@micha.bigler/ui-core-micha 2.2.0 → 2.2.2

package/dist/auth/authApi.js

@@ -19,15 +19,6 @@ export async function fetchAuthMethods() {
     const res = await apiClient.get('/api/auth-methods/');
     return res.data || {};
 }
-export async function fetchRegistrationOptions() {
-    try {
-        const res = await apiClient.get(`${USERS_BASE}/registration-options/`);
-        return res.data || {};
-    }
-    catch (error) {
-        throw normaliseApiError(error, 'Auth.REGISTRATION_OPTIONS_FAILED');
-    }
-}
 export async function fetchAuthPolicy() {
     try {
         const res = await apiClient.get(`${USERS_BASE}/auth-policy/`);
@@ -372,16 +363,6 @@ export async function createSignupQr(payload = {}) {
         throw normaliseApiError(error, 'Auth.SIGNUP_QR_CREATE_FAILED');
     }
 }
-export async function requestInviteWithCode(email, accessCode) {
-    if (accessCode) {
-        return submitRegistrationRequest({
-            email,
-            mode: 'self_signup_access_code',
-            accessCode,
-        });
-    }
-    return sendAdminInvite(email);
-}
 // -----------------------------
 // Recovery Support (Admin/Support Side)
 // -----------------------------

package/dist/components/AuthFactorRequirementCard.js

@@ -1,6 +1,6 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import React, { useEffect, useState } from 'react';
-import { Alert, Box, Button, FormControl, FormControlLabel, Radio, RadioGroup, Typography, } from '@mui/material';
+import { Alert, Box, FormControl, FormControlLabel, Radio, RadioGroup, Typography, } from '@mui/material';
 import { useTranslation } from 'react-i18next';
 import { fetchAuthPolicy, updateAuthPolicy } from '../auth/authApi';
 export function AuthFactorRequirementCard() {
@@ -26,20 +26,24 @@ export function AuthFactorRequirementCard() {
             active = false;
         };
     }, []);
-    const save = async () => {
+    const handleChange = async (event) => {
+        const nextValue = event.target.value;
+        const previous = value;
+        setValue(nextValue);
         setBusy(true);
         setError('');
         setSuccess('');
         try {
-            await updateAuthPolicy({ required_auth_factor_count: Number(value) });
+            await updateAuthPolicy({ required_auth_factor_count: Number(nextValue) });
             setSuccess(t('Auth.AUTH_FACTOR_SAVE_SUCCESS', 'Factor requirement saved.'));
         }
         catch (err) {
+            setValue(previous);
             setError(t((err === null || err === void 0 ? void 0 : err.code) || 'Auth.AUTH_POLICY_UPDATE_FAILED', 'Could not save factor requirement.'));
         }
         finally {
             setBusy(false);
         }
     };
-    return (_jsxs(Box, { children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: t('Auth.AUTH_FACTOR_TITLE', 'Authentication Factors') }), _jsx(Typography, { variant: "body2", sx: { mb: 2, color: 'text.secondary' }, children: t('Auth.AUTH_FACTOR_HINT', 'Choose whether one factor is enough or two factors are required.') }), error && _jsx(Alert, { severity: "error", sx: { mb: 2 }, children: error }), success && _jsx(Alert, { severity: "success", sx: { mb: 2 }, children: success }), _jsx(FormControl, { children: _jsxs(RadioGroup, { value: value, onChange: (event) => setValue(event.target.value), children: [_jsx(FormControlLabel, { value: "1", control: _jsx(Radio, {}), label: t('Auth.ONE_FACTOR_LABEL', 'One factor is enough') }), _jsx(FormControlLabel, { value: "2", control: _jsx(Radio, {}), label: t('Auth.TWO_FACTOR_LABEL', 'Two factors are required') })] }) }), _jsx(Button, { variant: "contained", sx: { mt: 2 }, onClick: save, disabled: busy, children: t('Common.SAVE', 'Save') })] }));
+    return (_jsxs(Box, { children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: t('Auth.AUTH_FACTOR_TITLE', 'Authentication Factors') }), _jsx(Typography, { variant: "body2", sx: { mb: 2, color: 'text.secondary' }, children: t('Auth.AUTH_FACTOR_HINT', 'Choose whether one factor is enough or two factors are required.') }), error && _jsx(Alert, { severity: "error", sx: { mb: 2 }, children: error }), success && _jsx(Alert, { severity: "success", sx: { mb: 2 }, children: success }), _jsx(FormControl, { children: _jsxs(RadioGroup, { value: value, onChange: handleChange, children: [_jsx(FormControlLabel, { value: "1", control: _jsx(Radio, { disabled: busy }), label: t('Auth.ONE_FACTOR_LABEL', 'One factor is enough') }), _jsx(FormControlLabel, { value: "2", control: _jsx(Radio, { disabled: busy }), label: t('Auth.TWO_FACTOR_LABEL', 'Two factors are required') })] }) })] }));
 }

