@marinoscar/platform-web 0.1.0-next.3 → 0.1.0-next.5

package/dist/identity/headless/types.d.ts

@@ -0,0 +1,186 @@
+import type { TenancyModeValue, UserExtensions } from '@marinoscar/platform-contract/identity';
+/**
+ * A role of the signed-in user (`/api/auth/me` `roles[]`).
+ *
+ * @stability stable
+ */
+export interface AuthRole {
+    /** The role name, e.g. `admin` or `viewer`. */
+    name: string;
+}
+/**
+ * An organization as `/api/auth/me` names it (`activeOrg`).
+ *
+ * @stability stable
+ */
+export interface OrgSummary {
+    /** The organization's id. */
+    id: string;
+    /** Its name. */
+    name: string;
+    /** Its slug. */
+    slug: string;
+}
+/**
+ * One of the user's active memberships, as `/api/auth/me` lists them.
+ *
+ * @stability stable
+ */
+export interface OrgMembershipSummary {
+    /** The organization's id. */
+    orgId: string;
+    /** Its name. */
+    name: string;
+    /** Its slug. */
+    slug: string;
+    /** The org role held there (`org_admin`, `contributor`, `viewer`, or an app role). */
+    role: string;
+}
+/**
+ * The signed-in user as the browser reads `GET /api/auth/me`
+ * (`currentUserSchema` of `@marinoscar/platform-contract/identity`). The
+ * picture and organization fields are optional so a payload from an older
+ * server reads as single-org with no picture.
+ *
+ * @stability stable
+ */
+export interface AuthUser {
+    /** The user's id. */
+    id: string;
+    /** The user's email address. */
+    email: string;
+    /** Display name, or `null`. */
+    displayName: string | null;
+    /**
+     * The RESOLVED picture to render, per the user's `profile.imageSource`:
+     * `null` for `none`, the provider URL for `provider`, and the same-origin
+     * avatar URL for `upload`.
+     */
+    profileImageUrl: string | null;
+    /** The sign-in provider's picture, whatever the chosen source (previews). */
+    providerProfileImageUrl?: string | null;
+    /** Whether an uploaded picture is stored, whatever the chosen source. */
+    hasUploadedProfileImage?: boolean;
+    /** The system roles plus the role on the active organization membership. */
+    roles: AuthRole[];
+    /** The effective permissions in the active organization. */
+    permissions: string[];
+    /** Whether the account is active. */
+    isActive: boolean;
+    /** ISO 8601 creation time. */
+    createdAt: string;
+    /** The deployment's tenancy mode (`TENANCY_MODE`); organization UI exists only in `multi`. */
+    tenancyMode?: TenancyModeValue;
+    /** The organization this session acts in, or `null`. */
+    activeOrg?: OrgSummary | null;
+    /** Every organization the user is an ACTIVE member of, i.e. can switch to. */
+    memberships?: OrgMembershipSummary[];
+    /**
+     * What the app's current-user extensions added on the server
+     * (`registerCurrentUserExtension` of `@marinoscar/platform-api/identity`),
+     * keyed by extension id: a small JSON object each, never a secret. Absent when
+     * none contributed. Read one with {@link useCurrentUserExtension}.
+     */
+    extensions?: UserExtensions;
+}
+/**
+ * One sign-in provider the API offers (`GET /api/auth/providers`).
+ *
+ * @stability stable
+ */
+export interface AuthProviderInfo {
+    /** The provider id, e.g. `google`; the login button posts to `/api/auth/<name>`. */
+    name: string;
+    /** The provider's start URL, when the server sends one. */
+    authUrl: string;
+    /**
+     * `custom` for a provider that owns its sign-in flow: there is no
+     * `/api/auth/<name>` redirect route, so `login(name)` calls the `start` of the
+     * look registered for the id instead of navigating. Absent for a redirect
+     * provider (every provider before this field existed).
+     */
+    mode?: 'custom';
+}
+/**
+ * What {@link AuthContextValue.login} takes.
+ *
+ * @stability stable
+ */
+export interface LoginOptions {
+    /**
+     * Ask the provider to show its account chooser instead of silently reusing
+     * the signed-in account (Google: `prompt=select_account`). Used by the
+     * "sign in with a different account" action on the sign-in error screen.
+     */
+    selectAccount?: boolean;
+}
+/**
+ * Everything the auth context offers: the session, the providers and the
+ * actions that change them.
+ *
+ * @stability stable
+ */
+export interface AuthContextValue {
+    /** The signed-in user, or `null`. */
+    user: AuthUser | null;
+    /** The boot-time session probe is still in flight. */
+    isLoading: boolean;
+    /** Someone is signed in. */
+    isAuthenticated: boolean;
+    /** The sign-in providers the API offers. */
+    providers: AuthProviderInfo[];
+    /**
+     * True once a signed-in session was lost because the server refused to
+     * refresh it, until the next sign-in. The login page reads it to explain
+     * why the user is there; `RequireAuth` does the redirect.
