@owlmeans/client-auth 0.1.18-rc.4 → 0.1.18-rc.41

package/build/login/hook.js

@@ -0,0 +1,72 @@
+import { useCallback } from 'react';
+import { useContext, useNavigate } from '@owlmeans/client';
+import { DISPATCHER } from '@owlmeans/auth';
+import { LoginIntent } from './types.js';
+import { LOGIN_SERVICE } from './consts.js';
+import { surrogatePath } from './surrogate.js';
+/**
+ * Wiring for a "Log in" control: where it points, and what it does when clicked.
+ *
+ * The caller renders one control and attaches one handler — which browsing context the flow can
+ * actually complete in is the login service's problem, not the app's. An ordinary tab redirects;
+ * an app embedded in a frame runs the flow one window up, because the provider refuses to be
+ * framed and its cookies are third-party there.
+ *
+ * The returned handler is deliberately NOT async and awaits nothing before delegating: a window
+ * opened after the user gesture has finished being handled is eaten by the popup blocker.
+ *
+ * The dispatcher entrypoint is resolved INSIDE the hook, never at module scope. Module bodies run
+ * while the app is still being imported, before `registerEntrypoints` has put anything on the
+ * context, and a top-level lookup throws `Entrypoint dispatcher not found` — which escapes during
+ * import, takes the whole render down, and paints an empty page with no component at fault.
+ */
+export const useLogin = (target) => {
+    const context = useContext();
+    const nav = useNavigate();
+    const dispatcher = context.entrypoint(DISPATCHER);
+    const path = dispatcher.path();
+    const onLogin = useCallback((event) => {
+        event?.preventDefault();
+        const login = context.service(LOGIN_SERVICE);
+        void login.begin({
+            url: path,
+            target,
+            // Only a component may call `useNavigate`, so the in-app continuation is handed to the
+            // plugin rather than reinvented by it.
+            navigate: () => { nav.go(target ?? DISPATCHER); },
+        });
+    }, [context, path, target]);
+    return [path, onLogin];
+};
+/**
+ * Wiring for a "Log out" control.
+ *
+ * One control, one handler, no decision — the mirror of {@link useLogin}. Where the session has to
+ * be ended (here, or one window up in a surrogate whose storage partition this document cannot
+ * reach) is the login plugin's call.
+ *
+ * NOT async, and nothing is awaited before delegating: logging out of a framed application opens a
+ * window, and a window opened after the gesture has finished being handled is eaten by the popup
+ * blocker. The surrogate entrypoint is resolved INSIDE the hook for the same reason `useLogin`
+ * resolves the dispatcher there.
+ *
+ * The return shape stays a bare handler rather than `useLogin`'s tuple: a logout control has no
+ * address to point at, and every generated application carries a copy of a component that writes
+ * `const onLogOut = useLogout()`. `(event?: MouseEvent) => void` is assignable to `() => void`, so
+ * `onClick={onLogOut}` keeps compiling everywhere.
+ */
+export const useLogout = (target) => {
+    const context = useContext();
+    const nav = useNavigate();
+    const path = surrogatePath(context, { intent: LoginIntent.Logout });
+    return useCallback((event) => {
+        event?.preventDefault();
+        const login = context.service(LOGIN_SERVICE);
+        void login.logout({
+            // An application whose entrypoint list predates the surrogate route logs out in place.
+            url: path ?? '',
+            ...(target != null ? { navigate: () => { nav.go(target); } } : {}),
+        });
+    }, [context, path, target]);
+};
+//# sourceMappingURL=hook.js.map

