@conduit-d365/auth 0.1.0

package/dist/AuthProvider.d.ts

@@ -0,0 +1,27 @@
+import React from "react";
+/** Context for passing custom scopes from AuthProvider to useAuth */
+export declare const ScopesContext: React.Context<string[] | undefined>;
+interface AuthProviderProps {
+    /** Entra ID app registration client ID */
+    clientId: string;
+    /** OAuth redirect URI. Defaults to window.location.origin */
+    redirectUri?: string;
+    /** Custom OAuth scopes. Defaults to ["api://<clientId>/access_as_user"] */
+    scopes?: string[];
+    children: React.ReactNode;
+}
+/**
+ * Wraps the app in an MSAL authentication context.
+ *
+ * Handles MSAL initialisation, redirect callbacks, and active account
+ * management. All child components can use the useAuth() hook to access
+ * the authenticated user.
+ *
+ * Usage:
+ *   <AuthProvider clientId={import.meta.env.VITE_ENTRA_CLIENT_ID}>
+ *     <App />
+ *   </AuthProvider>
+ */
+export declare function AuthProvider({ clientId, redirectUri, scopes, children, }: AuthProviderProps): import("react/jsx-runtime").JSX.Element;
+export {};
+//# sourceMappingURL=AuthProvider.d.ts.map

package/dist/AuthProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../src/AuthProvider.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA2C,MAAM,OAAO,CAAC;AAahE,qEAAqE;AACrE,eAAO,MAAM,aAAa,qCAAiD,CAAC;AAE5E,UAAU,iBAAiB;IACzB,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,EAC3B,QAAQ,EACR,WAAW,EACX,MAAM,EACN,QAAQ,GACT,EAAE,iBAAiB,2CA+CnB"}

package/dist/AuthProvider.js

@@ -0,0 +1,51 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { createContext, useEffect, useRef } from "react";
+import { MsalProvider, } from "@azure/msal-react";
+import { EventType, PublicClientApplication, } from "@azure/msal-browser";
+import { createMsalConfig } from "./authConfig";
+/** Context for passing custom scopes from AuthProvider to useAuth */
+export const ScopesContext = createContext(undefined);
+/**
+ * Wraps the app in an MSAL authentication context.
+ *
+ * Handles MSAL initialisation, redirect callbacks, and active account
+ * management. All child components can use the useAuth() hook to access
+ * the authenticated user.
+ *
+ * Usage:
+ *   <AuthProvider clientId={import.meta.env.VITE_ENTRA_CLIENT_ID}>
+ *     <App />
+ *   </AuthProvider>
+ */
+export function AuthProvider({ clientId, redirectUri, scopes, children, }) {
+    const msalInstanceRef = useRef(null);
+    if (!msalInstanceRef.current) {
+        const config = createMsalConfig({ clientId, redirectUri });
+        msalInstanceRef.current = new PublicClientApplication(config);
+    }
+    const msalInstance = msalInstanceRef.current;
+    useEffect(() => {
+        const init = async () => {
+            await msalInstance.initialize();
+            await msalInstance.handleRedirectPromise();
+            // Set active account if one exists but isn't set
+            if (!msalInstance.getActiveAccount() &&
+                msalInstance.getAllAccounts().length > 0) {
+                msalInstance.setActiveAccount(msalInstance.getAllAccounts()[0]);
+            }
+            // Set active account on successful login
+            msalInstance.addEventCallback((event) => {
+                if (event.eventType === EventType.LOGIN_SUCCESS &&
+                    event.payload) {
+                    const result = event.payload;
+                    if (result.account) {
+                        msalInstance.setActiveAccount(result.account);
+                    }
+                }
+            });
+        };
+        init();
+    }, [msalInstance]);
+    return (_jsx(MsalProvider, { instance: msalInstance, children: _jsx(ScopesContext.Provider, { value: scopes, children: children }) }));
+}
+//# sourceMappingURL=AuthProvider.js.map