package/dist/components/LoginForm.js

@@ -21,6 +21,6 @@ disabled = false, initialIdentifier = '', }) {
     const supportsPasskey = !!onPasskeyLogin &&
         typeof window !== 'undefined' &&
         !!window.PublicKeyCredential;
-    return (_jsxs(Box, { sx: { display: 'flex', flexDirection: 'column', gap: 3 }, children: [error && (_jsx(Typography, { color: "error", gutterBottom: true, children: error })), supportsPasskey && (_jsxs(_Fragment, { children: [_jsx(Button, { variant: "contained", fullWidth: true, type: "button", onClick: onPasskeyLogin, disabled: disabled, children: t('Auth.LOGIN_USE_PASSKEY_BUTTON') }), _jsx(Divider, { sx: { my: 2 }, children: t('Auth.LOGIN_OR') })] })), onSubmit && (_jsxs(Box, { component: "form", onSubmit: handleSubmit, sx: { display: 'flex', flexDirection: 'column', gap: 2 }, children: [_jsx(TextField, { label: t('Auth.EMAIL_LABEL'), type: "email", required: true, fullWidth: true, value: identifier, onChange: (e) => setIdentifier(e.target.value), disabled: disabled }), _jsx(TextField, { label: t('Auth.LOGIN_PASSWORD_LABEL'), type: "password", required: true, fullWidth: true, value: password, onChange: (e) => setPassword(e.target.value), disabled: disabled }), _jsx(Button, { type: "submit", variant: "contained", fullWidth: true, disabled: disabled, children: t('Auth.PAGE_LOGIN_TITLE') })] })), onSocialLogin && (_jsxs(Box, { children: [_jsx(Divider, { sx: { my: 2 }, children: t('Auth.LOGIN_OR') }), _jsx(SocialLoginButtons, { onProviderClick: onSocialLogin, providers: socialProviders })] })), (onSignUp || onForgotPassword) && (_jsxs(Box, { children: [_jsx(Typography, { variant: "subtitle2", sx: { mb: 1 }, children: t('Auth.LOGIN_ACCOUNT_RECOVERY_TITLE') }), _jsxs(Box, { sx: { display: 'flex', gap: 1, flexWrap: 'wrap' }, children: [onSignUp && (_jsx(Button, { type: "button", variant: "outlined", onClick: onSignUp, disabled: disabled, children: t('Auth.LOGIN_SIGNUP_BUTTON') })), onForgotPassword && (_jsx(Button, { type: "button", variant: "outlined", onClick: onForgotPassword, disabled: disabled, children: t('Auth.LOGIN_FORGOT_PASSWORD_BUTTON') }))] })] }))] }));
+    return (_jsxs(Box, { sx: { display: 'flex', flexDirection: 'column', gap: 3 }, children: [error && (_jsx(Typography, { color: "error", gutterBottom: true, children: error })), supportsPasskey && (_jsxs(_Fragment, { children: [_jsx(Button, { variant: "contained", fullWidth: true, type: "button", onClick: onPasskeyLogin, disabled: disabled, children: t('Auth.LOGIN_USE_PASSKEY_BUTTON') }), _jsx(Divider, { sx: { my: 2 }, children: t('Auth.LOGIN_OR') })] })), onSubmit && (_jsxs(Box, { component: "form", onSubmit: handleSubmit, sx: { display: 'flex', flexDirection: 'column', gap: 2 }, children: [_jsx(TextField, { label: t('Auth.EMAIL_LABEL'), type: "email", required: true, fullWidth: true, value: identifier, onChange: (e) => setIdentifier(e.target.value), disabled: disabled }), _jsx(TextField, { label: t('Auth.LOGIN_PASSWORD_LABEL'), type: "password", required: true, fullWidth: true, value: password, onChange: (e) => setPassword(e.target.value), disabled: disabled }), _jsx(Button, { type: "submit", variant: "contained", fullWidth: true, disabled: disabled, children: t('Auth.PAGE_LOGIN_TITLE') })] })), onSocialLogin && (_jsxs(Box, { children: [_jsx(Divider, { sx: { my: 2 }, children: t('Auth.LOGIN_OR') }), _jsx(SocialLoginButtons, { onProviderClick: onSocialLogin, providers: socialProviders })] })), (onSignUp || onForgotPassword) && (_jsxs(Box, { children: [_jsx(Divider, { sx: { my: 2 }, children: t('Auth.LOGIN_OR') }), _jsxs(Box, { sx: { display: 'flex', flexDirection: 'column', gap: 1.5 }, children: [onSignUp && (_jsx(Button, { type: "button", variant: "outlined", onClick: onSignUp, disabled: disabled, fullWidth: true, children: t('Auth.LOGIN_SIGNUP_BUTTON') })), onForgotPassword && (_jsx(Button, { type: "button", variant: "outlined", onClick: onForgotPassword, disabled: disabled, fullWidth: true, children: t('Auth.LOGIN_FORGOT_PASSWORD_BUTTON') }))] })] }))] }));
 }
 ;

package/dist/components/QrSignupManager.js

@@ -1,36 +1,32 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import React, { useState } from 'react';
-import { Alert, Box, Button, Stack, TextField, Typography, } from '@mui/material';
+import React, { useEffect, useRef, useState } from 'react';
+import { Alert, Box, Button, TextField, Typography, } from '@mui/material';
 import { useTranslation } from 'react-i18next';
 import { QRCodeSVG } from 'qrcode.react';
 import { createSignupQr } from '../auth/authApi';
-export function QrSignupManager() {
+export function QrSignupManager({ enabled = false }) {
     const { t } = useTranslation();
     const [label, setLabel] = useState('');
-    const [eventRef, setEventRef] = useState('');
-    const [courseRef, setCourseRef] = useState('');
-    const [groupRef, setGroupRef] = useState('');
     const [busy, setBusy] = useState(false);
     const [error, setError] = useState('');
+    const [success, setSuccess] = useState('');
     const [result, setResult] = useState(null);
+    const hasGeneratedRef = useRef(false);
     const generate = async () => {
+        if (!enabled) {
+            setResult(null);
+            return;
+        }
         setBusy(true);
         setError('');
