@micha.bigler/ui-core-micha 1.4.20 → 1.4.23

package/dist/auth/AuthContext.js

@@ -1,7 +1,6 @@
 import { jsx as _jsx } from "react/jsx-runtime";
 // src/auth/AuthContext.jsx
 import React, { createContext, useState, useEffect, } from 'react';
-// REMOVED: import axios from 'axios'; -> Not needed here anymore
 import { ensureCsrfToken } from './apiClient'; // <--- IMPORT ADDED
 import { fetchCurrentUser, logoutSession, } from './authApi';
 export const AuthContext = createContext(null);

package/dist/auth/authApi.js

@@ -1,110 +1,15 @@
 import apiClient from './apiClient';
 import { HEADLESS_BASE, USERS_BASE, ACCESS_CODES_BASE } from './authConfig';
-// -----------------------------
-// WebAuthn Serialization Helpers
-// -----------------------------
-function bufferToBase64URL(buffer) {
-    const bytes = new Uint8Array(buffer);
-    let str = '';
-    for (const char of bytes) {
-        str += String.fromCharCode(char);
-    }
-    const base64 = btoa(str);
-    return base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
-}
-function serializeCredential(credential) {
-    // Wir nutzen IMMER die manuelle Serialisierung, um sicherzugehen,
-    // dass alles Base64URL-kodiert ist (kompatibel mit Allauth).
-    const p = {
-        id: credential.id,
-        rawId: bufferToBase64URL(credential.rawId),
-        type: credential.type,
-        response: {
-            clientDataJSON: bufferToBase64URL(credential.response.clientDataJSON),
-        },
-    };
-    if (credential.response.attestationObject) {
-        p.response.attestationObject = bufferToBase64URL(credential.response.attestationObject);
-    }
-    if (credential.response.authenticatorData) {
-        p.response.authenticatorData = bufferToBase64URL(credential.response.authenticatorData);
-    }
-    if (credential.response.signature) {
-        p.response.signature = bufferToBase64URL(credential.response.signature);
-    }
-    if (credential.response.userHandle) {
-        p.response.userHandle = bufferToBase64URL(credential.response.userHandle);
-    }
-    // Extension Results direkt übernehmen, falls vorhanden
-    if (typeof credential.getClientExtensionResults === 'function') {
-        p.clientExtensionResults = credential.getClientExtensionResults();
-    }
-    return p;
-}
-function normaliseApiError(error, defaultCode = 'Auth.GENERIC_ERROR') {
-    const info = extractErrorInfo(error);
-    const code = info.code || defaultCode;
-    const message = info.message || code || defaultCode;
-    const err = new Error(message);
-    err.code = code;
-    err.status = info.status;
-    err.raw = info.raw;
-    return err;
-}
-function mapAllauthDetailToCode(detail) {
-    if (!detail || typeof detail !== 'string')
-        return null;
-    return null;
-}
-function extractErrorInfo(error) {
-    var _a, _b, _c, _d;
-    const status = (_b = (_a = error.response) === null || _a === void 0 ? void 0 : _a.status) !== null && _b !== void 0 ? _b : null;
-    const data = (_d = (_c = error.response) === null || _c === void 0 ? void 0 : _c.data) !== null && _d !== void 0 ? _d : null;
-    if (!data) {
-        return { status, code: null, message: error.message || null, raw: null };
-    }
-    if (typeof data.code === 'string') {
-        return { status, code: data.code, message: null, raw: data };
-    }
-    if (typeof data.detail === 'string') {
-        const mapped = mapAllauthDetailToCode(data.detail);
-        return { status, code: mapped, message: data.detail, raw: data };
-    }
-    if (Array.isArray(data.non_field_errors) && data.non_field_errors.length > 0) {
-        const msg = data.non_field_errors[0];
-        const mapped = mapAllauthDetailToCode(msg);
-        return { status, code: mapped, message: msg, raw: data };
-    }
-    return { status, code: null, message: null, raw: data };
-}
-// -----------------------------
-// CSRF helper
-// -----------------------------
+import { normaliseApiError } from '../utils/errors'; // Beachte den Pfad zu deiner errors.js
