@payez/next-mvp 4.5.7 → 4.7.10

package/dist/auth/idp-oauth.js

@@ -0,0 +1,280 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CLOCK_TOLERANCE_SECONDS = void 0;
+exports.resolveIdpRedirectUri = resolveIdpRedirectUri;
+exports.amrIncludesMfa = amrIncludesMfa;
+exports.isAddressShaped = isAddressShaped;
+exports.resolveEmail = resolveEmail;
+exports.createIdpOAuthHooks = createIdpOAuthHooks;
+/**
+ * PAY-2305 (next-mvp 4.7.4): the two hooks that let better-auth's genericOAuth talk to THIS IdP.
+ *
+ * WHY THEY EXIST (source read, PayEz-Core master d53f192af, BAPert 74014):
+ *   - POST /api/oauth/token takes a JSON body (snake_case), not better-auth's default form body, and answers with the
+ *     Core response envelope { success, data: { access_token, refresh_token, token_type, expires_in, user } }.
+ *     better-auth's default exchange reads top-level fields and would find nothing.
+ *   - There is NO id_token and NO userinfo endpoint (deliberate, PAY-1585). The only proof of who signed in is the
+ *     access token itself: an RS-family bearer JWT (RS512 on dev-93's JWKS, measured) signed by the IdP bearer key (jwks_uri in discovery) with sub, email,
+ *     roles, amr, token_type.
+ *
+ * TRUST RULE: a claim is read ONLY from a token whose signature, issuer, expiry and token_type were verified here.
+ * Never base64-decode and believe. Only RSA signatures are accepted (the RS and PS families; the JWKS key's own declared alg is binding), so a token
+ * re-signed with HS256 using the public key as the secret, or alg none, is refused. The `aud` of an IdP bearer is the IdP's public constant, not this client, so it is not a
+ * binding; the binding to THIS client is the authorization code + PKCE verifier + exact redirect_uri that Core checks.
+ *
+ * The redirect_uri sent here MUST be byte-identical at the authorize step and the token step (Core compares it
+ * Ordinal at the token step) and equal to the registered {site_url}/api/auth/callback (Core compares it exactly,
+ * case-insensitively, at the authorize step). Both come from ONE value: the `redirectURI` of the provider config.
+ */
+const jose_1 = require("jose");
+const DISCOVERY_TTL_MS = 10 * 60 * 1000;
+const HTTP_TIMEOUT_MS = 10_000;
+/** The URI sent at authorize AND token time. Explicit env wins; else the registered {app}/api/auth/callback form. */
+function resolveIdpRedirectUri(appBaseUrl, env = process.env) {
+    const explicit = env.IDP_OAUTH_REDIRECT_URI?.trim();
+    if (explicit)
+        return explicit;
+    return appBaseUrl.replace(/\/+$/, '') + '/api/auth/callback';
+}
+/** amr arrives as an array, a JSON-array string, or a delimited string (Core's own reader accepts all three). */
+function amrIncludesMfa(amr) {
+    let values = [];
+    if (Array.isArray(amr))
+        values = amr;
+    else if (typeof amr === 'string') {
+        const t = amr.trim();
+        if (t.startsWith('[')) {
+            try {
+                const parsed = JSON.parse(t);
+                if (Array.isArray(parsed))
+                    values = parsed;
+            }
+            catch {
+                values = [];
+            }
+        }
+        else {
+            values = t.split(/[\s,]+/);
+        }
+    }
+    return values.some((v) => typeof v === 'string' && v.trim().toLowerCase() === 'mfa');
+}
+/** Max skew accepted on nbf/exp/iat when verifying the IdP access token. */
+exports.CLOCK_TOLERANCE_SECONDS = 30;
+/**
+ * Address shape, a POSITIVE character rule (PAY-2337, Scout 74285): the local part may contain only [A-Za-z0-9] and . _ % + - ' ; the domain only
+ * [A-Za-z0-9-] labels joined by dots; one @, <= 254 total, local <= 64, no leading/trailing/double dot in the local part, a dotted domain.
+ * Everything else is NOT an address, and in particular a MASK: Core masks data.user.email on purpose (MaskedEmailJsonConverter), today with '*',
+ * tomorrow maybe a bullet, an ellipsis or an 'x' run; a blacklist of one glyph would pass the next mask. Not a deliverability check.
+ */
+function isAddressShaped(v) {
+    if (typeof v !== 'string' || v.length === 0 || v.length > 254)
+        return false;
+    if (!/^[A-Za-z0-9._%+'-]+@[A-Za-z0-9.-]+$/.test(v))
+        return false;
+    const [local, domain] = v.split('@');
+    if (local.length > 64 || local.startsWith('.') || local.endsWith('.') || local.includes('..'))
+        return false;
+    return /^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)+$/.test(domain) && !domain.startsWith('-') && !domain.endsWith('-');
+}
+/**
+ * The account address (BAPert 74193 / 74196, 4.7.8). Core's code-flow access token has NO email claim; its sub and ws-identity name claim are
+ * both user.UserName, which is a LOGIN, not the mailbox: it may be address-shaped and still differ from the account's Email (4.7.7 vetoed on that
+ * and refused every such sign-in, NightHawk 74189). Sources: the token RESPONSE's data.user.email (token endpoint, TLS) and/or the signed token's
+ * own email claim; if both are present they must be equal. sub / the name claim are NEITHER a source NOR a veto. Not trimmed. Returns '' on any doubt.
+ */
+function resolveEmail(payload, responseEmail) {
+    // NOT trimmed: padding or a trailing newline is a malformed address (refused by the shape check), never silently repaired.
+    const raw = (v) => (typeof v === 'string' ? v : '');
+    const sources = [raw(payload.email), raw(responseEmail)].filter((v) => v.trim() !== '');
+    if (sources.length === 0 || !sources.every(isAddressShaped))
+        return '';