+     */
+    sessionExpired: boolean;
+    /**
+     * Start a sign-in with `provider`: a full-page redirect to `/api/auth/<provider>`,
+     * or, for a provider the API lists with `mode: 'custom'`, the `start` function
+     * of the look registered for it (`registerAuthProvider` of this entry).
+     */
+    login: (provider: string, options?: LoginOptions) => void;
+    /** Sign out: the app's `onBeforeLogout`, `POST /auth/logout`, then the login page. */
+    logout: () => Promise<void>;
+    /** Re-read `GET /auth/me`. Rejects when the API refuses. */
+    refreshUser: () => Promise<void>;
+    /**
+     * Hold the access token the sign-in callback received (`null` drops it).
+     * The callback page calls it before {@link AuthContextValue.refreshUser}.
+     */
+    setAccessToken: (token: string | null) => void;
+    /** The organization this session acts in, from `/api/auth/me`. */
+    activeOrg: OrgSummary | null;
+    /** The organizations the user can switch to (active memberships), from `/api/auth/me`. */
+    memberships: OrgMembershipSummary[];
+    /**
+     * Re-issue the session for another organization: calls
+     * `POST /api/auth/switch-org` (which rotates the refresh cookie), keeps the
+     * new access token and reloads the user, so permissions follow the org.
+     * Rejects when the API refuses; the current session is then unchanged.
+     */
+    switchOrg: (orgId: string) => Promise<void>;
+}
+/**
+ * What {@link AuthProvider} drives sessions through: the access-token holder
+ * and the two verbs it needs. `PlatformHttpClient` of
+ * `@marinoscar/platform-web/core` satisfies it; keep its identity stable.
+ *
+ * @stability stable
+ */
+export interface AuthSessionClient {
+    /** `GET path`; `skipAuth` sends no token (the providers list is public). */
+    get<T>(path: string, options?: {
+        skipAuth?: boolean;
+    }): Promise<T>;
+    /** `POST path` with an optional JSON body. */
+    post<T>(path: string, body?: unknown): Promise<T>;
+    /** Replace the held access token. */
+    setAccessToken(token: string | null): void;
+    /** Refresh the access token from the refresh cookie; `true` when one is held. */
+    refreshToken(): Promise<boolean>;
+    /** Subscribe to a refused refresh of a live session; returns the unsubscribe. */
+    onSessionExpired(listener: () => void): () => void;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/identity/headless/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/identity/headless/types.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAE/F;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACvB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,6BAA6B;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,gBAAgB;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,6BAA6B;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,QAAQ;IACvB,qBAAqB;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,gCAAgC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,+BAA+B;IAC/B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;;OAIG;IACH,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,6EAA6E;IAC7E,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,yEAAyE;IACzE,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,4EAA4E;IAC5E,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,4DAA4D;IAC5D,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,qCAAqC;IACrC,QAAQ,EAAE,OAAO,CAAC;IAClB,8BAA8B;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,8FAA8F;IAC9F,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,wDAAwD;IACxD,SAAS,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC9B,8EAA8E;IAC9E,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACrC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,oFAAoF;IACpF,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,QAAQ,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,qCAAqC;IACrC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC;IACtB,sDAAsD;IACtD,SAAS,EAAE,OAAO,CAAC;IACnB,4BAA4B;IAC5B,eAAe,EAAE,OAAO,CAAC;IACzB,4CAA4C;IAC5C,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B;;;;OAIG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,KAAK,IAAI,CAAC;IAC1D,sFAAsF;IACtF,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,4DAA4D;IAC5D,WAAW,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC;;;OAGG;IACH,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC/C,kEAAkE;IAClE,SAAS,EAAE,UAAU,GAAG,IAAI,CAAC;IAC7B,0FAA0F;IAC1F,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACpC;;;;;OAKG;IACH,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACnE,8CAA8C;IAC9C,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAClD,qCAAqC;IACrC,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAC3C,iFAAiF;IACjF,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,iFAAiF;IACjF,gBAAgB,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;CACpD"}