+// --- Internal Helper for CSRF ---
 function getCsrfToken() {
-    if (typeof document === 'undefined' || !document.cookie) {
+    if (typeof document === 'undefined' || !document.cookie)
         return null;
-    }
-    // Robust regex for CSRF token
     const match = document.cookie.match(/(?:^|; )csrftoken=([^;]+)/);
     return match ? match[1] : null;
 }
 // -----------------------------
-// WebAuthn capability helpers
-// -----------------------------
-const hasJsonWebAuthn = typeof window !== 'undefined' &&
-    typeof window.PublicKeyCredential !== 'undefined' &&
-    typeof window.PublicKeyCredential.parseCreationOptionsFromJSON === 'function' &&
-    typeof window.PublicKeyCredential.parseRequestOptionsFromJSON === 'function';
-function ensureWebAuthnSupport() {
-    if (typeof window === 'undefined' ||
-        typeof navigator === 'undefined' ||
-        !window.PublicKeyCredential ||
-        !navigator.credentials) {
-        throw normaliseApiError(new Error('Auth.PASSKEY_NOT_SUPPORTED'), 'Auth.PASSKEY_NOT_SUPPORTED');
-    }
-}
-// -----------------------------
-// User-related helpers
+// Session & User Core
 // -----------------------------
 export async function fetchCurrentUser() {
     const res = await apiClient.get(`${USERS_BASE}/current/`);
@@ -112,7 +17,6 @@ export async function fetchCurrentUser() {
 }
 export async function updateUserProfile(data) {
     try {
-        // CHANGED: axios -> apiClient
         const res = await apiClient.patch(`${USERS_BASE}/current/`, data);
         return res.data;
     }
@@ -120,98 +24,98 @@ export async function updateUserProfile(data) {
         throw normaliseApiError(error, 'Auth.PROFILE_UPDATE_FAILED');
     }
 }
-// -----------------------------
-// Authentication: password
-// -----------------------------
-export async function requestPasswordReset(email) {
+export async function fetchHeadlessSession() {
+    const res = await apiClient.get(`${HEADLESS_BASE}/auth/session`);
+    return res.data;
+}
+export async function logoutSession() {
     try {
-        await apiClient.post(`${USERS_BASE}/reset-request/`, { email });
+        const headers = {};
+        const token = getCsrfToken();
+        if (token)
+            headers['X-CSRFToken'] = token;
+        await apiClient.delete(`${HEADLESS_BASE}/auth/session`, { headers });
     }
     catch (error) {
-        throw normaliseApiError(error, 'Auth.RESET_REQUEST_FAILED');
+        // 401/404 beim Logout ignorieren wir
+        if (error.response && [401, 404, 410].includes(error.response.status))
+            return;
+        console.error('Logout error:', error);
     }
 }
-export async function resetPasswordWithKey(key, newPassword) {
+// -----------------------------
+// Authentication: Password & MFA
+// -----------------------------
+export async function loginWithPassword(email, password) {
+    var _a, _b, _c;
     try {
-        await apiClient.post(`${HEADLESS_BASE}/auth/password/reset/key`, { key, password: newPassword });
+        await apiClient.post(`${HEADLESS_BASE}/auth/login`, { email, password });
+        // Nach erfolgreichem Login User holen
+        const user = await fetchCurrentUser();
+        return { user, needsMfa: false };
     }
     catch (error) {
-        throw normaliseApiError(error, 'Auth.RESET_WITH_KEY_FAILED');
+        const status = (_a = error.response) === null || _a === void 0 ? void 0 : _a.status;
+        const body = (_b = error.response) === null || _b === void 0 ? void 0 : _b.data;
+        // Prüfen auf Allauth Headless MFA Flow (401 + flows)
+        const flows = ((_c = body === null || body === void 0 ? void 0 : body.data) === null || _c === void 0 ? void 0 : _c.flows) || (body === null || body === void 0 ? void 0 : body.flows) || [];
+        const mfaFlow = Array.isArray(flows) ? flows.find((f) => f.id === 'mfa_authenticate') : null;
+        if (status === 401 && mfaFlow && mfaFlow.is_pending) {
