@owlmeans/web-client 0.1.18-rc.8 → 0.1.18

package/build/login/consts.local.d.ts

@@ -0,0 +1,22 @@
+import type { CSSProperties } from 'react';
+import { SurrogateStage } from './consts.js';
+/**
+ * The whole of what a login window shows.
+ *
+ * Plain elements and inline styles on purpose. This renders in a popup opened by a `web-panel` app,
+ * a `mui-panel` app and a generated Tailwind app alike, and none of their stylesheets is loaded
+ * here — a class name would simply do nothing. It is also the reason this component carries no
+ * dependency on a UI family at all.
+ */
+export declare const box: CSSProperties;
+export declare const action: CSSProperties;
+export declare const COPY: Record<SurrogateStage, {
+    key: string;
+    en: string;
+    action?: [string, string];
+}>;
+export declare const LOGOUT_COPY: Partial<Record<SurrogateStage, {
+    key: string;
+    en: string;
+}>>;
+//# sourceMappingURL=consts.local.d.ts.map

package/build/login/consts.local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.local.d.ts","sourceRoot":"","sources":["../../src/login/consts.local.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,OAAO,CAAA;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAE5C;;;;;;;GAOG;AACH,eAAO,MAAM,GAAG,EAAE,aAGjB,CAAA;AAED,eAAO,MAAM,MAAM,EAAE,aAGpB,CAAA;AAED,eAAO,MAAM,IAAI,EAAE,MAAM,CAAC,cAAc,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAkB/F,CAAA;AAED,eAAO,MAAM,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,CAUpF,CAAA"}

package/build/login/consts.local.js

@@ -0,0 +1,48 @@
+import { SurrogateStage } from './consts.js';
+/**
+ * The whole of what a login window shows.
+ *
+ * Plain elements and inline styles on purpose. This renders in a popup opened by a `web-panel` app,
+ * a `mui-panel` app and a generated Tailwind app alike, and none of their stylesheets is loaded
+ * here — a class name would simply do nothing. It is also the reason this component carries no
+ * dependency on a UI family at all.
+ */
+export const box = {
+    maxWidth: '22rem', margin: '15vh auto', padding: '1.5rem', textAlign: 'center',
+    fontFamily: 'system-ui, sans-serif', lineHeight: 1.5,
+};
+export const action = {
+    marginTop: '1rem', padding: '.625rem 1.25rem', fontSize: '1rem',
+    cursor: 'pointer', borderRadius: '.375rem', border: '1px solid currentColor',
+};
+export const COPY = {
+    [SurrogateStage.Working]: { key: 'working', en: 'Signing you in…' },
+    [SurrogateStage.Gesture]: {
+        key: 'gesture.title', en: 'Continue to sign in.', action: ['gesture.action', 'Sign in'],
+    },
+    [SurrogateStage.Handing]: { key: 'handing', en: 'Done. Returning to the application…' },
+    [SurrogateStage.Orphaned]: {
+        key: 'orphaned', en: 'Signed in. You can close this window and continue in the application.',
+        action: ['close', 'Close'],
+    },
+    [SurrogateStage.Failed]: {
+        key: 'failed', en: 'That did not complete. You can close this window and try again.',
+        action: ['close', 'Close'],
+    },
+    [SurrogateStage.Standalone]: {
+        key: 'standalone.title', en: 'This page is used to sign in from another window.',
+        action: ['standalone.action', 'Open the application'],
+    },
+};
+export const LOGOUT_COPY = {
+    [SurrogateStage.Working]: { key: 'working', en: 'Signing you out…' },
+    [SurrogateStage.Gesture]: { key: 'gesture.title', en: 'Continue to sign out.' },
+    [SurrogateStage.Handing]: { key: 'handing', en: 'Signed out. Returning to the application…' },
+    [SurrogateStage.Orphaned]: {
+        key: 'orphaned', en: 'Signed out. You can close this window.',
+    },
+    [SurrogateStage.Failed]: {
+        key: 'failed', en: 'Sign-out did not complete here. You can close this window.',
+    },
+};
+//# sourceMappingURL=consts.local.js.map

