@rebasepro/auth 0.4.0 → 0.6.0

package/dist/index.umd.js

@@ -1,1062 +1,823 @@
 (function(global, factory) {
-  typeof exports === "object" && typeof module !== "undefined" ? factory(exports, require("react")) : typeof define === "function" && define.amd ? define(["exports", "react"], factory) : (global = typeof globalThis !== "undefined" ? globalThis : global || self, factory(global["Rebase Auth"] = {}, global.react));
-})(this, (function(exports2, react) {
-  "use strict";
-  let baseApiUrl = "";
-  function setApiUrl(url) {
-    baseApiUrl = url;
-  }
-  function getApiUrl() {
-    return baseApiUrl;
-  }
-  class AuthApiError extends Error {
-    code;
-    constructor(message, code) {
-      super(message);
-      this.code = code;
-      this.name = "AuthApiError";
-    }
-  }
-  async function handleResponse(response) {
-    let data;
-    try {
-      data = await response.json();
-    } catch (parseError) {
-      throw new AuthApiError(
-        `Server returned non-JSON response (status: ${response.status})`,
-        "PARSE_ERROR"
-      );
-    }
-    if (!response.ok) {
-      throw new AuthApiError(
-        data.error?.message || "Request failed",
-        data.error?.code || "UNKNOWN_ERROR"
-      );
-    }
-    return data;
-  }
-  async function fetchWithHandling(input, init) {
-    try {
-      return await fetch(input, init);
-    } catch (error) {
-      if (error instanceof TypeError && error.message.includes("Failed to fetch")) {
-        throw new AuthApiError(
-          "Failed to connect to the backend server. The backend might be down or failed to initialize (e.g., database connection timeout).",
-          "NETWORK_ERROR"
-        );
-      }
-      throw new AuthApiError("Network error: " + (error instanceof Error ? error.message : String(error)), "NETWORK_ERROR");
-    }
-  }
-  async function register(email, password, displayName) {
-    const response = await fetchWithHandling(`${baseApiUrl}/api/auth/register`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        email,
-        password,
-        displayName
-      })
-    });
-    return handleResponse(response);
-  }
-  async function login(email, password) {
-    const response = await fetchWithHandling(`${baseApiUrl}/api/auth/login`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        email,
-        password
-      })
-    });
-    return handleResponse(response);
-  }
-  async function googleLogin(payload) {
-    const response = await fetchWithHandling(`${baseApiUrl}/api/auth/google`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(payload)
-    });
-    return handleResponse(response);
-  }
-  async function oauthLogin(providerId, payload) {
-    const response = await fetchWithHandling(`${baseApiUrl}/api/auth/${providerId}`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(payload)
-    });
-    return handleResponse(response);
-  }
-  async function refreshAccessToken(refreshToken) {
-    const response = await fetchWithHandling(`${baseApiUrl}/api/auth/refresh`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ refreshToken })
-    });
-    return handleResponse(response);
-  }
-  async function logout(refreshToken) {
-    await fetchWithHandling(`${baseApiUrl}/api/auth/logout`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ refreshToken })
-    });
-  }
-  async function getCurrentUser(accessToken) {
-    const response = await fetchWithHandling(`${baseApiUrl}/api/auth/me`, {
-      method: "GET",
-      headers: {
-        "Content-Type": "application/json",
-        "Authorization": `Bearer ${accessToken}`
-      }
-    });
-    return handleResponse(response);
-  }
-  async function forgotPassword(email) {
-    const response = await fetchWithHandling(`${baseApiUrl}/api/auth/forgot-password`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ email })
-    });
-    return handleResponse(response);
-  }
-  async function resetPassword(token, password) {
-    const response = await fetchWithHandling(`${baseApiUrl}/api/auth/reset-password`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        token,
-        password
-      })
-    });
-    return handleResponse(response);
-  }
-  async function changePassword(accessToken, oldPassword, newPassword) {
-    const response = await fetchWithHandling(`${baseApiUrl}/api/auth/change-password`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        "Authorization": `Bearer ${accessToken}`
-      },
-      body: JSON.stringify({
-        oldPassword,
-        newPassword
-      })
-    });
-    return handleResponse(response);
-  }
-  async function updateProfile(accessToken, displayName, photoURL) {
-    const response = await fetchWithHandling(`${baseApiUrl}/api/auth/me`, {
-      method: "PATCH",
-      headers: {
-        "Content-Type": "application/json",
-        "Authorization": `Bearer ${accessToken}`
-      },
-      body: JSON.stringify({
-        displayName,
-        photoURL
-      })
-    });
-    return handleResponse(response);
-  }
-  async function fetchSessions(accessToken, currentRefreshToken) {
-    const headers = {
-      "Content-Type": "application/json",
-      "Authorization": `Bearer ${accessToken}`
-    };
-    if (currentRefreshToken) {
-      headers["X-Refresh-Token"] = currentRefreshToken;
-    }
-    const response = await fetchWithHandling(`${baseApiUrl}/api/auth/sessions`, {
-      method: "GET",
-      headers
-    });
-    return handleResponse(response);
-  }
-  async function revokeSession(accessToken, sessionId) {
-    const response = await fetchWithHandling(`${baseApiUrl}/api/auth/sessions/${sessionId}`, {
-      method: "DELETE",
-      headers: {
-        "Content-Type": "application/json",
-        "Authorization": `Bearer ${accessToken}`
-      }
-    });
-    return handleResponse(response);
-  }
-  async function revokeAllSessions(accessToken) {
-    const response = await fetchWithHandling(`${baseApiUrl}/api/auth/sessions`, {
-      method: "DELETE",
-      headers: {
-        "Content-Type": "application/json",
-        "Authorization": `Bearer ${accessToken}`
-      }
-    });
-    return handleResponse(response);
-  }
-  let authConfigInflight = null;
-  let authConfigCached = null;
-  async function fetchAuthConfig() {
-    if (authConfigCached) {
-      return authConfigCached;
-    }
-    if (authConfigInflight) {
-      return authConfigInflight;
-    }
-    authConfigInflight = (async () => {
-      const response = await fetchWithHandling(`${baseApiUrl}/api/auth/config`, {
-        method: "GET",
-        headers: { "Content-Type": "application/json" }
-      });
-      return handleResponse(response);
-    })();
-    try {
-      const result = await authConfigInflight;
-      authConfigCached = result;
-      return result;
-    } finally {
-      authConfigInflight = null;
-    }
-  }
-  const STORAGE_KEY = "rebase_react_auth";
-  const TOKEN_REFRESH_BUFFER_MS = 2 * 60 * 1e3;
-  function convertToUser(userInfo) {
-    return {
-      uid: userInfo.uid,
-      email: userInfo.email,
-      displayName: userInfo.displayName || null,
-      photoURL: userInfo.photoURL || null,
-      providerId: "custom",
-      isAnonymous: false,
-      roles: userInfo.roles || [],
-      metadata: userInfo.metadata
-    };
-  }
-  function saveAuthToStorage(tokens, user) {
-    try {
-      const data = { tokens, user };
-      localStorage.setItem(STORAGE_KEY, JSON.stringify(data));
-    } catch (e) {
-    }
-  }
-  function loadAuthFromStorage() {
-    try {
-      const data = localStorage.getItem(STORAGE_KEY);
-      if (data) {
-        const parsed = JSON.parse(data);
-        return parsed;
-      }
-    } catch (e) {
-      console.warn("Failed to load auth from storage:", e);
-    }
-    return null;
-  }
-  function clearAuthFromStorage() {
-    try {
-      localStorage.removeItem(STORAGE_KEY);
-    } catch (e) {
-      console.warn("Failed to clear auth from storage:", e);
-    }
-  }
-  function isTokenExpiredOrNearExpiry(expiresAt, bufferMs = TOKEN_REFRESH_BUFFER_MS) {
-    return Date.now() + bufferMs >= expiresAt;
-  }
-  function useRebaseAuthController(props = {}) {
-    const { client, apiUrl, onSignOut, defineRolesFor } = props;
