@micha.bigler/ui-core-micha 2.1.20 → 2.2.1

package/dist/auth/AuthContext.js

@@ -8,6 +8,7 @@ const DEFAULT_AUTH_METHODS = {
     password_login: true,
     password_reset: true,
     signup: true,
+    signup_modes: ['self_signup_access_code'],
     password_change: true,
     social_login: true,
     social_providers: ['google', 'microsoft'],
@@ -16,6 +17,9 @@ const DEFAULT_AUTH_METHODS = {
     mfa_totp: true,
     mfa_recovery_codes: true,
     mfa_enabled: true,
+    required_auth_factor_count: 1,
+    two_factor_required: false,
+    qr_signup_enabled: false,
 };
 export const AuthProvider = ({ children }) => {
     const [user, setUser] = useState(null);

package/dist/auth/authApi.js

@@ -19,6 +19,24 @@ export async function fetchAuthMethods() {
     const res = await apiClient.get('/api/auth-methods/');
     return res.data || {};
 }
+export async function fetchAuthPolicy() {
+    try {
+        const res = await apiClient.get(`${USERS_BASE}/auth-policy/`);
+        return res.data || {};
+    }
+    catch (error) {
+        throw normaliseApiError(error, 'Auth.AUTH_POLICY_FETCH_FAILED');
+    }
+}
+export async function updateAuthPolicy(payload) {
+    try {
+        const res = await apiClient.patch(`${USERS_BASE}/auth-policy/`, payload);
+        return res.data || {};
+    }
+    catch (error) {
+        throw normaliseApiError(error, 'Auth.AUTH_POLICY_UPDATE_FAILED');
+    }
+}
 export async function updateUserProfile(data) {
     try {
         const res = await apiClient.patch(`${USERS_BASE}/current/`, data);
@@ -309,18 +327,42 @@ export async function validateAccessCode(code) {
         throw normaliseApiError(error, 'Auth.ACCESS_CODE_INVALID_OR_INACTIVE');
     }
 }
-export async function requestInviteWithCode(email, accessCode) {
-    const payload = { email };
+export async function sendAdminInvite(email) {
+    try {
+        const res = await apiClient.post(`${USERS_BASE}/invite/`, { email });
+        return res.data;
+    }
+    catch (error) {
+        throw normaliseApiError(error, 'Auth.INVITE_FAILED');
+    }
+}
+export async function submitRegistrationRequest({ email, mode, accessCode, registrationContextToken, registrationContext, }) {
+    const payload = { email, mode };
     if (accessCode)
         payload.access_code = accessCode;
+    if (registrationContextToken) {
+        payload.registration_context_token = registrationContextToken;
+    }
+    if (registrationContext) {
+        payload.registration_context = registrationContext;
+    }
     try {
-        const res = await apiClient.post(`${USERS_BASE}/invite/`, payload);
+        const res = await apiClient.post(`${USERS_BASE}/register-request/`, payload);
         return res.data;
     }
     catch (error) {
         throw normaliseApiError(error, 'Auth.INVITE_FAILED');
     }
 }
+export async function createSignupQr(payload = {}) {
+    try {
+        const res = await apiClient.post(`${USERS_BASE}/signup-qr/`, payload);
+        return res.data || {};
+    }
+    catch (error) {
+        throw normaliseApiError(error, 'Auth.SIGNUP_QR_CREATE_FAILED');
+    }
+}
 // -----------------------------
 // Recovery Support (Admin/Support Side)
 // -----------------------------

