@cobaltcore-dev/aurora 1.0.0 → 1.1.0

package/dist/server/index.js

@@ -27310,7 +27310,7 @@ var require_pathHelpers = __commonJS({
     });
     exports2.encodeOpenstackPathSegment = encodeOpenstackPathSegment2;
     exports2.encodeOpenstackPath = encodeOpenstackPath;
-    exports2.validateAndEncodeResourceId = validateAndEncodeResourceId7;
+    exports2.validateAndEncodeResourceId = validateAndEncodeResourceId6;
     var error_1 = require_error();
     function encodeOpenstackPathSegment2(segment, label = "Path segment") {
       if (!segment || typeof segment !== "string") {
@@ -27332,10 +27332,10 @@ var require_pathHelpers = __commonJS({
       return segments.map((seg, idx) => encodeOpenstackPathSegment2(seg, `Path segment ${idx}`)).join("/");
     }
     __name(encodeOpenstackPath, "encodeOpenstackPath");
-    function validateAndEncodeResourceId7(id, resourceType = "Resource") {
+    function validateAndEncodeResourceId6(id, resourceType = "Resource") {
       return encodeOpenstackPathSegment2(id, `${resourceType} ID`);
     }
-    __name(validateAndEncodeResourceId7, "validateAndEncodeResourceId");
+    __name(validateAndEncodeResourceId6, "validateAndEncodeResourceId");
   }
 });
 
@@ -28569,10 +28569,12 @@ __export(server_exports, {
   createServer: () => createServer,
   domainScopedInputSchema: () => domainScopedInputSchema,
   domainScopedProcedure: () => domainScopedProcedure,
+  parseOrThrow: () => parseOrThrow,
   projectScopedInputSchema: () => projectScopedInputSchema,
   projectScopedProcedure: () => projectScopedProcedure,
   protectedProcedure: () => protectedProcedure,
-  publicProcedure: () => publicProcedure
+  publicProcedure: () => publicProcedure,
+  validateOpenstackService: () => validateOpenstackService
 });
 module.exports = __toCommonJS(server_exports);
 
@@ -28688,11 +28690,20 @@ var discriminatedSchema = import_zod2.z.discriminatedUnion("type", [
 var sessionRouter = {
   getCurrentUserSession: publicProcedure.query(async ({ ctx }) => {
     const token = ctx.openstack?.getToken();
-    return token?.tokenData || null;
-  }),
-  getAuthToken: protectedProcedure.query(async ({ ctx }) => {
-    const token = ctx.openstack?.getToken();
-    return token?.authToken || null;
+    if (!token) return null;
+    return {
+      user: token.tokenData.user,
+      ...token.tokenData.expires_at && {
+        expires_at: token.tokenData.expires_at
+      },
+      ...token.tokenData.issued_at && {
+        issued_at: token.tokenData.issued_at
+      },
+      roles: token.tokenData.roles,
+      project: token.tokenData.project,
+      domain: token.tokenData.domain,
+      catalog: token.tokenData.catalog
+    };
   }),
   getCurrentScope: publicProcedure.query(async ({ ctx }) => {
     const token = ctx.openstack?.getToken();
@@ -36297,20 +36308,60 @@ var ec2CredentialRouter = {
   }),
   /**
   * Deletes an EC2 credential by ID.
+  * Verifies ownership before deletion to prevent IDOR attacks.