package/build/login/consts.local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consts.local.js","sourceRoot":"","sources":["../../src/login/consts.local.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAE5C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,GAAG,GAAkB;IAChC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ;IAC9E,UAAU,EAAE,uBAAuB,EAAE,UAAU,EAAE,GAAG;CACrD,CAAA;AAED,MAAM,CAAC,MAAM,MAAM,GAAkB;IACnC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM;IAC/D,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,wBAAwB;CAC7E,CAAA;AAED,MAAM,CAAC,MAAM,IAAI,GAAmF;IAClG,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,iBAAiB,EAAE;IACnE,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE;QACxB,GAAG,EAAE,eAAe,EAAE,EAAE,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAAC,gBAAgB,EAAE,SAAS,CAAC;KACxF;IACD,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,qCAAqC,EAAE;IACvF,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE;QACzB,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,uEAAuE;QAC5F,MAAM,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;KAC3B;IACD,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE;QACvB,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,iEAAiE;QACpF,MAAM,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;KAC3B;IACD,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE;QAC3B,GAAG,EAAE,kBAAkB,EAAE,EAAE,EAAE,mDAAmD;QAChF,MAAM,EAAE,CAAC,mBAAmB,EAAE,sBAAsB,CAAC;KACtD;CACF,CAAA;AAED,MAAM,CAAC,MAAM,WAAW,GAAiE;IACvF,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,kBAAkB,EAAE;IACpE,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,EAAE,EAAE,uBAAuB,EAAE;IAC/E,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,2CAA2C,EAAE;IAC7F,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE;QACzB,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,wCAAwC;KAC9D;IACD,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE;QACvB,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,4DAA4D;KAChF;CACF,CAAA"}

package/build/login/index.d.ts

@@ -1,5 +1,9 @@
 export * from './consts.js';
+export * from './pump.js';
 export * from './redirect.js';
 export * from './surrogate.js';
+export * from './view.js';
+export type * from './types.js';
+export * from './screen.js';
 export * from './service.js';
 //# sourceMappingURL=index.d.ts.map

package/build/login/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/login/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/login/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,WAAW,CAAA;AACzB,cAAc,eAAe,CAAA;AAC7B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,WAAW,CAAA;AACzB,mBAAmB,YAAY,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA"}

package/build/login/index.js

@@ -1,5 +1,8 @@
 export * from './consts.js';
+export * from './pump.js';
 export * from './redirect.js';
 export * from './surrogate.js';
+export * from './view.js';
+export * from './screen.js';
 export * from './service.js';
 //# sourceMappingURL=index.js.map

package/build/login/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/login/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA;AAC7B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/login/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,WAAW,CAAA;AACzB,cAAc,eAAe,CAAA;AAC7B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,WAAW,CAAA;AAEzB,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA"}

package/build/login/pump.d.ts

@@ -0,0 +1,20 @@
+import { LoginOutcome } from '@owlmeans/client-auth/login';
+/**
+ * Wait on a surrogate window until it says something, or goes away.
+ *
+ * Extracted so login and logout share one implementation rather than two that agree until one of
+ * them is changed. Every guard here was a real failure at some point:
+ *
+ * - the **origin pin** is not decoration — the message carries a bearer token, and a listener that
+ *   accepted any origin would take one from any page that could reach this window;
+ * - the **`settled` latch** stops a second message, or a close racing a message, resolving twice;
+ * - the **`closed` poll** is the only exit when the user simply closes the window, because a window
+ *   the user closes announces nothing at all;
+ * - the listener and the interval are removed on every path, including the ones that resolve.
+ */
+export declare const awaitSurrogate: (surrogate: Window, messageType: string, onMessage: (data: {
+    type?: string;
+    token?: string;
+    ok?: boolean;
+}) => Promise<LoginOutcome>) => Promise<LoginOutcome>;
+//# sourceMappingURL=pump.d.ts.map

package/build/login/pump.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pump.d.ts","sourceRoot":"","sources":["../../src/login/pump.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAEhF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,cACd,MAAM,eACJ,MAAM,aACR,CAAC,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAE,KAAK,OAAO,CAAC,YAAY,CAAC,KAC1F,OAAO,CAAC,YAAY,CAiCrB,CAAA"}