+        setSuccess('');
         try {
-            const registrationContext = {
-                schema_version: '1',
-            };
-            if (eventRef.trim())
-                registrationContext.event_ref = eventRef.trim();
-            if (courseRef.trim())
-                registrationContext.course_ref = courseRef.trim();
-            if (groupRef.trim())
-                registrationContext.group_ref = groupRef.trim();
             const data = await createSignupQr({
                 label,
-                registration_context: registrationContext,
             });
             setResult(data);
+            hasGeneratedRef.current = true;
+            setSuccess(t('Auth.SIGNUP_QR_SAVE_SUCCESS', 'QR signup link updated.'));
         }
         catch (err) {
             setError(t((err === null || err === void 0 ? void 0 : err.code) || 'Auth.SIGNUP_QR_CREATE_FAILED', 'Could not create signup QR.'));
@@ -39,5 +35,47 @@ export function QrSignupManager() {
             setBusy(false);
         }
     };
-    return (_jsxs(Box, { children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: t('Auth.SIGNUP_QR_MANAGER_TITLE', 'QR Signup') }), _jsx(Typography, { variant: "body2", sx: { mb: 2, color: 'text.secondary' }, children: t('Auth.SIGNUP_QR_MANAGER_HINT', 'Generate a QR code for self-signup and optionally prefill registration context references.') }), error && _jsx(Alert, { severity: "error", sx: { mb: 2 }, children: error }), _jsxs(Stack, { spacing: 2, children: [_jsx(TextField, { label: t('Common.LABEL', 'Label'), value: label, onChange: (event) => setLabel(event.target.value) }), _jsx(TextField, { label: t('Auth.EVENT_REF_LABEL', 'Event reference'), value: eventRef, onChange: (event) => setEventRef(event.target.value) }), _jsx(TextField, { label: t('Auth.COURSE_REF_LABEL', 'Course reference'), value: courseRef, onChange: (event) => setCourseRef(event.target.value) }), _jsx(TextField, { label: t('Auth.GROUP_REF_LABEL', 'Group reference'), value: groupRef, onChange: (event) => setGroupRef(event.target.value) })] }), _jsx(Button, { variant: "contained", sx: { mt: 2 }, onClick: generate, disabled: busy, children: t('Auth.SIGNUP_QR_CREATE_BUTTON', 'Generate QR') }), (result === null || result === void 0 ? void 0 : result.signup_url) && (_jsxs(Box, { sx: { mt: 3 }, children: [_jsx(QRCodeSVG, { value: result.signup_url, size: 180, includeMargin: true }), _jsx(TextField, { label: t('Auth.SIGNUP_QR_LINK_LABEL', 'Signup link'), value: result.signup_url, fullWidth: true, multiline: true, minRows: 2, sx: { mt: 2 }, InputProps: { readOnly: true } })] }))] }));
+    useEffect(() => {
+        if (!enabled) {
+            setResult(null);
+            setError('');
+            setSuccess('');
+            hasGeneratedRef.current = false;
+            return;
+        }
+        if (hasGeneratedRef.current) {
+            return;
+        }
+        let active = true;
+        const ensureInitialQr = async () => {
+            setBusy(true);
+            setError('');
+            setSuccess('');
+            try {
+                const data = await createSignupQr({
+                    label,
+                });
+                if (!active)
+                    return;
+                setResult(data);
+                hasGeneratedRef.current = true;
+                setSuccess(t('Auth.SIGNUP_QR_SAVE_SUCCESS', 'QR signup link updated.'));
+            }
+            catch (err) {
+                if (!active)
+                    return;
+                setError(t((err === null || err === void 0 ? void 0 : err.code) || 'Auth.SIGNUP_QR_CREATE_FAILED', 'Could not create signup QR.'));
+            }
+            finally {
+                if (active) {
+                    setBusy(false);
+                }
+            }
+        };
+        ensureInitialQr();
+        return () => {
+            active = false;
+        };
+    }, [enabled, label, t]);
+    return (_jsxs(Box, { children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: t('Auth.SIGNUP_QR_MANAGER_TITLE', 'QR Signup') }), _jsx(Typography, { variant: "body2", sx: { mb: 2, color: 'text.secondary' }, children: t('Auth.SIGNUP_QR_MANAGER_HINT', 'When QR signup is enabled, a signup QR code is shown here immediately.') }), error && _jsx(Alert, { severity: "error", sx: { mb: 2 }, children: error }), success && _jsx(Alert, { severity: "success", sx: { mb: 2 }, children: success }), !enabled && (_jsx(Alert, { severity: "info", sx: { mb: 2 }, children: t('Auth.SIGNUP_QR_DISABLED_HINT', 'Enable self-signup by QR above to show a QR code here.') })), _jsx(TextField, { label: t('Common.LABEL', 'Label'), value: label, onChange: (event) => setLabel(event.target.value), fullWidth: true, disabled: !enabled || busy }), _jsx(Button, { variant: "contained", sx: { mt: 2 }, onClick: generate, disabled: !enabled || busy, children: t('Common.SAVE', 'Save') }), (result === null || result === void 0 ? void 0 : result.signup_url) && (_jsxs(Box, { sx: { mt: 3 }, children: [_jsx(QRCodeSVG, { value: result.signup_url, size: 180, includeMargin: true }), _jsx(TextField, { label: t('Auth.SIGNUP_QR_LINK_LABEL', 'Signup link'), value: result.signup_url, fullWidth: true, multiline: true, minRows: 2, sx: { mt: 2 }, InputProps: { readOnly: true } })] }))] }));
 }

