@luxfi/ui 7.4.0 → 7.4.2

package/dist/identity.cjs

@@ -0,0 +1,420 @@
+"use client";
+'use strict';
+
+var React2 = require('react');
+require('@hanzo/gui');
+var reactQuery = require('@tanstack/react-query');
+var jsxRuntime = require('react/jsx-runtime');
+
+function _interopNamespace(e) {
+  if (e && e.__esModule) return e;
+  var n = Object.create(null);
+  if (e) {
+    Object.keys(e).forEach(function (k) {
+      if (k !== 'default') {
+        var d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: function () { return e[k]; }
+        });
+      }
+    });
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+
+var React2__namespace = /*#__PURE__*/_interopNamespace(React2);
+
+// src/white-label.ts
+var LUX_BRAND = {
+  lux: "#7000FF",
+  zoo: "#6C5EFB",
+  hanzo: "#EA580C",
+  pars: "#1C3879"};
+var PARS_GOLD = "#C8A45C";
+var ORGS = {
+  lux: {
+    org: "lux",
+    name: "Lux",
+    domain: "lux.network",
+    iamDomain: "lux.id",
+    accent: LUX_BRAND.lux,
+    accentForeground: "#FFFFFF"
+  },
+  zoo: {
+    org: "zoo",
+    name: "Zoo",
+    domain: "zoo.ngo",
+    // Zoo's IdP is `id.zoo.network`, not a `zoo.id` apex — the one row in this
+    // table where the issuer is not `<org>.id`, and the one every hand-rolled
+    // per-app branding map got wrong.
+    iamDomain: "id.zoo.network",
+    accent: LUX_BRAND.zoo,
+    accentForeground: "#FFFFFF"
+  },
+  bootnode: {
+    org: "bootnode",
+    name: "Bootnode",
+    domain: "bootno.de",
+    iamDomain: "id.bootno.de",
+    accent: LUX_BRAND.lux,
+    accentForeground: "#FFFFFF"
+  },
+  hanzo: {
+    org: "hanzo",
+    name: "Hanzo",
+    domain: "hanzo.ai",
+    iamDomain: "hanzo.id",
+    accent: LUX_BRAND.hanzo,
+    accentForeground: "#FFFFFF"
+  },
+  pars: {
+    org: "pars",
+    name: "Pars",
+    domain: "pars.id",
+    iamDomain: "pars.id",
+    accent: LUX_BRAND.pars,
+    accentForeground: PARS_GOLD
+  }
+};
+var DOMAIN_ORG = [
+  ["lux.network", "lux"],
+  ["lux.cloud", "lux"],
+  ["lux.id", "lux"],
+  ["lux.finance", "lux"],
+  ["zoo.ngo", "zoo"],
+  ["zoo.network", "zoo"],
+  ["zoo.cloud", "zoo"],
+  ["zoo.id", "zoo"],
+  ["hanzo.ai", "hanzo"],
+  ["hanzo.cloud", "hanzo"],
+  ["hanzo.id", "hanzo"],
+  ["pars.id", "pars"],
+  ["parsdao.org", "pars"],
+  ["bootno.de", "bootnode", "platform"]
+];
+var DEFAULT_ORG = "lux";
+function normalizeHost(host) {
+  const noPort = host.trim().toLowerCase().split(":")[0] ?? "";
+  return noPort.replace(/\.$/, "");
+}
+function isUnder(host, domain) {
+  return host === domain || host.endsWith(`.${domain}`);
+}
+function matchDomain(host) {
+  let best;
+  for (const entry of DOMAIN_ORG) {
+    if (isUnder(host, entry[0]) && (!best || entry[0].length > best[0].length)) {
+      best = entry;
+    }
+  }
+  return best;
+}
+function appSlug(host, domain, apexApp) {
+  const sub = host === domain ? "" : host.slice(0, -(domain.length + 1));
+  const leftmost = sub.split(".")[0] ?? "";
+  if (leftmost && leftmost !== "www") return leftmost;
+  if (apexApp) return apexApp;
+  const label = domain.split(".")[0] ?? "";
+  const tld = domain.split(".").slice(1).join(".");
+  return tld.split(".")[0] || label;
+}
+function isLocal(host) {
+  return host === "localhost" || host.endsWith(".localhost") || host === "127.0.0.1" || host === "0.0.0.0" || host === "[::1]" || host.endsWith(".local");
+}
+function resolveWhiteLabel(host) {
+  const h = normalizeHost(host ?? "");
+  const match = h ? matchDomain(h) : void 0;
+  const org = match ? match[1] : DEFAULT_ORG;
+  const identity = ORGS[org];
+  const app = match ? appSlug(h, match[0], match[2]) : h && isLocal(h) ? "local" : "app";
+  return {
+    ...identity,
+    host: h,
+    app,
+    theme: `dark_${org}`,
+    issuer: `https://${identity.iamDomain}`,
+    clientId: `${org}-${app}`
+  };
+}
+
+// src/iam.ts
+var IamError = class extends Error {
+  constructor(message, status, unauthenticated) {
+    super(message);