package/build/login/hook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hook.js","sourceRoot":"","sources":["../../src/login/hook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAA;AAEnC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAG1D,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAE9C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,MAAe,EAAmD,EAAE;IAC3F,MAAM,OAAO,GAAG,UAAU,EAA8B,CAAA;IACxD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IACzB,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAmB,UAAU,CAAC,CAAA;IACnE,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,CAAA;IAE9B,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,KAAkB,EAAE,EAAE;QACjD,KAAK,EAAE,cAAc,EAAE,CAAA;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAe,aAAa,CAAC,CAAA;QAC1D,KAAK,KAAK,CAAC,KAAK,CAAC;YACf,GAAG,EAAE,IAAI;YACT,MAAM;YACN,uFAAuF;YACvF,uCAAuC;YACvC,QAAQ,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,MAAM,IAAI,UAAU,CAAC,CAAA,CAAC,CAAC;SACjD,CAAC,CAAA;IACJ,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;IAE3B,OAAO,CAAC,IAAI,EAAE,OAAO,CAAU,CAAA;AACjC,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,MAAe,EAAkC,EAAE;IAC3E,MAAM,OAAO,GAAG,UAAU,EAA8B,CAAA;IACxD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IACzB,MAAM,IAAI,GAAG,aAAa,CAAC,OAAkC,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAA;IAE9F,OAAO,WAAW,CAAC,CAAC,KAAkB,EAAE,EAAE;QACxC,KAAK,EAAE,cAAc,EAAE,CAAA;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAe,aAAa,CAAC,CAAA;QAC1D,KAAK,KAAK,CAAC,MAAM,CAAC;YAChB,uFAAuF;YACvF,GAAG,EAAE,IAAI,IAAI,EAAE;YACf,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,CAAA,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC,CAAA;IACJ,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;AAC7B,CAAC,CAAA"}

package/build/login/i18n/be.json

@@ -0,0 +1,37 @@
+{
+    "login": {
+        "title": "Уваход",
+        "subtitle": "Абярыце спосаб уваходу.",
+        "busy": "Адкрываем акно ўваходу…",
+        "empty": "Для гэтай праграмы не наладжаны ніводзін спосаб уваходу.",
+        "method": {
+            "google": "Працягнуць з Google",
+            "oidc": "Працягнуць з {{provider}}",
+            "oidc-default": "Увайсці / Зарэгістравацца",
+            "oidc-client": "Працягнуць з {{provider}}",
+            "basic-ed25519": "Увайсці з ключом",
+            "pk-supervisor": "Сакрэтны ключ (аператар)",
+            "wallet-consumer": "Гаманец OwlMeans ID",
+            "one-time-token": "Увайсці па кодзе з ліста",
+            "fallback": "Працягнуць з {{method}}"
+        },
+        "terms": {
+            "agreement": "Я прачытаў(-ла) і прымаю {{terms}} і {{privacy}}.",
+            "terms": "Умовы карыстання",
+            "privacy": "Палітыку прыватнасці",
+            "cookies": "Палітыку файлаў cookie",
+            "required": "Каб працягнуць, пацвердзіце Умовы карыстання і Палітыку прыватнасці."
+        },
+        "consent": {
+            "required": "Уваход захоўвае сеансавы файл cookie. Прыміце неабходныя файлы cookie, каб працягнуць."
+        },
+        "credit": {
+            "powered": "Працуе на OwlMeans"
+        },
+        "error": {
+            "failed": "Уваход не завершаны. Паспрабуйце яшчэ раз.",
+            "blocked": "Акно ўваходу заблакавана. Націсніце значок заблакаванага ўсплывальнага акна ў адрасным радку браўзера, каб адкрыць яго."
+        },
+        "orphaned": "Уваход выкананы. Можаце закрыць гэтае акно і вярнуцца ў праграму."
+    }
+}

package/build/login/i18n/de.json

@@ -0,0 +1,37 @@
+{
+    "login": {
+        "title": "Anmelden",
+        "subtitle": "Wählen Sie, wie Sie fortfahren möchten.",
+        "busy": "Anmeldung wird geöffnet…",
+        "empty": "Für diese Anwendung ist keine Anmeldemethode konfiguriert.",
+        "method": {
+            "google": "Mit Google fortfahren",
+            "oidc": "Mit {{provider}} fortfahren",
+            "oidc-default": "Anmelden / Registrieren",
+            "oidc-client": "Mit {{provider}} fortfahren",
+            "basic-ed25519": "Mit einem Schlüssel anmelden",
+            "pk-supervisor": "Geheimer Schlüssel (Betreiber)",
+            "wallet-consumer": "OwlMeans-ID-Wallet",
+            "one-time-token": "Mit einem E-Mail-Code anmelden",
+            "fallback": "Mit {{method}} fortfahren"
+        },
+        "terms": {
+            "agreement": "Ich habe die {{terms}} und die {{privacy}} gelesen und stimme ihnen zu.",
+            "terms": "Allgemeinen Geschäftsbedingungen",
+            "privacy": "Datenschutzerklärung",
+            "cookies": "Cookie-Richtlinie",
+            "required": "Bitte bestätigen Sie die Allgemeinen Geschäftsbedingungen und die Datenschutzerklärung, um fortzufahren."
+        },
+        "consent": {
+            "required": "Bei der Anmeldung wird ein Sitzungs-Cookie gespeichert. Akzeptieren Sie die notwendigen Cookies, um fortzufahren."
+        },
+        "credit": {
+            "powered": "Betrieben mit OwlMeans"
+        },
+        "error": {
+            "failed": "Die Anmeldung wurde nicht abgeschlossen. Bitte versuchen Sie es erneut.",
+            "blocked": "Das Anmeldefenster wurde blockiert. Klicken Sie auf das Symbol für blockierte Pop-ups in der Adressleiste Ihres Browsers, um es zu öffnen."
+        },
+        "orphaned": "Angemeldet. Sie können dieses Fenster schließen und in der Anwendung fortfahren."
+    }
+}