package/dist/components/RegistrationMethodsManager.js

@@ -17,6 +17,7 @@ export function RegistrationMethodsManager({ onPolicyChange }) {
     const [policy, setPolicy] = useState(EMPTY_POLICY);
     const [domainsText, setDomainsText] = useState('');
     const [busy, setBusy] = useState(false);
+    const [busyField, setBusyField] = useState('');
     const [error, setError] = useState('');
     const [success, setSuccess] = useState('');
     useEffect(() => {
@@ -28,6 +29,8 @@ export function RegistrationMethodsManager({ onPolicyChange }) {
                     return;
                 setPolicy((prev) => (Object.assign(Object.assign({}, prev), data)));
                 setDomainsText(((data === null || data === void 0 ? void 0 : data.allowed_email_domains) || []).join('\n'));
+                if (onPolicyChange)
+                    onPolicyChange(data);
             }
             catch (err) {
                 if (active) {
@@ -38,9 +41,28 @@ export function RegistrationMethodsManager({ onPolicyChange }) {
         return () => {
             active = false;
         };
-    }, [t]);
-    const toggle = (field) => (_event, checked) => {
+    }, [onPolicyChange, t]);
+    const toggle = (field) => async (_event, checked) => {
+        const previous = policy[field];
         setPolicy((prev) => (Object.assign(Object.assign({}, prev), { [field]: checked })));
+        setBusyField(field);
+        setError('');
+        setSuccess('');
+        try {
+            const next = await updateAuthPolicy({ [field]: checked });
+            setPolicy((prev) => (Object.assign(Object.assign({}, prev), next)));
+            setDomainsText(((next === null || next === void 0 ? void 0 : next.allowed_email_domains) || []).join('\n'));
+            setSuccess(t('Auth.AUTH_POLICY_SAVE_SUCCESS', 'Authentication settings saved.'));
+            if (onPolicyChange)
+                onPolicyChange(next);
+        }
+        catch (err) {
+            setPolicy((prev) => (Object.assign(Object.assign({}, prev), { [field]: previous })));
+            setError(t((err === null || err === void 0 ? void 0 : err.code) || 'Auth.AUTH_POLICY_UPDATE_FAILED', 'Could not save authentication settings.'));
+        }
+        finally {
+            setBusyField('');
+        }
     };
     const save = async () => {
         setBusy(true);
@@ -51,7 +73,7 @@ export function RegistrationMethodsManager({ onPolicyChange }) {
                 .split(/\r?\n/)
                 .map((value) => value.trim())
                 .filter(Boolean);
-            const next = await updateAuthPolicy(Object.assign(Object.assign({}, policy), { allowed_email_domains }));
+            const next = await updateAuthPolicy({ allowed_email_domains });
             setPolicy((prev) => (Object.assign(Object.assign({}, prev), next)));
             setDomainsText(((next === null || next === void 0 ? void 0 : next.allowed_email_domains) || allowed_email_domains).join('\n'));
             setSuccess(t('Auth.AUTH_POLICY_SAVE_SUCCESS', 'Authentication settings saved.'));
@@ -65,5 +87,5 @@ export function RegistrationMethodsManager({ onPolicyChange }) {
             setBusy(false);
         }
     };
-    return (_jsxs(Box, { children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: t('Auth.REGISTRATION_METHODS_TITLE', 'Registration Methods') }), _jsx(Typography, { variant: "body2", sx: { mb: 2, color: 'text.secondary' }, children: t('Auth.REGISTRATION_METHODS_HINT', 'Choose which signup and invite flows are active for this app.') }), error && _jsx(Alert, { severity: "error", sx: { mb: 2 }, children: error }), success && _jsx(Alert, { severity: "success", sx: { mb: 2 }, children: success }), _jsxs(Stack, { spacing: 1, children: [_jsx(FormControlLabel, { control: _jsx(Switch, { checked: Boolean(policy.allow_admin_invite), onChange: toggle('allow_admin_invite') }), label: t('Auth.ADMIN_INVITE_LABEL', 'Admin invite') }), _jsx(FormControlLabel, { control: _jsx(Switch, { checked: Boolean(policy.allow_self_signup_access_code), onChange: toggle('allow_self_signup_access_code') }), label: t('Auth.SIGNUP_ACCESS_CODE_LABEL', 'Self-signup with access code') }), _jsx(FormControlLabel, { control: _jsx(Switch, { checked: Boolean(policy.allow_self_signup_open), onChange: toggle('allow_self_signup_open') }), label: t('Auth.SIGNUP_OPEN_LABEL', 'Open self-signup') }), _jsx(FormControlLabel, { control: _jsx(Switch, { checked: Boolean(policy.allow_self_signup_email_domain), onChange: toggle('allow_self_signup_email_domain') }), label: t('Auth.SIGNUP_EMAIL_DOMAIN_LABEL', 'Self-signup by email domain') }), _jsx(FormControlLabel, { control: _jsx(Switch, { checked: Boolean(policy.allow_self_signup_qr), onChange: toggle('allow_self_signup_qr') }), label: t('Auth.SIGNUP_QR_LABEL', 'Self-signup by QR') })] }), _jsx(TextField, { label: t('Auth.ALLOWED_EMAIL_DOMAINS_LABEL', 'Allowed email domains'), helperText: t('Auth.ALLOWED_EMAIL_DOMAINS_HINT', 'One domain per line, e.g. example.org'), multiline: true, minRows: 3, fullWidth: true, sx: { mt: 2 }, value: domainsText, onChange: (event) => setDomainsText(event.target.value) }), _jsx(Button, { variant: "contained", sx: { mt: 2 }, onClick: save, disabled: busy, children: t('Common.SAVE', 'Save') })] }));
+    return (_jsxs(Box, { children: [_jsx(Typography, { variant: "h6", gutterBottom: true, children: t('Auth.REGISTRATION_METHODS_TITLE', 'Registration Methods') }), _jsx(Typography, { variant: "body2", sx: { mb: 2, color: 'text.secondary' }, children: t('Auth.REGISTRATION_METHODS_HINT', 'Choose which signup and invite flows are active for this app.') }), error && _jsx(Alert, { severity: "error", sx: { mb: 2 }, children: error }), success && _jsx(Alert, { severity: "success", sx: { mb: 2 }, children: success }), _jsxs(Stack, { spacing: 1, children: [_jsx(FormControlLabel, { control: (_jsx(Switch, { checked: Boolean(policy.allow_admin_invite), onChange: toggle('allow_admin_invite'), disabled: Boolean(busyField) })), label: t('Auth.ADMIN_INVITE_LABEL', 'Admin invite') }), _jsx(FormControlLabel, { control: (_jsx(Switch, { checked: Boolean(policy.allow_self_signup_access_code), onChange: toggle('allow_self_signup_access_code'), disabled: Boolean(busyField) })), label: t('Auth.SIGNUP_ACCESS_CODE_LABEL', 'Self-signup with access code') }), _jsx(FormControlLabel, { control: (_jsx(Switch, { checked: Boolean(policy.allow_self_signup_open), onChange: toggle('allow_self_signup_open'), disabled: Boolean(busyField) })), label: t('Auth.SIGNUP_OPEN_LABEL', 'Open self-signup') }), _jsx(FormControlLabel, { control: (_jsx(Switch, { checked: Boolean(policy.allow_self_signup_email_domain), onChange: toggle('allow_self_signup_email_domain'), disabled: Boolean(busyField) })), label: t('Auth.SIGNUP_EMAIL_DOMAIN_LABEL', 'Self-signup by email domain') }), _jsx(FormControlLabel, { control: (_jsx(Switch, { checked: Boolean(policy.allow_self_signup_qr), onChange: toggle('allow_self_signup_qr'), disabled: Boolean(busyField) })), label: t('Auth.SIGNUP_QR_LABEL', 'Self-signup by QR') })] }), policy.allow_self_signup_email_domain && !(policy.allowed_email_domains || []).length && (_jsx(Alert, { severity: "info", sx: { mt: 2 }, children: t('Auth.EMAIL_DOMAIN_CURRENTLY_BLOCKED_HINT', 'Email-domain signup is enabled, but it stays blocked until at least one allowed domain is saved.') })), _jsx(TextField, { label: t('Auth.ALLOWED_EMAIL_DOMAINS_LABEL', 'Allowed email domains'), helperText: t('Auth.ALLOWED_EMAIL_DOMAINS_HINT', 'One domain per line, e.g. example.org. You can leave this empty temporarily.'), multiline: true, minRows: 3, fullWidth: true, sx: { mt: 2 }, value: domainsText, onChange: (event) => setDomainsText(event.target.value) }), _jsx(Button, { variant: "contained", sx: { mt: 2 }, onClick: save, disabled: busy, children: t('Common.SAVE', 'Save') })] }));
 }