package/dist/AuthProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthProvider.js","sourceRoot":"","sources":["../src/AuthProvider.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAChE,OAAO,EACL,YAAY,GAEb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,SAAS,EACT,uBAAuB,GAGxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,qEAAqE;AACrE,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAuB,SAAS,CAAC,CAAC;AAY5E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,QAAQ,EACR,WAAW,EACX,MAAM,EACN,QAAQ,GACU;IAClB,MAAM,eAAe,GAAG,MAAM,CAAiC,IAAI,CAAC,CAAC;IAErE,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;QAC3D,eAAe,CAAC,OAAO,GAAG,IAAI,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,CAAC;IAE7C,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;YACtB,MAAM,YAAY,CAAC,UAAU,EAAE,CAAC;YAChC,MAAM,YAAY,CAAC,qBAAqB,EAAE,CAAC;YAE3C,iDAAiD;YACjD,IACE,CAAC,YAAY,CAAC,gBAAgB,EAAE;gBAChC,YAAY,CAAC,cAAc,EAAE,CAAC,MAAM,GAAG,CAAC,EACxC,CAAC;gBACD,YAAY,CAAC,gBAAgB,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAClE,CAAC;YAED,yCAAyC;YACzC,YAAY,CAAC,gBAAgB,CAAC,CAAC,KAAmB,EAAE,EAAE;gBACpD,IACE,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,aAAa;oBAC3C,KAAK,CAAC,OAAO,EACb,CAAC;oBACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAA+B,CAAC;oBACrD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;wBACnB,YAAY,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;oBAChD,CAAC;gBACH,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,IAAI,EAAE,CAAC;IACT,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAEnB,OAAO,CACL,KAAC,YAAY,IAAC,QAAQ,EAAE,YAAY,YAClC,KAAC,aAAa,CAAC,QAAQ,IAAC,KAAK,EAAE,MAAM,YAClC,QAAQ,GACc,GACZ,CAChB,CAAC;AACJ,CAAC"}

package/dist/ProtectedRoute.d.ts

@@ -0,0 +1,23 @@
+import React from "react";
+interface ProtectedRouteProps {
+    children: React.ReactNode;
+    /** Custom loading component. Defaults to a simple "Loading..." div. */
+    loadingComponent?: React.ReactNode;
+}
+/**
+ * Route guard that requires authentication.
+ *
+ * While MSAL is initialising, shows a loading indicator. If the user
+ * is not authenticated, triggers a login redirect. Otherwise renders
+ * the children.
+ *
+ * Usage:
+ *   <Route path="/projects" element={
+ *     <ProtectedRoute>
+ *       <ProjectsPage />
+ *     </ProtectedRoute>
+ *   } />
+ */
+export declare function ProtectedRoute({ children, loadingComponent, }: ProtectedRouteProps): import("react/jsx-runtime").JSX.Element;
+export {};
+//# sourceMappingURL=ProtectedRoute.d.ts.map

package/dist/ProtectedRoute.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProtectedRoute.d.ts","sourceRoot":"","sources":["../src/ProtectedRoute.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,UAAU,mBAAmB;IAC3B,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,uEAAuE;IACvE,gBAAgB,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;CACpC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,EAC7B,QAAQ,EACR,gBAAgB,GACjB,EAAE,mBAAmB,2CAarB"}

package/dist/ProtectedRoute.js

@@ -0,0 +1,28 @@
+import { jsx as _jsx, Fragment as _Fragment } from "react/jsx-runtime";
+import { useAuth } from "./useAuth";
+/**
+ * Route guard that requires authentication.
+ *
+ * While MSAL is initialising, shows a loading indicator. If the user
+ * is not authenticated, triggers a login redirect. Otherwise renders
+ * the children.
+ *
+ * Usage:
+ *   <Route path="/projects" element={
+ *     <ProtectedRoute>
+ *       <ProjectsPage />
+ *     </ProtectedRoute>
+ *   } />
+ */
+export function ProtectedRoute({ children, loadingComponent, }) {
+    const { isAuthenticated, isLoading, login } = useAuth();
+    if (isLoading) {
+        return _jsx(_Fragment, { children: loadingComponent ?? _jsx("div", { children: "Loading..." }) });
+    }
+    if (!isAuthenticated) {
+        login();
+        return _jsx("div", { children: "Redirecting to login..." });
+    }
+    return _jsx(_Fragment, { children: children });
+}
+//# sourceMappingURL=ProtectedRoute.js.map