package/dist/components/AccessCodeManager.js

@@ -1,8 +1,9 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // src/auth/components/AccessCodeManager.jsx
 import React, { useEffect, useState } from 'react';
-import { Box, Stack, Typography, Slider, Button, TextField, Chip, Alert, CircularProgress, } from '@mui/material';
-import CloseIcon from '@mui/icons-material/Close';
+import { Box, Stack, Typography, Slider, Button, TextField, Alert, CircularProgress, } from '@mui/material';
+import ContentCopyIcon from '@mui/icons-material/ContentCopy';
+import DeleteIcon from '@mui/icons-material/Delete';
 import { useTranslation } from 'react-i18next';
 // Pfad ggf. anpassen je nach Struktur: von src/auth/components zu src/auth/authApi
 import { fetchAccessCodes, createAccessCode, deleteAccessCode, } from '../auth/authApi';
@@ -21,6 +22,7 @@ export function AccessCodeManager() {
     const [manualCode, setManualCode] = useState('');
     const [errorKey, setErrorKey] = useState(null);
     const [successKey, setSuccessKey] = useState(null);
+    const [copyNotice, setCopyNotice] = useState('');
     // Helper that prefers backend error code if available
     const setErrorFromErrorObject = (err, fallbackCode) => {
         const backendCode = err === null || err === void 0 ? void 0 : err.code;
@@ -93,10 +95,44 @@ export function AccessCodeManager() {
             setErrorFromErrorObject(err, 'Auth.ACCESS_CODE_DELETE_FAILED');
         }
     };
+    const handleCopyCode = async (codeValue) => {
+        var _a;
+        try {
+            if ((_a = navigator === null || navigator === void 0 ? void 0 : navigator.clipboard) === null || _a === void 0 ? void 0 : _a.writeText) {
+                await navigator.clipboard.writeText(codeValue);
+            }
+            else {
+                throw new Error('Clipboard API unavailable');
+            }
+            setCopyNotice(t('Auth.ACCESS_CODE_COPY_SUCCESS', 'Code kopiert.'));
+            window.setTimeout(() => setCopyNotice(''), 1800);
+        }
+        catch (_err) {
+            setCopyNotice(t('Auth.ACCESS_CODE_COPY_FALLBACK', 'Code markieren und mit Ctrl+C kopieren.'));
+            window.setTimeout(() => setCopyNotice(''), 2200);
+        }
+    };
     if (loading) {
         return (_jsx(Box, { sx: { py: 3, display: 'flex', justifyContent: 'center' }, children: _jsx(CircularProgress, {}) }));
     }
-    return (_jsxs(Box, { children: [errorKey && (_jsx(Alert, { severity: "error", sx: { mb: 2 }, children: t(errorKey) })), successKey && (_jsx(Alert, { severity: "success", sx: { mb: 2 }, children: t(successKey) })), _jsxs(Box, { sx: { mb: 3 }, children: [_jsx(Typography, { variant: "subtitle1", gutterBottom: true, children: t('Auth.ACCESS_CODE_SECTION_ACTIVE') }), codes.length === 0 ? (_jsx(Typography, { variant: "body2", children: t('Auth.ACCESS_CODE_NONE') })) : (_jsx(Stack, { direction: "row", flexWrap: "wrap", gap: 1, children: codes.map((code) => (_jsx(Chip, { label: code.code, onDelete: () => handleDelete(code.id), deleteIcon: _jsx(CloseIcon, {}) }, code.id))) }))] }), _jsxs(Box, { sx: { mb: 3 }, children: [_jsx(Typography, { variant: "subtitle1", gutterBottom: true, children: t('Auth.ACCESS_CODE_SECTION_GENERATE') }), _jsxs(Box, { sx: { maxWidth: 360 }, children: [_jsx(Typography, { variant: "body2", gutterBottom: true, children: t('Auth.ACCESS_CODE_LENGTH_LABEL', { length }) }), _jsx(Slider, { min: 6, max: 32, step: 1, value: length, onChange: (_, val) => setLength(val), valueLabelDisplay: "auto", disabled: submitting })] }), _jsx(Button, { variant: "contained", size: "small", sx: Object.assign(Object.assign({}, actionButtonSx), { mt: 1 }), onClick: handleGenerateClick, disabled: submitting, children: submitting
