@lukoweb/apitogo 0.2.31 → 0.2.34

package/src/lib/authentication/providers/dev-portal.tsx

@@ -1,448 +1,476 @@
-import type { DevPortalAuthenticationConfig } from "../../../config/config.js";
-import type { ZudokuContext } from "../../core/ZudokuContext.js";
-import type {
-  AuthActionContext,
-  AuthActionOptions,
-  AuthenticationPlugin,
-  AuthenticationProviderInitializer,
-} from "../authentication.js";
-import { CoreAuthenticationPlugin } from "../AuthenticationPlugin.js";
-import {
-  type UserProfile,
-  useAuthState,
-  waitForAuthStateHydration,
-} from "../state.js";
-import {
-  DevPortalForgotPasswordPage,
-  DevPortalLoginPage,
-  DevPortalRegisterPage,
-  DevPortalResetPasswordPage,
-  DevPortalVerifyEmailPage,
-} from "./dev-portal-auth-pages.js";
-import type {
-  DevPortalAuthMode,
-  UserMeResponse,
-} from "./dev-portal-constants.js";
-import {
-  clearDemoSession,
-  readDemoSession,
-  resolveDemoMode,
-  activateDemoSession,
-} from "./dev-portal-demo.js";
-import {
-  buildDevPortalLogoutUrl,
-  isNativeAuthEnabled,
-  isPlaceholderDevPortalApiUrl,
-  mapUserMeToProfile,
-  probeDevPortalBackend,
-  resolveDevPortalApiBaseUrl,
-  toAbsoluteReturnUrl,
-} from "./dev-portal-utils.js";
-
-export type DevPortalProviderData = {
-  type: "dev-portal";
-  apiBaseUrl: string;
-  authMode: DevPortalAuthMode;
-  isDemoSession?: boolean;
-  demoMode?: boolean;
-};
-
-declare module "../state.js" {
-  interface ProviderDataRegistry {
-    "dev-portal": DevPortalProviderData;
-  }
-}
-
-export class DevPortalAuthenticationProvider
-  extends CoreAuthenticationPlugin
-  implements AuthenticationPlugin
-{
-  private readonly apiBaseUrl: string | undefined;
-  private readonly demoMode: boolean;
-  private readonly redirectToAfterSignIn: string | undefined;
-  private readonly redirectToAfterSignUp: string | undefined;
-  private readonly redirectToAfterSignOut: string;
-  private backendAvailable = false;
-  private refreshGeneration = 0;
-  private refreshInFlight: Promise<boolean> | null = null;
-
-  private authConfigNativeEnabled: boolean | null = null;
-
-  constructor({
-    apiBaseUrl,
-    demoMode,
-    redirectToAfterSignIn,
-    redirectToAfterSignUp,
-    redirectToAfterSignOut = "/",
-  }: DevPortalAuthenticationConfig) {
-    super();
-    this.apiBaseUrl = resolveDevPortalApiBaseUrl({ apiBaseUrl });
-    this.demoMode = resolveDemoMode({ demoMode });
-    this.redirectToAfterSignIn = redirectToAfterSignIn;
-    this.redirectToAfterSignUp = redirectToAfterSignUp;
-    this.redirectToAfterSignOut = redirectToAfterSignOut;
-  }
-
-  getRoutes() {
-    const defaultReturnUrl =
-      this.redirectToAfterSignIn ?? this.redirectToAfterSignUp ?? "/";
-    const pageProps = {
-      apiBaseUrl: this.apiBaseUrl,
-      demoMode: this.demoMode,
-    };
-    return [
-      ...super.getRoutes(),
-      {
-        path: "/login",
-        element: (
-          <DevPortalLoginPage
-            {...pageProps}
-            defaultReturnUrl={defaultReturnUrl}
-          />
-        ),
-      },
-      {
-        path: "/register",
-        element: (
-          <DevPortalRegisterPage
-            apiBaseUrl={this.apiBaseUrl}
-            defaultReturnUrl={
-              this.redirectToAfterSignUp ?? this.redirectToAfterSignIn ?? "/"
-            }
-          />
-        ),
-      },
-      {
-        path: "/verify-email",
-        element: <DevPortalVerifyEmailPage {...pageProps} />,
-      },
-      {
-        path: "/forgot-password",
-        element: <DevPortalForgotPasswordPage {...pageProps} />,
-      },
-      {
-        path: "/reset-password",
-        element: <DevPortalResetPasswordPage {...pageProps} />,
-      },
-    ];
-  }
-
-  async initialize(_context: ZudokuContext): Promise<void> {
-    // Node SSR cannot reach local HTTPS backends with self-signed certs.