package/build/login/i18n/en.json

@@ -0,0 +1,37 @@
+{
+    "login": {
+        "title": "Sign in",
+        "subtitle": "Choose how you would like to continue.",
+        "busy": "Opening sign-in…",
+        "empty": "No sign-in method is configured for this application.",
+        "method": {
+            "google": "Continue with Google",
+            "oidc": "Continue with {{provider}}",
+            "oidc-default": "Sign in / Sign up",
+            "oidc-client": "Continue with {{provider}}",
+            "basic-ed25519": "Sign in with a key",
+            "pk-supervisor": "Secret key (operator)",
+            "wallet-consumer": "OwlMeans ID wallet",
+            "one-time-token": "Sign in with an email code",
+            "fallback": "Continue with {{method}}"
+        },
+        "terms": {
+            "agreement": "I have read and agree to the {{terms}} and the {{privacy}}.",
+            "terms": "Terms & Conditions",
+            "privacy": "Privacy Policy",
+            "cookies": "Cookie Policy",
+            "required": "Please confirm the Terms & Conditions and the Privacy Policy to continue."
+        },
+        "consent": {
+            "required": "Signing in stores a session cookie. Accept essential cookies to continue."
+        },
+        "credit": {
+            "powered": "Powered by OwlMeans"
+        },
+        "error": {
+            "failed": "Sign-in did not complete. Please try again.",
+            "blocked": "The sign-in window was blocked. Click the blocked pop-up icon in your browser's address bar to open it."
+        },
+        "orphaned": "Signed in. You can close this window and continue in the application."
+    }
+}

package/build/login/i18n/es.json

@@ -0,0 +1,37 @@
+{
+    "login": {
+        "title": "Iniciar sesión",
+        "subtitle": "Elige cómo quieres continuar.",
+        "busy": "Abriendo el inicio de sesión…",
+        "empty": "No hay ningún método de inicio de sesión configurado para esta aplicación.",
+        "method": {
+            "google": "Continuar con Google",
+            "oidc": "Continuar con {{provider}}",
+            "oidc-default": "Iniciar sesión / Registrarse",
+            "oidc-client": "Continuar con {{provider}}",
+            "basic-ed25519": "Iniciar sesión con una clave",
+            "pk-supervisor": "Clave secreta (operador)",
+            "wallet-consumer": "Cartera OwlMeans ID",
+            "one-time-token": "Iniciar sesión con un código por correo",
+            "fallback": "Continuar con {{method}}"
+        },
+        "terms": {
+            "agreement": "He leído y acepto los {{terms}} y la {{privacy}}.",
+            "terms": "Términos y Condiciones",
+            "privacy": "Política de Privacidad",
+            "cookies": "Política de Cookies",
+            "required": "Confirma los Términos y Condiciones y la Política de Privacidad para continuar."
+        },
+        "consent": {
+            "required": "Iniciar sesión guarda una cookie de sesión. Acepta las cookies esenciales para continuar."
+        },
+        "credit": {
+            "powered": "Con tecnología de OwlMeans"
+        },
+        "error": {
+            "failed": "El inicio de sesión no se completó. Inténtalo de nuevo.",
+            "blocked": "Se bloqueó la ventana de inicio de sesión. Haz clic en el icono de ventana emergente bloqueada en la barra de direcciones del navegador para abrirla."
+        },
+        "orphaned": "Sesión iniciada. Puedes cerrar esta ventana y continuar en la aplicación."
+    }
+}