package/dist/identity/headless/types.js

@@ -0,0 +1,5 @@
+// The identity slice's browser-side shapes (issue #727, PP-6.6): the signed-in
+// user as `GET /api/auth/me` reports it, and what the auth context offers.
+// Moved from the reference app's `types/index.ts` and `contexts/AuthContext.tsx`.
+export {};
+//# sourceMappingURL=types.js.map

package/dist/identity/headless/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/identity/headless/types.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,2EAA2E;AAC3E,kFAAkF"}

package/dist/identity/headless/use-permissions.d.ts

@@ -0,0 +1,42 @@
+/**
+ * What {@link usePermissions} returns. The predicates keep a stable identity
+ * across renders while the user's permissions do not change, so callers may
+ * key `useMemo`/`useEffect` on them.
+ *
+ * @stability stable
+ */
+export interface UsePermissionsReturn {
+    /** The effective permissions of the signed-in user. */
+    permissions: Set<string>;
+    /** The names of the signed-in user's roles. */
+    roles: Set<string>;
+    /** Whether the user holds `permission` (the exact string the API enforces). */
+    hasPermission: (permission: string) => boolean;
+    /** Whether the user holds at least one of `perms`. */
+    hasAnyPermission: (...perms: string[]) => boolean;
+    /** Whether the user holds every one of `perms`. */
+    hasAllPermissions: (...perms: string[]) => boolean;
+    /** Whether the user has the role `role`. */
+    hasRole: (role: string) => boolean;
+    /** Whether the user has at least one of `roleList`. */
+    hasAnyRole: (...roleList: string[]) => boolean;
+    /** Whether the user has the `admin` role. */
+    isAdmin: boolean;
+}
+/**
+ * The signed-in user's permissions and roles, as predicates.
+ *
+ * @returns see {@link UsePermissionsReturn}.
+ * @throws Error outside an `AuthProvider`.
+ *
+ * @example
+ * ```tsx
+ * const { hasPermission } = usePermissions();
+ * <Button disabled={!hasPermission('users:write')}>Save</Button>
+ * ```
+ *
+ * @extensionPoint hook
+ * @stability stable
+ */
+export declare function usePermissions(): UsePermissionsReturn;
+//# sourceMappingURL=use-permissions.d.ts.map

package/dist/identity/headless/use-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-permissions.d.ts","sourceRoot":"","sources":["../../../src/identity/headless/use-permissions.ts"],"names":[],"mappings":"AAQA;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,uDAAuD;IACvD,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,+CAA+C;IAC/C,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACnB,+EAA+E;IAC/E,aAAa,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/C,sDAAsD;IACtD,gBAAgB,EAAE,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IAClD,mDAAmD;IACnD,iBAAiB,EAAE,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IACnD,4CAA4C;IAC5C,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACnC,uDAAuD;IACvD,UAAU,EAAE,CAAC,GAAG,QAAQ,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IAC/C,6CAA6C;IAC7C,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,IAAI,oBAAoB,CA4DrD"}

