@owlmeans/client-auth 0.1.18-rc.2 → 0.1.18-rc.21

package/build/login/i18n/uk.json

@@ -0,0 +1,37 @@
+{
+    "login": {
+        "title": "Вхід",
+        "subtitle": "Оберіть спосіб входу.",
+        "busy": "Відкриваємо вікно входу…",
+        "empty": "Для цього застосунку не налаштовано жодного способу входу.",
+        "method": {
+            "google": "Продовжити з Google",
+            "oidc": "Продовжити з {{provider}}",
+            "oidc-default": "Увійти / Зареєструватися",
+            "oidc-client": "Продовжити з {{provider}}",
+            "basic-ed25519": "Увійти з ключем",
+            "pk-supervisor": "Секретний ключ (оператор)",
+            "wallet-consumer": "Гаманець OwlMeans ID",
+            "one-time-token": "Увійти за кодом з листа",
+            "fallback": "Продовжити з {{method}}"
+        },
+        "terms": {
+            "agreement": "Я прочитав(-ла) і приймаю {{terms}} та {{privacy}}.",
+            "terms": "Умови користування",
+            "privacy": "Політику конфіденційності",
+            "cookies": "Політику файлів cookie",
+            "required": "Щоб продовжити, підтвердьте Умови користування та Політику конфіденційності."
+        },
+        "consent": {
+            "required": "Вхід зберігає сеансовий файл cookie. Прийміть необхідні файли cookie, щоб продовжити."
+        },
+        "credit": {
+            "powered": "Працює на OwlMeans"
+        },
+        "error": {
+            "failed": "Вхід не завершено. Спробуйте ще раз.",
+            "blocked": "Вікно входу заблоковано. Дозвольте спливаючі вікна для цього сайту та спробуйте знову."
+        },
+        "orphaned": "Вхід виконано. Можете закрити це вікно й повернутися до застосунку."
+    }
+}

package/build/login/i18n.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=i18n.d.ts.map

package/build/login/i18n.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"i18n.d.ts","sourceRoot":"","sources":["../../src/login/i18n.ts"],"names":[],"mappings":""}

package/build/login/i18n.js

@@ -0,0 +1,25 @@
+import { addI18nLib } from '@owlmeans/i18n';
+import en from './i18n/en.json' with { type: 'json' };
+import pl from './i18n/pl.json' with { type: 'json' };
+import ru from './i18n/ru.json' with { type: 'json' };
+import be from './i18n/be.json' with { type: 'json' };
+import uk from './i18n/uk.json' with { type: 'json' };
+import es from './i18n/es.json' with { type: 'json' };
+import de from './i18n/de.json' with { type: 'json' };
+/**
+ * The sign-in screen's copy, registered into the `auth` library resource.
+ *
+ * `_addI18n` PUSHES rather than replaces, so this coexists with `@owlmeans/web-client`'s own
+ * `auth` registration (which owns `dispatcher.*` and `surrogate.*`) and the two merge by tier and
+ * priority. Registering here rather than in a UI package is what lets the plain fallback screen
+ * and every styled one read the same keys — so the seven-language rule holds on every path a user
+ * can actually reach, not only the pretty one.
+ */
+addI18nLib('en', 'auth', en);
+addI18nLib('pl', 'auth', pl);
+addI18nLib('ru', 'auth', ru);
+addI18nLib('be', 'auth', be);
+addI18nLib('uk', 'auth', uk);
+addI18nLib('es', 'auth', es);
+addI18nLib('de', 'auth', de);
+//# sourceMappingURL=i18n.js.map

package/build/login/i18n.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"i18n.js","sourceRoot":"","sources":["../../src/login/i18n.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AAErD;;;;;;;;GAQG;AACH,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;AAC5B,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;AAC5B,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;AAC5B,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;AAC5B,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;AAC5B,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;AAC5B,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA"}

package/build/login/index.d.ts

@@ -0,0 +1,15 @@
+import './i18n.js';
+export * from './consts.js';
+export * from './types.js';
+export * from './env.js';
+export * from './adopt.js';
+export * from './methods.js';
+export * from './flow.js';
+export * from './resume.js';
+export * from './terms.js';
+export * from './credit.js';
+export * from './surrogate.js';
+export * from './screen.js';
+export * from './service.js';
+export * from './hook.js';
+//# sourceMappingURL=index.d.ts.map

package/build/login/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/login/index.ts"],"names":[],"mappings":"AAAA,OAAO,WAAW,CAAA;AAElB,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,UAAU,CAAA;AACxB,cAAc,YAAY,CAAA;AAC1B,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA"}

package/build/login/index.js

@@ -0,0 +1,15 @@
+import './i18n.js';
+export * from './consts.js';
+export * from './types.js';
+export * from './env.js';
+export * from './adopt.js';
+export * from './methods.js';
+export * from './flow.js';
+export * from './resume.js';
+export * from './terms.js';
+export * from './credit.js';
+export * from './surrogate.js';
+export * from './screen.js';
+export * from './service.js';
+export * from './hook.js';
+//# sourceMappingURL=index.js.map

