@iblai/web-utils 1.10.11 → 1.11.0

package/README.md

@@ -126,6 +126,40 @@ function Header() {
 }
 ```
 
+### Tenant Switching
+
+Switch the active tenant with built-in cross-tab coordination. A short-lived,
+shared lock (localStorage) plus a `BroadcastChannel` signal prevent the
+"ping-pong" where a stale tab in another window reverts the session to its own
+tenant.
+
+```tsx
+import { handleTenantSwitch } from '@iblai/web-utils';
+
+// e.g. from a tenant dropdown
+await handleTenantSwitch('acme', {
+  authUrl: 'https://auth.example.com',
+  clearCurrentTenantCookie, // injected so the util stays React-free
+  saveRedirect: true,
+});
+```
+
+Gate automatic tenant "self-heal" redirects while a switch is in flight:
+
+```tsx
+import { isTenantSwitchInProgress } from '@iblai/web-utils';
+
+// inside <TenantProvider onTenantMismatch={...}>
+onTenantMismatch={() => {
+  if (isTenantSwitchInProgress()) return; // don't revert mid-switch
+  window.location.href = '/';
+}}
+```
+
+Lower-level helpers are also exported: `readTenantSwitchLock`,
+`writeTenantSwitchLock`, `refreshTenantSwitchLock`, `clearTenantSwitchLock`, and
+`getTabId`.
+
 ## Context Providers
 
 ### Auth Provider
@@ -345,6 +379,20 @@ function TenantSettings() {
 }
 ```
 
+### Tenant Switch Sync Hook
+
+Keep other tabs in sync during a tenant switch. Ignores this tab's own broadcast
+echo and refreshes the shared switch lock so the tab won't auto-revert:
+
+```tsx
+import { useTenantSwitchSync } from '@iblai/web-utils';
+
+function Providers({ children }) {
+  useTenantSwitchSync();
+  return <>{children}</>;
+}
+```
+
 ## Utility Functions
 
 ### Cookie Management

package/dist/auth/index.d.ts

@@ -198,6 +198,68 @@ interface HandleLogoutOptions {
  * ```
  */
 declare function handleLogout(options: HandleLogoutOptions): void;
+declare const TENANT_SWITCH_CHANNEL = "ibl-tenant-switch";
+declare const TENANT_SWITCH_LOCK_KEY = "ibl_tenant_switch_lock";
+declare const DEFAULT_TENANT_SWITCH_LOCK_TTL_MS = 8000;
+interface TenantSwitchLock {
+    tenant: string;
+    /** `${ts}-${tabId}` — monotonic; newer wins. */
+    token: string;
+    ts: number;
+    senderId: string;
+}
+/**
+ * Stable per-tab id. Uses sessionStorage so it survives same-tab reloads while
+ * staying unique per tab/window.
+ */
+declare function getTabId(): string;
+/** The active (non-expired) tenant-switch lock, or null. */
+declare function readTenantSwitchLock(ttlMs?: number): TenantSwitchLock | null;
+/** Write a fresh lock for `tenant` (newest intent). Returns the lock written. */
+declare function writeTenantSwitchLock(tenant: string): TenantSwitchLock;
+/** Extend an existing lock's window from "now" (no-op when no active lock). */
+declare function refreshTenantSwitchLock(): void;
+declare function clearTenantSwitchLock(): void;
+/** True while a tenant switch is in flight — gate automatic reverts on this. */
+declare function isTenantSwitchInProgress(ttlMs?: number): boolean;
+interface HandleTenantSwitchOptions {
+    /** Auth SPA base URL (e.g. config.authUrl()). */
+    authUrl: string;
+    /** localStorage key for the saved redirect path (default "redirect-to"). */
+    redirectPathStorageKey?: string;
+    /** localStorage key for a JWT to forward through the switch (default "edx_jwt_token"). */
+    preserveTokenKey?: string;
+    /** localStorage key holding the tenant (default "tenant"). */
+    tenantStorageKey?: string;
+    /** Cookie name signalling a switch is in progress (default "ibl_tenant_switching"). */
+    tenantSwitchingCookie?: string;
+    /** Query-param names for the auth URL. */
+    queryParams?: {
+        tenant?: string;
+        redirectTo?: string;
+    };
+    /** Persist the current path so the app returns to it post-switch. */
+    saveRedirect?: boolean;
+    /** Explicit redirect target (defaults to window.location.origin). */
+    redirectUrl?: string;
+    /** Broadcast to other tabs + clear storage (true for user-initiated; default true). */
+    broadcast?: boolean;
+    /** Lock TTL override. */
+    lockTtlMs?: number;
+    /** Injected so this util stays React-free (mentorai passes the SDK's). */
+    clearCurrentTenantCookie?: () => void;
+}
+/**
+ * Switch the active tenant. Coordinates across tabs (TTL lock + BroadcastChannel),
+ * clears storage, then redirects through the auth SPA's `/login/complete`.
+ *
+ * @example
+ * await handleTenantSwitch("acme", {
+ *   authUrl: config.authUrl(),
+ *   clearCurrentTenantCookie,
+ * });
+ */
+declare function handleTenantSwitch(tenant: string, options: HandleTenantSwitchOptions): Promise<void>;
 
-export { clearCookies, deleteCookie, deleteCookieOnAllDomains, getAuthSpaJoinUrl, getCookieValue, getDomainParts, getParentDomain, getPlatformKey, handleLogout, isInIframe, isLoggedIn, redirectToAuthSpa, redirectToAuthSpaJoinTenant, sendMessageToParentWebsite, setCookieForAuth };
-export type { HandleLogoutOptions, RedirectToAuthSpaOptions };
+export { DEFAULT_TENANT_SWITCH_LOCK_TTL_MS, TENANT_SWITCH_CHANNEL, TENANT_SWITCH_LOCK_KEY, clearCookies, clearTenantSwitchLock, deleteCookie, deleteCookieOnAllDomains, getAuthSpaJoinUrl, getCookieValue, getDomainParts, getParentDomain, getPlatformKey, getTabId, handleLogout, handleTenantSwitch, isInIframe, isLoggedIn, isTenantSwitchInProgress, readTenantSwitchLock, redirectToAuthSpa, redirectToAuthSpaJoinTenant, refreshTenantSwitchLock, sendMessageToParentWebsite, setCookieForAuth, writeTenantSwitchLock };
+export type { HandleLogoutOptions, HandleTenantSwitchOptions, RedirectToAuthSpaOptions, TenantSwitchLock };

package/dist/auth/index.esm.js

@@ -361,6 +361,142 @@ function handleLogout(options) {
         window.location.href = `${authUrl}/logout?redirect-to=${redirectUrl}${tenant ? "&tenant=" + tenant : ""}`;
     }
 }
+// ── Tenant-switch coordination ─────────────────────────────────────────────
+// Cross-tab tenant switching: a TTL lock (shared via localStorage) plus a
+// BroadcastChannel signal let multiple tabs coordinate a switch and prevent the
+// "ping-pong" where a stale tab reverts the session to its own route's tenant.
+const TENANT_SWITCH_CHANNEL = "ibl-tenant-switch";
+const TENANT_SWITCH_LOCK_KEY = "ibl_tenant_switch_lock";
+const DEFAULT_TENANT_SWITCH_LOCK_TTL_MS = 8000;
+let _tabId = null;
+/**
+ * Stable per-tab id. Uses sessionStorage so it survives same-tab reloads while
+ * staying unique per tab/window.
+ */
+function getTabId() {
+    var _a, _b;
+    if (_tabId)
+        return _tabId;
+    try {
+        const existing = sessionStorage.getItem("ibl_tab_id");
+        if (existing)
+            return (_tabId = existing);
+        const id = (_b = (_a = crypto === null || crypto === void 0 ? void 0 : crypto.randomUUID) === null || _a === void 0 ? void 0 : _a.call(crypto)) !== null && _b !== void 0 ? _b : `${Date.now()}-${Math.random()}`;
+        sessionStorage.setItem("ibl_tab_id", id);
+        return (_tabId = id);
+    }
+    catch (_c) {
+        return (_tabId = `${Date.now()}-${Math.random()}`);
+    }
+}
+/** The active (non-expired) tenant-switch lock, or null. */
+function readTenantSwitchLock(ttlMs = DEFAULT_TENANT_SWITCH_LOCK_TTL_MS) {
+    try {
+        const raw = localStorage.getItem(TENANT_SWITCH_LOCK_KEY);
+        if (!raw)
+            return null;
+        const lock = JSON.parse(raw);
+        if (typeof (lock === null || lock === void 0 ? void 0 : lock.ts) !== "number")
+            return null;
+        if (Date.now() - lock.ts > ttlMs)
+            return null;
+        return lock;
+    }
+    catch (_a) {
+        return null;
+    }
+}
+/** Write a fresh lock for `tenant` (newest intent). Returns the lock written. */
+function writeTenantSwitchLock(tenant) {
+    const lock = {
+        tenant,
+        token: `${Date.now()}-${getTabId()}`,
+        ts: Date.now(),
+        senderId: getTabId(),
+    };
+    try {
+        localStorage.setItem(TENANT_SWITCH_LOCK_KEY, JSON.stringify(lock));
+    }
+    catch (_a) { }
+    return lock;
+}
+/** Extend an existing lock's window from "now" (no-op when no active lock). */
+function refreshTenantSwitchLock() {
+    const lock = readTenantSwitchLock();
+    if (!lock)
+        return;
+    try {
+        localStorage.setItem(TENANT_SWITCH_LOCK_KEY, JSON.stringify({ ...lock, ts: Date.now() }));
+    }
+    catch (_a) { }
+}
+function clearTenantSwitchLock() {
+    try {
+        localStorage.removeItem(TENANT_SWITCH_LOCK_KEY);
+    }
+    catch (_a) { }
+}
+/** True while a tenant switch is in flight — gate automatic reverts on this. */
+function isTenantSwitchInProgress(ttlMs) {
+    return readTenantSwitchLock(ttlMs) !== null;
+}
+/**
+ * Switch the active tenant. Coordinates across tabs (TTL lock + BroadcastChannel),
+ * clears storage, then redirects through the auth SPA's `/login/complete`.
+ *
+ * @example
+ * await handleTenantSwitch("acme", {
+ *   authUrl: config.authUrl(),
+ *   clearCurrentTenantCookie,
+ * });
+ */
+async function handleTenantSwitch(tenant, options) {
+    var _a, _b, _c;
+    const { authUrl, redirectPathStorageKey = "redirect-to", preserveTokenKey = "edx_jwt_token", tenantStorageKey = "tenant", tenantSwitchingCookie = "ibl_tenant_switching", queryParams = {}, saveRedirect = false, redirectUrl, broadcast = true, clearCurrentTenantCookie, } = options;
+    const tenantParam = (_a = queryParams.tenant) !== null && _a !== void 0 ? _a : "tenant";
+    const redirectToParam = (_b = queryParams.redirectTo) !== null && _b !== void 0 ? _b : "redirect-to";
+    // Guard: don't start a new user switch while one is already in progress.
+    if (broadcast && document.cookie.includes(tenantSwitchingCookie))
+        return;
+    // Guard: already on the target tenant.
+    if (tenant === localStorage.getItem(tenantStorageKey))
+        return;
+    if (broadcast) {
+        setCookieForAuth(tenantSwitchingCookie, "true");
+        writeTenantSwitchLock(tenant);
+        if (typeof BroadcastChannel !== "undefined") {
+            const channel = new BroadcastChannel(TENANT_SWITCH_CHANNEL);
+            const lock = readTenantSwitchLock(options.lockTtlMs);
+            channel.postMessage({
+                type: "TENANT_SWITCHING",
+                tenant,
+                senderId: (_c = lock === null || lock === void 0 ? void 0 : lock.senderId) !== null && _c !== void 0 ? _c : getTabId(),
+                token: lock === null || lock === void 0 ? void 0 : lock.token,
+            });
+            channel.close();
+        }
+        clearCurrentTenantCookie === null || clearCurrentTenantCookie === void 0 ? void 0 : clearCurrentTenantCookie();
+    }
+    const currentPath = `${window.location.pathname}${window.location.search}`;
+    const jwtToken = localStorage.getItem(preserveTokenKey);
+    if (broadcast)
+        localStorage.clear();
+    const params = {
+        [tenantParam]: tenant,
+        [redirectToParam]: redirectUrl !== null && redirectUrl !== void 0 ? redirectUrl : window.location.origin,
+    };
+    if (jwtToken)
+        params.token = jwtToken;
+    localStorage.setItem(tenantStorageKey, tenant);
+    if (saveRedirect)
+        localStorage.setItem(redirectPathStorageKey, currentPath);
+    // Re-persist: localStorage.clear() above wiped the pre-broadcast lock; this
+    // copy survives the redirect so stale tabs honor the switch window.