-    if (typeof window === "undefined") {
-      return;
-    }
-
-    await waitForAuthStateHydration();
-    await this.syncBackendAvailability();
-    if (this.backendAvailable && this.apiBaseUrl) {
-      try {
-        const { fetchDevPortalAuthConfig } =
-          await import("./dev-portal-utils.js");
-        const config = await fetchDevPortalAuthConfig(this.apiBaseUrl);
-        this.authConfigNativeEnabled = isNativeAuthEnabled(config);
-      } catch {
-        this.authConfigNativeEnabled = null;
-      }
-    }
-    if (!this.backendAvailable) {
-      if (this.demoMode && readDemoSession()) {
-        this.setDemoAuthenticatedState();
-        return;
-      }
-
-      this.setPreviewState();
-      return;
-    }
-
-    await this.refreshUserProfile();
-  }
-
-  onPageLoad = async () => {
-    if (typeof window === "undefined") {
-      return;
-    }
-
-    await waitForAuthStateHydration();
-    await this.syncBackendAvailability();
-    if (!this.backendAvailable) {
-      if (this.demoMode && readDemoSession()) {
-        this.setDemoAuthenticatedState();
-        return;
-      }
-
-      this.setPreviewState();
-      return;
-    }
-
-    await this.refreshUserProfile();
-  };
-
-  private async syncBackendAvailability(): Promise<void> {
-    if (!this.apiBaseUrl || isPlaceholderDevPortalApiUrl(this.apiBaseUrl)) {
-      this.backendAvailable = false;
-      return;
-    }
-
-    this.backendAvailable = await probeDevPortalBackend(this.apiBaseUrl);
-  }
-
-  private setPreviewState(): void {
-    useAuthState.setState({
-      isAuthenticated: false,
-      isPending: false,
-      sessionChecked: true,
-      profile: null,
-      providerData: this.apiBaseUrl
-        ? {
-            type: "dev-portal",
-            apiBaseUrl: this.apiBaseUrl,
-            authMode: "preview",
-            demoMode: this.demoMode,
-          }
-        : this.demoMode
-          ? {
-              type: "dev-portal",
-              apiBaseUrl: "",
-              authMode: "preview",
-              demoMode: true,
-            }
-          : null,
-      isBackendAvailable: false,
-      authMode: "preview",
-    });
-  }
-
-  private setLiveUnauthenticatedState(): void {
-    if (!this.apiBaseUrl) {
-      this.setPreviewState();
-      return;
-    }
-
-    useAuthState.setState({
-      isAuthenticated: false,
-      isPending: false,
-      sessionChecked: true,
-      profile: null,
-      providerData: {
-        type: "dev-portal",
-        apiBaseUrl: this.apiBaseUrl,
-        authMode: "live",
-        demoMode: this.demoMode,
-      },
-      isBackendAvailable: true,
-      authMode: "live",
-    });
-  }
-
-  private setDemoAuthenticatedState(): void {
-    activateDemoSession(this.apiBaseUrl);
-  }
-
-  private ensureConfiguredBackend(): string {
-    if (!this.apiBaseUrl || isPlaceholderDevPortalApiUrl(this.apiBaseUrl)) {
-      if (this.demoMode) {
-        return "";
-      }
-
-      throw new Error("Dev portal authentication is not available in preview.");
-    }
-
-    return this.apiBaseUrl;
-  }
-
-  async refreshUserProfile(): Promise<boolean> {
-    if (this.refreshInFlight) {
-      return this.refreshInFlight;
-    }
-
-    this.refreshInFlight = this.refreshUserProfileInternal().finally(() => {
-      this.refreshInFlight = null;
-    });
-
-    return this.refreshInFlight;
-  }
-
-  private async refreshUserProfileInternal(): Promise<boolean> {
-    if (this.demoMode && readDemoSession() && !this.backendAvailable) {
-      this.setDemoAuthenticatedState();