package/build/login/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/login/index.ts"],"names":[],"mappings":"AAAA,OAAO,WAAW,CAAA;AAElB,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,UAAU,CAAA;AACxB,cAAc,YAAY,CAAA;AAC1B,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA"}

package/build/login/methods.d.ts

@@ -0,0 +1,25 @@
+import type { LoginScreenConfig } from '@owlmeans/config';
+import type { LoginMethod, LoginMethodContext, LoginMethodSource } from './types.js';
+export declare const registerMethodSource: (source: LoginMethodSource) => void;
+export declare const listMethodSources: () => LoginMethodSource[];
+/**
+ * Everything the current environment may be offered, in the order it should be offered in.
+ *
+ * Resolution order matters and is not arbitrary:
+ *
+ * 1. Sources produce candidates. A source that throws is skipped rather than taking the screen
+ *    down — a misconfigured provider list must not remove the sign-in method that does work.
+ * 2. `restricted` candidates are dropped unless the configuration named them, which is what makes
+ *    an operator login opt-in rather than merely unadvertised.
+ * 3. An explicit `methods` list is both a filter AND the order, because an app that bothered to
+ *    list them means that list.
+ */
+export declare const resolveLoginMethods: (ctx: LoginMethodContext, cfg?: LoginScreenConfig, extra?: LoginMethodSource[]) => LoginMethod[];
+/**
+ * The method a screen highlights and focuses.
+ *
+ * The first `primary` one, else the first offered. It is highlighted, never started: requirement
+ * one of this whole feature is that nothing leaves the document without a click.
+ */
+export declare const primaryLoginMethod: (methods: LoginMethod[]) => LoginMethod | null;
+//# sourceMappingURL=methods.d.ts.map

package/build/login/methods.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"methods.d.ts","sourceRoot":"","sources":["../../src/login/methods.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAqB,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAE5E,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAgBpF,eAAO,MAAM,oBAAoB,WAAY,iBAAiB,KAAG,IAMhE,CAAA;AAED,eAAO,MAAM,iBAAiB,QAAO,iBAAiB,EAAkB,CAAA;AAiBxE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,QACzB,kBAAkB,QAAQ,iBAAiB,UAAS,iBAAiB,EAAE,KAC3E,WAAW,EA8Cb,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,YAAa,WAAW,EAAE,KAAG,WAAW,GAAG,IACG,CAAA"}

package/build/login/methods.js

@@ -0,0 +1,97 @@
+import { DEFAULT_METHOD_ORDER } from './consts.js';
+/**
+ * The module-global registry of method SOURCES.
+ *
+ * A source, rather than a method, because the two things that offer sign-in methods answer
+ * different questions at different times: the plugin registry knows what code is loaded, and the
+ * OIDC configuration knows what an entity is federated with. Both are answered per render — a
+ * provider list can arrive from the api-config middleware after the first paint.
+ *
+ * Global, like the `AuthenticationPlugin` map it mirrors, because a package registers its source
+ * from a side-effect import that has no context to hang it on. A context-scoped registry exists
+ * alongside it on the login service, and both are merged by {@link resolveLoginMethods}.
+ */
+const sources = [];
+export const registerMethodSource = (source) => {
+    const existing = sources.findIndex(candidate => candidate.alias === source.alias);
+    if (existing >= 0) {
+        sources.splice(existing, 1);
+    }
+    sources.push(source);
+};
+export const listMethodSources = () => [...sources];
+/** Normalize a config entry, which may be a bare id or a full override object. */
+const asConfig = (entry) => typeof entry === 'string' ? { id: entry } : entry;
+const merge = (method, override) => override == null ? method : {
+    ...method,
+    ...(override.label != null ? { label: override.label } : {}),
+    ...(override.i18nKey != null ? { i18nKey: override.i18nKey } : {}),
+    ...(override.icon != null ? { icon: override.icon } : {}),
+    ...(override.order != null ? { order: override.order } : {}),
+    ...(override.emphasis != null ? { emphasis: override.emphasis } : {}),
+    ...(override.params != null ? { params: { ...method.params, ...override.params } } : {}),
+};
+/**
+ * Everything the current environment may be offered, in the order it should be offered in.
+ *
+ * Resolution order matters and is not arbitrary:
+ *
+ * 1. Sources produce candidates. A source that throws is skipped rather than taking the screen
+ *    down — a misconfigured provider list must not remove the sign-in method that does work.
+ * 2. `restricted` candidates are dropped unless the configuration named them, which is what makes
+ *    an operator login opt-in rather than merely unadvertised.
+ * 3. An explicit `methods` list is both a filter AND the order, because an app that bothered to
+ *    list them means that list.
+ */
+export const resolveLoginMethods = (ctx, cfg, extra = []) => {
+    const candidates = [];
+    for (const source of [...sources, ...extra]) {
+        try {
+            candidates.push(...source.list(ctx));
+        }
+        catch (e) {
+            console.error(`login: method source "${source.alias}" failed`, e);
+        }
+    }
+    const overrides = cfg?.overrides ?? {};
+    const listed = cfg?.methods?.map(asConfig);
+    const listedIds = listed?.map(entry => entry.id).filter((id) => id != null);
+    const offered = candidates
+        .filter(method => {
+        const override = overrides[method.id] ?? listed?.find(entry => entry.id === method.id);
+        if (override?.enabled === false || override?.hidden === true) {
+            return false;
+        }
+        // A restricted method is offered only where the configuration asked for it — by naming it in
+        // `methods`, or by enabling it in `overrides`. Registering the plugin is deliberately not
+        // enough: an operator login that appears wherever its code happens to be bundled is an
+        // operator login in production.
+        if (method.restricted === true
+            && listedIds?.includes(method.id) !== true
+            && override?.enabled !== true) {
+            return false;
+        }
+        return true;
+    })
+        .map(method => merge(method, overrides[method.id]));
+    if (listedIds != null) {
+        return listedIds
+            .map(id => {
+            const method = offered.find(candidate => candidate.id === id);
+            return method != null ? merge(method, listed?.find(entry => entry.id === id)) : null;
+        })
+            .filter((method) => method != null);
+    }
+    return offered.sort((a, b) => {
+        const order = (a.order ?? DEFAULT_METHOD_ORDER) - (b.order ?? DEFAULT_METHOD_ORDER);
+        return order !== 0 ? order : a.id.localeCompare(b.id);
+    });
+};
+/**
+ * The method a screen highlights and focuses.
+ *
+ * The first `primary` one, else the first offered. It is highlighted, never started: requirement
+ * one of this whole feature is that nothing leaves the document without a click.
+ */
+export const primaryLoginMethod = (methods) => methods.find(method => method.emphasis === 'primary') ?? methods[0] ?? null;
+//# sourceMappingURL=methods.js.map