   */
   delete: projectScopedProcedure.input(projectScopedInputSchema.extend({
     credentialId: import_zod15.z.string().min(1)
   })).mutation(async ({ ctx, input }) => {
     const userId = ctx.openstack.getToken()?.tokenData.user?.id;
+    const projectId = ctx.openstack.getToken()?.tokenData.project?.id;
     if (!userId) {
       throw new import_server15.TRPCError({
         code: "UNAUTHORIZED",
         message: "User ID not found in token"
       });
     }
+    if (!projectId) {
+      throw new import_server15.TRPCError({
+        code: "UNAUTHORIZED",
+        message: "Project ID not found in token"
+      });
+    }
     const identityService = ctx.openstack.service("identity");
-    const response = await identityService.del(`credentials/${input.credentialId}`);
-    if (!response.ok && response.status !== 404) {
+    const getResponse = await identityService.get(`credentials/${input.credentialId}`);
+    if (!getResponse.ok) {
+      if (getResponse.status === 404) {
+        return {
+          success: true
+        };
+      }
+      if (getResponse.status === 401) {
+        throw new import_server15.TRPCError({
+          code: "UNAUTHORIZED",
+          message: "Authentication failed"
+        });
+      }
+      if (getResponse.status === 403) {
+        throw new import_server15.TRPCError({
+          code: "FORBIDDEN",
+          message: "Access denied"
+        });
+      }
+      throw new import_server15.TRPCError({
+        code: "INTERNAL_SERVER_ERROR",
+        message: "Failed to fetch credential for verification"
+      });
+    }
+    const credentialData = await getResponse.json();
+    const credential = credentialData.credential;
+    if (credential.user_id !== userId || credential.project_id !== projectId) {
+      throw new import_server15.TRPCError({
+        code: "NOT_FOUND",
+        message: "Credential not found"
+      });
+    }
+    const deleteResponse = await identityService.del(`credentials/${input.credentialId}`);
+    if (!deleteResponse.ok && deleteResponse.status !== 404) {
       throw new import_server15.TRPCError({
         code: "INTERNAL_SERVER_ERROR",
         message: "Failed to delete EC2 credential"
@@ -39120,273 +39171,15 @@ var buildNetworkRouters = /* @__PURE__ */ __name((policyDir) => ({
   })
 }), "buildNetworkRouters");
 
-// src/server/Services/routers/pcaRouter.ts
-var import_signal_openstack8 = __toESM(require_esm());
-
-// src/server/Services/types/pca.ts
-var import_zod25 = require("zod");
-var CertificateValiditySchema = import_zod25.z.object({
-  not_after: import_zod25.z.number().int(),
-  not_before: import_zod25.z.number().int().optional()
-});
-var CertificateAuthorityCertificateSchema = import_zod25.z.object({
-  /** PEM encoded certificate data. */
-  pem: import_zod25.z.string(),
-  validity: CertificateValiditySchema
-});
-var CertificateAuthorityCertificateChainSchema = import_zod25.z.object({
-  certificates: import_zod25.z.array(import_zod25.z.object({
-    pem: import_zod25.z.string()
-  })),
-  /** Concatenated PEM certificates of the chain. */
-  pem: import_zod25.z.string()
-});
-var CertificateAuthorityAdditionalAttributeSchema = import_zod25.z.object({
-  /** ASN.1 Object Identifier of the attribute */
-  key: import_zod25.z.array(import_zod25.z.number().int()),
-  value: import_zod25.z.string()
-});
-var stringOrStringArray = import_zod25.z.union([
-  import_zod25.z.array(import_zod25.z.string()),
-  import_zod25.z.string().transform((s) => [
-    s
-  ])
-]);
-var CertificateAuthoritySubjectSchema = import_zod25.z.object({
-  additional_attribute: import_zod25.z.array(CertificateAuthorityAdditionalAttributeSchema).optional(),
-  named_attributes: import_zod25.z.object({
-    cn: import_zod25.z.string(),
-    /** Country codes (ISO 3166-1 alpha-2). */
-    c: stringOrStringArray.optional(),
-    /** Locality/city names. */
-    l: stringOrStringArray.optional(),
-    /** Organization names. */
-    o: stringOrStringArray.optional(),
-    /** Organizational unit names. */
-    ou: stringOrStringArray.optional(),
-    /** Postal/ZIP codes. */
-    postal_code: stringOrStringArray.optional(),
-    /** State or province names. */
-    st: stringOrStringArray.optional(),
-    serial_number: import_zod25.z.string().optional(),
-    street: stringOrStringArray.optional()
-  })
-});
-var CertificateAuthorityStateSchema = import_zod25.z.enum([
-  "CREATING",
-  "AWAITING_CERTIFICATE",
-  "READY",
-  "FAILED"
-]);
-var CertificateAuthoritySchema = import_zod25.z.object({
-  certificate: CertificateAuthorityCertificateSchema.optional(),
-  /** Details of Certificate Authority certificate's issuers chain. */
-  certificate_chain: CertificateAuthorityCertificateChainSchema.optional(),
-  configuration: import_zod25.z.object({
-    /** X.509 subject of Certificate Authority. Required on create operation. */
-    subject: CertificateAuthoritySubjectSchema
-  }).optional(),
-  csr: import_zod25.z.string().optional(),
-  /** Human-readable subject string, e.g. "CN=demo-ca.test.sci". */
-  display_subject: import_zod25.z.string().optional(),
-  id: import_zod25.z.string(),
-  /**
-  * Required on import certificate operation.