+    this.name = "IamError";
+    this.status = status;
+    this.unauthenticated = unauthenticated;
+  }
+};
+var SIGNED_OUT = /please sign in|authentication required|unauthorized/i;
+function isSignedOut(status, msg) {
+  return status === 401 || status === 403 || SIGNED_OUT.test(msg);
+}
+function iamBase(host) {
+  const wl = typeof host === "object" && host !== null ? host : resolveWhiteLabel(host);
+  return `${wl.issuer}/v1/iam`;
+}
+async function read(call, verb, params) {
+  const url = new URL(`${call.base}/${verb}`);
+  for (const [k, v] of Object.entries(params)) url.searchParams.set(k, String(v));
+  let res;
+  try {
+    res = await fetch(url.toString(), {
+      method: "GET",
+      // The bearer is the whole credential. IAM does not allow credentialed
+      // CORS, so sending cookies would only get the response blocked.
+      headers: call.token ? { Authorization: `Bearer ${call.token}` } : {},
+      signal: call.signal
+    });
+  } catch (e) {
+    throw new IamError(e instanceof Error ? e.message : "IAM unreachable", 0, false);
+  }
+  const body = await res.json().catch(() => ({}));
+  const msg = typeof body.msg === "string" ? body.msg : "";
+  if (!res.ok || body.status === "error") {
+    throw new IamError(msg || `IAM ${verb} failed (${res.status})`, res.status, isSignedOut(res.status, msg));
+  }
+  return body.data;
+}
+var IAM_PAGE_SIZE = 20;
+var iam = {
+  /** The signed-in principal, or null when there is no session. */
+  async account(call) {
+    try {
+      const data = await read(call, "get-account", {});
+      return data && data.name ? data : null;
+    } catch (e) {
+      if (e instanceof IamError && e.unauthenticated) return null;
+      throw e;
+    }
+  },
+  /**
+   * One page of the orgs the principal can see. IAM scopes the read to the
+   * caller's authority, so a normal member gets their own org and a super
+   * admin gets the tenant list — the page never has to decide.
+   */
+  async organizations(call, page = 0, query = "", pageSize = IAM_PAGE_SIZE) {
+    const params = {
+      owner: "admin",
+      // IAM orgs live under the reserved `admin` owner
+      p: page + 1,
+      // the backend page is 1-based
+      pageSize,
+      sortField: "name",
+      sortOrder: "ascending"
+    };
+    const q = query.trim();
+    if (q) {
+      params.field = "name";
+      params.value = q;
+    }
+    return await read(call, "get-organizations", params) ?? [];
+  },
+  /** One organization by name. */
+  async organization(call, name) {
+    return await read(call, "get-organization", { id: `admin/${name}` }) ?? null;
+  },
+  /** Members of an organization. */
+  async users(call, org) {
+    return await read(call, "get-users", { owner: org }) ?? [];
+  },
+  /** The organization's projects — IAM keys this read by `organization`. */
+  async projects(call, org) {
+    return await read(call, "get-organization-projects", { organization: org }) ?? [];
+  }
+};
+new reactQuery.QueryClient({
+  defaultOptions: { queries: { refetchOnWindowFocus: false, retry: 1, staleTime: 3e4 } }
+});
+var WhiteLabelContext = React2__namespace.default.createContext(resolveWhiteLabel(""));
+var useWhiteLabel = () => React2__namespace.default.useContext(WhiteLabelContext);
+var IAM_TOKEN_KEY = "hanzo_iam_access_token";
+function storedToken() {
+  if (typeof window === "undefined") return null;
+  for (const store of [window.sessionStorage, window.localStorage]) {
+    try {
+      const t = store.getItem(IAM_TOKEN_KEY);
+      if (t) return t;
+    } catch {
+    }
+  }
+  return null;
+}
+function clearStoredTokens() {
+  if (typeof window === "undefined") return;
+  for (const store of [window.sessionStorage, window.localStorage]) {
+    try {
+      for (const k of ["access_token", "refresh_token", "id_token", "expires_at"]) {
+        store.removeItem(`hanzo_iam_${k}`);
+      }
+    } catch {
+    }
+  }
+}
+var defaultAuth = {};