+    if (broadcast)
+        writeTenantSwitchLock(tenant);
+    await new Promise((resolve) => setTimeout(resolve, 100));
+    window.location.href = `${authUrl}/login/complete?${new URLSearchParams(params)}`;
+}
 
-export { clearCookies, deleteCookie, deleteCookieOnAllDomains, getAuthSpaJoinUrl, getCookieValue, getDomainParts, getParentDomain, getPlatformKey, handleLogout, isInIframe, isLoggedIn, redirectToAuthSpa, redirectToAuthSpaJoinTenant, sendMessageToParentWebsite, setCookieForAuth };
+export { DEFAULT_TENANT_SWITCH_LOCK_TTL_MS, TENANT_SWITCH_CHANNEL, TENANT_SWITCH_LOCK_KEY, clearCookies, clearTenantSwitchLock, deleteCookie, deleteCookieOnAllDomains, getAuthSpaJoinUrl, getCookieValue, getDomainParts, getParentDomain, getPlatformKey, getTabId, handleLogout, handleTenantSwitch, isInIframe, isLoggedIn, isTenantSwitchInProgress, readTenantSwitchLock, redirectToAuthSpa, redirectToAuthSpaJoinTenant, refreshTenantSwitchLock, sendMessageToParentWebsite, setCookieForAuth, writeTenantSwitchLock };
 //# sourceMappingURL=index.esm.js.map

package/dist/auth/index.esm.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.esm.js","sources":["../../src/utils/auth.ts"],"sourcesContent":["/**\n * Authentication and Authorization Utilities\n *\n * This module provides utility functions for handling authentication flows,\n * including redirects to auth SPA, cookie management, and session handling.\n */\n\n/**\n * Check if the current window is inside an iframe\n * @returns {boolean} True if running in an iframe, false otherwise\n */\nexport function isInIframe(): boolean {\n  if (typeof window === \"undefined\") {\n    return false;\n  }\n  return window?.self !== window?.top;\n}\n\n/**\n * Send a message to the parent website (when in iframe)\n * @param payload - The data to send to parent window\n */\nexport function sendMessageToParentWebsite(payload: unknown): void {\n  window.parent.postMessage(payload, \"*\");\n}\n\n/**\n * Delete a cookie with specific name, path, and domain\n * @param name - Cookie name\n * @param path - Cookie path\n * @param domain - Cookie domain\n */\nexport function deleteCookie(name: string, path: string, domain: string): void {\n  const expires = \"expires=Thu, 01 Jan 1970 00:00:00 UTC;\";\n  const cookieValue = `${name}=;`;\n  const pathValue = path ? `path=${path};` : \"\";\n  const domainValue = domain ? `domain=${domain};` : \"\";\n  document.cookie = cookieValue + expires + pathValue + domainValue;\n}\n\n/**\n * Get all possible domain parts for cookie deletion\n * @param domain - The domain to split\n * @returns Array of domain parts\n * @example\n * getDomainParts('app.example.com') // returns ['app.example.com', 'example.com', 'com']\n */\nexport function getDomainParts(domain: string): string[] {\n  const parts = domain.split(\".\");\n  const domains: string[] = [];\n  for (let i = parts.length - 1; i >= 0; i--) {\n    domains.push(parts.slice(i).join(\".\"));\n  }\n  return domains;\n}\n\n/**\n * Delete a cookie across all possible domain variations\n * @param name - Cookie name to delete\n * @param childDomain - The current domain\n */\nexport function deleteCookieOnAllDomains(\n  name: string,\n  childDomain: string,\n): void {\n  getDomainParts(childDomain).forEach((domainPart) => {\n    deleteCookie(name, \"/\", domainPart);\n    deleteCookie(name, \"\", domainPart);\n  });\n}\n\n/**\n * Get the parent domain from a given domain\n * @param domain - The domain to process\n * @returns The parent domain (e.g., 'app.example.com' → '.example.com')\n */\nexport function getParentDomain(domain?: string): string {\n  if (!domain) {\n    return \"\";\n  }\n  const parts = domain.split(\".\");\n  return parts.length > 1 ? `.${parts.slice(-2).join(\".\")}` : domain;\n}\n\n/**\n * Set a cookie for authentication with cross-domain support\n * @param name - Cookie name\n * @param value - Cookie value\n * @param days - Number of days until expiration (default: 365)\n */\nexport function setCookieForAuth(\n  name: string,\n  value: string,\n  days: number = 365,\n): void {\n  const expires = new Date();\n  expires.setTime(expires.getTime() + days * 24 * 60 * 60 * 1000);\n\n  const hostname = window.location.hostname;\n  let baseDomain = hostname;\n\n  // Calculate base domain (skip for localhost and IP addresses)\n  if (hostname !== \"localhost\" && !/^\\d+\\.\\d+\\.\\d+\\.\\d+$/.test(hostname)) {\n    const parts = hostname.split(\".\");\n    if (parts.length > 2) {\n      baseDomain = `.${parts.slice(-2).join(\".\")}`;\n    }\n  }\n\n  const domainAttr = baseDomain ? `;domain=${baseDomain}` : \"\";\n  document.cookie = `${name}=${encodeURIComponent(value)};expires=${expires.toUTCString()};path=/;SameSite=None;Secure${domainAttr}`;\n}\n\n/**\n * Clear all cookies for the current domain\n */\nexport function clearCookies(): void {\n  const cookies = document.cookie.split(\";\");\n  for (let i = 0; i < cookies.length; i++) {\n    const cookie = cookies[i];\n    const eqPos = cookie.indexOf(\"=\");\n    const name = eqPos > -1 ? cookie.substr(0, eqPos) : cookie;\n    deleteCookieOnAllDomains(name, window.location.hostname);\n    document.cookie = `${name}=;expires=Thu, 01 Jan 1970 00:00:00 GMT;path=/;Domain=${getParentDomain(\n      window.location.hostname,\n    )}`;\n  }\n}\n\n/**\n * Get the value of a cookie by name\n * @param name - Cookie name\n * @returns The cookie value or null if not found\n */\nexport function getCookieValue(name: string): string | null {\n  const match = document.cookie.match(new RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match ? decodeURIComponent(match[1]) : null;\n}\n\n/**\n * Check if user is currently logged in\n * @param tokenKey - The localStorage key for the auth token (default: 'axd_token')\n * @returns True if logged in, false otherwise\n */\nexport function isLoggedIn(tokenKey: string = \"axd_token\"): boolean {\n  return !!localStorage.getItem(tokenKey);\n}\n\n/**\n * Extract platform/tenant key from URL\n * @param url - The URL to parse\n * @param pattern - RegExp pattern to match platform key (default matches /platform/[key]/...)\n * @returns The platform key or null if not found\n */\nexport function getPlatformKey(\n  url: string,\n  pattern: RegExp = /\\/platform\\/([^/]+)/,\n): string | null {\n  const match = url.match(pattern);\n  return match ? match[1] : null;\n}\n\nexport interface RedirectToAuthSpaOptions {\n  /** URL to redirect to after auth (defaults to current path + search) */\n  redirectTo?: string;\n  /** Platform/tenant key */\n  platformKey?: string;\n  /** Whether this is a logout action */\n  logout?: boolean;\n  /** Whether to save redirect path to localStorage (default: true) */\n  saveRedirect?: boolean;\n  /** Auth SPA base URL */\n  authUrl: string;\n  /** Current app/platform identifier (e.g., 'mentor', 'skills') */\n  appName: string;\n  /** Query param names */\n  queryParams?: {\n    app?: string;\n    redirectTo?: string;\n    tenant?: string;\n  };\n  /** localStorage key for saving redirect path */\n  redirectPathStorageKey?: string;\n  /** Cookie names for cross-SPA sync */\n  cookieNames?: {\n    currentTenant?: string;\n    userData?: string;\n    tenant?: string;\n    logoutTimestamp?: string;\n    loginTimestamp?: string;\n    tenantSwitching?: string;\n  };\n  /** Function to check if auth token is valid and non-expired. Used to skip redirect when a recent login occurred. */\n  hasNonExpiredAuthToken?: () => boolean;\n  /** Function to check if the app is in offline mode (e.g., Tauri offline). Skips redirect when true. */\n  isOffline?: () => boolean;\n  /** localStorage key for a token to preserve before clearing storage (e.g., 'edx_jwt_token') */\n  preserveTokenKey?: string;\n  /** Path to an auth redirect proxy endpoint (e.g., '/api/auth-redirect'). When set, redirects via this proxy in browser. */\n  authRedirectProxy?: string;\n  /** Function to check if the app is running as a native app (e.g., Tauri). Affects redirect behavior. */\n  isNativeApp?: () => boolean;\n  forceRedirect?: boolean;\n  scheme?: string;\n}\n\n/**\n * Redirect to authentication SPA for login/logout\n *\n * This function handles the complete authentication flow:\n * - Clears localStorage and cookies on logout\n * - Saves redirect path for post-auth return\n * - Handles iframe scenarios\n * - Syncs logout across multiple SPAs via cookies\n *\n * @param options - Configuration options for the redirect\n *\n * @example\n * ```tsx\n * // Basic usage\n * redirectToAuthSpa({\n *   authUrl: 'https://auth.example.com',\n *   appName: 'mentor',\n * });\n *\n * // With logout\n * redirectToAuthSpa({\n *   authUrl: 'https://auth.example.com',\n *   appName: 'mentor',\n *   logout: true,\n *   platformKey: 'my-tenant',\n * });\n *\n * // With custom redirect\n * redirectToAuthSpa({\n *   authUrl: 'https://auth.example.com',\n *   appName: 'mentor',\n *   redirectTo: '/dashboard',\n *   platformKey: 'my-tenant',\n * });\n * ```\n */\nexport async function redirectToAuthSpa(\n  options: RedirectToAuthSpaOptions,\n): Promise<void> {\n  const {\n    redirectTo,\n    platformKey,\n    logout = false,\n    saveRedirect = true,\n    authUrl,\n    appName,\n    queryParams = {\n      app: \"app\",\n      redirectTo: \"redirect-to\",\n      tenant: \"tenant\",\n    },\n    redirectPathStorageKey = \"redirect_to\",\n    cookieNames = {\n      currentTenant: \"ibl_current_tenant\",\n      userData: \"ibl_user_data\",\n      tenant: \"ibl_tenant\",\n      logoutTimestamp: \"ibl_logout_timestamp\",\n      loginTimestamp: \"ibl_login_timestamp\",\n      tenantSwitching: \"ibl_tenant_switching\",\n    },\n    hasNonExpiredAuthToken,\n    isOffline,\n    preserveTokenKey,\n    authRedirectProxy,\n    isNativeApp,\n    scheme = \"iblai-mentor\",\n    forceRedirect = false,\n  } = options;\n\n  console.log(\n    \"[redirectToAuthSpa] starting redirect to auth spa\",\n    redirectTo,\n    platformKey,\n    logout,\n    saveRedirect,\n    forceRedirect,\n  );\n\n  // Skip if a tenant switch is already in progress\n  if (\n    !forceRedirect &&\n    cookieNames.tenantSwitching &&\n    document.cookie.includes(cookieNames.tenantSwitching)\n  ) {\n    console.log(\n      \"[redirectToAuthSpa] Tenant switch in progress, skipping redirect\",\n    );\n    return;\n  }\n\n  // Skip if a login occurred after the last logout (login takes precedence)\n  // but only if this app actually has a valid auth token\n  if (\n    !forceRedirect &&\n    hasNonExpiredAuthToken &&\n    cookieNames.loginTimestamp &&\n    cookieNames.logoutTimestamp\n  ) {\n    const loginTs = getCookieValue(cookieNames.loginTimestamp);\n    const logoutTs = getCookieValue(cookieNames.logoutTimestamp);\n    const hasValidToken = hasNonExpiredAuthToken();\n    console.log(\"[redirectToAuthSpa] Login/logout timestamp check\", {\n      loginTs,\n      logoutTs,\n      hasValidToken,\n      loginAhead:\n        loginTs && logoutTs ? Number(loginTs) > Number(logoutTs) : false,\n    });\n    if (\n      !forceRedirect &&\n      hasValidToken &&\n      loginTs &&\n      logoutTs &&\n      Number(loginTs) > Number(logoutTs)\n    ) {\n      console.log(\n        \"[redirectToAuthSpa] Login timestamp is ahead of logout timestamp, skipping redirect\",\n        { loginTs, logoutTs },\n      );\n      return;\n    }\n  }\n\n  // Skip redirect in offline mode\n  if (isOffline?.