+    return (_jsxs(Box, { children: [errorKey && (_jsx(Alert, { severity: "error", sx: { mb: 2 }, children: t(errorKey) })), successKey && (_jsx(Alert, { severity: "success", sx: { mb: 2 }, children: t(successKey) })), copyNotice && (_jsx(Alert, { severity: "info", sx: { mb: 2 }, children: copyNotice })), _jsxs(Box, { sx: { mb: 3 }, children: [_jsx(Typography, { variant: "subtitle1", gutterBottom: true, children: t('Auth.ACCESS_CODE_SECTION_ACTIVE') }), codes.length === 0 ? (_jsx(Typography, { variant: "body2", children: t('Auth.ACCESS_CODE_NONE') })) : (_jsx(Stack, { spacing: 1, children: codes.map((code) => (_jsxs(Box, { sx: {
+                                display: 'grid',
+                                gridTemplateColumns: '1fr auto auto',
+                                gap: 1,
+                                alignItems: 'center',
+                                width: '100%',
+                                maxWidth: 560,
+                            }, children: [_jsx(TextField, { value: code.code, size: "small", fullWidth: true, slotProps: {
+                                        input: {
+                                            readOnly: true,
+                                            onFocus: (event) => event.target.select(),
+                                        },
+                                    }, sx: {
+                                        '& .MuiInputBase-input': {
+                                            fontFamily: 'monospace',
+                                            letterSpacing: '0.04em',
+                                        },
+                                    } }), _jsx(Button, { variant: "outlined", size: "small", onClick: () => handleCopyCode(code.code), startIcon: _jsx(ContentCopyIcon, { fontSize: "small" }), sx: actionButtonSx, children: t('Auth.ACCESS_CODE_COPY_BUTTON', t('Auth.MFA_RECOVERY_COPY_TOOLTIP', 'Kopieren')) }), _jsx(Button, { variant: "outlined", color: "error", size: "small", onClick: () => handleDelete(code.id), startIcon: _jsx(DeleteIcon, { fontSize: "small" }), sx: actionButtonSx, children: t('Common.DELETE', 'Löschen') })] }, code.id))) }))] }), _jsxs(Box, { sx: { mb: 3 }, children: [_jsx(Typography, { variant: "subtitle1", gutterBottom: true, children: t('Auth.ACCESS_CODE_SECTION_GENERATE') }), _jsxs(Box, { sx: { maxWidth: 360 }, children: [_jsx(Typography, { variant: "body2", gutterBottom: true, children: t('Auth.ACCESS_CODE_LENGTH_LABEL', { length }) }), _jsx(Slider, { min: 6, max: 32, step: 1, value: length, onChange: (_, val) => setLength(val), valueLabelDisplay: "auto", disabled: submitting })] }), _jsx(Button, { variant: "contained", size: "small", sx: Object.assign(Object.assign({}, actionButtonSx), { mt: 1 }), onClick: handleGenerateClick, disabled: submitting, children: submitting
                             ? t('Auth.SAVE_BUTTON_LOADING')
                             : t('Auth.ACCESS_CODE_GENERATE_BUTTON') })] }), _jsxs(Box, { sx: { mb: 2, maxWidth: 360 }, children: [_jsx(Typography, { variant: "subtitle1", gutterBottom: true, children: t('Auth.ACCESS_CODE_SECTION_MANUAL') }), _jsxs(Box, { sx: { display: 'flex', gap: 1, alignItems: 'center' }, children: [_jsx(TextField, { label: t('Auth.ACCESS_CODE_LABEL'), fullWidth: true, size: "small", value: manualCode, onChange: (e) => setManualCode(e.target.value), disabled: submitting }), _jsx(Button, { variant: "contained", size: "small", onClick: handleAddManual, disabled: submitting, sx: actionButtonSx, children: t('Auth.ACCESS_CODE_ADD_BUTTON') })] })] })] }));
 }

