@dalgoridim/headless-cms 0.3.0 → 0.4.0

package/dist/auth/firebase/client/index.d.cts

@@ -1,4 +1,4 @@
-import * as React from 'react';
+import * as react from 'react';
 import { ReactNode } from 'react';
 import { Auth, GoogleAuthProvider, User } from 'firebase/auth';
 
@@ -22,7 +22,7 @@ interface FirebaseAuthContextValue {
     loginWithEmail: (email: string, password: string) => Promise<void>;
     logout: () => Promise<void>;
 }
-declare function FirebaseAuthProvider({ children, auth, googleProvider, cookieName, onLogout, }: FirebaseAuthProviderProps): React.JSX.Element;
+declare function FirebaseAuthProvider({ children, auth, googleProvider, cookieName, onLogout, }: FirebaseAuthProviderProps): react.JSX.Element;
 /** Extended Firebase auth API (login/logout/user) for login pages and toolbars. */
 declare function useFirebaseAuth(): FirebaseAuthContextValue;
 

package/dist/auth/firebase/client/index.d.ts

@@ -1,4 +1,4 @@
-import * as React from 'react';
+import * as react from 'react';
 import { ReactNode } from 'react';
 import { Auth, GoogleAuthProvider, User } from 'firebase/auth';
 
@@ -22,7 +22,7 @@ interface FirebaseAuthContextValue {
     loginWithEmail: (email: string, password: string) => Promise<void>;
     logout: () => Promise<void>;
 }
-declare function FirebaseAuthProvider({ children, auth, googleProvider, cookieName, onLogout, }: FirebaseAuthProviderProps): React.JSX.Element;
+declare function FirebaseAuthProvider({ children, auth, googleProvider, cookieName, onLogout, }: FirebaseAuthProviderProps): react.JSX.Element;
 /** Extended Firebase auth API (login/logout/user) for login pages and toolbars. */
 declare function useFirebaseAuth(): FirebaseAuthContextValue;
 

package/dist/auth/google/client/index.cjs

@@ -1,9 +1,38 @@
 "use strict";
 "use client";
 var __defProp = Object.defineProperty;
+var __defProps = Object.defineProperties;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropDescs = Object.getOwnPropertyDescriptors;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getOwnPropSymbols = Object.getOwnPropertySymbols;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __propIsEnum = Object.prototype.propertyIsEnumerable;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __spreadValues = (a, b) => {
+  for (var prop in b || (b = {}))
+    if (__hasOwnProp.call(b, prop))
+      __defNormalProp(a, prop, b[prop]);
+  if (__getOwnPropSymbols)
+    for (var prop of __getOwnPropSymbols(b)) {
+      if (__propIsEnum.call(b, prop))
+        __defNormalProp(a, prop, b[prop]);
+    }
+  return a;
+};
+var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
+var __objRest = (source, exclude) => {
+  var target = {};
+  for (var prop in source)
+    if (__hasOwnProp.call(source, prop) && exclude.indexOf(prop) < 0)
+      target[prop] = source[prop];
+  if (source != null && __getOwnPropSymbols)
+    for (var prop of __getOwnPropSymbols(source)) {
+      if (exclude.indexOf(prop) < 0 && __propIsEnum.call(source, prop))
+        target[prop] = source[prop];
+    }
+  return target;
+};
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
@@ -22,13 +51,14 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var client_exports = {};
 __export(client_exports, {
   GoogleAuthProvider: () => GoogleAuthProvider,
+  GoogleSignInButton: () => GoogleSignInButton,
   useGoogleAuth: () => useGoogleAuth
 });
 module.exports = __toCommonJS(client_exports);
 var import_react = require("react");
+var import_google = require("@react-oauth/google");
 var import_client = require("@dalgoridim/headless-cms/client");
 var import_jsx_runtime = require("react/jsx-runtime");
-var GSI_SRC = "https://accounts.google.com/gsi/client";
 var GoogleAuthContext = (0, import_react.createContext)(
   void 0
 );
@@ -49,15 +79,13 @@ function decodeJwt(token) {
   try {
     const payload = token.split(".")[1];
     const json = atob(payload.replace(/-/g, "+").replace(/_/g, "/"));
-    const data = JSON.parse(json);
-    return data;
+    return JSON.parse(json);
   } catch (e) {
     return null;
   }
 }
-function GoogleAuthProvider({
+function AuthState({
   children,
-  clientId,
   adminEmails,
   cookieName = "adminToken",
   onLogout
@@ -65,11 +93,10 @@ function GoogleAuthProvider({
   const [user, setUser] = (0, import_react.useState)(null);
   const [isAdmin, setIsAdmin] = (0, import_react.useState)(false);
   const [isEditing, setIsEditing] = (0, import_react.useState)(false);
-  const [ready, setReady] = (0, import_react.useState)(false);
   const allowed = (0, import_react.useRef)(
     (adminEmails != null ? adminEmails : []).map((e) => e.trim().toLowerCase())
   );
-  const applyToken = (0, import_react.useCallback)(
+  const applyCredential = (0, import_react.useCallback)(
     (token) => {
       var _a;
       const claims = decodeJwt(token);
@@ -93,37 +120,16 @@ function GoogleAuthProvider({
   );
   (0, import_react.useEffect)(() => {
     const existing = readCookie(cookieName);
-    if (existing) applyToken(existing);
-  }, [cookieName, applyToken]);
-  (0, import_react.useEffect)(() => {
-    function init() {
-      if (!window.google) return;
-      window.google.accounts.id.initialize({
-        client_id: clientId,
-        callback: (res) => applyToken(res.credential),
-        auto_select: false,
-        cancel_on_tap_outside: true
-      });
-      setReady(true);
-    }
-    if (window.google) {
-      init();
-      return;
-    }
-    const existing = document.querySelector(
-      `script[src="${GSI_SRC}"]`
-    );
-    if (existing) {
-      existing.addEventListener("load", init);
-      return () => existing.removeEventListener("load", init);
-    }
-    const script = document.createElement("script");
-    script.src = GSI_SRC;
-    script.async = true;
-    script.defer = true;
-    script.onload = init;
-    document.head.appendChild(script);
-  }, [clientId, applyToken]);
+    if (existing) applyCredential(existing);
+  }, [cookieName, applyCredential]);
+  const logout = (0, import_react.useCallback)(() => {
+    (0, import_google.googleLogout)();
+    deleteCookie(cookieName);
+    setUser(null);
+    setIsAdmin(false);
+    setIsEditing(false);
+    onLogout == null ? void 0 : onLogout();
+  }, [cookieName, onLogout]);
   (0, import_react.useEffect)(() => {
     const originalFetch = window.fetch;
     window.fetch = async (...args) => {
@@ -131,7 +137,7 @@ function GoogleAuthProvider({
       if (response.status === 401) {
         try {
           const data = await response.clone().json();
-          if (data == null ? void 0 : data.logout) doLogout();
+          if (data == null ? void 0 : data.logout) logout();
         } catch (e) {
         }
       }
@@ -140,47 +146,48 @@ function GoogleAuthProvider({
     return () => {
       window.fetch = originalFetch;
     };
-  }, []);
-  function doLogout() {
-    var _a;
-    (_a = window.google) == null ? void 0 : _a.accounts.id.disableAutoSelect();
-    deleteCookie(cookieName);
-    setUser(null);
-    setIsAdmin(false);
-    setIsEditing(false);
-    onLogout == null ? void 0 : onLogout();
-  }
-  const promptSignIn = (0, import_react.useCallback)(() => {
-    var _a;
-    if (!ready) return;
-    (_a = window.google) == null ? void 0 : _a.accounts.id.prompt();
-  }, [ready]);
-  const renderButton = (0, import_react.useCallback)(
-    (el, options) => {
-      var _a;
-      if (!ready) return;
-      (_a = window.google) == null ? void 0 : _a.accounts.id.renderButton(el, options);
-    },
-    [ready]
-  );
+  }, [logout]);
   const toggleEdit = (0, import_react.useCallback)(() => setIsEditing((p) => !p), []);
   return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
     GoogleAuthContext.Provider,
     {
-      value: {
-        user,
-        isAdmin,
-        isEditing,
-        toggleEdit,
-        ready,
-        promptSignIn,
-        renderButton,
-        logout: doLogout
-      },
+      value: { user, isAdmin, isEditing, toggleEdit, logout, applyCredential },
       children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_client.CmsAuthProvider, { value: { isAdmin, isEditing, toggleEdit }, children })
     }
   );
 }
+function GoogleAuthProvider(_a) {
+  var _b = _a, {
+    children,
+    clientId
+  } = _b, rest = __objRest(_b, [
+    "children",
+    "clientId"
+  ]);
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_google.GoogleOAuthProvider, { clientId, children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(AuthState, __spreadProps(__spreadValues({}, rest), { children })) });
+}
+function GoogleSignInButton({
+  theme = "filled_black",
+  shape = "pill",
+  size = "large",
+  text = "continue_with",
+  onError
+}) {
+  const { applyCredential } = useGoogleAuth();
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+    import_google.GoogleLogin,
+    {
+      onSuccess: (res) => {
+        if (res.credential) applyCredential(res.credential);
+      },
+      onError,
+      theme,
+      shape,
+      size,
+      text
+    }
+  );
+}
 function useGoogleAuth() {
   const ctx = (0, import_react.useContext)(GoogleAuthContext);
   if (!ctx) {
@@ -191,6 +198,7 @@ function useGoogleAuth() {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   GoogleAuthProvider,
+  GoogleSignInButton,
   useGoogleAuth
 });
 //# sourceMappingURL=index.cjs.map