package/dist/ProtectedRoute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProtectedRoute.js","sourceRoot":"","sources":["../src/ProtectedRoute.tsx"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQpC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,EAC7B,QAAQ,EACR,gBAAgB,GACI;IACpB,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;IAExD,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,4BAAG,gBAAgB,IAAI,uCAAqB,GAAI,CAAC;IAC1D,CAAC;IAED,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,KAAK,EAAE,CAAC;QACR,OAAO,oDAAkC,CAAC;IAC5C,CAAC;IAED,OAAO,4BAAG,QAAQ,GAAI,CAAC;AACzB,CAAC"}

package/dist/apiClient.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Create an authenticated fetch wrapper.
+ *
+ * Automatically acquires a Bearer token via MSAL and attaches it to
+ * every request. Replaces ConfigCompare's `credentials: 'include'`
+ * cookie-based pattern with JWT auth.
+ *
+ * @param getAccessToken - Function that returns a valid access token
+ * @returns An authenticated fetch function
+ */
+export declare function createApiClient(getAccessToken: () => Promise<string>): (endpoint: string, options?: RequestInit) => Promise<Response>;
+/**
+ * React hook that provides an authenticated API client.
+ *
+ * Drop-in replacement for ConfigCompare's apiCall() utility.
+ *
+ * Usage:
+ *   const api = useApiClient();
+ *   const resp = await api("/api/projects");
+ *   const projects = await resp.json();
+ */
+export declare function useApiClient(): (endpoint: string, options?: RequestInit) => Promise<Response>;
+//# sourceMappingURL=apiClient.d.ts.map

package/dist/apiClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiClient.d.ts","sourceRoot":"","sources":["../src/apiClient.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,cAAc,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,IAGnC,UAAU,MAAM,EAChB,UAAS,WAAgB,KACxB,OAAO,CAAC,QAAQ,CAAC,CAsBrB;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,eApCd,MAAM,YACP,WAAW,KACnB,OAAO,CAAC,QAAQ,CAAC,CAqCrB"}

package/dist/apiClient.js

@@ -0,0 +1,46 @@
+import { useAuth } from "./useAuth";
+/**
+ * Create an authenticated fetch wrapper.
+ *
+ * Automatically acquires a Bearer token via MSAL and attaches it to
+ * every request. Replaces ConfigCompare's `credentials: 'include'`
+ * cookie-based pattern with JWT auth.
+ *
+ * @param getAccessToken - Function that returns a valid access token
+ * @returns An authenticated fetch function
+ */
+export function createApiClient(getAccessToken) {
+    return async (endpoint, options = {}) => {
+        const token = await getAccessToken();
+        // Use relative URLs in production (container nginx proxies /api/*).
+        // In development, VITE_API_URL can point to the local backend.
+        const apiBase = typeof import.meta !== "undefined" &&
+            import.meta.env?.VITE_API_URL
+            ? import.meta.env.VITE_API_URL
+            : "";
+        const headers = new Headers(options.headers);
+        headers.set("Authorization", `Bearer ${token}`);
+        if (!headers.has("Content-Type")) {
+            headers.set("Content-Type", "application/json");
+        }
+        return fetch(`${apiBase}${endpoint}`, {
+            ...options,
+            headers,
+        });
+    };
+}
+/**
+ * React hook that provides an authenticated API client.
+ *
+ * Drop-in replacement for ConfigCompare's apiCall() utility.
+ *
+ * Usage:
+ *   const api = useApiClient();
+ *   const resp = await api("/api/projects");
+ *   const projects = await resp.json();
+ */
+export function useApiClient() {
+    const { getAccessToken } = useAuth();
+    return createApiClient(getAccessToken);
+}
+//# sourceMappingURL=apiClient.js.map