package/dist/i18n/authTranslations.js

@@ -295,10 +295,76 @@ export const authTranslations = {
         "sw": "Tafadhali ingiza anwani ya barua pepe."
     },
     "Auth.PAGE_SIGNUP_SUBTITLE": {
-        "de": "Geben Sie Ihre E-Mail-Adresse und den Zugangscode ein, um eine Einladung anzufordern.",
-        "fr": "Saisissez votre adresse e-mail et le code d'accès pour demander une invitation.",
-        "en": "Enter your email address and access code to request an invitation.",
-        "sw": "Ingiza barua pepe yako na msimbo wa ufikiaji ili kuomba mwaliko."
+        "de": "Wählen Sie eine Registrierungsart und geben Sie die benötigten Angaben ein.",
+        "fr": "Choisissez une méthode d'inscription et saisissez les informations requises.",
+        "en": "Choose a sign-up method and enter the required details.",
+        "sw": "Chagua njia ya kujisajili na uingize taarifa zinazohitajika."
+    },
+    "Auth.PAGE_SIGNUP_SUBTITLE_ACCESS_CODE": {
+        "de": "Geben Sie Ihre E-Mail-Adresse und den erhaltenen Zugangscode ein.",
+        "fr": "Saisissez votre adresse e-mail et le code d'accès reçu.",
+        "en": "Enter your email address and the access code you received.",
+        "sw": "Ingiza anwani yako ya barua pepe na msimbo wa ufikiaji uliopokea."
+    },
+    "Auth.PAGE_SIGNUP_SUBTITLE_OPEN": {
+        "de": "Geben Sie Ihre E-Mail-Adresse ein, um sich direkt zu registrieren.",
+        "fr": "Saisissez votre adresse e-mail pour vous inscrire directement.",
+        "en": "Enter your email address to sign up directly.",
+        "sw": "Ingiza anwani yako ya barua pepe ili kujisajili moja kwa moja."
+    },
+    "Auth.PAGE_SIGNUP_SUBTITLE_EMAIL_DOMAIN": {
+        "de": "Verwenden Sie eine E-Mail-Adresse aus einer freigegebenen Domain.",
+        "fr": "Utilisez une adresse e-mail provenant d'un domaine autorisé.",
+        "en": "Use an email address from an approved domain.",
+        "sw": "Tumia anwani ya barua pepe kutoka kwenye domeni iliyoidhinishwa."
+    },
+    "Auth.PAGE_SIGNUP_SUBTITLE_QR": {
+        "de": "Öffnen Sie diese Seite über einen gültigen QR-Link und geben Sie dann Ihre E-Mail-Adresse ein.",
+        "fr": "Ouvrez cette page via un lien QR valide, puis saisissez votre adresse e-mail.",
+        "en": "Open this page from a valid QR link, then enter your email address.",
+        "sw": "Fungua ukurasa huu kupitia kiungo halali cha QR, kisha ingiza anwani yako ya barua pepe."
+    },
+    "Auth.PAGE_SIGNUP_SUBTITLE_QR_READY": {
+        "de": "Geben Sie Ihre E-Mail-Adresse ein, um die Registrierung mit diesem QR-Link abzuschließen.",
+        "fr": "Saisissez votre adresse e-mail pour terminer l'inscription avec ce lien QR.",
+        "en": "Enter your email address to complete sign-up with this QR link.",
+        "sw": "Ingiza anwani yako ya barua pepe ili kukamilisha kujisajili kwa kutumia kiungo hiki cha QR."
+    },
+    "Auth.SIGNUP_ACCESS_CODE_TAB": {
+        "de": "Mit Zugangscode",
+        "fr": "Avec code d'accès",
+        "en": "With access code",
+        "sw": "Kwa msimbo wa ufikiaji"
+    },
+    "Auth.SIGNUP_OPEN_TAB": {
+        "de": "Direkte Registrierung",
+        "fr": "Inscription directe",
+        "en": "Direct sign-up",
+        "sw": "Kujisajili moja kwa moja"
+    },
+    "Auth.SIGNUP_EMAIL_DOMAIN_TAB": {
+        "de": "Mit E-Mail-Domain",
+        "fr": "Avec domaine e-mail",
+        "en": "With email domain",
+        "sw": "Kwa domeni ya barua pepe"
+    },
+    "Auth.SIGNUP_QR_TAB": {
+        "de": "Mit QR-Link",
+        "fr": "Avec lien QR",
+        "en": "With QR link",
+        "sw": "Kwa kiungo cha QR"
+    },
+    "Auth.SIGNUP_QR_INVALID": {
+        "de": "Dieser QR-Link ist ungültig oder fehlt.",
+        "fr": "Ce lien QR est invalide ou manquant.",
+        "en": "This QR link is invalid or missing.",
+        "sw": "Kiungo hiki cha QR si sahihi au hakipo."
+    },
+    "Auth.SIGNUP_QR_TOKEN_LABEL": {
+        "de": "QR-Token",
+        "fr": "Jeton QR",
+        "en": "QR token",
+        "sw": "Tokeni ya QR"
     },
     "Auth.EMAIL_LABEL": {
         "de": "E-Mail-Adresse",

