@nsxbet/admin-sdk 0.5.0 → 0.6.0

package/dist/auth/client/gateway-token.js

@@ -0,0 +1,89 @@
+export class GatewayTimeoutError extends Error {
+    constructor(gatewayUrl, timeoutMs) {
+        super(`Gateway at ${gatewayUrl} did not respond within ${timeoutMs}ms`);
+        Object.defineProperty(this, "gatewayUrl", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: gatewayUrl
+        });
+        Object.defineProperty(this, "timeoutMs", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: timeoutMs
+        });
+        this.name = 'GatewayTimeoutError';
+    }
+}
+export class GatewayFetchError extends Error {
+    constructor(gatewayUrl, statusCode, originalError) {
+        const detail = statusCode
+            ? `returned HTTP ${statusCode}`
+            : 'is not reachable';
+        super(`Gateway at ${gatewayUrl} ${detail}`);
+        Object.defineProperty(this, "gatewayUrl", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: gatewayUrl
+        });
+        Object.defineProperty(this, "statusCode", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: statusCode
+        });
+        Object.defineProperty(this, "originalError", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: originalError
+        });
+        this.name = 'GatewayFetchError';
+    }
+}
+function isValidResponse(data) {
+    if (typeof data !== 'object' || data === null)
+        return false;
+    const obj = data;
+    return typeof obj.token === 'string' && (typeof obj.expires === 'string' || typeof obj.expires === 'number');
+}
+export async function fetchGatewayToken(gatewayUrl, user, options) {
+    const timeoutMs = options?.timeoutMs ?? 5000;
+    const params = new URLSearchParams({
+        sub: user.id,
+        email: user.email,
+        roles: user.roles.join(','),
+        scopes: 'openid,profile,email',
+    });
+    const url = `${gatewayUrl}/auth/token?${params.toString()}`;
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const response = await fetch(url, { signal: controller.signal });
+        if (!response.ok) {
+            throw new GatewayFetchError(gatewayUrl, response.status);
+        }
+        const data = await response.json();
+        if (!isValidResponse(data)) {
+            throw new GatewayFetchError(gatewayUrl);
+        }
+        const expiresAt = typeof data.expires === 'number'
+            ? data.expires * 1000
+            : new Date(data.expires).getTime();
+        return { token: data.token, expiresAt };
+    }
+    catch (error) {
+        if (error instanceof GatewayTimeoutError || error instanceof GatewayFetchError) {
+            throw error;
+        }
+        if (error instanceof DOMException && error.name === 'AbortError') {
+            throw new GatewayTimeoutError(gatewayUrl, timeoutMs);
+        }
+        throw new GatewayFetchError(gatewayUrl, undefined, error);
+    }
+    finally {
+        clearTimeout(timeoutId);
+    }
+}

package/dist/auth/client/in-memory.d.ts

@@ -5,6 +5,7 @@
  * Users can be selected from a predefined list or created custom.
  */
 import type { MockUser, InMemoryAuthClient } from './interface';
+export { GatewayTimeoutError, GatewayFetchError } from './gateway-token';
 /**
  * Role configuration for creating mock users
  */
@@ -45,6 +46,10 @@ export interface InMemoryAuthClientOptions {
     users: MockUser[];
     /** localStorage key prefix (defaults to '@nsxbet/auth') */
     storageKey?: string;
+    /** Admin gateway URL for fetching real signed JWTs. If not set, falls back to import.meta.env.VITE_ADMIN_GATEWAY_URL. If neither is set, BFF integration is disabled. */
+    gatewayUrl?: string | null;
+    /** Timeout in milliseconds for gateway token fetch requests (defaults to 5000) */
+    tokenTimeout?: number;
 }
 /**
  * Create an in-memory auth client for development/testing
@@ -66,4 +71,3 @@ export declare function createInMemoryAuthClient(options: InMemoryAuthClientOpti
  * Clear in-memory auth storage (useful for tests)
  */
 export declare function clearInMemoryAuth(storageKey?: string): void;
-//# sourceMappingURL=in-memory.d.ts.map

package/dist/auth/client/in-memory.js

@@ -4,6 +4,8 @@
  * Provides fake authentication for development and testing.