package/dist/identity/headless/use-permissions.js

@@ -0,0 +1,58 @@
+// The viewer's permissions and roles (issue #727, PP-6.6), moved from the
+// reference app's `hooks/usePermissions.ts`. These only decide what the UI
+// shows; the API enforces every permission.
+import { useCallback, useMemo } from 'react';
+import { useAuth } from './auth-context.js';
+/**
+ * The signed-in user's permissions and roles, as predicates.
+ *
+ * @returns see {@link UsePermissionsReturn}.
+ * @throws Error outside an `AuthProvider`.
+ *
+ * @example
+ * ```tsx
+ * const { hasPermission } = usePermissions();
+ * <Button disabled={!hasPermission('users:write')}>Save</Button>
+ * ```
+ *
+ * @extensionPoint hook
+ * @stability stable
+ */
+export function usePermissions() {
+    const { user } = useAuth();
+    const permissions = useMemo(() => {
+        return new Set(user?.permissions || []);
+    }, [user?.permissions]);
+    const roles = useMemo(() => {
+        return new Set(user?.roles?.map((r) => r.name) || []);
+    }, [user?.roles]);
+    const hasPermission = useCallback((permission) => {
+        return permissions.has(permission);
+    }, [permissions]);
+    const hasAnyPermission = useCallback((...perms) => {
+        return perms.some((p) => permissions.has(p));
+    }, [permissions]);
+    const hasAllPermissions = useCallback((...perms) => {
+        return perms.every((p) => permissions.has(p));
+    }, [permissions]);
+    const hasRole = useCallback((role) => {
+        return roles.has(role);
+    }, [roles]);
+    const hasAnyRole = useCallback((...roleList) => {
+        return roleList.some((r) => roles.has(r));
+    }, [roles]);
+    const isAdmin = useMemo(() => {
+        return roles.has('admin');
+    }, [roles]);
+    return {
+        permissions,
+        roles,
+        hasPermission,
+        hasAnyPermission,
+        hasAllPermissions,
+        hasRole,
+        hasAnyRole,
+        isAdmin,
+    };
+}
+//# sourceMappingURL=use-permissions.js.map

package/dist/identity/headless/use-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-permissions.js","sourceRoot":"","sources":["../../../src/identity/headless/use-permissions.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,2EAA2E;AAC3E,4CAA4C;AAE5C,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAE7C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AA4B5C;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC;IAE3B,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,EAAE;QAC/B,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC;IAC1C,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IAExB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE;QACzB,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IAElB,MAAM,aAAa,GAAG,WAAW,CAC/B,CAAC,UAAkB,EAAW,EAAE;QAC9B,OAAO,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC,EACD,CAAC,WAAW,CAAC,CACd,CAAC;IAEF,MAAM,gBAAgB,GAAG,WAAW,CAClC,CAAC,GAAG,KAAe,EAAW,EAAE;QAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC,EACD,CAAC,WAAW,CAAC,CACd,CAAC;IAEF,MAAM,iBAAiB,GAAG,WAAW,CACnC,CAAC,GAAG,KAAe,EAAW,EAAE;QAC9B,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC,EACD,CAAC,WAAW,CAAC,CACd,CAAC;IAEF,MAAM,OAAO,GAAG,WAAW,CACzB,CAAC,IAAY,EAAW,EAAE;QACxB,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC,EACD,CAAC,KAAK,CAAC,CACR,CAAC;IAEF,MAAM,UAAU,GAAG,WAAW,CAC5B,CAAC,GAAG,QAAkB,EAAW,EAAE;QACjC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC,EACD,CAAC,KAAK,CAAC,CACR,CAAC;IAEF,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE;QAC3B,OAAO,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAEZ,OAAO;QACL,WAAW;QACX,KAAK;QACL,aAAa;QACb,gBAAgB;QAChB,iBAAiB;QACjB,OAAO;QACP,UAAU;QACV,OAAO;KACR,CAAC;AACJ,CAAC"}