package/dist/pages/AccountPage.js

@@ -1,5 +1,5 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import React, { useContext, useMemo } from 'react';
+import React, { useContext, useMemo, useState } from 'react';
 import { Helmet } from 'react-helmet';
 import { useSearchParams } from 'react-router-dom';
 import { Tabs, Tab, Box, Typography, Alert, CircularProgress, Paper, Stack, } from '@mui/material';
@@ -24,6 +24,7 @@ export function AccountPage({ userListExtraColumns = [], userListExtraRowActions
     const { t } = useTranslation();
     const { user, login, loading } = useContext(AuthContext);
     const [searchParams, setSearchParams] = useSearchParams();
+    const [authPolicy, setAuthPolicy] = useState(null);
     // 1. URL State Management
     const currentTabRaw = searchParams.get('tab') || 'profile';
     const currentTab = ['invite', 'bulk-invite-csv', 'access'].includes(currentTabRaw)
@@ -90,5 +91,5 @@ export function AccountPage({ userListExtraColumns = [], userListExtraRowActions
     const activeExtraTab = builtInTabValues.has(safeTab)
         ? null
         : extraTabs.find((tab) => tab.value === safeTab);
-    return (_jsxs(WidePage, { title: t('Account.TITLE', 'Account & Administration'), children: [_jsx(Helmet, { children: _jsxs("title", { children: [t('Account.PAGE_TITLE', 'Account'), " \u2013 ", user.email] }) }), _jsx(Tabs, { value: safeTab, onChange: handleTabChange, variant: "scrollable", scrollButtons: "auto", sx: { mb: 3, borderBottom: 1, borderColor: 'divider' }, children: tabs.map((tab) => (_jsx(Tab, { label: tab.label, value: tab.value }, tab.value))) }), safeTab === 'profile' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(ProfileComponent, { onSubmit: handleProfileSubmit, showName: true, showPrivacy: true, showCookies: true }) })), safeTab === 'security' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(SecurityComponent, { fromRecovery: fromRecovery, fromWeakLogin: fromWeakLogin }) })), safeTab === 'users' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(UserListComponent, { roles: activeRoles, currentUser: user, extraColumns: userListExtraColumns, extraRowActions: userListExtraRowActions, extraContext: userListExtraContext, refreshTrigger: userListRefreshTrigger, canEditUser: userListCanEditUser }) })), safeTab === 'invite' && (_jsx(Box, { sx: { mt: 2 }, children: _jsxs(Stack, { spacing: 2.5, children: [(isSuperUser || perms.can_invite) && (_jsx(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: _jsx(RegistrationMethodsManager, {}) })), (isSuperUser || perms.can_invite) && (_jsx(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: _jsx(AuthFactorRequirementCard, {}) })), (isSuperUser || perms.can_invite) && (_jsx(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: _jsx(UserInviteComponent, {}) })), (isSuperUser || perms.can_manage_access_codes) && (_jsxs(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: [_jsx(Typography, { variant: "body2", sx: { mb: 2, color: 'text.secondary' }, children: t('Account.ACCESS_CODES_HINT', 'Manage access codes for self-registration.') }), _jsx(AccessCodeManager, {})] })), (isSuperUser || perms.can_invite) && showBulkInviteCsvTab && (_jsx(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: _jsx(BulkInviteCsvTab, Object.assign({}, bulkInviteCsvProps)) })), (isSuperUser || perms.can_invite) && (_jsx(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: _jsx(QrSignupManager, {}) }))] }) })), safeTab === 'support' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(SupportRecoveryRequestsTab, {}) })), activeExtraTab && (_jsx(Box, { sx: { mt: 2 }, children: (_a = activeExtraTab.render) === null || _a === void 0 ? void 0 : _a.call(activeExtraTab, { user, perms, isSuperUser, t }) }))] }));
+    return (_jsxs(WidePage, { title: t('Account.TITLE', 'Account & Administration'), children: [_jsx(Helmet, { children: _jsxs("title", { children: [t('Account.PAGE_TITLE', 'Account'), " \u2013 ", user.email] }) }), _jsx(Tabs, { value: safeTab, onChange: handleTabChange, variant: "scrollable", scrollButtons: "auto", sx: { mb: 3, borderBottom: 1, borderColor: 'divider' }, children: tabs.map((tab) => (_jsx(Tab, { label: tab.label, value: tab.value }, tab.value))) }), safeTab === 'profile' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(ProfileComponent, { onSubmit: handleProfileSubmit, showName: true, showPrivacy: true, showCookies: true }) })), safeTab === 'security' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(SecurityComponent, { fromRecovery: fromRecovery, fromWeakLogin: fromWeakLogin }) })), safeTab === 'users' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(UserListComponent, { roles: activeRoles, currentUser: user, extraColumns: userListExtraColumns, extraRowActions: userListExtraRowActions, extraContext: userListExtraContext, refreshTrigger: userListRefreshTrigger, canEditUser: userListCanEditUser }) })), safeTab === 'invite' && (_jsx(Box, { sx: { mt: 2 }, children: _jsxs(Stack, { spacing: 2.5, children: [(isSuperUser || perms.can_invite) && (_jsx(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: _jsx(RegistrationMethodsManager, { onPolicyChange: setAuthPolicy }) })), (isSuperUser || perms.can_invite) && (_jsx(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: _jsx(AuthFactorRequirementCard, {}) })), (isSuperUser || perms.can_invite) && (_jsx(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: _jsx(UserInviteComponent, {}) })), (isSuperUser || perms.can_manage_access_codes) && (_jsxs(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: [_jsx(Typography, { variant: "body2", sx: { mb: 2, color: 'text.secondary' }, children: t('Account.ACCESS_CODES_HINT', 'Manage access codes for self-registration.') }), _jsx(AccessCodeManager, {})] })), (isSuperUser || perms.can_invite) && showBulkInviteCsvTab && (_jsx(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: _jsx(BulkInviteCsvTab, Object.assign({}, bulkInviteCsvProps)) })), (isSuperUser || perms.can_invite) && (_jsx(Paper, { variant: "outlined", sx: { p: 2.5, borderRadius: 2 }, children: _jsx(QrSignupManager, { enabled: Boolean(authPolicy === null || authPolicy === void 0 ? void 0 : authPolicy.allow_self_signup_qr) }) }))] }) })), safeTab === 'support' && (_jsx(Box, { sx: { mt: 2 }, children: _jsx(SupportRecoveryRequestsTab, {}) })), activeExtraTab && (_jsx(Box, { sx: { mt: 2 }, children: (_a = activeExtraTab.render) === null || _a === void 0 ? void 0 : _a.call(activeExtraTab, { user, perms, isSuperUser, t }) }))] }));
 }

package/dist/pages/LoginPage.js

@@ -32,6 +32,21 @@ export function LoginPage() {
         : recoveryTokenRaw;
     // Backward-compatible fallback for legacy links using query parameters.
     const recoveryEmail = hashParams.get('email') || params.get('email') || '';
+    const requestedNext = params.get('next');
+    const getRedirectTarget = (currentUser, options = {}) => {
+        var _a;
+        if (options.forceSecurityRedirect) {
+            return options.forceSecurityRedirect;
+        }
+        const requiresExtra = ((_a = currentUser === null || currentUser === void 0 ? void 0 : currentUser.security_state) === null || _a === void 0 ? void 0 : _a.requires_additional_security) === true;
+        if (requiresExtra) {
+            return '/account?tab=security&from=weak_login';
+        }
+        if (requestedNext && requestedNext.startsWith('/')) {
+            return requestedNext;
+        }
+        return '/';
+    };
     useEffect(() => {
         const socialError = params.get('error') || params.get('social');
         if (socialError) {
@@ -39,30 +54,14 @@ export function LoginPage() {
         }
     }, [location.search]);
     useEffect(() => {
-        var _a;
         if (loading || !user)
             return;
-        const requiresExtra = ((_a = user.security_state) === null || _a === void 0 ? void 0 : _a.requires_additional_security) === true;
-        if (requiresExtra) {
-            navigate('/account?tab=security&from=weak_login', { replace: true });
-        }
-        else {
-            navigate('/', { replace: true });
-        }
-    }, [loading, user, navigate]);
+        navigate(getRedirectTarget(user), { replace: true });
+    }, [loading, user, navigate, requestedNext]);
     // --- Helper: Central Success Logic ---
     const handleLoginSuccess = (user) => {
-        var _a;
         login(user); // Update Context
-        // Check if "Strong Security" is enforced/required but not met
-        const requiresExtra = ((_a = user.security_state) === null || _a === void 0 ? void 0 : _a.requires_additional_security) === true;
-        if (requiresExtra) {
-            navigate('/account?tab=security&from=weak_login');
-        }
-        else {
-            // Standard Redirect (könnte man noch mit ?next=... erweitern)
-            navigate('/');
-        }
+        navigate(getRedirectTarget(user));
     };
     // --- Handlers ---
     const handleSubmitCredentials = async ({ identifier, password }) => {
@@ -72,9 +71,10 @@ export function LoginPage() {
             // A) Recovery Flow
             if (recoveryToken) {
                 const result = await loginWithRecoveryPassword(identifier, password, recoveryToken);
-                // Recovery login implies a specific redirect usually, usually straight to security settings
                 login(result.user);
-                navigate('/account?tab=security&from=recovery');
+                navigate(getRedirectTarget(result.user, {
+                    forceSecurityRedirect: '/account?tab=security&from=recovery',
+                }));
                 return;
             }
             // B) Standard Password Login
@@ -118,9 +118,10 @@ export function LoginPage() {
     const handleMfaSuccess = ({ user, method }) => {
         // MFA component should return the user object after verifying code
         if (method === 'recovery_code') {
-            // Recovery codes often trigger a security check prompt
             login(user);
-            navigate('/account?tab=security&from=recovery');
+            navigate(getRedirectTarget(user, {
+                forceSecurityRedirect: '/account?tab=security&from=recovery',
+            }));
         }
         else {
             handleLoginSuccess(user);