  * Users can be selected from a predefined list or created custom.
  */
+import { fetchGatewayToken } from './gateway-token';
+export { GatewayTimeoutError, GatewayFetchError } from './gateway-token';
 /**
  * Create mock users from a role configuration
  *
@@ -67,15 +69,19 @@ const DEFAULT_STORAGE_KEY = '@nsxbet/auth';
  * ```
  */
 export function createInMemoryAuthClient(options) {
-    const { users, storageKey = DEFAULT_STORAGE_KEY } = options;
-    // Use provided users
+    const { users, storageKey = DEFAULT_STORAGE_KEY, tokenTimeout = 5000 } = options;
     const predefinedUsers = users;
+    // Resolve gatewayUrl: explicit option → env var → null (disabled)
+    const resolvedGatewayUrl = options.gatewayUrl !== undefined
+        ? options.gatewayUrl ?? null
+        : (typeof import.meta !== 'undefined' && import.meta.env?.VITE_ADMIN_GATEWAY_URL) || null;
     // State
     let selectedUser = null;
+    let tokenCache = null;
+    let useMockFallback = false;
+    let backgroundRefreshInFlight = false;
     const subscribers = new Set();
-    /**
-     * Load state from localStorage
-     */
+    const REFRESH_BUFFER_MS = 60000;
     function loadStorage() {
         try {
             const data = localStorage.getItem(storageKey);
@@ -88,28 +94,16 @@ export function createInMemoryAuthClient(options) {
         }
         return { selectedUserId: null, customUsers: [] };
     }
-    /**
-     * Save state to localStorage
-     */
     function saveStorage(data) {
         localStorage.setItem(storageKey, JSON.stringify(data));
     }
-    /**
-     * Get all available users (predefined + custom)
-     */
     function getAllUsers() {
         const storage = loadStorage();
         return [...predefinedUsers, ...storage.customUsers];
     }
-    /**
-     * Find user by ID
-     */
     function findUser(userId) {
         return getAllUsers().find((u) => u.id === userId);
     }
-    /**
-     * Notify subscribers of state change
-     */
     function notifySubscribers() {
         const state = {
             isAuthenticated: selectedUser !== null,
@@ -117,23 +111,36 @@ export function createInMemoryAuthClient(options) {
                 id: selectedUser.id,
                 email: selectedUser.email,
                 displayName: selectedUser.displayName,
+                roles: selectedUser.roles,
             } : null,
         };
         subscribers.forEach((callback) => callback(state));
     }
-    /**
-     * Convert MockUser to User
-     */
     function toUser(mockUser) {
         return {
             id: mockUser.id,
             email: mockUser.email,
             displayName: mockUser.displayName,
+            roles: mockUser.roles,
         };
     }
-    // Public API
+    function mockToken() {
+        return `mock-token-${selectedUser.id}-${Date.now()}`;
+    }
+    async function refreshToken() {
+        return fetchGatewayToken(resolvedGatewayUrl, selectedUser, { timeoutMs: tokenTimeout });
+    }
+    function selectUser(user, userId) {
+        selectedUser = user;
+        const storage = loadStorage();
+        storage.selectedUserId = userId;
+        saveStorage(storage);
+    }
     const client = {
         type: 'in-memory',
+        get gatewayUrl() {
+            return resolvedGatewayUrl;
+        },
         async initialize() {
             const storage = loadStorage();
             if (storage.selectedUserId) {
@@ -155,21 +162,44 @@ export function createInMemoryAuthClient(options) {
             if (!selectedUser) {
                 throw new Error('Not authenticated');
             }
-            return `mock-token-${selectedUser.id}-${Date.now()}`;
+            if (useMockFallback || !resolvedGatewayUrl) {
+                return mockToken();
+            }
+            if (tokenCache) {
+                const now = Date.now();
+                if (now < tokenCache.expiresAt) {
+                    // Token still valid — trigger background refresh if nearing expiry