-      return true;
-    }
-
-    if (!this.apiBaseUrl) {
-      this.setPreviewState();
-      return false;
-    }
-
-    if (isPlaceholderDevPortalApiUrl(this.apiBaseUrl)) {
-      if (this.demoMode && readDemoSession()) {
-        this.setDemoAuthenticatedState();
-        return true;
-      }
-
-      this.setPreviewState();
-      return false;
-    }
-
-    await waitForAuthStateHydration();
-    await this.syncBackendAvailability();
-    if (!this.backendAvailable) {
-      if (this.demoMode && readDemoSession()) {
-        this.setDemoAuthenticatedState();
-        return true;
-      }
-
-      this.setPreviewState();
-      return false;
-    }
-
-    const generation = ++this.refreshGeneration;
-    useAuthState.setState({ isPending: true });
-
-    try {
-      const response = await fetch(`${this.apiBaseUrl}/api/v1/auth/me`, {
-        method: "GET",
-        headers: { Accept: "application/json" },
-        credentials: "include",
-        redirect: "manual",
-      });
-
-      if (generation !== this.refreshGeneration) {
-        return useAuthState.getState().isAuthenticated;
-      }
-
-      // Backends may still respond with 302 to the IdP; treat as unauthenticated.
-      if (
-        response.type === "opaqueredirect" ||
-        response.status === 302 ||
-        response.status === 401
-      ) {
-        this.setLiveUnauthenticatedState();
-        return false;
-      }
-
-      if (!response.ok) {
-        this.setLiveUnauthenticatedState();
-        return false;
-      }
-
-      const me = (await response.json()) as UserMeResponse;
-      if (generation !== this.refreshGeneration) {
-        return useAuthState.getState().isAuthenticated;
-      }
-
-      const profile: UserProfile = mapUserMeToProfile(me);
-
-      useAuthState.setState({
-        isAuthenticated: true,
-        isPending: false,
-        sessionChecked: true,
-        profile,
-        providerData: {
-          type: "dev-portal",
-          apiBaseUrl: this.apiBaseUrl,
-          authMode: "live",
-          demoMode: this.demoMode,
-        },
-        isBackendAvailable: true,
-        authMode: "live",
-      });
-      return true;
-    } catch {
-      if (generation !== this.refreshGeneration) {
-        return useAuthState.getState().isAuthenticated;
-      }
-
-      if (this.backendAvailable) {
-        this.setLiveUnauthenticatedState();
-        return false;
-      }
-
-      this.setPreviewState();
-      return false;
-    }
-  }
-
-  async signIn(
-    _: AuthActionContext,
-    { redirectTo }: AuthActionOptions = {},
-  ): Promise<void> {
-    if (!this.backendAvailable && this.demoMode) {
-      const target =
-        redirectTo ?? this.redirectToAfterSignIn ?? window.location.href;
-      const url = new URL("/login", window.location.origin);
-      url.searchParams.set("redirect", toAbsoluteReturnUrl(target));
-      window.location.assign(url.toString());
-      return;
-    }
-
-    this.ensureConfiguredBackend();
-    const target =
-      redirectTo ?? this.redirectToAfterSignIn ?? window.location.href;
-    const url = new URL("/login", window.location.origin);
-    url.searchParams.set("redirect", toAbsoluteReturnUrl(target));
-    window.location.assign(url.toString());
-  }
-
-  async signUp(
-    _: AuthActionContext,
-    { redirectTo }: AuthActionOptions = {},
-  ): Promise<void> {
-    if (!this.backendAvailable && this.demoMode) {
-      const target =
-        redirectTo ?? this.redirectToAfterSignUp ?? window.location.href;