package/dist/components/AuthFactorRequirementCard.js

@@ -0,0 +1,49 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import React, { useEffect, useState } from 'react';
+import { Alert, Box, FormControl, FormControlLabel, Radio, RadioGroup, Typography, } from '@mui/material';
+import { useTranslation } from 'react-i18next';
+import { fetchAuthPolicy, updateAuthPolicy } from '../auth/authApi';
+export function AuthFactorRequirementCard() {
+    const { t } = useTranslation();
+    const [value, setValue] = useState('1');
+    const [busy, setBusy] = useState(false);
+    const [error, setError] = useState('');
+    const [success, setSuccess] = useState('');
+    useEffect(() => {
+        let active = true;
+        (async () => {
+            try {
+                const data = await fetchAuthPolicy();
+                if (active) {
+                    setValue(String((data === null || data === void 0 ? void 0 : data.required_auth_factor_count) || 1));
+                }
+            }
+            catch (_a) {
+                // Keep defaults when policy is unavailable.
+            }
+        })();
+        return () => {
+            active = false;
+        };
+    }, []);
+    const handleChange = async (event) => {
+        const nextValue = event.target.value;
+        const previous = value;
+        setValue(nextValue);
+        setBusy(true);
+        setError('');
+        setSuccess('');
+        try {
+            await updateAuthPolicy({ required_auth_factor_count: Number(nextValue) });
+            setSuccess(t('Auth.AUTH_FACTOR_SAVE_SUCCESS', 'Factor requirement saved.'));
+        }
+        catch (err) {
+            setValue(previous);
+            setError(t((err === null || err === void 0 ? void 0 : err.code) || 'Auth.AUTH_POLICY_UPDATE_FAILED', 'Could not save factor requirement.'));
+        }
+        finally {
+            setBusy(false);
+        }
+    };
+    return (_jsxs(Box, { children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: t('Auth.AUTH_FACTOR_TITLE', 'Authentication Factors') }), _jsx(Typography, { variant: "body2", sx: { mb: 2, color: 'text.secondary' }, children: t('Auth.AUTH_FACTOR_HINT', 'Choose whether one factor is enough or two factors are required.') }), error && _jsx(Alert, { severity: "error", sx: { mb: 2 }, children: error }), success && _jsx(Alert, { severity: "success", sx: { mb: 2 }, children: success }), _jsx(FormControl, { children: _jsxs(RadioGroup, { value: value, onChange: handleChange, children: [_jsx(FormControlLabel, { value: "1", control: _jsx(Radio, { disabled: busy }), label: t('Auth.ONE_FACTOR_LABEL', 'One factor is enough') }), _jsx(FormControlLabel, { value: "2", control: _jsx(Radio, { disabled: busy }), label: t('Auth.TWO_FACTOR_LABEL', 'Two factors are required') })] }) })] }));
+}

package/dist/components/BulkInviteCsvTab.js

@@ -2,7 +2,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import React, { useMemo, useState } from 'react';
 import { Box, Button, Typography, Alert, LinearProgress, Table, TableBody, TableCell, TableContainer, TableHead, TableRow, Paper, } from '@mui/material';
 import { useTranslation } from 'react-i18next';
-import { requestInviteWithCode } from '../auth/authApi';
+import { sendAdminInvite } from '../auth/authApi';
 function parseEmailsFromCsv(text) {
     if (!text)
         return [];
@@ -24,7 +24,7 @@ function parseEmailsFromCsv(text) {
     });
     return Array.from(new Set(emails.map((e) => e.toLowerCase())));
 }
-export function BulkInviteCsvTab({ inviteFn = (email) => requestInviteWithCode(email, null), onCompleted, }) {
+export function BulkInviteCsvTab({ inviteFn = (email) => sendAdminInvite(email), onCompleted, }) {
     const { t } = useTranslation();
     const actionButtonSx = {
         minWidth: 120,