package/dist/auth/google/client/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/auth/google/client/index.tsx"],"sourcesContent":["\"use client\";\n\nimport {\n  createContext,\n  useCallback,\n  useContext,\n  useEffect,\n  useRef,\n  useState,\n  type ReactNode,\n} from \"react\";\n// Imported via the public specifier so we share the SAME context instance as\n// the consumer's edit primitives at runtime (see tsup `external` + tsconfig paths).\nimport { CmsAuthProvider } from \"@dalgoridim/headless-cms/client\";\n\n/**\n * Client provider for **Google Identity Services** sign-in — the Firebase-free\n * counterpart to `FirebaseAuthProvider`. It loads the GSI script, lets the user\n * sign in with Google, stashes the resulting ID token in a cookie for the\n * server `googleAuth` adapter to verify, and feeds the shared CMS auth context\n * so the edit primitives light up. Admin status is optimistic on the client\n * (via `adminEmails`); the server gate remains authoritative.\n */\n\nconst GSI_SRC = \"https://accounts.google.com/gsi/client\";\n\n/** Minimal slice of the Google Identity Services API we use. */\ninterface GsiCredentialResponse {\n  credential: string;\n}\ninterface GsiButtonOptions {\n  type?: \"standard\" | \"icon\";\n  theme?: \"outline\" | \"filled_blue\" | \"filled_black\";\n  size?: \"small\" | \"medium\" | \"large\";\n  text?: \"signin_with\" | \"signup_with\" | \"continue_with\" | \"signin\";\n  shape?: \"rectangular\" | \"pill\" | \"circle\" | \"square\";\n  width?: number;\n}\ninterface GsiClient {\n  accounts: {\n    id: {\n      initialize: (config: {\n        client_id: string;\n        callback: (res: GsiCredentialResponse) => void;\n        auto_select?: boolean;\n        cancel_on_tap_outside?: boolean;\n      }) => void;\n      prompt: () => void;\n      renderButton: (el: HTMLElement, options?: GsiButtonOptions) => void;\n      disableAutoSelect: () => void;\n    };\n  };\n}\n\ndeclare global {\n  interface Window {\n    google?: GsiClient;\n  }\n}\n\nexport interface GoogleUser {\n  sub: string;\n  email?: string;\n  name?: string;\n  picture?: string;\n}\n\nexport interface GoogleAuthProviderProps {\n  children: ReactNode;\n  /** OAuth 2.0 Web client ID (from Google Cloud Console → Credentials). */\n  clientId: string;\n  /**\n   * Optional admin allowlist for *optimistic* client-side `isAdmin`. The server\n   * `googleAuth` adapter still enforces the real gate. Omit to treat any\n   * successful sign-in as optimistically admin (server will correct via 401).\n   */\n  adminEmails?: string[];\n  /** Cookie name for the ID token. Default `adminToken`. */\n  cookieName?: string;\n  /** Called when a 401 `{ logout: true }` response is intercepted. */\n  onLogout?: () => void;\n}\n\nexport interface GoogleAuthContextValue {\n  user: GoogleUser | null;\n  isAdmin: boolean;\n  isEditing: boolean;\n  toggleEdit: () => void;\n  /** True once the GSI script has loaded and the client is initialized. */\n  ready: boolean;\n  /** Trigger Google One Tap / sign-in prompt. */\n  promptSignIn: () => void;\n  /** Render the official Google button into `el` (most reliable trigger). */\n  renderButton: (el: HTMLElement, options?: GsiButtonOptions) => void;\n  logout: () => void;\n}\n\nconst GoogleAuthContext = createContext<GoogleAuthContextValue | undefined>(\n  undefined,\n);\n\nfunction setCookie(name: string, value: string) {\n  document.cookie = `${name}=${encodeURIComponent(value)}; path=/; samesite=lax`;\n}\nfunction deleteCookie(name: string) {\n  document.cookie = `${name}=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT`;\n}\nfunction readCookie(name: string): string | null {\n  for (const part of document.cookie.split(\";\")) {\n    const [k, ...v] = part.trim().split(\"=\");\n    if (k === name) return decodeURIComponent(v.join(\"=\"));\n  }\n  return null;\n}\n\n/** Decode a JWT payload client-side (no verification — the server does that). */\nfunction decodeJwt(token: string): (GoogleUser & { exp?: number }) | null {\n  try {\n    const payload = token.split(\".\")[1];\n    const json = atob(payload.replace(/-/g, \"+\").replace(/_/g, \"/\"));\n    const data = JSON.parse(json) as {\n      sub: string;\n      email?: string;\n      name?: string;\n      picture?: string;\n      exp?: number;\n    };\n    return data;\n  } catch {\n    return null;\n  }\n}\n\nexport function GoogleAuthProvider({\n  children,\n  clientId,\n  adminEmails,\n  cookieName = \"adminToken\",\n  onLogout,\n}: GoogleAuthProviderProps) {\n  const [user, setUser] = useState<GoogleUser | null>(null);\n  const [isAdmin, setIsAdmin] = useState(false);\n  const [isEditing, setIsEditing] = useState(false);\n  const [ready, setReady] = useState(false);\n  const allowed = useRef(\n    (adminEmails ?? []).map((e) => e.trim().toLowerCase()),\n  );\n\n  const applyToken = useCallback(\n    (token: string) => {\n      const claims = decodeJwt(token);\n      if (!claims) return;\n      if (claims.exp && claims.exp * 1000 <= Date.now()) {\n        deleteCookie(cookieName);\n        return;\n      }\n      const email = claims.email?.toLowerCase();\n      // Optimistic: if no allowlist supplied, trust the sign-in and let the\n      // server correct a non-admin via the 401 interceptor below.\n      const admin =\n        allowed.current.length === 0\n          ? true\n          : !!email && allowed.current.includes(email);\n      setCookie(cookieName, token);\n      setUser({\n        sub: claims.sub,\n        email: claims.email,\n        name: claims.name,\n        picture: claims.picture,\n      });\n      setIsAdmin(admin);\n    },\n    [cookieName],\n  );\n\n  // Restore an existing session from the cookie on mount.\n  useEffect(() => {\n    const existing = readCookie(cookieName);\n    if (existing) applyToken(existing);\n  }, [cookieName, applyToken]);\n\n  // Load the GSI script and initialize the One Tap / button client.\n  useEffect(() => {\n    function init() {\n      if (!window.google) return;\n      window.google.accounts.id.initialize({\n        client_id: clientId,\n        callback: (res) => applyToken(res.credential),\n        auto_select: false,\n        cancel_on_tap_outside: true,\n      });\n      setReady(true);\n    }\n\n    if (window.google) {\n      init();\n      return;\n    }\n    const existing = document.querySelector<HTMLScriptElement>(\n      `script[src=\"${GSI_SRC}\"]`,\n    );\n    if (existing) {\n      existing.addEventListener(\"load\", init);\n      return () => existing.removeEventListener(\"load\", init);\n    }\n    const script = document.createElement(\"script\");\n    script.src = GSI_SRC;\n    script.async = true;\n    script.defer = true;\n    script.onload = init;\n    document.head.appendChild(script);\n  }, [clientId, applyToken]);\n\n  // Intercept admin 401s so an expired/forbidden session forces sign-out.\n  useEffect(() => {\n    const originalFetch = window.fetch;\n    window.fetch = async (...args: Parameters<typeof fetch>) => {\n      const response = await originalFetch(...args);\n      if (response.status === 401) {\n        try {\n          const data = await response.clone().json();\n          if (data?.logout) doLogout();\n        } catch {\n          /* not a JSON body — ignore */\n        }\n      }\n      return response;\n    };\n    return () => {\n      window.fetch = originalFetch;\n    };\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, []);\n\n  function doLogout() {\n    window.google?.accounts.id.disableAutoSelect();\n    deleteCookie(cookieName);\n    setUser(null);\n    setIsAdmin(false);\n    setIsEditing(false);\n    onLogout?.();\n  }\n\n  const promptSignIn = useCallback(() => {\n    if (!ready) return;\n    window.google?.accounts.id.prompt();\n  }, [ready]);\n\n  const renderButton = useCallback(\n    (el: HTMLElement, options?: GsiButtonOptions) => {\n      if (!ready) return;\n      window.google?.accounts.id.renderButton(el, options);\n    },\n    [ready],\n  );\n\n  const toggleEdit = useCallback(() => setIsEditing((p) => !p), []);\n\n  return (\n    <GoogleAuthContext.Provider\n      value={{\n        user,\n        isAdmin,\n        isEditing,\n        toggleEdit,\n        ready,\n        promptSignIn,\n        renderButton,\n        logout: doLogout,\n      }}\n    >\n      <CmsAuthProvider value={{ isAdmin, isEditing, toggleEdit }}>\n        {children}\n      </CmsAuthProvider>\n    </GoogleAuthContext.Provider>\n  );\n}\n\n/** Google auth API (user/login/logout) for login pages and toolbars. */\nexport function useGoogleAuth(): GoogleAuthContextValue {\n  const ctx = useContext(GoogleAuthContext);\n  if (!ctx) {\n    throw new Error(\"useGoogleAuth must be used within a GoogleAuthProvider\");\n  }\n  return ctx;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,mBAQO;AAGP,oBAAgC;AAkQ1B;AAvPN,IAAM,UAAU;AAyEhB,IAAM,wBAAoB;AAAA,EACxB;AACF;AAEA,SAAS,UAAU,MAAc,OAAe;AAC9C,WAAS,SAAS,GAAG,IAAI,IAAI,mBAAmB,KAAK,CAAC;AACxD;AACA,SAAS,aAAa,MAAc;AAClC,WAAS,SAAS,GAAG,IAAI;AAC3B;AACA,SAAS,WAAW,MAA6B;AAC/C,aAAW,QAAQ,SAAS,OAAO,MAAM,GAAG,GAAG;AAC7C,UAAM,CAAC,GAAG,GAAG,CAAC,IAAI,KAAK,KAAK,EAAE,MAAM,GAAG;AACvC,QAAI,MAAM,KAAM,QAAO,mBAAmB,EAAE,KAAK,GAAG,CAAC;AAAA,EACvD;AACA,SAAO;AACT;AAGA,SAAS,UAAU,OAAuD;AACxE,MAAI;AACF,UAAM,UAAU,MAAM,MAAM,GAAG,EAAE,CAAC;AAClC,UAAM,OAAO,KAAK,QAAQ,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,CAAC;AAC/D,UAAM,OAAO,KAAK,MAAM,IAAI;AAO5B,WAAO;AAAA,EACT,SAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA,aAAa;AAAA,EACb;AACF,GAA4B;AAC1B,QAAM,CAAC,MAAM,OAAO,QAAI,uBAA4B,IAAI;AACxD,QAAM,CAAC,SAAS,UAAU,QAAI,uBAAS,KAAK;AAC5C,QAAM,CAAC,WAAW,YAAY,QAAI,uBAAS,KAAK;AAChD,QAAM,CAAC,OAAO,QAAQ,QAAI,uBAAS,KAAK;AACxC,QAAM,cAAU;AAAA,KACb,oCAAe,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC;AAAA,EACvD;AAEA,QAAM,iBAAa;AAAA,IACjB,CAAC,UAAkB;AArJvB;AAsJM,YAAM,SAAS,UAAU,KAAK;AAC9B,UAAI,CAAC,OAAQ;AACb,UAAI,OAAO,OAAO,OAAO,MAAM,OAAQ,KAAK,IAAI,GAAG;AACjD,qBAAa,UAAU;AACvB;AAAA,MACF;AACA,YAAM,SAAQ,YAAO,UAAP,mBAAc;AAG5B,YAAM,QACJ,QAAQ,QAAQ,WAAW,IACvB,OACA,CAAC,CAAC,SAAS,QAAQ,QAAQ,SAAS,KAAK;AAC/C,gBAAU,YAAY,KAAK;AAC3B,cAAQ;AAAA,QACN,KAAK,OAAO;AAAA,QACZ,OAAO,OAAO;AAAA,QACd,MAAM,OAAO;AAAA,QACb,SAAS,OAAO;AAAA,MAClB,CAAC;AACD,iBAAW,KAAK;AAAA,IAClB;AAAA,IACA,CAAC,UAAU;AAAA,EACb;AAGA,8BAAU,MAAM;AACd,UAAM,WAAW,WAAW,UAAU;AACtC,QAAI,SAAU,YAAW,QAAQ;AAAA,EACnC,GAAG,CAAC,YAAY,UAAU,CAAC;AAG3B,8BAAU,MAAM;AACd,aAAS,OAAO;AACd,UAAI,CAAC,OAAO,OAAQ;AACpB,aAAO,OAAO,SAAS,GAAG,WAAW;AAAA,QACnC,WAAW;AAAA,QACX,UAAU,CAAC,QAAQ,WAAW,IAAI,UAAU;AAAA,QAC5C,aAAa;AAAA,QACb,uBAAuB;AAAA,MACzB,CAAC;AACD,eAAS,IAAI;AAAA,IACf;AAEA,QAAI,OAAO,QAAQ;AACjB,WAAK;AACL;AAAA,IACF;AACA,UAAM,WAAW,SAAS;AAAA,MACxB,eAAe,OAAO;AAAA,IACxB;AACA,QAAI,UAAU;AACZ,eAAS,iBAAiB,QAAQ,IAAI;AACtC,aAAO,MAAM,SAAS,oBAAoB,QAAQ,IAAI;AAAA,IACxD;AACA,UAAM,SAAS,SAAS,cAAc,QAAQ;AAC9C,WAAO,MAAM;AACb,WAAO,QAAQ;AACf,WAAO,QAAQ;AACf,WAAO,SAAS;AAChB,aAAS,KAAK,YAAY,MAAM;AAAA,EAClC,GAAG,CAAC,UAAU,UAAU,CAAC;AAGzB,8BAAU,MAAM;AACd,UAAM,gBAAgB,OAAO;AAC7B,WAAO,QAAQ,UAAU,SAAmC;AAC1D,YAAM,WAAW,MAAM,cAAc,GAAG,IAAI;AAC5C,UAAI,SAAS,WAAW,KAAK;AAC3B,YAAI;AACF,gBAAM,OAAO,MAAM,SAAS,MAAM,EAAE,KAAK;AACzC,cAAI,6BAAM,OAAQ,UAAS;AAAA,QAC7B,SAAQ;AAAA,QAER;AAAA,MACF;AACA,aAAO;AAAA,IACT;AACA,WAAO,MAAM;AACX,aAAO,QAAQ;AAAA,IACjB;AAAA,EAEF,GAAG,CAAC,CAAC;AAEL,WAAS,WAAW;AA1OtB;AA2OI,iBAAO,WAAP,mBAAe,SAAS,GAAG;AAC3B,iBAAa,UAAU;AACvB,YAAQ,IAAI;AACZ,eAAW,KAAK;AAChB,iBAAa,KAAK;AAClB;AAAA,EACF;AAEA,QAAM,mBAAe,0BAAY,MAAM;AAnPzC;AAoPI,QAAI,CAAC,MAAO;AACZ,iBAAO,WAAP,mBAAe,SAAS,GAAG;AAAA,EAC7B,GAAG,CAAC,KAAK,CAAC;AAEV,QAAM,mBAAe;AAAA,IACnB,CAAC,IAAiB,YAA+B;AAzPrD;AA0PM,UAAI,CAAC,MAAO;AACZ,mBAAO,WAAP,mBAAe,SAAS,GAAG,aAAa,IAAI;AAAA,IAC9C;AAAA,IACA,CAAC,KAAK;AAAA,EACR;AAEA,QAAM,iBAAa,0BAAY,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC;AAEhE,SACE;AAAA,IAAC,kBAAkB;AAAA,IAAlB;AAAA,MACC,OAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,MACV;AAAA,MAEA,sDAAC,iCAAgB,OAAO,EAAE,SAAS,WAAW,WAAW,GACtD,UACH;AAAA;AAAA,EACF;AAEJ;AAGO,SAAS,gBAAwC;AACtD,QAAM,UAAM,yBAAW,iBAAiB;AACxC,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AACA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../../../src/auth/google/client/index.tsx"],"sourcesContent":["\"use client\";\n\nimport {\n  createContext,\n  useCallback,\n  useContext,\n  useEffect,\n  useRef,\n  useState,\n  type ReactNode,\n} from \"react\";\nimport {\n  GoogleOAuthProvider,\n  GoogleLogin,\n  googleLogout,\n  type CredentialResponse,\n} from \"@react-oauth/google\";\n// Imported via the public specifier so we share the SAME context instance as\n// the consumer's edit primitives at runtime (see tsup `external` + tsconfig paths).