@conduit-d365/auth 0.2.1 → 0.3.0

package/dist/AuthProvider.d.ts

@@ -16,18 +16,12 @@ interface AuthProviderProps {
  * Wraps the app in an MSAL authentication context.
  *
  * Handles MSAL initialisation, redirect callbacks, and active account
- * management. All child components can use the useAuth() hook to access
- * the authenticated user.
+ * management. Children are NOT rendered until MSAL has initialised and
+ * any pending redirect promise has been processed.
  *
- * Children are NOT rendered until MSAL has initialised and any pending
- * redirect promise has been processed. This prevents the race condition
- * where ProtectedRoute calls login() before handleRedirectPromise()
- * completes, causing an infinite redirect loop.
- *
- * Usage:
- *   <AuthProvider clientId={import.meta.env.VITE_ENTRA_CLIENT_ID}>
- *     <App />
- *   </AuthProvider>
+ * The MSAL instance is created once (via useRef) and initialised in a
+ * single useEffect. MsalProvider receives the instance but does NOT
+ * re-initialise it — MSAL internally tracks its own init state.
  */
 export declare function AuthProvider({ clientId, redirectUri, scopes, children, }: AuthProviderProps): import("react/jsx-runtime").JSX.Element | null;
 export {};

package/dist/AuthProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../src/AuthProvider.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAqD,MAAM,OAAO,CAAC;AAa1E,qEAAqE;AACrE,eAAO,MAAM,aAAa,qCAAiD,CAAC;AAE5E,mEAAmE;AACnE,eAAO,MAAM,gBAAgB,wBAAgC,CAAC;AAE9D,UAAU,iBAAiB;IACzB,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAAC,EAC3B,QAAQ,EACR,WAAW,EACX,MAAM,EACN,QAAQ,GACT,EAAE,iBAAiB,kDAyDnB"}
+{"version":3,"file":"AuthProvider.d.ts","sourceRoot":"","sources":["../src/AuthProvider.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAqD,MAAM,OAAO,CAAC;AAY1E,qEAAqE;AACrE,eAAO,MAAM,aAAa,qCAAiD,CAAC;AAE5E,mEAAmE;AACnE,eAAO,MAAM,gBAAgB,wBAAgC,CAAC;AAE9D,UAAU,iBAAiB;IACzB,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,EAC3B,QAAQ,EACR,WAAW,EACX,MAAM,EACN,QAAQ,GACT,EAAE,iBAAiB,kDAoEnB"}

package/dist/AuthProvider.js

@@ -11,37 +11,43 @@ export const MsalReadyContext = createContext(false);
  * Wraps the app in an MSAL authentication context.
  *
  * Handles MSAL initialisation, redirect callbacks, and active account
- * management. All child components can use the useAuth() hook to access
- * the authenticated user.
+ * management. Children are NOT rendered until MSAL has initialised and
+ * any pending redirect promise has been processed.
  *
- * Children are NOT rendered until MSAL has initialised and any pending
- * redirect promise has been processed. This prevents the race condition
- * where ProtectedRoute calls login() before handleRedirectPromise()
- * completes, causing an infinite redirect loop.
- *
- * Usage:
- *   <AuthProvider clientId={import.meta.env.VITE_ENTRA_CLIENT_ID}>
- *     <App />
- *   </AuthProvider>
+ * The MSAL instance is created once (via useRef) and initialised in a
+ * single useEffect. MsalProvider receives the instance but does NOT
+ * re-initialise it — MSAL internally tracks its own init state.
  */
 export function AuthProvider({ clientId, redirectUri, scopes, children, }) {
     const msalInstanceRef = useRef(null);
     const [msalReady, setMsalReady] = useState(false);
+    const initStarted = useRef(false);
     if (!msalInstanceRef.current) {
         const config = createMsalConfig({ clientId, redirectUri });
         msalInstanceRef.current = new PublicClientApplication(config);
     }
     const msalInstance = msalInstanceRef.current;
     useEffect(() => {
+        // Guard against double-invocation in React StrictMode
+        if (initStarted.current)
+            return;
+        initStarted.current = true;
         const init = async () => {
             await msalInstance.initialize();
-            await msalInstance.handleRedirectPromise();
-            // Set active account if one exists but isn't set
-            if (!msalInstance.getActiveAccount() &&
+            // Process any pending redirect response BEFORE rendering children.
+            // If this returns null after a redirect, MSAL couldn't match the
+            // response to a stored request (the root cause of the redirect loop).
+            const response = await msalInstance.handleRedirectPromise({
+                navigateToLoginRequestUrl: false,
+            });
+            if (response?.account) {
+                msalInstance.setActiveAccount(response.account);
+            }
+            else if (!msalInstance.getActiveAccount() &&
                 msalInstance.getAllAccounts().length > 0) {
                 msalInstance.setActiveAccount(msalInstance.getAllAccounts()[0]);
             }
-            // Set active account on successful login
+            // Listen for future login successes
             msalInstance.addEventCallback((event) => {
                 if (event.eventType === EventType.LOGIN_SUCCESS &&
                     event.payload) {
@@ -55,7 +61,6 @@ export function AuthProvider({ clientId, redirectUri, scopes, children, }) {
         };
         init();
     }, [msalInstance]);
-    // Block rendering until MSAL has initialised and processed any redirect
     if (!msalReady) {
         return null;
     }