package/dist/components/LoginForm.js

@@ -21,6 +21,6 @@ disabled = false, initialIdentifier = '', }) {
     const supportsPasskey = !!onPasskeyLogin &&
         typeof window !== 'undefined' &&
         !!window.PublicKeyCredential;
-    return (_jsxs(Box, { sx: { display: 'flex', flexDirection: 'column', gap: 3 }, children: [error && (_jsx(Typography, { color: "error", gutterBottom: true, children: error })), supportsPasskey && (_jsxs(_Fragment, { children: [_jsx(Button, { variant: "contained", fullWidth: true, type: "button", onClick: onPasskeyLogin, disabled: disabled, children: t('Auth.LOGIN_USE_PASSKEY_BUTTON') }), _jsx(Divider, { sx: { my: 2 }, children: t('Auth.LOGIN_OR') })] })), onSubmit && (_jsxs(Box, { component: "form", onSubmit: handleSubmit, sx: { display: 'flex', flexDirection: 'column', gap: 2 }, children: [_jsx(TextField, { label: t('Auth.EMAIL_LABEL'), type: "email", required: true, fullWidth: true, value: identifier, onChange: (e) => setIdentifier(e.target.value), disabled: disabled }), _jsx(TextField, { label: t('Auth.LOGIN_PASSWORD_LABEL'), type: "password", required: true, fullWidth: true, value: password, onChange: (e) => setPassword(e.target.value), disabled: disabled }), _jsx(Button, { type: "submit", variant: "contained", fullWidth: true, disabled: disabled, children: t('Auth.PAGE_LOGIN_TITLE') })] })), onSocialLogin && (_jsxs(Box, { children: [_jsx(Divider, { sx: { my: 2 }, children: t('Auth.LOGIN_OR') }), _jsx(SocialLoginButtons, { onProviderClick: onSocialLogin, providers: socialProviders })] })), (onSignUp || onForgotPassword) && (_jsxs(Box, { children: [_jsx(Typography, { variant: "subtitle2", sx: { mb: 1 }, children: t('Auth.LOGIN_ACCOUNT_RECOVERY_TITLE') }), _jsxs(Box, { sx: { display: 'flex', gap: 1, flexWrap: 'wrap' }, children: [onSignUp && (_jsx(Button, { type: "button", variant: "outlined", onClick: onSignUp, disabled: disabled, children: t('Auth.LOGIN_SIGNUP_BUTTON') })), onForgotPassword && (_jsx(Button, { type: "button", variant: "outlined", onClick: onForgotPassword, disabled: disabled, children: t('Auth.LOGIN_FORGOT_PASSWORD_BUTTON') }))] })] }))] }));
+    return (_jsxs(Box, { sx: { display: 'flex', flexDirection: 'column', gap: 3 }, children: [error && (_jsx(Typography, { color: "error", gutterBottom: true, children: error })), supportsPasskey && (_jsxs(_Fragment, { children: [_jsx(Button, { variant: "contained", fullWidth: true, type: "button", onClick: onPasskeyLogin, disabled: disabled, children: t('Auth.LOGIN_USE_PASSKEY_BUTTON') }), _jsx(Divider, { sx: { my: 2 }, children: t('Auth.LOGIN_OR') })] })), onSubmit && (_jsxs(Box, { component: "form", onSubmit: handleSubmit, sx: { display: 'flex', flexDirection: 'column', gap: 2 }, children: [_jsx(TextField, { label: t('Auth.EMAIL_LABEL'), type: "email", required: true, fullWidth: true, value: identifier, onChange: (e) => setIdentifier(e.target.value), disabled: disabled }), _jsx(TextField, { label: t('Auth.LOGIN_PASSWORD_LABEL'), type: "password", required: true, fullWidth: true, value: password, onChange: (e) => setPassword(e.target.value), disabled: disabled }), _jsx(Button, { type: "submit", variant: "contained", fullWidth: true, disabled: disabled, children: t('Auth.PAGE_LOGIN_TITLE') })] })), onSocialLogin && (_jsxs(Box, { children: [_jsx(Divider, { sx: { my: 2 }, children: t('Auth.LOGIN_OR') }), _jsx(SocialLoginButtons, { onProviderClick: onSocialLogin, providers: socialProviders })] })), (onSignUp || onForgotPassword) && (_jsxs(Box, { children: [_jsx(Divider, { sx: { my: 2 }, children: t('Auth.LOGIN_OR') }), _jsxs(Box, { sx: { display: 'flex', flexDirection: 'column', gap: 1.5 }, children: [onSignUp && (_jsx(Button, { type: "button", variant: "outlined", onClick: onSignUp, disabled: disabled, fullWidth: true, children: t('Auth.LOGIN_SIGNUP_BUTTON') })), onForgotPassword && (_jsx(Button, { type: "button", variant: "outlined", onClick: onForgotPassword, disabled: disabled, fullWidth: true, children: t('Auth.LOGIN_FORGOT_PASSWORD_BUTTON') }))] })] }))] }));
 }
 ;