package/dist/apiClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiClient.js","sourceRoot":"","sources":["../src/apiClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,cAAqC;IAErC,OAAO,KAAK,EACV,QAAgB,EAChB,UAAuB,EAAE,EACN,EAAE;QACrB,MAAM,KAAK,GAAG,MAAM,cAAc,EAAE,CAAC;QAErC,oEAAoE;QACpE,+DAA+D;QAC/D,MAAM,OAAO,GACX,OAAO,MAAM,CAAC,IAAI,KAAK,WAAW;YAClC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY;YAC3B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY;YAC9B,CAAC,CAAC,EAAE,CAAC;QAET,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,KAAK,CAAC,GAAG,OAAO,GAAG,QAAQ,EAAE,EAAE;YACpC,GAAG,OAAO;YACV,OAAO;SACR,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,EAAE,CAAC;IACrC,OAAO,eAAe,CAAC,cAAc,CAAC,CAAC;AACzC,CAAC"}

package/dist/authConfig.d.ts

@@ -0,0 +1,15 @@
+import type { Configuration } from "@azure/msal-browser";
+import type { ConduitAuthConfig } from "./types";
+/**
+ * Create an MSAL configuration for multi-tenant Entra ID auth.
+ *
+ * Uses the /common authority endpoint so users from any Azure AD tenant
+ * can sign in — MSAL redirects each user to their home tenant's login page.
+ */
+export declare function createMsalConfig(config: ConduitAuthConfig): Configuration;
+/**
+ * Get the default OAuth scopes for API access.
+ * Uses the custom scope exposed by the Conduit app registration.
+ */
+export declare function getDefaultScopes(clientId: string): string[];
+//# sourceMappingURL=authConfig.d.ts.map

package/dist/authConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authConfig.d.ts","sourceRoot":"","sources":["../src/authConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAEjD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,iBAAiB,GAAG,aAAa,CAYzE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAE3D"}

package/dist/authConfig.js

@@ -0,0 +1,27 @@
+/**
+ * Create an MSAL configuration for multi-tenant Entra ID auth.
+ *
+ * Uses the /common authority endpoint so users from any Azure AD tenant
+ * can sign in — MSAL redirects each user to their home tenant's login page.
+ */
+export function createMsalConfig(config) {
+    return {
+        auth: {
+            clientId: config.clientId,
+            authority: "https://login.microsoftonline.com/common",
+            redirectUri: config.redirectUri || window.location.origin,
+            postLogoutRedirectUri: window.location.origin,
+        },
+        cache: {
+            cacheLocation: "sessionStorage",
+        },
+    };
+}
+/**
+ * Get the default OAuth scopes for API access.
+ * Uses the custom scope exposed by the Conduit app registration.
+ */
+export function getDefaultScopes(clientId) {
+    return [`api://${clientId}/access_as_user`];
+}
+//# sourceMappingURL=authConfig.js.map

