@owlmeans/client-auth 0.1.18-rc.2 → 0.1.18-rc.21

package/build/login/credit.js

@@ -0,0 +1,58 @@
+/**
+ * The years one notice covers.
+ *
+ * A range only while the first year is genuinely in the past — an app configured with the current
+ * year, or with a year a skewed clock puts in the future, still gets a well-formed notice rather
+ * than `© 2026–2026` or a range that runs backwards.
+ */
+const years = (since, now) => since != null && since > 0 && since < now ? `${since}–${now}` : `${now}`;
+/**
+ * A configured value that was actually SET.
+ *
+ * Empty is how a build-time default spells "unset", and this config is filled from environment
+ * variables a platform delivers — `BRANDING_ORGANIZATION: meta.brandingOrganization ?? ''` is the
+ * shape of every one of them. `??` does not fall through an empty string, so an undelivered
+ * organization used to win the fallback chain and compose a line ending in a bare dash.
+ */
+const set = (value) => value != null && value.trim() !== '' ? value : null;
+/**
+ * What the bottom of the sign-in screen says.
+ *
+ * It is a copyright notice, so it is composed as one: `© <year> <holder>`. That is the whole
+ * reason `copyright` defaults to on — the name on its own reads as a caption, and an application
+ * that means to assert a copyright would have had to write the mark and the year into a literal
+ * `line` to get one.
+ *
+ * The organization falls back to its slug because an organization record carries no readable name
+ * — so "no name" is the ordinary case, not an error, and a screen that rendered an empty line for
+ * it would be worse than one that renders the slug.
+ *
+ * `line` replaces everything when an app supplies it: a product with its own legal wording should
+ * not have to defeat a composition rule to use it.
+ */
+export const resolveCredit = (cfg, brand, service) => {
+    const poweredBy = cfg?.poweredBy ?? true;
+    const literal = set(cfg?.line);
+    if (literal != null) {
+        return { poweredBy, line: literal };
+    }
+    const product = set(cfg?.product) ?? set(brand?.name) ?? set(service);
+    const organization = set(cfg?.organization) ?? set(brand?.organization)
+        ?? set(cfg?.entity) ?? set(brand?.entity);
+    // Whoever the notice names. A product with no organization behind it holds its own copyright,
+    // which is why this falls through to the product rather than dropping the notice.
+    const holder = set(cfg?.holder) ?? organization ?? product;
+    const wording = typeof cfg?.copyright === 'string' ? set(cfg.copyright) : null;
+    const notice = cfg?.copyright === false || holder == null
+        ? organization
+        : wording ?? `© ${years(cfg?.since, new Date().getFullYear())} ${holder}`;
+    // The product is named beside the notice only when it is not already the thing being claimed —
+    // "OwlMeans — © 2026 OwlMeans" says the name twice and neither time usefully.
+    return {
+        poweredBy,
+        line: product != null && notice != null && product !== holder
+            ? `${product} — ${notice}`
+            : notice ?? product,
+    };
+};
+//# sourceMappingURL=credit.js.map

package/build/login/credit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credit.js","sourceRoot":"","sources":["../../src/login/credit.ts"],"names":[],"mappings":"AASA;;;;;;GAMG;AACH,MAAM,KAAK,GAAG,CAAC,KAAyB,EAAE,GAAW,EAAU,EAAE,CAC/D,KAAK,IAAI,IAAI,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,CAAA;AAE1E;;;;;;;GAOG;AACH,MAAM,GAAG,GAAG,CAAC,KAAqB,EAAiB,EAAE,CACnD,KAAK,IAAI,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AAErD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,GAAuB,EAAE,KAAqB,EAAE,OAAgB,EAChD,EAAE;IAClB,MAAM,SAAS,GAAG,GAAG,EAAE,SAAS,IAAI,IAAI,CAAA;IACxC,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAC9B,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;QACpB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IACrC,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAA;IACrE,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC;WAClE,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IAE3C,8FAA8F;IAC9F,kFAAkF;IAClF,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,YAAY,IAAI,OAAO,CAAA;IAC1D,MAAM,OAAO,GAAG,OAAO,GAAG,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC9E,MAAM,MAAM,GAAG,GAAG,EAAE,SAAS,KAAK,KAAK,IAAI,MAAM,IAAI,IAAI;QACvD,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,OAAO,IAAI,KAAK,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,IAAI,MAAM,EAAE,CAAA;IAE3E,+FAA+F;IAC/F,8EAA8E;IAC9E,OAAO;QACL,SAAS;QACT,IAAI,EAAE,OAAO,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,MAAM;YAC3D,CAAC,CAAC,GAAG,OAAO,MAAM,MAAM,EAAE;YAC1B,CAAC,CAAC,MAAM,IAAI,OAAO;KACtB,CAAA;AACH,CAAC,CAAA"}