+                    if (now >= tokenCache.expiresAt - REFRESH_BUFFER_MS && !backgroundRefreshInFlight) {
+                        backgroundRefreshInFlight = true;
+                        refreshToken()
+                            .then((result) => { tokenCache = result; })
+                            .catch(() => { console.warn('[InMemoryAuth] Background token refresh failed, will retry on next access'); })
+                            .finally(() => { backgroundRefreshInFlight = false; });
+                    }
+                    return tokenCache.token;
+                }
+                // Token fully expired — try foreground fetch
+                try {
+                    tokenCache = await refreshToken();
+                    return tokenCache.token;
+                }
+                catch {
+                    console.warn('[InMemoryAuth] Token expired and refresh failed, falling back to mock token');
+                    return mockToken();
+                }
+            }
+            return mockToken();
         },
         hasPermission(permission) {
             if (!selectedUser) {
                 return false;
             }
-            // '*' means all permissions
             if (selectedUser.roles.includes('*')) {
                 return true;
             }
-            // Check exact match or wildcard
             return selectedUser.roles.some((role) => {
                 if (role === permission)
                     return true;
-                // Support wildcard like 'admin.*'
                 if (role.endsWith('.*')) {
                     const prefix = role.slice(0, -2);
                     return permission.startsWith(prefix);
@@ -179,6 +209,8 @@ export function createInMemoryAuthClient(options) {
         },
         logout() {
             selectedUser = null;
+            tokenCache = null;
+            useMockFallback = false;
             const storage = loadStorage();
             storage.selectedUserId = null;
             saveStorage(storage);
@@ -193,34 +225,39 @@ export function createInMemoryAuthClient(options) {
         getAvailableUsers() {
             return getAllUsers();
         },
-        login(userId) {
+        async login(userId, loginOptions) {
             const user = findUser(userId);
             if (!user) {
                 throw new Error(`User not found: ${userId}`);
             }
-            selectedUser = user;
-            const storage = loadStorage();
-            storage.selectedUserId = userId;
-            saveStorage(storage);
+            tokenCache = null;
+            if (loginOptions?.fallbackToMock || !resolvedGatewayUrl) {
+                useMockFallback = true;
+                if (resolvedGatewayUrl && loginOptions?.fallbackToMock) {
+                    console.warn('[InMemoryAuth] Continuing with mock token — gateway token fetch was skipped');
+                }
+                selectUser(user, userId);
+                notifySubscribers();
+                return;
+            }
+            useMockFallback = false;
+            tokenCache = await fetchGatewayToken(resolvedGatewayUrl, user, { timeoutMs: tokenTimeout });
+            selectUser(user, userId);
             notifySubscribers();
         },
-        createCustomUser(userData) {
+        async createCustomUser(userData) {
             const id = `custom-${Date.now()}-${Math.random().toString(36).slice(2, 9)}`;
             const newUser = { ...userData, id };
-            // Save to storage
             const storage = loadStorage();
             storage.customUsers.push(newUser);
             saveStorage(storage);
-            // Login as the new user
-            client.login(id);
+            await client.login(id);
             return newUser;
         },
         isCustomUser(userId) {
-            // Custom users have IDs starting with 'custom-'
             return userId.startsWith('custom-');
         },
         deleteCustomUser(userId) {
-            // Cannot delete predefined users
             if (!client.isCustomUser(userId)) {