-  * Certificate Authority certificate chain, in PEM format. Consists of concatenated string
-  * of Certificate Authority certificate, followed by its intermediate issuing CAs certificates
-  * and root issuing CA certificate last.
-  */
-  imported_certificate_chain: import_zod25.z.string().optional(),
-  /** Identifier of OpenStack project that Certificate Authority belongs. */
-  project_id: import_zod25.z.string(),
-  /** Current operational state of Certificate Authority. */
-  state: CertificateAuthorityStateSchema
-});
-var LinkSchema = import_zod25.z.object({
-  href: import_zod25.z.string(),
-  rel: import_zod25.z.string()
-});
-var CertificateAuthoritiesListSchema = import_zod25.z.object({
-  certificate_authorities: import_zod25.z.array(CertificateAuthoritySchema),
-  links: import_zod25.z.array(LinkSchema),
-  next_page_marker: import_zod25.z.string().optional()
-});
-var CertificateAuthoritiesListInputSchema = projectScopedInputSchema.extend({
-  limit: import_zod25.z.number().int().min(1).max(1e3).optional(),
-  next_page_marker: import_zod25.z.string().trim().min(1).optional()
-});
-var CertificateAuthorityCreateSchema = import_zod25.z.object({
-  configuration: import_zod25.z.object({
-    subject: import_zod25.z.object({
-      named_attributes: import_zod25.z.object({
-        cn: import_zod25.z.string().trim().min(1)
-      })
-    })
-  })
-});
-var CertificateAuthorityIdInputSchema = projectScopedInputSchema.extend({
-  certificate_authority_id: import_zod25.z.string().min(1)
-});
-var CertificateAuthorityCertificatesListInputSchema = CertificateAuthorityIdInputSchema.extend({
-  limit: import_zod25.z.number().int().min(1).max(1e3).optional(),
-  next_page_marker: import_zod25.z.string().trim().min(1).optional()
-});
-var CertificateAuthorityImportInputSchema = CertificateAuthorityIdInputSchema.extend({
-  imported_certificate_chain: import_zod25.z.string().min(1)
-});
-var CertificateIdInputSchema = CertificateAuthorityIdInputSchema.extend({
-  certificate_id: import_zod25.z.string().min(1)
-});
-var CertificateConfigurationSchema = import_zod25.z.object({
-  validity: CertificateValiditySchema
-});
-var CreateCertificateInputSchema = projectScopedInputSchema.extend({
-  certificate_authority_id: import_zod25.z.string().min(1),
-  csr: import_zod25.z.string().min(1),
-  configuration: CertificateConfigurationSchema
-});
-var CertificateSchema = import_zod25.z.object({
-  certificate: CertificateAuthorityCertificateSchema.optional(),
-  certificate_authority_id: import_zod25.z.string(),
-  certificate_chain: CertificateAuthorityCertificateChainSchema.optional(),
-  configuration: CertificateConfigurationSchema.optional(),
-  csr: import_zod25.z.string().optional(),
-  id: import_zod25.z.string(),
-  project_id: import_zod25.z.string()
-});
-var CertificatesListSchema = import_zod25.z.object({
-  certificates: import_zod25.z.array(CertificateSchema),
-  links: import_zod25.z.array(LinkSchema),
-  next_page_marker: import_zod25.z.string().optional()
-});
-
-// src/server/Services/routers/pcaRouter.ts
-var PCA_BASE_URL = "v1/certificate-authorities";
-var pcaRouter = {
-  list: projectScopedProcedure.input(CertificateAuthoritiesListInputSchema).query(async ({ input, ctx }) => {
-    return withErrorHandling3(async () => {
-      const pca = ctx.openstack?.service("pca");
-      validateOpenstackService(pca, "pca");
-      const queryParams = new URLSearchParams();
-      if (input.limit !== void 0) queryParams.set("limit", String(input.limit));
-      if (input.next_page_marker !== void 0) queryParams.set("next_page_marker", input.next_page_marker);
-      const queryString = queryParams.toString();
-      const url = queryString ? `${PCA_BASE_URL}?${queryString}` : PCA_BASE_URL;
-      const response = await pca.get(url);
-      const data = await response.json();
-      return parseOrThrow(CertificateAuthoritiesListSchema, data, "pcaRouter.list");
-    }, "list certificate authorities");
-  }),
-  /**
-  * Creates a new Certificate Authority (CA).
