@rebasepro/auth 0.4.0 → 0.6.0

package/dist/index.es.js

@@ -1,1059 +1,815 @@
-import { useState, useRef, useEffect, useCallback } from "react";
-let baseApiUrl = "";
+import { useCallback, useEffect, useRef, useState } from "react";
+//#region src/api.ts
+/**
+* Default API URL - can be overridden in hook props
+*/
+var baseApiUrl = "";
+/**
+* Configure the API base URL
+*/
 function setApiUrl(url) {
-  baseApiUrl = url;
+	baseApiUrl = url;
 }
+/**
+* Get the current API URL
+*/
 function getApiUrl() {
-  return baseApiUrl;
-}
-class AuthApiError extends Error {
-  code;
-  constructor(message, code) {
-    super(message);
-    this.code = code;
-    this.name = "AuthApiError";
-  }
+	return baseApiUrl;
 }
+var AuthApiError = class extends Error {
+	code;
+	constructor(message, code) {
+		super(message);
+		this.code = code;
+		this.name = "AuthApiError";
+	}
+};
 async function handleResponse(response) {
-  let data;
-  try {
-    data = await response.json();
-  } catch (parseError) {
-    throw new AuthApiError(
-      `Server returned non-JSON response (status: ${response.status})`,
-      "PARSE_ERROR"
-    );
-  }
-  if (!response.ok) {
-    throw new AuthApiError(
-      data.error?.message || "Request failed",
-      data.error?.code || "UNKNOWN_ERROR"
-    );
-  }
-  return data;
+	let data;
+	try {
+		data = await response.json();
+	} catch (parseError) {
+		throw new AuthApiError(`Server returned non-JSON response (status: ${response.status})`, "PARSE_ERROR");
+	}
+	if (!response.ok) throw new AuthApiError(data.error?.message || "Request failed", data.error?.code || "UNKNOWN_ERROR");
+	return data;
 }
+/**
+* Wrapper for fetch that catches generic network failures (like server down)
+* and translates them to an AuthApiError.
+*/
 async function fetchWithHandling(input, init) {
-  try {
-    return await fetch(input, init);
-  } catch (error) {
-    if (error instanceof TypeError && error.message.includes("Failed to fetch")) {
-      throw new AuthApiError(
-        "Failed to connect to the backend server. The backend might be down or failed to initialize (e.g., database connection timeout).",
-        "NETWORK_ERROR"
-      );
-    }
-    throw new AuthApiError("Network error: " + (error instanceof Error ? error.message : String(error)), "NETWORK_ERROR");
-  }
+	try {
+		return await fetch(input, init);
+	} catch (error) {
+		if (error instanceof TypeError && error.message.includes("Failed to fetch")) throw new AuthApiError("Failed to connect to the backend server. The backend might be down or failed to initialize (e.g., database connection timeout).", "NETWORK_ERROR");
+		throw new AuthApiError("Network error: " + (error instanceof Error ? error.message : String(error)), "NETWORK_ERROR");
+	}
 }
+/**
+* Register a new user with email/password
+*/
 async function register(email, password, displayName) {
-  const response = await fetchWithHandling(`${baseApiUrl}/api/auth/register`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({
-      email,
-      password,
-      displayName
-    })
-  });
-  return handleResponse(response);
+	return handleResponse(await fetchWithHandling(`${baseApiUrl}/api/auth/register`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({
+			email,
+			password,
+			displayName
+		})
+	}));
 }
+/**
+* Login with email/password
+*/
 async function login(email, password) {
-  const response = await fetchWithHandling(`${baseApiUrl}/api/auth/login`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({
-      email,
-      password
-    })
-  });
-  return handleResponse(response);
+	return handleResponse(await fetchWithHandling(`${baseApiUrl}/api/auth/login`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({
+			email,
+			password
+		})
+	}));
 }
+/**
+* Login with Google.
+*
+* Accepts one of:
+* - `{ idToken }` — ID-token flow (One Tap / Sign In button)
+* - `{ accessToken }` — Access-token flow (popup)
+* - `{ code, redirectUri }` — Authorization code flow (most secure)
+*/
 async function googleLogin(payload) {
-  const response = await fetchWithHandling(`${baseApiUrl}/api/auth/google`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify(payload)
-  });
-  return handleResponse(response);
+	return handleResponse(await fetchWithHandling(`${baseApiUrl}/api/auth/google`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify(payload)
+	}));
 }
+/**
+* Generic OAuth login — works with any provider registered on the backend.
+* The `providerId` is used to build the endpoint: `/api/auth/{providerId}`.
+*/
 async function oauthLogin(providerId, payload) {
-  const response = await fetchWithHandling(`${baseApiUrl}/api/auth/${providerId}`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify(payload)
-  });
-  return handleResponse(response);
+	return handleResponse(await fetchWithHandling(`${baseApiUrl}/api/auth/${providerId}`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify(payload)
+	}));
 }
+/**
+* Refresh access token using refresh token
+*/
 async function refreshAccessToken(refreshToken) {
-  const response = await fetchWithHandling(`${baseApiUrl}/api/auth/refresh`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ refreshToken })
-  });
-  return handleResponse(response);
+	return handleResponse(await fetchWithHandling(`${baseApiUrl}/api/auth/refresh`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({ refreshToken })
+	}));
 }
+/**
+* Logout and invalidate refresh token
+*/
 async function logout(refreshToken) {
-  await fetchWithHandling(`${baseApiUrl}/api/auth/logout`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ refreshToken })
-  });
+	await fetchWithHandling(`${baseApiUrl}/api/auth/logout`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({ refreshToken })
+	});
 }
+/**
+* Get current user info
+*/
 async function getCurrentUser(accessToken) {
-  const response = await fetchWithHandling(`${baseApiUrl}/api/auth/me`, {
-    method: "GET",
-    headers: {
-      "Content-Type": "application/json",
-      "Authorization": `Bearer ${accessToken}`
-    }
-  });
-  return handleResponse(response);
+	return handleResponse(await fetchWithHandling(`${baseApiUrl}/api/auth/me`, {
+		method: "GET",
+		headers: {
+			"Content-Type": "application/json",
+			"Authorization": `Bearer ${accessToken}`
+		}
+	}));
 }
+/**
+* Request password reset email
+*/
 async function forgotPassword(email) {
-  const response = await fetchWithHandling(`${baseApiUrl}/api/auth/forgot-password`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ email })
-  });
-  return handleResponse(response);
+	return handleResponse(await fetchWithHandling(`${baseApiUrl}/api/auth/forgot-password`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({ email })
+	}));
 }
+/**
+* Reset password using token from email
+*/
 async function resetPassword(token, password) {
-  const response = await fetchWithHandling(`${baseApiUrl}/api/auth/reset-password`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({
-      token,
-      password
-    })
-  });
-  return handleResponse(response);
+	return handleResponse(await fetchWithHandling(`${baseApiUrl}/api/auth/reset-password`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({
+			token,
+			password
+		})
+	}));
 }
+/**