                 return false;
             }
@@ -229,12 +266,12 @@ export function createInMemoryAuthClient(options) {
             if (index === -1) {
                 return false;
             }
-            // Remove from storage
             storage.customUsers.splice(index, 1);
-            // If deleted user was logged in, logout
             if (storage.selectedUserId === userId) {
                 storage.selectedUserId = null;
                 selectedUser = null;
+                tokenCache = null;
+                useMockFallback = false;
             }
             saveStorage(storage);
             notifySubscribers();

package/dist/auth/client/index.d.ts

@@ -4,4 +4,3 @@
 export type { AuthClient, InMemoryAuthClient, MockUser, AuthState, AuthStateCallback, } from './interface';
 export { createInMemoryAuthClient, clearInMemoryAuth, createMockUsersFromRoles, type InMemoryAuthClientOptions, type MockUserRoles, } from './in-memory';
 export { createKeycloakAuthClient, type KeycloakAuthClientOptions, } from './keycloak';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/client/interface.d.ts

@@ -91,6 +91,8 @@ export interface AuthClient {
  */
 export interface InMemoryAuthClient extends AuthClient {
     readonly type: 'in-memory';
+    /** Resolved gateway URL, or null if BFF integration is disabled */
+    readonly gatewayUrl: string | null;
     /**
      * Get all available mock users
      */
@@ -102,14 +104,15 @@ export interface InMemoryAuthClient extends AuthClient {
     /**
      * Login as a specific user
      */
-    login(userId: string): void;
+    login(userId: string, options?: {
+        fallbackToMock?: boolean;
+    }): Promise<void>;
     /**
      * Create and login as a custom user
      */
-    createCustomUser(user: Omit<MockUser, 'id'>): MockUser;
+    createCustomUser(user: Omit<MockUser, 'id'>): Promise<MockUser>;
     /**
      * Delete a custom user (predefined users cannot be deleted)
      */
     deleteCustomUser(userId: string): boolean;
 }
-//# sourceMappingURL=interface.d.ts.map

package/dist/auth/client/keycloak.d.ts

@@ -16,4 +16,3 @@ export interface KeycloakAuthClientOptions {
  * Create a Keycloak auth client for production
  */
 export declare function createKeycloakAuthClient(options: KeycloakAuthClientOptions): AuthClient;
-//# sourceMappingURL=keycloak.d.ts.map

package/dist/auth/client/keycloak.js

@@ -21,6 +21,7 @@ export function createKeycloakAuthClient(options) {
             id: tokenParsed.sub || '',
             email: tokenParsed.email || '',
             displayName: tokenParsed.name || tokenParsed.preferred_username || '',
+            roles: tokenParsed.realm_access?.roles ?? [],
         };
     }
     /**
@@ -101,10 +102,12 @@ export function createKeycloakAuthClient(options) {
             }
         },
         hasPermission(permission) {
-            // If not initialized yet, return true to avoid hiding modules during init
-            // The UI will re-render after authentication completes
+            // Deny-by-default: return false until Keycloak is fully initialized.
+            // This prevents a window where all actions appear permitted during auth init.
+            // AuthProvider gates rendering behind isAuthenticated, so modules won't
+            // render permission-gated UI until auth completes.
             if (!isInitialized || !keycloak) {
-                return true;
+                return false;
             }
             return keycloak.hasRealmRole(permission);
         },

package/dist/auth/components/UserSelector.d.ts

@@ -16,4 +16,3 @@ interface UserSelectorProps {
  */
 export declare function UserSelector({ authClient, onUserSelected }: UserSelectorProps): import("react/jsx-runtime").JSX.Element;
 export {};
-//# sourceMappingURL=UserSelector.d.ts.map

package/dist/auth/components/UserSelector.js

@@ -6,7 +6,8 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
  * Uses Brasa Design System tokens for consistent styling.