-      const url = new URL("/register", window.location.origin);
-      url.searchParams.set("redirect", toAbsoluteReturnUrl(target));
-      window.location.assign(url.toString());
-      return;
-    }
-
-    this.ensureConfiguredBackend();
-    const target =
-      redirectTo ?? this.redirectToAfterSignUp ?? window.location.href;
-    const url = new URL("/register", window.location.origin);
-    url.searchParams.set("redirect", toAbsoluteReturnUrl(target));
-    window.location.assign(url.toString());
-  }
-
-  async signOut(_: AuthActionContext): Promise<void> {
-    const providerData = useAuthState.getState().providerData as
-      | DevPortalProviderData
-      | null
-      | undefined;
-
-    if (providerData?.isDemoSession || (this.demoMode && readDemoSession())) {
-      clearDemoSession();
-      this.setPreviewState();
-      return;
-    }
-
-    const apiBaseUrl = this.ensureConfiguredBackend();
-    window.location.assign(
-      buildDevPortalLogoutUrl(apiBaseUrl, this.redirectToAfterSignOut),
-    );
-  }
-
-  hasDistinctSignUpFlow(): boolean {
-    if (this.demoMode && !this.backendAvailable) {
-      return true;
-    }
-
-    return this.authConfigNativeEnabled !== false;
-  }
-
-  async signRequest(request: Request): Promise<Request> {
-    return request;
-  }
-
-  /** Called from the login page after successful demo credential check. */
-  completeDemoLogin(): void {
-    activateDemoSession(this.apiBaseUrl);
-  }
-}
-
-const devPortalAuth: AuthenticationProviderInitializer<
-  DevPortalAuthenticationConfig
-> = (options) => new DevPortalAuthenticationProvider(options);
-
-export default devPortalAuth;
+import type { DevPortalAuthenticationConfig } from "../../../config/config.js";
+import type { ZudokuContext } from "../../core/ZudokuContext.js";
+import type {
+  AuthActionContext,
+  AuthActionOptions,
+  AuthenticationPlugin,
+  AuthenticationProviderInitializer,
+} from "../authentication.js";
+import { CoreAuthenticationPlugin } from "../AuthenticationPlugin.js";
+import {
+  type UserProfile,
+  useAuthState,
+  waitForAuthStateHydration,
+} from "../state.js";
+import {
+  DevPortalForgotPasswordPage,
+  DevPortalLoginPage,
+  DevPortalRegisterPage,
+  DevPortalResetPasswordPage,
+  DevPortalVerifyEmailPage,
+} from "./dev-portal-auth-pages.js";
+import type {
+  DevPortalAuthMode,
+  UserMeResponse,
+} from "./dev-portal-constants.js";
+import {
+  clearDemoSession,
+  readDemoSession,
+  resolveDemoMode,
+  activateDemoSession,
+} from "./dev-portal-demo.js";
+import {
+  buildDevPortalLogoutUrl,
+  isNativeAuthEnabled,
+  isPlaceholderDevPortalApiUrl,
+  mapUserMeToProfile,
+  probeDevPortalBackend,
+  resolveDevPortalApiBaseUrl,
+  toAbsoluteReturnUrl,
+} from "./dev-portal-utils.js";
+
+export type DevPortalProviderData = {
+  type: "dev-portal";
+  apiBaseUrl: string;
+  authMode: DevPortalAuthMode;
+  isDemoSession?: boolean;
+  demoMode?: boolean;
+};
+
+declare module "../state.js" {
+  interface ProviderDataRegistry {
+    "dev-portal": DevPortalProviderData;
+  }
+}
+
+export class DevPortalAuthenticationProvider
+  extends CoreAuthenticationPlugin
+  implements AuthenticationPlugin
+{
+  private readonly apiBaseUrl: string | undefined;
+  private readonly demoMode: boolean;
+  private readonly redirectToAfterSignIn: string | undefined;
+  private readonly redirectToAfterSignUp: string | undefined;
+  private readonly redirectToAfterSignOut: string;
+  private backendAvailable = false;
+  private refreshGeneration = 0;
+  private refreshInFlight: Promise<boolean> | null = null;