+* Change password for authenticated user
+*/
 async function changePassword(accessToken, oldPassword, newPassword) {
-  const response = await fetchWithHandling(`${baseApiUrl}/api/auth/change-password`, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      "Authorization": `Bearer ${accessToken}`
-    },
-    body: JSON.stringify({
-      oldPassword,
-      newPassword
-    })
-  });
-  return handleResponse(response);
+	return handleResponse(await fetchWithHandling(`${baseApiUrl}/api/auth/change-password`, {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			"Authorization": `Bearer ${accessToken}`
+		},
+		body: JSON.stringify({
+			oldPassword,
+			newPassword
+		})
+	}));
 }
+/**
+* Update current user profile
+*/
 async function updateProfile(accessToken, displayName, photoURL) {
-  const response = await fetchWithHandling(`${baseApiUrl}/api/auth/me`, {
-    method: "PATCH",
-    headers: {
-      "Content-Type": "application/json",
-      "Authorization": `Bearer ${accessToken}`
-    },
-    body: JSON.stringify({
-      displayName,
-      photoURL
-    })
-  });
-  return handleResponse(response);
+	return handleResponse(await fetchWithHandling(`${baseApiUrl}/api/auth/me`, {
+		method: "PATCH",
+		headers: {
+			"Content-Type": "application/json",
+			"Authorization": `Bearer ${accessToken}`
+		},
+		body: JSON.stringify({
+			displayName,
+			photoURL
+		})
+	}));
 }
+/**
+* Fetch active sessions for current user
+*/
 async function fetchSessions(accessToken, currentRefreshToken) {
-  const headers = {
-    "Content-Type": "application/json",
-    "Authorization": `Bearer ${accessToken}`
-  };
-  if (currentRefreshToken) {
-    headers["X-Refresh-Token"] = currentRefreshToken;
-  }
-  const response = await fetchWithHandling(`${baseApiUrl}/api/auth/sessions`, {
-    method: "GET",
-    headers
-  });
-  return handleResponse(response);
+	const headers = {
+		"Content-Type": "application/json",
+		"Authorization": `Bearer ${accessToken}`
+	};
+	if (currentRefreshToken) headers["X-Refresh-Token"] = currentRefreshToken;
+	return handleResponse(await fetchWithHandling(`${baseApiUrl}/api/auth/sessions`, {
+		method: "GET",
+		headers
+	}));
 }
+/**
+* Revoke a specific session
+*/
 async function revokeSession(accessToken, sessionId) {
-  const response = await fetchWithHandling(`${baseApiUrl}/api/auth/sessions/${sessionId}`, {
-    method: "DELETE",
-    headers: {
-      "Content-Type": "application/json",
-      "Authorization": `Bearer ${accessToken}`
-    }
-  });
-  return handleResponse(response);
+	return handleResponse(await fetchWithHandling(`${baseApiUrl}/api/auth/sessions/${sessionId}`, {
+		method: "DELETE",
+		headers: {
+			"Content-Type": "application/json",
+			"Authorization": `Bearer ${accessToken}`
+		}
+	}));
 }
+/**
+* Revoke all sessions for current user
+*/
 async function revokeAllSessions(accessToken) {
-  const response = await fetchWithHandling(`${baseApiUrl}/api/auth/sessions`, {
-    method: "DELETE",
-    headers: {
-      "Content-Type": "application/json",
-      "Authorization": `Bearer ${accessToken}`
-    }
-  });
-  return handleResponse(response);
+	return handleResponse(await fetchWithHandling(`${baseApiUrl}/api/auth/sessions`, {
+		method: "DELETE",
+		headers: {
+			"Content-Type": "application/json",
+			"Authorization": `Bearer ${accessToken}`
+		}
+	}));
 }
-let authConfigInflight = null;
-let authConfigCached = null;
+/**
+* Inflight promise for `fetchAuthConfig` — ensures concurrent callers
+* (e.g. React StrictMode double-mount) reuse the same network request.
+*/
+var authConfigInflight = null;
+/**
+* Cached result of the last successful `fetchAuthConfig` call.
+* Auth config is static for the lifetime of the app session, so
+* repeat calls (e.g. from effect re-runs) return instantly.
+*/
+var authConfigCached = null;
+/**
+* Fetch auth configuration / status from the backend
+* This is an unauthenticated endpoint used to detect bootstrap mode.
+*
+* Results are cached for the session lifetime.
+* Concurrent calls are deduplicated: only one network request is made
+* and all callers share the same promise.
+*/
 async function fetchAuthConfig() {
-  if (authConfigCached) {
-    return authConfigCached;
-  }
-  if (authConfigInflight) {
-    return authConfigInflight;
-  }
-  authConfigInflight = (async () => {
-    const response = await fetchWithHandling(`${baseApiUrl}/api/auth/config`, {
-      method: "GET",
-      headers: { "Content-Type": "application/json" }
-    });
-    return handleResponse(response);
-  })();
-  try {
-    const result = await authConfigInflight;
-    authConfigCached = result;
-    return result;
-  } finally {
-    authConfigInflight = null;
-  }
+	if (authConfigCached) return authConfigCached;
+	if (authConfigInflight) return authConfigInflight;
+	authConfigInflight = (async () => {
+		return handleResponse(await fetchWithHandling(`${baseApiUrl}/api/auth/config`, {
+			method: "GET",
+			headers: { "Content-Type": "application/json" }
+		}));
+	})();
+	try {
+		const result = await authConfigInflight;
+		authConfigCached = result;
+		return result;
+	} finally {
+		authConfigInflight = null;
+	}
 }
-const STORAGE_KEY = "rebase_react_auth";
-const TOKEN_REFRESH_BUFFER_MS = 2 * 60 * 1e3;
+//#endregion
+//#region src/hooks/useRebaseAuthController.ts
+var STORAGE_KEY = "rebase_react_auth";
+var TOKEN_REFRESH_BUFFER_MS = 120 * 1e3;
+/**
+* Convert UserInfo from API to Rebase User type
+*/
 function convertToUser(userInfo) {
-  return {
-    uid: userInfo.uid,
-    email: userInfo.email,
-    displayName: userInfo.displayName || null,
-    photoURL: userInfo.photoURL || null,
-    providerId: "custom",
-    isAnonymous: false,
-    roles: userInfo.roles || [],
-    metadata: userInfo.metadata
-  };
+	return {
+		uid: userInfo.uid,
+		email: userInfo.email,
+		displayName: userInfo.displayName || null,
+		photoURL: userInfo.photoURL || null,
+		providerId: "custom",
+		isAnonymous: false,
+		roles: userInfo.roles || [],
+		metadata: userInfo.metadata
+	};
 }
+/**
+* Save auth data to localStorage
+*/
 function saveAuthToStorage(tokens, user) {
-  try {
-    const data = { tokens, user };
-    localStorage.setItem(STORAGE_KEY, JSON.stringify(data));
-  } catch (e) {
-  }
+	try {
+		const data = {
+			tokens,
+			user
+		};
+		localStorage.setItem(STORAGE_KEY, JSON.stringify(data));
+	} catch (e) {}
 }
+/**
+* Load auth data from localStorage
+*/
 function loadAuthFromStorage() {
-  try {
-    const data = localStorage.getItem(STORAGE_KEY);
-    if (data) {
-      const parsed = JSON.parse(data);
-      return parsed;
-    }
-  } catch (e) {
-    console.warn("Failed to load auth from storage:", e);
-  }
-  return null;
+	try {
+		const data = localStorage.getItem(STORAGE_KEY);
+		if (data) return JSON.parse(data);
+	} catch (e) {
+		console.warn("Failed to load auth from storage:", e);
+	}
+	return null;
 }
+/**
+* Clear auth data from localStorage
+*/
 function clearAuthFromStorage() {
-  try {
-    localStorage.removeItem(STORAGE_KEY);
-  } catch (e) {
-    console.warn("Failed to clear auth from storage:", e);
-  }
+	try {
+		localStorage.removeItem(STORAGE_KEY);
+	} catch (e) {
+		console.warn("Failed to clear auth from storage:", e);
+	}
 }
+/**