package/dist/authConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authConfig.js","sourceRoot":"","sources":["../src/authConfig.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAyB;IACxD,OAAO;QACL,IAAI,EAAE;YACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,0CAA0C;YACrD,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM;YACzD,qBAAqB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;SAC9C;QACD,KAAK,EAAE;YACL,aAAa,EAAE,gBAAgB;SAChC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,CAAC,SAAS,QAAQ,iBAAiB,CAAC,CAAC;AAC9C,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export { AuthProvider } from "./AuthProvider";
+export { useAuth } from "./useAuth";
+export type { UseAuthReturn } from "./useAuth";
+export { ProtectedRoute } from "./ProtectedRoute";
+export { createApiClient, useApiClient } from "./apiClient";
+export { createMsalConfig, getDefaultScopes } from "./authConfig";
+export type { AuthUser, ConduitAuthConfig } from "./types";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAClE,YAAY,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -0,0 +1,6 @@
+export { AuthProvider } from "./AuthProvider";
+export { useAuth } from "./useAuth";
+export { ProtectedRoute } from "./ProtectedRoute";
+export { createApiClient, useApiClient } from "./apiClient";
+export { createMsalConfig, getDefaultScopes } from "./authConfig";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Authenticated user identity from Entra ID token claims.
+ * Maps to the backend's AuthenticatedUser dataclass.
+ */
+export interface AuthUser {
+    /** Entra ID tenant ID (tid claim) — identifies the user's organisation */
+    tenantId: string;
+    /** User object ID (oid claim) — unique within their tenant */
+    userId: string;
+    /** User's email address (preferred_username claim) */
+    email: string;
+    /** User's display name (name claim) */
+    displayName: string;
+}
+/** Configuration for the Conduit auth provider. */
+export interface ConduitAuthConfig {
+    /** Entra ID app registration client ID */
+    clientId: string;
+    /** OAuth redirect URI. Defaults to window.location.origin */
+    redirectUri?: string;
+    /** OAuth scopes. Defaults to ["api://<clientId>/access_as_user"] */
+    scopes?: string[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAC;IACf,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,uCAAuC;IACvC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,mDAAmD;AACnD,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/dist/useAuth.d.ts

@@ -0,0 +1,27 @@
+import type { AuthUser } from "./types";
+export interface UseAuthReturn {
+    /** The authenticated user, or null if not signed in */
+    user: AuthUser | null;
+    /** Whether the user is authenticated */
+    isAuthenticated: boolean;
+    /** Whether MSAL is still initialising */
+    isLoading: boolean;
+    /** Trigger a login redirect */
+    login: () => Promise<void>;
+    /** Trigger a logout redirect */
+    logout: () => Promise<void>;
+    /** Acquire an access token for API calls (silently, or via redirect) */
+    getAccessToken: () => Promise<string>;
+}
+/**
+ * Hook for accessing auth state and operations.
+ *
+ * Extracts user identity from MSAL account claims (tenant ID, user ID,
+ * email, display name). Provides token acquisition for authenticated
+ * API calls.
+ *
+ * Usage:
+ *   const { user, isAuthenticated, login, getAccessToken } = useAuth();
+ */
+export declare function useAuth(): UseAuthReturn;
+//# sourceMappingURL=useAuth.d.ts.map

package/dist/useAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAuth.d.ts","sourceRoot":"","sources":["../src/useAuth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAIxC,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC;IACtB,wCAAwC;IACxC,eAAe,EAAE,OAAO,CAAC;IACzB,yCAAyC;IACzC,SAAS,EAAE,OAAO,CAAC;IACnB,+BAA+B;IAC/B,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,gCAAgC;IAChC,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,wEAAwE;IACxE,cAAc,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACvC;AAED;;;;;;;;;GASG;AACH,wBAAgB,OAAO,IAAI,aAAa,CAyDvC"}

package/dist/useAuth.js

@@ -0,0 +1,70 @@
+import { useContext } from "react";
+import { useMsal, useAccount } from "@azure/msal-react";
+import { InteractionRequiredAuthError } from "@azure/msal-browser";
+import { getDefaultScopes } from "./authConfig";
+import { ScopesContext } from "./AuthProvider";
+/**
+ * Hook for accessing auth state and operations.
+ *
+ * Extracts user identity from MSAL account claims (tenant ID, user ID,
+ * email, display name). Provides token acquisition for authenticated
+ * API calls.
+ *
+ * Usage:
+ *   const { user, isAuthenticated, login, getAccessToken } = useAuth();
+ */
+export function useAuth() {
+    const { instance, accounts, inProgress } = useMsal();
+    const account = useAccount(accounts[0] ?? null);
+    const isLoading = inProgress !== "none";
+    const customScopes = useContext(ScopesContext);
+    const user = account
+        ? {
+            tenantId: account.idTokenClaims?.tid ?? "",
+            userId: account.idTokenClaims?.oid ?? "",
+            email: account.username ?? "",
+            displayName: account.name ?? "",
+        }
+        : null;
+    const login = async () => {
+        const clientId = instance.getConfiguration().auth.clientId;
+        await instance.loginRedirect({
+            scopes: customScopes ?? getDefaultScopes(clientId),
+        });
+    };
+    const logout = async () => {
+        await instance.logoutRedirect();
+    };
+    const getAccessToken = async () => {
+        if (!account) {
+            throw new Error("No authenticated account");
+        }
+        const clientId = instance.getConfiguration().auth.clientId;
+        try {
+            const result = await instance.acquireTokenSilent({
+                scopes: customScopes ?? getDefaultScopes(clientId),
+                account,
+            });
+            return result.accessToken;
+        }
+        catch (error) {
+            if (error instanceof InteractionRequiredAuthError) {
+                // Token can't be refreshed silently — redirect to login
+                await instance.acquireTokenRedirect({
+                    scopes: customScopes ?? getDefaultScopes(clientId),
+                    account,
+                });
+            }
+            throw error;
+        }
+    };
+    return {
+        user,
+        isAuthenticated: !!account,
+        isLoading,
+        login,
+        logout,
+        getAccessToken,
+    };
+}
+//# sourceMappingURL=useAuth.js.map