+    const chosen = sources[0];
+    const same = (a) => a.toLowerCase() === chosen.toLowerCase();
+    if (!sources.every(same))
+        return '';
+    return chosen;
+}
+function rolesOf(claim) {
+    if (Array.isArray(claim))
+        return claim.filter((r) => typeof r === 'string' && r.length > 0);
+    if (typeof claim === 'string' && claim.trim()) {
+        const t = claim.trim();
+        if (t.startsWith('[')) {
+            try {
+                const parsed = JSON.parse(t);
+                if (Array.isArray(parsed))
+                    return parsed.filter((r) => typeof r === 'string' && r.length > 0);
+            }
+            catch {
+                return [];
+            }
+        }
+        return t.split(/[\s,]+/).filter(Boolean);
+    }
+    return [];
+}
+function createIdpOAuthHooks(opts) {
+    const fetchFn = opts.deps?.fetch ?? fetch;
+    const now = opts.deps?.now ?? (() => Date.now());
+    const getKeySet = opts.deps?.getKeySet ?? ((uri) => (0, jose_1.createRemoteJWKSet)(new URL(uri)));
+    let discovery = null;
+    const keySets = new Map();
+    /** access token -> data.user.email / user_name from the token response, consumed by getUserInfo for THAT token (bounded; never keyed by anything shared). */
+    const responseUsers = new Map();
+    async function loadDiscovery() {
+        if (discovery && now() - discovery.at < DISCOVERY_TTL_MS)
+            return discovery.doc;
+        const res = await fetchFn(opts.discoveryUrl, {
+            headers: { Accept: 'application/json' },
+            redirect: 'error',
+            signal: AbortSignal.timeout(HTTP_TIMEOUT_MS),
+        });
+        if (!res.ok)
+            throw new Error(`IdP discovery returned ${res.status}`);
+        const doc = (await res.json());
+        if (typeof doc?.token_endpoint !== 'string' || typeof doc?.jwks_uri !== 'string' || typeof doc?.issuer !== 'string') {
+            throw new Error('IdP discovery document is missing token_endpoint, jwks_uri or issuer');
+        }
+        const allowed = new Set([new URL(opts.discoveryUrl).origin, ...(opts.trustedOrigins ?? []).map((o) => o.replace(/\/+$/, ''))]);
+        for (const field of ['token_endpoint', 'jwks_uri']) {
+            const origin = new URL(doc[field]).origin;
+            if (!allowed.has(origin))
+                throw new Error(`IdP discovery ${field} points at an untrusted origin (${origin})`);
+        }
+        discovery = { doc, at: now() }; // only a good document is cached
+        return doc;
+    }
+    /** better-auth `getToken`: JSON body, envelope unwrapped, no data.access_token => refused. */
+    async function getToken(data) {
+        const doc = await loadDiscovery();
+        if (!data.codeVerifier)
+            throw new Error('IdP token exchange refused: no PKCE code_verifier');
+        const res = await fetchFn(doc.token_endpoint, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+            redirect: 'error',
+            signal: AbortSignal.timeout(HTTP_TIMEOUT_MS),
+            body: JSON.stringify({
+                grant_type: 'authorization_code',
+                code: data.code,
+                code_verifier: data.codeVerifier,
+                // Deliberately NOT data.redirectURI: that is better-auth's own computed callback, not the registered URI.
+                redirect_uri: opts.redirectURI,
+                client_id: opts.clientId,
+            }),
+        });
+        let body;
+        try {
+            body = await res.json();
+        }
+        catch {
+            throw new Error(`IdP token response (${res.status}) was not JSON`);
+        }
+        if (!res.ok) {
+            const code = body?.error?.code ?? body?.error ?? body?.code ?? 'unknown';
+            throw new Error(`IdP token exchange refused (${res.status}, ${typeof code === 'string' ? code : 'unknown'})`);
+        }
+        const d = body?.data;
+        if (!d || typeof d.access_token !== 'string' || !d.access_token) {
+            throw new Error('IdP token response has no data.access_token (envelope not as expected)');
+        }
+        const expiresIn = typeof d.expires_in === 'number' && d.expires_in > 0 ? d.expires_in : undefined;
+        const expires = expiresIn ? now() + expiresIn * 1000 : undefined;
+        if (d.user && typeof d.user === 'object' && typeof d.user.email === 'string') {
+            if (responseUsers.size >= 64)
+                responseUsers.delete(responseUsers.keys().next().value);
+            responseUsers.set(d.access_token, { email: d.user.email, userName: typeof d.user.user_name === 'string' ? d.user.user_name : '' });
+        }
+        opts.onTokens?.({
+            accessToken: d.access_token,
+            refreshToken: typeof d.refresh_token === 'string' ? d.refresh_token : undefined,
+            accessTokenExpires: expires,
+            tokenType: typeof d.token_type === 'string' ? d.token_type : undefined,
+            user: d.user && typeof d.user === 'object' ? d.user : undefined,
+        });
+        return {
+            tokenType: typeof d.token_type === 'string' ? d.token_type : 'Bearer',
+            accessToken: d.access_token,
+            refreshToken: typeof d.refresh_token === 'string' ? d.refresh_token : undefined,
+            accessTokenExpiresAt: expires ? new Date(expires) : undefined,
+            scopes: [],
+        };
+    }
+    /** better-auth `getUserInfo`: the user comes from the VERIFIED access token. Returns null (never a guess) on any doubt. */
+    async function getUserInfo(tokens) {
+        try {