-    const [user, setUser] = react.useState(null);
-    const [authLoading, setAuthLoading] = react.useState(false);
-    const [initialLoading, setInitialLoading] = react.useState(true);
-    const [authError, setAuthError] = react.useState(null);
-    const [authProviderError, setAuthProviderError] = react.useState(null);
-    const [loginSkipped, setLoginSkipped] = react.useState(false);
-    const [extra, setExtra] = react.useState(null);
-    const [authConfig, setAuthConfig] = react.useState(null);
-    const tokensRef = react.useRef(null);
-    const refreshTimeoutRef = react.useRef(null);
-    const refreshPromiseRef = react.useRef(null);
-    const isMountedRef = react.useRef(true);
-    react.useEffect(() => {
-      const url = client?.baseUrl || apiUrl;
-      if (url) {
-        setApiUrl(url);
-      }
-    }, [client, client?.baseUrl, apiUrl]);
-    const clearError = react.useCallback(() => {
-      setAuthProviderError(null);
-    }, []);
-    const clearSessionAndSignOut = react.useCallback(() => {
-      tokensRef.current = null;
-      clearAuthFromStorage();
-      if (refreshTimeoutRef.current) {
-        clearTimeout(refreshTimeoutRef.current);
-        refreshTimeoutRef.current = null;
-      }
-      setUser(null);
-      setLoginSkipped(false);
-      onSignOut?.();
-    }, [onSignOut]);
-    const refreshAccessToken$1 = react.useCallback(async () => {
-      if (refreshPromiseRef.current) {
-        return refreshPromiseRef.current;
-      }
-      const executeRefresh = async () => {
-        const storedData = loadAuthFromStorage();
-        if (storedData?.tokens?.accessTokenExpiresAt) {
-          const storedTokens = storedData.tokens;
-          if (!isTokenExpiredOrNearExpiry(storedTokens.accessTokenExpiresAt) && storedTokens.accessToken !== tokensRef.current?.accessToken) {
-            tokensRef.current = storedTokens;
-            return storedTokens;
-          }
-        }
-        const currentTokens = tokensRef.current;
-        if (!currentTokens?.refreshToken) {
-          return null;
-        }
-        try {
-          const response = await refreshAccessToken(currentTokens.refreshToken);
-          const newTokens = response.tokens;
-          tokensRef.current = newTokens;
-          const latestStoredData = loadAuthFromStorage();
-          if (latestStoredData) {
-            saveAuthToStorage(newTokens, latestStoredData.user);
-          }
-          return newTokens;
-        } catch (error) {
-          if (error instanceof Error && error.code === "NETWORK_ERROR") {
-            throw error;
-          }
-          return null;
-        } finally {
-          refreshPromiseRef.current = null;
-        }
-      };
-      refreshPromiseRef.current = executeRefresh();
-      return refreshPromiseRef.current;
-    }, []);
-    const scheduleTokenRefresh = react.useCallback((tokens) => {
-      if (refreshTimeoutRef.current) {
-        clearTimeout(refreshTimeoutRef.current);
-      }
-      const expiresAt = tokens.accessTokenExpiresAt;
-      const refreshAt = expiresAt - TOKEN_REFRESH_BUFFER_MS;
-      const timeUntilRefresh = refreshAt - Date.now();
-      if (timeUntilRefresh <= 0) {
-        refreshAccessToken$1().then((newTokens) => {
-          if (newTokens && isMountedRef.current) {
-            scheduleTokenRefresh(newTokens);
-          } else if (!newTokens && isMountedRef.current) {
-            clearSessionAndSignOut();
-          }
-        });
-        return;
-      }
-      refreshTimeoutRef.current = setTimeout(async () => {
-        if (!isMountedRef.current) return;
-        try {
-          const newTokens = await refreshAccessToken$1();
-          if (newTokens && isMountedRef.current) {
-            scheduleTokenRefresh(newTokens);
-          } else if (!newTokens && isMountedRef.current) {
-            clearSessionAndSignOut();
-          }
-        } catch (error) {
-          if (isMountedRef.current) {
-            refreshTimeoutRef.current = setTimeout(() => {
-              scheduleTokenRefresh(tokens);
-            }, 1e4);
-          }
-        }
-      }, timeUntilRefresh);
-    }, [refreshAccessToken$1, clearSessionAndSignOut]);
-    const getAuthToken = react.useCallback(async () => {
-      if (initialLoading) {
-        throw new Error("Auth is still loading");
-      }
-      const currentTokens = tokensRef.current;
-      if (!currentTokens) {
-        throw new Error("User is not logged in");
-      }
-      if (isTokenExpiredOrNearExpiry(currentTokens.accessTokenExpiresAt)) {
-        try {
-          const newTokens = await refreshAccessToken$1();
-          if (!newTokens) {
-            clearSessionAndSignOut();
-            throw new Error("Session expired. Please login again.");
-          }
-          return newTokens.accessToken;
-        } catch (error) {
-          if (error instanceof Error && error.code === "NETWORK_ERROR") {
-            throw error;
-          }
-          clearSessionAndSignOut();
-          throw error;
-        }
-      }
-      return currentTokens.accessToken;
-    }, [initialLoading, refreshAccessToken$1, clearSessionAndSignOut]);
-    react.useEffect(() => {
-      if (client) {
-        client.setAuthTokenGetter?.(async () => {
-          try {
-            return await getAuthToken();
-          } catch {
-            return null;
-          }
-        });
-        if (client.setOnUnauthorized) {
-          client.setOnUnauthorized(async () => {
-            try {
-              const newTokens = await refreshAccessToken$1();
-              if (newTokens) return true;
-              clearSessionAndSignOut();
-              return false;
-            } catch (e) {
-              clearSessionAndSignOut();
-              return false;
-            }
-          });
-        }
-        if (client.ws) {
-          client.ws.setAuthTokenGetter(async () => {
-            return await getAuthToken();
-          });
-        }
-      }
-    }, [client, getAuthToken, refreshAccessToken$1, clearSessionAndSignOut]);
-    const handleAuthSuccess = react.useCallback(async (userInfo, tokens) => {
-      tokensRef.current = tokens;
-      let convertedUser = convertToUser(userInfo);
-      if (defineRolesFor) {
-        const customRoles = await defineRolesFor(convertedUser);
-        if (customRoles) {
-          convertedUser = { ...convertedUser, roles: customRoles };
-        }
-      }
-      saveAuthToStorage(tokens, userInfo);
-      setUser(convertedUser);
-      setAuthError(null);
-      setAuthProviderError(null);
-      setLoginSkipped(false);
-      scheduleTokenRefresh(tokens);
-    }, [scheduleTokenRefresh, defineRolesFor]);
-    const emailPasswordLogin = react.useCallback(async (email, password) => {
-      setAuthLoading(true);
-      setAuthProviderError(null);
-      try {
-        const response = await login(email, password);
-        await handleAuthSuccess(response.user, response.tokens);
-      } catch (error) {
-        setAuthProviderError(error);
-        throw error;
-      } finally {
-        setAuthLoading(false);
-      }
-    }, [handleAuthSuccess]);
-    const register$1 = react.useCallback(async (email, password, displayName) => {
-      setAuthLoading(true);
-      setAuthProviderError(null);
-      try {
-        const response = await register(email, password, displayName);
-        await handleAuthSuccess(response.user, response.tokens);
-      } catch (error) {
-        setAuthProviderError(error);
-        throw error;
-      } finally {
-        setAuthLoading(false);
-      }
-    }, [handleAuthSuccess]);
-    const googleLogin$1 = react.useCallback(async (payload) => {
-      setAuthLoading(true);
-      setAuthProviderError(null);
-      try {
-        const response = await googleLogin(payload);
-        await handleAuthSuccess(response.user, response.tokens);
-      } catch (error) {
-        setAuthProviderError(error);
-        throw error;
-      } finally {
-        setAuthLoading(false);
-      }
-    }, [handleAuthSuccess]);
-    const oauthLogin$1 = react.useCallback(async (providerId, payload) => {
-      setAuthLoading(true);
-      setAuthProviderError(null);
-      try {