package/build/login/i18n/fr.json

@@ -0,0 +1,37 @@
+{
+    "login": {
+        "title": "Connexion",
+        "subtitle": "Choisissez comment continuer.",
+        "busy": "Ouverture de la connexion…",
+        "empty": "Aucune méthode de connexion n’est configurée pour cette application.",
+        "method": {
+            "google": "Continuer avec Google",
+            "oidc": "Continuer avec {{provider}}",
+            "oidc-default": "Connexion / Inscription",
+            "oidc-client": "Continuer avec {{provider}}",
+            "basic-ed25519": "Se connecter avec une clé",
+            "pk-supervisor": "Clé secrète (opérateur)",
+            "wallet-consumer": "Portefeuille d’identité OwlMeans",
+            "one-time-token": "Se connecter avec un code e-mail",
+            "fallback": "Continuer avec {{method}}"
+        },
+        "terms": {
+            "agreement": "J’ai lu et j’accepte les {{terms}} et la {{privacy}}.",
+            "terms": "conditions générales",
+            "privacy": "politique de confidentialité",
+            "cookies": "Politique relative aux cookies",
+            "required": "Confirmez les conditions générales et la politique de confidentialité pour continuer."
+        },
+        "consent": {
+            "required": "La connexion enregistre un cookie de session. Acceptez les cookies essentiels pour continuer."
+        },
+        "credit": {
+            "powered": "Propulsé par OwlMeans"
+        },
+        "error": {
+            "failed": "La connexion n’a pas abouti. Réessayez.",
+            "blocked": "La fenêtre de connexion a été bloquée. Cliquez sur l’icône de fenêtre contextuelle bloquée dans la barre d’adresse pour l’ouvrir."
+        },
+        "orphaned": "Vous êtes connecté. Vous pouvez fermer cette fenêtre et continuer dans l’application."
+    }
+}

package/build/login/i18n/pl.json

@@ -0,0 +1,37 @@
+{
+    "login": {
+        "title": "Zaloguj się",
+        "subtitle": "Wybierz sposób, w jaki chcesz kontynuować.",
+        "busy": "Otwieranie logowania…",
+        "empty": "Dla tej aplikacji nie skonfigurowano żadnej metody logowania.",
+        "method": {
+            "google": "Kontynuuj z Google",
+            "oidc": "Kontynuuj z {{provider}}",
+            "oidc-default": "Zaloguj się / Zarejestruj się",
+            "oidc-client": "Kontynuuj z {{provider}}",
+            "basic-ed25519": "Zaloguj się kluczem",
+            "pk-supervisor": "Klucz tajny (operator)",
+            "wallet-consumer": "Portfel OwlMeans ID",
+            "one-time-token": "Zaloguj się kodem e-mail",
+            "fallback": "Kontynuuj z {{method}}"
+        },
+        "terms": {
+            "agreement": "Przeczytałem(-am) i akceptuję {{terms}} oraz {{privacy}}.",
+            "terms": "Regulamin",
+            "privacy": "Politykę prywatności",
+            "cookies": "Politykę plików cookie",
+            "required": "Aby kontynuować, potwierdź Regulamin i Politykę prywatności."
+        },
+        "consent": {
+            "required": "Logowanie zapisuje plik cookie sesji. Zaakceptuj niezbędne pliki cookie, aby kontynuować."
+        },
+        "credit": {
+            "powered": "Napędzane przez OwlMeans"
+        },
+        "error": {
+            "failed": "Logowanie nie zostało ukończone. Spróbuj ponownie.",
+            "blocked": "Okno logowania zostało zablokowane. Kliknij ikonę zablokowanego okienka w pasku adresu przeglądarki, aby je otworzyć."
+        },
+        "orphaned": "Zalogowano. Możesz zamknąć to okno i kontynuować w aplikacji."
+    }
+}