package/dist/AuthProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthProvider.js","sourceRoot":"","sources":["../src/AuthProvider.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAC1E,OAAO,EACL,YAAY,GAEb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,SAAS,EACT,uBAAuB,GAGxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,qEAAqE;AACrE,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAuB,SAAS,CAAC,CAAC;AAE5E,mEAAmE;AACnE,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAU,KAAK,CAAC,CAAC;AAY9D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,QAAQ,EACR,WAAW,EACX,MAAM,EACN,QAAQ,GACU;IAClB,MAAM,eAAe,GAAG,MAAM,CAAiC,IAAI,CAAC,CAAC;IACrE,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAElD,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;QAC3D,eAAe,CAAC,OAAO,GAAG,IAAI,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,CAAC;IAE7C,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;YACtB,MAAM,YAAY,CAAC,UAAU,EAAE,CAAC;YAChC,MAAM,YAAY,CAAC,qBAAqB,EAAE,CAAC;YAE3C,iDAAiD;YACjD,IACE,CAAC,YAAY,CAAC,gBAAgB,EAAE;gBAChC,YAAY,CAAC,cAAc,EAAE,CAAC,MAAM,GAAG,CAAC,EACxC,CAAC;gBACD,YAAY,CAAC,gBAAgB,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAClE,CAAC;YAED,yCAAyC;YACzC,YAAY,CAAC,gBAAgB,CAAC,CAAC,KAAmB,EAAE,EAAE;gBACpD,IACE,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,aAAa;oBAC3C,KAAK,CAAC,OAAO,EACb,CAAC;oBACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAA+B,CAAC;oBACrD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;wBACnB,YAAY,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;oBAChD,CAAC;gBACH,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,YAAY,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC;QAEF,IAAI,EAAE,CAAC;IACT,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAEnB,wEAAwE;IACxE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CACL,KAAC,YAAY,IAAC,QAAQ,EAAE,YAAY,YAClC,KAAC,gBAAgB,CAAC,QAAQ,IAAC,KAAK,EAAE,SAAS,YACzC,KAAC,aAAa,CAAC,QAAQ,IAAC,KAAK,EAAE,MAAM,YAClC,QAAQ,GACc,GACC,GACf,CAChB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"AuthProvider.js","sourceRoot":"","sources":["../src/AuthProvider.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAC1E,OAAO,EACL,YAAY,GACb,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,SAAS,EACT,uBAAuB,GAGxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,qEAAqE;AACrE,MAAM,CAAC,MAAM,aAAa,GAAG,aAAa,CAAuB,SAAS,CAAC,CAAC;AAE5E,mEAAmE;AACnE,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAU,KAAK,CAAC,CAAC;AAY9D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,QAAQ,EACR,WAAW,EACX,MAAM,EACN,QAAQ,GACU;IAClB,MAAM,eAAe,GAAG,MAAM,CAAiC,IAAI,CAAC,CAAC;IACrE,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAElC,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;QAC3D,eAAe,CAAC,OAAO,GAAG,IAAI,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,CAAC;IAE7C,SAAS,CAAC,GAAG,EAAE;QACb,sDAAsD;QACtD,IAAI,WAAW,CAAC,OAAO;YAAE,OAAO;QAChC,WAAW,CAAC,OAAO,GAAG,IAAI,CAAC;QAE3B,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;YACtB,MAAM,YAAY,CAAC,UAAU,EAAE,CAAC;YAEhC,mEAAmE;YACnE,iEAAiE;YACjE,sEAAsE;YACtE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,qBAAqB,CAAC;gBACxD,yBAAyB,EAAE,KAAK;aACjC,CAAC,CAAC;YAEH,IAAI,QAAQ,EAAE,OAAO,EAAE,CAAC;gBACtB,YAAY,CAAC,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAClD,CAAC;iBAAM,IACL,CAAC,YAAY,CAAC,gBAAgB,EAAE;gBAChC,YAAY,CAAC,cAAc,EAAE,CAAC,MAAM,GAAG,CAAC,EACxC,CAAC;gBACD,YAAY,CAAC,gBAAgB,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAClE,CAAC;YAED,oCAAoC;YACpC,YAAY,CAAC,gBAAgB,CAAC,CAAC,KAAmB,EAAE,EAAE;gBACpD,IACE,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,aAAa;oBAC3C,KAAK,CAAC,OAAO,EACb,CAAC;oBACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAA+B,CAAC;oBACrD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;wBACnB,YAAY,CAAC,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;oBAChD,CAAC;gBACH,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,YAAY,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC;QAEF,IAAI,EAAE,CAAC;IACT,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAEnB,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CACL,KAAC,YAAY,IAAC,QAAQ,EAAE,YAAY,YAClC,KAAC,gBAAgB,CAAC,QAAQ,IAAC,KAAK,EAAE,SAAS,YACzC,KAAC,aAAa,CAAC,QAAQ,IAAC,KAAK,EAAE,MAAM,YAClC,QAAQ,GACc,GACC,GACf,CAChB,CAAC;AACJ,CAAC"}