-  * The CA is created in CREATING state and transitions to AWAITING_CERTIFICATE state once its CSR has been generated.
-  * CA in AWAITING_CERTIFICATE can't issue end-entity certificates, and needs to have its certificate imported - see the respective importCertificate endpoint.
-  */
-  create: projectScopedProcedure.input(CertificateAuthorityCreateSchema).mutation(async ({ input, ctx }) => {
-    return withErrorHandling3(async () => {
-      const pca = ctx.openstack?.service("pca");
-      validateOpenstackService(pca, "pca");
-      const response = await pca.post(PCA_BASE_URL, omit(input, "project_id"));
-      const data = await response.json();
-      return parseOrThrow(CertificateAuthoritySchema, data, "pcaRouter.create");
-    }, "create certificate authority");
-  }),
-  getById: projectScopedProcedure.input(CertificateAuthorityIdInputSchema).query(async ({ input, ctx }) => {
-    return withErrorHandling3(async () => {
-      const pca = ctx.openstack?.service("pca");
-      validateOpenstackService(pca, "pca");
-      const encodedId = (0, import_signal_openstack8.validateAndEncodeResourceId)(input.certificate_authority_id, "Certificate authority");
-      const url = `${PCA_BASE_URL}/${encodedId}`;
-      const response = await pca.get(url);
-      const data = await response.json();
-      return parseOrThrow(CertificateAuthoritySchema, data, "pcaRouter.getById");
-    }, "get certificate authority details");
-  }),
-  // Permanently deletes a Certificate Authority. This operation is irreversible.
-  delete: projectScopedProcedure.input(CertificateAuthorityIdInputSchema).mutation(async ({ input, ctx }) => {
-    return withErrorHandling3(async () => {
-      const pca = ctx.openstack?.service("pca");
-      validateOpenstackService(pca, "pca");
-      const encodedId = (0, import_signal_openstack8.validateAndEncodeResourceId)(input.certificate_authority_id, "Certificate authority");
-      const url = `${PCA_BASE_URL}/${encodedId}`;
-      await pca.del(url);
-    }, "delete certificate authority");
-  }),
-  /**
-  * Imports Certificate Authority certificate
-  * Transitioning the CA from AWAITING_CERTIFICATE to READY state
-  * after which the CA becomes fully operational and can issue certificates to end entities
-  */
-  import: projectScopedProcedure.input(CertificateAuthorityImportInputSchema).mutation(async ({ input, ctx }) => {
-    return withErrorHandling3(async () => {
-      const pca = ctx.openstack?.service("pca");
-      validateOpenstackService(pca, "pca");
-      const encodedId = (0, import_signal_openstack8.validateAndEncodeResourceId)(input.certificate_authority_id, "Certificate authority");
-      const url = `${PCA_BASE_URL}/${encodedId}:importCertificate`;
-      const response = await pca.post(url, {
-        imported_certificate_chain: input.imported_certificate_chain
-      });
-      const data = await response.json();
-      return parseOrThrow(CertificateAuthoritySchema, data, "pcaRouter.import");
-    }, "import certificate of certificate authority");
-  }),
-  listCertificates: projectScopedProcedure.input(CertificateAuthorityCertificatesListInputSchema).query(async ({ input, ctx }) => {
-    return withErrorHandling3(async () => {
-      const pca = ctx.openstack?.service("pca");