\nimport { CmsAuthProvider } from \"@dalgoridim/headless-cms/client\";\n\n/**\n * Client provider for **Google sign-in**, built on `@react-oauth/google` (the\n * official React wrapper for Google Identity Services). It handles the GSI\n * script + button rendering robustly — including remounts, so the button shows\n * reliably every time a sign-in dialog opens. The resulting ID token is stashed\n * in a cookie for the server `googleAuth` adapter to verify; admin status is\n * optimistic on the client (via `adminEmails`), with the server gate\n * authoritative.\n *\n * Render `<GoogleSignInButton />` anywhere inside the provider to show the\n * official Google button.\n */\n\nexport interface GoogleUser {\n  sub: string;\n  email?: string;\n  name?: string;\n  picture?: string;\n}\n\nexport interface GoogleAuthProviderProps {\n  children: ReactNode;\n  /** OAuth 2.0 Web client ID (from Google Cloud Console → Credentials). */\n  clientId: string;\n  /**\n   * Optional admin allowlist for *optimistic* client-side `isAdmin`. The server\n   * `googleAuth` adapter still enforces the real gate. Omit to treat any\n   * successful sign-in as optimistically admin (server will correct via 401).\n   */\n  adminEmails?: string[];\n  /** Cookie name for the ID token. Default `adminToken`. */\n  cookieName?: string;\n  /** Called when a 401 `{ logout: true }` response is intercepted. */\n  onLogout?: () => void;\n}\n\nexport interface GoogleAuthContextValue {\n  user: GoogleUser | null;\n  isAdmin: boolean;\n  isEditing: boolean;\n  toggleEdit: () => void;\n  logout: () => void;\n  /** Feed a Google ID token credential (used by `GoogleSignInButton`). */\n  applyCredential: (credential: string) => void;\n}\n\nconst GoogleAuthContext = createContext<GoogleAuthContextValue | undefined>(\n  undefined,\n);\n\nfunction setCookie(name: string, value: string) {\n  document.cookie = `${name}=${encodeURIComponent(value)}; path=/; samesite=lax`;\n}\nfunction deleteCookie(name: string) {\n  document.cookie = `${name}=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT`;\n}\nfunction readCookie(name: string): string | null {\n  for (const part of document.cookie.split(\";\")) {\n    const [k, ...v] = part.trim().split(\"=\");\n    if (k === name) return decodeURIComponent(v.join(\"=\"));\n  }\n  return null;\n}\n\n/** Decode a JWT payload client-side (no verification — the server does that). */\nfunction decodeJwt(token: string): (GoogleUser & { exp?: number }) | null {\n  try {\n    const payload = token.split(\".\")[1];\n    const json = atob(payload.replace(/-/g, \"+\").replace(/_/g, \"/\"));\n    return JSON.parse(json);\n  } catch {\n    return null;\n  }\n}\n\nfunction AuthState({\n  children,\n  adminEmails,\n  cookieName = \"adminToken\",\n  onLogout,\n}: Omit<GoogleAuthProviderProps, \"clientId\">) {\n  const [user, setUser] = useState<GoogleUser | null>(null);\n  const [isAdmin, setIsAdmin] = useState(false);\n  const [isEditing, setIsEditing] = useState(false);\n  const allowed = useRef(\n    (adminEmails ?? []).map((e) => e.trim().toLowerCase()),\n  );\n\n  const applyCredential = useCallback(\n    (token: string) => {\n      const claims = decodeJwt(token);\n      if (!claims) return;\n      if (claims.exp && claims.exp * 1000 <= Date.now()) {\n        deleteCookie(cookieName);\n        return;\n      }\n      const email = claims.email?.toLowerCase();\n      // Optimistic: if no allowlist supplied, trust the sign-in and let the\n      // server correct a non-admin via the 401 interceptor below.\n      const admin =\n        allowed.current.length === 0\n          ? true\n          : !!email && allowed.current.includes(email);\n      setCookie(cookieName, token);\n      setUser({\n        sub: claims.sub,\n        email: claims.email,\n        name: claims.name,\n        picture: claims.picture,\n      });\n      setIsAdmin(admin);\n    },\n    [cookieName],\n  );\n\n  // Restore an existing session from the cookie on mount.\n  useEffect(() => {\n    const existing = readCookie(cookieName);\n    if (existing) applyCredential(existing);\n  }, [cookieName, applyCredential]);\n\n  const logout = useCallback(() => {\n    googleLogout();\n    deleteCookie(cookieName);\n    setUser(null);\n    setIsAdmin(false);\n    setIsEditing(false);\n    onLogout?.();\n  }, [cookieName, onLogout]);\n\n  // Intercept admin 401s so an expired/forbidden session forces sign-out.\n  useEffect(() => {\n    const originalFetch = window.fetch;\n    window.fetch = async (...args: Parameters<typeof fetch>) => {\n      const response = await originalFetch(...args);\n      if (response.status === 401) {\n        try {\n          const data = await response.clone().json();\n          if (data?.logout) logout();\n        } catch {\n          /* not a JSON body — ignore */\n        }\n      }\n      return response;\n    };\n    return () => {\n      window.fetch = originalFetch;\n    };\n  }, [logout]);\n\n  const toggleEdit = useCallback(() => setIsEditing((p) => !p), []);\n\n  return (\n    <GoogleAuthContext.Provider\n      value={{ user, isAdmin, isEditing, toggleEdit, logout, applyCredential }}\n    >\n      <CmsAuthProvider value={{ isAdmin, isEditing, toggleEdit }}>\n        {children}\n      </CmsAuthProvider>\n    </GoogleAuthContext.Provider>\n  );\n}\n\nexport function GoogleAuthProvider({\n  children,\n  clientId,\n  ...rest\n}: GoogleAuthProviderProps) {\n  return (\n    <GoogleOAuthProvider clientId={clientId}>\n      <AuthState {...rest}>{children}</AuthState>\n    </GoogleOAuthProvider>\n  );\n}\n\nexport interface GoogleSignInButtonProps {\n  /** Forwarded to the underlying `<GoogleLogin>` (theme, shape, size, text…). */\n  theme?: \"outline\" | \"filled_blue\" | \"filled_black\";\n  shape?: \"rectangular\" | \"pill\" | \"circle\" | \"square\";\n  size?: \"small\" | \"medium\" | \"large\";\n  text?: \"signin_with\" | \"signup_with\" | \"continue_with\" | \"signin\";\n  onError?: () => void;\n}\n\n/** The official Google sign-in button. Must be rendered inside a provider. */\nexport function GoogleSignInButton({\n  theme = \"filled_black\",\n  shape = \"pill\",\n  size = \"large\",\n  text = \"continue_with\",\n  onError,\n}: GoogleSignInButtonProps) {\n  const { applyCredential } = useGoogleAuth();\n  return (\n    <GoogleLogin\n      onSuccess={(res: CredentialResponse) => {\n        if (res.credential) applyCredential(res.credential);\n      }}\n      onError={onError}\n      theme={theme}\n      shape={shape}\n      size={size}\n      text={text}\n    />\n  );\n}\n\n/** Google auth API (user/logout) for login pages and toolbars. */\nexport function useGoogleAuth(): GoogleAuthContextValue {\n  const ctx = useContext(GoogleAuthContext);\n  if (!ctx) {\n    throw new Error(\"useGoogleAuth must be used within a GoogleAuthProvider\");\n  }\n  return ctx;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,mBAQO;AACP,oBAKO;AAGP,oBAAgC;AA8J1B;AA9GN,IAAM,wBAAoB;AAAA,EACxB;AACF;AAEA,SAAS,UAAU,MAAc,OAAe;AAC9C,WAAS,SAAS,GAAG,IAAI,IAAI,mBAAmB,KAAK,CAAC;AACxD;AACA,SAAS,aAAa,MAAc;AAClC,WAAS,SAAS,GAAG,IAAI;AAC3B;AACA,SAAS,WAAW,MAA6B;AAC/C,aAAW,QAAQ,SAAS,OAAO,MAAM,GAAG,GAAG;AAC7C,UAAM,CAAC,GAAG,GAAG,CAAC,IAAI,KAAK,KAAK,EAAE,MAAM,GAAG;AACvC,QAAI,MAAM,KAAM,QAAO,mBAAmB,EAAE,KAAK,GAAG,CAAC;AAAA,EACvD;AACA,SAAO;AACT;AAGA,SAAS,UAAU,OAAuD;AACxE,MAAI;AACF,UAAM,UAAU,MAAM,MAAM,GAAG,EAAE,CAAC;AAClC,UAAM,OAAO,KAAK,QAAQ,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,CAAC;AAC/D,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,SAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,UAAU;AAAA,EACjB;AAAA,EACA;AAAA,EACA,aAAa;AAAA,EACb;AACF,GAA8C;AAC5C,QAAM,CAAC,MAAM,OAAO,QAAI,uBAA4B,IAAI;AACxD,QAAM,CAAC,SAAS,UAAU,QAAI,uBAAS,KAAK;AAC5C,QAAM,CAAC,WAAW,YAAY,QAAI,uBAAS,KAAK;AAChD,QAAM,cAAU;AAAA,KACb,oCAAe,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC;AAAA,EACvD;AAEA,QAAM,sBAAkB;AAAA,IACtB,CAAC,UAAkB;AA9GvB;AA+GM,YAAM,SAAS,UAAU,KAAK;AAC9B,UAAI,CAAC,OAAQ;AACb,UAAI,OAAO,OAAO,OAAO,MAAM,OAAQ,KAAK,IAAI,GAAG;AACjD,qBAAa,UAAU;AACvB;AAAA,MACF;AACA,YAAM,SAAQ,YAAO,UAAP,mBAAc;AAG5B,YAAM,QACJ,QAAQ,QAAQ,WAAW,IACvB,OACA,CAAC,CAAC,SAAS,QAAQ,QAAQ,SAAS,KAAK;AAC/C,gBAAU,YAAY,KAAK;AAC3B,cAAQ;AAAA,QACN,KAAK,OAAO;AAAA,QACZ,OAAO,OAAO;AAAA,QACd,MAAM,OAAO;AAAA,QACb,SAAS,OAAO;AAAA,MAClB,CAAC;AACD,iBAAW,KAAK;AAAA,IAClB;AAAA,IACA,CAAC,UAAU;AAAA,EACb;AAGA,8BAAU,MAAM;AACd,UAAM,WAAW,WAAW,UAAU;AACtC,QAAI,SAAU,iBAAgB,QAAQ;AAAA,EACxC,GAAG,CAAC,YAAY,eAAe,CAAC;AAEhC,QAAM,aAAS,0BAAY,MAAM;AAC/B,oCAAa;AACb,iBAAa,UAAU;AACvB,YAAQ,IAAI;AACZ,eAAW,KAAK;AAChB,iBAAa,KAAK;AAClB;AAAA,EACF,GAAG,CAAC,YAAY,QAAQ,CAAC;AAGzB,8BAAU,MAAM;AACd,UAAM,gBAAgB,OAAO;AAC7B,WAAO,QAAQ,UAAU,SAAmC;AAC1D,YAAM,WAAW,MAAM,cAAc,GAAG,IAAI;AAC5C,UAAI,SAAS,WAAW,KAAK;AAC3B,YAAI;AACF,gBAAM,OAAO,MAAM,SAAS,MAAM,EAAE,KAAK;AACzC,cAAI,6BAAM,OAAQ,QAAO;AAAA,QAC3B,SAAQ;AAAA,QAER;AAAA,MACF;AACA,aAAO;AAAA,IACT;AACA,WAAO,MAAM;AACX,aAAO,QAAQ;AAAA,IACjB;AAAA,EACF,GAAG,CAAC,MAAM,CAAC;AAEX,QAAM,iBAAa,0BAAY,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC;AAEhE,SACE;AAAA,IAAC,kBAAkB;AAAA,IAAlB;AAAA,MACC,OAAO,EAAE,MAAM,SAAS,WAAW,YAAY,QAAQ,gBAAgB;AAAA,MAEvE,sDAAC,iCAAgB,OAAO,EAAE,SAAS,WAAW,WAAW,GACtD,UACH;AAAA;AAAA,EACF;AAEJ;AAEO,SAAS,mBAAmB,IAIP;AAJO,eACjC;AAAA;AAAA,IACA;AAAA,EA1LF,IAwLmC,IAG9B,iBAH8B,IAG9B;AAAA,IAFH;AAAA,IACA;AAAA;AAGA,SACE,4CAAC,qCAAoB,UACnB,sDAAC,4CAAc,OAAd,EAAqB,WAAS,GACjC;AAEJ;AAYO,SAAS,mBAAmB;AAAA,EACjC,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,OAAO;AAAA,EACP;AACF,GAA4B;AAC1B,QAAM,EAAE,gBAAgB,IAAI,cAAc;AAC1C,SACE;AAAA,IAAC;AAAA;AAAA,MACC,WAAW,CAAC,QAA4B;AACtC,YAAI,IAAI,WAAY,iBAAgB,IAAI,UAAU;AAAA,MACpD;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA;AAAA,EACF;AAEJ;AAGO,SAAS,gBAAwC;AACtD,QAAM,UAAM,yBAAW,iBAAiB;AACxC,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AACA,SAAO;AACT;","names":[]}