+var scopeKey = (host, kind) => `lux-ui:${kind}:${host}`;
+function readScope(host, kind) {
+  if (typeof window === "undefined") return null;
+  try {
+    return window.localStorage.getItem(scopeKey(host, kind));
+  } catch {
+    return null;
+  }
+}
+function writeScope(host, kind, value) {
+  if (typeof window === "undefined") return;
+  try {
+    window.localStorage.setItem(scopeKey(host, kind), value);
+  } catch {
+  }
+}
+var IdentityContext = React2__namespace.createContext(null);
+var IdentityProvider = ({
+  children,
+  auth = defaultAuth,
+  loginPath = "/login"
+}) => {
+  const whiteLabel = useWhiteLabel();
+  const base = React2__namespace.useMemo(() => iamBase(whiteLabel), [whiteLabel]);
+  const [status, setStatus] = React2__namespace.useState("loading");
+  const [account, setAccount] = React2__namespace.useState(null);
+  const [orgs, setOrgs] = React2__namespace.useState([]);
+  const [projects, setProjects] = React2__namespace.useState([]);
+  const [error, setError] = React2__namespace.useState(null);
+  const [orgName, setOrgName] = React2__namespace.useState(null);
+  const [projectName, setProjectName] = React2__namespace.useState(null);
+  const [epoch, setEpoch] = React2__namespace.useState(0);
+  React2__namespace.useEffect(() => {
+    const ac = new AbortController();
+    let live = true;
+    void (async () => {
+      const token = await (auth.token ?? storedToken)();
+      if (!live) return;
+      if (!token) {
+        setStatus("anonymous");
+        setAccount(null);
+        setOrgs([]);
+        return;
+      }
+      const call = { base, token, signal: ac.signal };
+      try {
+        const me = await iam.account(call);
+        if (!live) return;
+        if (!me) {
+          setStatus("anonymous");
+          setAccount(null);
+          setOrgs([]);
+          return;
+        }
+        setAccount(me);
+        const rows = await iam.organizations(call).catch((e) => {
+          if (e instanceof IamError && !e.unauthenticated) return [{ owner: "admin", name: me.owner }];
+          throw e;
+        });
+        if (!live) return;
+        setOrgs(rows);
+        setStatus("ready");
+        setError(null);
+      } catch (e) {
+        if (!live || ac.signal.aborted) return;
+        if (e instanceof IamError && e.unauthenticated) {
+          setStatus("anonymous");
+          setAccount(null);
+          setOrgs([]);
+          return;
+        }
+        setStatus("error");
+        setError(e instanceof Error ? e.message : "Could not reach IAM.");
+      }
+    })();
+    return () => {
+      live = false;
+      ac.abort();
+    };
+  }, [base, auth, epoch]);
+  const org = React2__namespace.useMemo(() => {
+    if (orgs.length === 0) return null;
+    const saved = orgName ?? readScope(whiteLabel.host, "org");
+    return orgs.find((o) => o.name === saved) ?? orgs.find((o) => o.name === account?.owner) ?? orgs[0];
+  }, [orgs, orgName, account, whiteLabel.host]);
+  React2__namespace.useEffect(() => {
+    if (!org) {
+      setProjects([]);
+      return;
+    }
+    const ac = new AbortController();
+    let live = true;
+    void (async () => {
+      const token = await (auth.token ?? storedToken)();
+      if (!live || !token) return;
+      const rows = await iam.projects({ base, token, signal: ac.signal }, org.name).catch(() => []);
+      if (live) setProjects(rows);
+    })();
+    return () => {
+      live = false;
+      ac.abort();
+    };
+  }, [base, auth, org, epoch]);
+  const project = React2__namespace.useMemo(() => {
+    if (projects.length === 0) return null;
+    const saved = projectName ?? readScope(whiteLabel.host, "project");
+    return projects.find((p) => p.name === saved) ?? projects.find((p) => p.isDefault) ?? projects[0];
+  }, [projects, projectName, whiteLabel.host]);
+  const value = React2__namespace.useMemo(() => ({
+    status,
+    account,
+    orgs,
+    org,
+    projects,
+    project,
+    error,