package/build/login/methods.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"methods.js","sourceRoot":"","sources":["../../src/login/methods.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAGlD;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,GAAwB,EAAE,CAAA;AAEvC,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAyB,EAAQ,EAAE;IACtE,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,CAAA;IACjF,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAClB,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IAC7B,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AACtB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAwB,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,CAAA;AAExE,kFAAkF;AAClF,MAAM,QAAQ,GAAG,CAAC,KAAiC,EAAqB,EAAE,CACxE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAA;AAEnD,MAAM,KAAK,GAAG,CAAC,MAAmB,EAAE,QAAuC,EAAe,EAAE,CAC1F,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1B,GAAG,MAAM;IACT,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CACzF,CAAA;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,GAAuB,EAAE,GAAuB,EAAE,KAAK,GAAwB,EAAE,EAClE,EAAE;IACjB,MAAM,UAAU,GAAkB,EAAE,CAAA;IACpC,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;QACtC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,yBAAyB,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC,CAAC,CAAA;QACnE,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,EAAE,SAAS,IAAI,EAAE,CAAA;IACtC,MAAM,MAAM,GAAG,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC1C,MAAM,SAAS,GAAG,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,EAAE,IAAI,IAAI,CAAC,CAAA;IAEzF,MAAM,OAAO,GAAG,UAAU;SACvB,MAAM,CAAC,MAAM,CAAC,EAAE;QACf,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAA;QACtF,IAAI,QAAQ,EAAE,OAAO,KAAK,KAAK,IAAI,QAAQ,EAAE,MAAM,KAAK,IAAI,EAAE,CAAC;YAC7D,OAAO,KAAK,CAAA;QACd,CAAC;QACD,6FAA6F;QAC7F,0FAA0F;QAC1F,uFAAuF;QACvF,gCAAgC;QAChC,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;eACzB,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI;eACvC,QAAQ,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YAChC,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAC;SACD,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAErD,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;QACtB,OAAO,SAAS;aACb,GAAG,CAAC,EAAE,CAAC,EAAE;YACR,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;YAC7D,OAAO,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACtF,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,MAAM,EAAyB,EAAE,CAAC,MAAM,IAAI,IAAI,CAAC,CAAA;IAC9D,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,oBAAoB,CAAC,CAAA;QACnF,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAsB,EAAsB,EAAE,CAC/E,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA"}

package/build/login/resume.d.ts

@@ -0,0 +1,30 @@
+import { LoginOutcome } from './types.js';
+/**
+ * The message key a FINISHED sign-in attempt should show, or null when it actually went somewhere.
+ *
+ * A dispatcher may treat `Passed` as "carry on with the ordinary continuation", because it has one.
+ * A screen does not: the user clicked, the document did not move, and nothing rendered — which is
+ * indistinguishable from a broken button, and is exactly how a null authorization URL used to
+ * present itself. Every outcome that leaves the user looking at the same screen therefore has to
+ * say something.
+ */
+export declare const loginAttemptError: (outcome: LoginOutcome | null) => string | null;
+/** What a dispatcher does once `login().resume(...)` has answered. */
+export declare enum ResumeAction {
+    /** The plugin took it over — the browser is leaving, or the window is closing. */
+    Stop = "stop",
+    /** Render the outcome to the user; there is nothing further to do automatically. */
+    Render = "render",
+    /** Ordinary tab: keep the session and carry on to the application. */
+    Navigate = "navigate"
+}
+/**
+ * The one reading of a `resume` outcome, shared by every dispatcher.
+ *
+ * Exported as a pure function because three dispatchers — `web-client`, `web-oidc-rp` and
+ * `mui-oidc-rp` — have to agree on it, and the last time they each held their own copy of a
+ * decision they drifted, which is how a popup came to render the application inside itself in two
+ * packages at once. It is also the whole rule, so it is testable without a DOM.
+ */
+export declare const resumeAction: (outcome: LoginOutcome) => ResumeAction;
+//# sourceMappingURL=resume.d.ts.map

