@luxfi/ui 8.2.6 → 8.2.8

package/dist/auth.cjs

@@ -1,11 +1,11 @@
-"use client";
+'use client';
 'use strict';
 
 var browser = require('@hanzo/iam/browser');
 var ui = require('@hanzo/ui');
-var React2 = require('react');
-require('@hanzo/gui');
-var reactQuery = require('@tanstack/react-query');
+var React = require('react');
+var identity_js = require('./identity.js');
+var provider_js = require('./provider.js');
 var jsxRuntime = require('react/jsx-runtime');
 
 function _interopNamespace(e) {
@@ -26,385 +26,8 @@ function _interopNamespace(e) {
   return Object.freeze(n);
 }
 
-var React2__namespace = /*#__PURE__*/_interopNamespace(React2);
+var React__namespace = /*#__PURE__*/_interopNamespace(React);
 
-// src/white-label.ts
-var LUX_BRAND = {
-  lux: "#7000FF",
-  zoo: "#6C5EFB",
-  hanzo: "#EA580C",
-  pars: "#1C3879"};
-var PARS_GOLD = "#C8A45C";
-var ORGS = {
-  lux: {
-    org: "lux",
-    name: "Lux",
-    domain: "lux.network",
-    iamDomain: "lux.id",
-    accent: LUX_BRAND.lux,
-    accentForeground: "#FFFFFF"
-  },
-  zoo: {
-    org: "zoo",
-    name: "Zoo",
-    domain: "zoo.ngo",
-    // Zoo's issuer is `zoolabs.id` — the one row where it is not `<org>.id`,
-    // and the one every hand-rolled branding map gets wrong. `id.zoo.network`
-    // ANSWERS, which is why it keeps being copied around, but it is an alias:
-    // its own discovery document advertises
-    //   issuer                  https://zoolabs.id
-    //   authorization_endpoint  https://zoolabs.id/v1/iam/oauth/authorize
-    //   jwks_uri                https://zoolabs.id/v1/iam/.well-known/jwks
-    // so a client configured on the alias validates `iss` against a string the
-    // IdP never emits and rejects every token it is given — the exact shape of
-    // the lux.id outage. `zoo.id` is not an IdP at all (no discovery document).
-    iamDomain: "zoolabs.id",
-    accent: LUX_BRAND.zoo,
-    accentForeground: "#FFFFFF"
-  },
-  bootnode: {
-    org: "bootnode",
-    name: "Bootnode",
-    domain: "bootno.de",
-    iamDomain: "id.bootno.de",
-    accent: LUX_BRAND.lux,
-    accentForeground: "#FFFFFF"
-  },
-  hanzo: {
-    org: "hanzo",
-    name: "Hanzo",
-    domain: "hanzo.ai",
-    iamDomain: "hanzo.id",
-    accent: LUX_BRAND.hanzo,
-    accentForeground: "#FFFFFF"
-  },
-  pars: {
-    org: "pars",
-    name: "Pars",
-    domain: "pars.id",
-    iamDomain: "pars.id",
-    accent: LUX_BRAND.pars,
-    accentForeground: PARS_GOLD
-  }
-};
-var DOMAIN_ORG = [
-  ["lux.network", "lux"],
-  ["lux.cloud", "lux"],
-  ["lux.id", "lux"],
-  ["lux.finance", "lux"],
-  ["lux.market", "lux"],
-  ["lux.exchange", "lux"],
-  ["zoo.ngo", "zoo"],
-  ["zoo.network", "zoo"],
-  ["zoo.cloud", "zoo"],
-  ["zoolabs.id", "zoo"],
-  ["hanzo.ai", "hanzo"],
-  ["hanzo.cloud", "hanzo"],
-  ["hanzo.id", "hanzo"],
-  ["pars.id", "pars", "app"],
-  ["pars.network", "pars", "app"],
-  ["parsdao.org", "pars", "app"],
-  ["bootno.de", "bootnode", "platform"]
-];
-var DEFAULT_ORG = "lux";
-function normalizeHost(host) {
-  const noPort = host.trim().toLowerCase().split(":")[0] ?? "";
-  return noPort.replace(/\.$/, "");
-}
-function isUnder(host, domain) {
-  return host === domain || host.endsWith(`.${domain}`);
-}
-function matchDomain(host) {
-  let best;