package/dist/components/QrSignupManager.js

@@ -0,0 +1,81 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import React, { useEffect, useRef, useState } from 'react';
+import { Alert, Box, Button, TextField, Typography, } from '@mui/material';
+import { useTranslation } from 'react-i18next';
+import { QRCodeSVG } from 'qrcode.react';
+import { createSignupQr } from '../auth/authApi';
+export function QrSignupManager({ enabled = false }) {
+    const { t } = useTranslation();
+    const [label, setLabel] = useState('');
+    const [busy, setBusy] = useState(false);
+    const [error, setError] = useState('');
+    const [success, setSuccess] = useState('');
+    const [result, setResult] = useState(null);
+    const hasGeneratedRef = useRef(false);
+    const generate = async () => {
+        if (!enabled) {
+            setResult(null);
+            return;
+        }
+        setBusy(true);
+        setError('');
+        setSuccess('');
+        try {
+            const data = await createSignupQr({
+                label,
+            });
+            setResult(data);
+            hasGeneratedRef.current = true;
+            setSuccess(t('Auth.SIGNUP_QR_SAVE_SUCCESS', 'QR signup link updated.'));
+        }
+        catch (err) {
+            setError(t((err === null || err === void 0 ? void 0 : err.code) || 'Auth.SIGNUP_QR_CREATE_FAILED', 'Could not create signup QR.'));
+        }
+        finally {
+            setBusy(false);
+        }
+    };
+    useEffect(() => {
+        if (!enabled) {
+            setResult(null);
+            setError('');
+            setSuccess('');
+            hasGeneratedRef.current = false;
+            return;
+        }
+        if (hasGeneratedRef.current) {
+            return;
+        }
+        let active = true;
+        const ensureInitialQr = async () => {
+            setBusy(true);
+            setError('');
+            setSuccess('');
+            try {
+                const data = await createSignupQr({
+                    label,
+                });
+                if (!active)
+                    return;
+                setResult(data);
+                hasGeneratedRef.current = true;
+                setSuccess(t('Auth.SIGNUP_QR_SAVE_SUCCESS', 'QR signup link updated.'));
+            }
+            catch (err) {
+                if (!active)
+                    return;
+                setError(t((err === null || err === void 0 ? void 0 : err.code) || 'Auth.SIGNUP_QR_CREATE_FAILED', 'Could not create signup QR.'));
+            }
+            finally {
+                if (active) {
+                    setBusy(false);
+                }
+            }
+        };
+        ensureInitialQr();
+        return () => {
+            active = false;
+        };
+    }, [enabled, label, t]);
+    return (_jsxs(Box, { children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: t('Auth.SIGNUP_QR_MANAGER_TITLE', 'QR Signup') }), _jsx(Typography, { variant: "body2", sx: { mb: 2, color: 'text.secondary' }, children: t('Auth.SIGNUP_QR_MANAGER_HINT', 'When QR signup is enabled, a signup QR code is shown here immediately.') }), error && _jsx(Alert, { severity: "error", sx: { mb: 2 }, children: error }), success && _jsx(Alert, { severity: "success", sx: { mb: 2 }, children: success }), !enabled && (_jsx(Alert, { severity: "info", sx: { mb: 2 }, children: t('Auth.SIGNUP_QR_DISABLED_HINT', 'Enable self-signup by QR above to show a QR code here.') })), _jsx(TextField, { label: t('Common.LABEL', 'Label'), value: label, onChange: (event) => setLabel(event.target.value), fullWidth: true, disabled: !enabled || busy }), _jsx(Button, { variant: "contained", sx: { mt: 2 }, onClick: generate, disabled: !enabled || busy, children: t('Common.SAVE', 'Save') }), (result === null || result === void 0 ? void 0 : result.signup_url) && (_jsxs(Box, { sx: { mt: 3 }, children: [_jsx(QRCodeSVG, { value: result.signup_url, size: 180, includeMargin: true }), _jsx(TextField, { label: t('Auth.SIGNUP_QR_LINK_LABEL', 'Signup link'), value: result.signup_url, fullWidth: true, multiline: true, minRows: 2, sx: { mt: 2 }, InputProps: { readOnly: true } })] }))] }));
+}