package/build/login/env.d.ts

@@ -0,0 +1,32 @@
+import type { LoginEnv } from './types.js';
+/**
+ * Whether this document is embedded in a frame.
+ *
+ * Reading `window.top` across origins throws, and that throw is itself the answer: a `top` that
+ * differs and a `top` that cannot be reached both mean "framed".
+ */
+export declare const isEmbedded: () => boolean;
+/**
+ * Record that this window is the surrogate login window, while that is still knowable.
+ *
+ * Must run on the surrogate's **first** load, before the flow navigates to the provider:
+ * `window.name` is the only evidence at that point, and browsers clear it as soon as a top-level
+ * context goes cross-origin — so by the time the provider redirects back, the name is gone and
+ * this window would look like an ordinary tab.
+ *
+ * Idempotent, and a no-op in every window that is not the surrogate.
+ */
+export declare const markSurrogate: () => void;
+/** Whether this document is the surrogate login window. */
+export declare const isSurrogate: () => boolean;
+/** Forget the surrogate marker — called once its token has been handed back. */
+export declare const clearSurrogate: () => void;
+/**
+ * Default login environment.
+ *
+ * The single source of environment truth for cascade selection — a plugin's `match` reads this
+ * and never probes `window` itself, so a non-DOM host can drive the same plugins by supplying its
+ * own descriptor.
+ */
+export declare const defaultLoginEnv: () => LoginEnv;
+//# sourceMappingURL=env.d.ts.map

package/build/login/env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/login/env.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAE1C;;;;;GAKG;AACH,eAAO,MAAM,UAAU,QAAO,OAM7B,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa,QAAO,IAUhC,CAAA;AAED,2DAA2D;AAC3D,eAAO,MAAM,WAAW,QAAO,OAY9B,CAAA;AAED,gFAAgF;AAChF,eAAO,MAAM,cAAc,QAAO,IAOjC,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,QAAO,QAclC,CAAA"}

package/build/login/env.js

@@ -0,0 +1,84 @@
+import { LOGIN_SURROGATE_MARKER, LOGIN_SURROGATE_NAME } from './consts.js';
+/**
+ * Whether this document is embedded in a frame.
+ *
+ * Reading `window.top` across origins throws, and that throw is itself the answer: a `top` that
+ * differs and a `top` that cannot be reached both mean "framed".
+ */
+export const isEmbedded = () => {
+    try {
+        return window.self !== window.top;
+    }
+    catch {
+        return true;
+    }
+};
+/**
+ * Record that this window is the surrogate login window, while that is still knowable.
+ *
+ * Must run on the surrogate's **first** load, before the flow navigates to the provider:
+ * `window.name` is the only evidence at that point, and browsers clear it as soon as a top-level
+ * context goes cross-origin — so by the time the provider redirects back, the name is gone and
+ * this window would look like an ordinary tab.
+ *
+ * Idempotent, and a no-op in every window that is not the surrogate.
+ */
+export const markSurrogate = () => {
+    if (typeof window === 'undefined' || window.name !== LOGIN_SURROGATE_NAME) {
+        return;
+    }
+    try {
+        window.sessionStorage.setItem(LOGIN_SURROGATE_MARKER, '1');
+    }
+    catch {
+        // Storage can be unavailable (private modes, blocked cookies). The `window.name` check still
+        // covers the case where nothing cross-origin happened in between.
+    }
+};
+/** Whether this document is the surrogate login window. */
+export const isSurrogate = () => {
+    if (typeof window === 'undefined') {
+        return false;
+    }
+    if (window.name === LOGIN_SURROGATE_NAME) {
+        return true;
+    }
+    try {
+        return window.sessionStorage.getItem(LOGIN_SURROGATE_MARKER) === '1';
+    }
+    catch {
+        return false;
+    }
+};
+/** Forget the surrogate marker — called once its token has been handed back. */
+export const clearSurrogate = () => {
+    if (typeof window === 'undefined') {
+        return;
+    }
+    try {
+        window.sessionStorage.removeItem(LOGIN_SURROGATE_MARKER);
+    }
+    catch { /* nothing to clean up if storage was never available */ }
+};
+/**
+ * Default login environment.
+ *
+ * The single source of environment truth for cascade selection — a plugin's `match` reads this
+ * and never probes `window` itself, so a non-DOM host can drive the same plugins by supplying its
+ * own descriptor.
+ */
+export const defaultLoginEnv = () => {
+    const hasWindow = typeof window !== 'undefined';
+    if (!hasWindow) {
+        return { hasWindow, embedded: false, surrogate: false, hasOpener: false };
+    }
+    return {
+        hasWindow,
+        embedded: isEmbedded(),
+        surrogate: isSurrogate(),
+        // `Cross-Origin-Opener-Policy: same-origin` from the provider severs this permanently, which
+        // is why it is observed rather than assumed from "we were opened by someone".
+        hasOpener: window.opener != null,
+    };
+};
+//# sourceMappingURL=env.js.map