package/dist/identity/headless/user-extensions.d.ts

@@ -0,0 +1,44 @@
+/**
+ * One extension's contribution to a user payload, or `undefined` when the
+ * extension did not contribute (it is not registered, it returned nothing for
+ * this user, or the API skipped it).
+ *
+ * Works on the signed-in user (`useAuth().user`) and on a row of the user list
+ * (`UserListItem`) alike.
+ *
+ * @typeParam T - the contribution's shape. The API sends JSON the extension
+ *   chose; the caller states what it expects, and should still tolerate a
+ *   missing field.
+ * @param holder - a user payload that may carry `extensions`.
+ * @param id - the extension id.
+ * @returns the contribution, or `undefined`.
+ *
+ * @example
+ * ```tsx
+ * { id: 'plan', label: 'Plan', priority: 'secondary', value: (user) => userExtension<{ plan: string }>(user, 'billing')?.plan ?? '' }
+ * ```
+ *
+ * @stability experimental
+ */
+export declare function userExtension<T extends object = Record<string, unknown>>(holder: {
+    extensions?: Readonly<Record<string, unknown>> | undefined;
+} | null | undefined, id: string): T | undefined;
+/**
+ * The signed-in user's contribution from one current-user extension
+ * (`GET /api/auth/me` `extensions.<id>`), or `undefined` when there is none or
+ * nobody is signed in. Outside an `AuthProvider` it answers `undefined`.
+ *
+ * @typeParam T - the contribution's shape.
+ * @param id - the extension id.
+ * @returns the contribution, or `undefined`.
+ *
+ * @example
+ * ```tsx
+ * const billing = useCurrentUserExtension<{ plan: string }>('billing');
+ * ```
+ *
+ * @extensionPoint hook
+ * @stability experimental
+ */
+export declare function useCurrentUserExtension<T extends object = Record<string, unknown>>(id: string): T | undefined;
+//# sourceMappingURL=user-extensions.d.ts.map

package/dist/identity/headless/user-extensions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-extensions.d.ts","sourceRoot":"","sources":["../../../src/identity/headless/user-extensions.ts"],"names":[],"mappings":"AAaA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACtE,MAAM,EAAE;IAAE,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,EACzF,EAAE,EAAE,MAAM,GACT,CAAC,GAAG,SAAS,CAKf;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAE7G"}

package/dist/identity/headless/user-extensions.js

@@ -0,0 +1,61 @@
+// =============================================================================
+// Reading what the app's user extensions added (PP-14.25)
+// =============================================================================
+//
+// The API merges the app's `registerCurrentUserExtension` contributions into
+// `GET /api/auth/me` and its `registerUserListExtension` contributions into each
+// row of `GET /api/users`, under `extensions.<id>`. The browser only reads them:
+// it never decides anything from them (the API enforces every permission), and
+// what an extension returns is untrusted data to render, not markup.
+// =============================================================================
+import { useOptionalAuth } from './auth-context.js';
+/**
+ * One extension's contribution to a user payload, or `undefined` when the
+ * extension did not contribute (it is not registered, it returned nothing for
+ * this user, or the API skipped it).
+ *
+ * Works on the signed-in user (`useAuth().user`) and on a row of the user list
+ * (`UserListItem`) alike.
+ *
+ * @typeParam T - the contribution's shape. The API sends JSON the extension
+ *   chose; the caller states what it expects, and should still tolerate a
+ *   missing field.
+ * @param holder - a user payload that may carry `extensions`.
+ * @param id - the extension id.
+ * @returns the contribution, or `undefined`.
+ *
+ * @example
+ * ```tsx
+ * { id: 'plan', label: 'Plan', priority: 'secondary', value: (user) => userExtension<{ plan: string }>(user, 'billing')?.plan ?? '' }
+ * ```
+ *
+ * @stability experimental
+ */
+export function userExtension(holder, id) {
+    const extensions = holder?.extensions;
+    if (!extensions || !Object.prototype.hasOwnProperty.call(extensions, id))
+        return undefined;
+    const value = extensions[id];
+    return value !== null && typeof value === 'object' ? value : undefined;
+}
+/**
+ * The signed-in user's contribution from one current-user extension
+ * (`GET /api/auth/me` `extensions.<id>`), or `undefined` when there is none or
+ * nobody is signed in. Outside an `AuthProvider` it answers `undefined`.
+ *
+ * @typeParam T - the contribution's shape.
+ * @param id - the extension id.
+ * @returns the contribution, or `undefined`.
+ *
+ * @example
+ * ```tsx
+ * const billing = useCurrentUserExtension<{ plan: string }>('billing');
+ * ```
+ *
+ * @extensionPoint hook
+ * @stability experimental
+ */
+export function useCurrentUserExtension(id) {
+    return userExtension(useOptionalAuth()?.user, id);
+}
+//# sourceMappingURL=user-extensions.js.map