package/dist/components/RegistrationMethodsManager.js

@@ -0,0 +1,91 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import React, { useEffect, useState } from 'react';
+import { Alert, Box, Button, FormControlLabel, Stack, Switch, TextField, Typography, } from '@mui/material';
+import { useTranslation } from 'react-i18next';
+import { fetchAuthPolicy, updateAuthPolicy } from '../auth/authApi';
+const EMPTY_POLICY = {
+    allow_admin_invite: true,
+    allow_self_signup_access_code: false,
+    allow_self_signup_open: false,
+    allow_self_signup_email_domain: false,
+    allow_self_signup_qr: false,
+    allowed_email_domains: [],
+    required_auth_factor_count: 1,
+};
+export function RegistrationMethodsManager({ onPolicyChange }) {
+    const { t } = useTranslation();
+    const [policy, setPolicy] = useState(EMPTY_POLICY);
+    const [domainsText, setDomainsText] = useState('');
+    const [busy, setBusy] = useState(false);
+    const [busyField, setBusyField] = useState('');
+    const [error, setError] = useState('');
+    const [success, setSuccess] = useState('');
+    useEffect(() => {
+        let active = true;
+        (async () => {
+            try {
+                const data = await fetchAuthPolicy();
+                if (!active)
+                    return;
+                setPolicy((prev) => (Object.assign(Object.assign({}, prev), data)));
+                setDomainsText(((data === null || data === void 0 ? void 0 : data.allowed_email_domains) || []).join('\n'));
+                if (onPolicyChange)
+                    onPolicyChange(data);
+            }
+            catch (err) {
+                if (active) {
+                    setError(t((err === null || err === void 0 ? void 0 : err.code) || 'Auth.AUTH_POLICY_FETCH_FAILED', 'Could not load authentication policy.'));
+                }
+            }
+        })();
+        return () => {
+            active = false;
+        };
+    }, [onPolicyChange, t]);
+    const toggle = (field) => async (_event, checked) => {
+        const previous = policy[field];
+        setPolicy((prev) => (Object.assign(Object.assign({}, prev), { [field]: checked })));
+        setBusyField(field);
+        setError('');
+        setSuccess('');
+        try {
+            const next = await updateAuthPolicy({ [field]: checked });
+            setPolicy((prev) => (Object.assign(Object.assign({}, prev), next)));
+            setDomainsText(((next === null || next === void 0 ? void 0 : next.allowed_email_domains) || []).join('\n'));
+            setSuccess(t('Auth.AUTH_POLICY_SAVE_SUCCESS', 'Authentication settings saved.'));
+            if (onPolicyChange)
+                onPolicyChange(next);
+        }
+        catch (err) {
+            setPolicy((prev) => (Object.assign(Object.assign({}, prev), { [field]: previous })));
+            setError(t((err === null || err === void 0 ? void 0 : err.code) || 'Auth.AUTH_POLICY_UPDATE_FAILED', 'Could not save authentication settings.'));
+        }
+        finally {
+            setBusyField('');
+        }
+    };
+    const save = async () => {
+        setBusy(true);
+        setError('');
+        setSuccess('');
+        try {
+            const allowed_email_domains = domainsText
+                .split(/\r?\n/)
+                .map((value) => value.trim())
+                .filter(Boolean);
+            const next = await updateAuthPolicy({ allowed_email_domains });
+            setPolicy((prev) => (Object.assign(Object.assign({}, prev), next)));
+            setDomainsText(((next === null || next === void 0 ? void 0 : next.allowed_email_domains) || allowed_email_domains).join('\n'));
+            setSuccess(t('Auth.AUTH_POLICY_SAVE_SUCCESS', 'Authentication settings saved.'));
+            if (onPolicyChange)
+                onPolicyChange(next);
+        }