+* Check if token is expired or about to expire
+*/
 function isTokenExpiredOrNearExpiry(expiresAt, bufferMs = TOKEN_REFRESH_BUFFER_MS) {
-  return Date.now() + bufferMs >= expiresAt;
+	return Date.now() + bufferMs >= expiresAt;
 }
+/**
+* Auth controller hook for JWT-based authentication
+* with @rebasepro/server-core
+*
+* @param props Configuration options
+* @returns RebaseAuthController instance
+*/
 function useRebaseAuthController(props = {}) {
-  const { client, apiUrl, onSignOut, defineRolesFor } = props;
-  const [user, setUser] = useState(null);
-  const [authLoading, setAuthLoading] = useState(false);
-  const [initialLoading, setInitialLoading] = useState(true);
-  const [authError, setAuthError] = useState(null);
-  const [authProviderError, setAuthProviderError] = useState(null);
-  const [loginSkipped, setLoginSkipped] = useState(false);
-  const [extra, setExtra] = useState(null);
-  const [authConfig, setAuthConfig] = useState(null);
-  const tokensRef = useRef(null);
-  const refreshTimeoutRef = useRef(null);
-  const refreshPromiseRef = useRef(null);
-  const isMountedRef = useRef(true);
-  useEffect(() => {
-    const url = client?.baseUrl || apiUrl;
-    if (url) {
-      setApiUrl(url);
-    }
-  }, [client, client?.baseUrl, apiUrl]);
-  const clearError = useCallback(() => {
-    setAuthProviderError(null);
-  }, []);
-  const clearSessionAndSignOut = useCallback(() => {
-    tokensRef.current = null;
-    clearAuthFromStorage();
-    if (refreshTimeoutRef.current) {
-      clearTimeout(refreshTimeoutRef.current);
-      refreshTimeoutRef.current = null;
-    }
-    setUser(null);
-    setLoginSkipped(false);
-    onSignOut?.();
-  }, [onSignOut]);
-  const refreshAccessToken$1 = useCallback(async () => {
-    if (refreshPromiseRef.current) {
-      return refreshPromiseRef.current;
-    }
-    const executeRefresh = async () => {
-      const storedData = loadAuthFromStorage();
-      if (storedData?.tokens?.accessTokenExpiresAt) {
-        const storedTokens = storedData.tokens;
-        if (!isTokenExpiredOrNearExpiry(storedTokens.accessTokenExpiresAt) && storedTokens.accessToken !== tokensRef.current?.accessToken) {
-          tokensRef.current = storedTokens;
-          return storedTokens;
-        }
-      }
-      const currentTokens = tokensRef.current;
-      if (!currentTokens?.refreshToken) {
-        return null;
-      }
-      try {
-        const response = await refreshAccessToken(currentTokens.refreshToken);
-        const newTokens = response.tokens;
-        tokensRef.current = newTokens;
-        const latestStoredData = loadAuthFromStorage();
-        if (latestStoredData) {
-          saveAuthToStorage(newTokens, latestStoredData.user);
-        }
-        return newTokens;
-      } catch (error) {
-        if (error instanceof Error && error.code === "NETWORK_ERROR") {
-          throw error;
-        }
-        return null;
-      } finally {
-        refreshPromiseRef.current = null;
-      }
-    };
-    refreshPromiseRef.current = executeRefresh();
-    return refreshPromiseRef.current;
-  }, []);
-  const scheduleTokenRefresh = useCallback((tokens) => {
-    if (refreshTimeoutRef.current) {
-      clearTimeout(refreshTimeoutRef.current);
-    }
-    const expiresAt = tokens.accessTokenExpiresAt;
-    const refreshAt = expiresAt - TOKEN_REFRESH_BUFFER_MS;
-    const timeUntilRefresh = refreshAt - Date.now();
-    if (timeUntilRefresh <= 0) {
-      refreshAccessToken$1().then((newTokens) => {
-        if (newTokens && isMountedRef.current) {
-          scheduleTokenRefresh(newTokens);
-        } else if (!newTokens && isMountedRef.current) {
-          clearSessionAndSignOut();
-        }
-      });
-      return;
-    }
-    refreshTimeoutRef.current = setTimeout(async () => {
-      if (!isMountedRef.current) return;
-      try {
-        const newTokens = await refreshAccessToken$1();
-        if (newTokens && isMountedRef.current) {
-          scheduleTokenRefresh(newTokens);
-        } else if (!newTokens && isMountedRef.current) {
-          clearSessionAndSignOut();
-        }
-      } catch (error) {
-        if (isMountedRef.current) {
-          refreshTimeoutRef.current = setTimeout(() => {
-            scheduleTokenRefresh(tokens);
-          }, 1e4);
-        }
-      }
-    }, timeUntilRefresh);
-  }, [refreshAccessToken$1, clearSessionAndSignOut]);
-  const getAuthToken = useCallback(async () => {
-    if (initialLoading) {
-      throw new Error("Auth is still loading");
-    }
-    const currentTokens = tokensRef.current;
-    if (!currentTokens) {
-      throw new Error("User is not logged in");
-    }
-    if (isTokenExpiredOrNearExpiry(currentTokens.accessTokenExpiresAt)) {
-      try {
-        const newTokens = await refreshAccessToken$1();
-        if (!newTokens) {
-          clearSessionAndSignOut();
-          throw new Error("Session expired. Please login again.");
-        }
-        return newTokens.accessToken;
-      } catch (error) {
-        if (error instanceof Error && error.code === "NETWORK_ERROR") {
-          throw error;
-        }
-        clearSessionAndSignOut();
-        throw error;
-      }
-    }
-    return currentTokens.accessToken;
-  }, [initialLoading, refreshAccessToken$1, clearSessionAndSignOut]);
-  useEffect(() => {
-    if (client) {
-      client.setAuthTokenGetter?.(async () => {
-        try {
-          return await getAuthToken();
-        } catch {
-          return null;
-        }
-      });
-      if (client.setOnUnauthorized) {
-        client.setOnUnauthorized(async () => {
-          try {
-            const newTokens = await refreshAccessToken$1();
-            if (newTokens) return true;
-            clearSessionAndSignOut();
-            return false;
-          } catch (e) {
-            clearSessionAndSignOut();
-            return false;
-          }
-        });
-      }
-      if (client.ws) {
-        client.ws.setAuthTokenGetter(async () => {
-          return await getAuthToken();
-        });
-      }
-    }
-  }, [client, getAuthToken, refreshAccessToken$1, clearSessionAndSignOut]);
-  const handleAuthSuccess = useCallback(async (userInfo, tokens) => {
-    tokensRef.current = tokens;
-    let convertedUser = convertToUser(userInfo);
-    if (defineRolesFor) {
-      const customRoles = await defineRolesFor(convertedUser);
-      if (customRoles) {
-        convertedUser = { ...convertedUser, roles: customRoles };
-      }
-    }
-    saveAuthToStorage(tokens, userInfo);
-    setUser(convertedUser);
-    setAuthError(null);
-    setAuthProviderError(null);
-    setLoginSkipped(false);
-    scheduleTokenRefresh(tokens);
-  }, [scheduleTokenRefresh, defineRolesFor]);
-  const emailPasswordLogin = useCallback(async (email, password) => {
-    setAuthLoading(true);
-    setAuthProviderError(null);
-    try {
-      const response = await login(email, password);
-      await handleAuthSuccess(response.user, response.tokens);
-    } catch (error) {
-      setAuthProviderError(error);
-      throw error;
-    } finally {
-      setAuthLoading(false);
-    }
-  }, [handleAuthSuccess]);
-  const register$1 = useCallback(async (email, password, displayName) => {
-    setAuthLoading(true);
-    setAuthProviderError(null);