+            return { needsMfa: true, availableTypes: mfaFlow.types || [] };
+        }
+        // 409 = Already logged in
+        if (status === 409) {
+            const user = await fetchCurrentUser();
+            return { user, needsMfa: false };
+        }
+        throw normaliseApiError(error, 'Auth.LOGIN_FAILED');
     }
 }
-export async function changePassword(currentPassword, newPassword) {
+export async function authenticateWithMFA({ code, credential }) {
+    const payload = {};
+    if (code)
+        payload.code = code;
+    if (credential)
+        payload.credential = credential;
     try {
-        await apiClient.post(`${HEADLESS_BASE}/account/password/change`, {
-            current_password: currentPassword,
-            new_password: newPassword,
-        });
+        const res = await apiClient.post(`${HEADLESS_BASE}/auth/2fa/authenticate`, payload);
+        return res.data;
     }
     catch (error) {
-        throw normaliseApiError(error, 'Auth.PASSWORD_CHANGE_FAILED');
+        throw normaliseApiError(error, 'Auth.MFA_AUTHENTICATE_FAILED');
     }
 }
 // -----------------------------
-// Logout / Session
+// Password Management
 // -----------------------------
-export async function logoutSession() {
+export async function requestPasswordReset(email) {
     try {
-        const headers = {};
-        const csrfToken = getCsrfToken();
-        if (csrfToken) {
-            headers['X-CSRFToken'] = csrfToken;
-        }
-        // CHANGED: axios -> apiClient
-        await apiClient.delete(`${HEADLESS_BASE}/auth/session`, { headers });
+        await apiClient.post(`${USERS_BASE}/reset-request/`, { email });
     }
     catch (error) {
-        if (error.response && [401, 404, 410].includes(error.response.status)) {
-            return;
-        }
-        // eslint-disable-next-line no-console
-        console.error('Logout error:', error);
-    }
-}
-export async function fetchHeadlessSession() {
-    const res = await apiClient.get(`${HEADLESS_BASE}/auth/session`);
-    return res.data;
-}
-// -----------------------------
-// Social login
-// -----------------------------
-export function startSocialLogin(provider) {
-    if (typeof window === 'undefined') {
-        throw normaliseApiError(new Error('Auth.SOCIAL_LOGIN_NOT_IN_BROWSER'), 'Auth.SOCIAL_LOGIN_NOT_IN_BROWSER');
+        throw normaliseApiError(error, 'Auth.RESET_REQUEST_FAILED');
     }
-    window.location.href = `/accounts/${provider}/login/?process=login`;
 }
-// -----------------------------
-// Invitation / access code
-// -----------------------------
-export async function validateAccessCode(code) {
+export async function resetPasswordWithKey(key, newPassword) {
     try {
-        const res = await apiClient.post(`${ACCESS_CODES_BASE}/validate/`, { code });
-        return res.data;
+        await apiClient.post(`${HEADLESS_BASE}/auth/password/reset/key`, { key, password: newPassword });
     }
     catch (error) {
-        throw normaliseApiError(error, 'Auth.ACCESS_CODE_INVALID_OR_INACTIVE');
+        throw normaliseApiError(error, 'Auth.RESET_WITH_KEY_FAILED');
     }
 }
-export async function requestInviteWithCode(email, accessCode) {
-    const payload = { email };
-    if (accessCode) {
-        payload.access_code = accessCode;
-    }
+export async function changePassword(currentPassword, newPassword) {
     try {
-        const res = await apiClient.post(`${USERS_BASE}/invite/`, payload);
-        return res.data;
+        await apiClient.post(`${HEADLESS_BASE}/account/password/change`, {
+            current_password: currentPassword,
+            new_password: newPassword,
+        });
     }
     catch (error) {
-        throw normaliseApiError(error, 'Auth.INVITE_FAILED');
+        throw normaliseApiError(error, 'Auth.PASSWORD_CHANGE_FAILED');
     }
 }
-// -----------------------------
-// Custom password-reset via uid/token
-// -----------------------------
+// Custom UID/Token Reset Flow