-  for (const entry of DOMAIN_ORG) {
-    if (isUnder(host, entry[0]) && (!best || entry[0].length > best[0].length)) {
-      best = entry;
-    }
-  }
-  return best;
-}
-function appSlug(host, domain, pinned) {
-  if (pinned) return pinned;
-  const sub = host === domain ? "" : host.slice(0, -(domain.length + 1));
-  const leftmost = sub.split(".")[0] ?? "";
-  if (leftmost && leftmost !== "www") return leftmost;
-  const label = domain.split(".")[0] ?? "";
-  const tld = domain.split(".").slice(1).join(".");
-  return tld.split(".")[0] || label;
-}
-function isLocal(host) {
-  return host === "localhost" || host.endsWith(".localhost") || host === "127.0.0.1" || host === "0.0.0.0" || host === "[::1]" || host.endsWith(".local");
-}
-function resolveWhiteLabel(host) {
-  const h = normalizeHost(host ?? "");
-  const match = h ? matchDomain(h) : void 0;
-  const org = match ? match[1] : DEFAULT_ORG;
-  const identity = ORGS[org];
-  const app = match ? appSlug(h, match[0], match[2]) : h && isLocal(h) ? "local" : "app";
-  return {
-    ...identity,
-    host: h,
-    app,
-    theme: `dark_${org}`,
-    issuer: `https://${identity.iamDomain}`,
-    clientId: `${org}-${app}`
-  };
-}
-
-// src/iam.ts
-var IamError = class extends Error {
-  constructor(message, status, unauthenticated) {
-    super(message);
-    this.name = "IamError";
-    this.status = status;
-    this.unauthenticated = unauthenticated;
-  }
-};
-var SIGNED_OUT = /please sign in|authentication required|unauthorized/i;
-function isSignedOut(status, msg) {
-  return status === 401 || SIGNED_OUT.test(msg);
-}
-function iamBase(host) {
-  const wl = typeof host === "object" && host !== null ? host : resolveWhiteLabel(host);
-  return `${wl.issuer}/v1/iam`;
-}
-async function read(call, verb, params) {
-  const url = new URL(`${call.base}/${verb}`);
-  for (const [k, v] of Object.entries(params)) url.searchParams.set(k, String(v));
-  let res;
-  try {
-    res = await fetch(url.toString(), {
-      method: "GET",
-      // The bearer is the whole credential. IAM does not allow credentialed
-      // CORS, so sending cookies would only get the response blocked.
-      headers: call.token ? { Authorization: `Bearer ${call.token}` } : {},
-      signal: call.signal
-    });
-  } catch (e) {
-    throw new IamError(e instanceof Error ? e.message : "IAM unreachable", 0, false);
-  }
-  const body = await res.json().catch(() => ({}));
-  const msg = typeof body.msg === "string" ? body.msg : "";
-  if (!res.ok || body.status === "error") {
-    throw new IamError(msg || `IAM ${verb} failed (${res.status})`, res.status, isSignedOut(res.status, msg));
-  }
-  return body.data;
-}
-var IAM_PAGE_SIZE = 20;
-var iam = {
-  /** The signed-in principal, or null when there is no session. */
-  async account(call) {
-    try {
-      const data = await read(call, "get-account", {});
-      return data && data.name ? data : null;
-    } catch (e) {
-      if (e instanceof IamError && e.unauthenticated) return null;
-      throw e;
-    }
-  },
-  /**
-   * One page of the orgs the principal can see. IAM scopes the read to the
-   * caller's authority, so a normal member gets their own org and a super
-   * admin gets the tenant list — the page never has to decide.
