resetConfig } from './chunk-K6TV3ZVS.js';

package/dist/svelte/index.d.ts

@@ -1,7 +1,7 @@
-import { b as AuthState, p as User, a as AuthConfig } from '../types-Bqh2gkvu.js';
-export { y as initAuth, z as isInitialized } from '../types-Bqh2gkvu.js';
-import { a as authService } from '../user-utils-92PeSjcw.js';
-export { R as RoleDeniedError, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from '../user-utils-92PeSjcw.js';
+import { b as AuthState, p as User, a as AuthConfig } from '../types-D_5ze47z.js';
+export { y as initAuth, z as isInitialized } from '../types-D_5ze47z.js';
+import { a as authService } from '../user-utils-Tc6yv4-Q.js';
+export { I as InvalidAuthResponseError, R as RoleDeniedError, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from '../user-utils-Tc6yv4-Q.js';
 
 /**
  * Auth Store

package/dist/svelte/index.js

@@ -1,5 +1,5 @@
-export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from '../chunk-SY6DG527.js';
-export { RoleDeniedError, formatUserRoles, getAvatarFallback, getDisplayName, getGreeting, getUserEmail, getUserInitials, isRoleDeniedError } from '../chunk-2LRLMSOH.js';
-export { authActions, authStore, currentUser, isAuthenticated } from '../chunk-LA5DFBWP.js';
-import '../chunk-SUW4DKKS.js';
-export { initAuth, isInitialized } from '../chunk-UJAJO5QJ.js';
+export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from '../chunk-JFWZUQGP.js';
+export { formatUserRoles, getAvatarFallback, getDisplayName, getGreeting, getUserEmail, getUserInitials } from '../chunk-C2UTC5B7.js';
+export { authActions, authStore, currentUser, isAuthenticated } from '../chunk-POOONCPP.js';
+export { InvalidAuthResponseError, RoleDeniedError, isRoleDeniedError } from '../chunk-FEKQXUPJ.js';
+export { initAuth, isInitialized } from '../chunk-K6TV3ZVS.js';

package/dist/testing/index.d.ts

@@ -1,4 +1,4 @@
-import { p as User, D as Device, f as LoginResponse, m as SecurityEvent, n as Session, A as ApiKey, L as LinkedAccount, g as LogoutResponse, h as MFASetupResponse, i as MFAStatus, k as RegisterResponse, q as UserPreferences, o as StorageAdapter, b as AuthState, a as AuthConfig } from '../types-Bqh2gkvu.js';
+import { p as User, D as Device, f as LoginResponse, m as SecurityEvent, n as Session, A as ApiKey, L as LinkedAccount, g as LogoutResponse, h as MFASetupResponse, i as MFAStatus, k as RegisterResponse, q as UserPreferences, o as StorageAdapter, b as AuthState, a as AuthConfig } from '../types-D_5ze47z.js';
 
 /**
  * User Fixtures

package/dist/testing/index.js

@@ -1,4 +1,4 @@
-import { hasRole, hasAnyRole, hasAllRoles, initAuth, resetConfig, getUserRoles, isTokenExpired, decodeJWT } from '../chunk-UJAJO5QJ.js';
+import { hasRole, hasAnyRole, hasAllRoles, initAuth, resetConfig, getUserRoles, isTokenExpired, decodeJWT } from '../chunk-K6TV3ZVS.js';
 
 // src/testing/fixtures/users.ts
 var mockUser = {

package/dist/{types-Bqh2gkvu.d.ts → types-D_5ze47z.d.ts}

@@ -11,6 +11,13 @@ interface SSOConfig {
     provider: string;
     /** Override the default authorize URL (defaults to /auth/sso/authorize) */
     authorizeUrl?: string;
+    /**
+     * Origins the server's SSO logout URL may point to (the identity
+     * provider's, e.g. 'https://sso.example.com'). The authorizeUrl origin and
+     * the redirect origins accepted by isValidRedirectUrl are always allowed;
+     * a logout URL anywhere else is dropped.
+     */
+    logoutOrigins?: string[];
 }
 interface StorageAdapter {
     getItem(key: string): string | null;

package/dist/{user-utils-92PeSjcw.d.ts → user-utils-Tc6yv4-Q.d.ts}

@@ -1,4 +1,4 @@
-import { e as LoginCredentials, f as LoginResponse, g as LogoutResponse, R as RegisterData, k as RegisterResponse, p as User, j as ProfileUpdateData, n as Session, A as ApiKey, c as CreateApiKeyRequest, d as CreateApiKeyResponse, U as UpdateApiKeyRequest, i as MFAStatus, h as MFASetupResponse, M as MFAChallengeData, D as Device, q as UserPreferences, L as LinkedAccount, m as SecurityEvent, P as Pagination } from './types-Bqh2gkvu.js';
+import { e as LoginCredentials, f as LoginResponse, g as LogoutResponse, R as RegisterData, k as RegisterResponse, p as User, j as ProfileUpdateData, n as Session, A as ApiKey, c as CreateApiKeyRequest, d as CreateApiKeyResponse, U as UpdateApiKeyRequest, i as MFAStatus, h as MFASetupResponse, M as MFAChallengeData, D as Device, q as UserPreferences, L as LinkedAccount, m as SecurityEvent, P as Pagination } from './types-D_5ze47z.js';
 
 /**
  * Auth Service
@@ -309,6 +309,16 @@ declare class RoleDeniedError extends Error {
  * Type guard to check if an error is a RoleDeniedError.
  */
 declare function isRoleDeniedError(error: unknown): error is RoleDeniedError;
+/**
+ * Error thrown when a login or MFA verification response is neither a
+ * recognised MFA challenge nor a success (an access token and a user).
+ * The auth state is left untouched, so an unexpected server shape fails
+ * closed instead of signing the user in without a token.
+ */
+declare class InvalidAuthResponseError extends Error {
+    readonly name = "InvalidAuthResponseError";
+    constructor(message?: string);
+}
 
 /**
  * User Display Utilities
@@ -413,4 +423,4 @@ declare function formatUserRoles(user: User | null | undefined, options?: {
     capitalize?: boolean;
 }): string;
 
-export { AuthService as A, type LoginOptions as L, type MFAVerifyOptions as M, RoleDeniedError as R, authService as a, getDisplayName as b, getGreeting as c, getUserEmail as d, getUserInitials as e, formatUserRoles as f, getAvatarFallback as g, isRoleDeniedError as i };
+export { AuthService as A, InvalidAuthResponseError as I, type LoginOptions as L, type MFAVerifyOptions as M, RoleDeniedError as R, authService as a, getDisplayName as b, getGreeting as c, getUserEmail as d, getUserInitials as e, formatUserRoles as f, getAvatarFallback as g, isRoleDeniedError as i };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@classic-homes/auth",
-  "version": "1.22.2",
+  "version": "1.27.0",
   "description": "Authentication services and Svelte bindings for Classic Theme apps",
   "type": "module",
   "main": "dist/index.js",

package/dist/auth.svelte-PT27BLWR.js

@@ -1,3 +0,0 @@
-export { authActions, authStore, currentUser, isAuthenticated } from './chunk-LA5DFBWP.js';
-import './chunk-SUW4DKKS.js';
-import './chunk-UJAJO5QJ.js';