-      validateOpenstackService(pca, "pca");
-      const queryParams = new URLSearchParams();
-      if (input.limit !== void 0) queryParams.set("limit", String(input.limit));
-      if (input.next_page_marker !== void 0) queryParams.set("next_page_marker", input.next_page_marker);
-      const queryString = queryParams.toString();
-      const encodedId = (0, import_signal_openstack8.validateAndEncodeResourceId)(input.certificate_authority_id, "Certificate authority");
-      const baseUrl = `${PCA_BASE_URL}/${encodedId}/certificates`;
-      const url = queryString ? `${baseUrl}?${queryString}` : baseUrl;
-      const response = await pca.get(url);
-      const data = await response.json();
-      return parseOrThrow(CertificatesListSchema, data, "pcaRouter.listCertificates");
-    }, "list certificates for certificate authority");
-  }),
-  createCertificate: projectScopedProcedure.input(CreateCertificateInputSchema).mutation(async ({ input, ctx }) => {
-    return withErrorHandling3(async () => {
-      const pca = ctx.openstack?.service("pca");
-      validateOpenstackService(pca, "pca");
-      const encodedId = (0, import_signal_openstack8.validateAndEncodeResourceId)(input.certificate_authority_id, "Certificate authority");
-      const url = `${PCA_BASE_URL}/${encodedId}/certificates`;
-      const response = await pca.post(url, omit(input, "project_id", "certificate_authority_id"));
-      const data = await response.json();
-      return parseOrThrow(CertificateSchema, data, "pcaRouter.createCertificate");
-    }, "create certificate for certificate authority");
-  }),
-  getByIdCertificate: projectScopedProcedure.input(CertificateIdInputSchema).query(async ({ input, ctx }) => {
-    return withErrorHandling3(async () => {
-      const pca = ctx.openstack?.service("pca");
-      validateOpenstackService(pca, "pca");
-      const encodedAuthorityId = (0, import_signal_openstack8.validateAndEncodeResourceId)(input.certificate_authority_id, "Certificate authority");
-      const encodedCertId = (0, import_signal_openstack8.validateAndEncodeResourceId)(input.certificate_id, "Certificate");
-      const url = `${PCA_BASE_URL}/${encodedAuthorityId}/certificates/${encodedCertId}`;
-      const response = await pca.get(url);
-      const data = await response.json();
-      return parseOrThrow(CertificateSchema, data, "pcaRouter.getByIdCertificate");
-    }, "get certificate details");
-  })
-};
-
-// src/server/Services/routers/index.ts
-var serviceRouters = {
-  services: auroraRouter({
-    pca: pcaRouter
-  })
-};
-
 // src/server/routers.ts
-var buildBaseRouter = /* @__PURE__ */ __name((policyDir) => mergeRouters(auroraRouter(authRouters), auroraRouter(buildComputeRouters(policyDir)), auroraRouter(buildObjectStorageRouters(policyDir)), auroraRouter(projectRouters), auroraRouter(buildNetworkRouters(policyDir)), auroraRouter(serviceRouters)), "buildBaseRouter");
+var buildBaseRouter = /* @__PURE__ */ __name((policyDir) => mergeRouters(auroraRouter(authRouters), auroraRouter(buildComputeRouters(policyDir)), auroraRouter(buildObjectStorageRouters(policyDir)), auroraRouter(projectRouters), auroraRouter(buildNetworkRouters(policyDir))), "buildBaseRouter");