package/dist/useAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"useAuth.js","sourceRoot":"","sources":["../src/useAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AAEnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAiB/C;;;;;;;;;GASG;AACH,MAAM,UAAU,OAAO;IACrB,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,OAAO,EAAE,CAAC;IACrD,MAAM,OAAO,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,UAAU,KAAK,MAAM,CAAC;IACxC,MAAM,YAAY,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;IAE/C,MAAM,IAAI,GAAoB,OAAO;QACnC,CAAC,CAAC;YACE,QAAQ,EAAG,OAAO,CAAC,aAAa,EAAE,GAAc,IAAI,EAAE;YACtD,MAAM,EAAG,OAAO,CAAC,aAAa,EAAE,GAAc,IAAI,EAAE;YACpD,KAAK,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE;YAC7B,WAAW,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE;SAChC;QACH,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE;QACvB,MAAM,QAAQ,GAAG,QAAQ,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC3D,MAAM,QAAQ,CAAC,aAAa,CAAC;YAC3B,MAAM,EAAE,YAAY,IAAI,gBAAgB,CAAC,QAAQ,CAAC;SACnD,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,IAAI,EAAE;QACxB,MAAM,QAAQ,CAAC,cAAc,EAAE,CAAC;IAClC,CAAC,CAAC;IAEF,MAAM,cAAc,GAAG,KAAK,IAAqB,EAAE;QACjD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC3D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC;gBAC/C,MAAM,EAAE,YAAY,IAAI,gBAAgB,CAAC,QAAQ,CAAC;gBAClD,OAAO;aACR,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,WAAW,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;gBAClD,wDAAwD;gBACxD,MAAM,QAAQ,CAAC,oBAAoB,CAAC;oBAClC,MAAM,EAAE,YAAY,IAAI,gBAAgB,CAAC,QAAQ,CAAC;oBAClD,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,IAAI;QACJ,eAAe,EAAE,CAAC,CAAC,OAAO;QAC1B,SAAS;QACT,KAAK;QACL,MAAM;QACN,cAAc;KACf,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "@conduit-d365/auth",
+  "version": "0.1.0",
+  "description": "Shared Entra ID authentication React components for the Conduit suite",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc",
+    "prepublishOnly": "npm run build"
+  },
+  "peerDependencies": {
+    "@azure/msal-browser": "^3.0 || ^4.0 || ^5.0",
+    "@azure/msal-react": "^2.0 || ^3.0 || ^5.0",
+    "react": "^18.0 || ^19.0",
+    "react-dom": "^18.0 || ^19.0",
+    "react-router-dom": "^6.0 || ^7.0"
+  },
+  "devDependencies": {
+    "@azure/msal-browser": "^5.0",
+    "@azure/msal-react": "^5.0",
+    "@types/react": "^19.0",
+    "react": "^19.0",
+    "react-dom": "^19.0",
+    "react-router-dom": "^7.0",
+    "typescript": "^5.5"
+  }
+}