+    whiteLabel,
+    setOrg: (name) => {
+      writeScope(whiteLabel.host, "org", name);
+      setOrgName(name);
+      setProjectName(null);
+    },
+    setProject: (name) => {
+      writeScope(whiteLabel.host, "project", name);
+      setProjectName(name);
+    },
+    signIn: () => {
+      if (auth.signIn) return auth.signIn();
+      if (typeof window !== "undefined") window.location.assign(loginPath);
+    },
+    signOut: () => {
+      if (auth.signOut) return auth.signOut();
+      clearStoredTokens();
+      if (typeof window !== "undefined") window.location.assign(loginPath);
+    },
+    reload: () => setEpoch((n) => n + 1)
+  }), [status, account, orgs, org, projects, project, error, whiteLabel, auth, loginPath]);
+  return /* @__PURE__ */ jsxRuntime.jsx(IdentityContext.Provider, { value, children });
+};
+function useIdentity() {
+  const ctx = React2__namespace.useContext(IdentityContext);
+  const whiteLabel = useWhiteLabel();
+  const fallback = React2__namespace.useMemo(() => ({
+    status: "anonymous",
+    account: null,
+    orgs: [],
+    org: null,
+    projects: [],
+    project: null,
+    error: null,
+    whiteLabel,
+    setOrg: () => void 0,
+    setProject: () => void 0,
+    signIn: () => {
+      if (typeof window !== "undefined") window.location.assign("/login");
+    },
+    signOut: () => void 0,
+    reload: () => void 0
+  }), [whiteLabel]);
+  return ctx ?? fallback;
+}
+
+exports.IdentityProvider = IdentityProvider;
+exports.useIdentity = useIdentity;

package/dist/identity.d.cts

@@ -0,0 +1,64 @@
+import * as React from 'react';
+import { IamAccount, IamOrg, IamProject } from './iam.cjs';
+import { WhiteLabel } from './white-label.cjs';
+
+type IdentityStatus = 'loading' | 'anonymous' | 'ready' | 'error';
+/**
+ * How the chrome gets a bearer and moves the user in and out of a session.
+ *
+ * Credentials are `@hanzo/iam`'s job, not the design system's — so this is the
+ * seam, and a surface using the SDK supplies only the two verbs:
+ *
+ *   auth={{ signIn: () => void startLogin(), signOut: () => void logout() }}
+ *
+ * The bearer itself needs no wiring: the default reads the SDK's own token
+ * store, so there is exactly one token and one refresh timer per surface.
+ */
+interface IdentityAuth {
+    /** The IAM access token. Defaults to the `@hanzo/iam` SDK's token store. */
+    readonly token?: () => string | null | Promise<string | null>;
+    /** Start a sign-in. */
+    readonly signIn?: () => void;
+    /** End the session. */
+    readonly signOut?: () => void;
+}
+interface Identity {
+    readonly status: IdentityStatus;
+    /** The signed-in principal, or null. */
+    readonly account: IamAccount | null;
+    /** Organizations the principal can act in. */
+    readonly orgs: ReadonlyArray<IamOrg>;
+    /** The organization the surface is currently scoped to, or null. */
+    readonly org: IamOrg | null;
+    /** Projects in the current organization. */
+    readonly projects: ReadonlyArray<IamProject>;
+    /** The project the surface is currently scoped to, or null. */
+    readonly project: IamProject | null;
+    /** Why the reads failed, when status is 'error'. */
+    readonly error: string | null;
+    /** Host-resolved brand, theme, issuer and IAM client. */
+    readonly whiteLabel: WhiteLabel;
+    readonly setOrg: (name: string) => void;
+    readonly setProject: (name: string) => void;
+    readonly signIn: () => void;
+    readonly signOut: () => void;
+    readonly reload: () => void;
+}
+interface IdentityProviderProps {
+    readonly children: React.ReactNode;
+    /** Bearer + sign-in/out. Defaults to the `@hanzo/iam` token store. */
+    readonly auth?: IdentityAuth;
+    /** Where sign-in goes when `auth.signIn` is not supplied. */
+    readonly loginPath?: string;
+}
+declare const IdentityProvider: ({ children, auth, loginPath, }: IdentityProviderProps) => React.ReactElement;
+/**
+ * The current identity.