 export async function verifyResetToken(uid, token) {
     try {
         const res = await apiClient.get(`${USERS_BASE}/password-reset/${uid}/${token}/`);
@@ -231,100 +135,36 @@ export async function setNewPassword(uid, token, newPassword) {
     }
 }
 // -----------------------------
-// WebAuthn / Passkeys
+// WebAuthn / Passkeys (API Calls Only)
 // -----------------------------
-async function registerPasskeyStart({ passwordless = true } = {}) {
-    ensureWebAuthnSupport();
+export async function getPasskeyRegistrationOptions() {
+    var _a;
     const res = await apiClient.get(`${HEADLESS_BASE}/account/authenticators/webauthn`, {
-        params: passwordless ? { passwordless: true } : {},
+        params: { passwordless: true }
+    });
+    // Extrahiere nested data Struktur von Allauth
+    const data = ((_a = res.data) === null || _a === void 0 ? void 0 : _a.data) || res.data;
+    return data.creation_options || data;
+}
+export async function completePasskeyRegistration(credentialJson, name) {
+    const res = await apiClient.post(`${HEADLESS_BASE}/account/authenticators/webauthn`, {
+        credential: credentialJson,
+        name
     });
-    const responseBody = res.data || {};
-    const payload = responseBody.data || responseBody;
-    const publicKeyJson = (payload.creation_options && payload.creation_options.publicKey) ||
-        payload.publicKey ||
-        payload;
-    return publicKeyJson;
-}
-async function registerPasskeyComplete(credentialJson, name = 'Passkey') {
-    const res = await apiClient.post(`${HEADLESS_BASE}/account/authenticators/webauthn`, { credential: credentialJson, name });
     return res.data;
 }
-export async function registerPasskey(name = 'Passkey') {
-    ensureWebAuthnSupport();
-    if (!hasJsonWebAuthn) {
-        throw normaliseApiError(new Error('Auth.PASSKEY_JSON_HELPERS_UNAVAILABLE'), 'Auth.PASSKEY_JSON_HELPERS_UNAVAILABLE');
-    }
-    const publicKeyJson = await registerPasskeyStart({ passwordless: true });
-    let credential;
-    try {
-        const publicKeyOptions = window.PublicKeyCredential.parseCreationOptionsFromJSON(publicKeyJson);
-        credential = await navigator.credentials.create({ publicKey: publicKeyOptions });
-    }
-    catch (err) {
-        if (err && err.name === 'NotAllowedError') {
-            throw normaliseApiError(err, 'Auth.PASSKEY_CREATION_CANCELLED');
-        }
-        throw err;
-    }
-    if (!credential) {
-        throw normaliseApiError(new Error('Auth.PASSKEY_CREATION_CANCELLED'), 'Auth.PASSKEY_CREATION_CANCELLED');
-    }
-    const credentialJson = serializeCredential(credential);
-    return registerPasskeyComplete(credentialJson, name);
-}
-async function loginWithPasskeyStart() {
-    ensureWebAuthnSupport();
+export async function getPasskeyLoginOptions() {
+    var _a;
     const res = await apiClient.get(`${HEADLESS_BASE}/auth/webauthn/login`);
-    const responseBody = res.data || {};
-    const payload = responseBody.data || responseBody;
-    const requestOptionsJson = (payload.request_options && payload.request_options.publicKey) ||
-        payload.request_options ||
-        payload;
-    return requestOptionsJson;
+    const data = ((_a = res.data) === null || _a === void 0 ? void 0 : _a.data) || res.data;
+    return data.request_options || data;
 }
-async function loginWithPasskeyComplete(credentialJson) {
-    const res = await apiClient.post(`${HEADLESS_BASE}/auth/webauthn/login`, { credential: credentialJson });
+export async function completePasskeyLogin(credentialJson) {
+    const res = await apiClient.post(`${HEADLESS_BASE}/auth/webauthn/login`, {
+        credential: credentialJson
+    });
     return res.data;
 }
-export async function loginWithPasskey() {
-    ensureWebAuthnSupport();
-    if (!hasJsonWebAuthn) {
-        throw normaliseApiError(new Error('Auth.PASSKEY_JSON_HELPERS_UNAVAILABLE'), 'Auth.PASSKEY_JSON_HELPERS_UNAVAILABLE');
-    }
-    const requestOptionsJson = await loginWithPasskeyStart();