+        catch (err) {
+            setError(t((err === null || err === void 0 ? void 0 : err.code) || 'Auth.AUTH_POLICY_UPDATE_FAILED', 'Could not save authentication settings.'));
+        }
+        finally {
+            setBusy(false);
+        }
+    };
+    return (_jsxs(Box, { children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: t('Auth.REGISTRATION_METHODS_TITLE', 'Registration Methods') }), _jsx(Typography, { variant: "body2", sx: { mb: 2, color: 'text.secondary' }, children: t('Auth.REGISTRATION_METHODS_HINT', 'Choose which signup and invite flows are active for this app.') }), error && _jsx(Alert, { severity: "error", sx: { mb: 2 }, children: error }), success && _jsx(Alert, { severity: "success", sx: { mb: 2 }, children: success }), _jsxs(Stack, { spacing: 1, children: [_jsx(FormControlLabel, { control: (_jsx(Switch, { checked: Boolean(policy.allow_admin_invite), onChange: toggle('allow_admin_invite'), disabled: Boolean(busyField) })), label: t('Auth.ADMIN_INVITE_LABEL', 'Admin invite') }), _jsx(FormControlLabel, { control: (_jsx(Switch, { checked: Boolean(policy.allow_self_signup_access_code), onChange: toggle('allow_self_signup_access_code'), disabled: Boolean(busyField) })), label: t('Auth.SIGNUP_ACCESS_CODE_LABEL', 'Self-signup with access code') }), _jsx(FormControlLabel, { control: (_jsx(Switch, { checked: Boolean(policy.allow_self_signup_open), onChange: toggle('allow_self_signup_open'), disabled: Boolean(busyField) })), label: t('Auth.SIGNUP_OPEN_LABEL', 'Open self-signup') }), _jsx(FormControlLabel, { control: (_jsx(Switch, { checked: Boolean(policy.allow_self_signup_email_domain), onChange: toggle('allow_self_signup_email_domain'), disabled: Boolean(busyField) })), label: t('Auth.SIGNUP_EMAIL_DOMAIN_LABEL', 'Self-signup by email domain') }), _jsx(FormControlLabel, { control: (_jsx(Switch, { checked: Boolean(policy.allow_self_signup_qr), onChange: toggle('allow_self_signup_qr'), disabled: Boolean(busyField) })), label: t('Auth.SIGNUP_QR_LABEL', 'Self-signup by QR') })] }), policy.allow_self_signup_email_domain && !(policy.allowed_email_domains || []).length && (_jsx(Alert, { severity: "info", sx: { mt: 2 }, children: t('Auth.EMAIL_DOMAIN_CURRENTLY_BLOCKED_HINT', 'Email-domain signup is enabled, but it stays blocked until at least one allowed domain is saved.') })), _jsx(TextField, { label: t('Auth.ALLOWED_EMAIL_DOMAINS_LABEL', 'Allowed email domains'), helperText: t('Auth.ALLOWED_EMAIL_DOMAINS_HINT', 'One domain per line, e.g. example.org. You can leave this empty temporarily.'), multiline: true, minRows: 3, fullWidth: true, sx: { mt: 2 }, value: domainsText, onChange: (event) => setDomainsText(event.target.value) }), _jsx(Button, { variant: "contained", sx: { mt: 2 }, onClick: save, disabled: busy, children: t('Common.SAVE', 'Save') })] }));
+}

package/dist/components/UserInviteComponent.js

@@ -1,7 +1,7 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import React, { useState } from 'react';
 import { Box, TextField, Button, Typography, Alert, CircularProgress } from '@mui/material';
-import { requestInviteWithCode } from '../auth/authApi';
+import { sendAdminInvite } from '../auth/authApi';
 import { useTranslation } from 'react-i18next';
 export function UserInviteComponent() {
     const { t } = useTranslation();
@@ -22,9 +22,7 @@ export function UserInviteComponent() {
             return;
         setLoading(true);
         try {
-            // FIX: 2nd parameter is accessCode. For admin invites without code, we pass null.
-            // Previously, 'apiUrl' was passed here incorrectly.
-            const data = await requestInviteWithCode(inviteEmail, null);
+            const data = await sendAdminInvite(inviteEmail);
             setInviteEmail('');
             setMessage(data.detail || t('Auth.INVITE_SENT_SUCCESS', 'Invitation sent.'));
         }