+
+  private authConfigNativeEnabled: boolean | null = null;
+
+  constructor({
+    apiBaseUrl,
+    demoMode,
+    redirectToAfterSignIn,
+    redirectToAfterSignUp,
+    redirectToAfterSignOut = "/",
+  }: DevPortalAuthenticationConfig) {
+    super();
+    this.apiBaseUrl = resolveDevPortalApiBaseUrl({ apiBaseUrl });
+    this.demoMode = resolveDemoMode({ demoMode });
+    this.redirectToAfterSignIn = redirectToAfterSignIn;
+    this.redirectToAfterSignUp = redirectToAfterSignUp;
+    this.redirectToAfterSignOut = redirectToAfterSignOut;
+  }
+
+  getRoutes() {
+    const defaultReturnUrl =
+      this.redirectToAfterSignIn ?? this.redirectToAfterSignUp ?? "/";
+    const pageProps = {
+      apiBaseUrl: this.apiBaseUrl,
+      demoMode: this.demoMode,
+    };
+    return [
+      ...super.getRoutes(),
+      {
+        path: "/login",
+        element: (
+          <DevPortalLoginPage
+            {...pageProps}
+            defaultReturnUrl={defaultReturnUrl}
+          />
+        ),
+      },
+      {
+        path: "/register",
+        element: (
+          <DevPortalRegisterPage
+            apiBaseUrl={this.apiBaseUrl}
+            defaultReturnUrl={
+              this.redirectToAfterSignUp ?? this.redirectToAfterSignIn ?? "/"
+            }
+          />
+        ),
+      },
+      {
+        path: "/verify-email",
+        element: <DevPortalVerifyEmailPage {...pageProps} />,
+      },
+      {
+        path: "/forgot-password",
+        element: <DevPortalForgotPasswordPage {...pageProps} />,
+      },
+      {
+        path: "/reset-password",
+        element: <DevPortalResetPasswordPage {...pageProps} />,
+      },
+    ];
+  }
+
+  async initialize(_context: ZudokuContext): Promise<void> {
+    // Node SSR cannot reach local HTTPS backends with self-signed certs.
+    if (typeof window === "undefined") {
+      return;
+    }
+
+    await waitForAuthStateHydration();
+    await this.syncBackendAvailability();
+    if (this.backendAvailable && this.apiBaseUrl) {
+      try {
+        const { fetchDevPortalAuthConfig } =
+          await import("./dev-portal-utils.js");
+        const config = await fetchDevPortalAuthConfig(this.apiBaseUrl);
+        this.authConfigNativeEnabled = isNativeAuthEnabled(config);
+      } catch {
+        this.authConfigNativeEnabled = null;
+      }
+    }
+    if (!this.backendAvailable) {
+      if (this.demoMode && readDemoSession()) {
+        this.setDemoAuthenticatedState();
+        return;
+      }
+
+      this.setPreviewState();
+      return;
+    }
+
+    await this.refreshUserProfile();
+  }
+
+  onPageLoad = async () => {
+    if (typeof window === "undefined") {
+      return;
+    }
+
+    await waitForAuthStateHydration();
+    await this.syncBackendAvailability();
+    if (!this.backendAvailable) {
+      if (this.demoMode && readDemoSession()) {
+        this.setDemoAuthenticatedState();
+        return;
+      }
+
+      this.setPreviewState();
+      return;
+    }
+
+    await this.refreshUserProfile();
+  };
+
+  private async syncBackendAvailability(): Promise<void> {
+    if (!this.apiBaseUrl || isPlaceholderDevPortalApiUrl(this.apiBaseUrl)) {
+      this.backendAvailable = false;
+      return;
+    }
+
+    this.backendAvailable = await probeDevPortalBackend(this.apiBaseUrl);
+  }
+
+  private setPreviewState(): void {
+    useAuthState.setState({
+      isAuthenticated: false,
+      isPending: false,
+      sessionChecked: true,
+      profile: null,
+      providerData: this.apiBaseUrl