-    let assertion;
-    try {
-        const publicKeyOptions = window.PublicKeyCredential.parseRequestOptionsFromJSON(requestOptionsJson);
-        assertion = await navigator.credentials.get({ publicKey: publicKeyOptions });
-    }
-    catch (err) {
-        const e = new Error('Auth.PASSKEY_AUTH_CANCELLED');
-        e.code = 'Auth.PASSKEY_AUTH_CANCELLED';
-        throw e;
-    }
-    if (!assertion) {
-        const e = new Error('Auth.PASSKEY_AUTH_CANCELLED');
-        e.code = 'Auth.PASSKEY_AUTH_CANCELLED';
-        throw e;
-    }
-    const credentialJson = serializeCredential(assertion);
-    let postError = null;
-    try {
-        await loginWithPasskeyComplete(credentialJson);
-    }
-    catch (err) {
-        postError = err;
-    }
-    try {
-        const user = await fetchCurrentUser();
-        return { user };
-    }
-    catch (err) {
-        if (postError)
-            throw normaliseApiError(postError, 'Auth.PASSKEY_FAILED');
-        throw normaliseApiError(err, 'Auth.PASSKEY_FAILED');
-    }
-}
 export async function fetchPasskeys() {
     try {
         const res = await apiClient.get(`${USERS_BASE}/passkeys/`);
@@ -336,7 +176,6 @@ export async function fetchPasskeys() {
 }
 export async function deletePasskey(id) {
     try {
-        // CHANGED: axios -> apiClient
         await apiClient.delete(`${USERS_BASE}/passkeys/${id}/`);
     }
     catch (error) {
@@ -344,77 +183,24 @@ export async function deletePasskey(id) {
     }
 }
 // -----------------------------
-// Authentication: MFA Step
-// -----------------------------
-export async function authenticateWithMFA({ code, credential }) {
-    const payload = {};
-    if (code)
-        payload.code = code;
-    if (credential)
-        payload.credential = credential;
-    try {
-        const res = await apiClient.post(`${HEADLESS_BASE}/auth/2fa/authenticate`, payload);
-        return res.data;
-    }
-    catch (error) {
-        throw normaliseApiError(error, 'Auth.MFA_AUTHENTICATE_FAILED');
-    }
-}
-// -----------------------------
-// Authentication: password
-// -----------------------------
-export async function loginWithPassword(email, password) {
-    var _a, _b, _c;
-    try {
-        await apiClient.post(`${HEADLESS_BASE}/auth/login`, { email, password });
-    }
-    catch (error) {
-        const status = (_a = error.response) === null || _a === void 0 ? void 0 : _a.status;
-        const body = (_b = error.response) === null || _b === void 0 ? void 0 : _b.data;
-        const flows = ((_c = body === null || body === void 0 ? void 0 : body.data) === null || _c === void 0 ? void 0 : _c.flows) || (body === null || body === void 0 ? void 0 : body.flows) || [];
-        const mfaFlow = Array.isArray(flows)
-            ? flows.find((f) => f.id === 'mfa_authenticate')
-            : null;
-        if (status === 401 && mfaFlow && mfaFlow.is_pending) {
-            return {
-                needsMfa: true,
-                availableTypes: mfaFlow.types || [],
-            };
-        }
-        if (status === 409) {
-            // Already logged in
-        }
-        else {
-            throw normaliseApiError(error, 'Auth.LOGIN_FAILED');
-        }
-    }
-    const user = await fetchCurrentUser();
-    return { user, needsMfa: false };
-}
-// -----------------------------
-// Authenticators & MFA
+// Authenticators (TOTP & Recovery)
 // -----------------------------
 export async function fetchAuthenticators() {
     const res = await apiClient.get(`${HEADLESS_BASE}/account/authenticators`);
     const body = res.data || {};
-    const items = Array.isArray(body.data) ? body.data : (Array.isArray(body) ? body : []);
-    return items;
+    return Array.isArray(body.data) ? body.data : (Array.isArray(body) ? body : []);
 }
 export async function requestTotpKey() {
-    var _a;
+    var _a, _b, _c;
     try {
         const res = await apiClient.get(`${HEADLESS_BASE}/account/authenticators/totp`);