package/build/login/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/login/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAG1E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,GAAY,EAAE;IACtC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,GAAG,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,GAAS,EAAE;IACtC,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QAC1E,OAAM;IACR,CAAC;IACD,IAAI,CAAC;QACH,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAA;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,6FAA6F;QAC7F,kEAAkE;IACpE,CAAC;AACH,CAAC,CAAA;AAED,2DAA2D;AAC3D,MAAM,CAAC,MAAM,WAAW,GAAG,GAAY,EAAE;IACvC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QACzC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,GAAG,CAAA;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC,CAAA;AAED,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,GAAS,EAAE;IACvC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAM;IACR,CAAC;IACD,IAAI,CAAC;QACH,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAA;IAC1D,CAAC;IAAC,MAAM,CAAC,CAAC,wDAAwD,CAAC,CAAC;AACtE,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,GAAa,EAAE;IAC5C,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,WAAW,CAAA;IAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;IAC3E,CAAC;IAED,OAAO;QACL,SAAS;QACT,QAAQ,EAAE,UAAU,EAAE;QACtB,SAAS,EAAE,WAAW,EAAE;QACxB,6FAA6F;QAC7F,8EAA8E;QAC9E,SAAS,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;KACjC,CAAA;AACH,CAAC,CAAA"}

package/build/login/flow.d.ts

@@ -0,0 +1,20 @@
+import type { FlowModel } from '@owlmeans/flow';
+/**
+ * Bring a freshly booted standard OIDC flow to the step an authorization request can be made from.
+ *
+ * `stdOidcFlow` starts at `Dispatch`, but `OidcAuthService.authenticate` refuses any state that is
+ * not `Ephemeral` and returns null — so an application whose flow was only booted can ask for an
+ * authorization URL all day and be told nothing, forever. The dispatcher in this package has always
+ * done this transition inline; a relying party that replaces that dispatcher (`web-oidc-rp`,
+ * `mui-oidc-rp`) inherited the requirement without the code, which is what left a sign-in button
+ * that reported no error and did nothing at all.
+ *
+ * `Ephemeral` is the branch for an application that is its OWN authority — its flow configuration
+ * maps the auth service to a placeholder, which is exactly the generated-application case. An app
+ * federated with a real auth service keeps its target and is left alone.
+ *
+ * Idempotent, and safe to call on every attempt: a flow already past `Dispatch`, or one that is
+ * not the standard OIDC flow at all, is returned untouched.
+ */
+export declare const enterOidcAuthorization: (model: FlowModel) => FlowModel;
+//# sourceMappingURL=flow.d.ts.map

package/build/login/flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow.d.ts","sourceRoot":"","sources":["../../src/login/flow.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAG/C;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,sBAAsB,UAAW,SAAS,KAAG,SAsBzD,CAAA"}