()) {\n    console.log(\"[redirectToAuthSpa] Skipping redirect - offline mode\");\n    return;\n  }\n\n  // Preserve a token before clearing localStorage if requested\n  const preservedToken = preserveTokenKey\n    ? window.localStorage.getItem(preserveTokenKey)\n    : null;\n\n  console.log(\"[redirectToAuthSpa] clearing local storage\");\n  localStorage.clear();\n\n  if (logout || isInIframe()) {\n    // Delete authentication cookies for cross-SPA synchronization\n    const currentDomain = window.location.hostname;\n    if (cookieNames.currentTenant) {\n      deleteCookieOnAllDomains(cookieNames.currentTenant, currentDomain);\n    }\n    if (cookieNames.userData) {\n      deleteCookieOnAllDomains(cookieNames.userData, currentDomain);\n    }\n    if (cookieNames.tenant) {\n      deleteCookieOnAllDomains(cookieNames.tenant, currentDomain);\n    }\n\n    // Set logout timestamp cookie to trigger logout on other SPAs\n    if (cookieNames.logoutTimestamp && !isInIframe()) {\n      setCookieForAuth(cookieNames.logoutTimestamp, Date.now().toString());\n    }\n  }\n\n  // Handle iframe scenario\n  if (isInIframe()) {\n    console.log(\"[redirectToAuthSpa]: sending authExpired to parent\");\n    sendMessageToParentWebsite({ authExpired: true });\n    return;\n  }\n\n  const redirectPath =\n    redirectTo ?? `${window.location.pathname}${window.location.search}`;\n\n  // Never save sso-login routes as redirect paths\n  if (\n    !redirectPath.startsWith(\"/sso-login\") &&\n    !redirectPath.startsWith(\"/sso-login-complete\") &&\n    saveRedirect\n  ) {\n    window.localStorage.setItem(redirectPathStorageKey, redirectPath);\n  }\n\n  const platform = platformKey ?? getPlatformKey(redirectPath);\n\n  const redirectToUrl = window.location.origin;\n\n  let authRedirectUrl = `${authUrl}/login?${queryParams.app}=${appName}`;\n\n  authRedirectUrl += `&${queryParams.redirectTo}=${redirectToUrl}`;\n\n  if (platform) {\n    authRedirectUrl += `&${queryParams.tenant}=${platform}`;\n  }\n  if (logout) {\n    authRedirectUrl += \"&logout=1\";\n  }\n  if (isNativeApp?.() && scheme) {\n    authRedirectUrl += `&scheme=${scheme}`;\n  }\n\n  // Small delay for any pending operations\n  await new Promise((resolve) => setTimeout(resolve, 100));\n\n  if (isNativeApp?.()) {\n    // On native apps (e.g., Tauri), pass preserved token and navigate directly\n    if (preservedToken && preserveTokenKey) {\n      authRedirectUrl += `&token=${encodeURIComponent(preservedToken)}`;\n      console.log(\"[redirectToAuthSpa] Added preserved token to auth URL\");\n    }\n    console.log(\n      \"[redirectToAuthSpa] Native app, navigating to auth URL:\",\n      authRedirectUrl,\n    );\n    window.location.href = authRedirectUrl;\n  } else if (authRedirectProxy) {\n    // Use auth redirect proxy endpoint\n    window.location.href = `${authRedirectProxy}?to=${encodeURIComponent(authRedirectUrl)}`;\n  } else {\n    window.location.href = authRedirectUrl;\n  }\n}\n\n/**\n * Get the URL for joining a tenant (sign up flow)\n * @param authUrl - Auth SPA base URL\n * @param tenantKey - Tenant to join\n * @param redirectUrl - URL to redirect to after joining (defaults to current URL)\n * @returns The join URL\n */\nexport function getAuthSpaJoinUrl(\n  authUrl: string,\n  tenantKey?: string,\n  redirectUrl?: string,\n): string {\n  const resolvedTenant =\n    tenantKey || getPlatformKey(window.location.pathname) || \"\";\n\n  if (!resolvedTenant) {\n    return \"\";\n  }\n\n  const targetUrl = redirectUrl ?? window.location.href;\n  const joinUrl = `${authUrl}/join?tenant=${encodeURIComponent(resolvedTenant)}&redirect-to=${encodeURIComponent(\n    targetUrl,\n  )}`;\n  return joinUrl;\n}\n\n/**\n * Redirect to auth SPA's join/signup page for a specific tenant\n * @param authUrl - Auth SPA base URL\n * @param tenantKey - Tenant to join\n * @param redirectUrl - URL to redirect to after joining (defaults to current URL)\n */\nexport function redirectToAuthSpaJoinTenant(\n  authUrl: string,\n  tenantKey?: string,\n  redirectUrl?: string,\n): void {\n  const resolvedTenant =\n    tenantKey || getPlatformKey(window.location.pathname) || \"\";\n\n  if (!resolvedTenant) {\n    console.log(\"[auth-redirect] Missing tenant key for join\", {\n      tenantKey,\n      redirectUrl,\n    });\n    redirectToAuthSpa({\n      authUrl,\n      appName: \"app\", // Will need to be configured\n      redirectTo: redirectUrl,\n    });\n    return;\n  }\n\n  const targetUrl = redirectUrl ?? window.location.href;\n  const joinUrl = `${authUrl}/join?tenant=${encodeURIComponent(resolvedTenant)}&redirect-to=${encodeURIComponent(\n    targetUrl,\n  )}`;\n\n  window.location.href = joinUrl;\n}\n\nexport interface HandleLogoutOptions {\n  /** URL to redirect to after logout (defaults to current origin) */\n  redirectUrl?: string;\n  /** Auth SPA base URL */\n  authUrl: string;\n  /** localStorage key for tenant */\n  tenantStorageKey?: string;\n  /** Cookie name for logout timestamp */\n  logoutTimestampCookie?: string;\n  /** Callback to execute before logout */\n  callback?: () => void;\n}\n\n/**\n * Handle user logout\n *\n * This function:\n * - Clears localStorage (preserving tenant)\n * - Sets logout timestamp cookie for cross-SPA sync\n * - Clears all cookies\n * - Redirects to auth SPA logout endpoint\n *\n * @param options - Logout configuration options\n *\n * @example\n * ```tsx\n * handleLogout({\n *   authUrl: 'https://auth.example.com',\n *   redirectUrl: 'https://app.example.com',\n * });\n * ```\n */\nexport function handleLogout(options: HandleLogoutOptions): void {\n  const {\n    redirectUrl = window.location.origin,\n    authUrl,\n    tenantStorageKey = \"tenant\",\n    logoutTimestampCookie = \"ibl_logout_timestamp\",\n    callback,\n  } = options;\n\n  const tenant = window.localStorage.getItem(tenantStorageKey);\n  window.localStorage.clear();\n  if (tenant) {\n    window.localStorage.setItem(tenantStorageKey, tenant);\n  }\n\n  // Set logout timestamp cookie to trigger logout on other SPAs\n  setCookieForAuth(logoutTimestampCookie, Date.now().toString());\n\n  clearCookies();\n  callback?.();\n\n  if (!isInIframe()) {\n    window.location.href = `${authUrl}/logout?redirect-to=${redirectUrl}${tenant ? \"&tenant=\" + tenant : \"\"}`;\n  }\n}\n"],"names":[],"mappings":"AAAA;;;;;AAKG;AAEH;;;AAGG;SACa,UAAU,GAAA;AACxB,IAAA,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE;AACjC,QAAA,OAAO,KAAK;IACd;AACA,IAAA,OAAO,CAAA,MAAM,KAAA,IAAA,IAAN,MAAM,KAAA,MAAA,GAAA,MAAA,GAAN,MAAM,CAAE,IAAI,OAAK,MAAM,aAAN,MAAM,KAAA,MAAA,GAAA,MAAA,GAAN,MAAM,CAAE,GAAG,CAAA;AACrC;AAEA;;;AAGG;AACG,SAAU,0BAA0B,CAAC,OAAgB,EAAA;IACzD,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC;AACzC;AAEA;;;;;AAKG;SACa,YAAY,CAAC,IAAY,EAAE,IAAY,EAAE,MAAc,EAAA;IACrE,MAAM,OAAO,GAAG,wCAAwC;AACxD,IAAA,MAAM,WAAW,GAAG,CAAA,EAAG,IAAI,IAAI;AAC/B,IAAA,MAAM,SAAS,GAAG,IAAI,GAAG,CAAA,KAAA,EAAQ,IAAI,CAAA,CAAA,CAAG,GAAG,EAAE;AAC7C,IAAA,MAAM,WAAW,GAAG,MAAM,GAAG,CAAA,OAAA,EAAU,MAAM,CAAA,CAAA,CAAG,GAAG,EAAE;IACrD,QAAQ,CAAC,MAAM,GAAG,WAAW,GAAG,OAAO,GAAG,SAAS,GAAG,WAAW;AACnE;AAEA;;;;;;AAMG;AACG,SAAU,cAAc,CAAC,MAAc,EAAA;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;IAC/B,MAAM,OAAO,GAAa,EAAE;AAC5B,IAAA,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE;AAC1C,QAAA,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxC;AACA,IAAA,OAAO,OAAO;AAChB;AAEA;;;;AAIG;AACG,SAAU,wBAAwB,CACtC,IAAY,EACZ,WAAmB,EAAA;IAEnB,cAAc,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,KAAI;AACjD,QAAA,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC;AACnC,QAAA,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,UAAU,CAAC;AACpC,IAAA,CAAC,CAAC;AACJ;AAEA;;;;AAIG;AACG,SAAU,eAAe,CAAC,MAAe,EAAA;IAC7C,IAAI,CAAC,MAAM,EAAE;AACX,QAAA,OAAO,EAAE;IACX;IACA,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,CAAA,CAAA,EAAI,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA,CAAE,GAAG,MAAM;AACpE;AAEA;;;;;AAKG;AACG,SAAU,gBAAgB,CAC9B,IAAY,EACZ,KAAa,EACb,OAAe,GAAG,EAAA;AAElB,IAAA,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE;AAC1B,IAAA,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/D,IAAA,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ;IACzC,IAAI,UAAU,GAAG,QAAQ;;AAGzB,IAAA,IAAI,QAAQ,KAAK,WAAW,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;QACtE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;AACjC,QAAA,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;AACpB,YAAA,UAAU,GAAG,CAAA,CAAA,EAAI,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QAC9C;IACF;AAEA,IAAA,MAAM,UAAU,GAAG,UAAU,GAAG,CAAA,QAAA,EAAW,UAAU,CAAA,CAAE,GAAG,EAAE;AAC5D,IAAA,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,CAAA,CAAA,EAAI,kBAAkB,CAAC,KAAK,CAAC,CAAA,SAAA,EAAY,OAAO,CAAC,WAAW,EAAE,CAAA,4BAAA,EAA+B,UAAU,EAAE;AACpI;AAEA;;AAEG;SACa,YAAY,GAAA;IAC1B,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;AAC1C,IAAA,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;AACvC,QAAA,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;QACjC,MAAM,IAAI,GAAG,KAAK,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM;QAC1D,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;AACxD,QAAA,QAAQ,CAAC,MAAM,GAAG,CAAA,EAAG,IAAI,CAAA,sDAAA,EAAyD,eAAe,CAC/F,MAAM,CAAC,QAAQ,CAAC,QAAQ,CACzB,EAAE;IACL;AACF;AAEA;;;;AAIG;AACG,SAAU,cAAc,CAAC,IAAY,EAAA;AACzC,IAAA,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,CAAA,WAAA,EAAc,IAAI,CAAA,QAAA,CAAU,CAAC,CAAC;AAC7E,IAAA,OAAO,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI;AACpD;AAEA;;;;AAIG;AACG,SAAU,UAAU,CAAC,QAAA,GAAmB,WAAW,EAAA;IACvD,OAAO,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;AACzC;AAEA;;;;;AAKG;SACa,cAAc,CAC5B,GAAW,EACX,UAAkB,qBAAqB,EAAA;IAEvC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;AAChC,IAAA,OAAO,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI;AAChC;AA8CA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmCG;AACI,eAAe,iBAAiB,CACrC,OAAiC,EAAA;AAEjC,IAAA,MAAM,EACJ,UAAU,EACV,WAAW,EACX,MAAM,GAAG,KAAK,EACd,YAAY,GAAG,IAAI,EACnB,OAAO,EACP,OAAO,EACP,WAAW,GAAG;AACZ,QAAA,GAAG,EAAE,KAAK;AACV,QAAA,UAAU,EAAE,aAAa;AACzB,QAAA,MAAM,EAAE,QAAQ;AACjB,KAAA,EACD,sBAAsB,GAAG,aAAa,EACtC,WAAW,GAAG;AACZ,QAAA,aAAa,EAAE,oBAAoB;AACnC,QAAA,QAAQ,EAAE,eAAe;AACzB,QAAA,MAAM,EAAE,YAAY;AACpB,QAAA,eAAe,EAAE,sBAAsB;AACvC,QAAA,cAAc,EAAE,qBAAqB;AACrC,QAAA,eAAe,EAAE,sBAAsB;KACxC,EACD,sBAAsB,EACtB,SAAS,EACT,gBAAgB,EAChB,iBAAiB,EACjB,WAAW,EACX,MAAM,GAAG,cAAc,EACvB,aAAa,GAAG,KAAK,GACtB,GAAG,OAAO;AAEX,IAAA,OAAO,CAAC,GAAG,CACT,mDAAmD,EACnD,UAAU,EACV,WAAW,EACX,MAAM,EACN,YAAY,EACZ,aAAa,CACd;;AAGD,IAAA,IACE,CAAC,aAAa;AACd,QAAA,WAAW,CAAC,eAAe;QAC3B,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,eAAe,CAAC,EACrD;AACA,QAAA,OAAO,CAAC,GAAG,CACT,kEAAkE,CACnE;QACD;IACF;;;AAIA,IAAA,IACE,CAAC,aAAa;QACd,sBAAsB;AACtB,QAAA,WAAW,CAAC,cAAc;QAC1B,WAAW,CAAC,eAAe,EAC3B;QACA,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,cAAc,CAAC;QAC1D,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,CAAC,eAAe,CAAC;AAC5D,QAAA,MAAM,aAAa,GAAG,sBAAsB,EAAE;AAC9C,QAAA,OAAO,CAAC,GAAG,CAAC,kDAAkD,EAAE;YAC9D,OAAO;YACP,QAAQ;YACR,aAAa;AACb,YAAA,UAAU,EACR,OAAO,IAAI,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK;AACnE,SAAA,CAAC;AACF,QAAA,IACE,CAAC,aAAa;YACd,aAAa;YACb,OAAO;YACP,QAAQ;YACR,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,EAClC;YACA,OAAO,CAAC,GAAG,CACT,qFAAqF,EACrF,EAAE,OAAO,EAAE,QAAQ,EAAE,CACtB;YACD;QACF;IACF;;AAGA,IAAA,IAAI,SAAS,KAAA,IAAA,IAAT,SAAS,uBAAT,SAAS,EAAI,EAAE;AACjB,QAAA,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC;QACnE;IACF;;IAGA,MAAM,cAAc,GAAG;UACnB,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,gBAAgB;UAC5C,IAAI;AAER,IAAA,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC;IACzD,YAAY,CAAC,KAAK,EAAE;AAEpB,IAAA,IAAI,MAAM,IAAI,UAAU,EAAE,EAAE;;AAE1B,QAAA,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ;AAC9C,QAAA,IAAI,WAAW,CAAC,aAAa,EAAE;AAC7B,YAAA,wBAAwB,CAAC,WAAW,CAAC,aAAa,EAAE,aAAa,CAAC;QACpE;AACA,QAAA,IAAI,WAAW,CAAC,QAAQ,EAAE;AACxB,YAAA,wBAAwB,CAAC,WAAW,CAAC,QAAQ,EAAE,aAAa,CAAC;QAC/D;AACA,QAAA,IAAI,WAAW,CAAC,MAAM,EAAE;AACtB,YAAA,wBAAwB,CAAC,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC;QAC7D;;QAGA,IAAI,WAAW,CAAC,eAAe,IAAI,CAAC,UAAU,EAAE,EAAE;AAChD,YAAA,gBAAgB,CAAC,WAAW,CAAC,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;QACtE;IACF;;IAGA,IAAI,UAAU,EAAE,EAAE;AAChB,QAAA,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC;AACjE,QAAA,0BAA0B,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QACjD;IACF;IAEA,MAAM,YAAY,GAChB,UAAU,KAAA,IAAA,IAAV,UAAU,KAAA,MAAA,GAAV,UAAU,GAAI,CAAA,EAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAA,EAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAA,CAAE;;AAGtE,IAAA,IACE,CAAC,YAAY,CAAC,UAAU,CAAC,YAAY,CAAC;AACtC,QAAA,CAAC,YAAY,CAAC,UAAU,CAAC,qBAAqB,CAAC;AAC/C,QAAA,YAAY,EACZ;QACA,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,sBAAsB,EAAE,YAAY,CAAC;IACnE;AAEA,IAAA,MAAM,QAAQ,GAAG,WAAW,KAAA,IAAA,IAAX,WAAW,KAAA,MAAA,GAAX,WAAW,GAAI,cAAc,CAAC,YAAY,CAAC;AAE5D,IAAA,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM;IAE5C,IAAI,eAAe,GAAG,CAAA,EAAG,OAAO,CAAA,OAAA,EAAU,WAAW,CAAC,GAAG,CAAA,CAAA,EAAI,OAAO,CAAA,CAAE;IAEtE,eAAe,IAAI,IAAI,WAAW,CAAC,UAAU,CAAA,CAAA,EAAI,aAAa,EAAE;IAEhE,IAAI,QAAQ,EAAE;QACZ,eAAe,IAAI,IAAI,WAAW,CAAC,MAAM,CAAA,CAAA,EAAI,QAAQ,EAAE;IACzD;IACA,IAAI,MAAM,EAAE;QACV,eAAe,IAAI,WAAW;IAChC;IACA,IAAI,CAAA,WAAW,KAAA,IAAA,IAAX,WAAW,KAAA,MAAA,GAAA,MAAA,GAAX,WAAW,EAAI,KAAI,MAAM,EAAE;AAC7B,QAAA,eAAe,IAAI,CAAA,QAAA,EAAW,MAAM,CAAA,CAAE;IACxC;;AAGA,IAAA,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAExD,IAAA,IAAI,WAAW,KAAA,IAAA,IAAX,WAAW,uBAAX,WAAW,EAAI,EAAE;;AAEnB,QAAA,IAAI,cAAc,IAAI,gBAAgB,EAAE;AACtC,YAAA,eAAe,IAAI,CAAA,OAAA,EAAU,kBAAkB,CAAC,cAAc,CAAC,EAAE;AACjE,YAAA,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC;QACtE;AACA,QAAA,OAAO,CAAC,GAAG,CACT,yDAAyD,EACzD,eAAe,CAChB;AACD,QAAA,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,eAAe;IACxC;SAAO,IAAI,iBAAiB,EAAE;;AAE5B,QAAA,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAA,EAAG,iBAAiB,CAAA,IAAA,EAAO,kBAAkB,CAAC,eAAe,CAAC,EAAE;IACzF;SAAO;AACL,QAAA,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,eAAe;IACxC;AACF;AAEA;;;;;;AAMG;SACa,iBAAiB,CAC/B,OAAe,EACf,SAAkB,EAClB,WAAoB,EAAA;AAEpB,IAAA,MAAM,cAAc,GAClB,SAAS,IAAI,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;IAE7D,IAAI,CAAC,cAAc,EAAE;AACnB,QAAA,OAAO,EAAE;IACX;AAEA,IAAA,MAAM,SAAS,GAAG,WAAW,KAAA,IAAA,IAAX,WAAW,KAAA,MAAA,GAAX,WAAW,GAAI,MAAM,CAAC,QAAQ,CAAC,IAAI;AACrD,IAAA,MAAM,OAAO,GAAG,CAAA,EAAG,OAAO,gBAAgB,kBAAkB,CAAC,cAAc,CAAC,gBAAgB,kBAAkB,CAC5G,SAAS,CACV,EAAE;AACH,IAAA,OAAO,OAAO;AAChB;AAEA;;;;;AAKG;SACa,2BAA2B,CACzC,OAAe,EACf,SAAkB,EAClB,WAAoB,EAAA;AAEpB,IAAA,MAAM,cAAc,GAClB,SAAS,IAAI,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;IAE7D,IAAI,CAAC,cAAc,EAAE;AACnB,QAAA,OAAO,CAAC,GAAG,CAAC,6CAA6C,EAAE;YACzD,SAAS;YACT,WAAW;AACZ,SAAA,CAAC;AACF,QAAA,iBAAiB,CAAC;YAChB,OAAO;YACP,OAAO,EAAE,KAAK;AACd,YAAA,UAAU,EAAE,WAAW;AACxB,SAAA,CAAC;QACF;IACF;AAEA,IAAA,MAAM,SAAS,GAAG,WAAW,KAAA,IAAA,IAAX,WAAW,KAAA,MAAA,GAAX,WAAW,GAAI,MAAM,CAAC,QAAQ,CAAC,IAAI;AACrD,IAAA,MAAM,OAAO,GAAG,CAAA,EAAG,OAAO,gBAAgB,kBAAkB,CAAC,cAAc,CAAC,gBAAgB,kBAAkB,CAC5G,SAAS,CACV,EAAE;AAEH,IAAA,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,OAAO;AAChC;AAeA;;;;;;;;;;;;;;;;;;AAkBG;AACG,SAAU,YAAY,CAAC,OAA4B,EAAA;IACvD,MAAM,EACJ,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EACpC,OAAO,EACP,gBAAgB,GAAG,QAAQ,EAC3B,qBAAqB,GAAG,sBAAsB,EAC9C,QAAQ,GACT,GAAG,OAAO;IAEX,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,gBAAgB,CAAC;AAC5D,IAAA,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE;IAC3B,IAAI,MAAM,EAAE;QACV,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,gBAAgB,EAAE,MAAM,CAAC;IACvD;;IAGA,gBAAgB,CAAC,qBAAqB,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;AAE9D,IAAA,YAAY,EAAE;AACd,IAAA,QAAQ,KAAA,IAAA,IAAR,QAAQ,KAAA,MAAA,GAAA,MAAA,GAAR,QAAQ,EAAI;AAEZ,IAAA,IAAI,CAAC,UAAU,EAAE,EAAE;QACjB,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAA,EAAG,OAAO,CAAA,oBAAA,EAAuB,WAAW,CAAA,EAAG,MAAM,GAAG,UAAU,GAAG,MAAM,GAAG,EAAE,CAAA,CAAE;IAC3G;AACF;;;;"}
+{"version":3,"file":"index.esm.js","sources":["../../src/utils/auth.ts"],"sourcesContent":["/**\n * Authentication and Authorization Utilities\n *\n * This module provides utility functions for handling authentication flows,\n * including redirects to auth SPA, cookie management, and session handling.\n */\n\n/**\n * Check if the current window is inside an iframe\n * @returns {boolean} True if running in an iframe, false otherwise\n */\nexport function isInIframe(): boolean {\n  if (typeof window === \"undefined\") {\n    return false;\n  }\n  return window?.self !== window?.top;\n}\n\n/**\n * Send a message to the parent website (when in iframe)\n * @param payload - The data to send to parent window\n */\nexport function sendMessageToParentWebsite(payload: unknown): void {\n  window.parent.postMessage(payload, \"*\");\n}\n\n/**\n * Delete a cookie with specific name, path, and domain\n * @param name - Cookie name\n * @param path - Cookie path\n * @param domain - Cookie domain\n */\nexport function deleteCookie(name: string, path: string, domain: string): void {\n  const expires = \"expires=Thu, 01 Jan 1970 00:00:00 UTC;\";\n  const cookieValue = `${name}=;`;\n  const pathValue = path ? `path=${path};` : \"\";\n  const domainValue = domain ? `domain=${domain};` : \"\";\n  document.cookie = cookieValue + expires + pathValue + domainValue;\n}\n\n/**\n * Get all possible domain parts for cookie deletion\n * @param domain - The domain to split\n * @returns Array of domain parts\n * @example\n * getDomainParts('app.example.com') // returns ['app.example.com', 'example.com', 'com']\n */\nexport function getDomainParts(domain: string): string[] {\n  const parts = domain.split(\".\");\n  const domains: string[] = [];\n  for (let i = parts.length - 1; i >= 0; i--) {\n    domains.push(parts.slice(i).join(\".\"));\n  }\n  return domains;\n}\n\n/**\n * Delete a cookie across all possible domain variations\n * @param name - Cookie name to delete\n * @param childDomain - The current domain\n */\nexport function deleteCookieOnAllDomains(\n  name: string,\n  childDomain: string,\n): void {\n  getDomainParts(childDomain).forEach((domainPart) => {\n    deleteCookie(name, \"/\", domainPart);\n    deleteCookie(name, \"\", domainPart);\n  });\n}\n\n/**\n * Get the parent domain from a given domain\n * @param domain - The domain to process\n * @returns The parent domain (e.g., 'app.example.com' → '.example.com')\n */\nexport function getParentDomain(domain?: string): string {\n  if (!domain) {\n    return \"\";\n  }\n  const parts = domain.split(\".\");\n  return parts.length > 1 ? `.${parts.slice(-2).join(\".\")}` : domain;\n}\n\n/**\n * Set a cookie for authentication with cross-domain support\n * @param name - Cookie name\n * @param value - Cookie value\n * @param days - Number of days until expiration (default: 365)\n */\nexport function setCookieForAuth(\n  name: string,\n  value: string,\n  days: number = 365,\n): void {\n  const expires = new Date();\n  expires.setTime(expires.getTime() + days * 24 * 60 * 60 * 1000);\n\n  const hostname = window.location.hostname;\n  let baseDomain = hostname;\n\n  // Calculate base domain (skip for localhost and IP addresses)\n  if (hostname !== \"localhost\" && !/^\\d+\\.\\d+\\.\\d+\\.\\d+$/.test(hostname)) {\n    const parts = hostname.split(\".\");\n    if (parts.length > 2) {\n      baseDomain = `.${parts.slice(-2).join(\".