-        const body = res.data || {};
-        const data = body.data || body;
-        return {
-            exists: true,
-            authenticator: data,
-        };
+        const data = ((_a = res.data) === null || _a === void 0 ? void 0 : _a.data) || res.data;
+        return { exists: true, authenticator: data };
     }
     catch (error) {
-        const { response } = error;
-        if ((response === null || response === void 0 ? void 0 : response.status) === 404) {
-            const meta = ((_a = response.data) === null || _a === void 0 ? void 0 : _a.meta) || {};
+        // 404 bedeutet: Noch kein TOTP eingerichtet -> Wir bekommen das Secret zum Einrichten
+        if (((_b = error.response) === null || _b === void 0 ? void 0 : _b.status) === 404) {
+            const meta = ((_c = error.response.data) === null || _c === void 0 ? void 0 : _c.meta) || {};
             return {
                 exists: false,
                 secret: meta.secret,
@@ -426,8 +212,7 @@ export async function requestTotpKey() {
 }
 export async function activateTotp(code) {
     try {
-        const res = await apiClient.post(`${HEADLESS_BASE}/account/authenticators/totp`, { code });
-        return res.data;
+        await apiClient.post(`${HEADLESS_BASE}/account/authenticators/totp`, { code });
     }
     catch (error) {
         throw normaliseApiError(error, 'Auth.TOTP_ACTIVATE_FAILED');
@@ -435,67 +220,70 @@ export async function activateTotp(code) {
 }
 export async function deactivateTotp() {
     try {
-        // CHANGED: axios -> apiClient
-        const res = await apiClient.delete(`${HEADLESS_BASE}/account/authenticators/totp`);
-        return res.data;
+        await apiClient.delete(`${HEADLESS_BASE}/account/authenticators/totp`);
     }
     catch (error) {
         throw normaliseApiError(error, 'Auth.TOTP_DEACTIVATE_FAILED');
     }
 }
 export async function fetchRecoveryCodes() {
-    var _a;
+    var _a, _b, _c;
     try {
+        // Versuch, Codes zu laden
         const res = await apiClient.get(`${HEADLESS_BASE}/account/authenticators/recovery-codes`);
-        const body = res.data || {};
-        const data = body.data || body;
-        return data;
+        return ((_a = res.data) === null || _a === void 0 ? void 0 : _a.data) || res.data;
     }
     catch (error) {
-        const status = (_a = error.response) === null || _a === void 0 ? void 0 : _a.status;
-        if (status === 404) {
+        // 404 -> Noch keine Codes -> Generieren
+        if (((_b = error.response) === null || _b === void 0 ? void 0 : _b.status) === 404) {
             const resPost = await apiClient.post(`${HEADLESS_BASE}/account/authenticators/recovery-codes`, {});
-            const body = resPost.data || {};
-            const data = body.data || body;
-            return data;
+            return ((_c = resPost.data) === null || _c === void 0 ? void 0 : _c.data) || resPost.data;
         }
         throw normaliseApiError(error, 'Auth.RECOVERY_CODES_FETCH_FAILED');
     }
 }
 export async function generateRecoveryCodes() {
+    var _a;
     try {
         const res = await apiClient.post(`${HEADLESS_BASE}/account/authenticators/recovery-codes`, {});
-        const body = res.data || {};
-        const data = body.data || body;
-        return data;
+        return ((_a = res.data) === null || _a === void 0 ? void 0 : _a.data) || res.data;
     }
     catch (error) {
         throw normaliseApiError(error, 'Auth.RECOVERY_CODES_GENERATE_FAILED');
     }
 }
-export async function fetchOrGenerateRecoveryCodes() {
+// -----------------------------
+// Invitations & Access Codes
+// -----------------------------
+export async function validateAccessCode(code) {
     try {
-        const res = await apiClient.get(`${HEADLESS_BASE}/mfa/recovery_codes`);
+        const res = await apiClient.post(`${ACCESS_CODES_BASE}/validate/`, { code });
         return res.data;
     }
     catch (error) {
-        const { response } = error;