package/build/login/flow.js

@@ -0,0 +1,39 @@
+import { FLOW_PLACEHOLDER, OidcAuthStep, STD_OIDC_FLOW } from '@owlmeans/flow';
+import { DEFAULT_ENTITY } from '../consts.js';
+/**
+ * Bring a freshly booted standard OIDC flow to the step an authorization request can be made from.
+ *
+ * `stdOidcFlow` starts at `Dispatch`, but `OidcAuthService.authenticate` refuses any state that is
+ * not `Ephemeral` and returns null — so an application whose flow was only booted can ask for an
+ * authorization URL all day and be told nothing, forever. The dispatcher in this package has always
+ * done this transition inline; a relying party that replaces that dispatcher (`web-oidc-rp`,
+ * `mui-oidc-rp`) inherited the requirement without the code, which is what left a sign-in button
+ * that reported no error and did nothing at all.
+ *
+ * `Ephemeral` is the branch for an application that is its OWN authority — its flow configuration
+ * maps the auth service to a placeholder, which is exactly the generated-application case. An app
+ * federated with a real auth service keeps its target and is left alone.
+ *
+ * Idempotent, and safe to call on every attempt: a flow already past `Dispatch`, or one that is
+ * not the standard OIDC flow at all, is returned untouched.
+ */
+export const enterOidcAuthorization = (model) => {
+    const state = model.state();
+    if (state.flow !== STD_OIDC_FLOW || state.step !== OidcAuthStep.Dispatch) {
+        return model;
+    }
+    const target = model.step().service;
+    if (state.service == null || state.service === '') {
+        model.target(target);
+    }
+    // The entity travels to this app's own backend, which resolves its default provider by `def`
+    // alone. It still has to BE there: the init endpoint rejects a body without one.
+    if (state.entityId == null) {
+        model.entity(DEFAULT_ENTITY);
+    }
+    if (target === FLOW_PLACEHOLDER) {
+        model.transit(OidcAuthStep.Ephemeral, true);
+    }
+    return model;
+};
+//# sourceMappingURL=flow.js.map

package/build/login/flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flow.js","sourceRoot":"","sources":["../../src/login/flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAE9E,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAE7C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAgB,EAAa,EAAE;IACpE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAA;IAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,QAAQ,EAAE,CAAC;QACzE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAA;IACnC,IAAI,KAAK,CAAC,OAAO,IAAI,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;QAClD,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACtB,CAAC;IAED,6FAA6F;IAC7F,iFAAiF;IACjF,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;QAC3B,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;IAC9B,CAAC;IAED,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;QAChC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IAC7C,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}

package/build/login/hook.d.ts

@@ -0,0 +1,37 @@
+import type { MouseEvent } from 'react';
+/**
+ * Wiring for a "Log in" control: where it points, and what it does when clicked.
+ *
+ * The caller renders one control and attaches one handler — which browsing context the flow can
+ * actually complete in is the login service's problem, not the app's. An ordinary tab redirects;
+ * an app embedded in a frame runs the flow one window up, because the provider refuses to be
+ * framed and its cookies are third-party there.
+ *
+ * The returned handler is deliberately NOT async and awaits nothing before delegating: a window
+ * opened after the user gesture has finished being handled is eaten by the popup blocker.
+ *
+ * The dispatcher entrypoint is resolved INSIDE the hook, never at module scope. Module bodies run
+ * while the app is still being imported, before `registerEntrypoints` has put anything on the
+ * context, and a top-level lookup throws `Entrypoint dispatcher not found` — which escapes during
+ * import, takes the whole render down, and paints an empty page with no component at fault.
+ */
+export declare const useLogin: (target?: string) => readonly [string, (event?: MouseEvent) => void];
+/**
+ * Wiring for a "Log out" control.
+ *
+ * One control, one handler, no decision — the mirror of {@link useLogin}. Where the session has to
+ * be ended (here, or one window up in a surrogate whose storage partition this document cannot
+ * reach) is the login plugin's call.
+ *
+ * NOT async, and nothing is awaited before delegating: logging out of a framed application opens a
+ * window, and a window opened after the gesture has finished being handled is eaten by the popup
+ * blocker. The surrogate entrypoint is resolved INSIDE the hook for the same reason `useLogin`
+ * resolves the dispatcher there.
+ *
+ * The return shape stays a bare handler rather than `useLogin`'s tuple: a logout control has no
+ * address to point at, and every generated application carries a copy of a component that writes
+ * `const onLogOut = useLogout()`. `(event?: MouseEvent) => void` is assignable to `() => void`, so
+ * `onClick={onLogOut}` keeps compiling everywhere.
+ */
+export declare const useLogout: (target?: string) => ((event?: MouseEvent) => void);
+//# sourceMappingURL=hook.d.ts.map

