@elevasis/ui 1.3.3 → 1.3.5

package/dist/api/index.js

@@ -1,5 +1,5 @@
 import '../chunk-XCYKC6OZ.js';
-export { ApiClientProvider, useApiClient, useApiClientContext } from '../chunk-XLV6LYN2.js';
+export { ApiClientProvider, useApiClient, useApiClientContext } from '../chunk-LBPALY25.js';
 import '../chunk-LFYO3MDC.js';
 import '../chunk-4VGWQ5AN.js';
 import '../chunk-DD3CCMCZ.js';

package/dist/auth/index.d.ts

@@ -1,16 +1,176 @@
+import * as react from 'react';
+import { ReactNode } from 'react';
+import * as react_jsx_runtime from 'react/jsx-runtime';
+
+interface AuthContextValue {
+    user: {
+        id: string;
+    } | null;
+    isLoading: boolean;
+    getAccessToken: () => Promise<string>;
+    organizationId?: string | null;
+    /**
+     * Trigger WorkOS AuthKit's sign-in flow (redirect to WorkOS hosted auth page).
+     * Used by ProtectedRoute for auto-recovery when `canRecover()` returns true.
+     */
+    signIn: (options?: {
+        state?: {
+            returnTo?: string;
+        };
+    }) => void;
+    /**
+     * Returns true when a previous session can be recovered (refresh token
+     * exists in storage). ProtectedRoute calls `signIn()` only when this returns
+     * true; otherwise it navigates to the login page.
+     *
+     * Explicit logout clears the stored token, so canRecover() returns false
+     * and the user sees the login page as expected.
+     */
+    canRecover: () => boolean;
+}
+declare function useAuthContext(): AuthContextValue;
+declare function AuthProvider({ value, children }: {
+    value: AuthContextValue;
+    children: ReactNode;
+}): react.FunctionComponentElement<react.ProviderProps<AuthContextValue | null>>;
+
 /**
- * Auth module - Pure authentication concerns
- *
- * Exports:
- * - AuthContextValue: Interface for auth state (user, isLoading, getAccessToken, organizationId, signIn, canRecover)
- * - AuthProvider: React context provider for AuthContextValue
- * - useAuthContext: Hook to consume AuthContextValue from context
- * - useStableAccessToken: Stable reference to getAccessToken for SSE connections
- * - useSessionCheck: Validates session on tab refocus
+ * Returns a stable reference to getAccessToken that won't change between renders
+ *
+ * This prevents SSE connections from reconnecting unnecessarily when the
+ * WorkOS useAuth hook returns a new getAccessToken function reference
+ *
+ * @example
+ * ```tsx
+ * const getAccessToken = useStableAccessToken()
+ *
+ * useEffect(() => {
+ *   fetchEventSourceWithTokenRefresh({
+ *     getToken: getAccessToken,
+ *     // ...
+ *   })
+ * }, [getAccessToken]) // Won't re-run on every render
+ * ```
+ */
+declare function useStableAccessToken(): () => Promise<string>;
+
+/**
+ * Checks WorkOS session validity when window/tab regains focus
+ *
+ * When window or tab becomes visible after inactivity, validates session
+ * by attempting to get access token. If session expired (WorkOS inactivity
+ * timeout exceeded), signs out user and redirects to login.
+ *
+ * How it works:
+ * 1. Window/tab regains focus after inactivity
+ * 2. Cancel all pending queries to prevent 401 error cascade
+ * 3. Attempt to get access token from WorkOS
+ * 4. If successful: Resume queries with fresh token
+ * 5. If failed (session expired): Sign out and redirect to login
+ *
+ * @example
+ * // In __root.tsx
+ * export function RootLayoutComponent() {
+ *   useSessionCheck()
+ *   return <YourApp />
+ * }
+ */
+declare function useSessionCheck(): void;
+
+interface InitializationError {
+    layer: 'auth' | 'profile' | 'organization';
+    message: string;
+    originalError?: Error;
+}
+
+interface ProtectedRouteProps {
+    children: ReactNode;
+    /**
+     * Path to redirect to when user is unauthenticated and the auth adapter
+     * does not provide a `signIn` function.
+     * @default '/login'
+     */
+    redirectTo?: string;
+    /**
+     * Rendered while initialization is in progress.
+     * When not provided, nothing is rendered during initialization.
+     */
+    fallback?: ReactNode;
+    /**
+     * Rendered when initialization fails with a non-organization error.
+     * Receives the error and a retry callback.