-        const response = await oauthLogin(providerId, payload);
-        await handleAuthSuccess(response.user, response.tokens);
-      } catch (error) {
-        setAuthProviderError(error);
-        throw error;
-      } finally {
-        setAuthLoading(false);
-      }
-    }, [handleAuthSuccess]);
-    const signOut = react.useCallback(async () => {
-      try {
-        if (tokensRef.current) {
-          await logout(tokensRef.current.refreshToken);
-        }
-      } catch (error) {
-        console.error("Logout error:", error);
-      } finally {
-        clearSessionAndSignOut();
-      }
-    }, [clearSessionAndSignOut]);
-    const skipLogin = react.useCallback(() => {
-      setLoginSkipped(true);
-      setUser(null);
-    }, []);
-    const forgotPassword$1 = react.useCallback(async (email) => {
-      setAuthLoading(true);
-      setAuthProviderError(null);
-      try {
-        await forgotPassword(email);
-      } catch (error) {
-        setAuthProviderError(error);
-        throw error;
-      } finally {
-        setAuthLoading(false);
-      }
-    }, []);
-    const resetPassword$1 = react.useCallback(async (token, password) => {
-      setAuthLoading(true);
-      setAuthProviderError(null);
-      try {
-        await resetPassword(token, password);
-      } catch (error) {
-        setAuthProviderError(error);
-        throw error;
-      } finally {
-        setAuthLoading(false);
-      }
-    }, []);
-    const changePassword$1 = react.useCallback(async (oldPassword, newPassword) => {
-      setAuthLoading(true);
-      setAuthProviderError(null);
-      try {
-        if (!tokensRef.current) {
-          throw new Error("User is not logged in");
-        }
-        await changePassword(tokensRef.current.accessToken, oldPassword, newPassword);
-        clearSessionAndSignOut();
-      } catch (error) {
-        setAuthProviderError(error);
-        throw error;
-      } finally {
-        setAuthLoading(false);
-      }
-    }, [clearSessionAndSignOut]);
-    const updateProfile$1 = react.useCallback(async (displayName, photoURL) => {
-      setAuthLoading(true);
-      setAuthProviderError(null);
-      try {
-        if (!tokensRef.current) {
-          throw new Error("User is not logged in");
-        }
-        const response = await updateProfile(tokensRef.current.accessToken, displayName, photoURL);
-        let convertedUser = convertToUser(response.user);
-        if (defineRolesFor) {
-          const customRoles = await defineRolesFor(convertedUser);
-          if (customRoles) {
-            convertedUser = {
-              ...convertedUser,
-              roles: customRoles
-            };
-          }
-        }
-        const storedData = loadAuthFromStorage();
-        if (storedData) {
-          saveAuthToStorage(storedData.tokens, response.user);
-        }
-        setUser(convertedUser);
-        return convertedUser;
-      } catch (error) {
-        setAuthProviderError(error);
-        throw error;
-      } finally {
-        setAuthLoading(false);
-      }
-    }, [defineRolesFor]);
-    const fetchSessions$1 = react.useCallback(async () => {
-      try {
-        if (!tokensRef.current) {
-          throw new Error("User is not logged in");
-        }
-        const response = await fetchSessions(tokensRef.current.accessToken, tokensRef.current.refreshToken);
-        return response.sessions;
-      } catch (error) {
-        setAuthProviderError(error);
-        throw error;
-      }
-    }, []);
-    const revokeSession$1 = react.useCallback(async (sessionId) => {
-      try {
-        if (!tokensRef.current) {
-          throw new Error("User is not logged in");
-        }
-        await revokeSession(tokensRef.current.accessToken, sessionId);
-      } catch (error) {
-        setAuthProviderError(error);
-        throw error;
-      }
-    }, []);
-    react.useEffect(() => {
-      isMountedRef.current = true;
-      const restoreAuth = async () => {
-        try {
-          const config = await fetchAuthConfig();
-          if (isMountedRef.current) {
-            setAuthConfig(config);
-          }
-        } catch (e) {
-        }
-        const stored = loadAuthFromStorage();
-        if (!stored) {
-          setInitialLoading(false);
-          return;
-        }
-        if (!stored.tokens?.refreshToken) {
-          clearAuthFromStorage();
-          setInitialLoading(false);
-          return;
-        }
-        const expiresAt = stored.tokens.accessTokenExpiresAt;
-        if (typeof expiresAt !== "number" || !Number.isFinite(expiresAt)) {
-          clearAuthFromStorage();
-          setInitialLoading(false);
-          return;
-        }
-        if (!isTokenExpiredOrNearExpiry(stored.tokens.accessTokenExpiresAt)) {
-          tokensRef.current = stored.tokens;
-          let userToSet = convertToUser(stored.user);
-          if (defineRolesFor) {
-            const customRoles = await defineRolesFor(userToSet);
-            if (customRoles) {
-              userToSet = {
-                ...userToSet,
-                roles: customRoles
-              };
-            }
-          }
-          setUser(userToSet);
-          scheduleTokenRefresh(stored.tokens);
-          setInitialLoading(false);
-          return;
-        }
-        tokensRef.current = stored.tokens;
-        try {
-          const newTokens = await refreshAccessToken$1();
-          if (!newTokens) {
-            clearAuthFromStorage();
-            tokensRef.current = null;
-            setInitialLoading(false);
-            return;
-          }
-          if (!isMountedRef.current) return;
-          let userToSet;
-          try {
-            const meResponse = await getCurrentUser(newTokens.accessToken);
-            if (!isMountedRef.current) return;
-            const freshUserInfo = meResponse.user;
-            saveAuthToStorage(newTokens, freshUserInfo);
-            userToSet = convertToUser(freshUserInfo);
-            if (defineRolesFor) {
-              const customRoles = await defineRolesFor(userToSet);
-              if (!isMountedRef.current) return;
-              if (customRoles) {
-                userToSet = {
-                  ...userToSet,
-                  roles: customRoles
-                };
-              }
-            }
-          } catch (meError) {
-            if (!isMountedRef.current) return;
-            if (meError instanceof AuthApiError && (meError.code === "NOT_FOUND" || meError.code === "UNAUTHORIZED")) {
-              clearSessionAndSignOut();
-              return;
-            }
-            userToSet = convertToUser(stored.user);
-          }
-          if (!isMountedRef.current) return;
-          setUser(userToSet);
-          scheduleTokenRefresh(newTokens);
-        } catch (error) {
-          if (!isMountedRef.current) return;
-          if (!(error instanceof Error && error.code === "NETWORK_ERROR")) {
-            clearAuthFromStorage();
-            tokensRef.current = null;
-          }
-        } finally {
-          if (isMountedRef.current) {
-            setInitialLoading(false);
-          }
-        }
-      };
-      restoreAuth();
-      return () => {
-        isMountedRef.current = false;
-      };
-    }, [scheduleTokenRefresh, defineRolesFor, refreshAccessToken$1]);
-    react.useEffect(() => {
-      const handleVisibilityChange = async () => {
-        if (initialLoading) return;
-        if (document.visibilityState === "visible" && tokensRef.current) {
-          if (isTokenExpiredOrNearExpiry(tokensRef.current.accessTokenExpiresAt)) {
-            try {
-              const newTokens = await refreshAccessToken$1();
-              if (newTokens && isMountedRef.current) {
-                scheduleTokenRefresh(newTokens);
-              } else if (!newTokens && isMountedRef.current) {
-                clearSessionAndSignOut();
-              }
-            } catch (e) {
-            }
-          }
-        }
-      };
-      document.addEventListener("visibilitychange", handleVisibilityChange);
-      return () => {
-        document.removeEventListener("visibilitychange", handleVisibilityChange);
-      };