package/build/login/hook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook.d.ts","sourceRoot":"","sources":["../../src/login/hook.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,OAAO,CAAA;AAUvC;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,QAAQ,YAAa,MAAM,KAAG,SAAS,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,UAAU,KAAK,IAAI,CAmBxF,CAAA;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,SAAS,YAAa,MAAM,KAAG,CAAC,CAAC,KAAK,CAAC,EAAE,UAAU,KAAK,IAAI,CAcxE,CAAA"}

package/build/login/hook.js

@@ -0,0 +1,72 @@
+import { useCallback } from 'react';
+import { useContext, useNavigate } from '@owlmeans/client';
+import { DISPATCHER } from '@owlmeans/auth';
+import { LoginIntent } from './types.js';
+import { LOGIN_SERVICE } from './consts.js';
+import { surrogatePath } from './surrogate.js';
+/**
+ * Wiring for a "Log in" control: where it points, and what it does when clicked.
+ *
+ * The caller renders one control and attaches one handler — which browsing context the flow can
+ * actually complete in is the login service's problem, not the app's. An ordinary tab redirects;
+ * an app embedded in a frame runs the flow one window up, because the provider refuses to be
+ * framed and its cookies are third-party there.
+ *
+ * The returned handler is deliberately NOT async and awaits nothing before delegating: a window
+ * opened after the user gesture has finished being handled is eaten by the popup blocker.
+ *
+ * The dispatcher entrypoint is resolved INSIDE the hook, never at module scope. Module bodies run
+ * while the app is still being imported, before `registerEntrypoints` has put anything on the
+ * context, and a top-level lookup throws `Entrypoint dispatcher not found` — which escapes during
+ * import, takes the whole render down, and paints an empty page with no component at fault.
+ */
+export const useLogin = (target) => {
+    const context = useContext();
+    const nav = useNavigate();
+    const dispatcher = context.entrypoint(DISPATCHER);
+    const path = dispatcher.path();
+    const onLogin = useCallback((event) => {
+        event?.preventDefault();
+        const login = context.service(LOGIN_SERVICE);
+        void login.begin({
+            url: path,
+            target,
+            // Only a component may call `useNavigate`, so the in-app continuation is handed to the
+            // plugin rather than reinvented by it.
+            navigate: () => { nav.go(target ?? DISPATCHER); },
+        });
+    }, [context, path, target]);
+    return [path, onLogin];
+};
+/**
+ * Wiring for a "Log out" control.
+ *
+ * One control, one handler, no decision — the mirror of {@link useLogin}. Where the session has to
+ * be ended (here, or one window up in a surrogate whose storage partition this document cannot
+ * reach) is the login plugin's call.
+ *
+ * NOT async, and nothing is awaited before delegating: logging out of a framed application opens a
+ * window, and a window opened after the gesture has finished being handled is eaten by the popup
+ * blocker. The surrogate entrypoint is resolved INSIDE the hook for the same reason `useLogin`
+ * resolves the dispatcher there.
+ *
+ * The return shape stays a bare handler rather than `useLogin`'s tuple: a logout control has no
+ * address to point at, and every generated application carries a copy of a component that writes
+ * `const onLogOut = useLogout()`. `(event?: MouseEvent) => void` is assignable to `() => void`, so
+ * `onClick={onLogOut}` keeps compiling everywhere.
+ */
+export const useLogout = (target) => {
+    const context = useContext();
+    const nav = useNavigate();
+    const path = surrogatePath(context, { intent: LoginIntent.Logout });
+    return useCallback((event) => {
+        event?.preventDefault();
+        const login = context.service(LOGIN_SERVICE);
+        void login.logout({
+            // An application whose entrypoint list predates the surrogate route logs out in place.
+            url: path ?? '',
+            ...(target != null ? { navigate: () => { nav.go(target); } } : {}),
+        });
+    }, [context, path, target]);
+};
+//# sourceMappingURL=hook.js.map