-        if ((response === null || response === void 0 ? void 0 : response.status) === 404) {
-            const resPost = await apiClient.post(`${HEADLESS_BASE}/mfa/recovery_codes`, {});
-            return resPost.data;
-        }
-        throw normaliseApiError(error, 'Auth.RECOVERY_CODES_FETCH_FAILED');
+        throw normaliseApiError(error, 'Auth.ACCESS_CODE_INVALID_OR_INACTIVE');
     }
 }
-export function isStrongSession(session) {
-    const methods = (session === null || session === void 0 ? void 0 : session.methods) || [];
-    const used = methods.map((m) => m.method);
-    const strongMethods = ['totp', 'recovery_codes', 'webauthn'];
-    return used.some((m) => strongMethods.includes(m));
+export async function requestInviteWithCode(email, accessCode) {
+    const payload = { email };
+    if (accessCode)
+        payload.access_code = accessCode;
+    try {
+        const res = await apiClient.post(`${USERS_BASE}/invite/`, payload);
+        return res.data;
+    }
+    catch (error) {
+        throw normaliseApiError(error, 'Auth.INVITE_FAILED');
+    }
 }
+// -----------------------------
+// Recovery Support (Admin/Support Side)
+// -----------------------------
 export async function requestMfaSupportHelp(emailOrIdentifier, message = '') {
-    const payload = { email: emailOrIdentifier, message };
-    const res = await apiClient.post(`${USERS_BASE}/mfa/support-help/`, payload);
+    const res = await apiClient.post(`${USERS_BASE}/mfa/support-help/`, {
+        email: emailOrIdentifier,
+        message
+    });
     return res.data;
 }
 export async function fetchRecoveryRequests(status = 'pending') {
@@ -503,16 +291,23 @@ export async function fetchRecoveryRequests(status = 'pending') {
     return res.data;
 }
 export async function approveRecoveryRequest(id, supportNote) {
-    const res = await apiClient.post(`/api/support/recovery-requests/${id}/approve/`, { support_note: supportNote || '' });
+    const res = await apiClient.post(`/api/support/recovery-requests/${id}/approve/`, {
+        support_note: supportNote || ''
+    });
     return res.data;
 }
 export async function rejectRecoveryRequest(id, supportNote) {
-    const res = await apiClient.post(`/api/support/recovery-requests/${id}/reject/`, { support_note: supportNote || '' });
+    const res = await apiClient.post(`/api/support/recovery-requests/${id}/reject/`, {
+        support_note: supportNote || ''
+    });
     return res.data;
 }
 export async function loginWithRecoveryPassword(email, password, token) {
     try {
-        await apiClient.post(`/api/support/recovery-requests/recovery-login/${token}/`, { email, password });
+        await apiClient.post(`/api/support/recovery-requests/recovery-login/${token}/`, {
+            email,
+            password
+        });
     }
     catch (error) {
         throw normaliseApiError(error, 'Auth.RECOVERY_LOGIN_FAILED');
@@ -520,39 +315,3 @@ export async function loginWithRecoveryPassword(email, password, token) {
     const user = await fetchCurrentUser();
     return { user, needsMfa: false };
 }
-// -----------------------------
-// Aggregated API object
-// -----------------------------
-export const authApi = {
-    fetchCurrentUser,
-    updateUserProfile,
-    loginWithPassword,
-    requestPasswordReset,
-    changePassword,
-    logoutSession,
-    startSocialLogin,
-    fetchHeadlessSession,
-    verifyResetToken,
-    setNewPassword,
-    loginWithPasskey,
-    registerPasskey,
-    fetchPasskeys,
-    deletePasskey,
-    authenticateWithMFA,
-    fetchAuthenticators,
-    requestTotpKey,
-    activateTotp,
-    deactivateTotp,
-    fetchRecoveryCodes,
-    generateRecoveryCodes,
-    fetchOrGenerateRecoveryCodes,
-    validateAccessCode,
-    requestInviteWithCode,
-    isStrongSession,
-    requestMfaSupportHelp,
-    fetchRecoveryRequests,
-    approveRecoveryRequest,
-    rejectRecoveryRequest,
-    loginWithRecoveryPassword,
-};
-export default authApi;