-    }, [initialLoading, refreshAccessToken$1, scheduleTokenRefresh, clearSessionAndSignOut]);
-    const getApiUrl$1 = react.useCallback(() => {
-      return getApiUrl();
-    }, []);
-    react.useEffect(() => {
-      return () => {
-        isMountedRef.current = false;
-        if (refreshTimeoutRef.current) {
-          clearTimeout(refreshTimeoutRef.current);
-        }
-      };
-    }, []);
-    const revokeAllSessions$1 = react.useCallback(async () => {
-      try {
-        if (!tokensRef.current) {
-          throw new Error("User is not logged in");
-        }
-        await revokeAllSessions(tokensRef.current.accessToken);
-        clearSessionAndSignOut();
-      } catch (error) {
-        setAuthProviderError(error);
-        throw error;
-      }
-    }, [clearSessionAndSignOut]);
-    return {
-      user,
-      authLoading,
-      initialLoading,
-      authError,
-      authProviderError,
-      loginSkipped,
-      needsSetup: authConfig?.needsSetup ?? false,
-      registrationEnabled: authConfig?.registrationEnabled ?? false,
-      getAuthToken,
-      getApiUrl: getApiUrl$1,
-      signOut,
-      emailPasswordLogin,
-      register: register$1,
-      googleLogin: googleLogin$1,
-      oauthLogin: oauthLogin$1,
-      skipLogin,
-      forgotPassword: forgotPassword$1,
-      resetPassword: resetPassword$1,
-      changePassword: changePassword$1,
-      updateProfile: updateProfile$1,
-      fetchSessions: fetchSessions$1,
-      revokeSession: revokeSession$1,
-      revokeAllSessions: revokeAllSessions$1,
-      clearError,
-      setAuthProviderError,
-      extra,
-      setExtra,
-      capabilities: {
-        emailPasswordLogin: true,
-        googleLogin: !!props.googleClientId,
-        registration: authConfig?.registrationEnabled ?? false,
-        passwordReset: authConfig?.passwordReset ?? false,
-        sessionManagement: true,
-        profileUpdate: true,
-        emailVerification: authConfig?.emailVerification ?? false,
-        enabledProviders: authConfig?.enabledProviders ?? []
-      }
-    };
-  }
-  function convertUser(apiUser) {
-    return {
-      uid: apiUser.uid,
-      email: apiUser.email,
-      displayName: apiUser.displayName || null,
-      photoURL: apiUser.photoURL || null,
-      providerId: "custom",
-      isAnonymous: false,
-      roles: apiUser.roles,
-      createdAt: apiUser.createdAt ? new Date(apiUser.createdAt) : null
-    };
-  }
-  function useBackendUserManagement(config) {
-    const { client, apiUrl, getAuthToken, currentUser } = config;
-    const [userCache, setUserCache] = react.useState(/* @__PURE__ */ new Map());
-    const [hasAdminUsers, setHasAdminUsers] = react.useState(false);
-    const userRoles = currentUser?.roles ?? [];
-    const isUserAdmin = userRoles.some((r) => r === "admin" || r === "schema-admin");
-    const [loading, setLoading] = react.useState(() => {
-      if (!currentUser) return false;
-      if (!isUserAdmin) return false;
-      return true;
-    });
-    const [usersError, setUsersError] = react.useState();
-    const lastLoadedUidRef = react.useRef(null);
-    const effectiveLoading = loading || !!(currentUser && isUserAdmin && lastLoadedUidRef.current !== currentUser.uid);
-    const mergeIntoCache = react.useCallback((incoming) => {
-      setUserCache((prev) => {
-        const next = new Map(prev);
-        for (const u of incoming) {
-          next.set(u.uid, u);
-        }
-        return next;
-      });
-    }, []);
-    const apiRequestRef = react.useRef(null);
-    const apiRequest = react.useCallback(async (endpoint, method = "GET", body, retryCount = 6, signal) => {
-      let lastError = null;
-      for (let attempt = 0; attempt < retryCount; attempt++) {
-        if (signal?.aborted) {
-          const error = new Error("Request aborted");
-          error.name = "AbortError";
-          throw error;
-        }
-        try {
-          const token = getAuthToken ? await getAuthToken() : client?.resolveToken ? await client.resolveToken() : null;
-          const baseUrl = apiUrl || (client?.baseUrl ? client.baseUrl : "");
-          const response = await fetch(`${baseUrl}/api/admin${endpoint}`, {
-            method,
-            headers: {
-              "Content-Type": "application/json",
-              ...token ? { "Authorization": `Bearer ${token}` } : {}
-            },
-            body: body ? JSON.stringify(body) : void 0,
-            signal
-          });
-          if (!response.ok) {
-            const errorText = await response.text();
-            let errorMessage = "API request failed";
-            try {
-              const errorJson = JSON.parse(errorText);
-              errorMessage = errorJson.error?.message || errorMessage;
-            } catch (e) {
-              errorMessage = errorText || `HTTP error ${response.status}`;
-            }
-            const error = Object.assign(new Error(errorMessage), { status: response.status });
-            throw error;
-          }
-          return await response.json();
-        } catch (error) {
-          if (error instanceof Error && error.name === "AbortError" || signal?.aborted) {
-            throw error;
-          }
-          lastError = error instanceof Error ? error : new Error(String(error));
-          const isNetworkError = error instanceof TypeError;
-          const isServerError = typeof error.status === "number" && error.status >= 500 && error.status < 600;
-          if (attempt < retryCount - 1 && (isNetworkError || isServerError)) {
-            const delay = Math.min(1e3 * Math.pow(2, attempt), 5e3);
-            console.warn(`Admin API request to ${endpoint} failed, retrying in ${delay}ms...`);
-            await new Promise((resolve, reject) => {
-              if (signal?.aborted) return reject(new Error("AbortError"));
-              const timer = setTimeout(resolve, delay);
-              if (signal) {
-                signal.addEventListener("abort", () => {
-                  clearTimeout(timer);
-                  reject(new Error("AbortError"));
-                }, { once: true });
-              }
-            }).catch(() => {
-            });
-            if (signal?.aborted) {
-              const abortError = new Error("Request aborted");
-              abortError.name = "AbortError";
-              throw abortError;
-            }
-            continue;
-          }
-          console.error("Admin API error after retries:", error);
-          throw error;
-        }
-      }
-      throw lastError;
-    }, [apiUrl, getAuthToken]);
-    apiRequestRef.current = apiRequest;
-    const checkAdminExists = react.useCallback(async (signal) => {
-      try {
-        const data = await apiRequest("/users?role=admin&limit=1", "GET", void 0, 6, signal);
-        const adminUsers = data.users.map((u) => convertUser(u));
-        setHasAdminUsers(adminUsers.length > 0);
-        if (adminUsers.length > 0) {
-          mergeIntoCache(adminUsers);
-        }
-        setUsersError(void 0);
-      } catch (error) {
-        if (error instanceof Error && error.name === "AbortError") return;
-        console.error("Failed to check admin users:", error);
-        setUsersError(error instanceof Error ? error : new Error(String(error)));
-      }
-    }, [apiRequest, mergeIntoCache]);
-    react.useEffect(() => {
-      if (!currentUser) {
-        setLoading(false);
-        return;
-      }
-      const userRoles2 = currentUser.roles ?? [];
-      const isUserAdmin2 = userRoles2.some((r) => r === "admin" || r === "schema-admin");
-      if (!isUserAdmin2) {
-        setLoading(false);
-        return;
-      }
-      if (lastLoadedUidRef.current === currentUser.uid) {
-        setLoading(false);
-        return;
-      }
-      const abortController = new AbortController();
-      const load = async () => {
-        setLoading(true);
-        const request = apiRequestRef.current;
-        if (!abortController.signal.aborted) {
-          try {
-            const data = await request("/users?role=admin&limit=1", "GET", void 0, 6, abortController.signal);
-            const adminUsers = data.users.map((u) => convertUser(u));
-            setHasAdminUsers(adminUsers.length > 0);