-   */
-  async organizations(call, page = 0, query = "", pageSize = IAM_PAGE_SIZE) {
-    const params = {
-      owner: "admin",
-      // IAM orgs live under the reserved `admin` owner
-      p: page + 1,
-      // the backend page is 1-based
-      pageSize,
-      sortField: "name",
-      sortOrder: "ascending"
-    };
-    const q = query.trim();
-    if (q) {
-      params.field = "name";
-      params.value = q;
-    }
-    return await read(call, "get-organizations", params) ?? [];
-  },
-  /** One organization by name. */
-  async organization(call, name) {
-    return await read(call, "get-organization", { id: `admin/${name}` }) ?? null;
-  },
-  /** Members of an organization. */
-  async users(call, org) {
-    return await read(call, "get-users", { owner: org }) ?? [];
-  },
-  /** The organization's projects — IAM keys this read by `organization`. */
-  async projects(call, org) {
-    return await read(call, "get-organization-projects", { organization: org }) ?? [];
-  }
-};
-new reactQuery.QueryClient({
-  defaultOptions: { queries: { refetchOnWindowFocus: false, retry: 1, staleTime: 3e4 } }
-});
-var WhiteLabelContext = React2__namespace.default.createContext(resolveWhiteLabel(""));
-var useWhiteLabel = () => React2__namespace.default.useContext(WhiteLabelContext);
-var IAM_TOKEN_KEY = "hanzo_iam_access_token";
-function storedToken() {
-  if (typeof window === "undefined") return null;
-  for (const store of [window.sessionStorage, window.localStorage]) {
-    try {
-      const t = store.getItem(IAM_TOKEN_KEY);
-      if (t) return t;
-    } catch {
-    }
-  }
-  return null;
-}
-function clearStoredTokens() {
-  if (typeof window === "undefined") return;
-  for (const store of [window.sessionStorage, window.localStorage]) {
-    try {
-      for (const k of ["access_token", "refresh_token", "id_token", "expires_at"]) {
-        store.removeItem(`hanzo_iam_${k}`);
-      }
-    } catch {
-    }
-  }
-}
-var defaultAuth = {};
-var scopeKey = (host, kind) => `lux-ui:${kind}:${host}`;
-function readScope(host, kind) {
-  if (typeof window === "undefined") return null;
-  try {
-    return window.localStorage.getItem(scopeKey(host, kind));
-  } catch {
-    return null;
-  }
-}
-function writeScope(host, kind, value) {
-  if (typeof window === "undefined") return;
-  try {
-    window.localStorage.setItem(scopeKey(host, kind), value);
-  } catch {
-  }
-}
-var IdentityContext = React2__namespace.createContext(null);
-var IdentityProvider = ({
-  children,
-  auth = defaultAuth,
-  loginPath = "/login"
-}) => {
-  const whiteLabel = useWhiteLabel();
-  const base = React2__namespace.useMemo(() => iamBase(whiteLabel), [whiteLabel]);
-  const [status, setStatus] = React2__namespace.useState("loading");
-  const [account, setAccount] = React2__namespace.useState(null);
-  const [orgs, setOrgs] = React2__namespace.useState([]);
-  const [projects, setProjects] = React2__namespace.useState([]);
-  const [error, setError] = React2__namespace.useState(null);
-  const [orgName, setOrgName] = React2__namespace.useState(null);
-  const [projectName, setProjectName] = React2__namespace.useState(null);
-  const [epoch, setEpoch] = React2__namespace.useState(0);
-  React2__namespace.useEffect(() => {
-    const ac = new AbortController();
-    let live = true;
-    void (async () => {
-      const token = await (auth.token ?? storedToken)();
-      if (!live) return;
-      if (!token) {
-        setStatus("anonymous");
-        setAccount(null);
-        setOrgs([]);
-        return;
-      }
-      const call = { base, token, signal: ac.signal };
-      try {
-        const me = await iam.account(call);
-        if (!live) return;
-        if (!me) {
-          setStatus("anonymous");
-          setAccount(null);
-          setOrgs([]);
-          return;
-        }
-        setAccount(me);
-        const rows = await iam.organizations(call).catch((e) => {
-          if (e instanceof IamError && !e.unauthenticated) return [{ owner: "admin", name: me.owner }];
-          throw e;
-        });
-        if (!live) return;
-        setOrgs(rows);
-        setStatus("ready");
-        setError(null);
-      } catch (e) {