package/dist/auth/google/client/index.d.cts

@@ -1,38 +1,18 @@
-import * as React from 'react';
+import * as react from 'react';
 import { ReactNode } from 'react';
 
-/** Minimal slice of the Google Identity Services API we use. */
-interface GsiCredentialResponse {
-    credential: string;
-}
-interface GsiButtonOptions {
-    type?: "standard" | "icon";
-    theme?: "outline" | "filled_blue" | "filled_black";
-    size?: "small" | "medium" | "large";
-    text?: "signin_with" | "signup_with" | "continue_with" | "signin";
-    shape?: "rectangular" | "pill" | "circle" | "square";
-    width?: number;
-}
-interface GsiClient {
-    accounts: {
-        id: {
-            initialize: (config: {
-                client_id: string;
-                callback: (res: GsiCredentialResponse) => void;
-                auto_select?: boolean;
-                cancel_on_tap_outside?: boolean;
-            }) => void;
-            prompt: () => void;
-            renderButton: (el: HTMLElement, options?: GsiButtonOptions) => void;
-            disableAutoSelect: () => void;
-        };
-    };
-}
-declare global {
-    interface Window {
-        google?: GsiClient;
-    }
-}
+/**
+ * Client provider for **Google sign-in**, built on `@react-oauth/google` (the
+ * official React wrapper for Google Identity Services). It handles the GSI
+ * script + button rendering robustly — including remounts, so the button shows
+ * reliably every time a sign-in dialog opens. The resulting ID token is stashed
+ * in a cookie for the server `googleAuth` adapter to verify; admin status is
+ * optimistic on the client (via `adminEmails`), with the server gate
+ * authoritative.
+ *
+ * Render `<GoogleSignInButton />` anywhere inside the provider to show the
+ * official Google button.
+ */
 interface GoogleUser {
     sub: string;
     email?: string;
@@ -59,16 +39,22 @@ interface GoogleAuthContextValue {
     isAdmin: boolean;
     isEditing: boolean;
     toggleEdit: () => void;
-    /** True once the GSI script has loaded and the client is initialized. */
-    ready: boolean;
-    /** Trigger Google One Tap / sign-in prompt. */
-    promptSignIn: () => void;
-    /** Render the official Google button into `el` (most reliable trigger). */
-    renderButton: (el: HTMLElement, options?: GsiButtonOptions) => void;
     logout: () => void;
+    /** Feed a Google ID token credential (used by `GoogleSignInButton`). */
+    applyCredential: (credential: string) => void;
+}
+declare function GoogleAuthProvider({ children, clientId, ...rest }: GoogleAuthProviderProps): react.JSX.Element;
+interface GoogleSignInButtonProps {
+    /** Forwarded to the underlying `<GoogleLogin>` (theme, shape, size, text…). */
+    theme?: "outline" | "filled_blue" | "filled_black";
+    shape?: "rectangular" | "pill" | "circle" | "square";
+    size?: "small" | "medium" | "large";
+    text?: "signin_with" | "signup_with" | "continue_with" | "signin";
+    onError?: () => void;
 }
-declare function GoogleAuthProvider({ children, clientId, adminEmails, cookieName, onLogout, }: GoogleAuthProviderProps): React.JSX.Element;
-/** Google auth API (user/login/logout) for login pages and toolbars. */
+/** The official Google sign-in button. Must be rendered inside a provider. */
+declare function GoogleSignInButton({ theme, shape, size, text, onError, }: GoogleSignInButtonProps): react.JSX.Element;
+/** Google auth API (user/logout) for login pages and toolbars. */
 declare function useGoogleAuth(): GoogleAuthContextValue;
 
-export { type GoogleAuthContextValue, GoogleAuthProvider, type GoogleAuthProviderProps, type GoogleUser, useGoogleAuth };
+export { type GoogleAuthContextValue, GoogleAuthProvider, type GoogleAuthProviderProps, GoogleSignInButton, type GoogleSignInButtonProps, type GoogleUser, useGoogleAuth };

package/dist/auth/google/client/index.d.ts

@@ -1,38 +1,18 @@
-import * as React from 'react';
+import * as react from 'react';
 import { ReactNode } from 'react';
 
-/** Minimal slice of the Google Identity Services API we use. */
-interface GsiCredentialResponse {
-    credential: string;
-}
-interface GsiButtonOptions {
-    type?: "standard" | "icon";
-    theme?: "outline" | "filled_blue" | "filled_black";
-    size?: "small" | "medium" | "large";
-    text?: "signin_with" | "signup_with" | "continue_with" | "signin";
-    shape?: "rectangular" | "pill" | "circle" | "square";
-    width?: number;
-}
-interface GsiClient {
-    accounts: {
-        id: {
-            initialize: (config: {
-                client_id: string;
-                callback: (res: GsiCredentialResponse) => void;
-                auto_select?: boolean;
-                cancel_on_tap_outside?: boolean;
-            }) => void;
-            prompt: () => void;
-            renderButton: (el: HTMLElement, options?: GsiButtonOptions) => void;
-            disableAutoSelect: () => void;
-        };
-    };
-}
-declare global {
-    interface Window {
-        google?: GsiClient;
-    }
-}
+/**
+ * Client provider for **Google sign-in**, built on `@react-oauth/google` (the
+ * official React wrapper for Google Identity Services). It handles the GSI
+ * script + button rendering robustly — including remounts, so the button shows
+ * reliably every time a sign-in dialog opens. The resulting ID token is stashed
+ * in a cookie for the server `googleAuth` adapter to verify; admin status is
+ * optimistic on the client (via `adminEmails`), with the server gate
+ * authoritative.
+ *
+ * Render `<GoogleSignInButton />` anywhere inside the provider to show the
+ * official Google button.
+ */
 interface GoogleUser {
     sub: string;
     email?: string;
@@ -59,16 +39,22 @@ interface GoogleAuthContextValue {
     isAdmin: boolean;
     isEditing: boolean;
     toggleEdit: () => void;
-    /** True once the GSI script has loaded and the client is initialized. */
-    ready: boolean;
-    /** Trigger Google One Tap / sign-in prompt. */
-    promptSignIn: () => void;
-    /** Render the official Google button into `el` (most reliable trigger). */
-    renderButton: (el: HTMLElement, options?: GsiButtonOptions) => void;
     logout: () => void;
+    /** Feed a Google ID token credential (used by `GoogleSignInButton`). */
+    applyCredential: (credential: string) => void;
+}
+declare function GoogleAuthProvider({ children, clientId, ...rest }: GoogleAuthProviderProps): react.JSX.Element;
+interface GoogleSignInButtonProps {
+    /** Forwarded to the underlying `<GoogleLogin>` (theme, shape, size, text…). */
+    theme?: "outline" | "filled_blue" | "filled_black";
+    shape?: "rectangular" | "pill" | "circle" | "square";
+    size?: "small" | "medium" | "large";
+    text?: "signin_with" | "signup_with" | "continue_with" | "signin";
+    onError?: () => void;
 }
-declare function GoogleAuthProvider({ children, clientId, adminEmails, cookieName, onLogout, }: GoogleAuthProviderProps): React.JSX.Element;
-/** Google auth API (user/login/logout) for login pages and toolbars. */
+/** The official Google sign-in button. Must be rendered inside a provider. */
+declare function GoogleSignInButton({ theme, shape, size, text, onError, }: GoogleSignInButtonProps): react.JSX.Element;
+/** Google auth API (user/logout) for login pages and toolbars. */
 declare function useGoogleAuth(): GoogleAuthContextValue;
 