package/build/login/i18n/ru.json

@@ -0,0 +1,37 @@
+{
+    "login": {
+        "title": "Вход",
+        "subtitle": "Выберите способ входа.",
+        "busy": "Открываем окно входа…",
+        "empty": "Для этого приложения не настроен ни один способ входа.",
+        "method": {
+            "google": "Продолжить с Google",
+            "oidc": "Продолжить с {{provider}}",
+            "oidc-default": "Войти / Зарегистрироваться",
+            "oidc-client": "Продолжить с {{provider}}",
+            "basic-ed25519": "Войти с ключом",
+            "pk-supervisor": "Секретный ключ (оператор)",
+            "wallet-consumer": "Кошелёк OwlMeans ID",
+            "one-time-token": "Войти по коду из письма",
+            "fallback": "Продолжить с {{method}}"
+        },
+        "terms": {
+            "agreement": "Я прочитал(а) и принимаю {{terms}} и {{privacy}}.",
+            "terms": "Условия использования",
+            "privacy": "Политику конфиденциальности",
+            "cookies": "Политику файлов cookie",
+            "required": "Чтобы продолжить, подтвердите Условия использования и Политику конфиденциальности."
+        },
+        "consent": {
+            "required": "Вход сохраняет сессионный файл cookie. Примите необходимые файлы cookie, чтобы продолжить."
+        },
+        "credit": {
+            "powered": "Работает на OwlMeans"
+        },
+        "error": {
+            "failed": "Вход не завершён. Попробуйте ещё раз.",
+            "blocked": "Окно входа заблокировано. Нажмите на значок заблокированного всплывающего окна в адресной строке браузера, чтобы открыть его."
+        },
+        "orphaned": "Вход выполнен. Можете закрыть это окно и вернуться в приложение."
+    }
+}

package/build/login/i18n/uk.json

@@ -0,0 +1,37 @@
+{
+    "login": {
+        "title": "Вхід",
+        "subtitle": "Оберіть спосіб входу.",
+        "busy": "Відкриваємо вікно входу…",
+        "empty": "Для цього застосунку не налаштовано жодного способу входу.",
+        "method": {
+            "google": "Продовжити з Google",
+            "oidc": "Продовжити з {{provider}}",
+            "oidc-default": "Увійти / Зареєструватися",
+            "oidc-client": "Продовжити з {{provider}}",
+            "basic-ed25519": "Увійти з ключем",
+            "pk-supervisor": "Секретний ключ (оператор)",
+            "wallet-consumer": "Гаманець OwlMeans ID",
+            "one-time-token": "Увійти за кодом з листа",
+            "fallback": "Продовжити з {{method}}"
+        },
+        "terms": {
+            "agreement": "Я прочитав(-ла) і приймаю {{terms}} та {{privacy}}.",
+            "terms": "Умови користування",
+            "privacy": "Політику конфіденційності",
+            "cookies": "Політику файлів cookie",
+            "required": "Щоб продовжити, підтвердьте Умови користування та Політику конфіденційності."
+        },
+        "consent": {
+            "required": "Вхід зберігає сеансовий файл cookie. Прийміть необхідні файли cookie, щоб продовжити."
+        },
+        "credit": {
+            "powered": "Працює на OwlMeans"
+        },
+        "error": {
+            "failed": "Вхід не завершено. Спробуйте ще раз.",
+            "blocked": "Вікно входу заблоковано. Натисніть значок заблокованого спливаючого вікна в адресному рядку браузера, щоб відкрити його."
+        },
+        "orphaned": "Вхід виконано. Можете закрити це вікно й повернутися до застосунку."
+    }
+}

package/build/login/i18n.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=i18n.d.ts.map

package/build/login/i18n.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"i18n.d.ts","sourceRoot":"","sources":["../../src/login/i18n.ts"],"names":[],"mappings":""}

package/build/login/i18n.js

@@ -0,0 +1,27 @@
+import { addI18nLib } from '@owlmeans/i18n';
+import en from './i18n/en.json' with { type: 'json' };
+import pl from './i18n/pl.json' with { type: 'json' };
+import ru from './i18n/ru.json' with { type: 'json' };
+import be from './i18n/be.json' with { type: 'json' };
+import uk from './i18n/uk.json' with { type: 'json' };
+import es from './i18n/es.json' with { type: 'json' };
+import de from './i18n/de.json' with { type: 'json' };
+import fr from './i18n/fr.json' with { type: 'json' };
+/**
+ * The sign-in screen's copy, registered into the `auth` library resource.
+ *
+ * `_addI18n` PUSHES rather than replaces, so this coexists with `@owlmeans/web-client`'s own
+ * `auth` registration (which owns `dispatcher.*` and `surrogate.*`) and the two merge by tier and
+ * priority. Registering here rather than in a UI package is what lets the plain fallback screen
+ * and every styled one read the same keys — so the seven-language rule holds on every path a user
+ * can actually reach, not only the pretty one.
+ */
+addI18nLib('en', 'auth', en);
+addI18nLib('pl', 'auth', pl);
+addI18nLib('ru', 'auth', ru);
+addI18nLib('be', 'auth', be);
+addI18nLib('uk', 'auth', uk);
+addI18nLib('es', 'auth', es);
+addI18nLib('de', 'auth', de);
+addI18nLib('fr', 'auth', fr);
+//# sourceMappingURL=i18n.js.map