  */
 import { useState } from 'react';
-import { Crown, Ban, Eye, User, Users, Sparkles, Wrench, Trash2, Plus, ChevronRight } from '@nsxbet/admin-ui';
+import { Crown, Ban, Eye, User, Users, Sparkles, Wrench, Trash2, Plus, ChevronRight, Loader2, AlertCircle, Clock, ArrowLeft, RefreshCw, ShieldAlert, } from '@nsxbet/admin-ui';
+import { GatewayTimeoutError } from '../client/in-memory';
 /**
  * Get user icon based on roles
  */
@@ -84,26 +85,107 @@ function CustomUserForm({ onSubmit, onCancel, }) {
     const isValid = displayName.trim() && email.trim();
     return (_jsxs("form", { onSubmit: handleSubmit, className: "p-4 rounded-xl border border-border bg-card", children: [_jsxs("h3", { className: "font-semibold text-foreground mb-4 flex items-center gap-2", children: [_jsx(Sparkles, { className: "h-5 w-5 text-amber-500" }), "Create Custom User"] }), _jsxs("div", { className: "space-y-3", children: [_jsxs("div", { children: [_jsx("label", { className: "block text-sm font-medium text-muted-foreground mb-1", children: "Display Name" }), _jsx("input", { type: "text", value: displayName, onChange: (e) => setDisplayName(e.target.value), placeholder: "John Doe", className: "w-full px-3 py-2 rounded-lg border border-border bg-background text-foreground placeholder-muted-foreground focus:outline-none focus:ring-2 focus:ring-ring focus:border-transparent" })] }), _jsxs("div", { children: [_jsx("label", { className: "block text-sm font-medium text-muted-foreground mb-1", children: "Email" }), _jsx("input", { type: "email", value: email, onChange: (e) => setEmail(e.target.value), placeholder: "john@example.com", className: "w-full px-3 py-2 rounded-lg border border-border bg-background text-foreground placeholder-muted-foreground focus:outline-none focus:ring-2 focus:ring-ring focus:border-transparent" })] }), _jsxs("div", { children: [_jsxs("label", { className: "block text-sm font-medium text-muted-foreground mb-1", children: ["Roles ", _jsx("span", { className: "text-muted-foreground/60", children: "(comma-separated)" })] }), _jsx("input", { type: "text", value: rolesInput, onChange: (e) => setRolesInput(e.target.value), placeholder: "admin, admin.users.view, admin.tasks.edit", className: "w-full px-3 py-2 rounded-lg border border-border bg-background text-foreground placeholder-muted-foreground focus:outline-none focus:ring-2 focus:ring-ring focus:border-transparent" }), _jsxs("p", { className: "text-xs text-muted-foreground mt-1", children: ["Use ", _jsx("code", { className: "px-1 py-0.5 rounded bg-muted", children: "*" }), " for all permissions"] })] })] }), _jsxs("div", { className: "flex gap-2 mt-4", children: [_jsx("button", { type: "button", onClick: onCancel, className: "flex-1 px-4 py-2 rounded-lg border border-border text-foreground hover:bg-muted/50 transition-colors", children: "Cancel" }), _jsx("button", { type: "submit", disabled: !isValid, className: "flex-1 px-4 py-2 rounded-lg bg-primary text-primary-foreground font-medium hover:bg-primary/90 disabled:opacity-50 disabled:cursor-not-allowed transition-colors", children: "Create & Login" })] })] }));
 }
+/**
+ * Loading screen shown while fetching a BFF token.
+ */
+function LoginLoadingScreen({ userName }) {
+    return (_jsx("div", { className: "min-h-screen bg-background flex items-center justify-center p-4", children: _jsxs("div", { className: "w-full max-w-md text-center", children: [_jsx("div", { className: "inline-flex items-center justify-center w-16 h-16 rounded-2xl bg-primary/10 mb-6", children: _jsx(Loader2, { className: "h-8 w-8 text-primary animate-spin" }) }), _jsx("h2", { className: "text-xl font-semibold text-foreground mb-2", children: "Authenticating\u2026" }), _jsxs("p", { className: "text-muted-foreground", children: ["Fetching token for ", _jsx("span", { className: "font-medium text-foreground", children: userName })] })] }) }));
+}
+/**
+ * Shared action bar for error / timeout screens.