-export { type GoogleAuthContextValue, GoogleAuthProvider, type GoogleAuthProviderProps, type GoogleUser, useGoogleAuth };
+export { type GoogleAuthContextValue, GoogleAuthProvider, type GoogleAuthProviderProps, GoogleSignInButton, type GoogleSignInButtonProps, type GoogleUser, useGoogleAuth };

package/dist/auth/google/client/index.js

@@ -1,4 +1,35 @@
 "use client";
+var __defProp = Object.defineProperty;
+var __defProps = Object.defineProperties;
+var __getOwnPropDescs = Object.getOwnPropertyDescriptors;
+var __getOwnPropSymbols = Object.getOwnPropertySymbols;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __propIsEnum = Object.prototype.propertyIsEnumerable;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __spreadValues = (a, b) => {
+  for (var prop in b || (b = {}))
+    if (__hasOwnProp.call(b, prop))
+      __defNormalProp(a, prop, b[prop]);
+  if (__getOwnPropSymbols)
+    for (var prop of __getOwnPropSymbols(b)) {
+      if (__propIsEnum.call(b, prop))
+        __defNormalProp(a, prop, b[prop]);
+    }
+  return a;
+};
+var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
+var __objRest = (source, exclude) => {
+  var target = {};
+  for (var prop in source)
+    if (__hasOwnProp.call(source, prop) && exclude.indexOf(prop) < 0)
+      target[prop] = source[prop];
+  if (source != null && __getOwnPropSymbols)
+    for (var prop of __getOwnPropSymbols(source)) {
+      if (exclude.indexOf(prop) < 0 && __propIsEnum.call(source, prop))
+        target[prop] = source[prop];
+    }
+  return target;
+};
 
 // src/auth/google/client/index.tsx
 import {
@@ -9,9 +40,13 @@ import {
   useRef,
   useState
 } from "react";
+import {
+  GoogleOAuthProvider,
+  GoogleLogin,
+  googleLogout
+} from "@react-oauth/google";
 import { CmsAuthProvider } from "@dalgoridim/headless-cms/client";
 import { jsx } from "react/jsx-runtime";
-var GSI_SRC = "https://accounts.google.com/gsi/client";
 var GoogleAuthContext = createContext(
   void 0
 );
@@ -32,15 +67,13 @@ function decodeJwt(token) {
   try {
     const payload = token.split(".")[1];
     const json = atob(payload.replace(/-/g, "+").replace(/_/g, "/"));
-    const data = JSON.parse(json);
-    return data;
+    return JSON.parse(json);
   } catch (e) {
     return null;
   }
 }
-function GoogleAuthProvider({
+function AuthState({
   children,
-  clientId,
   adminEmails,
   cookieName = "adminToken",
   onLogout
@@ -48,11 +81,10 @@ function GoogleAuthProvider({
   const [user, setUser] = useState(null);
   const [isAdmin, setIsAdmin] = useState(false);
   const [isEditing, setIsEditing] = useState(false);
-  const [ready, setReady] = useState(false);
   const allowed = useRef(
     (adminEmails != null ? adminEmails : []).map((e) => e.trim().toLowerCase())
   );
-  const applyToken = useCallback(
+  const applyCredential = useCallback(
     (token) => {
       var _a;
       const claims = decodeJwt(token);
@@ -76,37 +108,16 @@ function GoogleAuthProvider({
   );
   useEffect(() => {
     const existing = readCookie(cookieName);
-    if (existing) applyToken(existing);
-  }, [cookieName, applyToken]);
-  useEffect(() => {
-    function init() {
-      if (!window.google) return;
-      window.google.accounts.id.initialize({
-        client_id: clientId,
-        callback: (res) => applyToken(res.credential),
-        auto_select: false,
-        cancel_on_tap_outside: true
-      });
-      setReady(true);
-    }
-    if (window.google) {
-      init();
-      return;
-    }
-    const existing = document.querySelector(
-      `script[src="${GSI_SRC}"]`
-    );
-    if (existing) {
-      existing.addEventListener("load", init);
-      return () => existing.removeEventListener("load", init);
-    }
-    const script = document.createElement("script");
-    script.src = GSI_SRC;
-    script.async = true;
-    script.defer = true;
-    script.onload = init;
-    document.head.appendChild(script);
-  }, [clientId, applyToken]);
+    if (existing) applyCredential(existing);
+  }, [cookieName, applyCredential]);
+  const logout = useCallback(() => {
+    googleLogout();
+    deleteCookie(cookieName);
+    setUser(null);
+    setIsAdmin(false);
+    setIsEditing(false);
+    onLogout == null ? void 0 : onLogout();
+  }, [cookieName, onLogout]);
   useEffect(() => {
     const originalFetch = window.fetch;
     window.fetch = async (...args) => {
@@ -114,7 +125,7 @@ function GoogleAuthProvider({
       if (response.status === 401) {
         try {
           const data = await response.clone().json();
-          if (data == null ? void 0 : data.logout) doLogout();
+          if (data == null ? void 0 : data.logout) logout();
         } catch (e) {
         }
       }
@@ -123,47 +134,48 @@ function GoogleAuthProvider({
     return () => {
       window.fetch = originalFetch;
     };
-  }, []);
-  function doLogout() {
-    var _a;
-    (_a = window.google) == null ? void 0 : _a.accounts.id.disableAutoSelect();
-    deleteCookie(cookieName);
-    setUser(null);
-    setIsAdmin(false);
-    setIsEditing(false);
-    onLogout == null ? void 0 : onLogout();
-  }
-  const promptSignIn = useCallback(() => {
-    var _a;
-    if (!ready) return;
-    (_a = window.google) == null ? void 0 : _a.accounts.id.prompt();
-  }, [ready]);
-  const renderButton = useCallback(
-    (el, options) => {
-      var _a;
-      if (!ready) return;
-      (_a = window.google) == null ? void 0 : _a.accounts.id.renderButton(el, options);
-    },
-    [ready]
-  );
+  }, [logout]);
   const toggleEdit = useCallback(() => setIsEditing((p) => !p), []);
   return /* @__PURE__ */ jsx(
     GoogleAuthContext.Provider,
     {
-      value: {
-        user,
-        isAdmin,
-        isEditing,
-        toggleEdit,
-        ready,
-        promptSignIn,
-        renderButton,
-        logout: doLogout
-      },
+      value: { user, isAdmin, isEditing, toggleEdit, logout, applyCredential },
       children: /* @__PURE__ */ jsx(CmsAuthProvider, { value: { isAdmin, isEditing, toggleEdit }, children })
     }
   );
 }
+function GoogleAuthProvider(_a) {
+  var _b = _a, {
+    children,
+    clientId
+  } = _b, rest = __objRest(_b, [
+    "children",
+    "clientId"
+  ]);
+  return /* @__PURE__ */ jsx(GoogleOAuthProvider, { clientId, children: /* @__PURE__ */ jsx(AuthState, __spreadProps(__spreadValues({}, rest), { children })) });
+}
+function GoogleSignInButton({
+  theme = "filled_black",
+  shape = "pill",
+  size = "large",
+  text = "continue_with",
+  onError
+}) {
+  const { applyCredential } = useGoogleAuth();
+  return /* @__PURE__ */ jsx(
+    GoogleLogin,
+    {
+      onSuccess: (res) => {
+        if (res.credential) applyCredential(res.credential);
+      },
+      onError,
+      theme,
+      shape,
+      size,
+      text
+    }
+  );
+}
 function useGoogleAuth() {
   const ctx = useContext(GoogleAuthContext);
   if (!ctx) {
@@ -173,6 +185,7 @@ function useGoogleAuth() {
 }
 export {
   GoogleAuthProvider,
+  GoogleSignInButton,
   useGoogleAuth
 };
 //# sourceMappingURL=index.js.map