package/dist/identity/headless/user-extensions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-extensions.js","sourceRoot":"","sources":["../../../src/identity/headless/user-extensions.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,0DAA0D;AAC1D,gFAAgF;AAChF,EAAE;AACF,6EAA6E;AAC7E,iFAAiF;AACjF,iFAAiF;AACjF,+EAA+E;AAC/E,qEAAqE;AACrE,gFAAgF;AAEhF,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAyF,EACzF,EAAU;IAEV,MAAM,UAAU,GAAG,MAAM,EAAE,UAAU,CAAC;IACtC,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3F,MAAM,KAAK,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;IAC7B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAW,CAAC,CAAC,CAAC,SAAS,CAAC;AAChF,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,uBAAuB,CAA6C,EAAU;IAC5F,OAAO,aAAa,CAAI,eAAe,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AACvD,CAAC"}

package/dist/identity/index.d.ts

@@ -0,0 +1,4 @@
+export { useAuth, usePermissions } from './headless/index.js';
+export type { IdentityDataTableProps, IdentityTableColumn, IdentityTableFilter, IdentityTableRowAction, } from './headless/index.js';
+export { IdentityTable } from './ui/table.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/identity/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC9D,YAAY,EACV,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC"}

package/dist/identity/index.js

@@ -0,0 +1,11 @@
+// The identity slice's entry point for SIBLING SLICES of this package (issue
+// #738): the boundary lint lets one slice import another only through the
+// other's `index.ts`, and only when packages/platform-slices.json lists the
+// dependency (notifications -> identity). Not a package subpath: apps import
+// `@marinoscar/platform-web/identity/headless` and `/identity/ui`. Narrow on
+// purpose: only what a sibling uses.
+export { useAuth, usePermissions } from './headless/index.js';
+// The table seam: the app's DataTable from the identity adapters, else the
+// plain MUI fallback.
+export { IdentityTable } from './ui/table.js';
+//# sourceMappingURL=index.js.map

package/dist/identity/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/identity/index.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,0EAA0E;AAC1E,4EAA4E;AAC5E,6EAA6E;AAC7E,6EAA6E;AAC7E,qCAAqC;AAErC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAO9D,2EAA2E;AAC3E,sBAAsB;AACtB,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC"}

package/dist/identity/internal/use-is-mounted.d.ts

@@ -0,0 +1,9 @@
+/**
+ * A stable getter for "is this component still mounted?", to guard `setState`
+ * in the tail of an async operation. A ref rather than state, and a getter
+ * rather than the ref, so callers can list it in a `useCallback` dependency
+ * array without invalidating on every render. Copied from the reference app's
+ * `hooks/useIsMounted.ts` (a slice-private helper, not exported).
+ */
+export declare function useIsMounted(): () => boolean;
+//# sourceMappingURL=use-is-mounted.d.ts.map

package/dist/identity/internal/use-is-mounted.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-is-mounted.d.ts","sourceRoot":"","sources":["../../../src/identity/internal/use-is-mounted.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,wBAAgB,YAAY,IAAI,MAAM,OAAO,CAW5C"}

package/dist/identity/internal/use-is-mounted.js

@@ -0,0 +1,19 @@
+import { useCallback, useEffect, useRef } from 'react';
+/**
+ * A stable getter for "is this component still mounted?", to guard `setState`
+ * in the tail of an async operation. A ref rather than state, and a getter
+ * rather than the ref, so callers can list it in a `useCallback` dependency
+ * array without invalidating on every render. Copied from the reference app's
+ * `hooks/useIsMounted.ts` (a slice-private helper, not exported).
+ */
+export function useIsMounted() {
+    const mounted = useRef(true);
+    useEffect(() => {
+        mounted.current = true;
+        return () => {
+            mounted.current = false;
+        };
+    }, []);
+    return useCallback(() => mounted.current, []);
+}
+//# sourceMappingURL=use-is-mounted.js.map