package/build/login/resume.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resume.d.ts","sourceRoot":"","sources":["../../src/login/resume.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAEzC;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,YAAa,YAAY,GAAG,IAAI,KAAG,MAAM,GAAG,IAYzE,CAAA;AAED,sEAAsE;AACtE,oBAAY,YAAY;IACtB,kFAAkF;IAClF,IAAI,SAAS;IACb,oFAAoF;IACpF,MAAM,WAAW;IACjB,sEAAsE;IACtE,QAAQ,aAAa;CACtB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,YAAa,YAAY,KAAG,YAYpD,CAAA"}

package/build/login/resume.js

@@ -0,0 +1,55 @@
+import { LoginOutcome } from './types.js';
+/**
+ * The message key a FINISHED sign-in attempt should show, or null when it actually went somewhere.
+ *
+ * A dispatcher may treat `Passed` as "carry on with the ordinary continuation", because it has one.
+ * A screen does not: the user clicked, the document did not move, and nothing rendered — which is
+ * indistinguishable from a broken button, and is exactly how a null authorization URL used to
+ * present itself. Every outcome that leaves the user looking at the same screen therefore has to
+ * say something.
+ */
+export const loginAttemptError = (outcome) => {
+    switch (outcome) {
+        case LoginOutcome.Gesture:
+            // The window never opened. That is the popup blocker, and it has its own copy.
+            return 'login.error.blocked';
+        case LoginOutcome.Failed:
+        case LoginOutcome.Passed:
+            return 'login.error.failed';
+        default:
+            // Handled, Redirected and Orphaned all did something; Orphaned reports itself elsewhere.
+            return null;
+    }
+};
+/** What a dispatcher does once `login().resume(...)` has answered. */
+export var ResumeAction;
+(function (ResumeAction) {
+    /** The plugin took it over — the browser is leaving, or the window is closing. */
+    ResumeAction["Stop"] = "stop";
+    /** Render the outcome to the user; there is nothing further to do automatically. */
+    ResumeAction["Render"] = "render";
+    /** Ordinary tab: keep the session and carry on to the application. */
+    ResumeAction["Navigate"] = "navigate";
+})(ResumeAction || (ResumeAction = {}));
+/**
+ * The one reading of a `resume` outcome, shared by every dispatcher.
+ *
+ * Exported as a pure function because three dispatchers — `web-client`, `web-oidc-rp` and
+ * `mui-oidc-rp` — have to agree on it, and the last time they each held their own copy of a
+ * decision they drifted, which is how a popup came to render the application inside itself in two
+ * packages at once. It is also the whole rule, so it is testable without a DOM.
+ */
+export const resumeAction = (outcome) => {
+    switch (outcome) {
+        case LoginOutcome.Handled:
+        case LoginOutcome.Redirected:
+            return ResumeAction.Stop;
+        case LoginOutcome.Orphaned:
+        case LoginOutcome.Failed:
+        case LoginOutcome.Gesture:
+            return ResumeAction.Render;
+        default:
+            return ResumeAction.Navigate;
+    }
+};
+//# sourceMappingURL=resume.js.map

package/build/login/resume.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resume.js","sourceRoot":"","sources":["../../src/login/resume.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAEzC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAA4B,EAAiB,EAAE;IAC/E,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,YAAY,CAAC,OAAO;YACvB,+EAA+E;YAC/E,OAAO,qBAAqB,CAAA;QAC9B,KAAK,YAAY,CAAC,MAAM,CAAC;QACzB,KAAK,YAAY,CAAC,MAAM;YACtB,OAAO,oBAAoB,CAAA;QAC7B;YACE,yFAAyF;YACzF,OAAO,IAAI,CAAA;IACf,CAAC;AACH,CAAC,CAAA;AAED,sEAAsE;AACtE,MAAM,CAAN,IAAY,YAOX;AAPD,WAAY,YAAY;IACtB,kFAAkF;IAClF,6BAAa,CAAA;IACb,oFAAoF;IACpF,iCAAiB,CAAA;IACjB,sEAAsE;IACtE,qCAAqB,CAAA;AACvB,CAAC,EAPW,YAAY,KAAZ,YAAY,QAOvB;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAqB,EAAgB,EAAE;IAClE,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,YAAY,CAAC,OAAO,CAAC;QAC1B,KAAK,YAAY,CAAC,UAAU;YAC1B,OAAO,YAAY,CAAC,IAAI,CAAA;QAC1B,KAAK,YAAY,CAAC,QAAQ,CAAC;QAC3B,KAAK,YAAY,CAAC,MAAM,CAAC;QACzB,KAAK,YAAY,CAAC,OAAO;YACvB,OAAO,YAAY,CAAC,MAAM,CAAA;QAC5B;YACE,OAAO,YAAY,CAAC,QAAQ,CAAA;IAChC,CAAC;AACH,CAAC,CAAA"}