+            if (!tokens?.accessToken)
+                return null;
+            const doc = await loadDiscovery();
+            // A token without a kid is refused: no "first key" fallback. (A kid that is not in the key set is refused by jose.)
+            const kid = (0, jose_1.decodeProtectedHeader)(tokens.accessToken).kid;
+            if (typeof kid !== 'string' || !kid)
+                throw new Error('token header has no kid');
+            const jwksUri = doc.jwks_uri;
+            let keys = keySets.get(jwksUri);
+            if (!keys) {
+                keys = getKeySet(jwksUri);
+                keySets.set(jwksUri, keys);
+            }
+            const { payload } = await (0, jose_1.jwtVerify)(tokens.accessToken, keys, {
+                // RSA signatures ONLY (RS256/384/512, PS256/384/512; BAPert 74117): never HS* (a token "signed" with the public key as an HMAC
+                // secret), never none, never ES. 4.7.4/4.7.5 pinned RS256 from a source read; the live IdP's JWKS (dev-93, kid 46) declares alg RS512
+                // and every real access token was refused (NightHawk 74114). Which RS alg is binding is the JWKS KEY's own declared
+                // `alg`: jose only offers a JWK to a token whose header alg equals that JWK's `alg`, so a token cannot choose a
+                // weaker/other algorithm than the published key says. A JWK with no `alg` accepts any listed RSA alg; a symmetric (oct) key is never usable for these algorithms.
+                algorithms: ['RS256', 'RS384', 'RS512', 'PS256', 'PS384', 'PS512'],
+                issuer: opts.issuer ?? doc.issuer,
+                currentDate: new Date(now()),
+                // The IdP stamps nbf = issue time with no skew and the token is verified in the same second it is minted (NightHawk 74151:
+                // "nbf claim timestamp check failed"). 30 s, bounded. jose applies it to exp too: a token is accepted up to 30 s after exp.
+                clockTolerance: exports.CLOCK_TOLERANCE_SECONDS,
+            });
+            if (payload.token_type !== 'bearer_token')
+                throw new Error('token_type is not bearer_token');
+            if (typeof payload.sub !== 'string' || !payload.sub)
+                throw new Error('no sub');
+            const hasEmailClaim = typeof payload.email === 'string' && payload.email.trim() !== '';
+            const responseUser = responseUsers.get(tokens.accessToken);
+            responseUsers.delete(tokens.accessToken);
+            // The response user object (UNSIGNED body) must be the TOKEN's user (Scout 74198, DotNetPert-Scout 74202): Core fills data.user.user_name and the
+            // signed sub from the same loaded user in one mint, so WHENEVER a response user exists (even if a signed email claim is also present), user_name MUST be present
+            // and equal sub (case-insensitive). A different or missing user_name means the address may belong to someone else -> refuse. Does not constrain email == sub.
+            if (responseUser && responseUser.userName.trim().toLowerCase() !== payload.sub.trim().toLowerCase()) {
+                throw new Error('token response user is missing or does not match the token subject');
+            }
+            // A MASKED / unusable response address is ABSENT (PAY-2337), not "a different address": a valid signed claim still signs in, and with no claim
+            // there is no source. NEVER repaired or unmasked (no prefix match against sub or the claim). Log names only the fact, no value, no length.
+            const responseEmailRaw = responseUser?.email ?? '';
+            const responseEmailUsable = isAddressShaped(responseEmailRaw);
+            const responseMasked = responseEmailRaw.trim() !== '' && !responseEmailUsable;
+            if (responseMasked)
+                console.warn('[BETTER_AUTH] payez-idp token response address is masked or unusable; ignored');
+            const email = resolveEmail(payload, responseEmailUsable ? responseEmailRaw : undefined);
+            if (!email) {
+                throw new Error(responseMasked ? 'response address is masked' : 'no usable email (needs data.user.email or an email claim, address-shaped, equal when both are present)');
+            }
+            const name = (typeof payload.name === 'string' && payload.name.trim()) ||
+                (typeof payload.full_name === 'string' && payload.full_name.trim()) ||
+                email.split('@')[0];
+            const claims = {
+                sub: payload.sub,
+                email,
+                name,
+                userId: typeof payload.user_id === 'string' || typeof payload.user_id === 'number' ? String(payload.user_id) : undefined,
+                roles: rolesOf(payload.roles),
+                mfaVerified: amrIncludesMfa(payload.amr),
+                // Only the signed token's own email CLAIM can be verified; an address that came from the token response (data.user.email) never asserts it.
+                emailVerified: hasEmailClaim && (payload.email_verified === true || payload.email_verified === 'true'),
+            };
+            opts.onClaims?.(claims);
+            return { id: claims.sub, email: claims.email, name: claims.name, emailVerified: claims.emailVerified };
+        }
+        catch (err) {
+            // Reason only, never the token.
+            console.warn('[BETTER_AUTH] payez-idp access token refused:', err instanceof Error ? err.message : String(err));
+            return null;
+        }
+    }
+    return { getToken, getUserInfo };
+}