-            if (adminUsers.length > 0) {
-              mergeIntoCache(adminUsers);
-            }
-            setUsersError(void 0);
-          } catch (error) {
-            if (error instanceof Error && error.name === "AbortError") return;
-            console.error("Failed to check admin users:", error);
-            setUsersError(error instanceof Error ? error : new Error(String(error)));
-          }
-        }
-        if (!abortController.signal.aborted) {
-          lastLoadedUidRef.current = currentUser.uid;
-          setLoading(false);
-        }
-      };
-      load();
-      return () => {
-        abortController.abort();
-      };
-    }, [currentUser?.uid]);
-    const searchUsers = react.useCallback(async (options) => {
-      const params = new URLSearchParams();
-      if (options.limit !== void 0) params.set("limit", String(options.limit));
-      if (options.offset !== void 0) params.set("offset", String(options.offset));
-      if (options.search) params.set("search", options.search);
-      if (options.orderBy) params.set("orderBy", options.orderBy);
-      if (options.orderDir) params.set("orderDir", options.orderDir);
-      if (options.roleId) params.set("role", options.roleId);
-      const qs = params.toString();
-      const data = await apiRequest("/users" + (qs ? "?" + qs : ""), "GET");
-      const converted = data.users.map((u) => convertUser(u));
-      mergeIntoCache(converted);
-      return {
-        users: converted,
-        total: data.total
-      };
-    }, [apiRequest, mergeIntoCache]);
-    const saveUser = react.useCallback(async (user) => {
-      const roleIds = user.roles ?? [];
-      const data = await apiRequest(`/users/${user.uid}`, "PUT", {
-        email: user.email,
-        displayName: user.displayName,
-        roles: roleIds
-      });
-      const updated = convertUser(data.user);
-      mergeIntoCache([updated]);
-      return updated;
-    }, [apiRequest, mergeIntoCache]);
-    const createUser = react.useCallback(async (user) => {
-      const roleIds = user.roles ?? [];
-      const data = await apiRequest("/users", "POST", {
-        email: user.email,
-        displayName: user.displayName,
-        roles: roleIds
-      });
-      const created = convertUser(data.user);
-      mergeIntoCache([created]);
-      return {
-        user: created,
-        invitationSent: data.invitationSent ?? false,
-        temporaryPassword: data.temporaryPassword
-      };
-    }, [apiRequest, mergeIntoCache]);
-    const resetPassword2 = react.useCallback(async (user) => {
-      const data = await apiRequest(`/users/${user.uid}/reset-password`, "POST");
-      const updatedUser = convertUser(data.user);
-      mergeIntoCache([updatedUser]);
-      return {
-        user: updatedUser,
-        invitationSent: data.invitationSent ?? false,
-        temporaryPassword: data.temporaryPassword
-      };
-    }, [apiRequest, mergeIntoCache]);
-    const deleteUser = react.useCallback(async (user) => {
-      await apiRequest(`/users/${user.uid}`, "DELETE");
-      setUserCache((prev) => {
-        const next = new Map(prev);
-        next.delete(user.uid);
-        return next;
-      });
-    }, [apiRequest]);
-    const getUser = react.useCallback((uid) => {
-      return userCache.get(uid) ?? null;
-    }, [userCache]);
-    const defineRolesFor = react.useCallback(async (user) => {
-      let existingUser = userCache.get(user.uid) ?? Array.from(userCache.values()).find((u) => u.email === user.email);
-      if (!existingUser) {
-        try {
-          const data = await apiRequest(`/users/${user.uid}`, "GET");
-          existingUser = convertUser(data.user);
-          mergeIntoCache([existingUser]);
-        } catch {
-          return void 0;
-        }
-      }
-      const userRoleIds = existingUser.roles ?? [];
-      return userRoleIds;
-    }, [userCache, apiRequest, mergeIntoCache]);
-    const isAdmin = currentUser?.roles?.includes("admin") ?? false;
-    const bootstrapAdmin = react.useCallback(async () => {
-      try {
-        await apiRequest("/bootstrap", "POST");
-        await checkAdminExists();
-      } catch (error) {
-        console.error("Failed to bootstrap admin:", error);
-        throw error;
-      }
-    }, [apiRequest, checkAdminExists]);
-    const users = Array.from(userCache.values());
-    return {
-      loading: effectiveLoading,
-      users,
-      hasAdminUsers,
-      saveUser,
-      createUser,
-      resetPassword: resetPassword2,
-      deleteUser,
-      isAdmin,
-      allowDefaultRolesCreation: isAdmin,
-      defineRolesFor,
-      getUser,
-      searchUsers,
-      usersError,
-      bootstrapAdmin
-    };
-  }
-  exports2.AuthApiError = AuthApiError;
-  exports2.fetchAuthConfig = fetchAuthConfig;
-  exports2.getApiUrl = getApiUrl;
-  exports2.setApiUrl = setApiUrl;
-  exports2.useBackendUserManagement = useBackendUserManagement;
-  exports2.useRebaseAuthController = useRebaseAuthController;
-  Object.defineProperty(exports2, Symbol.toStringTag, { value: "Module" });
-}));
-//# sourceMappingURL=index.umd.js.map
+	typeof exports === "object" && typeof module !== "undefined" ? factory(exports, require("react")) : typeof define === "function" && define.amd ? define(["exports", "react"], factory) : (global = typeof globalThis !== "undefined" ? globalThis : global || self, factory(global["Rebase Auth"] = {}, global.react));
+})(this, function(exports, react) {
+	Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+	//#region src/api.ts
+	/**
+	* Default API URL - can be overridden in hook props
+	*/
+	var baseApiUrl = "";
+	/**
+	* Configure the API base URL
+	*/
+	function setApiUrl(url) {
+		baseApiUrl = url;
+	}
+	/**
+	* Get the current API URL
+	*/
+	function getApiUrl() {
+		return baseApiUrl;
+	}
+	var AuthApiError = class extends Error {
+		code;
+		constructor(message, code) {
+			super(message);
+			this.code = code;
+			this.name = "AuthApiError";
+		}
+	};
+	async function handleResponse(response) {
+		let data;
+		try {
+			data = await response.json();
+		} catch (parseError) {
+			throw new AuthApiError(`Server returned non-JSON response (status: ${response.status})`, "PARSE_ERROR");
+		}
+		if (!response.ok) throw new AuthApiError(data.error?.message || "Request failed", data.error?.code || "UNKNOWN_ERROR");
+		return data;
+	}
+	/**
+	* Wrapper for fetch that catches generic network failures (like server down)
+	* and translates them to an AuthApiError.
+	*/
+	async function fetchWithHandling(input, init) {
+		try {
+			return await fetch(input, init);
+		} catch (error) {
+			if (error instanceof TypeError && error.message.includes("Failed to fetch")) throw new AuthApiError("Failed to connect to the backend server. The backend might be down or failed to initialize (e.g., database connection timeout).", "NETWORK_ERROR");
+			throw new AuthApiError("Network error: " + (error instanceof Error ? error.message : String(error)), "NETWORK_ERROR");
+		}
+	}
+	/**
+	* Register a new user with email/password
+	*/
+	async function register(email, password, displayName) {
+		return handleResponse(await fetchWithHandling(`${baseApiUrl}/api/auth/register`, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({
+				email,
+				password,
+				displayName
+			})
+		}));
+	}
+	/**
+	* Login with email/password
+	*/
+	async function login(email, password) {
+		return handleResponse(await fetchWithHandling(`${baseApiUrl}/api/auth/login`, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({
+				email,
+				password
+			})
+		}));
+	}
+	/**
+	* Login with Google.
+	*
+	* Accepts one of:
+	* - `{ idToken }` — ID-token flow (One Tap / Sign In button)
+	* - `{ accessToken }` — Access-token flow (popup)
+	* - `{ code, redirectUri }` — Authorization code flow (most secure)
+	*/
+	async function googleLogin(payload) {
+		return handleResponse(await fetchWithHandling(`${baseApiUrl}/api/auth/google`, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify(payload)
+		}));
+	}
+	/**
+	* Generic OAuth login — works with any provider registered on the backend.
+	* The `providerId` is used to build the endpoint: `/api/auth/{providerId}`.