package/dist/identity/internal/use-is-mounted.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-is-mounted.js","sourceRoot":"","sources":["../../../src/identity/internal/use-is-mounted.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAEvD;;;;;;GAMG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAE7B,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;QACvB,OAAO,GAAG,EAAE;YACV,OAAO,CAAC,OAAO,GAAG,KAAK,CAAC;QAC1B,CAAC,CAAC;IACJ,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,OAAO,WAAW,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAChD,CAAC"}

package/dist/identity/ui/ActivateDevicePage.d.ts

@@ -0,0 +1,34 @@
+import type { ReactElement } from 'react';
+import type { PageSlotsBase } from '../../core/index.js';
+/**
+ * The slots of {@link ActivateDevicePage}: the packaged-page slot contract.
+ * `Header` replaces the heading block of the card (its `title` and `description`
+ * change with the step); `BeforeContent` and `Sections` (top) sit between the
+ * heading and the step's content, `Sections` (bottom) and `AfterContent` after it.
+ * All of it is inside the card.
+ *
+ * @extensionPoint slot
+ * @stability experimental
+ */
+export type ActivateDevicePageSlots = PageSlotsBase;
+/**
+ * Props of {@link ActivateDevicePage}.
+ *
+ * @stability experimental
+ */
+export interface ActivateDevicePageProps {
+    /** Add to the page without a fork. */
+    slots?: ActivateDevicePageSlots;
+}
+/**
+ * The `/activate` route: enter (or arrive with) a device's user code, review
+ * what the device asked for, approve or deny.
+ *
+ * @param props - see {@link ActivateDevicePageProps}.
+ * @returns the page.
+ *
+ * @extensionPoint component
+ * @stability stable
+ */
+export declare function ActivateDevicePage({ slots }?: ActivateDevicePageProps): ReactElement;
+//# sourceMappingURL=ActivateDevicePage.d.ts.map

package/dist/identity/ui/ActivateDevicePage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ActivateDevicePage.d.ts","sourceRoot":"","sources":["../../../src/identity/ui/ActivateDevicePage.tsx"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,OAAO,CAAC;AAU1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAYzD;;;;;;;;;GASG;AACH,MAAM,MAAM,uBAAuB,GAAG,aAAa,CAAC;AAEpD;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,sCAAsC;IACtC,KAAK,CAAC,EAAE,uBAAuB,CAAC;CACjC;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,KAAK,EAAE,GAAE,uBAA4B,GAAG,YAAY,CAyJxF"}