package/dist/auth/safe-callback.js

@@ -68,6 +68,14 @@ exports.resolveCallbackDestination = resolveCallbackDestination;
 exports.DEFAULT_CALLBACK = '/';
 /** The auth surface. A callback pointing back into it causes a redirect cycle. */
 const AUTH_PREFIX = '/account-auth/';
+/**
+ * PAY-2315 (4.7.1): the middleware now treats the public /login page like /account-auth/login (a signed-in user is sent
+ * on), so a callback or a resolved path that is /login itself must be refused here too - otherwise /login with no
+ * callbackUrl would resolve its own pathname as the destination and redirect to itself forever.
+ */
+function isAuthSurface(pathname) {
+    return pathname.startsWith(AUTH_PREFIX) || pathname === '/login' || pathname.startsWith('/login/');
+}
 /**
  * Synthetic, unreachable base. Only ever used as the resolution origin for the
  * comparison below - never emitted, never navigated to. `.invalid` is reserved
@@ -95,7 +103,7 @@ function safeCallbackPath(raw, fallback = exports.DEFAULT_CALLBACK) {
     if (url.origin !== BASE)
         return fallback;
     // Loopbacks into the auth surface cause redirect cycles.
-    if (url.pathname.startsWith(AUTH_PREFIX))
+    if (isAuthSurface(url.pathname))
         return fallback;
     // PAY-2218: `_rsc` is Next's flight cache-buster. Once skipProxyUrlNormalize lets it reach middleware it leaks
     // into return targets (`callbackUrl=/overview?_rsc=abc12`, NightHawk 72013); it is never a meaningful part of a
@@ -143,7 +151,7 @@ function safeCallbackPath(raw, fallback = exports.DEFAULT_CALLBACK) {
     }
     if (echo.origin !== BASE)
         return fallback;
-    if (echo.pathname.startsWith(AUTH_PREFIX))
+    if (isAuthSurface(echo.pathname))
         return fallback;
     if (echo.pathname + echo.search + echo.hash !== candidate)
         return fallback;

package/dist/client/AuthContext.d.ts

@@ -9,6 +9,8 @@ interface AuthProviderProps {
      */
     useDynamicProviders?: boolean;
 }
+/** PAY-2334: how long /api/auth/settings may take before the sign-in card stops waiting and says it could not load. */
+export declare const SETTINGS_FETCH_TIMEOUT_MS = 10000;
 export declare function AuthProvider({ children, config, useDynamicProviders }: AuthProviderProps): import("react/jsx-runtime").JSX.Element;
 export declare function useAuthConfig(): AuthConfig;
 export declare function useAuthMode(): AuthMode;

package/dist/client/AuthContext.js

@@ -1,6 +1,7 @@
 "use strict";
 'use client';
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.SETTINGS_FETCH_TIMEOUT_MS = void 0;
 exports.AuthProvider = AuthProvider;
 exports.useAuthConfig = useAuthConfig;
 exports.useAuthMode = useAuthMode;
@@ -29,9 +30,14 @@ const PROVIDER_MAP = {
 };
 // OAuth providers we support in UI (excludes credentials)
 const OAUTH_PROVIDER_IDS = ['google', 'apple', 'facebook', 'github', 'azure-ad', 'microsoft-entra-id'];
+/** PAY-2334: how long /api/auth/settings may take before the sign-in card stops waiting and says it could not load. */
+exports.SETTINGS_FETCH_TIMEOUT_MS = 10000;
 function AuthProvider({ children, config, useDynamicProviders = true }) {
     const [dynamicProviders, setDynamicProviders] = (0, react_1.useState)([]);
     const [providersLoaded, setProvidersLoaded] = (0, react_1.useState)(!useDynamicProviders);
+    // PAY-2334: providersLoaded is true on failure too (it only means "stop waiting"), so it cannot tell an empty answer from
+    // no answer. This can: loading -> ready (answered) | failed (non-2xx, thrown, timed out).
+    const [settingsStatus, setSettingsStatus] = (0, react_1.useState)(useDynamicProviders ? 'loading' : 'ready');
     // What the IDP says this client offers. null until /api/auth/settings answers.
     const [serverSettings, setServerSettings] = (0, react_1.useState)(null);
     // Create QueryClient instance for React Query - used internally by MVP hooks
@@ -50,6 +56,9 @@ function AuthProvider({ children, config, useDynamicProviders = true }) {
             return;
         let mounted = true;
         async function fetchDynamicProviders() {
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), exports.SETTINGS_FETCH_TIMEOUT_MS);
+            let status = 'failed';
             try {
                 // READ THE IDP. This used to be a hardcoded literal:
                 //     const result = { google: { id: 'google', name: 'Google' } };
@@ -59,7 +68,7 @@ function AuthProvider({ children, config, useDynamicProviders = true }) {
                 //
                 // /api/auth/settings already serves the real answer (enabledProviders,
                 // allowFederatedLogin, enablePasswordReset) and nothing consumed it.
-                const response = await fetch('/api/auth/settings');
+                const response = await fetch('/api/auth/settings', { signal: controller.signal });
                 if (!response.ok) {
                     // No silent substitution. Absent settings means we do not know what this
                     // client offers, and inventing a provider list is how a tenant ends up with a
@@ -79,6 +88,7 @@ function AuthProvider({ children, config, useDynamicProviders = true }) {
                     .filter(id => OAUTH_PROVIDER_IDS.includes(id))
                     .map(id => PROVIDER_MAP[id])
                     .filter((p) => p !== undefined);
+                status = 'ready';
                 setDynamicProviders(oauthProviders);
                 setServerSettings({
                     allowFederatedLogin: settings?.allowFederatedLogin !== false,
@@ -92,7 +102,9 @@ function AuthProvider({ children, config, useDynamicProviders = true }) {
                 console.error('[AuthProvider] could not read /api/auth/settings:', err);
             }
             finally {
+                clearTimeout(timer);
                 if (mounted) {
+                    setSettingsStatus(status);
                     setProvidersLoaded(true);
                 }
             }
@@ -110,6 +122,7 @@ function AuthProvider({ children, config, useDynamicProviders = true }) {
         ...defaultConfig,
         ...config,
         providers, // from the IDP when useDynamicProviders is on
+        settingsStatus: useDynamicProviders ? settingsStatus : 'ready',
         // THE SERVER DECIDES, THE SITE MAY OVERRIDE. A site that passes an explicit value
         // still wins; absent that, what the tenant's IDP reports is what renders. A client
         // hardcoding its own auth mode is how a sign-in screen and its IDP disagree.