+ */
+function LoginRecoveryActions({ onRetry, onFallback, onBack, retrying, }) {
+    return (_jsxs("div", { className: "space-y-3 mt-6 w-full", children: [_jsxs("button", { onClick: onRetry, disabled: retrying, className: "w-full px-4 py-2.5 rounded-lg bg-primary text-primary-foreground font-medium hover:bg-primary/90 disabled:opacity-50 disabled:cursor-not-allowed transition-colors flex items-center justify-center gap-2", children: [retrying ? _jsx(Loader2, { className: "h-4 w-4 animate-spin" }) : _jsx(RefreshCw, { className: "h-4 w-4" }), "Retry"] }), _jsxs("button", { onClick: onFallback, disabled: retrying, className: "w-full px-4 py-2.5 rounded-lg border border-border text-foreground hover:bg-muted/50 disabled:opacity-50 disabled:cursor-not-allowed transition-colors flex items-center justify-center gap-2", children: [_jsx(ShieldAlert, { className: "h-4 w-4" }), "Continue with mock token"] }), _jsxs("button", { onClick: onBack, disabled: retrying, className: "w-full px-4 py-2 text-sm text-muted-foreground hover:text-foreground disabled:opacity-50 transition-colors flex items-center justify-center gap-1", children: [_jsx(ArrowLeft, { className: "h-3.5 w-3.5" }), "Back to user selection"] })] }));
+}
+/**
+ * Error screen shown when the gateway returns an error or is unreachable.
+ */
+function LoginErrorScreen({ errorMessage, gatewayUrl, onRetry, onFallback, onBack, retrying, }) {
+    return (_jsx("div", { className: "min-h-screen bg-background flex items-center justify-center p-4", children: _jsxs("div", { className: "w-full max-w-md flex flex-col items-center text-center", children: [_jsx("div", { className: "inline-flex items-center justify-center w-16 h-16 rounded-2xl bg-destructive/10 mb-6", children: _jsx(AlertCircle, { className: "h-8 w-8 text-destructive" }) }), _jsx("h2", { className: "text-xl font-semibold text-foreground mb-2", children: "Authentication Failed" }), _jsx("p", { className: "text-muted-foreground mb-1", children: errorMessage }), gatewayUrl && (_jsx("p", { className: "text-xs text-muted-foreground/70 font-mono break-all", children: gatewayUrl })), _jsx(LoginRecoveryActions, { onRetry: onRetry, onFallback: onFallback, onBack: onBack, retrying: retrying })] }) }));
+}
+/**
+ * Timeout screen shown when the gateway doesn't respond in time.
+ */
+function LoginTimeoutScreen({ gatewayUrl, onRetry, onFallback, onBack, retrying, }) {
+    return (_jsx("div", { className: "min-h-screen bg-background flex items-center justify-center p-4", children: _jsxs("div", { className: "w-full max-w-md flex flex-col items-center text-center", children: [_jsx("div", { className: "inline-flex items-center justify-center w-16 h-16 rounded-2xl bg-amber-500/10 mb-6", children: _jsx(Clock, { className: "h-8 w-8 text-amber-500" }) }), _jsx("h2", { className: "text-xl font-semibold text-foreground mb-2", children: "Gateway Timeout" }), _jsx("p", { className: "text-muted-foreground mb-1", children: "The gateway did not respond in time." }), gatewayUrl && (_jsx("p", { className: "text-xs text-muted-foreground/70 font-mono break-all", children: gatewayUrl })), _jsx(LoginRecoveryActions, { onRetry: onRetry, onFallback: onFallback, onBack: onBack, retrying: retrying })] }) }));
+}
 /**
  * Main User Selector Component
  */
 export function UserSelector({ authClient, onUserSelected }) {
     const [showCustomForm, setShowCustomForm] = useState(false);
+    const [loginState, setLoginState] = useState({ status: 'idle' });
     const [, forceUpdate] = useState(0);
     const users = authClient.getAvailableUsers();
-    const handleSelectUser = (userId) => {
-        authClient.login(userId);
-        onUserSelected?.();
+    const findUserName = (userId) => users.find((u) => u.id === userId)?.displayName ?? userId;
+    const handleSelectUser = async (userId) => {
+        if (!authClient.gatewayUrl) {
+            await authClient.login(userId);
+            onUserSelected?.();
+            return;
+        }
+        setLoginState({ status: 'loading', userId });
+        try {
+            await authClient.login(userId);
+            onUserSelected?.();
+        }
+        catch (error) {