+	*/
+	async function oauthLogin(providerId, payload) {
+		return handleResponse(await fetchWithHandling(`${baseApiUrl}/api/auth/${providerId}`, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify(payload)
+		}));
+	}
+	/**
+	* Refresh access token using refresh token
+	*/
+	async function refreshAccessToken(refreshToken) {
+		return handleResponse(await fetchWithHandling(`${baseApiUrl}/api/auth/refresh`, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({ refreshToken })
+		}));
+	}
+	/**
+	* Logout and invalidate refresh token
+	*/
+	async function logout(refreshToken) {
+		await fetchWithHandling(`${baseApiUrl}/api/auth/logout`, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({ refreshToken })
+		});
+	}
+	/**
+	* Get current user info
+	*/
+	async function getCurrentUser(accessToken) {
+		return handleResponse(await fetchWithHandling(`${baseApiUrl}/api/auth/me`, {
+			method: "GET",
+			headers: {
+				"Content-Type": "application/json",
+				"Authorization": `Bearer ${accessToken}`
+			}
+		}));
+	}
+	/**
+	* Request password reset email
+	*/
+	async function forgotPassword(email) {
+		return handleResponse(await fetchWithHandling(`${baseApiUrl}/api/auth/forgot-password`, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({ email })
+		}));
+	}
+	/**
+	* Reset password using token from email
+	*/
+	async function resetPassword(token, password) {
+		return handleResponse(await fetchWithHandling(`${baseApiUrl}/api/auth/reset-password`, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({
+				token,
+				password
+			})
+		}));
+	}
+	/**
+	* Change password for authenticated user
+	*/
+	async function changePassword(accessToken, oldPassword, newPassword) {
+		return handleResponse(await fetchWithHandling(`${baseApiUrl}/api/auth/change-password`, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				"Authorization": `Bearer ${accessToken}`
+			},
+			body: JSON.stringify({
+				oldPassword,
+				newPassword
+			})
+		}));
+	}
+	/**
+	* Update current user profile
+	*/
+	async function updateProfile(accessToken, displayName, photoURL) {
+		return handleResponse(await fetchWithHandling(`${baseApiUrl}/api/auth/me`, {
+			method: "PATCH",
+			headers: {
+				"Content-Type": "application/json",
+				"Authorization": `Bearer ${accessToken}`
+			},
+			body: JSON.stringify({
+				displayName,
+				photoURL
+			})
+		}));
+	}
+	/**
+	* Fetch active sessions for current user
+	*/
+	async function fetchSessions(accessToken, currentRefreshToken) {
+		const headers = {
+			"Content-Type": "application/json",
+			"Authorization": `Bearer ${accessToken}`
+		};
+		if (currentRefreshToken) headers["X-Refresh-Token"] = currentRefreshToken;
+		return handleResponse(await fetchWithHandling(`${baseApiUrl}/api/auth/sessions`, {
+			method: "GET",
+			headers
+		}));
+	}
+	/**
+	* Revoke a specific session
+	*/
+	async function revokeSession(accessToken, sessionId) {
+		return handleResponse(await fetchWithHandling(`${baseApiUrl}/api/auth/sessions/${sessionId}`, {
+			method: "DELETE",
+			headers: {
+				"Content-Type": "application/json",
+				"Authorization": `Bearer ${accessToken}`
+			}
+		}));
+	}
+	/**
+	* Revoke all sessions for current user
+	*/
+	async function revokeAllSessions(accessToken) {
+		return handleResponse(await fetchWithHandling(`${baseApiUrl}/api/auth/sessions`, {
+			method: "DELETE",
+			headers: {
+				"Content-Type": "application/json",
+				"Authorization": `Bearer ${accessToken}`
+			}
+		}));
+	}
+	/**
+	* Inflight promise for `fetchAuthConfig` — ensures concurrent callers
+	* (e.g. React StrictMode double-mount) reuse the same network request.
+	*/
+	var authConfigInflight = null;
+	/**
+	* Cached result of the last successful `fetchAuthConfig` call.
+	* Auth config is static for the lifetime of the app session, so
+	* repeat calls (e.g. from effect re-runs) return instantly.
+	*/
+	var authConfigCached = null;
+	/**
+	* Fetch auth configuration / status from the backend
+	* This is an unauthenticated endpoint used to detect bootstrap mode.
+	*
+	* Results are cached for the session lifetime.
+	* Concurrent calls are deduplicated: only one network request is made
+	* and all callers share the same promise.
+	*/
+	async function fetchAuthConfig() {
+		if (authConfigCached) return authConfigCached;
+		if (authConfigInflight) return authConfigInflight;
+		authConfigInflight = (async () => {
+			return handleResponse(await fetchWithHandling(`${baseApiUrl}/api/auth/config`, {
+				method: "GET",
+				headers: { "Content-Type": "application/json" }
+			}));
+		})();
+		try {
+			const result = await authConfigInflight;
+			authConfigCached = result;
+			return result;
+		} finally {
+			authConfigInflight = null;
+		}
+	}
+	//#endregion
+	//#region src/hooks/useRebaseAuthController.ts
+	var STORAGE_KEY = "rebase_react_auth";
+	var TOKEN_REFRESH_BUFFER_MS = 120 * 1e3;
+	/**
+	* Convert UserInfo from API to Rebase User type
+	*/
+	function convertToUser(userInfo) {
+		return {
+			uid: userInfo.uid,
+			email: userInfo.email,
+			displayName: userInfo.displayName || null,
+			photoURL: userInfo.photoURL || null,
+			providerId: "custom",
+			isAnonymous: false,
+			roles: userInfo.roles || [],
+			metadata: userInfo.metadata
+		};
+	}
+	/**
+	* Save auth data to localStorage
+	*/
+	function saveAuthToStorage(tokens, user) {
+		try {
+			const data = {
+				tokens,
+				user
+			};
+			localStorage.setItem(STORAGE_KEY, JSON.stringify(data));
+		} catch (e) {}
+	}
+	/**
+	* Load auth data from localStorage
+	*/
+	function loadAuthFromStorage() {
+		try {
+			const data = localStorage.getItem(STORAGE_KEY);
+			if (data) return JSON.parse(data);
+		} catch (e) {
+			console.warn("Failed to load auth from storage:", e);
+		}
+		return null;
+	}
+	/**
+	* Clear auth data from localStorage
+	*/
+	function clearAuthFromStorage() {
+		try {
+			localStorage.removeItem(STORAGE_KEY);
+		} catch (e) {
+			console.warn("Failed to clear auth from storage:", e);
+		}
+	}
+	/**
+	* Check if token is expired or about to expire
+	*/
+	function isTokenExpiredOrNearExpiry(expiresAt, bufferMs = TOKEN_REFRESH_BUFFER_MS) {
+		return Date.now() + bufferMs >= expiresAt;
+	}
+	/**
+	* Auth controller hook for JWT-based authentication
+	* with @rebasepro/server-core
+	*
+	* @param props Configuration options
+	* @returns RebaseAuthController instance
+	*/
+	function useRebaseAuthController(props = {}) {
+		const { client, apiUrl, onSignOut, defineRolesFor } = props;
+		const [user, setUser] = (0, react.useState)(null);
+		const [authLoading, setAuthLoading] = (0, react.useState)(false);
+		const [initialLoading, setInitialLoading] = (0, react.useState)(true);
+		const [authError, setAuthError] = (0, react.useState)(null);
+		const [authProviderError, setAuthProviderError] = (0, react.useState)(null);
+		const [loginSkipped, setLoginSkipped] = (0, react.useState)(false);
+		const [extra, setExtra] = (0, react.useState)(null);
+		const [authConfig, setAuthConfig] = (0, react.useState)(null);
+		const tokensRef = (0, react.useRef)(null);
+		const refreshTimeoutRef = (0, react.useRef)(null);
+		const refreshPromiseRef = (0, react.useRef)(null);
+		const isMountedRef = (0, react.useRef)(true);
+		(0, react.useEffect)(() => {
+			const url = client?.baseUrl || apiUrl;
+			if (url) setApiUrl(url);
+		}, [
+			client,
+			client?.baseUrl,
+			apiUrl
+		]);
+		const clearError = (0, react.useCallback)(() => {
+			setAuthProviderError(null);
+		}, []);
+		const clearSessionAndSignOut = (0, react.useCallback)(() => {
+			tokensRef.current = null;
+			clearAuthFromStorage();
+			if (refreshTimeoutRef.current) {
+				clearTimeout(refreshTimeoutRef.current);
+				refreshTimeoutRef.current = null;
+			}
+			setUser(null);
+			setLoginSkipped(false);
+			onSignOut?.();
+		}, [onSignOut]);
+		/**
+		* Refresh the access token using the stored refresh token.
+		* Returns the new tokens or null if refresh failed.