package/build/login/pump.js

@@ -0,0 +1,46 @@
+import { LOGIN_WATCH_INTERVAL, LoginOutcome } from '@owlmeans/client-auth/login';
+/**
+ * Wait on a surrogate window until it says something, or goes away.
+ *
+ * Extracted so login and logout share one implementation rather than two that agree until one of
+ * them is changed. Every guard here was a real failure at some point:
+ *
+ * - the **origin pin** is not decoration — the message carries a bearer token, and a listener that
+ *   accepted any origin would take one from any page that could reach this window;
+ * - the **`settled` latch** stops a second message, or a close racing a message, resolving twice;
+ * - the **`closed` poll** is the only exit when the user simply closes the window, because a window
+ *   the user closes announces nothing at all;
+ * - the listener and the interval are removed on every path, including the ones that resolve.
+ */
+export const awaitSurrogate = async (surrogate, messageType, onMessage) => await new Promise(resolve => {
+    let settled = false;
+    let watch;
+    const finish = (result) => {
+        if (settled) {
+            return;
+        }
+        settled = true;
+        window.removeEventListener('message', handler);
+        if (watch != null) {
+            clearInterval(watch);
+        }
+        resolve(result);
+    };
+    function handler(event) {
+        if (event.origin !== window.location.origin) {
+            return;
+        }
+        const data = event.data;
+        if (data?.type !== messageType) {
+            return;
+        }
+        void onMessage(data).then(finish).catch(() => finish(LoginOutcome.Failed));
+    }
+    window.addEventListener('message', handler);
+    watch = setInterval(() => {
+        if (surrogate.closed) {
+            finish(LoginOutcome.Failed);
+        }
+    }, LOGIN_WATCH_INTERVAL);
+});
+//# sourceMappingURL=pump.js.map

package/build/login/pump.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pump.js","sourceRoot":"","sources":["../../src/login/pump.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAEhF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,SAAiB,EACjB,WAAmB,EACnB,SAA2F,EACpE,EAAE,CAAC,MAAM,IAAI,OAAO,CAAe,OAAO,CAAC,EAAE;IACpE,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,IAAI,KAAiD,CAAA;IAErD,MAAM,MAAM,GAAG,CAAC,MAAoB,EAAQ,EAAE;QAC5C,IAAI,OAAO,EAAE,CAAC;YACZ,OAAM;QACR,CAAC;QACD,OAAO,GAAG,IAAI,CAAA;QACd,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QAC9C,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAClB,aAAa,CAAC,KAAK,CAAC,CAAA;QACtB,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,CAAA;IACjB,CAAC,CAAA;IAED,SAAS,OAAO,CAAC,KAAmB;QAClC,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC5C,OAAM;QACR,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAA8D,CAAA;QACjF,IAAI,IAAI,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;YAC/B,OAAM;QACR,CAAC;QACD,KAAK,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAA;IAC5E,CAAC;IAED,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IAC3C,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QACvB,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACrB,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;QAC7B,CAAC;IACH,CAAC,EAAE,oBAAoB,CAAC,CAAA;AAC1B,CAAC,CAAC,CAAA"}

package/build/login/redirect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redirect.d.ts","sourceRoot":"","sources":["../../src/login/redirect.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAG9D;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,QAAO,WA2BzC,CAAA"}
+{"version":3,"file":"redirect.d.ts","sourceRoot":"","sources":["../../src/login/redirect.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAgB,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAG5E;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,QAAO,WAgDzC,CAAA"}

package/build/login/redirect.js

@@ -1,4 +1,4 @@
-import { LoginOutcome } from '@owlmeans/client-auth/login';
+import { LoginOutcome, loginTokenOf } from '@owlmeans/client-auth/login';
 import { REDIRECT_LOGIN } from './consts.js';
 /**
  * The ordinary login flow: this document leaves for the identity provider and comes back.
@@ -27,5 +27,21 @@ export const makeRedirectLoginPlugin = () => ({
     },
     // Nothing to hand anywhere — the token was issued in the document that will use it.
     complete: async () => LoginOutcome.Passed,
+    // `resume` is deliberately NOT implemented. The host defaults to `Passed`, which is "keep the
+    // session you already have and carry on" — byte for byte what an ordinary tab has always done.
+    // Implementing it here would be the one way to regress every unframed application.
+    logout: (ctx, request) => loginTokenOf(ctx).revokeToken().then(async () => {
+        if (request.navigate != null) {
+            await request.navigate();
+            return LoginOutcome.Handled;
+        }
+        // A reload rather than a client-side navigation: `useOwlAuth` and its kin read through
+        // cached values, so the honest way to make a whole application forget a session is to
+        // rebuild it. This is what `useLogout` did inline before the mechanic became a plugin.
+        window.location.reload();
+        return LoginOutcome.Handled;
+    }),
+    // Nothing to tell anyone — the session was cleared in the document that owned it.
+    logoutComplete: async () => LoginOutcome.Passed,
 });
 //# sourceMappingURL=redirect.js.map