+            if (error instanceof GatewayTimeoutError) {
+                setLoginState({ status: 'timeout', userId });
+            }
+            else {
+                setLoginState({
+                    status: 'error',
+                    userId,
+                    error: error instanceof Error ? error.message : 'An unexpected error occurred',
+                    canRetry: true,
+                });
+            }
+        }
+    };
+    const handleRetry = () => {
+        if (loginState.status === 'error' || loginState.status === 'timeout') {
+            handleSelectUser(loginState.userId);
+        }
     };
-    const handleCreateCustomUser = (userData) => {
-        authClient.createCustomUser(userData);
+    const handleFallbackToMock = async () => {
+        if (loginState.status === 'error' || loginState.status === 'timeout') {
+            const { userId } = loginState;
+            setLoginState({ status: 'loading', userId });
+            try {
+                await authClient.login(userId, { fallbackToMock: true });
+                onUserSelected?.();
+            }
+            catch (error) {
+                setLoginState({
+                    status: 'error',
+                    userId,
+                    error: error instanceof Error ? error.message : 'An unexpected error occurred',
+                    canRetry: true,
+                });
+            }
+        }
+    };
+    const handleBack = () => {
+        setLoginState({ status: 'idle' });
+    };
+    const handleCreateCustomUser = async (userData) => {
+        await authClient.createCustomUser(userData);
         onUserSelected?.();
     };
     const handleDeleteUser = (userId) => {
         authClient.deleteCustomUser(userId);
-        // Force re-render to update the list
         forceUpdate((n) => n + 1);
     };
+    if (loginState.status === 'loading') {
+        return _jsx(LoginLoadingScreen, { userName: findUserName(loginState.userId) });
+    }
+    if (loginState.status === 'error') {
+        return (_jsx(LoginErrorScreen, { errorMessage: loginState.error, gatewayUrl: authClient.gatewayUrl, onRetry: handleRetry, onFallback: handleFallbackToMock, onBack: handleBack, retrying: false }));
+    }
+    if (loginState.status === 'timeout') {
+        return (_jsx(LoginTimeoutScreen, { gatewayUrl: authClient.gatewayUrl, onRetry: handleRetry, onFallback: handleFallbackToMock, onBack: handleBack, retrying: false }));
+    }
     return (_jsx("div", { className: "min-h-screen bg-background flex items-center justify-center p-4", children: _jsxs("div", { className: "w-full max-w-md", children: [_jsxs("div", { className: "text-center mb-8", children: [_jsx("div", { className: "inline-flex items-center justify-center w-16 h-16 rounded-2xl bg-primary mb-4 shadow-lg shadow-primary/25", children: _jsx(Users, { className: "h-8 w-8 text-primary-foreground" }) }), _jsx("h1", { className: "text-2xl font-bold text-foreground mb-2", children: "Select User" }), _jsx("p", { className: "text-muted-foreground", children: "Choose a mock user to continue in development mode" })] }), _jsx("div", { className: "space-y-3 mb-6", children: users.map((user) => {
                         const isCustom = authClient.isCustomUser(user.id);
                         return (_jsx(UserCard, { user: user, isCustom: isCustom, onClick: () => handleSelectUser(user.id), onDelete: isCustom ? () => handleDeleteUser(user.id) : undefined }, user.id));

package/dist/auth/components/index.d.ts

@@ -2,4 +2,3 @@
  * Auth components exports
  */
 export { UserSelector } from './UserSelector';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts

@@ -4,4 +4,3 @@
 export type { AuthClient, InMemoryAuthClient, MockUser, AuthState, AuthStateCallback, } from './client';
 export { createInMemoryAuthClient, clearInMemoryAuth, createMockUsersFromRoles, createKeycloakAuthClient, type InMemoryAuthClientOptions, type MockUserRoles, type KeycloakAuthClientOptions, } from './client';
 export { UserSelector } from './components';
-//# sourceMappingURL=index.d.ts.map

package/dist/components/AuthProvider.d.ts

@@ -45,4 +45,3 @@ export declare function useAuthContext(): AuthContextValue;