package/dist/identity/ui/ActivateDevicePage.js

@@ -0,0 +1,118 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+// The device-activation route (RFC 8628), moved from the reference app's
+// `pages/ActivateDevicePage.tsx` (issue #727).
+import { useState, useEffect } from 'react';
+import { useSearchParams } from 'react-router-dom';
+import { Box, Card, CardContent, Typography, useTheme, } from '@mui/material';
+import { isPlatformApiError } from '../../core/index.js';
+import { useIdentityApi } from '../headless/index.js';
+import { DeviceCodeInput } from './device/DeviceCodeInput.js';
+import { DeviceInfoCard } from './device/DeviceInfoCard.js';
+import { ActivationSuccess } from './device/ActivationSuccess.js';
+/**
+ * The `/activate` route: enter (or arrive with) a device's user code, review
+ * what the device asked for, approve or deny.
+ *
+ * @param props - see {@link ActivateDevicePageProps}.
+ * @returns the page.
+ *
+ * @extensionPoint component
+ * @stability stable
+ */
+export function ActivateDevicePage({ slots } = {}) {
+    const Header = slots?.Header;
+    const BeforeContent = slots?.BeforeContent;
+    const Sections = slots?.Sections;
+    const AfterContent = slots?.AfterContent;
+    const { getDeviceActivationInfo, authorizeDevice } = useIdentityApi();
+    const [searchParams] = useSearchParams();
+    const theme = useTheme();
+    const [state, setState] = useState({ step: 'input' });
+    const [error, setError] = useState(null);
+    // Pre-fill code from URL query parameter
+    const codeFromUrl = searchParams.get('code') || '';
+    // Auto-verify if code is provided in URL
+    useEffect(() => {
+        if (codeFromUrl && state.step === 'input') {
+            handleVerifyCode(codeFromUrl);
+        }
+    }, []);
+    const handleVerifyCode = async (code) => {
+        setError(null);
+        try {
+            const deviceInfo = await getDeviceActivationInfo(code);
+            setState({ step: 'review', deviceInfo });
+        }
+        catch (err) {
+            if (isPlatformApiError(err)) {
+                if (err.status === 404 || err.status === 400) {
+                    setError('Invalid code. Please check and try again.');
+                }
+                else if (err.status === 410) {
+                    setError('This code has expired. Please request a new one.');
+                }
+                else {
+                    setError(err.message || 'Failed to verify code. Please try again.');
+                }
+            }
+            else {
+                setError('Network error. Please check your connection and try again.');
+            }
+        }
+    };
+    const handleApprove = async () => {
+        if (state.step !== 'review')
+            return;
+        setError(null);
+        try {
+            const response = await authorizeDevice(state.deviceInfo.userCode, true);
+            setState({
+                step: 'complete',
+                success: response.success,
+                message: response.message || 'Device authorized successfully!',
+            });
+        }
+        catch (err) {
+            if (isPlatformApiError(err)) {
+                setError(err.message || 'Failed to authorize device. Please try again.');
+            }
+            else {
+                setError('Network error. Please check your connection and try again.');
+            }
+        }
+    };
+    const handleDeny = async () => {
+        if (state.step !== 'review')
+            return;
+        setError(null);
+        try {
+            const response = await authorizeDevice(state.deviceInfo.userCode, false);
+            setState({
+                step: 'complete',
+                success: false,
+                message: response.message || 'Device access denied.',
+            });
+        }
+        catch (err) {
+            if (isPlatformApiError(err)) {
+                setError(err.message || 'Failed to process request. Please try again.');
+            }
+            else {
+                setError('Network error. Please check your connection and try again.');
+            }
+        }
+    };
+    return (_jsx(Box, { sx: {
+            minHeight: '100vh',
+            display: 'flex',
+            alignItems: 'center',
+            justifyContent: 'center',
+            backgroundColor: theme.palette.background.default,
+            p: 2,
+        }, children: _jsx(Card, { sx: {
+                maxWidth: 500,
+                width: '100%',
+                boxShadow: theme.shadows[10],
+            }, children: _jsxs(CardContent, { sx: { p: { xs: 3, sm: 4 } }, children: [Header ? (_jsx(Header, { title: state.step === 'complete' ? 'Authorization Complete' : 'Authorize Device', ...(state.step !== 'complete' ? { description: 'Link a device to your account' } : {}), actions: null })) : (_jsxs(Box, { sx: { textAlign: 'center', mb: 4 }, children: [_jsx(Typography, { variant: "h4", component: "h1", sx: { fontWeight: 'bold' }, children: state.step === 'complete' ? 'Authorization Complete' : 'Authorize Device' }), state.step !== 'complete' && (_jsx(Typography, { color: "text.secondary", sx: { mt: 1 }, children: "Link a device to your account" }))] })), BeforeContent && _jsx(BeforeContent, {}), Sections && _jsx(Sections, { position: "top" }), state.step === 'input' && (_jsx(DeviceCodeInput, { initialCode: codeFromUrl, onVerify: handleVerifyCode, error: error })), state.step === 'review' && (_jsx(DeviceInfoCard, { deviceInfo: state.deviceInfo, onApprove: handleApprove, onDeny: handleDeny, error: error })), state.step === 'complete' && (_jsx(ActivationSuccess, { success: state.success, message: state.message })), Sections && _jsx(Sections, { position: "bottom" }), AfterContent && _jsx(AfterContent, {})] }) }) }));
+}
+//# sourceMappingURL=ActivateDevicePage.js.map