package/build/login/i18n.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"i18n.js","sourceRoot":"","sources":["../../src/login/i18n.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AAErD;;;;;;;;GAQG;AACH,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;AAC5B,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;AAC5B,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;AAC5B,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;AAC5B,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;AAC5B,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;AAC5B,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;AAC5B,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA"}

package/build/login/index.d.ts

@@ -0,0 +1,15 @@
+import './i18n.js';
+export * from './consts.js';
+export * from './types.js';
+export * from './env.js';
+export * from './adopt.js';
+export * from './methods.js';
+export * from './flow.js';
+export * from './resume.js';
+export * from './terms.js';
+export * from './credit.js';
+export * from './surrogate.js';
+export * from './screen.js';
+export * from './service.js';
+export * from './hook.js';
+//# sourceMappingURL=index.d.ts.map

package/build/login/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/login/index.ts"],"names":[],"mappings":"AAAA,OAAO,WAAW,CAAA;AAElB,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,UAAU,CAAA;AACxB,cAAc,YAAY,CAAA;AAC1B,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA"}

package/build/login/index.js

@@ -0,0 +1,15 @@
+import './i18n.js';
+export * from './consts.js';
+export * from './types.js';
+export * from './env.js';
+export * from './adopt.js';
+export * from './methods.js';
+export * from './flow.js';
+export * from './resume.js';
+export * from './terms.js';
+export * from './credit.js';
+export * from './surrogate.js';
+export * from './screen.js';
+export * from './service.js';
+export * from './hook.js';
+//# sourceMappingURL=index.js.map

package/build/login/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/login/index.ts"],"names":[],"mappings":"AAAA,OAAO,WAAW,CAAA;AAElB,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,UAAU,CAAA;AACxB,cAAc,YAAY,CAAA;AAC1B,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA"}

package/build/login/methods.d.ts

@@ -0,0 +1,25 @@
+import type { LoginScreenConfig } from '@owlmeans/config';
+import type { LoginMethod, LoginMethodContext, LoginMethodSource } from './types.js';
+export declare const registerMethodSource: (source: LoginMethodSource) => void;
+export declare const listMethodSources: () => LoginMethodSource[];
+/**
+ * Everything the current environment may be offered, in the order it should be offered in.
+ *
+ * Resolution order matters and is not arbitrary:
+ *
+ * 1. Sources produce candidates. A source that throws is skipped rather than taking the screen
+ *    down — a misconfigured provider list must not remove the sign-in method that does work.
+ * 2. `restricted` candidates are dropped unless the configuration named them, which is what makes
+ *    an operator login opt-in rather than merely unadvertised.
+ * 3. An explicit `methods` list is both a filter AND the order, because an app that bothered to
+ *    list them means that list.
+ */
+export declare const resolveLoginMethods: (ctx: LoginMethodContext, cfg?: LoginScreenConfig, extra?: LoginMethodSource[]) => LoginMethod[];
+/**
+ * The method a screen highlights and focuses.
+ *
+ * The first `primary` one, else the first offered. It is highlighted, never started: requirement
+ * one of this whole feature is that nothing leaves the document without a click.
+ */
+export declare const primaryLoginMethod: (methods: LoginMethod[]) => LoginMethod | null;
+//# sourceMappingURL=methods.d.ts.map

package/build/login/methods.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"methods.d.ts","sourceRoot":"","sources":["../../src/login/methods.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAqB,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAE5E,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAgBpF,eAAO,MAAM,oBAAoB,WAAY,iBAAiB,KAAG,IAMhE,CAAA;AAED,eAAO,MAAM,iBAAiB,QAAO,iBAAiB,EAAkB,CAAA;AAiBxE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,QACzB,kBAAkB,QAAQ,iBAAiB,UAAS,iBAAiB,EAAE,KAC3E,WAAW,EA8Cb,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,YAAa,WAAW,EAAE,KAAG,WAAW,GAAG,IACG,CAAA"}