package/dist/auth/google/client/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/auth/google/client/index.tsx"],"sourcesContent":["\"use client\";\n\nimport {\n  createContext,\n  useCallback,\n  useContext,\n  useEffect,\n  useRef,\n  useState,\n  type ReactNode,\n} from \"react\";\n// Imported via the public specifier so we share the SAME context instance as\n// the consumer's edit primitives at runtime (see tsup `external` + tsconfig paths).\nimport { CmsAuthProvider } from \"@dalgoridim/headless-cms/client\";\n\n/**\n * Client provider for **Google Identity Services** sign-in — the Firebase-free\n * counterpart to `FirebaseAuthProvider`. It loads the GSI script, lets the user\n * sign in with Google, stashes the resulting ID token in a cookie for the\n * server `googleAuth` adapter to verify, and feeds the shared CMS auth context\n * so the edit primitives light up. Admin status is optimistic on the client\n * (via `adminEmails`); the server gate remains authoritative.\n */\n\nconst GSI_SRC = \"https://accounts.google.com/gsi/client\";\n\n/** Minimal slice of the Google Identity Services API we use. */\ninterface GsiCredentialResponse {\n  credential: string;\n}\ninterface GsiButtonOptions {\n  type?: \"standard\" | \"icon\";\n  theme?: \"outline\" | \"filled_blue\" | \"filled_black\";\n  size?: \"small\" | \"medium\" | \"large\";\n  text?: \"signin_with\" | \"signup_with\" | \"continue_with\" | \"signin\";\n  shape?: \"rectangular\" | \"pill\" | \"circle\" | \"square\";\n  width?: number;\n}\ninterface GsiClient {\n  accounts: {\n    id: {\n      initialize: (config: {\n        client_id: string;\n        callback: (res: GsiCredentialResponse) => void;\n        auto_select?: boolean;\n        cancel_on_tap_outside?: boolean;\n      }) => void;\n      prompt: () => void;\n      renderButton: (el: HTMLElement, options?: GsiButtonOptions) => void;\n      disableAutoSelect: () => void;\n    };\n  };\n}\n\ndeclare global {\n  interface Window {\n    google?: GsiClient;\n  }\n}\n\nexport interface GoogleUser {\n  sub: string;\n  email?: string;\n  name?: string;\n  picture?: string;\n}\n\nexport interface GoogleAuthProviderProps {\n  children: ReactNode;\n  /** OAuth 2.0 Web client ID (from Google Cloud Console → Credentials). */\n  clientId: string;\n  /**\n   * Optional admin allowlist for *optimistic* client-side `isAdmin`. The server\n   * `googleAuth` adapter still enforces the real gate. Omit to treat any\n   * successful sign-in as optimistically admin (server will correct via 401).\n   */\n  adminEmails?: string[];\n  /** Cookie name for the ID token. Default `adminToken`. */\n  cookieName?: string;\n  /** Called when a 401 `{ logout: true }` response is intercepted. */\n  onLogout?: () => void;\n}\n\nexport interface GoogleAuthContextValue {\n  user: GoogleUser | null;\n  isAdmin: boolean;\n  isEditing: boolean;\n  toggleEdit: () => void;\n  /** True once the GSI script has loaded and the client is initialized. */\n  ready: boolean;\n  /** Trigger Google One Tap / sign-in prompt. */\n  promptSignIn: () => void;\n  /** Render the official Google button into `el` (most reliable trigger). */\n  renderButton: (el: HTMLElement, options?: GsiButtonOptions) => void;\n  logout: () => void;\n}\n\nconst GoogleAuthContext = createContext<GoogleAuthContextValue | undefined>(\n  undefined,\n);\n\nfunction setCookie(name: string, value: string) {\n  document.cookie = `${name}=${encodeURIComponent(value)}; path=/; samesite=lax`;\n}\nfunction deleteCookie(name: string) {\n  document.cookie = `${name}=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT`;\n}\nfunction readCookie(name: string): string | null {\n  for (const part of document.cookie.split(\";\")) {\n    const [k, ...v] = part.trim().split(\"=\");\n    if (k === name) return decodeURIComponent(v.join(\"=\"));\n  }\n  return null;\n}\n\n/** Decode a JWT payload client-side (no verification — the server does that). */\nfunction decodeJwt(token: string): (GoogleUser & { exp?: number }) | null {\n  try {\n    const payload = token.split(\".\")[1];\n    const json = atob(payload.replace(/-/g, \"+\").replace(/_/g, \"/\"));\n    const data = JSON.parse(json) as {\n      sub: string;\n      email?: string;\n      name?: string;\n      picture?: string;\n      exp?: number;\n    };\n    return data;\n  } catch {\n    return null;\n  }\n}\n\nexport function GoogleAuthProvider({\n  children,\n  clientId,\n  adminEmails,\n  cookieName = \"adminToken\",\n  onLogout,\n}: GoogleAuthProviderProps) {\n  const [user, setUser] = useState<GoogleUser | null>(null);\n  const [isAdmin, setIsAdmin] = useState(false);\n  const [isEditing, setIsEditing] = useState(false);\n  const [ready, setReady] = useState(false);\n  const allowed = useRef(\n    (adminEmails ?? []).map((e) => e.trim().toLowerCase()),\n  );\n\n  const applyToken = useCallback(\n    (token: string) => {\n      const claims = decodeJwt(token);\n      if (!claims) return;\n      if (claims.exp && claims.exp * 1000 <= Date.now()) {\n        deleteCookie(cookieName);\n        return;\n      }\n      const email = claims.email?.toLowerCase();\n      // Optimistic: if no allowlist supplied, trust the sign-in and let the\n      // server correct a non-admin via the 401 interceptor below.\n      const admin =\n        allowed.current.length === 0\n          ? true\n          : !!email && allowed.current.includes(email);\n      setCookie(cookieName, token);\n      setUser({\n        sub: claims.sub,\n        email: claims.email,\n        name: claims.name,\n        picture: claims.picture,\n      });\n      setIsAdmin(admin);\n    },\n    [cookieName],\n  );\n\n  // Restore an existing session from the cookie on mount.\n  useEffect(() => {\n    const existing = readCookie(cookieName);\n    if (existing) applyToken(existing);\n  }, [cookieName, applyToken]);\n\n  // Load the GSI script and initialize the One Tap / button client.\n  useEffect(() => {\n    function init() {\n      if (!window.google) return;\n      window.google.accounts.id.initialize({\n        client_id: clientId,\n        callback: (res) => applyToken(res.credential),\n        auto_select: false,\n        cancel_on_tap_outside: true,\n      });\n      setReady(true);\n    }\n\n    if (window.google) {\n      init();\n      return;\n    }\n    const existing = document.querySelector<HTMLScriptElement>(\n      `script[src=\"${GSI_SRC}\"]`,\n    );\n    if (existing) {\n      existing.addEventListener(\"load\", init);\n      return () => existing.removeEventListener(\"load\", init);\n    }\n    const script = document.createElement(\"script\");\n    script.src = GSI_SRC;\n    script.async = true;\n    script.defer = true;\n    script.onload = init;\n    document.head.appendChild(script);\n  }, [clientId, applyToken]);\n\n  // Intercept admin 401s so an expired/forbidden session forces sign-out.\n  useEffect(() => {\n    const originalFetch = window.fetch;\n    window.fetch = async (...args: Parameters<typeof fetch>) => {\n      const response = await originalFetch(...args);\n      if (response.status === 401) {\n        try {\n          const data = await response.clone().json();\n          if (data?.logout) doLogout();\n        } catch {\n          /* not a JSON body — ignore */\n        }\n      }\n      return response;\n    };\n    return () => {\n      window.fetch = originalFetch;\n    };\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, []);\n\n  function doLogout() {\n    window.google?.accounts.id.disableAutoSelect();\n    deleteCookie(cookieName);\n    setUser(null);\n    setIsAdmin(false);\n    setIsEditing(false);\n    onLogout?.();\n  }\n\n  const promptSignIn = useCallback(() => {\n    if (!ready) return;\n    window.google?.accounts.id.prompt();\n  }, [ready]);\n\n  const renderButton = useCallback(\n    (el: HTMLElement, options?: GsiButtonOptions) => {\n      if (!ready) return;\n      window.google?.accounts.id.renderButton(el, options);\n    },\n    [ready],\n  );\n\n  const toggleEdit = useCallback(() => setIsEditing((p) => !p), []);\n\n  return (\n    <GoogleAuthContext.Provider\n      value={{\n        user,\n        isAdmin,\n        isEditing,\n        toggleEdit,\n        ready,\n        promptSignIn,\n        renderButton,\n        logout: doLogout,\n      }}\n    >\n      <CmsAuthProvider value={{ isAdmin, isEditing, toggleEdit }}>\n        {children}\n      </CmsAuthProvider>\n    </GoogleAuthContext.Provider>\n  );\n}\n\n/** Google auth API (user/login/logout) for login pages and toolbars. */\nexport function useGoogleAuth(): GoogleAuthContextValue {\n  const ctx = useContext(GoogleAuthContext);\n  if (!ctx) {\n    throw new Error(\"useGoogleAuth must be used within a GoogleAuthProvider\");\n  }\n  return ctx;\n}\n"],"mappings":";;;AAEA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAGP,SAAS,uBAAuB;AAkQ1B;AAvPN,IAAM,UAAU;AAyEhB,IAAM,oBAAoB;AAAA,EACxB;AACF;AAEA,SAAS,UAAU,MAAc,OAAe;AAC9C,WAAS,SAAS,GAAG,IAAI,IAAI,mBAAmB,KAAK,CAAC;AACxD;AACA,SAAS,aAAa,MAAc;AAClC,WAAS,SAAS,GAAG,IAAI;AAC3B;AACA,SAAS,WAAW,MAA6B;AAC/C,aAAW,QAAQ,SAAS,OAAO,MAAM,GAAG,GAAG;AAC7C,UAAM,CAAC,GAAG,GAAG,CAAC,IAAI,KAAK,KAAK,EAAE,MAAM,GAAG;AACvC,QAAI,MAAM,KAAM,QAAO,mBAAmB,EAAE,KAAK,GAAG,CAAC;AAAA,EACvD;AACA,SAAO;AACT;AAGA,SAAS,UAAU,OAAuD;AACxE,MAAI;AACF,UAAM,UAAU,MAAM,MAAM,GAAG,EAAE,CAAC;AAClC,UAAM,OAAO,KAAK,QAAQ,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,CAAC;AAC/D,UAAM,OAAO,KAAK,MAAM,IAAI;AAO5B,WAAO;AAAA,EACT,SAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,mBAAmB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA,aAAa;AAAA,EACb;AACF,GAA4B;AAC1B,QAAM,CAAC,MAAM,OAAO,IAAI,SAA4B,IAAI;AACxD,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,KAAK;AAC5C,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,KAAK;AAChD,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAS,KAAK;AACxC,QAAM,UAAU;AAAA,KACb,oCAAe,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC;AAAA,EACvD;AAEA,QAAM,aAAa;AAAA,IACjB,CAAC,UAAkB;AArJvB;AAsJM,YAAM,SAAS,UAAU,KAAK;AAC9B,UAAI,CAAC,OAAQ;AACb,UAAI,OAAO,OAAO,OAAO,MAAM,OAAQ,KAAK,IAAI,GAAG;AACjD,qBAAa,UAAU;AACvB;AAAA,MACF;AACA,YAAM,SAAQ,YAAO,UAAP,mBAAc;AAG5B,YAAM,QACJ,QAAQ,QAAQ,WAAW,IACvB,OACA,CAAC,CAAC,SAAS,QAAQ,QAAQ,SAAS,KAAK;AAC/C,gBAAU,YAAY,KAAK;AAC3B,cAAQ;AAAA,QACN,KAAK,OAAO;AAAA,QACZ,OAAO,OAAO;AAAA,QACd,MAAM,OAAO;AAAA,QACb,SAAS,OAAO;AAAA,MAClB,CAAC;AACD,iBAAW,KAAK;AAAA,IAClB;AAAA,IACA,CAAC,UAAU;AAAA,EACb;AAGA,YAAU,MAAM;AACd,UAAM,WAAW,WAAW,UAAU;AACtC,QAAI,SAAU,YAAW,QAAQ;AAAA,EACnC,GAAG,CAAC,YAAY,UAAU,CAAC;AAG3B,YAAU,MAAM;AACd,aAAS,OAAO;AACd,UAAI,CAAC,OAAO,OAAQ;AACpB,aAAO,OAAO,SAAS,GAAG,WAAW;AAAA,QACnC,WAAW;AAAA,QACX,UAAU,CAAC,QAAQ,WAAW,IAAI,UAAU;AAAA,QAC5C,aAAa;AAAA,QACb,uBAAuB;AAAA,MACzB,CAAC;AACD,eAAS,IAAI;AAAA,IACf;AAEA,QAAI,OAAO,QAAQ;AACjB,WAAK;AACL;AAAA,IACF;AACA,UAAM,WAAW,SAAS;AAAA,MACxB,eAAe,OAAO;AAAA,IACxB;AACA,QAAI,UAAU;AACZ,eAAS,iBAAiB,QAAQ,IAAI;AACtC,aAAO,MAAM,SAAS,oBAAoB,QAAQ,IAAI;AAAA,IACxD;AACA,UAAM,SAAS,SAAS,cAAc,QAAQ;AAC9C,WAAO,MAAM;AACb,WAAO,QAAQ;AACf,WAAO,QAAQ;AACf,WAAO,SAAS;AAChB,aAAS,KAAK,YAAY,MAAM;AAAA,EAClC,GAAG,CAAC,UAAU,UAAU,CAAC;AAGzB,YAAU,MAAM;AACd,UAAM,gBAAgB,OAAO;AAC7B,WAAO,QAAQ,UAAU,SAAmC;AAC1D,YAAM,WAAW,MAAM,cAAc,GAAG,IAAI;AAC5C,UAAI,SAAS,WAAW,KAAK;AAC3B,YAAI;AACF,gBAAM,OAAO,MAAM,SAAS,MAAM,EAAE,KAAK;AACzC,cAAI,6BAAM,OAAQ,UAAS;AAAA,QAC7B,SAAQ;AAAA,QAER;AAAA,MACF;AACA,aAAO;AAAA,IACT;AACA,WAAO,MAAM;AACX,aAAO,QAAQ;AAAA,IACjB;AAAA,EAEF,GAAG,CAAC,CAAC;AAEL,WAAS,WAAW;AA1OtB;AA2OI,iBAAO,WAAP,mBAAe,SAAS,GAAG;AAC3B,iBAAa,UAAU;AACvB,YAAQ,IAAI;AACZ,eAAW,KAAK;AAChB,iBAAa,KAAK;AAClB;AAAA,EACF;AAEA,QAAM,eAAe,YAAY,MAAM;AAnPzC;AAoPI,QAAI,CAAC,MAAO;AACZ,iBAAO,WAAP,mBAAe,SAAS,GAAG;AAAA,EAC7B,GAAG,CAAC,KAAK,CAAC;AAEV,QAAM,eAAe;AAAA,IACnB,CAAC,IAAiB,YAA+B;AAzPrD;AA0PM,UAAI,CAAC,MAAO;AACZ,mBAAO,WAAP,mBAAe,SAAS,GAAG,aAAa,IAAI;AAAA,IAC9C;AAAA,IACA,CAAC,KAAK;AAAA,EACR;AAEA,QAAM,aAAa,YAAY,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC;AAEhE,SACE;AAAA,IAAC,kBAAkB;AAAA,IAAlB;AAAA,MACC,OAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,QAAQ;AAAA,MACV;AAAA,MAEA,8BAAC,mBAAgB,OAAO,EAAE,SAAS,WAAW,WAAW,GACtD,UACH;AAAA;AAAA,EACF;AAEJ;AAGO,SAAS,gBAAwC;AACtD,QAAM,MAAM,WAAW,iBAAiB;AACxC,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AACA,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../../../src/auth/google/client/index.tsx"],"sourcesContent":["\"use client\";\n\nimport {\n  createContext,\n  useCallback,\n  useContext,\n  useEffect,\n  useRef,\n  useState,\n  type ReactNode,\n} from \"react\";\nimport {\n  GoogleOAuthProvider,\n  GoogleLogin,\n  googleLogout,\n  type CredentialResponse,\n} from \"@react-oauth/google\";\n// Imported via the public specifier so we share the SAME context instance as\n// the consumer's edit primitives at runtime (see tsup `external` + tsconfig paths).