  */
 export declare function useOptionalAuthContext(): AuthContextValue | null;
 export {};
-//# sourceMappingURL=AuthProvider.d.ts.map

package/dist/components/Timestamp.d.ts

@@ -0,0 +1,7 @@
+import type { TimestampFormat } from '../types/platform';
+export interface TimestampProps {
+    value: Date | string;
+    format?: TimestampFormat;
+    className?: string;
+}
+export declare function Timestamp({ value, format, className }: TimestampProps): import("react/jsx-runtime").JSX.Element;

package/dist/components/Timestamp.js

@@ -0,0 +1,50 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useMemo } from 'react';
+import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from '@nsxbet/admin-ui';
+import { useTimestamp } from '../hooks/useTimestamp';
+export function Timestamp({ value, format = 'datetime', className }) {
+    const { mode, formatDate } = useTimestamp();
+    const date = useMemo(() => {
+        if (value instanceof Date)
+            return value;
+        const parsed = new Date(value);
+        return parsed;
+    }, [value]);
+    const isInvalid = isNaN(date.getTime());
+    const formatted = useMemo(() => {
+        if (isInvalid)
+            return 'Invalid date';
+        return formatDate(date, format);
+    }, [date, format, formatDate, isInvalid]);
+    const tooltipText = useMemo(() => {
+        if (isInvalid)
+            return '';
+        const oppositeMode = mode === 'utc' ? 'local' : 'utc';
+        const oppositeTz = oppositeMode === 'utc' ? 'UTC' : undefined;
+        const suffix = oppositeMode === 'utc' ? ' UTC' : '';
+        if (format === 'relative') {
+            const options = {
+                year: 'numeric',
+                month: 'short',
+                day: 'numeric',
+                hour: 'numeric',
+                minute: '2-digit',
+                second: '2-digit',
+                timeZone: oppositeTz,
+            };
+            return new Intl.DateTimeFormat('en-US', options).format(date) + suffix;
+        }
+        const options = {
+            year: 'numeric',
+            month: 'short',
+            day: 'numeric',
+            hour: 'numeric',
+            minute: '2-digit',
+            second: '2-digit',
+            timeZone: oppositeTz,
+        };
+        return new Intl.DateTimeFormat('en-US', options).format(date) + suffix;
+    }, [date, mode, format, isInvalid]);
+    const isoString = isInvalid ? '' : date.toISOString();
+    return (_jsx(TooltipProvider, { children: _jsxs(Tooltip, { children: [_jsx(TooltipTrigger, { asChild: true, children: _jsx("time", { dateTime: isoString, className: className, children: formatted }) }), !isInvalid && (_jsx(TooltipContent, { children: _jsx("p", { children: tooltipText }) }))] }) }));
+}

package/dist/hooks/useAuth.d.ts

@@ -18,4 +18,3 @@ export interface UseAuthResult {
  * - Standalone mode with AuthClient (Keycloak or in-memory)
  */
 export declare function useAuth(): UseAuthResult;
-//# sourceMappingURL=useAuth.d.ts.map

package/dist/hooks/useAuth.js

@@ -25,7 +25,7 @@ export function useAuth() {
         return {
             getAccessToken: authContext.getAccessToken,
             hasPermission: authContext.hasPermission,
-            getUser: () => authContext.user || { id: '', email: '', displayName: '' },
+            getUser: () => authContext.user || { id: '', email: '', displayName: '', roles: [] },
             logout: authContext.logout,
         };
     }

package/dist/hooks/useFetch.d.ts

@@ -5,4 +5,3 @@
  * In standalone mode: Manually adds Authorization header with token
  */
 export declare function useFetch(): (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
-//# sourceMappingURL=useFetch.d.ts.map

package/dist/hooks/useI18n.d.ts

@@ -43,4 +43,3 @@ export interface UseI18nResult {
  * ```
  */
 export declare function useI18n(namespace?: string): UseI18nResult;
-//# sourceMappingURL=useI18n.d.ts.map

package/dist/hooks/usePlatformAPI.d.ts

@@ -9,4 +9,3 @@ export declare function usePlatformAPI(): {
     isShellMode: boolean;
     api: PlatformAPI | undefined;
 };
-//# sourceMappingURL=usePlatformAPI.d.ts.map