\")}`;\n    }\n  }\n\n  const domainAttr = baseDomain ? `;domain=${baseDomain}` : \"\";\n  document.cookie = `${name}=${encodeURIComponent(value)};expires=${expires.toUTCString()};path=/;SameSite=None;Secure${domainAttr}`;\n}\n\n/**\n * Clear all cookies for the current domain\n */\nexport function clearCookies(): void {\n  const cookies = document.cookie.split(\";\");\n  for (let i = 0; i < cookies.length; i++) {\n    const cookie = cookies[i];\n    const eqPos = cookie.indexOf(\"=\");\n    const name = eqPos > -1 ? cookie.substr(0, eqPos) : cookie;\n    deleteCookieOnAllDomains(name, window.location.hostname);\n    document.cookie = `${name}=;expires=Thu, 01 Jan 1970 00:00:00 GMT;path=/;Domain=${getParentDomain(\n      window.location.hostname,\n    )}`;\n  }\n}\n\n/**\n * Get the value of a cookie by name\n * @param name - Cookie name\n * @returns The cookie value or null if not found\n */\nexport function getCookieValue(name: string): string | null {\n  const match = document.cookie.match(new RegExp(`(?:^|;\\\\s*)${name}=([^;]*)`));\n  return match ? decodeURIComponent(match[1]) : null;\n}\n\n/**\n * Check if user is currently logged in\n * @param tokenKey - The localStorage key for the auth token (default: 'axd_token')\n * @returns True if logged in, false otherwise\n */\nexport function isLoggedIn(tokenKey: string = \"axd_token\"): boolean {\n  return !!localStorage.getItem(tokenKey);\n}\n\n/**\n * Extract platform/tenant key from URL\n * @param url - The URL to parse\n * @param pattern - RegExp pattern to match platform key (default matches /platform/[key]/...)\n * @returns The platform key or null if not found\n */\nexport function getPlatformKey(\n  url: string,\n  pattern: RegExp = /\\/platform\\/([^/]+)/,\n): string | null {\n  const match = url.match(pattern);\n  return match ? match[1] : null;\n}\n\nexport interface RedirectToAuthSpaOptions {\n  /** URL to redirect to after auth (defaults to current path + search) */\n  redirectTo?: string;\n  /** Platform/tenant key */\n  platformKey?: string;\n  /** Whether this is a logout action */\n  logout?: boolean;\n  /** Whether to save redirect path to localStorage (default: true) */\n  saveRedirect?: boolean;\n  /** Auth SPA base URL */\n  authUrl: string;\n  /** Current app/platform identifier (e.g., 'mentor', 'skills') */\n  appName: string;\n  /** Query param names */\n  queryParams?: {\n    app?: string;\n    redirectTo?: string;\n    tenant?: string;\n  };\n  /** localStorage key for saving redirect path */\n  redirectPathStorageKey?: string;\n  /** Cookie names for cross-SPA sync */\n  cookieNames?: {\n    currentTenant?: string;\n    userData?: string;\n    tenant?: string;\n    logoutTimestamp?: string;\n    loginTimestamp?: string;\n    tenantSwitching?: string;\n  };\n  /** Function to check if auth token is valid and non-expired. Used to skip redirect when a recent login occurred. */\n  hasNonExpiredAuthToken?: () => boolean;\n  /** Function to check if the app is in offline mode (e.g., Tauri offline). Skips redirect when true. */\n  isOffline?: () => boolean;\n  /** localStorage key for a token to preserve before clearing storage (e.g., 'edx_jwt_token') */\n  preserveTokenKey?: string;\n  /** Path to an auth redirect proxy endpoint (e.g., '/api/auth-redirect'). When set, redirects via this proxy in browser. */\n  authRedirectProxy?: string;\n  /** Function to check if the app is running as a native app (e.g., Tauri). Affects redirect behavior. */\n  isNativeApp?: () => boolean;\n  forceRedirect?: boolean;\n  scheme?: string;\n}\n\n/**\n * Redirect to authentication SPA for login/logout\n *\n * This function handles the complete authentication flow:\n * - Clears localStorage and cookies on logout\n * - Saves redirect path for post-auth return\n * - Handles iframe scenarios\n * - Syncs logout across multiple SPAs via cookies\n *\n * @param options - Configuration options for the redirect\n *\n * @example\n * ```tsx\n * // Basic usage\n * redirectToAuthSpa({\n *   authUrl: 'https://auth.example.com',\n *   appName: 'mentor',\n * });\n *\n * // With logout\n * redirectToAuthSpa({\n *   authUrl: 'https://auth.example.com',\n *   appName: 'mentor',\n *   logout: true,\n *   platformKey: 'my-tenant',\n * });\n *\n * // With custom redirect\n * redirectToAuthSpa({\n *   authUrl: 'https://auth.example.com',\n *   appName: 'mentor',\n *   redirectTo: '/dashboard',\n *   platformKey: 'my-tenant',\n * });\n * ```\n */\nexport async function redirectToAuthSpa(\n  options: RedirectToAuthSpaOptions,\n): Promise<void> {\n  const {\n    redirectTo,\n    platformKey,\n    logout = false,\n    saveRedirect = true,\n    authUrl,\n    appName,\n    queryParams = {\n      app: \"app\",\n      redirectTo: \"redirect-to\",\n      tenant: \"tenant\",\n    },\n    redirectPathStorageKey = \"redirect_to\",\n    cookieNames = {\n      currentTenant: \"ibl_current_tenant\",\n      userData: \"ibl_user_data\",\n      tenant: \"ibl_tenant\",\n      logoutTimestamp: \"ibl_logout_timestamp\",\n      loginTimestamp: \"ibl_login_timestamp\",\n      tenantSwitching: \"ibl_tenant_switching\",\n    },\n    hasNonExpiredAuthToken,\n    isOffline,\n    preserveTokenKey,\n    authRedirectProxy,\n    isNativeApp,\n    scheme = \"iblai-mentor\",\n    forceRedirect = false,\n  } = options;\n\n  console.log(\n    \"[redirectToAuthSpa] starting redirect to auth spa\",\n    redirectTo,\n    platformKey,\n    logout,\n    saveRedirect,\n    forceRedirect,\n  );\n\n  // Skip if a tenant switch is already in progress\n  if (\n    !forceRedirect &&\n    cookieNames.tenantSwitching &&\n    document.cookie.includes(cookieNames.tenantSwitching)\n  ) {\n    console.log(\n      \"[redirectToAuthSpa] Tenant switch in progress, skipping redirect\",\n    );\n    return;\n  }\n\n  // Skip if a login occurred after the last logout (login takes precedence)\n  // but only if this app actually has a valid auth token\n  if (\n    !forceRedirect &&\n    hasNonExpiredAuthToken &&\n    cookieNames.loginTimestamp &&\n    cookieNames.logoutTimestamp\n  ) {\n    const loginTs = getCookieValue(cookieNames.loginTimestamp);\n    const logoutTs = getCookieValue(cookieNames.logoutTimestamp);\n    const hasValidToken = hasNonExpiredAuthToken();\n    console.log(\"[redirectToAuthSpa] Login/logout timestamp check\", {\n      loginTs,\n      logoutTs,\n      hasValidToken,\n      loginAhead:\n        loginTs && logoutTs ? Number(loginTs) > Number(logoutTs) : false,\n    });\n    if (\n      !forceRedirect &&\n      hasValidToken &&\n      loginTs &&\n      logoutTs &&\n      Number(loginTs) > Number(logoutTs)\n    ) {\n      console.log(\n        \"[redirectToAuthSpa] Login timestamp is ahead of logout timestamp, skipping redirect\",\n        { loginTs, logoutTs },\n      );\n      return;\n    }\n  }\n\n  // Skip redirect in offline mode\n  if (isOffline?.()) {\n    console.log(\"[redirectToAuthSpa] Skipping redirect - offline mode\");\n    return;\n  }\n\n  // Preserve a token before clearing localStorage if requested\n  const preservedToken = preserveTokenKey\n    ? window.localStorage.getItem(preserveTokenKey)\n    : null;\n\n  console.log(\"[redirectToAuthSpa] clearing local storage\");\n  localStorage.clear();\n\n  if (logout || isInIframe()) {\n    // Delete authentication cookies for cross-SPA synchronization\n    const currentDomain = window.location.hostname;\n    if (cookieNames.currentTenant) {\n      deleteCookieOnAllDomains(cookieNames.currentTenant, currentDomain);\n    }\n    if (cookieNames.userData) {\n      deleteCookieOnAllDomains(cookieNames.userData, currentDomain);\n    }\n    if (cookieNames.tenant) {\n      deleteCookieOnAllDomains(cookieNames.tenant, currentDomain);\n    }\n\n    // Set logout timestamp cookie to trigger logout on other SPAs\n    if (cookieNames.logoutTimestamp && !isInIframe()) {\n      setCookieForAuth(cookieNames.logoutTimestamp, Date.now().toString());\n    }\n  }\n\n  // Handle iframe scenario\n  if (isInIframe()) {\n    console.log(\"[redirectToAuthSpa]: sending authExpired to parent\");\n    sendMessageToParentWebsite({ authExpired: true });\n    return;\n  }\n\n  const redirectPath =\n    redirectTo ?? `${window.location.pathname}${window.location.search}`;\n\n  // Never save sso-login routes as redirect paths\n  if (\n    !redirectPath.startsWith(\"/sso-login\") &&\n    !redirectPath.startsWith(\"/sso-login-complete\") &&\n    saveRedirect\n  ) {\n    window.localStorage.setItem(redirectPathStorageKey, redirectPath);\n  }\n\n  const platform = platformKey ?? getPlatformKey(redirectPath);\n\n  const redirectToUrl = window.location.origin;\n\n  let authRedirectUrl = `${authUrl}/login?${queryParams.app}=${appName}`;\n\n  authRedirectUrl += `&${queryParams.redirectTo}=${redirectToUrl}`;\n\n  if (platform) {\n    authRedirectUrl += `&${queryParams.tenant}=${platform}`;\n  }\n  if (logout) {\n    authRedirectUrl += \"&logout=1\";\n  }\n  if (isNativeApp?.() && scheme) {\n    authRedirectUrl += `&scheme=${scheme}`;\n  }\n\n  // Small delay for any pending operations\n  await new Promise((resolve) => setTimeout(resolve, 100));\n\n  if (isNativeApp?.