+        ? {
+            type: "dev-portal",
+            apiBaseUrl: this.apiBaseUrl,
+            authMode: "preview",
+            demoMode: this.demoMode,
+          }
+        : this.demoMode
+          ? {
+              type: "dev-portal",
+              apiBaseUrl: "",
+              authMode: "preview",
+              demoMode: true,
+            }
+          : null,
+      isBackendAvailable: false,
+      authMode: "preview",
+    });
+  }
+
+  private setLiveUnauthenticatedState(): void {
+    if (!this.apiBaseUrl) {
+      this.setPreviewState();
+      return;
+    }
+
+    useAuthState.setState({
+      isAuthenticated: false,
+      isPending: false,
+      sessionChecked: true,
+      profile: null,
+      providerData: {
+        type: "dev-portal",
+        apiBaseUrl: this.apiBaseUrl,
+        authMode: "live",
+        demoMode: this.demoMode,
+      },
+      isBackendAvailable: true,
+      authMode: "live",
+    });
+  }
+
+  private setDemoAuthenticatedState(): void {
+    activateDemoSession(this.apiBaseUrl);
+  }
+
+  private ensureConfiguredBackend(): string {
+    if (!this.apiBaseUrl || isPlaceholderDevPortalApiUrl(this.apiBaseUrl)) {
+      if (this.demoMode) {
+        return "";
+      }
+
+      throw new Error("Dev portal authentication is not available in preview.");
+    }
+
+    return this.apiBaseUrl;
+  }
+
+  async refreshUserProfile(): Promise<boolean> {
+    if (this.refreshInFlight) {
+      return this.refreshInFlight;
+    }
+
+    this.refreshInFlight = this.refreshUserProfileInternal().finally(() => {
+      this.refreshInFlight = null;
+    });
+
+    return this.refreshInFlight;
+  }
+
+  private async refreshUserProfileInternal(): Promise<boolean> {
+    if (this.demoMode && readDemoSession() && !this.backendAvailable) {
+      this.setDemoAuthenticatedState();
+      return true;
+    }
+
+    if (!this.apiBaseUrl) {
+      this.setPreviewState();
+      return false;
+    }
+
+    if (isPlaceholderDevPortalApiUrl(this.apiBaseUrl)) {
+      if (this.demoMode && readDemoSession()) {
+        this.setDemoAuthenticatedState();
+        return true;
+      }
+
+      this.setPreviewState();
+      return false;
+    }
+
+    await waitForAuthStateHydration();
+    await this.syncBackendAvailability();
+    if (!this.backendAvailable) {
+      if (this.demoMode && readDemoSession()) {
+        this.setDemoAuthenticatedState();
+        return true;
+      }
+
+      this.setPreviewState();
+      return false;
+    }
+
+    const generation = ++this.refreshGeneration;
+    useAuthState.setState({ isPending: true });
+
+    try {
+      // /auth/session answers 200 for everyone, so a visitor does not put a failed request in the console. A backend
+      // from before it existed answers 404: ask /auth/me there, which answers 401 for a visitor.
+      const requestInit: RequestInit = {
+        method: "GET",
+        headers: { Accept: "application/json" },
+        credentials: "include",
+        redirect: "manual",
+      };
+      let response = await fetch(
+        `${this.apiBaseUrl}/api/v1/auth/session`,
+        requestInit,
+      );
+      const hasSession = response.status !== 404;
+      if (!hasSession) {
+        response = await fetch(
+          `${this.apiBaseUrl}/api/v1/auth/me`,
+          requestInit,
+        );
+      }
+
+      if (generation !== this.refreshGeneration) {
+        return useAuthState.getState().isAuthenticated;
+      }
+
+      // Backends may still respond with 302 to the IdP; treat as unauthenticated.