package/dist/components/auth/CredentialSignInForm.d.ts

@@ -0,0 +1,33 @@
+import { type FetchLike } from '../../lib/credential-sign-in-client';
+/**
+ * PAY-2302 cut 1b: the package's email + password (+ 2FA code) sign-in form.
+ *
+ * WHY IT EXISTS. The package's own Better Auth instance has no emailAndPassword, so the login page had no credential form
+ * (removed 2026-08-02, BAPert 17586: "restore this form together" with the backend that makes it work). This is that pair:
+ * the backend is routes/auth/credential-login (+ credential-login-email-code), which the app mounts at
+ * /api/auth/admin-login[/email-code]; this component drives it. Moved from the portal's AdminLoginCard (VibeID-Customer-Portal
+ * 3d654917), re-styled with the package's own TraditionalAuthSection instead of the portal's AuthCard chrome.
+ *
+ * MOUNT IT through the login page's slot, so nothing changes for a consumer that does not opt in:
+ *     <LoginPage altAuthSlot={<CredentialSignInForm />} />
+ * (An app that has not mounted the two routes must NOT mount this form: it would be the dead control 17586 removed.)
+ *
+ * Two steps, the IdP's own contract (an access token with no refresh token means a second factor is outstanding):
+ *   'credentials' - email + password
+ *   'code'        - the 2FA code; the door parks the provisional bearer in an httpOnly cookie, this step resubmits with the code.
+ *
+ * After success the browser goes to the callbackUrl, passed through safeCallbackPath (same-origin paths only); when the page
+ * carries ?return_url (an IdP authorize request) it goes to the app's /api/oauth/resume instead, which resumes that request.
+ */
+interface Props {
+    /** Where to go after sign-in. Default: the page's ?callbackUrl, else /dashboard. Always passed through safeCallbackPath. */
+    callbackUrl?: string;
+    /** Test seam: the fetch used for both doors. */
+    fetchImpl?: FetchLike;
+    /** Test seam: navigation after success. */
+    onSignedIn?: (destination: string) => void;
+    showForgotPassword?: boolean;
+}
+export declare function resolveDestination(explicit?: string): string;
+export declare function CredentialSignInForm({ callbackUrl, fetchImpl, onSignedIn, showForgotPassword }: Props): import("react/jsx-runtime").JSX.Element;
+export default CredentialSignInForm;