package/dist/ProtectedRoute.d.ts

@@ -7,9 +7,10 @@ interface ProtectedRouteProps {
 /**
  * Route guard that requires authentication.
  *
- * While MSAL is initialising, shows a loading indicator. If the user
- * is not authenticated, triggers a login redirect (once only per mount).
- * Otherwise renders the children.
+ * While MSAL is initialising or processing a redirect, shows a loading
+ * indicator. If the user is not authenticated AND MSAL is completely
+ * idle (InteractionStatus.None), triggers a login redirect once per
+ * mount. Otherwise renders the children.
  *
  * Usage:
  *   <Route path="/projects" element={

package/dist/ProtectedRoute.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ProtectedRoute.d.ts","sourceRoot":"","sources":["../src/ProtectedRoute.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAiB,MAAM,OAAO,CAAC;AAGtC,UAAU,mBAAmB;IAC3B,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,uEAAuE;IACvE,gBAAgB,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;CACpC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAAC,EAC7B,QAAQ,EACR,gBAAgB,GACjB,EAAE,mBAAmB,2CAiBrB"}
+{"version":3,"file":"ProtectedRoute.d.ts","sourceRoot":"","sources":["../src/ProtectedRoute.tsx"],"names":[],"mappings":"AAAA,OAAO,KAA4B,MAAM,OAAO,CAAC;AAKjD,UAAU,mBAAmB;IAC3B,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,uEAAuE;IACvE,gBAAgB,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;CACpC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,EAC7B,QAAQ,EACR,gBAAgB,GACjB,EAAE,mBAAmB,2CA6BrB"}