+		*/
+		const refreshAccessToken$1 = (0, react.useCallback)(async () => {
+			if (refreshPromiseRef.current) return refreshPromiseRef.current;
+			const executeRefresh = async () => {
+				const storedData = loadAuthFromStorage();
+				if (storedData?.tokens?.accessTokenExpiresAt) {
+					const storedTokens = storedData.tokens;
+					if (!isTokenExpiredOrNearExpiry(storedTokens.accessTokenExpiresAt) && storedTokens.accessToken !== tokensRef.current?.accessToken) {
+						tokensRef.current = storedTokens;
+						return storedTokens;
+					}
+				}
+				const currentTokens = tokensRef.current;
+				if (!currentTokens?.refreshToken) return null;
+				try {
+					const newTokens = (await refreshAccessToken(currentTokens.refreshToken)).tokens;
+					tokensRef.current = newTokens;
+					const latestStoredData = loadAuthFromStorage();
+					if (latestStoredData) saveAuthToStorage(newTokens, latestStoredData.user);
+					return newTokens;
+				} catch (error) {
+					if (error instanceof Error && error.code === "NETWORK_ERROR") throw error;
+					return null;
+				} finally {
+					refreshPromiseRef.current = null;
+				}
+			};
+			refreshPromiseRef.current = executeRefresh();
+			return refreshPromiseRef.current;
+		}, []);
+		const scheduleTokenRefresh = (0, react.useCallback)((tokens) => {
+			if (refreshTimeoutRef.current) clearTimeout(refreshTimeoutRef.current);
+			const timeUntilRefresh = tokens.accessTokenExpiresAt - TOKEN_REFRESH_BUFFER_MS - Date.now();
+			if (timeUntilRefresh <= 0) {
+				refreshAccessToken$1().then((newTokens) => {
+					if (newTokens && isMountedRef.current) scheduleTokenRefresh(newTokens);
+					else if (!newTokens && isMountedRef.current) clearSessionAndSignOut();
+				});
+				return;
+			}
+			refreshTimeoutRef.current = setTimeout(async () => {
+				if (!isMountedRef.current) return;
+				try {
+					const newTokens = await refreshAccessToken$1();
+					if (newTokens && isMountedRef.current) scheduleTokenRefresh(newTokens);
+					else if (!newTokens && isMountedRef.current) clearSessionAndSignOut();
+				} catch (error) {
+					if (isMountedRef.current) refreshTimeoutRef.current = setTimeout(() => {
+						scheduleTokenRefresh(tokens);
+					}, 1e4);
+				}
+			}, timeUntilRefresh);
+		}, [refreshAccessToken$1, clearSessionAndSignOut]);
+		const getAuthToken = (0, react.useCallback)(async () => {
+			if (initialLoading) throw new Error("Auth is still loading");
+			const currentTokens = tokensRef.current;
+			if (!currentTokens) throw new Error("User is not logged in");
+			if (isTokenExpiredOrNearExpiry(currentTokens.accessTokenExpiresAt)) try {
+				const newTokens = await refreshAccessToken$1();
+				if (!newTokens) {
+					clearSessionAndSignOut();
+					throw new Error("Session expired. Please login again.");
+				}
+				return newTokens.accessToken;
+			} catch (error) {
+				if (error instanceof Error && error.code === "NETWORK_ERROR") throw error;
+				clearSessionAndSignOut();
+				throw error;
+			}
+			return currentTokens.accessToken;
+		}, [
+			initialLoading,
+			refreshAccessToken$1,
+			clearSessionAndSignOut
+		]);
+		(0, react.useEffect)(() => {
+			if (client) {
+				client.setAuthTokenGetter?.(async () => {
+					try {
+						return await getAuthToken();
+					} catch {
+						return null;
+					}
+				});
+				if (client.setOnUnauthorized) client.setOnUnauthorized(async () => {
+					try {
+						if (await refreshAccessToken$1()) return true;
+						clearSessionAndSignOut();
+						return false;
+					} catch (e) {
+						clearSessionAndSignOut();
+						return false;
+					}
+				});
+				if (client.ws) client.ws.setAuthTokenGetter(async () => {
+					try {
+						return await getAuthToken();
+					} catch {
+						return null;
+					}
+				});
+			}
+		}, [
+			client,
+			getAuthToken,
+			refreshAccessToken$1,
+			clearSessionAndSignOut
+		]);
+		const handleAuthSuccess = (0, react.useCallback)(async (userInfo, tokens) => {
+			tokensRef.current = tokens;
+			let convertedUser = convertToUser(userInfo);
+			if (defineRolesFor) {
+				const customRoles = await defineRolesFor(convertedUser);
+				if (customRoles) convertedUser = {
+					...convertedUser,
+					roles: customRoles
+				};
+			}
+			saveAuthToStorage(tokens, userInfo);
+			setUser(convertedUser);
+			setAuthError(null);
+			setAuthProviderError(null);
+			setLoginSkipped(false);
+			scheduleTokenRefresh(tokens);
+		}, [scheduleTokenRefresh, defineRolesFor]);
+		const emailPasswordLogin = (0, react.useCallback)(async (email, password) => {
+			setAuthLoading(true);
+			setAuthProviderError(null);
+			try {
+				const response = await login(email, password);
+				await handleAuthSuccess(response.user, response.tokens);
+			} catch (error) {
+				setAuthProviderError(error);
+				throw error;
+			} finally {
+				setAuthLoading(false);
+			}
+		}, [handleAuthSuccess]);
+		const register$1 = (0, react.useCallback)(async (email, password, displayName) => {
+			setAuthLoading(true);
+			setAuthProviderError(null);
+			try {
+				const response = await register(email, password, displayName);
+				await handleAuthSuccess(response.user, response.tokens);
+			} catch (error) {
+				setAuthProviderError(error);
+				throw error;
+			} finally {
+				setAuthLoading(false);
+			}
+		}, [handleAuthSuccess]);
+		const googleLogin$1 = (0, react.useCallback)(async (payload) => {
+			setAuthLoading(true);
+			setAuthProviderError(null);
+			try {
+				const response = await googleLogin(payload);
+				await handleAuthSuccess(response.user, response.tokens);
+			} catch (error) {
+				setAuthProviderError(error);
+				throw error;
+			} finally {
+				setAuthLoading(false);
+			}
+		}, [handleAuthSuccess]);
+		const oauthLogin$1 = (0, react.useCallback)(async (providerId, payload) => {
+			setAuthLoading(true);
+			setAuthProviderError(null);
+			try {
+				const response = await oauthLogin(providerId, payload);
+				await handleAuthSuccess(response.user, response.tokens);
+			} catch (error) {
+				setAuthProviderError(error);
+				throw error;
+			} finally {
+				setAuthLoading(false);
+			}
+		}, [handleAuthSuccess]);
+		const signOut = (0, react.useCallback)(async () => {
+			try {
+				if (tokensRef.current) await logout(tokensRef.current.refreshToken);
+			} catch (error) {
+				console.error("Logout error:", error);
+			} finally {
+				clearSessionAndSignOut();
+			}
+		}, [clearSessionAndSignOut]);
+		const skipLogin = (0, react.useCallback)(() => {
+			setLoginSkipped(true);
+			setUser(null);
+		}, []);
+		const forgotPassword$1 = (0, react.useCallback)(async (email) => {
+			setAuthLoading(true);
+			setAuthProviderError(null);
+			try {
+				await forgotPassword(email);
+			} catch (error) {
+				setAuthProviderError(error);
+				throw error;
+			} finally {
+				setAuthLoading(false);
+			}
+		}, []);
+		const resetPassword$1 = (0, react.useCallback)(async (token, password) => {
+			setAuthLoading(true);
+			setAuthProviderError(null);
+			try {
+				await resetPassword(token, password);
+			} catch (error) {
+				setAuthProviderError(error);
+				throw error;
+			} finally {
+				setAuthLoading(false);
+			}
+		}, []);
+		const changePassword$1 = (0, react.useCallback)(async (oldPassword, newPassword) => {
+			setAuthLoading(true);
+			setAuthProviderError(null);
+			try {
+				if (!tokensRef.current) throw new Error("User is not logged in");
+				await changePassword(tokensRef.current.accessToken, oldPassword, newPassword);