package/dist/components/auth/CredentialSignInForm.js

@@ -0,0 +1,134 @@
+"use strict";
+'use client';
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveDestination = resolveDestination;
+exports.CredentialSignInForm = CredentialSignInForm;
+const jsx_runtime_1 = require("react/jsx-runtime");
+const react_1 = require("react");
+const TraditionalAuthSection_1 = require("./TraditionalAuthSection");
+const safe_callback_1 = require("../../auth/safe-callback");
+const authorize_resume_1 = require("../../lib/authorize-resume");
+const code_step_copy_1 = require("../../lib/code-step-copy");
+const credential_sign_in_client_1 = require("../../lib/credential-sign-in-client");
+const inputStyle = {
+    borderColor: 'var(--border-default, #e5e7eb)',
+    color: 'var(--text-primary, #111827)',
+    background: 'var(--bg-input, white)',
+};
+function resolveDestination(explicit) {
+    let raw = explicit;
+    let returnUrl = null;
+    if (typeof window !== 'undefined') {
+        const params = new URLSearchParams(window.location.search);
+        if (raw === undefined)
+            raw = params.get('callbackUrl') ?? undefined;
+        // PAY-2302 cut 2: an IdP that sent the user here mid-authorize (?return_url=<IdP authorize request>) must get the
+        // authorize request resumed after sign-in. The href points at the app's OWN /api/oauth/resume, which validates the
+        // URL against IDP_URL server-side; nothing absolute is navigated to from here, and the result is still guarded.
+        returnUrl = params.get('return_url');
+    }
+    return (0, safe_callback_1.safeCallbackPath)((0, authorize_resume_1.authorizeResumeHref)(returnUrl), (0, safe_callback_1.safeCallbackPath)(raw, '/dashboard'));
+}
+function CredentialSignInForm({ callbackUrl, fetchImpl, onSignedIn, showForgotPassword = false }) {
+    const [step, setStep] = (0, react_1.useState)('credentials');
+    const [email, setEmail] = (0, react_1.useState)('');
+    const [password, setPassword] = (0, react_1.useState)('');
+    const [code, setCode] = (0, react_1.useState)('');
+    const [busy, setBusy] = (0, react_1.useState)(false);
+    const [error, setError] = (0, react_1.useState)(null);
+    const [fieldError, setFieldError] = (0, react_1.useState)(null);
+    const [codeRequest, setCodeRequest] = (0, react_1.useState)(code_step_copy_1.NO_CODE_REQUEST);
+    const [offerEmailCode, setOfferEmailCode] = (0, react_1.useState)(false);
+    const [emailCodeMsg, setEmailCodeMsg] = (0, react_1.useState)(null);
+    async function submit(withCode) {
+        setBusy(true);
+        setError(null);
+        setOfferEmailCode(false);
+        try {
+            const r = await (0, credential_sign_in_client_1.credentialSignIn)({ email, password, code: withCode }, fetchImpl);
+            if (r.kind === 'success') {
+                const destination = resolveDestination(callbackUrl);
+                if (onSignedIn)
+                    onSignedIn(destination);
+                else
+                    window.location.href = destination;
+                return;
+            }
+            if (r.kind === 'two_factor') {
+                setCodeRequest(r.codeRequest);
+                setStep('code');
+                return;
+            }
+            setError(r.message);
+            if (r.kind === 'error')
+                setOfferEmailCode(r.offerEmailCode);
+        }
+        finally {
+            setBusy(false);
+        }
+    }
+    function onCredentialsSubmit(e) {
+        e.preventDefault();
+        const invalid = (0, credential_sign_in_client_1.validateCredentials)(email, password);
+        if (invalid) {
+            setFieldError(invalid.email ?? invalid.password ?? null);
+            return;
+        }
+        setFieldError(null);
+        void submit();
+    }
+    function onCodeSubmit(e) {
+        e.preventDefault();
+        const trimmed = code.trim();
+        if (!trimmed) {
+            setFieldError('Enter your authentication code.');
+            return;
+        }
+        setFieldError(null);
+        void submit(trimmed);
+    }
+    function onBack() {
+        setStep('credentials');
+        setCodeRequest(code_step_copy_1.NO_CODE_REQUEST);
+        setCode('');
+        setFieldError(null);
+        setError(null);
+        setOfferEmailCode(false);
+        setEmailCodeMsg(null);
+    }
+    async function askForEmailCode() {
+        setBusy(true);
+        setEmailCodeMsg(null);
+        try {
+            const r = await (0, credential_sign_in_client_1.requestEmailCode)(fetchImpl);
+            if (r.kind === 'requested') {
+                setCodeRequest(r.codeRequest);
+                setError(null);
+                setOfferEmailCode(false);
+                setEmailCodeMsg('We asked for a code to be emailed to you. Enter it above when it arrives.');
+            }
+            else {
+                setEmailCodeMsg(r.message);
+            }
+        }
+        finally {
+            setBusy(false);
+        }
+    }
+    const problem = fieldError ?? error;
+    const problemLine = problem && ((0, jsx_runtime_1.jsx)("p", { role: "alert", "data-testid": "credential-sign-in-error", className: "text-sm mt-3", style: { color: 'var(--color-error, #ef4444)' }, children: problem }));
+    if (step === 'code') {
+        return ((0, jsx_runtime_1.jsxs)("div", { "data-testid": "credential-sign-in-code-step", className: "text-left", children: [(0, jsx_runtime_1.jsx)("p", { className: "text-sm mb-4", style: { color: 'var(--text-primary, #111827)' }, children: (0, code_step_copy_1.codeStepInstruction)(email, codeRequest) }), (0, jsx_runtime_1.jsxs)("form", { onSubmit: onCodeSubmit, noValidate: true, className: "space-y-4", children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("label", { htmlFor: "credential-code", className: "block text-sm font-medium mb-2", style: { color: 'var(--text-primary, #111827)' }, children: "Authentication code" }), (0, jsx_runtime_1.jsx)("input", { id: "credential-code", name: "code", type: "text", inputMode: "numeric", autoComplete: "one-time-code", required: true, placeholder: "000000", value: code, disabled: busy, onChange: (e) => {
+                                        setCode(e.target.value);
+                                        setFieldError(null);
+                                    }, className: "w-full px-4 py-3 rounded-lg border transition-colors focus:outline-none focus:ring-2 disabled:opacity-50", style: inputStyle })] }), (0, jsx_runtime_1.jsx)("button", { type: "submit", disabled: busy, className: "w-full py-3 px-4 rounded-lg font-semibold focus:outline-none focus:ring-2 disabled:opacity-50 disabled:cursor-not-allowed transition-colors", style: { background: 'var(--btn-primary-bg, #11B588)', color: 'var(--btn-primary-text, white)' }, children: busy ? 'Verifying…' : 'Verify' })] }), (0, jsx_runtime_1.jsx)("button", { type: "button", onClick: onBack, disabled: busy, className: "text-sm underline mt-4", style: { background: 'none', border: 'none', padding: 0, color: 'var(--text-muted, #6b7280)' }, children: "Back" }), problemLine, (offerEmailCode || emailCodeMsg) && ((0, jsx_runtime_1.jsxs)("div", { "data-testid": "email-code-offer", className: "mt-4", children: [offerEmailCode && ((0, jsx_runtime_1.jsx)("button", { type: "button", onClick: () => void askForEmailCode(), disabled: busy, className: "text-sm font-semibold underline", style: { background: 'none', border: 'none', padding: 0, color: 'var(--text-primary, #111827)' }, children: "Email me a code instead" })), emailCodeMsg && ((0, jsx_runtime_1.jsx)("p", { role: "status", "data-testid": "email-code-offer-msg", className: "text-sm mt-2", style: { color: 'var(--text-primary, #111827)' }, children: emailCodeMsg }))] }))] }));
+    }
+    return ((0, jsx_runtime_1.jsxs)("div", { "data-testid": "credential-sign-in", className: "text-left", children: [(0, jsx_runtime_1.jsx)(TraditionalAuthSection_1.TraditionalAuthSection, { email: email, password: password, onEmailChange: (v) => {
+                    setEmail(v);
+                    setFieldError(null);
+                }, onPasswordChange: (v) => {
+                    setPassword(v);
+                    setFieldError(null);
+                }, onSubmit: onCredentialsSubmit, isLoading: busy, buttonText: "Sign in", showForgotPassword: showForgotPassword }), problemLine] }));
+}
+exports.default = CredentialSignInForm;