-    try {
-      const response = await register(email, password, displayName);
-      await handleAuthSuccess(response.user, response.tokens);
-    } catch (error) {
-      setAuthProviderError(error);
-      throw error;
-    } finally {
-      setAuthLoading(false);
-    }
-  }, [handleAuthSuccess]);
-  const googleLogin$1 = useCallback(async (payload) => {
-    setAuthLoading(true);
-    setAuthProviderError(null);
-    try {
-      const response = await googleLogin(payload);
-      await handleAuthSuccess(response.user, response.tokens);
-    } catch (error) {
-      setAuthProviderError(error);
-      throw error;
-    } finally {
-      setAuthLoading(false);
-    }
-  }, [handleAuthSuccess]);
-  const oauthLogin$1 = useCallback(async (providerId, payload) => {
-    setAuthLoading(true);
-    setAuthProviderError(null);
-    try {
-      const response = await oauthLogin(providerId, payload);
-      await handleAuthSuccess(response.user, response.tokens);
-    } catch (error) {
-      setAuthProviderError(error);
-      throw error;
-    } finally {
-      setAuthLoading(false);
-    }
-  }, [handleAuthSuccess]);
-  const signOut = useCallback(async () => {
-    try {
-      if (tokensRef.current) {
-        await logout(tokensRef.current.refreshToken);
-      }
-    } catch (error) {
-      console.error("Logout error:", error);
-    } finally {
-      clearSessionAndSignOut();
-    }
-  }, [clearSessionAndSignOut]);
-  const skipLogin = useCallback(() => {
-    setLoginSkipped(true);
-    setUser(null);
-  }, []);
-  const forgotPassword$1 = useCallback(async (email) => {
-    setAuthLoading(true);
-    setAuthProviderError(null);
-    try {
-      await forgotPassword(email);
-    } catch (error) {
-      setAuthProviderError(error);
-      throw error;
-    } finally {
-      setAuthLoading(false);
-    }
-  }, []);
-  const resetPassword$1 = useCallback(async (token, password) => {
-    setAuthLoading(true);
-    setAuthProviderError(null);
-    try {
-      await resetPassword(token, password);
-    } catch (error) {
-      setAuthProviderError(error);
-      throw error;
-    } finally {
-      setAuthLoading(false);
-    }
-  }, []);
-  const changePassword$1 = useCallback(async (oldPassword, newPassword) => {
-    setAuthLoading(true);
-    setAuthProviderError(null);
-    try {
-      if (!tokensRef.current) {
-        throw new Error("User is not logged in");
-      }
-      await changePassword(tokensRef.current.accessToken, oldPassword, newPassword);
-      clearSessionAndSignOut();
-    } catch (error) {
-      setAuthProviderError(error);
-      throw error;
-    } finally {
-      setAuthLoading(false);
-    }
-  }, [clearSessionAndSignOut]);
-  const updateProfile$1 = useCallback(async (displayName, photoURL) => {
-    setAuthLoading(true);
-    setAuthProviderError(null);
-    try {
-      if (!tokensRef.current) {
-        throw new Error("User is not logged in");
-      }
-      const response = await updateProfile(tokensRef.current.accessToken, displayName, photoURL);
-      let convertedUser = convertToUser(response.user);
-      if (defineRolesFor) {
-        const customRoles = await defineRolesFor(convertedUser);
-        if (customRoles) {
-          convertedUser = {
-            ...convertedUser,
-            roles: customRoles
-          };
-        }
-      }
-      const storedData = loadAuthFromStorage();
-      if (storedData) {
-        saveAuthToStorage(storedData.tokens, response.user);
-      }
-      setUser(convertedUser);
-      return convertedUser;
-    } catch (error) {
-      setAuthProviderError(error);
-      throw error;
-    } finally {
-      setAuthLoading(false);
-    }
-  }, [defineRolesFor]);
-  const fetchSessions$1 = useCallback(async () => {
-    try {
-      if (!tokensRef.current) {
-        throw new Error("User is not logged in");
-      }
-      const response = await fetchSessions(tokensRef.current.accessToken, tokensRef.current.refreshToken);
-      return response.sessions;
-    } catch (error) {
-      setAuthProviderError(error);
-      throw error;
-    }
-  }, []);
-  const revokeSession$1 = useCallback(async (sessionId) => {
-    try {
-      if (!tokensRef.current) {
-        throw new Error("User is not logged in");
-      }
-      await revokeSession(tokensRef.current.accessToken, sessionId);
-    } catch (error) {
-      setAuthProviderError(error);
-      throw error;
-    }
-  }, []);
-  useEffect(() => {
-    isMountedRef.current = true;
-    const restoreAuth = async () => {
-      try {
-        const config = await fetchAuthConfig();
-        if (isMountedRef.current) {
-          setAuthConfig(config);
-        }
-      } catch (e) {
-      }
-      const stored = loadAuthFromStorage();
-      if (!stored) {
-        setInitialLoading(false);
-        return;
-      }
-      if (!stored.tokens?.refreshToken) {
-        clearAuthFromStorage();
-        setInitialLoading(false);
-        return;
-      }
-      const expiresAt = stored.tokens.accessTokenExpiresAt;
-      if (typeof expiresAt !== "number" || !Number.isFinite(expiresAt)) {
-        clearAuthFromStorage();
-        setInitialLoading(false);
-        return;
-      }
-      if (!isTokenExpiredOrNearExpiry(stored.tokens.accessTokenExpiresAt)) {
-        tokensRef.current = stored.tokens;
-        let userToSet = convertToUser(stored.user);
-        if (defineRolesFor) {
-          const customRoles = await defineRolesFor(userToSet);
-          if (customRoles) {
-            userToSet = {
-              ...userToSet,
-              roles: customRoles
-            };
-          }
-        }
-        setUser(userToSet);
-        scheduleTokenRefresh(stored.tokens);
-        setInitialLoading(false);
-        return;
-      }
-      tokensRef.current = stored.tokens;
-      try {
-        const newTokens = await refreshAccessToken$1();
-        if (!newTokens) {
-          clearAuthFromStorage();
-          tokensRef.current = null;
-          setInitialLoading(false);
-          return;
-        }
-        if (!isMountedRef.current) return;
-        let userToSet;
-        try {
-          const meResponse = await getCurrentUser(newTokens.accessToken);
-          if (!isMountedRef.current) return;
-          const freshUserInfo = meResponse.user;
-          saveAuthToStorage(newTokens, freshUserInfo);
-          userToSet = convertToUser(freshUserInfo);
-          if (defineRolesFor) {
-            const customRoles = await defineRolesFor(userToSet);
-            if (!isMountedRef.current) return;
-            if (customRoles) {
-              userToSet = {
-                ...userToSet,
-                roles: customRoles
-              };
-            }
-          }
-        } catch (meError) {
-          if (!isMountedRef.current) return;
-          if (meError instanceof AuthApiError && (meError.code === "NOT_FOUND" || meError.code === "UNAUTHORIZED")) {
-            clearSessionAndSignOut();
-            return;
-          }
-          userToSet = convertToUser(stored.user);
-        }
-        if (!isMountedRef.current) return;
-        setUser(userToSet);
-        scheduleTokenRefresh(newTokens);
-      } catch (error) {
-        if (!isMountedRef.current) return;