package/build/login/redirect.js.map

@@ -1 +1 @@
-{"version":3,"file":"redirect.js","sourceRoot":"","sources":["../../src/login/redirect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAE1D,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAE5C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAgB,EAAE,CAAC,CAAC;IACzD,KAAK,EAAE,cAAc;IACrB,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,UAAU;IAChB,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI;IAEjB,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;QAC7B,yFAAyF;QACzF,8FAA8F;QAC9F,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;YAC7B,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAA;YAExB,OAAO,YAAY,CAAC,OAAO,CAAA;QAC7B,CAAC;QACD,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAA;QAElC,OAAO,YAAY,CAAC,UAAU,CAAA;IAChC,CAAC;IAED,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC7B,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAA;QAE1B,OAAO,YAAY,CAAC,UAAU,CAAA;IAChC,CAAC;IAED,oFAAoF;IACpF,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,YAAY,CAAC,MAAM;CAC1C,CAAC,CAAA"}
+{"version":3,"file":"redirect.js","sourceRoot":"","sources":["../../src/login/redirect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAExE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAE5C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAgB,EAAE,CAAC,CAAC;IACzD,KAAK,EAAE,cAAc;IACrB,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,UAAU;IAChB,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI;IAEjB,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;QAC7B,yFAAyF;QACzF,8FAA8F;QAC9F,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;YAC7B,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAA;YAExB,OAAO,YAAY,CAAC,OAAO,CAAA;QAC7B,CAAC;QACD,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,CAAA;QAElC,OAAO,YAAY,CAAC,UAAU,CAAA;IAChC,CAAC;IAED,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC7B,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAA;QAE1B,OAAO,YAAY,CAAC,UAAU,CAAA;IAChC,CAAC;IAED,oFAAoF;IACpF,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,YAAY,CAAC,MAAM;IAEzC,8FAA8F;IAC9F,+FAA+F;IAC/F,mFAAmF;IAEnF,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,GAAmB,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;QACxF,IAAI,OAAO,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;YAC7B,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAA;YAExB,OAAO,YAAY,CAAC,OAAO,CAAA;QAC7B,CAAC;QACD,uFAAuF;QACvF,sFAAsF;QACtF,uFAAuF;QACvF,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAA;QAExB,OAAO,YAAY,CAAC,OAAO,CAAA;IAC7B,CAAC,CAAC;IAEF,kFAAkF;IAClF,cAAc,EAAE,KAAK,IAAI,EAAE,CAAC,YAAY,CAAC,MAAM;CAChD,CAAC,CAAA"}

package/build/login/screen.d.ts

@@ -0,0 +1,19 @@
+import { type FC } from 'react';
+import { SurrogateLoginStep } from './consts.js';
+/**
+ * A sign-in request never reuses the session this window happens to hold.
+ *
+ * The opener asks for a sign-in only when it has no session its server accepts — and the window it
+ * opens does not share its storage: an embedded application's storage is partitioned by the top
+ * level site, the popup's is first-party. So the popup can hold a session the server has already
+ * REFUSED (its record gone after a restart, revoked, fenced). Handing that back closes the popup
+ * at once — a blink — and the opener fails its next request exactly as before, forever, because
+ * nothing in the opener can reach the popup's storage to clear it. A fresh round trip costs only
+ * redirects while the provider still has a session, and always yields a session the server holds.
+ *
+ * Only without a dispatcher address is the stored session handed back as it is: there is nothing
+ * to authenticate through, and the opener's own 401 handling drops it if it is refused.
+ */
+export declare const surrogateLoginStep: (token: string | null | undefined, next: string | null) => SurrogateLoginStep;
+export declare const SurrogateScreen: FC;
+//# sourceMappingURL=screen.d.ts.map