package/dist/pages/PasswordInvitePage.js

@@ -13,6 +13,8 @@ export function PasswordInvitePage() {
     const location = useLocation();
     const navigate = useNavigate();
     const { t } = useTranslation();
+    const searchParams = new URLSearchParams(location.search);
+    const nextPath = searchParams.get('next');
     const [submitting, setSubmitting] = useState(false);
     const [errorKey, setErrorKey] = useState(null);
     const [successKey, setSuccessKey] = useState(null);
@@ -57,7 +59,10 @@ export function PasswordInvitePage() {
             setSuccessKey(isInvite
                 ? 'Auth.RESET_PASSWORD_SUCCESS_INVITE'
                 : 'Auth.RESET_PASSWORD_SUCCESS_RESET');
-            navigate('/login');
+            const target = nextPath
+                ? `/login?next=${encodeURIComponent(nextPath)}`
+                : '/login';
+            navigate(target);
         }
         catch (err) {
             setErrorKey(err.code || 'Auth.RESET_PASSWORD_FAILED');

package/dist/pages/SignUpPage.js

@@ -1,7 +1,7 @@
 import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
 import React, { useContext, useEffect, useMemo, useState } from 'react';
 import { useNavigate, useLocation } from 'react-router-dom';
-import { Alert, Box, Button, Stack, Tab, Tabs, TextField, Typography, } from '@mui/material';
+import { Alert, Box, Button, Stack, TextField, Typography, } from '@mui/material';
 import { Helmet } from 'react-helmet';
 import { useTranslation } from 'react-i18next';
 import { NarrowPage } from '../layout/PageLayout';
@@ -13,6 +13,12 @@ const MODE_LABELS = {
     self_signup_email_domain: 'Auth.SIGNUP_EMAIL_DOMAIN_TAB',
     self_signup_qr: 'Auth.SIGNUP_QR_TAB',
 };
+const MODE_SUBTITLES = {
+    self_signup_access_code: 'Auth.PAGE_SIGNUP_SUBTITLE_ACCESS_CODE',
+    self_signup_open: 'Auth.PAGE_SIGNUP_SUBTITLE_OPEN',
+    self_signup_email_domain: 'Auth.PAGE_SIGNUP_SUBTITLE_EMAIL_DOMAIN',
+    self_signup_qr: 'Auth.PAGE_SIGNUP_SUBTITLE_QR',
+};
 export function SignUpPage() {
     const navigate = useNavigate();
     const location = useLocation();
@@ -41,18 +47,15 @@ export function SignUpPage() {
     const [submitting, setSubmitting] = useState(false);
     const [successKey, setSuccessKey] = useState(null);
     const [errorKey, setErrorKey] = useState(null);
-    const [qrHint, setQrHint] = useState('');
+    const pageSubtitle = useMemo(() => {
+        if (mode === 'self_signup_qr' && tokenFromUrl) {
+            return t('Auth.PAGE_SIGNUP_SUBTITLE_QR_READY', 'Enter your email address to complete sign-up with the QR link you opened.');
+        }
+        return t(MODE_SUBTITLES[mode] || 'Auth.PAGE_SIGNUP_SUBTITLE', 'Choose a sign-up method and enter the required details.');
+    }, [mode, t, tokenFromUrl]);
     useEffect(() => {
         setMode(initialMode);
     }, [initialMode]);
-    useEffect(() => {
-        if (!tokenFromUrl || mode !== 'self_signup_qr') {
-            setQrHint('');
-            return undefined;
-        }
-        setQrHint(t('Auth.SIGNUP_QR_READY', 'QR signup token detected. You can complete your signup now.'));
-        return undefined;
-    }, [mode, tokenFromUrl, t]);
     const handleSubmit = async (event) => {
         event.preventDefault();
         setSuccessKey(null);
@@ -89,7 +92,7 @@ export function SignUpPage() {
     const handleGoToLogin = () => {
         navigate('/login');
     };
-    return (_jsxs(NarrowPage, { title: t('Auth.LOGIN_SIGNUP_BUTTON'), subtitle: t('Auth.PAGE_SIGNUP_SUBTITLE'), children: [_jsx(Helmet, { children: _jsxs("title", { children: [t('App.NAME'), " \u2013 ", t('Auth.LOGIN_SIGNUP_BUTTON')] }) }), successKey && (_jsx(Alert, { severity: "success", sx: { mb: 2 }, children: t(successKey, { email }) })), errorKey && (_jsx(Alert, { severity: "error", sx: { mb: 2 }, children: t(errorKey, t('Auth.INVITE_FAILED', 'Could not complete signup.')) })), signupModes.length > 1 && (_jsx(Tabs, { value: mode, onChange: (_event, next) => setMode(next), variant: "scrollable", scrollButtons: "auto", sx: { mb: 2 }, children: signupModes.map((entry) => (_jsx(Tab, { value: entry, label: t(MODE_LABELS[entry] || entry, entry) }, entry))) })), _jsxs(Box, { component: "form", onSubmit: handleSubmit, sx: { display: 'flex', flexDirection: 'column', gap: 2 }, children: [_jsx(TextField, { label: t('Auth.EMAIL_LABEL'), type: "email", required: true, fullWidth: true, value: email, onChange: (e) => setEmail(e.target.value), disabled: submitting }), mode === 'self_signup_access_code' && (_jsx(TextField, { label: t('Auth.ACCESS_CODE_LABEL'), type: "text", required: true, fullWidth: true, value: accessCode, onChange: (e) => setAccessCode(e.target.value), disabled: submitting })), mode === 'self_signup_email_domain' && (_jsx(Alert, { severity: "info", children: t('Auth.SIGNUP_EMAIL_DOMAIN_HINT', 'Only addresses from configured email domains are allowed for this signup flow.') })), mode === 'self_signup_qr' && (_jsxs(Stack, { spacing: 1, children: [_jsx(Alert, { severity: "info", children: qrHint || t('Auth.SIGNUP_QR_HINT', 'Use a valid QR signup link to continue.') }), _jsx(TextField, { label: t('Auth.SIGNUP_QR_TOKEN_LABEL', 'QR token'), value: tokenFromUrl, fullWidth: true, InputProps: { readOnly: true } })] })), _jsx(Button, { type: "submit", variant: "contained", disabled: submitting || signupModes.length === 0, children: submitting
+    return (_jsxs(NarrowPage, { title: t('Auth.LOGIN_SIGNUP_BUTTON'), subtitle: pageSubtitle, children: [_jsx(Helmet, { children: _jsxs("title", { children: [t('App.NAME'), " \u2013 ", t('Auth.LOGIN_SIGNUP_BUTTON')] }) }), successKey && (_jsx(Alert, { severity: "success", sx: { mb: 2 }, children: t(successKey, { email }) })), errorKey && (_jsx(Alert, { severity: "error", sx: { mb: 2 }, children: t(errorKey, t('Auth.INVITE_FAILED', 'Could not complete signup.')) })), signupModes.length > 1 && (_jsx(Stack, { spacing: 1, sx: { mb: 2 }, children: _jsx(Stack, { spacing: 1, children: signupModes.map((entry) => (_jsx(Button, { variant: mode === entry ? 'contained' : 'outlined', onClick: () => setMode(entry), disabled: submitting, fullWidth: true, children: t(MODE_LABELS[entry] || entry, entry) }, entry))) }) })), _jsxs(Box, { component: "form", onSubmit: handleSubmit, sx: { display: 'flex', flexDirection: 'column', gap: 2 }, children: [_jsx(TextField, { label: t('Auth.EMAIL_LABEL'), type: "email", required: true, fullWidth: true, value: email, onChange: (e) => setEmail(e.target.value), disabled: submitting }), mode === 'self_signup_access_code' && (_jsx(TextField, { label: t('Auth.ACCESS_CODE_LABEL'), type: "text", required: true, fullWidth: true, value: accessCode, onChange: (e) => setAccessCode(e.target.value), disabled: submitting })), mode === 'self_signup_qr' && (_jsx(Stack, { spacing: 1, children: _jsx(TextField, { label: t('Auth.SIGNUP_QR_TOKEN_LABEL', 'QR token'), value: tokenFromUrl, fullWidth: true, InputProps: { readOnly: true } }) })), _jsx(Button, { type: "submit", variant: "contained", disabled: submitting || signupModes.length === 0, children: submitting
                             ? t('Auth.SIGNUP_SUBMITTING')
                             : t('Auth.SIGNUP_SUBMIT') })] }), _jsx(Box, { sx: { mt: 3 }, children: _jsxs(Typography, { variant: "body2", children: [t('Auth.SIGNUP_ALREADY_HAVE_ACCOUNT'), ' ', _jsx(Button, { onClick: handleGoToLogin, variant: "text", size: "small", children: t('Auth.SIGNUP_GO_TO_LOGIN') })] }) })] }));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@micha.bigler/ui-core-micha",
-  "version": "2.2.0",
+  "version": "2.2.2",
   "main": "dist/index.js",
   "module": "dist/index.js",
   "private": false,