\nimport { CmsAuthProvider } from \"@dalgoridim/headless-cms/client\";\n\n/**\n * Client provider for **Google sign-in**, built on `@react-oauth/google` (the\n * official React wrapper for Google Identity Services). It handles the GSI\n * script + button rendering robustly — including remounts, so the button shows\n * reliably every time a sign-in dialog opens. The resulting ID token is stashed\n * in a cookie for the server `googleAuth` adapter to verify; admin status is\n * optimistic on the client (via `adminEmails`), with the server gate\n * authoritative.\n *\n * Render `<GoogleSignInButton />` anywhere inside the provider to show the\n * official Google button.\n */\n\nexport interface GoogleUser {\n  sub: string;\n  email?: string;\n  name?: string;\n  picture?: string;\n}\n\nexport interface GoogleAuthProviderProps {\n  children: ReactNode;\n  /** OAuth 2.0 Web client ID (from Google Cloud Console → Credentials). */\n  clientId: string;\n  /**\n   * Optional admin allowlist for *optimistic* client-side `isAdmin`. The server\n   * `googleAuth` adapter still enforces the real gate. Omit to treat any\n   * successful sign-in as optimistically admin (server will correct via 401).\n   */\n  adminEmails?: string[];\n  /** Cookie name for the ID token. Default `adminToken`. */\n  cookieName?: string;\n  /** Called when a 401 `{ logout: true }` response is intercepted. */\n  onLogout?: () => void;\n}\n\nexport interface GoogleAuthContextValue {\n  user: GoogleUser | null;\n  isAdmin: boolean;\n  isEditing: boolean;\n  toggleEdit: () => void;\n  logout: () => void;\n  /** Feed a Google ID token credential (used by `GoogleSignInButton`). */\n  applyCredential: (credential: string) => void;\n}\n\nconst GoogleAuthContext = createContext<GoogleAuthContextValue | undefined>(\n  undefined,\n);\n\nfunction setCookie(name: string, value: string) {\n  document.cookie = `${name}=${encodeURIComponent(value)}; path=/; samesite=lax`;\n}\nfunction deleteCookie(name: string) {\n  document.cookie = `${name}=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT`;\n}\nfunction readCookie(name: string): string | null {\n  for (const part of document.cookie.split(\";\")) {\n    const [k, ...v] = part.trim().split(\"=\");\n    if (k === name) return decodeURIComponent(v.join(\"=\"));\n  }\n  return null;\n}\n\n/** Decode a JWT payload client-side (no verification — the server does that). */\nfunction decodeJwt(token: string): (GoogleUser & { exp?: number }) | null {\n  try {\n    const payload = token.split(\".\")[1];\n    const json = atob(payload.replace(/-/g, \"+\").replace(/_/g, \"/\"));\n    return JSON.parse(json);\n  } catch {\n    return null;\n  }\n}\n\nfunction AuthState({\n  children,\n  adminEmails,\n  cookieName = \"adminToken\",\n  onLogout,\n}: Omit<GoogleAuthProviderProps, \"clientId\">) {\n  const [user, setUser] = useState<GoogleUser | null>(null);\n  const [isAdmin, setIsAdmin] = useState(false);\n  const [isEditing, setIsEditing] = useState(false);\n  const allowed = useRef(\n    (adminEmails ?? []).map((e) => e.trim().toLowerCase()),\n  );\n\n  const applyCredential = useCallback(\n    (token: string) => {\n      const claims = decodeJwt(token);\n      if (!claims) return;\n      if (claims.exp && claims.exp * 1000 <= Date.now()) {\n        deleteCookie(cookieName);\n        return;\n      }\n      const email = claims.email?.toLowerCase();\n      // Optimistic: if no allowlist supplied, trust the sign-in and let the\n      // server correct a non-admin via the 401 interceptor below.\n      const admin =\n        allowed.current.length === 0\n          ? true\n          : !!email && allowed.current.includes(email);\n      setCookie(cookieName, token);\n      setUser({\n        sub: claims.sub,\n        email: claims.email,\n        name: claims.name,\n        picture: claims.picture,\n      });\n      setIsAdmin(admin);\n    },\n    [cookieName],\n  );\n\n  // Restore an existing session from the cookie on mount.\n  useEffect(() => {\n    const existing = readCookie(cookieName);\n    if (existing) applyCredential(existing);\n  }, [cookieName, applyCredential]);\n\n  const logout = useCallback(() => {\n    googleLogout();\n    deleteCookie(cookieName);\n    setUser(null);\n    setIsAdmin(false);\n    setIsEditing(false);\n    onLogout?.();\n  }, [cookieName, onLogout]);\n\n  // Intercept admin 401s so an expired/forbidden session forces sign-out.\n  useEffect(() => {\n    const originalFetch = window.fetch;\n    window.fetch = async (...args: Parameters<typeof fetch>) => {\n      const response = await originalFetch(...args);\n      if (response.status === 401) {\n        try {\n          const data = await response.clone().json();\n          if (data?.logout) logout();\n        } catch {\n          /* not a JSON body — ignore */\n        }\n      }\n      return response;\n    };\n    return () => {\n      window.fetch = originalFetch;\n    };\n  }, [logout]);\n\n  const toggleEdit = useCallback(() => setIsEditing((p) => !p), []);\n\n  return (\n    <GoogleAuthContext.Provider\n      value={{ user, isAdmin, isEditing, toggleEdit, logout, applyCredential }}\n    >\n      <CmsAuthProvider value={{ isAdmin, isEditing, toggleEdit }}>\n        {children}\n      </CmsAuthProvider>\n    </GoogleAuthContext.Provider>\n  );\n}\n\nexport function GoogleAuthProvider({\n  children,\n  clientId,\n  ...rest\n}: GoogleAuthProviderProps) {\n  return (\n    <GoogleOAuthProvider clientId={clientId}>\n      <AuthState {...rest}>{children}</AuthState>\n    </GoogleOAuthProvider>\n  );\n}\n\nexport interface GoogleSignInButtonProps {\n  /** Forwarded to the underlying `<GoogleLogin>` (theme, shape, size, text…). */\n  theme?: \"outline\" | \"filled_blue\" | \"filled_black\";\n  shape?: \"rectangular\" | \"pill\" | \"circle\" | \"square\";\n  size?: \"small\" | \"medium\" | \"large\";\n  text?: \"signin_with\" | \"signup_with\" | \"continue_with\" | \"signin\";\n  onError?: () => void;\n}\n\n/** The official Google sign-in button. Must be rendered inside a provider. */\nexport function GoogleSignInButton({\n  theme = \"filled_black\",\n  shape = \"pill\",\n  size = \"large\",\n  text = \"continue_with\",\n  onError,\n}: GoogleSignInButtonProps) {\n  const { applyCredential } = useGoogleAuth();\n  return (\n    <GoogleLogin\n      onSuccess={(res: CredentialResponse) => {\n        if (res.credential) applyCredential(res.credential);\n      }}\n      onError={onError}\n      theme={theme}\n      shape={shape}\n      size={size}\n      text={text}\n    />\n  );\n}\n\n/** Google auth API (user/logout) for login pages and toolbars. */\nexport function useGoogleAuth(): GoogleAuthContextValue {\n  const ctx = useContext(GoogleAuthContext);\n  if (!ctx) {\n    throw new Error(\"useGoogleAuth must be used within a GoogleAuthProvider\");\n  }\n  return ctx;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAGP,SAAS,uBAAuB;AA8J1B;AA9GN,IAAM,oBAAoB;AAAA,EACxB;AACF;AAEA,SAAS,UAAU,MAAc,OAAe;AAC9C,WAAS,SAAS,GAAG,IAAI,IAAI,mBAAmB,KAAK,CAAC;AACxD;AACA,SAAS,aAAa,MAAc;AAClC,WAAS,SAAS,GAAG,IAAI;AAC3B;AACA,SAAS,WAAW,MAA6B;AAC/C,aAAW,QAAQ,SAAS,OAAO,MAAM,GAAG,GAAG;AAC7C,UAAM,CAAC,GAAG,GAAG,CAAC,IAAI,KAAK,KAAK,EAAE,MAAM,GAAG;AACvC,QAAI,MAAM,KAAM,QAAO,mBAAmB,EAAE,KAAK,GAAG,CAAC;AAAA,EACvD;AACA,SAAO;AACT;AAGA,SAAS,UAAU,OAAuD;AACxE,MAAI;AACF,UAAM,UAAU,MAAM,MAAM,GAAG,EAAE,CAAC;AAClC,UAAM,OAAO,KAAK,QAAQ,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,CAAC;AAC/D,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,SAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,UAAU;AAAA,EACjB;AAAA,EACA;AAAA,EACA,aAAa;AAAA,EACb;AACF,GAA8C;AAC5C,QAAM,CAAC,MAAM,OAAO,IAAI,SAA4B,IAAI;AACxD,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,KAAK;AAC5C,QAAM,CAAC,WAAW,YAAY,IAAI,SAAS,KAAK;AAChD,QAAM,UAAU;AAAA,KACb,oCAAe,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC;AAAA,EACvD;AAEA,QAAM,kBAAkB;AAAA,IACtB,CAAC,UAAkB;AA9GvB;AA+GM,YAAM,SAAS,UAAU,KAAK;AAC9B,UAAI,CAAC,OAAQ;AACb,UAAI,OAAO,OAAO,OAAO,MAAM,OAAQ,KAAK,IAAI,GAAG;AACjD,qBAAa,UAAU;AACvB;AAAA,MACF;AACA,YAAM,SAAQ,YAAO,UAAP,mBAAc;AAG5B,YAAM,QACJ,QAAQ,QAAQ,WAAW,IACvB,OACA,CAAC,CAAC,SAAS,QAAQ,QAAQ,SAAS,KAAK;AAC/C,gBAAU,YAAY,KAAK;AAC3B,cAAQ;AAAA,QACN,KAAK,OAAO;AAAA,QACZ,OAAO,OAAO;AAAA,QACd,MAAM,OAAO;AAAA,QACb,SAAS,OAAO;AAAA,MAClB,CAAC;AACD,iBAAW,KAAK;AAAA,IAClB;AAAA,IACA,CAAC,UAAU;AAAA,EACb;AAGA,YAAU,MAAM;AACd,UAAM,WAAW,WAAW,UAAU;AACtC,QAAI,SAAU,iBAAgB,QAAQ;AAAA,EACxC,GAAG,CAAC,YAAY,eAAe,CAAC;AAEhC,QAAM,SAAS,YAAY,MAAM;AAC/B,iBAAa;AACb,iBAAa,UAAU;AACvB,YAAQ,IAAI;AACZ,eAAW,KAAK;AAChB,iBAAa,KAAK;AAClB;AAAA,EACF,GAAG,CAAC,YAAY,QAAQ,CAAC;AAGzB,YAAU,MAAM;AACd,UAAM,gBAAgB,OAAO;AAC7B,WAAO,QAAQ,UAAU,SAAmC;AAC1D,YAAM,WAAW,MAAM,cAAc,GAAG,IAAI;AAC5C,UAAI,SAAS,WAAW,KAAK;AAC3B,YAAI;AACF,gBAAM,OAAO,MAAM,SAAS,MAAM,EAAE,KAAK;AACzC,cAAI,6BAAM,OAAQ,QAAO;AAAA,QAC3B,SAAQ;AAAA,QAER;AAAA,MACF;AACA,aAAO;AAAA,IACT;AACA,WAAO,MAAM;AACX,aAAO,QAAQ;AAAA,IACjB;AAAA,EACF,GAAG,CAAC,MAAM,CAAC;AAEX,QAAM,aAAa,YAAY,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC;AAEhE,SACE;AAAA,IAAC,kBAAkB;AAAA,IAAlB;AAAA,MACC,OAAO,EAAE,MAAM,SAAS,WAAW,YAAY,QAAQ,gBAAgB;AAAA,MAEvE,8BAAC,mBAAgB,OAAO,EAAE,SAAS,WAAW,WAAW,GACtD,UACH;AAAA;AAAA,EACF;AAEJ;AAEO,SAAS,mBAAmB,IAIP;AAJO,eACjC;AAAA;AAAA,IACA;AAAA,EA1LF,IAwLmC,IAG9B,iBAH8B,IAG9B;AAAA,IAFH;AAAA,IACA;AAAA;AAGA,SACE,oBAAC,uBAAoB,UACnB,8BAAC,4CAAc,OAAd,EAAqB,WAAS,GACjC;AAEJ;AAYO,SAAS,mBAAmB;AAAA,EACjC,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,OAAO;AAAA,EACP;AACF,GAA4B;AAC1B,QAAM,EAAE,gBAAgB,IAAI,cAAc;AAC1C,SACE;AAAA,IAAC;AAAA;AAAA,MACC,WAAW,CAAC,QAA4B;AACtC,YAAI,IAAI,WAAY,iBAAgB,IAAI,UAAU;AAAA,MACpD;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA;AAAA,EACF;AAEJ;AAGO,SAAS,gBAAwC;AACtD,QAAM,MAAM,WAAW,iBAAiB;AACxC,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AACA,SAAO;AACT;","names":[]}