package/build/login/screen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"screen.d.ts","sourceRoot":"","sources":["../../src/login/screen.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAoC,KAAK,EAAE,EAAE,MAAM,OAAO,CAAA;AASjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAGhD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,UAAW,MAAM,GAAG,IAAI,GAAG,SAAS,QAAQ,MAAM,GAAG,IAAI,KAAG,kBAO1F,CAAA;AAED,eAAO,MAAM,eAAe,EAAE,EAyG7B,CAAA"}

package/build/login/screen.js

@@ -0,0 +1,119 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { useCallback, useEffect, useState } from 'react';
+import { useContext } from '@owlmeans/client';
+import { useI18nLib } from '@owlmeans/client-i18n';
+import { LoginIntent, LoginOutcome, LOGIN_INTENT_QUERY, LOGIN_METHOD_QUERY, LOGIN_NEXT_QUERY } from '@owlmeans/client-auth/login';
+import { USER_ID } from '@owlmeans/client-auth';
+import { LoginSurrogateView } from './view.js';
+import { SurrogateStage } from './consts.js';
+import { logger } from '@owlmeans/log';
+import { SurrogateLoginStep } from './consts.js';
+const log = logger('web-client:login');
+/**
+ * A sign-in request never reuses the session this window happens to hold.
+ *
+ * The opener asks for a sign-in only when it has no session its server accepts — and the window it
+ * opens does not share its storage: an embedded application's storage is partitioned by the top
+ * level site, the popup's is first-party. So the popup can hold a session the server has already
+ * REFUSED (its record gone after a restart, revoked, fenced). Handing that back closes the popup
+ * at once — a blink — and the opener fails its next request exactly as before, forever, because
+ * nothing in the opener can reach the popup's storage to clear it. A fresh round trip costs only
+ * redirects while the provider still has a session, and always yields a session the server holds.
+ *
+ * Only without a dispatcher address is the stored session handed back as it is: there is nothing
+ * to authenticate through, and the opener's own 401 handling drops it if it is refused.
+ */
+export const surrogateLoginStep = (token, next) => {
+    const stored = token != null && token !== '';
+    if (!stored) {
+        return SurrogateLoginStep.Authenticate;
+    }
+    return next != null && next !== '' ? SurrogateLoginStep.Forget : SurrogateLoginStep.Resume;
+};
+export const SurrogateScreen = () => {
+    const context = useContext();
+    const [query] = context.router().useSearchParams();
+    const t = useI18nLib('auth');
+    const intent = query.get(LOGIN_INTENT_QUERY) === LoginIntent.Logout
+        ? LoginIntent.Logout
+        : LoginIntent.Login;
+    const [stage, setStage] = useState(SurrogateStage.Working);
+    const [error, setError] = useState();
+    const onAction = useCallback(() => {
+        if (stage === SurrogateStage.Standalone) {
+            window.location.href = '/';
+            return;
+        }
+        if (stage === SurrogateStage.Gesture) {
+            const next = query.get(LOGIN_NEXT_QUERY);
+            void context.login().begin({ url: next ?? window.location.href });
+            return;
+        }
+        window.close();
+    }, [context, stage, query]);
+    useEffect(() => {
+        const login = context.service('login-service');
+        // First statement, unconditionally: `markSurrogate` reads `window.name`, and the browser
+        // clears that the moment this window's top-level context goes cross-origin. Recording it
+        // later means recording nothing.
+        login.enter();
+        const env = login.env();
+        if (!env.surrogate) {
+            // Somebody opened this address directly, or the window lost its marker. Never navigate on
+            // its behalf — offer a link and stop.
+            setStage(env.embedded ? SurrogateStage.Gesture : SurrogateStage.Standalone);
+            return;
+        }
+        const run = async () => {
+            const token = await context.auth().authenticated();
+            if (intent === LoginIntent.Logout) {
+                // Revoked FIRST, before anything can be awaited on a channel that may never answer: a
+                // window the user closes half a second later must still have ended the session it opened
+                // to end.
+                await login.revoke();
+                const outcome = await login.logoutComplete();
+                setStage(outcome === LoginOutcome.Handled ? SurrogateStage.Handing
+                    : outcome === LoginOutcome.Orphaned ? SurrogateStage.Orphaned
+                        : SurrogateStage.Failed);
+                return;
+            }
+            const next = query.get(LOGIN_NEXT_QUERY);
+            const step = surrogateLoginStep(token, next);
+            if (step === SurrogateLoginStep.Forget) {
+                // Dropped from this window's storage only — the web auth service's own clearing path
+                // navigates to the dispatcher, and `next` below is exactly where this window goes anyway.
+                const auth = context.auth();
+                await auth.store().delete(USER_ID);
+                auth.token = undefined;
+                auth.auth = undefined;
+            }
+            if (step === SurrogateLoginStep.Resume && token != null) {
+                // Signed in here and nowhere to authenticate afresh: hand what there is to the opener.
+                const outcome = await login.resume(token);
+                setStage(outcome === LoginOutcome.Handled ? SurrogateStage.Handing
+                    : outcome === LoginOutcome.Orphaned ? SurrogateStage.Orphaned
+                        : SurrogateStage.Failed);
+                return;
+            }
+            // The dispatcher owns the authorization round trip, and the provider's callback lands there
+            // rather than on this route. The method the user already chose travels with it, so the
+            // dispatcher does not ask a second time in a window with no one to ask.
+            if (next == null || next === '') {
+                setStage(SurrogateStage.Gesture);
+                return;
+            }
+            const method = query.get(LOGIN_METHOD_QUERY);
+            const target = method != null && method !== ''
+                ? `${next}${next.includes('?') ? '&' : '?'}${LOGIN_METHOD_QUERY}=${encodeURIComponent(method)}`
+                : next;
+            window.location.href = target;
+        };
+        void run().catch((e) => {
+            log.error('Surrogate login failed', e);
+            setError(e.message);
+            setStage(SurrogateStage.Failed);
+        });
+    }, [context, intent]);
+    return _jsx(LoginSurrogateView, { stage: stage, intent: intent, onAction: onAction, error: error, translate: (key, defaultValue) => t(key, { defaultValue }) });
+};
+//# sourceMappingURL=screen.js.map