+     * When not provided, the error is silently swallowed (children not rendered).
+     */
+    errorFallback?: (error: InitializationError, retry: () => void) => ReactNode;
+    /**
+     * When true (default), waits for both user AND organization to be ready
+     * before rendering children. When false, only waits for user readiness.
+     * @default true
+     */
+    waitForOrganization?: boolean;
+}
+/**
+ * Headless route guard for authenticated pages.
+ *
+ * Reads initialization state from the nearest InitializationProvider.
+ *
+ * When `canRecover()` returns true (refresh token exists), unauthenticated users
+ * are sent directly to WorkOS AuthKit via `signIn()`. WorkOS checks its
+ * server-side session and either signs the user in immediately (page-reload case)
+ * or shows a login form (logged-out case). Explicit logout destroys the
+ * server-side session, so the next auto-signIn correctly presents a login form
+ * rather than looping.
+ *
+ * When `canRecover()` returns false, falls back to navigating to `redirectTo`
+ * (default: '/login') with a `returnTo` search param.
+ *
+ * Organization-layer errors are allowed through -- routes like /invitations
+ * must be accessible even when the user has no org membership.
+ *
+ * @example
+ * // With custom fallback (your Mantine loader):
+ * <ProtectedRoute fallback={<AppShellLoader />}>
+ *   <DashboardPage />
+ * </ProtectedRoute>
+ *
+ * @example
+ * // Wait only for user, not org (e.g. /invitations route):
+ * <ProtectedRoute waitForOrganization={false}>
+ *   <InvitationsPage />
+ * </ProtectedRoute>
+ */
+declare function ProtectedRoute({ children, redirectTo, fallback, errorFallback, waitForOrganization }: ProtectedRouteProps): react_jsx_runtime.JSX.Element | null;
+
+interface AdminGuardProps {
+    children: ReactNode;
+    /**
+     * Path to redirect non-admin users to.
+     * @default '/'
+     */
+    redirectTo?: string;
+    /**
+     * Rendered while user readiness is being determined.
+     * When not provided, nothing is rendered during initialization.
+     */
+    fallback?: ReactNode;
+}
+/**
+ * Headless route guard for platform admin pages.
+ *
+ * Reads `profile.is_platform_admin` from the nearest InitializationProvider.
+ * Non-admin users are redirected to `redirectTo` (default: '/').
+ *
+ * Must be nested inside a ProtectedRoute (or equivalent) so that
+ * `userReady` is guaranteed to be true when this guard runs.
+ *
+ * @example
+ * <ProtectedRoute>
+ *   <AdminGuard fallback={<AppShellLoader />}>
+ *     <AdminDashboard />
+ *   </AdminGuard>
+ * </ProtectedRoute>
  */
-export { AuthProvider, useAuthContext, type AuthContextValue } from './context';
-export * from './hooks/useStableAccessToken';
-export * from './hooks/useSessionCheck';
-export { ProtectedRoute, type ProtectedRouteProps } from './guards/ProtectedRoute';
-export { AdminGuard, type AdminGuardProps } from './guards/AdminGuard';
-//# sourceMappingURL=index.d.ts.map
+declare function AdminGuard({ children, redirectTo, fallback }: AdminGuardProps): react_jsx_runtime.JSX.Element | null;
+
+export { AdminGuard, AuthProvider, ProtectedRoute, useAuthContext, useSessionCheck as useRefocusSessionCheck, useSessionCheck, useStableAccessToken };
+export type { AdminGuardProps, AuthContextValue, ProtectedRouteProps };

package/dist/{chunk-XLV6LYN2.js → chunk-LBPALY25.js}

@@ -21,7 +21,6 @@ function ApiClientProvider({
 }) {
   const getOrganizationId = useMemo(
     () => getOrganizationIdProp ?? (() => organizationId ?? null),
-    // eslint-disable-next-line react-hooks/exhaustive-deps
     [getOrganizationIdProp, organizationId]
   );
   const value = useMemo(

package/dist/{chunk-LTQAAIGE.js → chunk-Y2I5JJ3N.js}

@@ -1,6 +1,6 @@
 import { NotificationProvider } from './chunk-TIRMFDM4.js';
 import { OrganizationProvider } from './chunk-SFF5MJEI.js';
-import { ApiClientProvider, useApiClient } from './chunk-XLV6LYN2.js';
+import { ApiClientProvider, useApiClient } from './chunk-LBPALY25.js';
 import { InitializationProvider } from './chunk-NEK6JKPW.js';
 import { ProfileProvider } from './chunk-L2CM2CUA.js';
 import { ElevasisServiceProvider, useElevasisServices } from './chunk-KA7LO7U5.js';