package/dist/ProtectedRoute.js

@@ -1,12 +1,15 @@
 import { jsx as _jsx, Fragment as _Fragment } from "react/jsx-runtime";
-import { useRef } from "react";
+import { useEffect, useRef } from "react";
 import { useAuth } from "./useAuth";
+import { useMsal } from "@azure/msal-react";
+import { InteractionStatus } from "@azure/msal-browser";
 /**
  * Route guard that requires authentication.
  *
- * While MSAL is initialising, shows a loading indicator. If the user
- * is not authenticated, triggers a login redirect (once only per mount).
- * Otherwise renders the children.
+ * While MSAL is initialising or processing a redirect, shows a loading
+ * indicator. If the user is not authenticated AND MSAL is completely
+ * idle (InteractionStatus.None), triggers a login redirect once per
+ * mount. Otherwise renders the children.
  *
  * Usage:
  *   <Route path="/projects" element={
@@ -17,15 +20,24 @@ import { useAuth } from "./useAuth";
  */
 export function ProtectedRoute({ children, loadingComponent, }) {
     const { isAuthenticated, isLoading, login } = useAuth();
+    const { inProgress } = useMsal();
     const loginTriggered = useRef(false);
-    if (isLoading) {
-        return _jsx(_Fragment, { children: loadingComponent ?? _jsx("div", { children: "Loading..." }) });
-    }
-    if (!isAuthenticated) {
-        if (!loginTriggered.current) {
+    useEffect(() => {
+        // Only trigger login when MSAL is completely idle and user is not
+        // authenticated. This prevents firing loginRedirect while MSAL is
+        // still processing a redirect response (which caused the loop).
+        if (!isAuthenticated &&
+            !isLoading &&
+            inProgress === InteractionStatus.None &&
+            !loginTriggered.current) {
             loginTriggered.current = true;
             login();
         }
+    }, [isAuthenticated, isLoading, inProgress, login]);
+    if (isLoading || inProgress !== InteractionStatus.None) {
+        return _jsx(_Fragment, { children: loadingComponent ?? _jsx("div", { children: "Loading..." }) });
+    }
+    if (!isAuthenticated) {
         return _jsx("div", { children: "Redirecting to login..." });
     }
     return _jsx(_Fragment, { children: children });

package/dist/ProtectedRoute.js.map

@@ -1 +1 @@
-{"version":3,"file":"ProtectedRoute.js","sourceRoot":"","sources":["../src/ProtectedRoute.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQpC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,cAAc,CAAC,EAC7B,QAAQ,EACR,gBAAgB,GACI;IACpB,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;IACxD,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAErC,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,4BAAG,gBAAgB,IAAI,uCAAqB,GAAI,CAAC;IAC1D,CAAC;IAED,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;YAC5B,cAAc,CAAC,OAAO,GAAG,IAAI,CAAC;YAC9B,KAAK,EAAE,CAAC;QACV,CAAC;QACD,OAAO,oDAAkC,CAAC;IAC5C,CAAC;IAED,OAAO,4BAAG,QAAQ,GAAI,CAAC;AACzB,CAAC"}
+{"version":3,"file":"ProtectedRoute.js","sourceRoot":"","sources":["../src/ProtectedRoute.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAQxD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAAC,EAC7B,QAAQ,EACR,gBAAgB,GACI;IACpB,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC;IACxD,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,EAAE,CAAC;IACjC,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAErC,SAAS,CAAC,GAAG,EAAE;QACb,kEAAkE;QAClE,kEAAkE;QAClE,gEAAgE;QAChE,IACE,CAAC,eAAe;YAChB,CAAC,SAAS;YACV,UAAU,KAAK,iBAAiB,CAAC,IAAI;YACrC,CAAC,cAAc,CAAC,OAAO,EACvB,CAAC;YACD,cAAc,CAAC,OAAO,GAAG,IAAI,CAAC;YAC9B,KAAK,EAAE,CAAC;QACV,CAAC;IACH,CAAC,EAAE,CAAC,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;IAEpD,IAAI,SAAS,IAAI,UAAU,KAAK,iBAAiB,CAAC,IAAI,EAAE,CAAC;QACvD,OAAO,4BAAG,gBAAgB,IAAI,uCAAqB,GAAI,CAAC;IAC1D,CAAC;IAED,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,oDAAkC,CAAC;IAC5C,CAAC;IAED,OAAO,4BAAG,QAAQ,GAAI,CAAC;AACzB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@conduit-d365/auth",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Shared Entra ID authentication React components for the Conduit suite",
   "type": "module",
   "main": "dist/index.js",