 var buildAppRouter = /* @__PURE__ */ __name((policyDir, extraRouters = []) => {
   if (extraRouters.length === 0) return buildBaseRouter(policyDir);
   return mergeRouters(buildBaseRouter(policyDir), ...extraRouters);
 }, "buildAppRouter");
 
 // src/server/context.ts
-var import_signal_openstack9 = __toESM(require_esm());
+var import_signal_openstack8 = __toESM(require_esm());
 
 // src/server/sessionCookie.ts
 var import_cookie = require("@fastify/cookie");
@@ -39474,7 +39267,7 @@ async function createContext(opts, config) {
     writable: false
   });
   if (currentAuthToken) {
-    openstackSession = await (0, import_signal_openstack9.SignalOpenstackSession)(normalizedEndpoint, {
+    openstackSession = await (0, import_signal_openstack8.SignalOpenstackSession)(normalizedEndpoint, {
       auth: {
         identity: {
           methods: [
@@ -39537,7 +39330,7 @@ async function createContext(opts, config) {
     }
   }, "getUserInfo");
   const createSession = /* @__PURE__ */ __name(async (params) => {
-    openstackSession = await (0, import_signal_openstack9.SignalOpenstackSession)(normalizedEndpoint, {
+    openstackSession = await (0, import_signal_openstack8.SignalOpenstackSession)(normalizedEndpoint, {
       auth: {
         identity: {
           methods: [
@@ -39683,7 +39476,7 @@ __name(createContext, "createContext");
 // src/server/server.ts
 var import_path2 = __toESM(require("path"));
 var import_node_stream4 = require("stream");
-var import_zod26 = require("zod");
+var import_zod25 = require("zod");
 
 // src/server/aurora-fastify-plugins/csrfProtection.ts
 var import_csrf_protection = __toESM(require("@fastify/csrf-protection"));
@@ -39884,7 +39677,7 @@ async function createServer(config) {
       router: appRouter,
       createContext: /* @__PURE__ */ __name((opts) => createContext(opts, contextConfig), "createContext"),
       onError: /* @__PURE__ */ __name((err) => {
-        if (err.error.cause instanceof import_zod26.ZodError) err.error.message = err.error.cause.issues.map((e) => e.message).join(",");
+        if (err.error.cause instanceof import_zod25.ZodError) err.error.message = err.error.cause.issues.map((e) => e.message).join(",");
       }, "onError")
     }
   });
@@ -39949,10 +39742,12 @@ __name(createServer, "createServer");
   createServer,
   domainScopedInputSchema,
   domainScopedProcedure,
+  parseOrThrow,
   projectScopedInputSchema,
   projectScopedProcedure,
   protectedProcedure,
-  publicProcedure
+  publicProcedure,
+  validateOpenstackService
 });
 /*! Bundled license information:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cobaltcore-dev/aurora",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "private": false,
   "description": "Aurora OpenStack dashboard — server and client library",
   "license": "Apache-2.0",
@@ -58,14 +58,12 @@
     "@fastify/helmet": "^13.0.2",
     "@fastify/multipart": "^10.0.0",
     "@fastify/static": "^10.1.2",
-    "@peculiar/x509": "^2.0.0",
     "@trpc/client": "11.16.0",
     "@trpc/server": "11.16.0",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "fastify-plugin": "^5.1.0",
     "node-fetch": "^3.3.2",
-    "reflect-metadata": "^0.2.2",
     "tailwind-merge": "^3.2.0",
     "zod": "^4.0.0"
   },