+				clearSessionAndSignOut();
+			} catch (error) {
+				setAuthProviderError(error);
+				throw error;
+			} finally {
+				setAuthLoading(false);
+			}
+		}, [clearSessionAndSignOut]);
+		const updateProfile$1 = (0, react.useCallback)(async (displayName, photoURL) => {
+			setAuthLoading(true);
+			setAuthProviderError(null);
+			try {
+				if (!tokensRef.current) throw new Error("User is not logged in");
+				const response = await updateProfile(tokensRef.current.accessToken, displayName, photoURL);
+				let convertedUser = convertToUser(response.user);
+				if (defineRolesFor) {
+					const customRoles = await defineRolesFor(convertedUser);
+					if (customRoles) convertedUser = {
+						...convertedUser,
+						roles: customRoles
+					};
+				}
+				const storedData = loadAuthFromStorage();
+				if (storedData) saveAuthToStorage(storedData.tokens, response.user);
+				setUser(convertedUser);
+				return convertedUser;
+			} catch (error) {
+				setAuthProviderError(error);
+				throw error;
+			} finally {
+				setAuthLoading(false);
+			}
+		}, [defineRolesFor]);
+		const fetchSessions$1 = (0, react.useCallback)(async () => {
+			try {
+				if (!tokensRef.current) throw new Error("User is not logged in");
+				return (await fetchSessions(tokensRef.current.accessToken, tokensRef.current.refreshToken)).sessions;
+			} catch (error) {
+				setAuthProviderError(error);
+				throw error;
+			}
+		}, []);
+		const revokeSession$1 = (0, react.useCallback)(async (sessionId) => {
+			try {
+				if (!tokensRef.current) throw new Error("User is not logged in");
+				await revokeSession(tokensRef.current.accessToken, sessionId);
+			} catch (error) {
+				setAuthProviderError(error);
+				throw error;
+			}
+		}, []);
+		(0, react.useEffect)(() => {
+			isMountedRef.current = true;
+			const restoreAuth = async () => {
+				try {
+					const config = await fetchAuthConfig();
+					if (isMountedRef.current) setAuthConfig(config);
+				} catch (e) {}
+				const stored = loadAuthFromStorage();
+				if (!stored) {
+					setInitialLoading(false);
+					return;
+				}
+				if (!stored.tokens?.refreshToken) {
+					clearAuthFromStorage();
+					setInitialLoading(false);
+					return;
+				}
+				const expiresAt = stored.tokens.accessTokenExpiresAt;
+				if (typeof expiresAt !== "number" || !Number.isFinite(expiresAt)) {
+					clearAuthFromStorage();
+					setInitialLoading(false);
+					return;
+				}
+				if (!isTokenExpiredOrNearExpiry(stored.tokens.accessTokenExpiresAt)) {
+					tokensRef.current = stored.tokens;
+					let userToSet = convertToUser(stored.user);
+					if (defineRolesFor) {
+						const customRoles = await defineRolesFor(userToSet);
+						if (customRoles) userToSet = {
+							...userToSet,
+							roles: customRoles
+						};
+					}
+					setUser(userToSet);
+					scheduleTokenRefresh(stored.tokens);
+					setInitialLoading(false);
+					return;
+				}
+				tokensRef.current = stored.tokens;
+				try {
+					const newTokens = await refreshAccessToken$1();
+					if (!newTokens) {
+						clearAuthFromStorage();
+						tokensRef.current = null;
+						setInitialLoading(false);
+						return;
+					}
+					if (!isMountedRef.current) return;
+					let userToSet;
+					try {
+						const meResponse = await getCurrentUser(newTokens.accessToken);
+						if (!isMountedRef.current) return;
+						const freshUserInfo = meResponse.user;
+						saveAuthToStorage(newTokens, freshUserInfo);
+						userToSet = convertToUser(freshUserInfo);
+						if (defineRolesFor) {
+							const customRoles = await defineRolesFor(userToSet);
+							if (!isMountedRef.current) return;
+							if (customRoles) userToSet = {
+								...userToSet,
+								roles: customRoles
+							};
+						}
+					} catch (meError) {
+						if (!isMountedRef.current) return;
+						if (meError instanceof AuthApiError && (meError.code === "NOT_FOUND" || meError.code === "UNAUTHORIZED")) {
+							clearSessionAndSignOut();
+							return;
+						}
+						userToSet = convertToUser(stored.user);
+					}
+					if (!isMountedRef.current) return;
+					setUser(userToSet);
+					scheduleTokenRefresh(newTokens);
+				} catch (error) {
+					if (!isMountedRef.current) return;
+					if (!(error instanceof Error && error.code === "NETWORK_ERROR")) {
+						clearAuthFromStorage();
+						tokensRef.current = null;
+					}
+				} finally {
+					if (isMountedRef.current) setInitialLoading(false);
+				}
+			};
+			restoreAuth();
+			return () => {
+				isMountedRef.current = false;
+			};
+		}, [
+			scheduleTokenRefresh,
+			defineRolesFor,
+			refreshAccessToken$1
+		]);
+		(0, react.useEffect)(() => {
+			const handleVisibilityChange = async () => {
+				if (initialLoading) return;
+				if (document.visibilityState === "visible" && tokensRef.current) {
+					if (isTokenExpiredOrNearExpiry(tokensRef.current.accessTokenExpiresAt)) try {
+						const newTokens = await refreshAccessToken$1();
+						if (newTokens && isMountedRef.current) scheduleTokenRefresh(newTokens);
+						else if (!newTokens && isMountedRef.current) clearSessionAndSignOut();
+					} catch (e) {}
+				}
+			};
+			document.addEventListener("visibilitychange", handleVisibilityChange);
+			return () => {
+				document.removeEventListener("visibilitychange", handleVisibilityChange);
+			};
+		}, [
+			initialLoading,
+			refreshAccessToken$1,
+			scheduleTokenRefresh,
+			clearSessionAndSignOut
+		]);
+		const getApiUrl$1 = (0, react.useCallback)(() => {
+			return getApiUrl();
+		}, []);
+		(0, react.useEffect)(() => {
+			return () => {
+				isMountedRef.current = false;
+				if (refreshTimeoutRef.current) clearTimeout(refreshTimeoutRef.current);
+			};
+		}, []);
+		const revokeAllSessions$1 = (0, react.useCallback)(async () => {
+			try {
+				if (!tokensRef.current) throw new Error("User is not logged in");
+				await revokeAllSessions(tokensRef.current.accessToken);
+				clearSessionAndSignOut();
+			} catch (error) {
+				setAuthProviderError(error);
+				throw error;
+			}
+		}, [clearSessionAndSignOut]);
+		return {
+			user,
+			authLoading,
+			initialLoading,
+			authError,
+			authProviderError,
+			loginSkipped,
+			needsSetup: authConfig?.needsSetup ?? false,
+			registrationEnabled: authConfig?.registrationEnabled ?? false,
+			getAuthToken,
+			getApiUrl: getApiUrl$1,
+			signOut,
+			emailPasswordLogin,
+			register: register$1,
+			googleLogin: googleLogin$1,
+			oauthLogin: oauthLogin$1,
+			skipLogin,
+			forgotPassword: forgotPassword$1,
+			resetPassword: resetPassword$1,
+			changePassword: changePassword$1,
+			updateProfile: updateProfile$1,
+			fetchSessions: fetchSessions$1,
+			revokeSession: revokeSession$1,
+			revokeAllSessions: revokeAllSessions$1,
+			clearError,
+			setAuthProviderError,
+			extra,
+			setExtra,
+			capabilities: {
+				emailPasswordLogin: true,
+				googleLogin: !!props.googleClientId,
+				registration: authConfig?.registrationEnabled ?? false,
+				passwordReset: authConfig?.passwordReset ?? false,
+				sessionManagement: true,
+				profileUpdate: true,
+				emailVerification: authConfig?.emailVerification ?? false,
+				enabledProviders: authConfig?.enabledProviders ?? []
+			}
+		};
+	}
+	//#endregion
+	exports.AuthApiError = AuthApiError;
+	exports.fetchAuthConfig = fetchAuthConfig;
+	exports.getApiUrl = getApiUrl;
+	exports.setApiUrl = setApiUrl;
+	exports.useRebaseAuthController = useRebaseAuthController;
+});
+
+//# sourceMappingURL=index.umd.js.map