-        if (!(error instanceof Error && error.code === "NETWORK_ERROR")) {
-          clearAuthFromStorage();
-          tokensRef.current = null;
-        }
-      } finally {
-        if (isMountedRef.current) {
-          setInitialLoading(false);
-        }
-      }
-    };
-    restoreAuth();
-    return () => {
-      isMountedRef.current = false;
-    };
-  }, [scheduleTokenRefresh, defineRolesFor, refreshAccessToken$1]);
-  useEffect(() => {
-    const handleVisibilityChange = async () => {
-      if (initialLoading) return;
-      if (document.visibilityState === "visible" && tokensRef.current) {
-        if (isTokenExpiredOrNearExpiry(tokensRef.current.accessTokenExpiresAt)) {
-          try {
-            const newTokens = await refreshAccessToken$1();
-            if (newTokens && isMountedRef.current) {
-              scheduleTokenRefresh(newTokens);
-            } else if (!newTokens && isMountedRef.current) {
-              clearSessionAndSignOut();
-            }
-          } catch (e) {
-          }
-        }
-      }
-    };
-    document.addEventListener("visibilitychange", handleVisibilityChange);
-    return () => {
-      document.removeEventListener("visibilitychange", handleVisibilityChange);
-    };
-  }, [initialLoading, refreshAccessToken$1, scheduleTokenRefresh, clearSessionAndSignOut]);
-  const getApiUrl$1 = useCallback(() => {
-    return getApiUrl();
-  }, []);
-  useEffect(() => {
-    return () => {
-      isMountedRef.current = false;
-      if (refreshTimeoutRef.current) {
-        clearTimeout(refreshTimeoutRef.current);
-      }
-    };
-  }, []);
-  const revokeAllSessions$1 = useCallback(async () => {
-    try {
-      if (!tokensRef.current) {
-        throw new Error("User is not logged in");
-      }
-      await revokeAllSessions(tokensRef.current.accessToken);
-      clearSessionAndSignOut();
-    } catch (error) {
-      setAuthProviderError(error);
-      throw error;
-    }
-  }, [clearSessionAndSignOut]);
-  return {
-    user,
-    authLoading,
-    initialLoading,
-    authError,
-    authProviderError,
-    loginSkipped,
-    needsSetup: authConfig?.needsSetup ?? false,
-    registrationEnabled: authConfig?.registrationEnabled ?? false,
-    getAuthToken,
-    getApiUrl: getApiUrl$1,
-    signOut,
-    emailPasswordLogin,
-    register: register$1,
-    googleLogin: googleLogin$1,
-    oauthLogin: oauthLogin$1,
-    skipLogin,
-    forgotPassword: forgotPassword$1,
-    resetPassword: resetPassword$1,
-    changePassword: changePassword$1,
-    updateProfile: updateProfile$1,
-    fetchSessions: fetchSessions$1,
-    revokeSession: revokeSession$1,
-    revokeAllSessions: revokeAllSessions$1,
-    clearError,
-    setAuthProviderError,
-    extra,
-    setExtra,
-    capabilities: {
-      emailPasswordLogin: true,
-      googleLogin: !!props.googleClientId,
-      registration: authConfig?.registrationEnabled ?? false,
-      passwordReset: authConfig?.passwordReset ?? false,
-      sessionManagement: true,
-      profileUpdate: true,
-      emailVerification: authConfig?.emailVerification ?? false,
-      enabledProviders: authConfig?.enabledProviders ?? []
-    }
-  };
-}
-function convertUser(apiUser) {
-  return {
-    uid: apiUser.uid,
-    email: apiUser.email,
-    displayName: apiUser.displayName || null,
-    photoURL: apiUser.photoURL || null,
-    providerId: "custom",
-    isAnonymous: false,
-    roles: apiUser.roles,
-    createdAt: apiUser.createdAt ? new Date(apiUser.createdAt) : null
-  };
+	const { client, apiUrl, onSignOut, defineRolesFor } = props;
+	const [user, setUser] = useState(null);
+	const [authLoading, setAuthLoading] = useState(false);
+	const [initialLoading, setInitialLoading] = useState(true);
+	const [authError, setAuthError] = useState(null);
+	const [authProviderError, setAuthProviderError] = useState(null);
+	const [loginSkipped, setLoginSkipped] = useState(false);
+	const [extra, setExtra] = useState(null);
+	const [authConfig, setAuthConfig] = useState(null);
+	const tokensRef = useRef(null);
+	const refreshTimeoutRef = useRef(null);
+	const refreshPromiseRef = useRef(null);
+	const isMountedRef = useRef(true);
+	useEffect(() => {
+		const url = client?.baseUrl || apiUrl;
+		if (url) setApiUrl(url);
+	}, [
+		client,
+		client?.baseUrl,
+		apiUrl
+	]);
+	const clearError = useCallback(() => {
+		setAuthProviderError(null);
+	}, []);
+	const clearSessionAndSignOut = useCallback(() => {
+		tokensRef.current = null;
+		clearAuthFromStorage();
+		if (refreshTimeoutRef.current) {
+			clearTimeout(refreshTimeoutRef.current);
+			refreshTimeoutRef.current = null;
+		}
+		setUser(null);
+		setLoginSkipped(false);
+		onSignOut?.();
+	}, [onSignOut]);
+	/**
+	* Refresh the access token using the stored refresh token.
+	* Returns the new tokens or null if refresh failed.
+	*/
+	const refreshAccessToken$1 = useCallback(async () => {
+		if (refreshPromiseRef.current) return refreshPromiseRef.current;
+		const executeRefresh = async () => {
+			const storedData = loadAuthFromStorage();
+			if (storedData?.tokens?.accessTokenExpiresAt) {
+				const storedTokens = storedData.tokens;
+				if (!isTokenExpiredOrNearExpiry(storedTokens.accessTokenExpiresAt) && storedTokens.accessToken !== tokensRef.current?.accessToken) {
+					tokensRef.current = storedTokens;
+					return storedTokens;
+				}
+			}
+			const currentTokens = tokensRef.current;
+			if (!currentTokens?.refreshToken) return null;
+			try {
+				const newTokens = (await refreshAccessToken(currentTokens.refreshToken)).tokens;
+				tokensRef.current = newTokens;
+				const latestStoredData = loadAuthFromStorage();
+				if (latestStoredData) saveAuthToStorage(newTokens, latestStoredData.user);
+				return newTokens;
+			} catch (error) {
+				if (error instanceof Error && error.code === "NETWORK_ERROR") throw error;
+				return null;
+			} finally {
+				refreshPromiseRef.current = null;
+			}
+		};
+		refreshPromiseRef.current = executeRefresh();
+		return refreshPromiseRef.current;
+	}, []);
+	const scheduleTokenRefresh = useCallback((tokens) => {
+		if (refreshTimeoutRef.current) clearTimeout(refreshTimeoutRef.current);
+		const timeUntilRefresh = tokens.accessTokenExpiresAt - TOKEN_REFRESH_BUFFER_MS - Date.now();
+		if (timeUntilRefresh <= 0) {
+			refreshAccessToken$1().then((newTokens) => {
+				if (newTokens && isMountedRef.current) scheduleTokenRefresh(newTokens);
+				else if (!newTokens && isMountedRef.current) clearSessionAndSignOut();
+			});
+			return;
+		}
+		refreshTimeoutRef.current = setTimeout(async () => {
+			if (!isMountedRef.current) return;
+			try {
+				const newTokens = await refreshAccessToken$1();
+				if (newTokens && isMountedRef.current) scheduleTokenRefresh(newTokens);
+				else if (!newTokens && isMountedRef.current) clearSessionAndSignOut();
+			} catch (error) {
+				if (isMountedRef.current) refreshTimeoutRef.current = setTimeout(() => {
+					scheduleTokenRefresh(tokens);
+				}, 1e4);
+			}
+		}, timeUntilRefresh);
+	}, [refreshAccessToken$1, clearSessionAndSignOut]);
+	const getAuthToken = useCallback(async () => {
+		if (initialLoading) throw new Error("Auth is still loading");
+		const currentTokens = tokensRef.current;