()) {\n    // On native apps (e.g., Tauri), pass preserved token and navigate directly\n    if (preservedToken && preserveTokenKey) {\n      authRedirectUrl += `&token=${encodeURIComponent(preservedToken)}`;\n      console.log(\"[redirectToAuthSpa] Added preserved token to auth URL\");\n    }\n    console.log(\n      \"[redirectToAuthSpa] Native app, navigating to auth URL:\",\n      authRedirectUrl,\n    );\n    window.location.href = authRedirectUrl;\n  } else if (authRedirectProxy) {\n    // Use auth redirect proxy endpoint\n    window.location.href = `${authRedirectProxy}?to=${encodeURIComponent(authRedirectUrl)}`;\n  } else {\n    window.location.href = authRedirectUrl;\n  }\n}\n\n/**\n * Get the URL for joining a tenant (sign up flow)\n * @param authUrl - Auth SPA base URL\n * @param tenantKey - Tenant to join\n * @param redirectUrl - URL to redirect to after joining (defaults to current URL)\n * @returns The join URL\n */\nexport function getAuthSpaJoinUrl(\n  authUrl: string,\n  tenantKey?: string,\n  redirectUrl?: string,\n): string {\n  const resolvedTenant =\n    tenantKey || getPlatformKey(window.location.pathname) || \"\";\n\n  if (!resolvedTenant) {\n    return \"\";\n  }\n\n  const targetUrl = redirectUrl ?? window.location.href;\n  const joinUrl = `${authUrl}/join?tenant=${encodeURIComponent(resolvedTenant)}&redirect-to=${encodeURIComponent(\n    targetUrl,\n  )}`;\n  return joinUrl;\n}\n\n/**\n * Redirect to auth SPA's join/signup page for a specific tenant\n * @param authUrl - Auth SPA base URL\n * @param tenantKey - Tenant to join\n * @param redirectUrl - URL to redirect to after joining (defaults to current URL)\n */\nexport function redirectToAuthSpaJoinTenant(\n  authUrl: string,\n  tenantKey?: string,\n  redirectUrl?: string,\n): void {\n  const resolvedTenant =\n    tenantKey || getPlatformKey(window.location.pathname) || \"\";\n\n  if (!resolvedTenant) {\n    console.log(\"[auth-redirect] Missing tenant key for join\", {\n      tenantKey,\n      redirectUrl,\n    });\n    redirectToAuthSpa({\n      authUrl,\n      appName: \"app\", // Will need to be configured\n      redirectTo: redirectUrl,\n    });\n    return;\n  }\n\n  const targetUrl = redirectUrl ?? window.location.href;\n  const joinUrl = `${authUrl}/join?tenant=${encodeURIComponent(resolvedTenant)}&redirect-to=${encodeURIComponent(\n    targetUrl,\n  )}`;\n\n  window.location.href = joinUrl;\n}\n\nexport interface HandleLogoutOptions {\n  /** URL to redirect to after logout (defaults to current origin) */\n  redirectUrl?: string;\n  /** Auth SPA base URL */\n  authUrl: string;\n  /** localStorage key for tenant */\n  tenantStorageKey?: string;\n  /** Cookie name for logout timestamp */\n  logoutTimestampCookie?: string;\n  /** Callback to execute before logout */\n  callback?: () => void;\n}\n\n/**\n * Handle user logout\n *\n * This function:\n * - Clears localStorage (preserving tenant)\n * - Sets logout timestamp cookie for cross-SPA sync\n * - Clears all cookies\n * - Redirects to auth SPA logout endpoint\n *\n * @param options - Logout configuration options\n *\n * @example\n * ```tsx\n * handleLogout({\n *   authUrl: 'https://auth.example.com',\n *   redirectUrl: 'https://app.example.com',\n * });\n * ```\n */\nexport function handleLogout(options: HandleLogoutOptions): void {\n  const {\n    redirectUrl = window.location.origin,\n    authUrl,\n    tenantStorageKey = \"tenant\",\n    logoutTimestampCookie = \"ibl_logout_timestamp\",\n    callback,\n  } = options;\n\n  const tenant = window.localStorage.getItem(tenantStorageKey);\n  window.localStorage.clear();\n  if (tenant) {\n    window.localStorage.setItem(tenantStorageKey, tenant);\n  }\n\n  // Set logout timestamp cookie to trigger logout on other SPAs\n  setCookieForAuth(logoutTimestampCookie, Date.now().toString());\n\n  clearCookies();\n  callback?.();\n\n  if (!isInIframe()) {\n    window.location.href = `${authUrl}/logout?redirect-to=${redirectUrl}${tenant ? \"&tenant=\" + tenant : \"\"}`;\n  }\n}\n\n// ── Tenant-switch coordination ─────────────────────────────────────────────\n// Cross-tab tenant switching: a TTL lock (shared via localStorage) plus a\n// BroadcastChannel signal let multiple tabs coordinate a switch and prevent the\n// \"ping-pong\" where a stale tab reverts the session to its own route's tenant.\nexport const TENANT_SWITCH_CHANNEL = \"ibl-tenant-switch\";\nexport const TENANT_SWITCH_LOCK_KEY = \"ibl_tenant_switch_lock\";\nexport const DEFAULT_TENANT_SWITCH_LOCK_TTL_MS = 8_000;\n\nexport interface TenantSwitchLock {\n  tenant: string;\n  /** `${ts}-${tabId}` — monotonic; newer wins. */\n  token: string;\n  ts: number;\n  senderId: string;\n}\n\nlet _tabId: string | null = null;\n/**\n * Stable per-tab id. Uses sessionStorage so it survives same-tab reloads while\n * staying unique per tab/window.\n */\nexport function getTabId(): string {\n  if (_tabId) return _tabId;\n  try {\n    const existing = sessionStorage.getItem(\"ibl_tab_id\");\n    if (existing) return (_tabId = existing);\n    const id = crypto?.randomUUID?.() ?? `${Date.now()}-${Math.random()}`;\n    sessionStorage.setItem(\"ibl_tab_id\", id);\n    return (_tabId = id);\n  } catch {\n    return (_tabId = `${Date.now()}-${Math.random()}`);\n  }\n}\n\n/** The active (non-expired) tenant-switch lock, or null. */\nexport function readTenantSwitchLock(\n  ttlMs: number = DEFAULT_TENANT_SWITCH_LOCK_TTL_MS,\n): TenantSwitchLock | null {\n  try {\n    const raw = localStorage.getItem(TENANT_SWITCH_LOCK_KEY);\n    if (!raw) return null;\n    const lock = JSON.parse(raw) as TenantSwitchLock;\n    if (typeof lock?.ts !== \"number\") return null;\n    if (Date.now() - lock.ts > ttlMs) return null;\n    return lock;\n  } catch {\n    return null;\n  }\n}\n\n/** Write a fresh lock for `tenant` (newest intent). Returns the lock written. */\nexport function writeTenantSwitchLock(tenant: string): TenantSwitchLock {\n  const lock: TenantSwitchLock = {\n    tenant,\n    token: `${Date.now()}-${getTabId()}`,\n    ts: Date.now(),\n    senderId: getTabId(),\n  };\n  try {\n    localStorage.setItem(TENANT_SWITCH_LOCK_KEY, JSON.stringify(lock));\n  } catch {}\n  return lock;\n}\n\n/** Extend an existing lock's window from \"now\" (no-op when no active lock). */\nexport function refreshTenantSwitchLock(): void {\n  const lock = readTenantSwitchLock();\n  if (!lock) return;\n  try {\n    localStorage.setItem(\n      TENANT_SWITCH_LOCK_KEY,\n      JSON.stringify({ ...lock, ts: Date.now() }),\n    );\n  } catch {}\n}\n\nexport function clearTenantSwitchLock(): void {\n  try {\n    localStorage.removeItem(TENANT_SWITCH_LOCK_KEY);\n  } catch {}\n}\n\n/** True while a tenant switch is in flight — gate automatic reverts on this. */\nexport function isTenantSwitchInProgress(ttlMs?: number): boolean {\n  return readTenantSwitchLock(ttlMs) !== null;\n}\n\nexport interface HandleTenantSwitchOptions {\n  /** Auth SPA base URL (e.g. config.authUrl()). */\n  authUrl: string;\n  /** localStorage key for the saved redirect path (default \"redirect-to\"). */\n  redirectPathStorageKey?: string;\n  /** localStorage key for a JWT to forward through the switch (default \"edx_jwt_token\"). */\n  preserveTokenKey?: string;\n  /** localStorage key holding the tenant (default \"tenant\"). */\n  tenantStorageKey?: string;\n  /** Cookie name signalling a switch is in progress (default \"ibl_tenant_switching\"). */\n  tenantSwitchingCookie?: string;\n  /** Query-param names for the auth URL. */\n  queryParams?: { tenant?: string; redirectTo?: string };\n  /** Persist the current path so the app returns to it post-switch. */\n  saveRedirect?: boolean;\n  /** Explicit redirect target (defaults to window.location.origin). */\n  redirectUrl?: string;\n  /** Broadcast to other tabs + clear storage (true for user-initiated; default true). */\n  broadcast?: boolean;\n  /** Lock TTL override. */\n  lockTtlMs?: number;\n  /** Injected so this util stays React-free (mentorai passes the SDK's). */\n  clearCurrentTenantCookie?: () => void;\n}\n\n/**\n * Switch the active tenant. Coordinates across tabs (TTL lock + BroadcastChannel),\n * clears storage, then redirects through the auth SPA's `/login/complete`.\n *\n * @example\n * await handleTenantSwitch(\"acme\", {\n *   authUrl: config.authUrl(),\n *   clearCurrentTenantCookie,\n * });\n */\nexport async function handleTenantSwitch(\n  tenant: string,\n  options: HandleTenantSwitchOptions,\n): Promise<void> {\n  const {\n    authUrl,\n    redirectPathStorageKey = \"redirect-to\",\n    preserveTokenKey = \"edx_jwt_token\",\n    tenantStorageKey = \"tenant\",\n    tenantSwitchingCookie = \"ibl_tenant_switching\",\n    queryParams = {},\n    saveRedirect = false,\n    redirectUrl,\n    broadcast = true,\n    clearCurrentTenantCookie,\n  } = options;\n  const tenantParam = queryParams.tenant ?? \"tenant\";\n  const redirectToParam = queryParams.redirectTo ?? \"redirect-to\";\n\n  // Guard: don't start a new user switch while one is already in progress.\n  if (broadcast && document.cookie.includes(tenantSwitchingCookie)) return;\n  // Guard: already on the target tenant.\n  if (tenant === localStorage.getItem(tenantStorageKey)) return;\n\n  if (broadcast) {\n    setCookieForAuth(tenantSwitchingCookie, \"true\");\n    writeTenantSwitchLock(tenant);\n    if (typeof BroadcastChannel !== \"undefined\") {\n      const channel = new BroadcastChannel(TENANT_SWITCH_CHANNEL);\n      const lock = readTenantSwitchLock(options.lockTtlMs);\n      channel.postMessage({\n        type: \"TENANT_SWITCHING\",\n        tenant,\n        senderId: lock?.senderId ?? getTabId(),\n        token: lock?.token,\n      });\n      channel.close();\n    }\n    clearCurrentTenantCookie?.();\n  }\n\n  const currentPath = `${window.location.pathname}${window.location.search}`;\n  const jwtToken = localStorage.getItem(preserveTokenKey);\n  if (broadcast) localStorage.clear();\n\n  const params: Record<string, string> = {\n    [tenantParam]: tenant,\n    [redirectToParam]: redirectUrl ?? window.location.origin,\n  };\n  if (jwtToken) params.token = jwtToken;\n\n  localStorage.setItem(tenantStorageKey, tenant);\n  if (saveRedirect) localStorage.setItem(redirectPathStorageKey, currentPath);\n  // Re-persist: localStorage.clear() above wiped the pre-broadcast lock; this\n  // copy survives the redirect so stale tabs honor the switch window.\n  if (broadcast) writeTenantSwitchLock(tenant);\n\n  await new Promise((resolve) => setTimeout(resolve, 100));\n  window.location.href = `${authUrl}/login/complete?