+      if (
+        response.type === "opaqueredirect" ||
+        response.status === 302 ||
+        response.status === 401
+      ) {
+        this.setLiveUnauthenticatedState();
+        return false;
+      }
+
+      if (!response.ok) {
+        this.setLiveUnauthenticatedState();
+        return false;
+      }
+
+      let me: UserMeResponse;
+      if (hasSession) {
+        const session = (await response.json()) as {
+          authenticated?: boolean;
+          user?: UserMeResponse | null;
+        };
+        if (!session.authenticated || !session.user) {
+          if (generation === this.refreshGeneration) {
+            this.setLiveUnauthenticatedState();
+          }
+          return false;
+        }
+        me = session.user;
+      } else {
+        me = (await response.json()) as UserMeResponse;
+      }
+      if (generation !== this.refreshGeneration) {
+        return useAuthState.getState().isAuthenticated;
+      }
+
+      const profile: UserProfile = mapUserMeToProfile(me);
+
+      useAuthState.setState({
+        isAuthenticated: true,
+        isPending: false,
+        sessionChecked: true,
+        profile,
+        providerData: {
+          type: "dev-portal",
+          apiBaseUrl: this.apiBaseUrl,
+          authMode: "live",
+          demoMode: this.demoMode,
+        },
+        isBackendAvailable: true,
+        authMode: "live",
+      });
+      return true;
+    } catch {
+      if (generation !== this.refreshGeneration) {
+        return useAuthState.getState().isAuthenticated;
+      }
+
+      if (this.backendAvailable) {
+        this.setLiveUnauthenticatedState();
+        return false;
+      }
+
+      this.setPreviewState();
+      return false;
+    }
+  }
+
+  async signIn(
+    _: AuthActionContext,
+    { redirectTo }: AuthActionOptions = {},
+  ): Promise<void> {
+    if (!this.backendAvailable && this.demoMode) {
+      const target =
+        redirectTo ?? this.redirectToAfterSignIn ?? window.location.href;
+      const url = new URL("/login", window.location.origin);
+      url.searchParams.set("redirect", toAbsoluteReturnUrl(target));
+      window.location.assign(url.toString());
+      return;
+    }
+
+    this.ensureConfiguredBackend();
+    const target =
+      redirectTo ?? this.redirectToAfterSignIn ?? window.location.href;
+    const url = new URL("/login", window.location.origin);
+    url.searchParams.set("redirect", toAbsoluteReturnUrl(target));
+    window.location.assign(url.toString());
+  }
+
+  async signUp(
+    _: AuthActionContext,
+    { redirectTo }: AuthActionOptions = {},
+  ): Promise<void> {
+    if (!this.backendAvailable && this.demoMode) {
+      const target =
+        redirectTo ?? this.redirectToAfterSignUp ?? window.location.href;
+      const url = new URL("/register", window.location.origin);
+      url.searchParams.set("redirect", toAbsoluteReturnUrl(target));
+      window.location.assign(url.toString());
+      return;
+    }
+
+    this.ensureConfiguredBackend();
+    const target =
+      redirectTo ?? this.redirectToAfterSignUp ?? window.location.href;
+    const url = new URL("/register", window.location.origin);
+    url.searchParams.set("redirect", toAbsoluteReturnUrl(target));
+    window.location.assign(url.toString());
+  }
+
+  async signOut(_: AuthActionContext): Promise<void> {
+    const providerData = useAuthState.getState().providerData as
+      | DevPortalProviderData
+      | null
+      | undefined;
+
+    if (providerData?.isDemoSession || (this.demoMode && readDemoSession())) {
+      clearDemoSession();
+      this.setPreviewState();
+      return;
+    }
+
+    const apiBaseUrl = this.ensureConfiguredBackend();
+    window.location.assign(
+      buildDevPortalLogoutUrl(apiBaseUrl, this.redirectToAfterSignOut),
+    );
+  }
+
+  hasDistinctSignUpFlow(): boolean {
+    if (this.demoMode && !this.backendAvailable) {
+      return true;
+    }
+
+    return this.authConfigNativeEnabled !== false;
+  }
+
+  async signRequest(request: Request): Promise<Request> {
+    return request;
+  }
+
+  /** Called from the login page after successful demo credential check. */
+  completeDemoLogin(): void {
+    activateDemoSession(this.apiBaseUrl);
+  }
+}
+
+const devPortalAuth: AuthenticationProviderInitializer<
+  DevPortalAuthenticationConfig
+> = (options) => new DevPortalAuthenticationProvider(options);
+
+export default devPortalAuth;