package/dist/components/auth/ModeAwareLoginPage.js

@@ -37,7 +37,10 @@ function ModeAwareLoginPage({ onFederatedSignIn, onTraditionalSignIn, onForgotPa
     return ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [error && ((0, jsx_runtime_1.jsx)("div", { className: "mb-6 px-4 py-3 rounded-lg", style: {
                     background: 'var(--color-error, #ef4444)',
                     color: 'white',
-                }, children: error })), isFederated && ((0, jsx_runtime_1.jsx)(FederatedAuthSection_1.FederatedAuthSection, { providers: config.providers, onProviderClick: handleFederatedClick, isLoading: totalLoading })), isFederated && isTraditional && ((0, jsx_runtime_1.jsxs)("div", { className: "flex items-center gap-3 my-6", "aria-hidden": "true", children: [(0, jsx_runtime_1.jsx)("span", { className: "h-px flex-1", style: { background: 'var(--border-default, #e5e7eb)' } }), (0, jsx_runtime_1.jsx)("span", { className: "text-xs uppercase tracking-wide", style: { color: 'var(--text-muted, #6b7280)' }, children: "or" }), (0, jsx_runtime_1.jsx)("span", { className: "h-px flex-1", style: { background: 'var(--border-default, #e5e7eb)' } })] })), isTraditional && ((0, jsx_runtime_1.jsx)(TraditionalAuthSection_1.TraditionalAuthSection, { email: email, password: password, onEmailChange: setEmail, onPasswordChange: setPassword, onSubmit: handleTraditionalSubmit, isLoading: totalLoading, buttonText: "Sign In", showForgotPassword: config.enableRecovery, onForgotPassword: onForgotPassword })), !isFederated && !isTraditional && ((0, jsx_runtime_1.jsxs)("div", { role: "alert", className: "px-4 py-3 rounded-lg text-sm text-left", style: {
+                }, children: error })), isFederated && ((0, jsx_runtime_1.jsx)(FederatedAuthSection_1.FederatedAuthSection, { providers: config.providers, onProviderClick: handleFederatedClick, isLoading: totalLoading })), isFederated && isTraditional && ((0, jsx_runtime_1.jsxs)("div", { className: "flex items-center gap-3 my-6", "aria-hidden": "true", children: [(0, jsx_runtime_1.jsx)("span", { className: "h-px flex-1", style: { background: 'var(--border-default, #e5e7eb)' } }), (0, jsx_runtime_1.jsx)("span", { className: "text-xs uppercase tracking-wide", style: { color: 'var(--text-muted, #6b7280)' }, children: "or" }), (0, jsx_runtime_1.jsx)("span", { className: "h-px flex-1", style: { background: 'var(--border-default, #e5e7eb)' } })] })), isTraditional && ((0, jsx_runtime_1.jsx)(TraditionalAuthSection_1.TraditionalAuthSection, { email: email, password: password, onEmailChange: setEmail, onPasswordChange: setPassword, onSubmit: handleTraditionalSubmit, isLoading: totalLoading, buttonText: "Sign In", showForgotPassword: config.enableRecovery, onForgotPassword: onForgotPassword })), !isFederated && !isTraditional && config.settingsStatus === 'loading' && ((0, jsx_runtime_1.jsx)("div", { role: "status", className: "px-4 py-3 rounded-lg text-sm text-left", style: { color: 'var(--text-secondary, #6b7280)' }, children: (0, jsx_runtime_1.jsx)("p", { children: "Loading sign-in options\u2026" }) })), !isFederated && !isTraditional && config.settingsStatus === 'failed' && ((0, jsx_runtime_1.jsxs)("div", { role: "alert", className: "px-4 py-3 rounded-lg text-sm text-left", style: {
+                    border: '1px solid var(--border-default, #e5e7eb)',
+                    color: 'var(--text-primary, #111827)',
+                }, children: [(0, jsx_runtime_1.jsx)("p", { className: "font-semibold", children: "Could not load sign-in options." }), (0, jsx_runtime_1.jsx)("p", { className: "mt-1", children: "Please reload the page. If it keeps happening, contact an administrator." })] })), !isFederated && !isTraditional && (config.settingsStatus ?? 'ready') === 'ready' && ((0, jsx_runtime_1.jsxs)("div", { role: "alert", className: "px-4 py-3 rounded-lg text-sm text-left", style: {
                     border: '1px solid var(--border-default, #e5e7eb)',
                     color: 'var(--text-primary, #111827)',
                 }, children: [(0, jsx_runtime_1.jsx)("p", { className: "font-semibold", children: "Sign-in is not available for this application." }), (0, jsx_runtime_1.jsx)("p", { className: "mt-1", children: "No sign-in method is enabled for this client. An administrator needs to enable a federated provider or username and password sign-in." })] }))] }));