${new URLSearchParams(params)}`;\n}\n"],"names":[],"mappings":"AAAA;;;;;AAKG;AAEH;;;AAGG;SACa,UAAU,GAAA;AACxB,IAAA,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE;AACjC,QAAA,OAAO,KAAK;IACd;AACA,IAAA,OAAO,CAAA,MAAM,KAAA,IAAA,IAAN,MAAM,KAAA,MAAA,GAAA,MAAA,GAAN,MAAM,CAAE,IAAI,OAAK,MAAM,aAAN,MAAM,KAAA,MAAA,GAAA,MAAA,GAAN,MAAM,CAAE,GAAG,CAAA;AACrC;AAEA;;;AAGG;AACG,SAAU,0BAA0B,CAAC,OAAgB,EAAA;IACzD,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC;AACzC;AAEA;;;;;AAKG;SACa,YAAY,CAAC,IAAY,EAAE,IAAY,EAAE,MAAc,EAAA;IACrE,MAAM,OAAO,GAAG,wCAAwC;AACxD,IAAA,MAAM,WAAW,GAAG,CAAA,EAAG,IAAI,IAAI;AAC/B,IAAA,MAAM,SAAS,GAAG,IAAI,GAAG,CAAA,KAAA,EAAQ,IAAI,CAAA,CAAA,CAAG,GAAG,EAAE;AAC7C,IAAA,MAAM,WAAW,GAAG,MAAM,GAAG,CAAA,OAAA,EAAU,MAAM,CAAA,CAAA,CAAG,GAAG,EAAE;IACrD,QAAQ,CAAC,MAAM,GAAG,WAAW,GAAG,OAAO,GAAG,SAAS,GAAG,WAAW;AACnE;AAEA;;;;;;AAMG;AACG,SAAU,cAAc,CAAC,MAAc,EAAA;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;IAC/B,MAAM,OAAO,GAAa,EAAE;AAC5B,IAAA,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE;AAC1C,QAAA,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxC;AACA,IAAA,OAAO,OAAO;AAChB;AAEA;;;;AAIG;AACG,SAAU,wBAAwB,CACtC,IAAY,EACZ,WAAmB,EAAA;IAEnB,cAAc,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,KAAI;AACjD,QAAA,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,CAAC;AACnC,QAAA,YAAY,CAAC,IAAI,EAAE,EAAE,EAAE,UAAU,CAAC;AACpC,IAAA,CAAC,CAAC;AACJ;AAEA;;;;AAIG;AACG,SAAU,eAAe,CAAC,MAAe,EAAA;IAC7C,IAAI,CAAC,MAAM,EAAE;AACX,QAAA,OAAO,EAAE;IACX;IACA,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,CAAA,CAAA,EAAI,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA,CAAE,GAAG,MAAM;AACpE;AAEA;;;;;AAKG;AACG,SAAU,gBAAgB,CAC9B,IAAY,EACZ,KAAa,EACb,OAAe,GAAG,EAAA;AAElB,IAAA,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE;AAC1B,IAAA,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/D,IAAA,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ;IACzC,IAAI,UAAU,GAAG,QAAQ;;AAGzB,IAAA,IAAI,QAAQ,KAAK,WAAW,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;QACtE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;AACjC,QAAA,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE;AACpB,YAAA,UAAU,GAAG,CAAA,CAAA,EAAI,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QAC9C;IACF;AAEA,IAAA,MAAM,UAAU,GAAG,UAAU,GAAG,CAAA,QAAA,EAAW,UAAU,CAAA,CAAE,GAAG,EAAE;AAC5D,IAAA,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,CAAA,CAAA,EAAI,kBAAkB,CAAC,KAAK,CAAC,CAAA,SAAA,EAAY,OAAO,CAAC,WAAW,EAAE,CAAA,4BAAA,EAA+B,UAAU,EAAE;AACpI;AAEA;;AAEG;SACa,YAAY,GAAA;IAC1B,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;AAC1C,IAAA,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;AACvC,QAAA,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;QACjC,MAAM,IAAI,GAAG,KAAK,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM;QAC1D,wBAAwB,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;AACxD,QAAA,QAAQ,CAAC,MAAM,GAAG,CAAA,EAAG,IAAI,CAAA,sDAAA,EAAyD,eAAe,CAC/F,MAAM,CAAC,QAAQ,CAAC,QAAQ,CACzB,EAAE;IACL;AACF;AAEA;;;;AAIG;AACG,SAAU,cAAc,CAAC,IAAY,EAAA;AACzC,IAAA,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,CAAA,WAAA,EAAc,IAAI,CAAA,QAAA,CAAU,CAAC,CAAC;AAC7E,IAAA,OAAO,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI;AACpD;AAEA;;;;AAIG;AACG,SAAU,UAAU,CAAC,QAAA,GAAmB,WAAW,EAAA;IACvD,OAAO,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC;AACzC;AAEA;;;;;AAKG;SACa,cAAc,CAC5B,GAAW,EACX,UAAkB,qBAAqB,EAAA;IAEvC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;AAChC,IAAA,OAAO,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI;AAChC;AA8CA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmCG;AACI,eAAe,iBAAiB,CACrC,OAAiC,EAAA;AAEjC,IAAA,MAAM,EACJ,UAAU,EACV,WAAW,EACX,MAAM,GAAG,KAAK,EACd,YAAY,GAAG,IAAI,EACnB,OAAO,EACP,OAAO,EACP,WAAW,GAAG;AACZ,QAAA,GAAG,EAAE,KAAK;AACV,QAAA,UAAU,EAAE,aAAa;AACzB,QAAA,MAAM,EAAE,QAAQ;AACjB,KAAA,EACD,sBAAsB,GAAG,aAAa,EACtC,WAAW,GAAG;AACZ,QAAA,aAAa,EAAE,oBAAoB;AACnC,QAAA,QAAQ,EAAE,eAAe;AACzB,QAAA,MAAM,EAAE,YAAY;AACpB,QAAA,eAAe,EAAE,sBAAsB;AACvC,QAAA,cAAc,EAAE,qBAAqB;AACrC,QAAA,eAAe,EAAE,sBAAsB;KACxC,EACD,sBAAsB,EACtB,SAAS,EACT,gBAAgB,EAChB,iBAAiB,EACjB,WAAW,EACX,MAAM,GAAG,cAAc,EACvB,aAAa,GAAG,KAAK,GACtB,GAAG,OAAO;AAEX,IAAA,OAAO,CAAC,GAAG,CACT,mDAAmD,EACnD,UAAU,EACV,WAAW,EACX,MAAM,EACN,YAAY,EACZ,aAAa,CACd;;AAGD,IAAA,IACE,CAAC,aAAa;AACd,QAAA,WAAW,CAAC,eAAe;QAC3B,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,eAAe,CAAC,EACrD;AACA,QAAA,OAAO,CAAC,GAAG,CACT,kEAAkE,CACnE;QACD;IACF;;;AAIA,IAAA,IACE,CAAC,aAAa;QACd,sBAAsB;AACtB,QAAA,WAAW,CAAC,cAAc;QAC1B,WAAW,CAAC,eAAe,EAC3B;QACA,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,cAAc,CAAC;QAC1D,MAAM,QAAQ,GAAG,cAAc,CAAC,WAAW,CAAC,eAAe,CAAC;AAC5D,QAAA,MAAM,aAAa,GAAG,sBAAsB,EAAE;AAC9C,QAAA,OAAO,CAAC,GAAG,CAAC,kDAAkD,EAAE;YAC9D,OAAO;YACP,QAAQ;YACR,aAAa;AACb,YAAA,UAAU,EACR,OAAO,IAAI,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK;AACnE,SAAA,CAAC;AACF,QAAA,IACE,CAAC,aAAa;YACd,aAAa;YACb,OAAO;YACP,QAAQ;YACR,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,EAClC;YACA,OAAO,CAAC,GAAG,CACT,qFAAqF,EACrF,EAAE,OAAO,EAAE,QAAQ,EAAE,CACtB;YACD;QACF;IACF;;AAGA,IAAA,IAAI,SAAS,KAAA,IAAA,IAAT,SAAS,uBAAT,SAAS,EAAI,EAAE;AACjB,QAAA,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC;QACnE;IACF;;IAGA,MAAM,cAAc,GAAG;UACnB,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,gBAAgB;UAC5C,IAAI;AAER,IAAA,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC;IACzD,YAAY,CAAC,KAAK,EAAE;AAEpB,IAAA,IAAI,MAAM,IAAI,UAAU,EAAE,EAAE;;AAE1B,QAAA,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ;AAC9C,QAAA,IAAI,WAAW,CAAC,aAAa,EAAE;AAC7B,YAAA,wBAAwB,CAAC,WAAW,CAAC,aAAa,EAAE,aAAa,CAAC;QACpE;AACA,QAAA,IAAI,WAAW,CAAC,QAAQ,EAAE;AACxB,YAAA,wBAAwB,CAAC,WAAW,CAAC,QAAQ,EAAE,aAAa,CAAC;QAC/D;AACA,QAAA,IAAI,WAAW,CAAC,MAAM,EAAE;AACtB,YAAA,wBAAwB,CAAC,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC;QAC7D;;QAGA,IAAI,WAAW,CAAC,eAAe,IAAI,CAAC,UAAU,EAAE,EAAE;AAChD,YAAA,gBAAgB,CAAC,WAAW,CAAC,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;QACtE;IACF;;IAGA,IAAI,UAAU,EAAE,EAAE;AAChB,QAAA,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC;AACjE,QAAA,0BAA0B,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QACjD;IACF;IAEA,MAAM,YAAY,GAChB,UAAU,KAAA,IAAA,IAAV,UAAU,KAAA,MAAA,GAAV,UAAU,GAAI,CAAA,EAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAA,EAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAA,CAAE;;AAGtE,IAAA,IACE,CAAC,YAAY,CAAC,UAAU,CAAC,YAAY,CAAC;AACtC,QAAA,CAAC,YAAY,CAAC,UAAU,CAAC,qBAAqB,CAAC;AAC/C,QAAA,YAAY,EACZ;QACA,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,sBAAsB,EAAE,YAAY,CAAC;IACnE;AAEA,IAAA,MAAM,QAAQ,GAAG,WAAW,KAAA,IAAA,IAAX,WAAW,KAAA,MAAA,GAAX,WAAW,GAAI,cAAc,CAAC,YAAY,CAAC;AAE5D,IAAA,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM;IAE5C,IAAI,eAAe,GAAG,CAAA,EAAG,OAAO,CAAA,OAAA,EAAU,WAAW,CAAC,GAAG,CAAA,CAAA,EAAI,OAAO,CAAA,CAAE;IAEtE,eAAe,IAAI,IAAI,WAAW,CAAC,UAAU,CAAA,CAAA,EAAI,aAAa,EAAE;IAEhE,IAAI,QAAQ,EAAE;QACZ,eAAe,IAAI,IAAI,WAAW,CAAC,MAAM,CAAA,CAAA,EAAI,QAAQ,EAAE;IACzD;IACA,IAAI,MAAM,EAAE;QACV,eAAe,IAAI,WAAW;IAChC;IACA,IAAI,CAAA,WAAW,KAAA,IAAA,IAAX,WAAW,KAAA,MAAA,GAAA,MAAA,GAAX,WAAW,EAAI,KAAI,MAAM,EAAE;AAC7B,QAAA,eAAe,IAAI,CAAA,QAAA,EAAW,MAAM,CAAA,CAAE;IACxC;;AAGA,IAAA,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAExD,IAAA,IAAI,WAAW,KAAA,IAAA,IAAX,WAAW,uBAAX,WAAW,EAAI,EAAE;;AAEnB,QAAA,IAAI,cAAc,IAAI,gBAAgB,EAAE;AACtC,YAAA,eAAe,IAAI,CAAA,OAAA,EAAU,kBAAkB,CAAC,cAAc,CAAC,EAAE;AACjE,YAAA,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC;QACtE;AACA,QAAA,OAAO,CAAC,GAAG,CACT,yDAAyD,EACzD,eAAe,CAChB;AACD,QAAA,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,eAAe;IACxC;SAAO,IAAI,iBAAiB,EAAE;;AAE5B,QAAA,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAA,EAAG,iBAAiB,CAAA,IAAA,EAAO,kBAAkB,CAAC,eAAe,CAAC,EAAE;IACzF;SAAO;AACL,QAAA,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,eAAe;IACxC;AACF;AAEA;;;;;;AAMG;SACa,iBAAiB,CAC/B,OAAe,EACf,SAAkB,EAClB,WAAoB,EAAA;AAEpB,IAAA,MAAM,cAAc,GAClB,SAAS,IAAI,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;IAE7D,IAAI,CAAC,cAAc,EAAE;AACnB,QAAA,OAAO,EAAE;IACX;AAEA,IAAA,MAAM,SAAS,GAAG,WAAW,KAAA,IAAA,IAAX,WAAW,KAAA,MAAA,GAAX,WAAW,GAAI,MAAM,CAAC,QAAQ,CAAC,IAAI;AACrD,IAAA,MAAM,OAAO,GAAG,CAAA,EAAG,OAAO,gBAAgB,kBAAkB,CAAC,cAAc,CAAC,gBAAgB,kBAAkB,CAC5G,SAAS,CACV,EAAE;AACH,IAAA,OAAO,OAAO;AAChB;AAEA;;;;;AAKG;SACa,2BAA2B,CACzC,OAAe,EACf,SAAkB,EAClB,WAAoB,EAAA;AAEpB,IAAA,MAAM,cAAc,GAClB,SAAS,IAAI,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;IAE7D,IAAI,CAAC,cAAc,EAAE;AACnB,QAAA,OAAO,CAAC,GAAG,CAAC,6CAA6C,EAAE;YACzD,SAAS;YACT,WAAW;AACZ,SAAA,CAAC;AACF,QAAA,iBAAiB,CAAC;YAChB,OAAO;YACP,OAAO,EAAE,KAAK;AACd,YAAA,UAAU,EAAE,WAAW;AACxB,SAAA,CAAC;QACF;IACF;AAEA,IAAA,MAAM,SAAS,GAAG,WAAW,KAAA,IAAA,IAAX,WAAW,KAAA,MAAA,GAAX,WAAW,GAAI,MAAM,CAAC,QAAQ,CAAC,IAAI;AACrD,IAAA,MAAM,OAAO,GAAG,CAAA,EAAG,OAAO,gBAAgB,kBAAkB,CAAC,cAAc,CAAC,gBAAgB,kBAAkB,CAC5G,SAAS,CACV,EAAE;AAEH,IAAA,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,OAAO;AAChC;AAeA;;;;;;;;;;;;;;;;;;AAkBG;AACG,SAAU,YAAY,CAAC,OAA4B,EAAA;IACvD,MAAM,EACJ,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EACpC,OAAO,EACP,gBAAgB,GAAG,QAAQ,EAC3B,qBAAqB,GAAG,sBAAsB,EAC9C,QAAQ,GACT,GAAG,OAAO;IAEX,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,gBAAgB,CAAC;AAC5D,IAAA,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE;IAC3B,IAAI,MAAM,EAAE;QACV,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,gBAAgB,EAAE,MAAM,CAAC;IACvD;;IAGA,gBAAgB,CAAC,qBAAqB,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;AAE9D,IAAA,YAAY,EAAE;AACd,IAAA,QAAQ,KAAA,IAAA,IAAR,QAAQ,KAAA,MAAA,GAAA,MAAA,GAAR,QAAQ,EAAI;AAEZ,IAAA,IAAI,CAAC,UAAU,EAAE,EAAE;QACjB,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAA,EAAG,OAAO,CAAA,oBAAA,EAAuB,WAAW,CAAA,EAAG,MAAM,GAAG,UAAU,GAAG,MAAM,GAAG,EAAE,CAAA,CAAE;IAC3G;AACF;AAEA;AACA;AACA;AACA;AACO,MAAM,qBAAqB,GAAG;AAC9B,MAAM,sBAAsB,GAAG;AAC/B,MAAM,iCAAiC,GAAG;AAUjD,IAAI,MAAM,GAAkB,IAAI;AAChC;;;AAGG;SACa,QAAQ,GAAA;;AACtB,IAAA,IAAI,MAAM;AAAE,QAAA,OAAO,MAAM;AACzB,IAAA,IAAI;QACF,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,YAAY,CAAC;AACrD,QAAA,IAAI,QAAQ;AAAE,YAAA,QAAQ,MAAM,GAAG,QAAQ;QACvC,MAAM,EAAE,GAAG,CAAA,EAAA,GAAA,CAAA,EAAA,GAAA,MAAM,aAAN,MAAM,KAAA,KAAA,CAAA,GAAA,KAAA,CAAA,GAAN,MAAM,CAAE,UAAU,MAAA,IAAA,IAAA,EAAA,KAAA,KAAA,CAAA,GAAA,KAAA,CAAA,GAAA,EAAA,CAAA,IAAA,CAAA,MAAA,CAAI,mCAAI,CAAA,EAAG,IAAI,CAAC,GAAG,EAAE,CAAA,CAAA,EAAI,IAAI,CAAC,MAAM,EAAE,CAAA,CAAE;AACrE,QAAA,cAAc,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;AACxC,QAAA,QAAQ,MAAM,GAAG,EAAE;IACrB;AAAE,IAAA,OAAA,EAAA,EAAM;AACN,QAAA,QAAQ,MAAM,GAAG,CAAA,EAAG,IAAI,CAAC,GAAG,EAAE,CAAA,CAAA,EAAI,IAAI,CAAC,MAAM,EAAE,CAAA,CAAE;IACnD;AACF;AAEA;AACM,SAAU,oBAAoB,CAClC,KAAA,GAAgB,iCAAiC,EAAA;AAEjD,IAAA,IAAI;QACF,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,sBAAsB,CAAC;AACxD,QAAA,IAAI,CAAC,GAAG;AAAE,YAAA,OAAO,IAAI;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAqB;QAChD,IAAI,QAAO,IAAI,KAAA,IAAA,IAAJ,IAAI,KAAA,KAAA,CAAA,GAAA,KAAA,CAAA,GAAJ,IAAI,CAAE,EAAE,CAAA,KAAK,QAAQ;AAAE,YAAA,OAAO,IAAI;QAC7C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,GAAG,KAAK;AAAE,YAAA,OAAO,IAAI;AAC7C,QAAA,OAAO,IAAI;IACb;AAAE,IAAA,OAAA,EAAA,EAAM;AACN,QAAA,OAAO,IAAI;IACb;AACF;AAEA;AACM,SAAU,qBAAqB,CAAC,MAAc,EAAA;AAClD,IAAA,MAAM,IAAI,GAAqB;QAC7B,MAAM;QACN,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA,CAAA,EAAI,QAAQ,EAAE,CAAA,CAAE;AACpC,QAAA,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;QACd,QAAQ,EAAE,QAAQ,EAAE;KACrB;AACD,IAAA,IAAI;AACF,QAAA,YAAY,CAAC,OAAO,CAAC,sBAAsB,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACpE;IAAE,OAAA,EAAA,EAAM,EAAC;AACT,IAAA,OAAO,IAAI;AACb;AAEA;SACgB,uBAAuB,GAAA;AACrC,IAAA,MAAM,IAAI,GAAG,oBAAoB,EAAE;AACnC,IAAA,IAAI,CAAC,IAAI;QAAE;AACX,IAAA,IAAI;QACF,YAAY,CAAC,OAAO,CAClB,sBAAsB,EACtB,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAC5C;IACH;IAAE,OAAA,EAAA,EAAM,EAAC;AACX;SAEgB,qBAAqB,GAAA;AACnC,IAAA,IAAI;AACF,QAAA,YAAY,CAAC,UAAU,CAAC,sBAAsB,CAAC;IACjD;IAAE,OAAA,EAAA,EAAM,EAAC;AACX;AAEA;AACM,SAAU,wBAAwB,CAAC,KAAc,EAAA;AACrD,IAAA,OAAO,oBAAoB,CAAC,KAAK,CAAC,KAAK,IAAI;AAC7C;AA2BA;;;;;;;;;AASG;AACI,eAAe,kBAAkB,CACtC,MAAc,EACd,OAAkC,EAAA;;AAElC,IAAA,MAAM,EACJ,OAAO,EACP,sBAAsB,GAAG,aAAa,EACtC,gBAAgB,GAAG,eAAe,EAClC,gBAAgB,GAAG,QAAQ,EAC3B,qBAAqB,GAAG,sBAAsB,EAC9C,WAAW,GAAG,EAAE,EAChB,YAAY,GAAG,KAAK,EACpB,WAAW,EACX,SAAS,GAAG,IAAI,EAChB,wBAAwB,GACzB,GAAG,OAAO;IACX,MAAM,WAAW,GAAG,CAAA,EAAA,GAAA,WAAW,CAAC,MAAM,MAAA,IAAA,IAAA,EAAA,KAAA,MAAA,GAAA,EAAA,GAAI,QAAQ;IAClD,MAAM,eAAe,GAAG,CAAA,EAAA,GAAA,WAAW,CAAC,UAAU,MAAA,IAAA,IAAA,EAAA,KAAA,MAAA,GAAA,EAAA,GAAI,aAAa;;IAG/D,IAAI,SAAS,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QAAE;;AAElE,IAAA,IAAI,MAAM,KAAK,YAAY,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAAE;IAEvD,IAAI,SAAS,EAAE;AACb,QAAA,gBAAgB,CAAC,qBAAqB,EAAE,MAAM,CAAC;QAC/C,qBAAqB,CAAC,MAAM,CAAC;AAC7B,QAAA,IAAI,OAAO,gBAAgB,KAAK,WAAW,EAAE;AAC3C,YAAA,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,qBAAqB,CAAC;YAC3D,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,SAAS,CAAC;YACpD,OAAO,CAAC,WAAW,CAAC;AAClB,gBAAA,IAAI,EAAE,kBAAkB;gBACxB,MAAM;gBACN,QAAQ,EAAE,CAAA,EAAA,GAAA,IAAI,KAAA,IAAA,IAAJ,IAAI,KAAA,MAAA,GAAA,MAAA,GAAJ,IAAI,CAAE,QAAQ,MAAA,IAAA,IAAA,EAAA,KAAA,MAAA,GAAA,EAAA,GAAI,QAAQ,EAAE;AACtC,gBAAA,KAAK,EAAE,IAAI,KAAA,IAAA,IAAJ,IAAI,KAAA,MAAA,GAAA,MAAA,GAAJ,IAAI,CAAE,KAAK;AACnB,aAAA,CAAC;YACF,OAAO,CAAC,KAAK,EAAE;QACjB;AACA,QAAA,wBAAwB,KAAA,IAAA,IAAxB,wBAAwB,KAAA,MAAA,GAAA,MAAA,GAAxB,wBAAwB,EAAI;IAC9B;AAEA,IAAA,MAAM,WAAW,GAAG,CAAA,EAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAA,EAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE;IAC1E,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,gBAAgB,CAAC;AACvD,IAAA,IAAI,SAAS;QAAE,YAAY,CAAC,KAAK,EAAE;AAEnC,IAAA,MAAM,MAAM,GAA2B;QACrC,CAAC,WAAW,GAAG,MAAM;AACrB,QAAA,CAAC,eAAe,GAAG,WAAW,KAAA,IAAA,IAAX,WAAW,KAAA,MAAA,GAAX,WAAW,GAAI,MAAM,CAAC,QAAQ,CAAC,MAAM;KACzD;AACD,IAAA,IAAI,QAAQ;AAAE,QAAA,MAAM,CAAC,KAAK,GAAG,QAAQ;AAErC,IAAA,YAAY,CAAC,OAAO,CAAC,gBAAgB,EAAE,MAAM,CAAC;AAC9C,IAAA,IAAI,YAAY;AAAE,QAAA,YAAY,CAAC,OAAO,CAAC,sBAAsB,EAAE,WAAW,CAAC;;;AAG3E,IAAA,IAAI,SAAS;QAAE,qBAAqB,CAAC,MAAM,CAAC;AAE5C,IAAA,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AACxD,IAAA,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAA,EAAG,OAAO,CAAA,gBAAA,EAAmB,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE;AACnF;;;;"}

package/dist/auth/index.js

@@ -363,8 +363,148 @@ function handleLogout(options) {
         window.location.href = `${authUrl}/logout?redirect-to=${redirectUrl}${tenant ? "&tenant=" + tenant : ""}`;
     }
 }
+// ── Tenant-switch coordination ─────────────────────────────────────────────
+// Cross-tab tenant switching: a TTL lock (shared via localStorage) plus a
+// BroadcastChannel signal let multiple tabs coordinate a switch and prevent the
+// "ping-pong" where a stale tab reverts the session to its own route's tenant.
+const TENANT_SWITCH_CHANNEL = "ibl-tenant-switch";
+const TENANT_SWITCH_LOCK_KEY = "ibl_tenant_switch_lock";
+const DEFAULT_TENANT_SWITCH_LOCK_TTL_MS = 8000;
+let _tabId = null;
+/**
+ * Stable per-tab id. Uses sessionStorage so it survives same-tab reloads while
+ * staying unique per tab/window.
+ */
+function getTabId() {
+    var _a, _b;
+    if (_tabId)
+        return _tabId;
+    try {
+        const existing = sessionStorage.getItem("ibl_tab_id");
+        if (existing)
+            return (_tabId = existing);
+        const id = (_b = (_a = crypto === null || crypto === void 0 ? void 0 : crypto.randomUUID) === null || _a === void 0 ? void 0 : _a.call(crypto)) !== null && _b !== void 0 ? _b : `${Date.now()}-${Math.random()}`;
+        sessionStorage.setItem("ibl_tab_id", id);
+        return (_tabId = id);
+    }
+    catch (_c) {
+        return (_tabId = `${Date.now()}-${Math.random()}`);
+    }
+}
+/** The active (non-expired) tenant-switch lock, or null. */
+function readTenantSwitchLock(ttlMs = DEFAULT_TENANT_SWITCH_LOCK_TTL_MS) {
+    try {
+        const raw = localStorage.getItem(TENANT_SWITCH_LOCK_KEY);
+        if (!raw)
+            return null;
+        const lock = JSON.parse(raw);
+        if (typeof (lock === null || lock === void 0 ? void 0 : lock.ts) !== "number")
+            return null;
+        if (Date.now() - lock.ts > ttlMs)
+            return null;
+        return lock;
+    }
+    catch (_a) {
+        return null;
+    }
+}
+/** Write a fresh lock for `tenant` (newest intent). Returns the lock written. */
+function writeTenantSwitchLock(tenant) {
+    const lock = {
+        tenant,
+        token: `${Date.now()}-${getTabId()}`,
+        ts: Date.now(),
+        senderId: getTabId(),
+    };
+    try {
+        localStorage.setItem(TENANT_SWITCH_LOCK_KEY, JSON.stringify(lock));
+    }
+    catch (_a) { }
+    return lock;
+}
+/** Extend an existing lock's window from "now" (no-op when no active lock). */
+function refreshTenantSwitchLock() {
+    const lock = readTenantSwitchLock();
+    if (!lock)
+        return;
+    try {
+        localStorage.setItem(TENANT_SWITCH_LOCK_KEY, JSON.stringify({ ...lock, ts: Date.now() }));
+    }
+    catch (_a) { }
+}
+function clearTenantSwitchLock() {
+    try {
+        localStorage.removeItem(TENANT_SWITCH_LOCK_KEY);
+    }
+    catch (_a) { }
+}
+/** True while a tenant switch is in flight — gate automatic reverts on this. */
+function isTenantSwitchInProgress(ttlMs) {
+    return readTenantSwitchLock(ttlMs) !== null;
+}
+/**
+ * Switch the active tenant. Coordinates across tabs (TTL lock + BroadcastChannel),
+ * clears storage, then redirects through the auth SPA's `/login/complete`.
+ *
+ * @example
+ * await handleTenantSwitch("acme", {
+ *   authUrl: config.authUrl(),
+ *   clearCurrentTenantCookie,
+ * });
+ */
+async function handleTenantSwitch(tenant, options) {
+    var _a, _b, _c;
+    const { authUrl, redirectPathStorageKey = "redirect-to", preserveTokenKey = "edx_jwt_token", tenantStorageKey = "tenant", tenantSwitchingCookie = "ibl_tenant_switching", queryParams = {}, saveRedirect = false, redirectUrl, broadcast = true, clearCurrentTenantCookie, } = options;
+    const tenantParam = (_a = queryParams.tenant) !== null && _a !== void 0 ? _a : "tenant";
+    const redirectToParam = (_b = queryParams.redirectTo) !== null && _b !== void 0 ? _b : "redirect-to";
+    // Guard: don't start a new user switch while one is already in progress.
+    if (broadcast && document.cookie.includes(tenantSwitchingCookie))
+        return;
+    // Guard: already on the target tenant.
+    if (tenant === localStorage.getItem(tenantStorageKey))
+        return;
+    if (broadcast) {
+        setCookieForAuth(tenantSwitchingCookie, "true");
+        writeTenantSwitchLock(tenant);
+        if (typeof BroadcastChannel !== "undefined") {
+            const channel = new BroadcastChannel(TENANT_SWITCH_CHANNEL);
+            const lock = readTenantSwitchLock(options.lockTtlMs);
+            channel.postMessage({
+                type: "TENANT_SWITCHING",
+                tenant,
+                senderId: (_c = lock === null || lock === void 0 ? void 0 : lock.senderId) !== null && _c !== void 0 ? _c : getTabId(),
+                token: lock === null || lock === void 0 ? void 0 : lock.token,
+            });
+            channel.close();
+        }
+        clearCurrentTenantCookie === null || clearCurrentTenantCookie === void 0 ? void 0 : clearCurrentTenantCookie();
+    }
+    const currentPath = `${window.location.pathname}${window.location.search}`;
+    const jwtToken = localStorage.getItem(preserveTokenKey);
+    if (broadcast)
+        localStorage.clear();
+    const params = {
+        [tenantParam]: tenant,
+        [redirectToParam]: redirectUrl !== null && redirectUrl !== void 0 ? redirectUrl : window.location.origin,
+    };
+    if (jwtToken)
+        params.token = jwtToken;
+    localStorage.setItem(tenantStorageKey, tenant);
+    if (saveRedirect)
+        localStorage.setItem(redirectPathStorageKey, currentPath);
+    // Re-persist: localStorage.clear() above wiped the pre-broadcast lock; this
+    // copy survives the redirect so stale tabs honor the switch window.
+    if (broadcast)
+        writeTenantSwitchLock(tenant);
+    await new Promise((resolve) => setTimeout(resolve, 100));
+    window.location.href = `${authUrl}/login/complete?${new URLSearchParams(params)}`;
+}
 
+exports.DEFAULT_TENANT_SWITCH_LOCK_TTL_MS = DEFAULT_TENANT_SWITCH_LOCK_TTL_MS;
+exports.TENANT_SWITCH_CHANNEL = TENANT_SWITCH_CHANNEL;
+exports.TENANT_SWITCH_LOCK_KEY = TENANT_SWITCH_LOCK_KEY;
 exports.clearCookies = clearCookies;
+exports.clearTenantSwitchLock = clearTenantSwitchLock;
 exports.deleteCookie = deleteCookie;
 exports.deleteCookieOnAllDomains = deleteCookieOnAllDomains;
 exports.getAuthSpaJoinUrl = getAuthSpaJoinUrl;
@@ -372,11 +512,17 @@ exports.getCookieValue = getCookieValue;
 exports.getDomainParts = getDomainParts;
 exports.getParentDomain = getParentDomain;
 exports.getPlatformKey = getPlatformKey;
+exports.getTabId = getTabId;
 exports.handleLogout = handleLogout;
+exports.handleTenantSwitch = handleTenantSwitch;
 exports.isInIframe = isInIframe;
 exports.isLoggedIn = isLoggedIn;
+exports.isTenantSwitchInProgress = isTenantSwitchInProgress;
+exports.readTenantSwitchLock = readTenantSwitchLock;
 exports.redirectToAuthSpa = redirectToAuthSpa;
 exports.redirectToAuthSpaJoinTenant = redirectToAuthSpaJoinTenant;
+exports.refreshTenantSwitchLock = refreshTenantSwitchLock;
 exports.sendMessageToParentWebsite = sendMessageToParentWebsite;
 exports.setCookieForAuth = setCookieForAuth;
+exports.writeTenantSwitchLock = writeTenantSwitchLock;
 //# sourceMappingURL=index.js.map