package/build/login/hook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook.js","sourceRoot":"","sources":["../../src/login/hook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAA;AAEnC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAG1D,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAE9C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,MAAe,EAAmD,EAAE;IAC3F,MAAM,OAAO,GAAG,UAAU,EAA8B,CAAA;IACxD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IACzB,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAmB,UAAU,CAAC,CAAA;IACnE,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,CAAA;IAE9B,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,KAAkB,EAAE,EAAE;QACjD,KAAK,EAAE,cAAc,EAAE,CAAA;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAe,aAAa,CAAC,CAAA;QAC1D,KAAK,KAAK,CAAC,KAAK,CAAC;YACf,GAAG,EAAE,IAAI;YACT,MAAM;YACN,uFAAuF;YACvF,uCAAuC;YACvC,QAAQ,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,MAAM,IAAI,UAAU,CAAC,CAAA,CAAC,CAAC;SACjD,CAAC,CAAA;IACJ,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;IAE3B,OAAO,CAAC,IAAI,EAAE,OAAO,CAAU,CAAA;AACjC,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,MAAe,EAAkC,EAAE;IAC3E,MAAM,OAAO,GAAG,UAAU,EAA8B,CAAA;IACxD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IACzB,MAAM,IAAI,GAAG,aAAa,CAAC,OAAkC,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAA;IAE9F,OAAO,WAAW,CAAC,CAAC,KAAkB,EAAE,EAAE;QACxC,KAAK,EAAE,cAAc,EAAE,CAAA;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAe,aAAa,CAAC,CAAA;QAC1D,KAAK,KAAK,CAAC,MAAM,CAAC;YAChB,uFAAuF;YACvF,GAAG,EAAE,IAAI,IAAI,EAAE;YACf,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,CAAA,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC,CAAA;IACJ,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;AAC7B,CAAC,CAAA"}

package/build/login/i18n/be.json

@@ -0,0 +1,37 @@
+{
+    "login": {
+        "title": "Уваход",
+        "subtitle": "Абярыце спосаб уваходу.",
+        "busy": "Адкрываем акно ўваходу…",
+        "empty": "Для гэтай праграмы не наладжаны ніводзін спосаб уваходу.",
+        "method": {
+            "google": "Працягнуць з Google",
+            "oidc": "Працягнуць з {{provider}}",
+            "oidc-default": "Увайсці / Зарэгістравацца",
+            "oidc-client": "Працягнуць з {{provider}}",
+            "basic-ed25519": "Увайсці з ключом",
+            "pk-supervisor": "Сакрэтны ключ (аператар)",
+            "wallet-consumer": "Гаманец OwlMeans ID",
+            "one-time-token": "Увайсці па кодзе з ліста",
+            "fallback": "Працягнуць з {{method}}"
+        },
+        "terms": {
+            "agreement": "Я прачытаў(-ла) і прымаю {{terms}} і {{privacy}}.",
+            "terms": "Умовы карыстання",
+            "privacy": "Палітыку прыватнасці",
+            "cookies": "Палітыку файлаў cookie",
+            "required": "Каб працягнуць, пацвердзіце Умовы карыстання і Палітыку прыватнасці."
+        },
+        "consent": {
+            "required": "Уваход захоўвае сеансавы файл cookie. Прыміце неабходныя файлы cookie, каб працягнуць."
+        },
+        "credit": {
+            "powered": "Працуе на OwlMeans"
+        },
+        "error": {
+            "failed": "Уваход не завершаны. Паспрабуйце яшчэ раз.",
+            "blocked": "Акно ўваходу заблакавана. Дазвольце ўсплывальныя вокны для гэтага сайта і паспрабуйце зноў."
+        },
+        "orphaned": "Уваход выкананы. Можаце закрыць гэтае акно і вярнуцца ў праграму."
+    }
+}