+		if (!currentTokens) throw new Error("User is not logged in");
+		if (isTokenExpiredOrNearExpiry(currentTokens.accessTokenExpiresAt)) try {
+			const newTokens = await refreshAccessToken$1();
+			if (!newTokens) {
+				clearSessionAndSignOut();
+				throw new Error("Session expired. Please login again.");
+			}
+			return newTokens.accessToken;
+		} catch (error) {
+			if (error instanceof Error && error.code === "NETWORK_ERROR") throw error;
+			clearSessionAndSignOut();
+			throw error;
+		}
+		return currentTokens.accessToken;
+	}, [
+		initialLoading,
+		refreshAccessToken$1,
+		clearSessionAndSignOut
+	]);
+	useEffect(() => {
+		if (client) {
+			client.setAuthTokenGetter?.(async () => {
+				try {
+					return await getAuthToken();
+				} catch {
+					return null;
+				}
+			});
+			if (client.setOnUnauthorized) client.setOnUnauthorized(async () => {
+				try {
+					if (await refreshAccessToken$1()) return true;
+					clearSessionAndSignOut();
+					return false;
+				} catch (e) {
+					clearSessionAndSignOut();
+					return false;
+				}
+			});
+			if (client.ws) client.ws.setAuthTokenGetter(async () => {
+				try {
+					return await getAuthToken();
+				} catch {
+					return null;
+				}
+			});
+		}
+	}, [
+		client,
+		getAuthToken,
+		refreshAccessToken$1,
+		clearSessionAndSignOut
+	]);
+	const handleAuthSuccess = useCallback(async (userInfo, tokens) => {
+		tokensRef.current = tokens;
+		let convertedUser = convertToUser(userInfo);
+		if (defineRolesFor) {
+			const customRoles = await defineRolesFor(convertedUser);
+			if (customRoles) convertedUser = {
+				...convertedUser,
+				roles: customRoles
+			};
+		}
+		saveAuthToStorage(tokens, userInfo);
+		setUser(convertedUser);
+		setAuthError(null);
+		setAuthProviderError(null);
+		setLoginSkipped(false);
+		scheduleTokenRefresh(tokens);
+	}, [scheduleTokenRefresh, defineRolesFor]);
+	const emailPasswordLogin = useCallback(async (email, password) => {
+		setAuthLoading(true);
+		setAuthProviderError(null);
+		try {
+			const response = await login(email, password);
+			await handleAuthSuccess(response.user, response.tokens);
+		} catch (error) {
+			setAuthProviderError(error);
+			throw error;
+		} finally {
+			setAuthLoading(false);
+		}
+	}, [handleAuthSuccess]);
+	const register$1 = useCallback(async (email, password, displayName) => {
+		setAuthLoading(true);
+		setAuthProviderError(null);
+		try {
+			const response = await register(email, password, displayName);
+			await handleAuthSuccess(response.user, response.tokens);
+		} catch (error) {
+			setAuthProviderError(error);
+			throw error;
+		} finally {
+			setAuthLoading(false);
+		}
+	}, [handleAuthSuccess]);
+	const googleLogin$1 = useCallback(async (payload) => {
+		setAuthLoading(true);
+		setAuthProviderError(null);
+		try {
+			const response = await googleLogin(payload);
+			await handleAuthSuccess(response.user, response.tokens);
+		} catch (error) {
+			setAuthProviderError(error);
+			throw error;
+		} finally {
+			setAuthLoading(false);
+		}
+	}, [handleAuthSuccess]);
+	const oauthLogin$1 = useCallback(async (providerId, payload) => {
+		setAuthLoading(true);
+		setAuthProviderError(null);
+		try {
+			const response = await oauthLogin(providerId, payload);
+			await handleAuthSuccess(response.user, response.tokens);
+		} catch (error) {
+			setAuthProviderError(error);
+			throw error;
+		} finally {
+			setAuthLoading(false);
+		}
+	}, [handleAuthSuccess]);
+	const signOut = useCallback(async () => {
+		try {
+			if (tokensRef.current) await logout(tokensRef.current.refreshToken);
+		} catch (error) {
+			console.error("Logout error:", error);
+		} finally {
+			clearSessionAndSignOut();
+		}
+	}, [clearSessionAndSignOut]);
+	const skipLogin = useCallback(() => {
+		setLoginSkipped(true);
+		setUser(null);
+	}, []);
+	const forgotPassword$1 = useCallback(async (email) => {
+		setAuthLoading(true);
+		setAuthProviderError(null);
+		try {
+			await forgotPassword(email);
+		} catch (error) {
+			setAuthProviderError(error);
+			throw error;
+		} finally {
+			setAuthLoading(false);
+		}
+	}, []);
+	const resetPassword$1 = useCallback(async (token, password) => {
+		setAuthLoading(true);
+		setAuthProviderError(null);
+		try {
+			await resetPassword(token, password);
+		} catch (error) {
+			setAuthProviderError(error);
+			throw error;
+		} finally {
+			setAuthLoading(false);
+		}
+	}, []);
+	const changePassword$1 = useCallback(async (oldPassword, newPassword) => {
+		setAuthLoading(true);
+		setAuthProviderError(null);
+		try {
+			if (!tokensRef.current) throw new Error("User is not logged in");
+			await changePassword(tokensRef.current.accessToken, oldPassword, newPassword);
+			clearSessionAndSignOut();
+		} catch (error) {
+			setAuthProviderError(error);
+			throw error;
+		} finally {
+			setAuthLoading(false);
+		}
+	}, [clearSessionAndSignOut]);
+	const updateProfile$1 = useCallback(async (displayName, photoURL) => {
+		setAuthLoading(true);
+		setAuthProviderError(null);
+		try {
+			if (!tokensRef.current) throw new Error("User is not logged in");
+			const response = await updateProfile(tokensRef.current.accessToken, displayName, photoURL);
+			let convertedUser = convertToUser(response.user);
+			if (defineRolesFor) {
+				const customRoles = await defineRolesFor(convertedUser);
+				if (customRoles) convertedUser = {
+					...convertedUser,
+					roles: customRoles
+				};
+			}
+			const storedData = loadAuthFromStorage();
+			if (storedData) saveAuthToStorage(storedData.tokens, response.user);
+			setUser(convertedUser);
+			return convertedUser;
+		} catch (error) {
+			setAuthProviderError(error);
+			throw error;
+		} finally {
+			setAuthLoading(false);
+		}
+	}, [defineRolesFor]);
+	const fetchSessions$1 = useCallback(async () => {
+		try {
+			if (!tokensRef.current) throw new Error("User is not logged in");
+			return (await fetchSessions(tokensRef.current.accessToken, tokensRef.current.refreshToken)).sessions;
+		} catch (error) {
+			setAuthProviderError(error);
+			throw error;
+		}
+	}, []);
+	const revokeSession$1 = useCallback(async (sessionId) => {
+		try {
+			if (!tokensRef.current) throw new Error("User is not logged in");
+			await revokeSession(tokensRef.current.accessToken, sessionId);
+		} catch (error) {
+			setAuthProviderError(error);
+			throw error;
+		}
+	}, []);
+	useEffect(() => {
+		isMountedRef.current = true;
+		const restoreAuth = async () => {
+			try {
+				const config = await fetchAuthConfig();
+				if (isMountedRef.current) setAuthConfig(config);
+			} catch (e) {}
+			const stored = loadAuthFromStorage();
+			if (!stored) {
+				setInitialLoading(false);
+				return;
+			}
+			if (!stored.tokens?.refreshToken) {
+				clearAuthFromStorage();
+				setInitialLoading(false);
+				return;
+			}
+			const expiresAt = stored.tokens.accessTokenExpiresAt;
+			if (typeof expiresAt !== "number" || !Number.isFinite(expiresAt)) {
+				clearAuthFromStorage();
+				setInitialLoading(false);
+				return;
+			}
+			if (!isTokenExpiredOrNearExpiry(stored.tokens.accessTokenExpiresAt)) {
+				tokensRef.current = stored.tokens;
+				let userToSet = convertToUser(stored.user);
+				if (defineRolesFor) {
+					const customRoles = await defineRolesFor(userToSet);