package/build/login/screen.d.ts

@@ -0,0 +1,17 @@
+import type { FC } from 'react';
+import type { LoginScreenProps } from './types.js';
+/**
+ * The sign-in screen every application gets, whether or not it registered a styled one.
+ *
+ * It exists because a relying party must render SOMETHING rather than start a flow on its own, and
+ * a relying party may not depend on a UI family. So this is deliberately plain: raw elements and
+ * inline styles, no Tailwind class that a consumer's stylesheet would have to scan for, no shadcn
+ * primitive a consumer would have to vendor. An application that registers a real screen through
+ * `login().registerScreen(...)` never sees it.
+ *
+ * Because it is the floor rather than the design, it still has to be correct: it offers the same
+ * methods, enforces the same terms confirmation, centres the same way, and renders the same
+ * credit line.
+ */
+export declare const FallbackLoginScreen: FC<LoginScreenProps>;
+//# sourceMappingURL=screen.d.ts.map

package/build/login/screen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"screen.d.ts","sourceRoot":"","sources":["../../src/login/screen.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAiB,EAAE,EAAE,MAAM,OAAO,CAAA;AAG9C,OAAO,KAAK,EAA6B,gBAAgB,EAAgB,MAAM,YAAY,CAAA;AA+B3F;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB,EAAE,EAAE,CAAC,gBAAgB,CAuFpD,CAAA"}

package/build/login/screen.js

@@ -0,0 +1,76 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useCallback, useState } from 'react';
+import { useContext } from '@owlmeans/client';
+import { LOGIN_SERVICE } from './consts.js';
+import { primaryLoginMethod } from './methods.js';
+import { acceptTerms, resolveTerms, termsAccepted } from './terms.js';
+import { resolveCredit } from './credit.js';
+/**
+ * The page the card sits in.
+ *
+ * It carries its own viewport height because this screen is rendered straight out of the
+ * dispatcher, into whatever the application happens to have around it — which is usually nothing
+ * with a height, so a percentage minimum would resolve to zero and leave the card at the top.
+ */
+const page = {
+    display: 'flex', alignItems: 'center', justifyContent: 'center',
+    minHeight: '100dvh', padding: '1rem',
+    fontFamily: 'system-ui, sans-serif', lineHeight: 1.5,
+};
+// Centred throughout, so the plain screen and the styled one read the same way.
+const box = {
+    width: '100%', maxWidth: '24rem', padding: '1.5rem', textAlign: 'center',
+};
+const button = (emphasis) => ({
+    display: 'block', width: '100%', marginTop: '.5rem', padding: '.625rem 1rem',
+    fontSize: '1rem', cursor: 'pointer', borderRadius: '.375rem',
+    border: '1px solid currentColor',
+    ...(emphasis === 'primary' ? { fontWeight: 600 } : {}),
+});
+/**
+ * The sign-in screen every application gets, whether or not it registered a styled one.
+ *
+ * It exists because a relying party must render SOMETHING rather than start a flow on its own, and
+ * a relying party may not depend on a UI family. So this is deliberately plain: raw elements and
+ * inline styles, no Tailwind class that a consumer's stylesheet would have to scan for, no shadcn
+ * primitive a consumer would have to vendor. An application that registers a real screen through
+ * `login().registerScreen(...)` never sees it.
+ *
+ * Because it is the floor rather than the design, it still has to be correct: it offers the same
+ * methods, enforces the same terms confirmation, centres the same way, and renders the same
+ * credit line.
+ */
+export const FallbackLoginScreen = props => {
+    const context = useContext();
+    const t = props.translate ?? ((_key, defaultValue) => defaultValue);
+    const cfg = props.config ?? context.cfg.security?.auth?.login;
+    const brand = context.cfg.brand;
+    const login = context.service(LOGIN_SERVICE);
+    const env = login.env();
+    const resolved = resolveTerms(props.terms ?? cfg?.terms);
+    const credit = resolveCredit(cfg?.credit, brand, context.cfg.service);
+    const [accepted, setAccepted] = useState(() => termsAccepted(resolved));
+    const [attempted, setAttempted] = useState(false);
+    const all = login.methods({ context, env });
+    const methods = typeof props.methods === 'function'
+        ? props.methods(all)
+        : props.methods ?? all;
+    const primary = primaryLoginMethod(methods);
+    const blocked = resolved != null && resolved.required && !accepted;
+    const select = useCallback((method) => {
+        if (blocked) {
+            setAttempted(true);
+            return;
+        }
+        void method.start({ context, env });
+    }, [blocked, context, env]);
+    const onAccept = useCallback((value) => {
+        setAccepted(value);
+        setAttempted(false);
+        acceptTerms(resolved, value);
+    }, [resolved]);
+    return _jsx("div", { "data-login-screen": true, style: page, children: _jsxs("div", { style: box, children: [_jsx("h1", { style: { fontSize: '1.25rem', marginBottom: '.25rem' }, children: props.title ?? t('login.title', 'Sign in') }), _jsx("p", { style: { opacity: .75, marginTop: 0 }, children: props.subtitle ?? t('login.subtitle', 'Choose how you would like to continue.') }), methods.length < 1
+                    ? _jsx("p", { role: "status", children: t('login.empty', 'No sign-in method is configured for this application.') })
+                    : methods.map(method => _jsx("button", { type: "button", "data-login-method": method.id, "aria-disabled": blocked, "data-blocked": blocked ? 'true' : undefined, style: { ...button(method.emphasis), opacity: blocked ? .6 : 1 }, autoFocus: method.id === primary?.id, onClick: () => select(method), children: method.label ?? t(`login.method.${method.i18nKey ?? method.id}`, method.id) }, method.id)), resolved != null && _jsxs("p", { style: { marginTop: '1rem', fontSize: '.875rem' }, children: [_jsxs("label", { children: [_jsx("input", { type: "checkbox", checked: accepted, "data-login-terms": true, onChange: event => onAccept(event.target.checked) }), ' ', t('login.terms.agreement', 'I have read and agree to the Terms & Conditions and the Privacy Policy.')] }), ' ', _jsx("a", { href: resolved.terms, target: "_blank", rel: "noreferrer noopener", children: t('login.terms.terms', 'Terms & Conditions') }), ' · ', _jsx("a", { href: resolved.privacy, target: "_blank", rel: "noreferrer noopener", children: t('login.terms.privacy', 'Privacy Policy') })] }), attempted && blocked && _jsx("p", { role: "alert", style: { color: '#b00', fontSize: '.875rem' }, children: t('login.terms.required', 'Please confirm the Terms & Conditions and the Privacy Policy to continue.') }), props.footer ?? _jsxs("p", { style: { marginTop: '2rem', fontSize: '.75rem', opacity: .7 }, children: [credit.poweredBy && _jsx("span", { children: t('login.credit.powered', 'Powered by OwlMeans') }), credit.poweredBy && credit.line != null && ' · ', credit.line] })] }) });
+};
+//# sourceMappingURL=screen.js.map