package/build/login/i18n/de.json

@@ -0,0 +1,37 @@
+{
+    "login": {
+        "title": "Anmelden",
+        "subtitle": "Wählen Sie, wie Sie fortfahren möchten.",
+        "busy": "Anmeldung wird geöffnet…",
+        "empty": "Für diese Anwendung ist keine Anmeldemethode konfiguriert.",
+        "method": {
+            "google": "Mit Google fortfahren",
+            "oidc": "Mit {{provider}} fortfahren",
+            "oidc-default": "Anmelden / Registrieren",
+            "oidc-client": "Mit {{provider}} fortfahren",
+            "basic-ed25519": "Mit einem Schlüssel anmelden",
+            "pk-supervisor": "Geheimer Schlüssel (Betreiber)",
+            "wallet-consumer": "OwlMeans-ID-Wallet",
+            "one-time-token": "Mit einem E-Mail-Code anmelden",
+            "fallback": "Mit {{method}} fortfahren"
+        },
+        "terms": {
+            "agreement": "Ich habe die {{terms}} und die {{privacy}} gelesen und stimme ihnen zu.",
+            "terms": "Allgemeinen Geschäftsbedingungen",
+            "privacy": "Datenschutzerklärung",
+            "cookies": "Cookie-Richtlinie",
+            "required": "Bitte bestätigen Sie die Allgemeinen Geschäftsbedingungen und die Datenschutzerklärung, um fortzufahren."
+        },
+        "consent": {
+            "required": "Bei der Anmeldung wird ein Sitzungs-Cookie gespeichert. Akzeptieren Sie die notwendigen Cookies, um fortzufahren."
+        },
+        "credit": {
+            "powered": "Betrieben mit OwlMeans"
+        },
+        "error": {
+            "failed": "Die Anmeldung wurde nicht abgeschlossen. Bitte versuchen Sie es erneut.",
+            "blocked": "Das Anmeldefenster wurde blockiert. Erlauben Sie Pop-ups für diese Website und versuchen Sie es erneut."
+        },
+        "orphaned": "Angemeldet. Sie können dieses Fenster schließen und in der Anwendung fortfahren."
+    }
+}

package/build/login/i18n/en.json

@@ -0,0 +1,37 @@
+{
+    "login": {
+        "title": "Sign in",
+        "subtitle": "Choose how you would like to continue.",
+        "busy": "Opening sign-in…",
+        "empty": "No sign-in method is configured for this application.",
+        "method": {
+            "google": "Continue with Google",
+            "oidc": "Continue with {{provider}}",
+            "oidc-default": "Sign in / Sign up",
+            "oidc-client": "Continue with {{provider}}",
+            "basic-ed25519": "Sign in with a key",
+            "pk-supervisor": "Secret key (operator)",
+            "wallet-consumer": "OwlMeans ID wallet",
+            "one-time-token": "Sign in with an email code",
+            "fallback": "Continue with {{method}}"
+        },
+        "terms": {
+            "agreement": "I have read and agree to the {{terms}} and the {{privacy}}.",
+            "terms": "Terms & Conditions",
+            "privacy": "Privacy Policy",
+            "cookies": "Cookie Policy",
+            "required": "Please confirm the Terms & Conditions and the Privacy Policy to continue."
+        },
+        "consent": {
+            "required": "Signing in stores a session cookie. Accept essential cookies to continue."
+        },
+        "credit": {
+            "powered": "Powered by OwlMeans"
+        },
+        "error": {
+            "failed": "Sign-in did not complete. Please try again.",
+            "blocked": "The sign-in window was blocked. Allow pop-ups for this site and try again."
+        },
+        "orphaned": "Signed in. You can close this window and continue in the application."
+    }
+}

package/build/login/i18n/es.json

@@ -0,0 +1,37 @@
+{
+    "login": {
+        "title": "Iniciar sesión",
+        "subtitle": "Elige cómo quieres continuar.",
+        "busy": "Abriendo el inicio de sesión…",
+        "empty": "No hay ningún método de inicio de sesión configurado para esta aplicación.",
+        "method": {
+            "google": "Continuar con Google",
+            "oidc": "Continuar con {{provider}}",
+            "oidc-default": "Iniciar sesión / Registrarse",
+            "oidc-client": "Continuar con {{provider}}",
+            "basic-ed25519": "Iniciar sesión con una clave",
+            "pk-supervisor": "Clave secreta (operador)",
+            "wallet-consumer": "Cartera OwlMeans ID",
+            "one-time-token": "Iniciar sesión con un código por correo",
+            "fallback": "Continuar con {{method}}"
+        },
+        "terms": {
+            "agreement": "He leído y acepto los {{terms}} y la {{privacy}}.",
+            "terms": "Términos y Condiciones",
+            "privacy": "Política de Privacidad",
+            "cookies": "Política de Cookies",
+            "required": "Confirma los Términos y Condiciones y la Política de Privacidad para continuar."
+        },
+        "consent": {
+            "required": "Iniciar sesión guarda una cookie de sesión. Acepta las cookies esenciales para continuar."
+        },
+        "credit": {
+            "powered": "Con tecnología de OwlMeans"
+        },
+        "error": {
+            "failed": "El inicio de sesión no se completó. Inténtalo de nuevo.",
+            "blocked": "Se bloqueó la ventana de inicio de sesión. Permite las ventanas emergentes para este sitio e inténtalo de nuevo."
+        },
+        "orphaned": "Sesión iniciada. Puedes cerrar esta ventana y continuar en la aplicación."
+    }
+}