package/build/login/screen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"screen.js","sourceRoot":"","sources":["../../src/login/screen.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAW,MAAM,OAAO,CAAA;AACjE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,gBAAgB,EAAqB,MAAM,6BAA6B,CAAA;AACpJ,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAA;AAE/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AACtC,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhD,MAAM,GAAG,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAA;AACtC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAgC,EAAE,IAAmB,EAAsB,EAAE;IAC9G,MAAM,MAAM,GAAG,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE,CAAA;IAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,kBAAkB,CAAC,YAAY,CAAA;IACxC,CAAC;IAED,OAAO,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAA;AAC5F,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAO,GAAG,EAAE;IACtC,MAAM,OAAO,GAAG,UAAU,EAA2B,CAAA;IACrD,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,eAAe,EAAE,CAAA;IAClD,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;IAE5B,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,WAAW,CAAC,MAAM;QACjE,CAAC,CAAC,WAAW,CAAC,MAAM;QACpB,CAAC,CAAC,WAAW,CAAC,KAAK,CAAA;IAErB,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAiB,cAAc,CAAC,OAAO,CAAC,CAAA;IAC1E,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,EAAsB,CAAA;IAExD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;QAChC,IAAI,KAAK,KAAK,cAAc,CAAC,UAAU,EAAE,CAAC;YACxC,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAA;YAC1B,OAAM;QACR,CAAC;QACD,IAAI,KAAK,KAAK,cAAc,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;YACxC,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;YACjE,OAAM;QACR,CAAC;QACD,MAAM,CAAC,KAAK,EAAE,CAAA;IAChB,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAA;IAE3B,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAe,eAAe,CAAC,CAAA;QAC5D,yFAAyF;QACzF,yFAAyF;QACzF,iCAAiC;QACjC,KAAK,CAAC,KAAK,EAAE,CAAA;QAEb,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAA;QACvB,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;YACnB,0FAA0F;YAC1F,sCAAsC;YACtC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAA;YAC3E,OAAM;QACR,CAAC;QAED,MAAM,GAAG,GAAG,KAAK,IAAmB,EAAE;YACpC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,CAAA;YAElD,IAAI,MAAM,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;gBAClC,sFAAsF;gBACtF,yFAAyF;gBACzF,UAAU;gBACV,MAAM,KAAK,CAAC,MAAM,EAAE,CAAA;gBACpB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,EAAE,CAAA;gBAC5C,QAAQ,CACN,OAAO,KAAK,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO;oBACvD,CAAC,CAAC,OAAO,KAAK,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ;wBAC3D,CAAC,CAAC,cAAc,CAAC,MAAM,CAC5B,CAAA;gBACD,OAAM;YACR,CAAC;YAED,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;YACxC,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;YAE5C,IAAI,IAAI,KAAK,kBAAkB,CAAC,MAAM,EAAE,CAAC;gBACvC,qFAAqF;gBACrF,0FAA0F;gBAC1F,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAA;gBAC3B,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;gBAClC,IAAI,CAAC,KAAK,GAAG,SAAS,CAAA;gBACtB,IAAI,CAAC,IAAI,GAAG,SAAS,CAAA;YACvB,CAAC;YAED,IAAI,IAAI,KAAK,kBAAkB,CAAC,MAAM,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBACxD,uFAAuF;gBACvF,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;gBACzC,QAAQ,CACN,OAAO,KAAK,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO;oBACvD,CAAC,CAAC,OAAO,KAAK,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ;wBAC3D,CAAC,CAAC,cAAc,CAAC,MAAM,CAC5B,CAAA;gBACD,OAAM;YACR,CAAC;YAED,4FAA4F;YAC5F,uFAAuF;YACvF,wEAAwE;YACxE,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;gBAChC,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC,CAAA;gBAChC,OAAM;YACR,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;YAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,IAAI,IAAI,MAAM,KAAK,EAAE;gBAC5C,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,kBAAkB,IAAI,kBAAkB,CAAC,MAAM,CAAC,EAAE;gBAC/F,CAAC,CAAC,IAAI,CAAA;YACR,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAA;QAC/B,CAAC,CAAA;QAED,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAQ,EAAE,EAAE;YAC5B,GAAG,CAAC,KAAK,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAA;YACtC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;YACnB,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QACjC,CAAC,CAAC,CAAA;IACJ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;IAErB,OAAO,KAAC,kBAAkB,IACxB,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAC9D,SAAS,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,CAAC,GAC1D,CAAA;AACJ,CAAC,CAAA"}