package/src/auth/authApi.jsx

@@ -23,15 +23,6 @@ export async function fetchAuthMethods() {
   return res.data || {};
 }
 
-export async function fetchRegistrationOptions() {
-  try {
-    const res = await apiClient.get(`${USERS_BASE}/registration-options/`);
-    return res.data || {};
-  } catch (error) {
-    throw normaliseApiError(error, 'Auth.REGISTRATION_OPTIONS_FAILED');
-  }
-}
-
 export async function fetchAuthPolicy() {
   try {
     const res = await apiClient.get(`${USERS_BASE}/auth-policy/`);
@@ -390,17 +381,6 @@ export async function createSignupQr(payload = {}) {
   }
 }
 
-export async function requestInviteWithCode(email, accessCode) {
-  if (accessCode) {
-    return submitRegistrationRequest({
-      email,
-      mode: 'self_signup_access_code',
-      accessCode,
-    });
-  }
-  return sendAdminInvite(email);
-}
-
 // -----------------------------
 // Recovery Support (Admin/Support Side)
 // -----------------------------

package/src/components/AuthFactorRequirementCard.jsx

@@ -2,7 +2,6 @@ import React, { useEffect, useState } from 'react';
 import {
   Alert,
   Box,
-  Button,
   FormControl,
   FormControlLabel,
   Radio,
@@ -36,14 +35,18 @@ export function AuthFactorRequirementCard() {
     };
   }, []);
 
-  const save = async () => {
+  const handleChange = async (event) => {
+    const nextValue = event.target.value;
+    const previous = value;
+    setValue(nextValue);
     setBusy(true);
     setError('');
     setSuccess('');
     try {
-      await updateAuthPolicy({ required_auth_factor_count: Number(value) });
+      await updateAuthPolicy({ required_auth_factor_count: Number(nextValue) });
       setSuccess(t('Auth.AUTH_FACTOR_SAVE_SUCCESS', 'Factor requirement saved.'));
     } catch (err) {
+      setValue(previous);
       setError(t(err?.code || 'Auth.AUTH_POLICY_UPDATE_FAILED', 'Could not save factor requirement.'));
     } finally {
       setBusy(false);
@@ -61,14 +64,11 @@ export function AuthFactorRequirementCard() {
       {error && <Alert severity="error" sx={{ mb: 2 }}>{error}</Alert>}
       {success && <Alert severity="success" sx={{ mb: 2 }}>{success}</Alert>}
       <FormControl>
-        <RadioGroup value={value} onChange={(event) => setValue(event.target.value)}>
-          <FormControlLabel value="1" control={<Radio />} label={t('Auth.ONE_FACTOR_LABEL', 'One factor is enough')} />
-          <FormControlLabel value="2" control={<Radio />} label={t('Auth.TWO_FACTOR_LABEL', 'Two factors are required')} />
+        <RadioGroup value={value} onChange={handleChange}>
+          <FormControlLabel value="1" control={<Radio disabled={busy} />} label={t('Auth.ONE_FACTOR_LABEL', 'One factor is enough')} />
+          <FormControlLabel value="2" control={<Radio disabled={busy} />} label={t('Auth.TWO_FACTOR_LABEL', 'Two factors are required')} />
         </RadioGroup>
       </FormControl>
-      <Button variant="contained" sx={{ mt: 2 }} onClick={save} disabled={busy}>
-        {t('Common.SAVE', 'Save')}
-      </Button>
     </Box>
   );
 }