package/build/login/methods.js

@@ -0,0 +1,97 @@
+import { DEFAULT_METHOD_ORDER } from './consts.js';
+/**
+ * The module-global registry of method SOURCES.
+ *
+ * A source, rather than a method, because the two things that offer sign-in methods answer
+ * different questions at different times: the plugin registry knows what code is loaded, and the
+ * OIDC configuration knows what an entity is federated with. Both are answered per render — a
+ * provider list can arrive from the api-config middleware after the first paint.
+ *
+ * Global, like the `AuthenticationPlugin` map it mirrors, because a package registers its source
+ * from a side-effect import that has no context to hang it on. A context-scoped registry exists
+ * alongside it on the login service, and both are merged by {@link resolveLoginMethods}.
+ */
+const sources = [];
+export const registerMethodSource = (source) => {
+    const existing = sources.findIndex(candidate => candidate.alias === source.alias);
+    if (existing >= 0) {
+        sources.splice(existing, 1);
+    }
+    sources.push(source);
+};
+export const listMethodSources = () => [...sources];
+/** Normalize a config entry, which may be a bare id or a full override object. */
+const asConfig = (entry) => typeof entry === 'string' ? { id: entry } : entry;
+const merge = (method, override) => override == null ? method : {
+    ...method,
+    ...(override.label != null ? { label: override.label } : {}),
+    ...(override.i18nKey != null ? { i18nKey: override.i18nKey } : {}),
+    ...(override.icon != null ? { icon: override.icon } : {}),
+    ...(override.order != null ? { order: override.order } : {}),
+    ...(override.emphasis != null ? { emphasis: override.emphasis } : {}),
+    ...(override.params != null ? { params: { ...method.params, ...override.params } } : {}),
+};
+/**
+ * Everything the current environment may be offered, in the order it should be offered in.
+ *
+ * Resolution order matters and is not arbitrary:
+ *
+ * 1. Sources produce candidates. A source that throws is skipped rather than taking the screen
+ *    down — a misconfigured provider list must not remove the sign-in method that does work.
+ * 2. `restricted` candidates are dropped unless the configuration named them, which is what makes
+ *    an operator login opt-in rather than merely unadvertised.
+ * 3. An explicit `methods` list is both a filter AND the order, because an app that bothered to
+ *    list them means that list.
+ */
+export const resolveLoginMethods = (ctx, cfg, extra = []) => {
+    const candidates = [];
+    for (const source of [...sources, ...extra]) {
+        try {
+            candidates.push(...source.list(ctx));
+        }
+        catch (e) {
+            console.error(`login: method source "${source.alias}" failed`, e);
+        }
+    }
+    const overrides = cfg?.overrides ?? {};
+    const listed = cfg?.methods?.map(asConfig);
+    const listedIds = listed?.map(entry => entry.id).filter((id) => id != null);
+    const offered = candidates
+        .filter(method => {
+        const override = overrides[method.id] ?? listed?.find(entry => entry.id === method.id);
+        if (override?.enabled === false || override?.hidden === true) {
+            return false;
+        }
+        // A restricted method is offered only where the configuration asked for it — by naming it in
+        // `methods`, or by enabling it in `overrides`. Registering the plugin is deliberately not
+        // enough: an operator login that appears wherever its code happens to be bundled is an
+        // operator login in production.
+        if (method.restricted === true
+            && listedIds?.includes(method.id) !== true
+            && override?.enabled !== true) {
+            return false;
+        }
+        return true;
+    })
+        .map(method => merge(method, overrides[method.id]));
+    if (listedIds != null) {
+        return listedIds
+            .map(id => {
+            const method = offered.find(candidate => candidate.id === id);
+            return method != null ? merge(method, listed?.find(entry => entry.id === id)) : null;
+        })
+            .filter((method) => method != null);
+    }
+    return offered.sort((a, b) => {
+        const order = (a.order ?? DEFAULT_METHOD_ORDER) - (b.order ?? DEFAULT_METHOD_ORDER);
+        return order !== 0 ? order : a.id.localeCompare(b.id);
+    });
+};
+/**
+ * The method a screen highlights and focuses.
+ *
+ * The first `primary` one, else the first offered. It is highlighted, never started: requirement
+ * one of this whole feature is that nothing leaves the document without a click.
+ */
+export const primaryLoginMethod = (methods) => methods.find(method => method.emphasis === 'primary') ?? methods[0] ?? null;
+//# sourceMappingURL=methods.js.map