package/dist/client/index.d.cts

@@ -1,5 +1,5 @@
-import * as React$1 from 'react';
-import React__default, { ReactNode } from 'react';
+import * as react from 'react';
+import react__default, { ReactNode } from 'react';
 import { NestedSections, ClientStorageAdapter, PendingImage, Section, CmsAuthState } from '../index.cjs';
 export { AuthAdapter, AuthIdentity, DataAdapter, Editable, EntityAddress, Query, QueryCondition, QueryFilter, QueryFilterGroup, QueryFilterOp, Ref, RelationConfig, SectionMap, ServerStorageAdapter, StorageAdapter } from '../index.cjs';
 
@@ -37,7 +37,7 @@ interface PageProviderProps {
     /** Notification sink. Defaults to `sonner` toasts. */
     notify?: Notifier;
 }
-declare const PageProvider: ({ children, initialSections, apiBasePath, storage, notify, }: PageProviderProps) => React$1.JSX.Element;
+declare const PageProvider: ({ children, initialSections, apiBasePath, storage, notify, }: PageProviderProps) => react.JSX.Element;
 declare const usePageContext: () => PageContextType;
 
 /**
@@ -49,7 +49,7 @@ declare const usePageContext: () => PageContextType;
  * this context through the package's public `…/client` specifier so they share
  * the *same* context instance as the consumer's primitives at runtime.
  */
-declare const CmsAuthContext: React$1.Context<CmsAuthState | undefined>;
+declare const CmsAuthContext: react.Context<CmsAuthState | undefined>;
 declare function useCmsAuth(): CmsAuthState;
 /**
  * Controlled provider for consumers wiring their own auth. Pass the resolved
@@ -58,7 +58,7 @@ declare function useCmsAuth(): CmsAuthState;
 declare function CmsAuthProvider({ value, children, }: {
     value: CmsAuthState;
     children: ReactNode;
-}): React$1.JSX.Element;
+}): react.JSX.Element;
 
 /**
  * Inline-editable text primitive. Headless: it wires `contentEditable`, reads
@@ -75,13 +75,13 @@ interface ContentEditSpanProps {
     sectionKey: string;
     fieldKey: string;
     className?: string;
-    children?: React__default.ReactNode;
+    children?: react__default.ReactNode;
     /** Element/tag to render. Defaults to `span`. */
-    as?: React__default.ElementType;
+    as?: react__default.ElementType;
     /** Render the stored raw string into nodes. Defaults to plain text. */
-    renderValue?: (raw: string) => React__default.ReactNode;
+    renderValue?: (raw: string) => react__default.ReactNode;
 }
-declare function ContentEditSpan({ collection, sectionKey, fieldKey, className, children, as, renderValue, }: ContentEditSpanProps): React__default.JSX.Element;
+declare function ContentEditSpan({ collection, sectionKey, fieldKey, className, children, as, renderValue, }: ContentEditSpanProps): react__default.JSX.Element;
 
 /** State + actions handed to the {@link EditableImage} render-prop. */
 interface EditableImageRenderState {
@@ -116,9 +116,9 @@ interface EditableImageProps {
      * package ships no visual look — bring your own. When omitted, a bare
      * unstyled `<img>` is rendered.
      */
-    children?: (state: EditableImageRenderState) => React__default.ReactNode;
+    children?: (state: EditableImageRenderState) => react__default.ReactNode;
 }
-declare function EditableImage({ sectionKey, fieldKey, src, collection, docId, className, children, }: EditableImageProps): React__default.JSX.Element;
+declare function EditableImage({ sectionKey, fieldKey, src, collection, docId, className, children, }: EditableImageProps): react__default.JSX.Element;
 
 interface UseMarkdownEditorOptions {
     initialValue: string;

package/dist/client/index.d.ts

@@ -1,5 +1,5 @@
-import * as React$1 from 'react';
-import React__default, { ReactNode } from 'react';
+import * as react from 'react';
+import react__default, { ReactNode } from 'react';
 import { NestedSections, ClientStorageAdapter, PendingImage, Section, CmsAuthState } from '../index.js';
 export { AuthAdapter, AuthIdentity, DataAdapter, Editable, EntityAddress, Query, QueryCondition, QueryFilter, QueryFilterGroup, QueryFilterOp, Ref, RelationConfig, SectionMap, ServerStorageAdapter, StorageAdapter } from '../index.js';
 
@@ -37,7 +37,7 @@ interface PageProviderProps {
     /** Notification sink. Defaults to `sonner` toasts. */
     notify?: Notifier;
 }
-declare const PageProvider: ({ children, initialSections, apiBasePath, storage, notify, }: PageProviderProps) => React$1.JSX.Element;
+declare const PageProvider: ({ children, initialSections, apiBasePath, storage, notify, }: PageProviderProps) => react.JSX.Element;
 declare const usePageContext: () => PageContextType;
 
 /**
@@ -49,7 +49,7 @@ declare const usePageContext: () => PageContextType;
  * this context through the package's public `…/client` specifier so they share
  * the *same* context instance as the consumer's primitives at runtime.
  */
-declare const CmsAuthContext: React$1.Context<CmsAuthState | undefined>;
+declare const CmsAuthContext: react.Context<CmsAuthState | undefined>;
 declare function useCmsAuth(): CmsAuthState;
 /**
  * Controlled provider for consumers wiring their own auth. Pass the resolved
@@ -58,7 +58,7 @@ declare function useCmsAuth(): CmsAuthState;
 declare function CmsAuthProvider({ value, children, }: {
     value: CmsAuthState;
     children: ReactNode;
-}): React$1.JSX.Element;
+}): react.JSX.Element;
 
 /**
  * Inline-editable text primitive. Headless: it wires `contentEditable`, reads
@@ -75,13 +75,13 @@ interface ContentEditSpanProps {
     sectionKey: string;
     fieldKey: string;
     className?: string;
-    children?: React__default.ReactNode;
+    children?: react__default.ReactNode;
     /** Element/tag to render. Defaults to `span`. */
-    as?: React__default.ElementType;
+    as?: react__default.ElementType;
     /** Render the stored raw string into nodes. Defaults to plain text. */
-    renderValue?: (raw: string) => React__default.ReactNode;
+    renderValue?: (raw: string) => react__default.ReactNode;
 }
-declare function ContentEditSpan({ collection, sectionKey, fieldKey, className, children, as, renderValue, }: ContentEditSpanProps): React__default.JSX.Element;
+declare function ContentEditSpan({ collection, sectionKey, fieldKey, className, children, as, renderValue, }: ContentEditSpanProps): react__default.JSX.Element;
 
 /** State + actions handed to the {@link EditableImage} render-prop. */
 interface EditableImageRenderState {
@@ -116,9 +116,9 @@ interface EditableImageProps {
      * package ships no visual look — bring your own. When omitted, a bare
      * unstyled `<img>` is rendered.
      */
-    children?: (state: EditableImageRenderState) => React__default.ReactNode;
+    children?: (state: EditableImageRenderState) => react__default.ReactNode;
 }
-declare function EditableImage({ sectionKey, fieldKey, src, collection, docId, className, children, }: EditableImageProps): React__default.JSX.Element;
+declare function EditableImage({ sectionKey, fieldKey, src, collection, docId, className, children, }: EditableImageProps): react__default.JSX.Element;
 
 interface UseMarkdownEditorOptions {
     initialValue: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dalgoridim/headless-cms",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Database-agnostic, inline-edit headless CMS engine for React / Next.js apps",
   "license": "UNLICENSED",
   "author": "dalgoridim",
@@ -119,6 +119,7 @@
   "peerDependencies": {
     "@aws-sdk/client-s3": ">=3",
     "@aws-sdk/s3-request-presigner": ">=3",
+    "@react-oauth/google": ">=0.12",
     "cloudinary": ">=2",
     "firebase": ">=10",
     "firebase-admin": ">=12",
@@ -131,6 +132,9 @@
     "@aws-sdk/client-s3": {
       "optional": true
     },
+    "@react-oauth/google": {
+      "optional": true
+    },
     "@aws-sdk/s3-request-presigner": {
       "optional": true
     },
@@ -150,10 +154,10 @@
       "optional": true
     }
   },
-  "dependencies": {},
   "devDependencies": {
     "@aws-sdk/client-s3": "^3.700.0",
     "@aws-sdk/s3-request-presigner": "^3.700.0",
+    "@react-oauth/google": "^0.13.5",
     "@types/node": "^20.0.0",
     "@types/pg": "^8.11.10",
     "@types/react": "^19.0.0",