package/build/login/screen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"screen.js","sourceRoot":"","sources":["../../src/login/screen.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAE7C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAG7C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACjD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3C;;;;;;GAMG;AACH,MAAM,IAAI,GAAkB;IAC1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ;IAC/D,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM;IACpC,UAAU,EAAE,uBAAuB,EAAE,UAAU,EAAE,GAAG;CACrD,CAAA;AAED,gFAAgF;AAChF,MAAM,GAAG,GAAkB;IACzB,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ;CACzE,CAAA;AAED,MAAM,MAAM,GAAG,CAAC,QAAiB,EAAiB,EAAE,CAAC,CAAC;IACpD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc;IAC5E,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS;IAC5D,MAAM,EAAE,wBAAwB;IAChC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CACvD,CAAC,CAAA;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAyB,KAAK,CAAC,EAAE;IAC/D,MAAM,OAAO,GAAG,UAAU,EAA6B,CAAA;IACvD,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC,IAAY,EAAE,YAAoB,EAAE,EAAE,CAAC,YAAY,CAAC,CAAA;IACnF,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,IAAK,OAAO,CAAC,GAAoB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAA;IAC/E,MAAM,KAAK,GAAI,OAAO,CAAC,GAAoB,CAAC,KAAK,CAAA;IAEjD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAe,aAAa,CAAC,CAAA;IAC1D,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAA;IACvB,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,IAAI,GAAG,EAAE,KAAK,CAAC,CAAA;IACxD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAErE,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAA;IACvE,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAEjD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAA;IAC3C,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,UAAU;QACjD,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QACpB,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,GAAG,CAAA;IACxB,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAA;IAE3C,MAAM,OAAO,GAAG,QAAQ,IAAI,IAAI,IAAI,QAAQ,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAA;IAElE,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,MAAmB,EAAE,EAAE;QACjD,IAAI,OAAO,EAAE,CAAC;YACZ,YAAY,CAAC,IAAI,CAAC,CAAA;YAClB,OAAM;QACR,CAAC;QACD,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAA;IACrC,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;IAE3B,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,KAAc,EAAE,EAAE;QAC9C,WAAW,CAAC,KAAK,CAAC,CAAA;QAClB,YAAY,CAAC,KAAK,CAAC,CAAA;QACnB,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IAC9B,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEd,OAAO,yCAAuB,KAAK,EAAE,IAAI,YAAE,eAAK,KAAK,EAAE,GAAG,aACxD,aAAI,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,YACvD,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,aAAa,EAAE,SAAS,CAAC,GACxC,EACL,YAAG,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,YACrC,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,gBAAgB,EAAE,wCAAwC,CAAC,GAC9E,EAEH,OAAO,CAAC,MAAM,GAAG,CAAC;oBACjB,CAAC,CAAC,YAAG,IAAI,EAAC,QAAQ,YAAE,CAAC,CAAC,aAAa,EAAE,uDAAuD,CAAC,GAAK;oBAClG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,iBACN,IAAI,EAAC,QAAQ,uBAAoB,MAAM,CAAC,EAAE,mBAG3C,OAAO,kBAAgB,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAClE,KAAK,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAChE,SAAS,EAAE,MAAM,CAAC,EAAE,KAAK,OAAO,EAAE,EAAE,EACpC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,YAE5B,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,gBAAgB,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,IARvE,MAAM,CAAC,EAAE,CASP,CAAC,EAEX,QAAQ,IAAI,IAAI,IAAI,aAAG,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,aACvE,4BACE,gBACE,IAAI,EAAC,UAAU,EAAC,OAAO,EAAE,QAAQ,4BACjC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GACjD,EAAC,GAAG,EACL,CAAC,CAAC,uBAAuB,EAAE,yEAAyE,CAAC,IAChG,EACP,GAAG,EACJ,YAAG,IAAI,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAC,QAAQ,EAAC,GAAG,EAAC,qBAAqB,YAC/D,CAAC,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,GAC3C,EACH,KAAK,EACN,YAAG,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAC,QAAQ,EAAC,GAAG,EAAC,qBAAqB,YACjE,CAAC,CAAC,qBAAqB,EAAE,gBAAgB,CAAC,GACzC,IACF,EAEH,SAAS,IAAI,OAAO,IAAI,YAAG,IAAI,EAAC,OAAO,EAAC,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,YACnF,CAAC,CAAC,sBAAsB,EACvB,2EAA2E,CAAC,GAC5E,EAEH,KAAK,CAAC,MAAM,IAAI,aAAG,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,aAC9E,MAAM,CAAC,SAAS,IAAI,yBAAO,CAAC,CAAC,sBAAsB,EAAE,qBAAqB,CAAC,GAAQ,EACnF,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,IAAI,IAAI,IAAI,KAAK,EAChD,MAAM,CAAC,IAAI,IACV,IACA,GAAM,CAAA;AACd,CAAC,CAAA"}