package/dist/components/auth/ModeAwareSignupPage.js

@@ -56,26 +56,11 @@ function ModeAwareSignupPage({ onFederatedSignUp, onTraditionalSignUp, isLoading
                             border: '1px solid var(--border-default)',
                             color: 'white',
                             background: 'var(--color-primary, #10b981)',
-                        }, children: totalLoading ? 'Creating Account...' : 'Create Account' })] })), isFederated === false && isTraditional === false && ((0, jsx_runtime_1.jsxs)(jsx_runtime_1.Fragment, { children: [(0, jsx_runtime_1.jsx)(FederatedAuthSection_1.FederatedAuthSection, { providers: config.providers, onProviderClick: handleFederatedClick, isLoading: totalLoading }), config.providers.length > 0 && config.enableEmailSignup && ((0, jsx_runtime_1.jsxs)("div", { className: "relative my-6", children: [(0, jsx_runtime_1.jsx)("div", { className: "absolute inset-0 flex items-center", children: (0, jsx_runtime_1.jsx)("div", { className: "w-full", style: {
-                                        borderTop: '1px solid var(--border-default)',
-                                    } }) }), (0, jsx_runtime_1.jsx)("div", { className: "relative flex justify-center text-sm", children: (0, jsx_runtime_1.jsx)("span", { className: "px-2", style: {
-                                        background: 'var(--bg-card)',
-                                        color: 'var(--text-secondary)',
-                                    }, children: "Or sign up with email" }) })] })), config.enableEmailSignup && ((0, jsx_runtime_1.jsxs)("form", { onSubmit: handleTraditionalSubmit, className: "space-y-4", children: [(0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("label", { className: "block text-sm font-medium mb-2", style: { color: 'var(--text-primary)' }, children: "Email Address" }), (0, jsx_runtime_1.jsx)("input", { type: "email", value: email, onChange: (e) => setEmail(e.target.value), placeholder: "you@example.com", disabled: totalLoading, required: true, className: "w-full px-4 py-3 rounded-lg border transition-colors focus:outline-none focus:ring-2 disabled:opacity-50", style: {
-                                            border: '1px solid var(--border-default)',
-                                            color: 'var(--text-primary)',
-                                            background: 'var(--bg-default)',
-                                        } })] }), (0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("label", { className: "block text-sm font-medium mb-2", style: { color: 'var(--text-primary)' }, children: "Password" }), (0, jsx_runtime_1.jsx)("input", { type: "password", value: password, onChange: (e) => setPassword(e.target.value), placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022", disabled: totalLoading, required: true, className: "w-full px-4 py-3 rounded-lg border transition-colors focus:outline-none focus:ring-2 disabled:opacity-50", style: {
-                                            border: '1px solid var(--border-default)',
-                                            color: 'var(--text-primary)',
-                                            background: 'var(--bg-default)',
-                                        } })] }), (0, jsx_runtime_1.jsxs)("div", { children: [(0, jsx_runtime_1.jsx)("label", { className: "block text-sm font-medium mb-2", style: { color: 'var(--text-primary)' }, children: "Confirm Password" }), (0, jsx_runtime_1.jsx)("input", { type: "password", value: confirmPassword, onChange: (e) => setConfirmPassword(e.target.value), placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022", disabled: totalLoading, required: true, className: "w-full px-4 py-3 rounded-lg border transition-colors focus:outline-none focus:ring-2 disabled:opacity-50", style: {
-                                            border: '1px solid var(--border-default)',
-                                            color: 'var(--text-primary)',
-                                            background: 'var(--bg-default)',
-                                        } })] }), (0, jsx_runtime_1.jsx)("button", { type: "submit", disabled: totalLoading, className: "w-full py-3 px-4 rounded-lg font-semibold focus:outline-none focus:ring-2 disabled:opacity-50 disabled:cursor-not-allowed transition-colors mt-6", style: {
-                                    border: '1px solid var(--border-default)',
-                                    color: 'white',
-                                    background: 'var(--color-primary, #10b981)',
-                                }, children: totalLoading ? 'Creating Account...' : 'Create Account' })] }))] }))] }));
+                        }, children: totalLoading ? 'Creating Account...' : 'Create Account' })] })), !isFederated && !isTraditional && config.settingsStatus === 'loading' && ((0, jsx_runtime_1.jsx)("div", { role: "status", className: "px-4 py-3 rounded-lg text-sm text-left", style: { color: 'var(--text-secondary, #6b7280)' }, children: (0, jsx_runtime_1.jsx)("p", { children: "Loading sign-up options\u2026" }) })), !isFederated && !isTraditional && config.settingsStatus === 'failed' && ((0, jsx_runtime_1.jsxs)("div", { role: "alert", className: "px-4 py-3 rounded-lg text-sm text-left", style: {
+                    border: '1px solid var(--border-default, #e5e7eb)',
+                    color: 'var(--text-primary, #111827)',
+                }, children: [(0, jsx_runtime_1.jsx)("p", { className: "font-semibold", children: "Could not load sign-up options." }), (0, jsx_runtime_1.jsx)("p", { className: "mt-1", children: "Please reload the page. If it keeps happening, contact an administrator." })] })), !isFederated && !isTraditional && (config.settingsStatus ?? 'ready') === 'ready' && ((0, jsx_runtime_1.jsxs)("div", { role: "alert", className: "px-4 py-3 rounded-lg text-sm text-left", style: {
+                    border: '1px solid var(--border-default, #e5e7eb)',
+                    color: 'var(--text-primary, #111827)',
+                }, children: [(0, jsx_runtime_1.jsx)("p", { className: "font-semibold", children: "Sign-up is not available for this application." }), (0, jsx_runtime_1.jsx)("p", { className: "mt-1", children: "No sign-up method is enabled for this client. An administrator needs to enable a federated provider or username and password sign-in." })] }))] }));
 }