package/build/login/methods.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"methods.js","sourceRoot":"","sources":["../../src/login/methods.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAGlD;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,GAAwB,EAAE,CAAA;AAEvC,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAyB,EAAQ,EAAE;IACtE,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,CAAA;IACjF,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAClB,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IAC7B,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AACtB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAwB,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,CAAA;AAExE,kFAAkF;AAClF,MAAM,QAAQ,GAAG,CAAC,KAAiC,EAAqB,EAAE,CACxE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAA;AAEnD,MAAM,KAAK,GAAG,CAAC,MAAmB,EAAE,QAAuC,EAAe,EAAE,CAC1F,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1B,GAAG,MAAM;IACT,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CACzF,CAAA;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,GAAuB,EAAE,GAAuB,EAAE,KAAK,GAAwB,EAAE,EAClE,EAAE;IACjB,MAAM,UAAU,GAAkB,EAAE,CAAA;IACpC,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC;YACH,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;QACtC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,yBAAyB,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC,CAAC,CAAA;QACnE,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,EAAE,SAAS,IAAI,EAAE,CAAA;IACtC,MAAM,MAAM,GAAG,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC1C,MAAM,SAAS,GAAG,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,EAAE,IAAI,IAAI,CAAC,CAAA;IAEzF,MAAM,OAAO,GAAG,UAAU;SACvB,MAAM,CAAC,MAAM,CAAC,EAAE;QACf,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAA;QACtF,IAAI,QAAQ,EAAE,OAAO,KAAK,KAAK,IAAI,QAAQ,EAAE,MAAM,KAAK,IAAI,EAAE,CAAC;YAC7D,OAAO,KAAK,CAAA;QACd,CAAC;QACD,6FAA6F;QAC7F,0FAA0F;QAC1F,uFAAuF;QACvF,gCAAgC;QAChC,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;eACzB,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI;eACvC,QAAQ,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;YAChC,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAC;SACD,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAErD,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;QACtB,OAAO,SAAS;aACb,GAAG,CAAC,EAAE,CAAC,EAAE;YACR,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;YAC7D,OAAO,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACtF,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,MAAM,EAAyB,EAAE,CAAC,MAAM,IAAI,IAAI,CAAC,CAAA;IAC9D,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,oBAAoB,CAAC,CAAA;QACnF,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAsB,EAAsB,EAAE,CAC/E,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA"}

package/build/login/resume.d.ts

@@ -0,0 +1,30 @@
+import { LoginOutcome } from './types.js';
+/**
+ * The message key a FINISHED sign-in attempt should show, or null when it actually went somewhere.
+ *
+ * A dispatcher may treat `Passed` as "carry on with the ordinary continuation", because it has one.
+ * A screen does not: the user clicked, the document did not move, and nothing rendered — which is
+ * indistinguishable from a broken button, and is exactly how a null authorization URL used to
+ * present itself. Every outcome that leaves the user looking at the same screen therefore has to
+ * say something.
+ */
+export declare const loginAttemptError: (outcome: LoginOutcome | null) => string | null;
+/** What a dispatcher does once `login().resume(...)` has answered. */
+export declare enum ResumeAction {
+    /** The plugin took it over — the browser is leaving, or the window is closing. */
+    Stop = "stop",
+    /** Render the outcome to the user; there is nothing further to do automatically. */
+    Render = "render",
+    /** Ordinary tab: keep the session and carry on to the application. */
+    Navigate = "navigate"
+}
+/**
+ * The one reading of a `resume` outcome, shared by every dispatcher.
+ *
+ * Exported as a pure function because three dispatchers — `web-client`, `web-oidc-rp` and
+ * `mui-oidc-rp` — have to agree on it, and the last time they each held their own copy of a
+ * decision they drifted, which is how a popup came to render the application inside itself in two
+ * packages at once. It is also the whole rule, so it is testable without a DOM.
+ */
+export declare const resumeAction: (outcome: LoginOutcome) => ResumeAction;
+//# sourceMappingURL=resume.d.ts.map