package/build/login/service.d.ts

@@ -0,0 +1,31 @@
+import type { BasicConfig, BasicContext } from '@owlmeans/context';
+import { LoginOutcome } from './types.js';
+import type { LoginService, LoginServiceAppend } from './types.js';
+/**
+ * Login service = plugin host. It holds a registry of login plugins and, on every facade call,
+ * resolves the active plugin by cascade (priority desc, first whose `match(env)` is truthy) and
+ * delegates to it.
+ *
+ * The facade methods stay ordinary writable properties (never getters) so that non-plugin
+ * implementations — e.g. a native login service — can keep overriding them directly.
+ *
+ * It is a LAZY service on purpose. The host carries no async setup, and plugin packages must be
+ * able to reach it from an app's `makeContext` — i.e. while the context is still in the Loading
+ * stage. `context.service()` throws for an uninitialized non-lazy service, which would make
+ * `ensureLoginService` fail exactly where apps are told to call it.
+ *
+ * `begin` and `logout` are deliberately NOT `async`. An async facade method defers the plugin's
+ * body past a microtask boundary, and a `window.open` that lands after the user gesture has
+ * finished being handled is eaten by the popup blocker. The same rule binds every plugin's own
+ * `begin` and `logout`, and it is why a precondition must be synchronous too.
+ */
+export declare const makeLoginService: (alias?: string) => LoginService;
+/**
+ * Idempotently obtain the login service on a context, registering an empty host if none exists
+ * yet. Plugin packages call this before `registerPlugin`.
+ */
+export declare const ensureLoginService: (ctx: BasicContext<any>) => LoginService;
+/** Register the host and expose it as `context.login()`. */
+export declare const appendLogin: <C extends BasicConfig, T extends BasicContext<C>>(ctx: T) => T & LoginServiceAppend;
+export { LoginOutcome };
+//# sourceMappingURL=service.d.ts.map

package/build/login/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/login/service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAMlE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,KAAK,EAEV,YAAY,EAAE,kBAAkB,EACjC,MAAM,YAAY,CAAA;AAEnB;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,gBAAgB,WAAW,MAAM,KAAmB,YA0HhE,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,QAAS,YAAY,CAAC,GAAG,CAAC,KAAG,YAQ3D,CAAA;AAED,4DAA4D;AAC5D,eAAO,MAAM,WAAW,GAAI,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC,OACrE,CAAC,KACL,CAAC,GAAG,kBAMN,CAAA;AAED,OAAO,EAAE,YAAY,EAAE,CAAA"}