+					if (customRoles) userToSet = {
+						...userToSet,
+						roles: customRoles
+					};
+				}
+				setUser(userToSet);
+				scheduleTokenRefresh(stored.tokens);
+				setInitialLoading(false);
+				return;
+			}
+			tokensRef.current = stored.tokens;
+			try {
+				const newTokens = await refreshAccessToken$1();
+				if (!newTokens) {
+					clearAuthFromStorage();
+					tokensRef.current = null;
+					setInitialLoading(false);
+					return;
+				}
+				if (!isMountedRef.current) return;
+				let userToSet;
+				try {
+					const meResponse = await getCurrentUser(newTokens.accessToken);
+					if (!isMountedRef.current) return;
+					const freshUserInfo = meResponse.user;
+					saveAuthToStorage(newTokens, freshUserInfo);
+					userToSet = convertToUser(freshUserInfo);
+					if (defineRolesFor) {
+						const customRoles = await defineRolesFor(userToSet);
+						if (!isMountedRef.current) return;
+						if (customRoles) userToSet = {
+							...userToSet,
+							roles: customRoles
+						};
+					}
+				} catch (meError) {
+					if (!isMountedRef.current) return;
+					if (meError instanceof AuthApiError && (meError.code === "NOT_FOUND" || meError.code === "UNAUTHORIZED")) {
+						clearSessionAndSignOut();
+						return;
+					}
+					userToSet = convertToUser(stored.user);
+				}
+				if (!isMountedRef.current) return;
+				setUser(userToSet);
+				scheduleTokenRefresh(newTokens);
+			} catch (error) {
+				if (!isMountedRef.current) return;
+				if (!(error instanceof Error && error.code === "NETWORK_ERROR")) {
+					clearAuthFromStorage();
+					tokensRef.current = null;
+				}
+			} finally {
+				if (isMountedRef.current) setInitialLoading(false);
+			}
+		};
+		restoreAuth();
+		return () => {
+			isMountedRef.current = false;
+		};
+	}, [
+		scheduleTokenRefresh,
+		defineRolesFor,
+		refreshAccessToken$1
+	]);
+	useEffect(() => {
+		const handleVisibilityChange = async () => {
+			if (initialLoading) return;
+			if (document.visibilityState === "visible" && tokensRef.current) {
+				if (isTokenExpiredOrNearExpiry(tokensRef.current.accessTokenExpiresAt)) try {
+					const newTokens = await refreshAccessToken$1();
+					if (newTokens && isMountedRef.current) scheduleTokenRefresh(newTokens);
+					else if (!newTokens && isMountedRef.current) clearSessionAndSignOut();
+				} catch (e) {}
+			}
+		};
+		document.addEventListener("visibilitychange", handleVisibilityChange);
+		return () => {
+			document.removeEventListener("visibilitychange", handleVisibilityChange);
+		};
+	}, [
+		initialLoading,
+		refreshAccessToken$1,
+		scheduleTokenRefresh,
+		clearSessionAndSignOut
+	]);
+	const getApiUrl$1 = useCallback(() => {
+		return getApiUrl();
+	}, []);
+	useEffect(() => {
+		return () => {
+			isMountedRef.current = false;
+			if (refreshTimeoutRef.current) clearTimeout(refreshTimeoutRef.current);
+		};
+	}, []);
+	const revokeAllSessions$1 = useCallback(async () => {
+		try {
+			if (!tokensRef.current) throw new Error("User is not logged in");
+			await revokeAllSessions(tokensRef.current.accessToken);
+			clearSessionAndSignOut();
+		} catch (error) {
+			setAuthProviderError(error);
+			throw error;
+		}
+	}, [clearSessionAndSignOut]);
+	return {
+		user,
+		authLoading,
+		initialLoading,
+		authError,
+		authProviderError,
+		loginSkipped,
+		needsSetup: authConfig?.needsSetup ?? false,
+		registrationEnabled: authConfig?.registrationEnabled ?? false,
+		getAuthToken,
+		getApiUrl: getApiUrl$1,
+		signOut,
+		emailPasswordLogin,
+		register: register$1,
+		googleLogin: googleLogin$1,
+		oauthLogin: oauthLogin$1,
+		skipLogin,
+		forgotPassword: forgotPassword$1,
+		resetPassword: resetPassword$1,
+		changePassword: changePassword$1,
+		updateProfile: updateProfile$1,
+		fetchSessions: fetchSessions$1,
+		revokeSession: revokeSession$1,
+		revokeAllSessions: revokeAllSessions$1,
+		clearError,
+		setAuthProviderError,
+		extra,
+		setExtra,
+		capabilities: {
+			emailPasswordLogin: true,
+			googleLogin: !!props.googleClientId,
+			registration: authConfig?.registrationEnabled ?? false,
+			passwordReset: authConfig?.passwordReset ?? false,
+			sessionManagement: true,
+			profileUpdate: true,
+			emailVerification: authConfig?.emailVerification ?? false,
+			enabledProviders: authConfig?.enabledProviders ?? []
+		}
+	};
 }
-function useBackendUserManagement(config) {
-  const { client, apiUrl, getAuthToken, currentUser } = config;
-  const [userCache, setUserCache] = useState(/* @__PURE__ */ new Map());
-  const [hasAdminUsers, setHasAdminUsers] = useState(false);
-  const userRoles = currentUser?.roles ?? [];
-  const isUserAdmin = userRoles.some((r) => r === "admin" || r === "schema-admin");
-  const [loading, setLoading] = useState(() => {
-    if (!currentUser) return false;
-    if (!isUserAdmin) return false;
-    return true;
-  });
-  const [usersError, setUsersError] = useState();
-  const lastLoadedUidRef = useRef(null);
-  const effectiveLoading = loading || !!(currentUser && isUserAdmin && lastLoadedUidRef.current !== currentUser.uid);
-  const mergeIntoCache = useCallback((incoming) => {
-    setUserCache((prev) => {
-      const next = new Map(prev);
-      for (const u of incoming) {
-        next.set(u.uid, u);
-      }
-      return next;
-    });
-  }, []);
-  const apiRequestRef = useRef(null);
-  const apiRequest = useCallback(async (endpoint, method = "GET", body, retryCount = 6, signal) => {
-    let lastError = null;
-    for (let attempt = 0; attempt < retryCount; attempt++) {
-      if (signal?.aborted) {
-        const error = new Error("Request aborted");
-        error.name = "AbortError";
-        throw error;
-      }
-      try {
-        const token = getAuthToken ? await getAuthToken() : client?.resolveToken ? await client.resolveToken() : null;
-        const baseUrl = apiUrl || (client?.baseUrl ? client.baseUrl : "");
-        const response = await fetch(`${baseUrl}/api/admin${endpoint}`, {
-          method,
-          headers: {
-            "Content-Type": "application/json",
-            ...token ? { "Authorization": `Bearer ${token}` } : {}
-          },
-          body: body ? JSON.stringify(body) : void 0,
-          signal
-        });
-        if (!response.ok) {
-          const errorText = await response.text();
-          let errorMessage = "API request failed";
-          try {
-            const errorJson = JSON.parse(errorText);
-            errorMessage = errorJson.error?.message || errorMessage;
-          } catch (e) {
-            errorMessage = errorText || `HTTP error ${response.status}`;
-          }
-          const error = Object.assign(new Error(errorMessage), { status: response.status });
-          throw error;
-        }
-        return await response.json();
-      } catch (error) {
-        if (error instanceof Error && error.name === "AbortError" || signal?.aborted) {
-          throw error;
-        }
-        lastError = error instanceof Error ? error : new Error(String(error));
-        const isNetworkError = error instanceof TypeError;
-        const isServerError = typeof error.status === "number" && error.status >= 500 && error.status < 600;
-        if (attempt < retryCount - 1 && (isNetworkError || isServerError)) {