package/build/login/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/login/service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAIlE;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,GAAI,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,KAAG,CAMzF,CAAA"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/login/service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAIlE;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,GAAI,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,KAAG,CAMzF,CAAA"}

package/build/login/surrogate.d.ts

@@ -1,4 +1,20 @@
 import type { LoginPlugin } from '@owlmeans/client-auth/login';
+/**
+ * `window.open` features that size and CENTER the surrogate on the screen the browser window
+ * currently occupies.
+ *
+ * Computed fresh per call, never a constant: centering depends on where the browser window sits
+ * NOW, which can change between one login attempt and the next. `screenLeft`/`screenTop` and
+ * `outerWidth`/`outerHeight` describe the browser's own chrome rather than this document's
+ * viewport — and, unlike `innerWidth` or anything reached through `window.top`, they stay readable
+ * from a cross-origin iframe. That matters here specifically: a generated app's preview runs
+ * framed on a different origin than the manager that embeds it, so `env.embedded` is exactly the
+ * case where `window.top.innerWidth` would throw, and reading this document's own `innerWidth`
+ * instead would center the popup on the IFRAME's rectangle rather than on the actual window a
+ * person sees. Falling back to `window.screen` covers a window that reports no outer geometry at
+ * all (a headless test runner).
+ */
+export declare const centeredPopupFeatures: (width: number, height: number) => string;
 /**
  * Login for a document that cannot complete the flow where it is.
  *

package/build/login/surrogate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"surrogate.d.ts","sourceRoot":"","sources":["../../src/login/surrogate.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAgB,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAG5E;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,wBAAwB,QAAO,WAiG1C,CAAA"}
+{"version":3,"file":"surrogate.d.ts","sourceRoot":"","sources":["../../src/login/surrogate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAA0B,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAItF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB,UAAW,MAAM,UAAU,MAAM,KAAG,MAUrE,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,wBAAwB,QAAO,WA4J3C,CAAA"}