package/dist/client/AuthProvider-5TyZKZkx.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"AuthProvider-5TyZKZkx.mjs","names":["React","useEffect","useState","trpcClient","AuthContext","createContext","AuthProvider","children","user","setUser","isLoading","setIsLoading","error","setError","expiresAt","setExpiresAt","redirectToLogin","saveReturnUrl","window","location","pathname","returnUrl","encodeURIComponent","search","replace","clearLocalSession","auth","getCurrentUserSession","query","then","session","expires_at","catch","err","Error","message","finally","timeUntilExpiry","Date","getTime","now","handleExpiry","timer","setTimeout","clearTimeout","login","domain","password","createUserSession","mutate","domainName","success","logout","terminateUserSession","Provider","value","isAuthenticated","undefined","useAuth","context","useContext"],"sources":["../../src/client/store/AuthProvider.tsx"],"sourcesContent":["import React, { useEffect, useState } from \"react\"\nimport { TokenData } from \"../../server/Authentication/types/models\"\nimport { trpcClient } from \"../trpcClient\"\n\nexport type User = TokenData[\"user\"] | null\n\nexport interface AuthContext {\n  isAuthenticated: boolean\n  isLoading: boolean\n  error: string | null\n  login: (credentials: { domain: string; user: string; password: string }) => Promise<{ success: boolean }>\n  logout: () => Promise<void>\n  user?: User\n  expiresAt?: Date\n}\n\nconst AuthContext = React.createContext<AuthContext | null>(null)\n\nexport function AuthProvider({ children }: { children: React.ReactNode }) {\n  const [user, setUser] = useState<User | null>(null)\n  const [isLoading, setIsLoading] = useState(true)\n  const [error, setError] = useState<string | null>(null)\n  const [expiresAt, setExpiresAt] = useState<string | null>(null)\n\n  // Redirect to login, optionally with return URL\n  const redirectToLogin = (saveReturnUrl: boolean = false) => {\n    if (window.location.pathname !== \"/\") {\n      const returnUrl = saveReturnUrl\n        ? `/?redirect=${encodeURIComponent(window.location.pathname + window.location.search)}`\n        : \"/\"\n      window.location.replace(returnUrl)\n    }\n  }\n\n  // Clear local session state\n  const clearLocalSession = () => {\n    setUser(null)\n    setExpiresAt(null)\n  }\n\n  // Get current session on mount\n  useEffect(() => {\n    trpcClient.auth.getCurrentUserSession\n      .query()\n      .then((session) => {\n        if (session) {\n          setUser(session.user)\n          setExpiresAt(session.expires_at)\n        }\n      })\n      .catch((err) => {\n        setError(err instanceof Error ? err.message : \"Could not load session\")\n      })\n      .finally(() => setIsLoading(false))\n  }, [])\n\n  // Auto-logout when session expires\n  useEffect(() => {\n    if (!user || !expiresAt) return\n\n    const timeUntilExpiry = new Date(expiresAt).getTime() - Date.now()\n\n    const handleExpiry = () => {\n      clearLocalSession()\n      redirectToLogin(true)\n    }\n\n    if (timeUntilExpiry <= 0) {\n      handleExpiry()\n      return\n    }\n\n    const timer = setTimeout(handleExpiry, timeUntilExpiry)\n    return () => clearTimeout(timer)\n  }, [user, expiresAt])\n\n  const login = async ({ domain, user, password }: { domain: string; user: string; password: string }) => {\n    setError(null)\n    setIsLoading(true)\n    try {\n      const session = await trpcClient.auth.createUserSession.mutate({ domainName: domain, user, password })\n      setUser(session.user)\n      setExpiresAt(session.expires_at)\n      return { success: true }\n    } catch (err) {\n      setError(err instanceof Error ? err.message : `Could not create session: ${err}`)\n      return { success: false }\n    } finally {\n      setIsLoading(false)\n    }\n  }\n\n  const logout = async () => {\n    setIsLoading(true)\n    await trpcClient.auth.terminateUserSession.mutate().catch(() => {})\n    clearLocalSession()\n    redirectToLogin(false) // Don't save return URL on manual logout\n    // If already on login page, no redirect happens - reset loading state\n    if (window.location.pathname === \"/\") {\n      setIsLoading(false)\n    }\n  }\n\n  return (\n    <AuthContext.Provider\n      value={{\n        user,\n        isAuthenticated: !!user,\n        isLoading,\n        error,\n        login,\n        logout,\n        expiresAt: expiresAt ? new Date(expiresAt) : undefined,\n      }}\n    >\n      {children}\n    </AuthContext.Provider>\n  )\n}\n\nexport function useAuth() {\n  const context = React.useContext(AuthContext)\n  if (!context) {\n    throw new Error(\"useAuth must be used within an AuthProvider\")\n  }\n  return context\n}\n"],"mappings":";;;;AAgBA,IAAMI,IAAcJ,gBAAMK,cAAkC,IAAA;AAE5D,SAAgBC,EAAa,EAAEC,eAAyC;CACtE,IAAM,CAACC,GAAMC,KAAWP,EAAsB,IAAA,GACxC,CAACQ,GAAWC,KAAgBT,EAAS,EAAA,GACrC,CAACU,GAAOC,KAAYX,EAAwB,IAAA,GAC5C,CAACY,GAAWC,KAAgBb,EAAwB,IAAA,GAGpDc,KAAmBC,IAAyB,OAAK;EACrD,IAAIC,OAAOC,SAASC,aAAa,KAAK;GACpC,IAAMC,IAAYJ,IACd,cAAcK,mBAAmBJ,OAAOC,SAASC,WAAWF,OAAOC,SAASI,MAAM,MAClF;GACJL,OAAOC,SAASK,QAAQH,CAAAA;EAC1B;CACF,GAGMI,UAAoB;EAExBV,AADAN,EAAQ,IAAA,GACRM,EAAa,IAAA;CACf;CAiEA,OA9DAd,QAAU;EACRE,EAAWuB,KAAKC,sBACbC,MAAK,CAAA,CACLC,MAAMC,MAAAA;GACL,AAAIA,MACFrB,EAAQqB,EAAQtB,IAAI,GACpBO,EAAae,EAAQC,UAAU;EAEnC,CAAA,CAAA,CACCC,OAAOC,MAAAA;GACNpB,EAASoB,aAAeC,QAAQD,EAAIE,UAAU,wBAAA;EAChD,CAAA,CAAA,CACCC,cAAczB,EAAa,EAAA,CAAA;CAChC,GAAG,CAAA,CAAE,GAGLV,QAAU;EACR,IAAI,CAACO,KAAQ,CAACM,GAAW;EAEzB,IAAMuB,IAAkB,IAAIC,KAAKxB,CAAAA,CAAAA,CAAWyB,QAAO,IAAKD,KAAKE,IAAG,GAE1DC,UAAe;GAEnBzB,AADAS,EAAAA,GACAT,EAAgB,EAAA;EAClB;EAEA,IAAIqB,KAAmB,GAAG;GACxBI,EAAAA;GACA;EACF;EAEA,IAAMC,IAAQC,WAAWF,GAAcJ,CAAAA;EACvC,aAAaO,aAAaF,CAAAA;CAC5B,GAAG,CAAClC,GAAMM,CAAU,CAAA,GA8BlB,gBAACV,EAAYkD,UAAQ;EACnBC,OAAO;GACL/C;GACAgD,iBAAiB,CAAC,CAAChD;GACnBE;GACAE;GACAiC,cAlCe,EAAEC,WAAQtC,SAAMuC,kBAA8D;IAEjGpC,AADAE,EAAS,IAAA,GACTF,EAAa,EAAA;IACb,IAAI;KACF,IAAMmB,IAAU,MAAM3B,EAAWuB,KAAKsB,kBAAkBC,OAAO;MAAEC,YAAYJ;MAAQtC;MAAMuC;KAAS,CAAA;KAGpG,OAFAtC,EAAQqB,EAAQtB,IAAI,GACpBO,EAAae,EAAQC,UAAU,GACxB,EAAEoB,SAAS,GAAK;IACzB,SAASlB,GAAK;KAEZ,OADApB,EAASoB,aAAeC,QAAQD,EAAIE,UAAU,6BAA6BF,GAAK,GACzE,EAAEkB,SAAS,GAAM;IAC1B,UAAU;KACRxC,EAAa,EAAA;IACf;GACF;GAqBMyC,oBAnBS;IAMb,AALAzC,EAAa,EAAA,GACb,MAAMR,EAAWuB,KAAK2B,qBAAqBJ,OAAM,CAAA,CAAGjB,YAAM,CAAO,CAAA,GACjEP,EAAAA,GACAT,EAAgB,EAAA,GAEZE,OAAOC,SAASC,aAAa,OAC/BT,EAAa,EAAA;GAEjB;GAWMG,WAAWA,IAAY,IAAIwB,KAAKxB,CAAAA,IAAa2C,KAAAA;EAC/C;EAEClD;;AAGP;AAEA,SAAgBmD,IAAAA;CACd,IAAMC,IAAU3D,EAAM4D,WAAWxD,CAAAA;CACjC,IAAI,CAACuD,GACH,MAAUzB,MAAM,6CAAA;CAElB,OAAOyB;AACT"}