+ *
+ * Outside an `<IdentityProvider>` this reports `anonymous` rather than
+ * throwing: chrome that renders before a surface has wired identity should
+ * offer sign-in, not crash the page.
+ */
+declare function useIdentity(): Identity;
+
+export { type Identity, type IdentityAuth, IdentityProvider, type IdentityProviderProps, type IdentityStatus, useIdentity };

package/dist/identity.d.ts

@@ -0,0 +1,64 @@
+import * as React from 'react';
+import { IamAccount, IamOrg, IamProject } from './iam.js';
+import { WhiteLabel } from './white-label.js';
+
+type IdentityStatus = 'loading' | 'anonymous' | 'ready' | 'error';
+/**
+ * How the chrome gets a bearer and moves the user in and out of a session.
+ *
+ * Credentials are `@hanzo/iam`'s job, not the design system's — so this is the
+ * seam, and a surface using the SDK supplies only the two verbs:
+ *
+ *   auth={{ signIn: () => void startLogin(), signOut: () => void logout() }}
+ *
+ * The bearer itself needs no wiring: the default reads the SDK's own token
+ * store, so there is exactly one token and one refresh timer per surface.
+ */
+interface IdentityAuth {
+    /** The IAM access token. Defaults to the `@hanzo/iam` SDK's token store. */
+    readonly token?: () => string | null | Promise<string | null>;
+    /** Start a sign-in. */
+    readonly signIn?: () => void;
+    /** End the session. */
+    readonly signOut?: () => void;
+}
+interface Identity {
+    readonly status: IdentityStatus;
+    /** The signed-in principal, or null. */
+    readonly account: IamAccount | null;
+    /** Organizations the principal can act in. */
+    readonly orgs: ReadonlyArray<IamOrg>;
+    /** The organization the surface is currently scoped to, or null. */
+    readonly org: IamOrg | null;
+    /** Projects in the current organization. */
+    readonly projects: ReadonlyArray<IamProject>;
+    /** The project the surface is currently scoped to, or null. */
+    readonly project: IamProject | null;
+    /** Why the reads failed, when status is 'error'. */
+    readonly error: string | null;
+    /** Host-resolved brand, theme, issuer and IAM client. */
+    readonly whiteLabel: WhiteLabel;
+    readonly setOrg: (name: string) => void;
+    readonly setProject: (name: string) => void;
+    readonly signIn: () => void;
+    readonly signOut: () => void;
+    readonly reload: () => void;
+}
+interface IdentityProviderProps {
+    readonly children: React.ReactNode;
+    /** Bearer + sign-in/out. Defaults to the `@hanzo/iam` token store. */
+    readonly auth?: IdentityAuth;
+    /** Where sign-in goes when `auth.signIn` is not supplied. */
+    readonly loginPath?: string;
+}
+declare const IdentityProvider: ({ children, auth, loginPath, }: IdentityProviderProps) => React.ReactElement;
+/**
+ * The current identity.
+ *
+ * Outside an `<IdentityProvider>` this reports `anonymous` rather than
+ * throwing: chrome that renders before a surface has wired identity should
+ * offer sign-in, not crash the page.
+ */
+declare function useIdentity(): Identity;
+
+export { type Identity, type IdentityAuth, IdentityProvider, type IdentityProviderProps, type IdentityStatus, useIdentity };