package/build/login/i18n/pl.json

@@ -0,0 +1,37 @@
+{
+    "login": {
+        "title": "Zaloguj się",
+        "subtitle": "Wybierz sposób, w jaki chcesz kontynuować.",
+        "busy": "Otwieranie logowania…",
+        "empty": "Dla tej aplikacji nie skonfigurowano żadnej metody logowania.",
+        "method": {
+            "google": "Kontynuuj z Google",
+            "oidc": "Kontynuuj z {{provider}}",
+            "oidc-default": "Zaloguj się / Zarejestruj się",
+            "oidc-client": "Kontynuuj z {{provider}}",
+            "basic-ed25519": "Zaloguj się kluczem",
+            "pk-supervisor": "Klucz tajny (operator)",
+            "wallet-consumer": "Portfel OwlMeans ID",
+            "one-time-token": "Zaloguj się kodem e-mail",
+            "fallback": "Kontynuuj z {{method}}"
+        },
+        "terms": {
+            "agreement": "Przeczytałem(-am) i akceptuję {{terms}} oraz {{privacy}}.",
+            "terms": "Regulamin",
+            "privacy": "Politykę prywatności",
+            "cookies": "Politykę plików cookie",
+            "required": "Aby kontynuować, potwierdź Regulamin i Politykę prywatności."
+        },
+        "consent": {
+            "required": "Logowanie zapisuje plik cookie sesji. Zaakceptuj niezbędne pliki cookie, aby kontynuować."
+        },
+        "credit": {
+            "powered": "Napędzane przez OwlMeans"
+        },
+        "error": {
+            "failed": "Logowanie nie zostało ukończone. Spróbuj ponownie.",
+            "blocked": "Okno logowania zostało zablokowane. Zezwól na wyskakujące okienka dla tej witryny i spróbuj ponownie."
+        },
+        "orphaned": "Zalogowano. Możesz zamknąć to okno i kontynuować w aplikacji."
+    }
+}

package/build/login/i18n/ru.json

@@ -0,0 +1,37 @@
+{
+    "login": {
+        "title": "Вход",
+        "subtitle": "Выберите способ входа.",
+        "busy": "Открываем окно входа…",
+        "empty": "Для этого приложения не настроен ни один способ входа.",
+        "method": {
+            "google": "Продолжить с Google",
+            "oidc": "Продолжить с {{provider}}",
+            "oidc-default": "Войти / Зарегистрироваться",
+            "oidc-client": "Продолжить с {{provider}}",
+            "basic-ed25519": "Войти с ключом",
+            "pk-supervisor": "Секретный ключ (оператор)",
+            "wallet-consumer": "Кошелёк OwlMeans ID",
+            "one-time-token": "Войти по коду из письма",
+            "fallback": "Продолжить с {{method}}"
+        },
+        "terms": {
+            "agreement": "Я прочитал(а) и принимаю {{terms}} и {{privacy}}.",
+            "terms": "Условия использования",
+            "privacy": "Политику конфиденциальности",
+            "cookies": "Политику файлов cookie",
+            "required": "Чтобы продолжить, подтвердите Условия использования и Политику конфиденциальности."
+        },
+        "consent": {
+            "required": "Вход сохраняет сессионный файл cookie. Примите необходимые файлы cookie, чтобы продолжить."
+        },
+        "credit": {
+            "powered": "Работает на OwlMeans"
+        },
+        "error": {
+            "failed": "Вход не завершён. Попробуйте ещё раз.",
+            "blocked": "Окно входа заблокировано. Разрешите всплывающие окна для этого сайта и попробуйте снова."
+        },
+        "orphaned": "Вход выполнен. Можете закрыть это окно и вернуться в приложение."
+    }
+}