-        if (!live || ac.signal.aborted) return;
-        if (e instanceof IamError && e.unauthenticated) {
-          setStatus("anonymous");
-          setAccount(null);
-          setOrgs([]);
-          return;
-        }
-        setStatus("error");
-        setError(e instanceof Error ? e.message : "Could not reach IAM.");
-      }
-    })();
-    return () => {
-      live = false;
-      ac.abort();
-    };
-  }, [base, auth, epoch]);
-  const org = React2__namespace.useMemo(() => {
-    if (orgs.length === 0) return null;
-    const saved = orgName ?? readScope(whiteLabel.host, "org");
-    return orgs.find((o) => o.name === saved) ?? orgs.find((o) => o.name === account?.owner) ?? orgs[0];
-  }, [orgs, orgName, account, whiteLabel.host]);
-  React2__namespace.useEffect(() => {
-    if (!org) {
-      setProjects([]);
-      return;
-    }
-    const ac = new AbortController();
-    let live = true;
-    void (async () => {
-      const token = await (auth.token ?? storedToken)();
-      if (!live || !token) return;
-      const rows = await iam.projects({ base, token, signal: ac.signal }, org.name).catch(() => []);
-      if (live) setProjects(rows);
-    })();
-    return () => {
-      live = false;
-      ac.abort();
-    };
-  }, [base, auth, org, epoch]);
-  const project = React2__namespace.useMemo(() => {
-    if (projects.length === 0) return null;
-    const saved = projectName ?? readScope(whiteLabel.host, "project");
-    return projects.find((p) => p.name === saved) ?? projects.find((p) => p.isDefault) ?? projects[0];
-  }, [projects, projectName, whiteLabel.host]);
-  const value = React2__namespace.useMemo(() => ({
-    status,
-    account,
-    orgs,
-    org,
-    projects,
-    project,
-    error,
-    whiteLabel,
-    setOrg: (name) => {
-      writeScope(whiteLabel.host, "org", name);
-      setOrgName(name);
-      setProjectName(null);
-    },
-    setProject: (name) => {
-      writeScope(whiteLabel.host, "project", name);
-      setProjectName(name);
-    },
-    signIn: () => {
-      if (auth.signIn) return auth.signIn();
-      if (typeof window !== "undefined") window.location.assign(loginPath);
-    },
-    signOut: () => {
-      if (auth.signOut) return auth.signOut();
-      clearStoredTokens();
-      if (typeof window !== "undefined") window.location.assign(loginPath);
-    },
-    reload: () => setEpoch((n) => n + 1)
-  }), [status, account, orgs, org, projects, project, error, whiteLabel, auth, loginPath]);
-  return /* @__PURE__ */ jsxRuntime.jsx(IdentityContext.Provider, { value, children });
-};
 var CALLBACK_PATH = "/auth/callback";
 function configureAuth(wl) {
   if (typeof window === "undefined") return;
@@ -418,9 +41,9 @@ function configureAuth(wl) {
   });
 }
 function useAuth(defaultRedirect = "/") {
-  const whiteLabel = useWhiteLabel();
+  const whiteLabel = provider_js.useWhiteLabel();
   configureAuth(whiteLabel);
-  return React2__namespace.useMemo(() => ({
+  return React__namespace.useMemo(() => ({
     signIn: (redirect = defaultRedirect) => void browser.startLogin({ redirect }),
     signOut: () => void browser.logout(),
     complete: () => browser.handleCallback(),
@@ -429,14 +52,14 @@ function useAuth(defaultRedirect = "/") {
 }
 var AuthProvider = ({ children, redirect = "/", onSignOut }) => {
   const auth = useAuth(redirect);
-  const identityAuth = React2__namespace.useMemo(() => ({
+  const identityAuth = React__namespace.useMemo(() => ({
     signIn: () => auth.signIn(redirect),
     signOut: () => {
       onSignOut?.();
       auth.signOut();
     }
   }), [auth, redirect, onSignOut]);
-  return /* @__PURE__ */ jsxRuntime.jsx(IdentityProvider, { auth: identityAuth, children });
+  return /* @__PURE__ */ jsxRuntime.jsx(identity_js.IdentityProvider, { auth: identityAuth, children });
 };
 var AuthCallback = ({
   onSignedIn,
@@ -445,8 +68,8 @@ var AuthCallback = ({
   retryPath = "/login"
 }) => {
   const auth = useAuth();
-  const [error, setError] = React2__namespace.useState(null);
-  React2__namespace.useEffect(() => {
+  const [error, setError] = React__namespace.useState(null);
+  React__namespace.useEffect(() => {
     let live = true;
     void (async () => {
       try {