package/build/login/service.js

@@ -0,0 +1,137 @@
+import { createLazyService } from '@owlmeans/context';
+import { DEFAULT_ALIAS } from './consts.js';
+import { defaultLoginEnv } from './env.js';
+import { adoptToken, revokeToken } from './adopt.js';
+import { resolveLoginMethods } from './methods.js';
+import { LoginOutcome } from './types.js';
+/**
+ * Login service = plugin host. It holds a registry of login plugins and, on every facade call,
+ * resolves the active plugin by cascade (priority desc, first whose `match(env)` is truthy) and
+ * delegates to it.
+ *
+ * The facade methods stay ordinary writable properties (never getters) so that non-plugin
+ * implementations — e.g. a native login service — can keep overriding them directly.
+ *
+ * It is a LAZY service on purpose. The host carries no async setup, and plugin packages must be
+ * able to reach it from an app's `makeContext` — i.e. while the context is still in the Loading
+ * stage. `context.service()` throws for an uninitialized non-lazy service, which would make
+ * `ensureLoginService` fail exactly where apps are told to call it.
+ *
+ * `begin` and `logout` are deliberately NOT `async`. An async facade method defers the plugin's
+ * body past a microtask boundary, and a `window.open` that lands after the user gesture has
+ * finished being handled is eaten by the popup blocker. The same rule binds every plugin's own
+ * `begin` and `logout`, and it is why a precondition must be synchronous too.
+ */
+export const makeLoginService = (alias = DEFAULT_ALIAS) => {
+    const plugins = [];
+    const preconditions = [];
+    const methodSources = [];
+    let screen = null;
+    const ctx = () => service.ctx;
+    const service = createLazyService(alias, {
+        registerPlugin: (plugin) => {
+            const existing = plugins.findIndex(candidate => candidate.alias === plugin.alias);
+            if (existing >= 0) {
+                plugins.splice(existing, 1);
+            }
+            plugins.push(plugin);
+            plugins.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
+        },
+        registerPrecondition: (precondition) => {
+            const existing = preconditions.findIndex(candidate => candidate.alias === precondition.alias);
+            if (existing >= 0) {
+                preconditions.splice(existing, 1);
+            }
+            preconditions.push(precondition);
+            preconditions.sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
+        },
+        registerMethodSource: (source) => {
+            const existing = methodSources.findIndex(candidate => candidate.alias === source.alias);
+            if (existing >= 0) {
+                methodSources.splice(existing, 1);
+            }
+            methodSources.push(source);
+        },
+        methods: methodCtx => resolveLoginMethods(methodCtx, methodCtx.context.cfg.security?.auth?.login, methodSources),
+        registerScreen: value => { screen = value; },
+        screen: () => screen,
+        plugin: env => {
+            const environment = env ?? defaultLoginEnv();
+            const plugin = plugins.find(candidate => candidate.match?.(environment, service.ctx) ?? true);
+            if (plugin == null) {
+                throw new Error('login: no plugin matches the current environment');
+            }
+            return plugin;
+        },
+        env: () => defaultLoginEnv(),
+        enter: () => {
+            const env = defaultLoginEnv();
+            service.plugin(env).enter?.(ctx(), env);
+        },
+        begin: request => {
+            const env = defaultLoginEnv();
+            // Synchronously, before anything can open a window: a precondition that refuses leaves the
+            // user exactly where `Gesture` describes — unable to proceed until they act again.
+            for (const precondition of preconditions) {
+                if (!precondition.check(ctx(), request, env)) {
+                    return Promise.resolve(LoginOutcome.Gesture);
+                }
+            }
+            return service.plugin(env).begin(ctx(), request, env);
+        },
+        authorize: async (url) => {
+            const env = defaultLoginEnv();
+            return await service.plugin(env).authorize(ctx(), url, env);
+        },
+        complete: async (token) => {
+            const env = defaultLoginEnv();
+            return await service.plugin(env).complete(ctx(), token, env);
+        },
+        resume: async (token) => {
+            const env = defaultLoginEnv();
+            // Absent means "keep it and carry on" — which is what an ordinary tab has always done, and
+            // is why the redirect plugin implements nothing here.
+            return await service.plugin(env).resume?.(ctx(), token, env) ?? LoginOutcome.Passed;
+        },
+        logout: request => {
+            const env = defaultLoginEnv();
+            const plugin = service.plugin(env);
+            if (plugin.logout == null) {
+                // A plugin with no logout mechanic still has to end the session it started.
+                return revokeToken(ctx()).then(async () => {
+                    await request.navigate?.();
+                    return LoginOutcome.Passed;
+                });
+            }
+            return plugin.logout(ctx(), request, env);
+        },
+        logoutComplete: async () => {
+            const env = defaultLoginEnv();
+            return await service.plugin(env).logoutComplete?.(ctx(), env) ?? LoginOutcome.Passed;
+        },
+        adopt: async (token) => { await adoptToken(ctx(), token); },
+        revoke: async () => { await revokeToken(ctx()); },
+    });
+    return service;
+};
+/**
+ * Idempotently obtain the login service on a context, registering an empty host if none exists
+ * yet. Plugin packages call this before `registerPlugin`.
+ */
+export const ensureLoginService = (ctx) => {
+    if (ctx.hasService(DEFAULT_ALIAS)) {
+        return ctx.service(DEFAULT_ALIAS);
+    }
+    const service = makeLoginService();
+    ctx.registerService(service);
+    return service;
+};
+/** Register the host and expose it as `context.login()`. */
+export const appendLogin = (ctx) => {
+    ensureLoginService(ctx);
+    const contextual = ctx;
+    contextual.login = () => ctx.service(DEFAULT_ALIAS);
+    return contextual;
+};
+export { LoginOutcome };
+//# sourceMappingURL=service.js.map