-          const delay = Math.min(1e3 * Math.pow(2, attempt), 5e3);
-          console.warn(`Admin API request to ${endpoint} failed, retrying in ${delay}ms...`);
-          await new Promise((resolve, reject) => {
-            if (signal?.aborted) return reject(new Error("AbortError"));
-            const timer = setTimeout(resolve, delay);
-            if (signal) {
-              signal.addEventListener("abort", () => {
-                clearTimeout(timer);
-                reject(new Error("AbortError"));
-              }, { once: true });
-            }
-          }).catch(() => {
-          });
-          if (signal?.aborted) {
-            const abortError = new Error("Request aborted");
-            abortError.name = "AbortError";
-            throw abortError;
-          }
-          continue;
-        }
-        console.error("Admin API error after retries:", error);
-        throw error;
-      }
-    }
-    throw lastError;
-  }, [apiUrl, getAuthToken]);
-  apiRequestRef.current = apiRequest;
-  const checkAdminExists = useCallback(async (signal) => {
-    try {
-      const data = await apiRequest("/users?role=admin&limit=1", "GET", void 0, 6, signal);
-      const adminUsers = data.users.map((u) => convertUser(u));
-      setHasAdminUsers(adminUsers.length > 0);
-      if (adminUsers.length > 0) {
-        mergeIntoCache(adminUsers);
-      }
-      setUsersError(void 0);
-    } catch (error) {
-      if (error instanceof Error && error.name === "AbortError") return;
-      console.error("Failed to check admin users:", error);
-      setUsersError(error instanceof Error ? error : new Error(String(error)));
-    }
-  }, [apiRequest, mergeIntoCache]);
-  useEffect(() => {
-    if (!currentUser) {
-      setLoading(false);
-      return;
-    }
-    const userRoles2 = currentUser.roles ?? [];
-    const isUserAdmin2 = userRoles2.some((r) => r === "admin" || r === "schema-admin");
-    if (!isUserAdmin2) {
-      setLoading(false);
-      return;
-    }
-    if (lastLoadedUidRef.current === currentUser.uid) {
-      setLoading(false);
-      return;
-    }
-    const abortController = new AbortController();
-    const load = async () => {
-      setLoading(true);
-      const request = apiRequestRef.current;
-      if (!abortController.signal.aborted) {
-        try {
-          const data = await request("/users?role=admin&limit=1", "GET", void 0, 6, abortController.signal);
-          const adminUsers = data.users.map((u) => convertUser(u));
-          setHasAdminUsers(adminUsers.length > 0);
-          if (adminUsers.length > 0) {
-            mergeIntoCache(adminUsers);
-          }
-          setUsersError(void 0);
-        } catch (error) {
-          if (error instanceof Error && error.name === "AbortError") return;
-          console.error("Failed to check admin users:", error);
-          setUsersError(error instanceof Error ? error : new Error(String(error)));
-        }
-      }
-      if (!abortController.signal.aborted) {
-        lastLoadedUidRef.current = currentUser.uid;
-        setLoading(false);
-      }
-    };
-    load();
-    return () => {
-      abortController.abort();
-    };
-  }, [currentUser?.uid]);
-  const searchUsers = useCallback(async (options) => {
-    const params = new URLSearchParams();
-    if (options.limit !== void 0) params.set("limit", String(options.limit));
-    if (options.offset !== void 0) params.set("offset", String(options.offset));
-    if (options.search) params.set("search", options.search);
-    if (options.orderBy) params.set("orderBy", options.orderBy);
-    if (options.orderDir) params.set("orderDir", options.orderDir);
-    if (options.roleId) params.set("role", options.roleId);
-    const qs = params.toString();
-    const data = await apiRequest("/users" + (qs ? "?" + qs : ""), "GET");
-    const converted = data.users.map((u) => convertUser(u));
-    mergeIntoCache(converted);
-    return {
-      users: converted,
-      total: data.total
-    };
-  }, [apiRequest, mergeIntoCache]);
-  const saveUser = useCallback(async (user) => {
-    const roleIds = user.roles ?? [];
-    const data = await apiRequest(`/users/${user.uid}`, "PUT", {
-      email: user.email,
-      displayName: user.displayName,
-      roles: roleIds
-    });
-    const updated = convertUser(data.user);
-    mergeIntoCache([updated]);
-    return updated;
-  }, [apiRequest, mergeIntoCache]);
-  const createUser = useCallback(async (user) => {
-    const roleIds = user.roles ?? [];
-    const data = await apiRequest("/users", "POST", {
-      email: user.email,
-      displayName: user.displayName,
-      roles: roleIds
-    });
-    const created = convertUser(data.user);
-    mergeIntoCache([created]);
-    return {
-      user: created,
-      invitationSent: data.invitationSent ?? false,
-      temporaryPassword: data.temporaryPassword
-    };
-  }, [apiRequest, mergeIntoCache]);
-  const resetPassword2 = useCallback(async (user) => {
-    const data = await apiRequest(`/users/${user.uid}/reset-password`, "POST");
-    const updatedUser = convertUser(data.user);
-    mergeIntoCache([updatedUser]);
-    return {
-      user: updatedUser,
-      invitationSent: data.invitationSent ?? false,
-      temporaryPassword: data.temporaryPassword
-    };
-  }, [apiRequest, mergeIntoCache]);
-  const deleteUser = useCallback(async (user) => {
-    await apiRequest(`/users/${user.uid}`, "DELETE");
-    setUserCache((prev) => {
-      const next = new Map(prev);
-      next.delete(user.uid);
-      return next;
-    });
-  }, [apiRequest]);
-  const getUser = useCallback((uid) => {
-    return userCache.get(uid) ?? null;
-  }, [userCache]);
-  const defineRolesFor = useCallback(async (user) => {
-    let existingUser = userCache.get(user.uid) ?? Array.from(userCache.values()).find((u) => u.email === user.email);
-    if (!existingUser) {
-      try {
-        const data = await apiRequest(`/users/${user.uid}`, "GET");
-        existingUser = convertUser(data.user);
-        mergeIntoCache([existingUser]);
-      } catch {
-        return void 0;
-      }
-    }
-    const userRoleIds = existingUser.roles ?? [];
-    return userRoleIds;
-  }, [userCache, apiRequest, mergeIntoCache]);
-  const isAdmin = currentUser?.roles?.includes("admin") ?? false;
-  const bootstrapAdmin = useCallback(async () => {
-    try {
-      await apiRequest("/bootstrap", "POST");
-      await checkAdminExists();
-    } catch (error) {
-      console.error("Failed to bootstrap admin:", error);
-      throw error;
-    }
-  }, [apiRequest, checkAdminExists]);
-  const users = Array.from(userCache.values());
-  return {
-    loading: effectiveLoading,
-    users,
-    hasAdminUsers,
-    saveUser,
-    createUser,
-    resetPassword: resetPassword2,
-    deleteUser,
-    isAdmin,
-    allowDefaultRolesCreation: isAdmin,
-    defineRolesFor,
-    getUser,
-    searchUsers,
-    usersError,
-    bootstrapAdmin
-  };
-}
-export {
-  AuthApiError,
-  fetchAuthConfig,
-  getApiUrl,
-  setApiUrl,
-  useBackendUserManagement,
-  useRebaseAuthController
-};
-//# sourceMappingURL=index.es.js.map
+//#endregion
+export { AuthApiError, fetchAuthConfig, getApiUrl, setApiUrl, useRebaseAuthController };
+
+//# sourceMappingURL=index.es.js.map