@replicated/portal-components 0.0.18 → 0.0.20

package/dist/actions/team-settings.js

@@ -0,0 +1,1040 @@
+"use server";
+'use strict';
+
+var headers = require('next/headers');
+var cache = require('next/cache');
+var buffer = require('buffer');
+var react = require('react');
+
+/**
+ * Enterprise Portal Components
+ * This file is generated by tsup. Do not edit manually.
+ */
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// datadog/tracer.ts
+var tracer_exports = {};
+__export(tracer_exports, {
+  default: () => tracer_default
+});
+var rawFlag, isEnabled, tracer, getRoutePattern, tracer_default;
+var init_tracer = __esm({
+  "datadog/tracer.ts"() {
+    rawFlag = String(process.env.USE_DATADOG_APM || "").toLowerCase();
+    isEnabled = rawFlag === "true";
+    process.env.DD_TRACE_ENABLED = isEnabled ? "1" : "0";
+    tracer = null;
+    if (isEnabled) {
+      const serviceName = process.env.DD_SERVICE || "enterprise-portal";
+      const environment = process.env.DD_ENV || process.env.NODE_ENV || "development";
+      const version = process.env.DD_VERSION || process.env.NEXT_PUBLIC_VERSION || "0.0.0-dev";
+      const agentHost = process.env.DD_AGENT_HOST || process.env.DATADOG_AGENT_HOST || "127.0.0.1";
+      const agentPort = process.env.DD_TRACE_AGENT_PORT || "8126";
+      process.env.DD_SERVICE = serviceName;
+      process.env.DD_ENV = environment;
+      {
+        process.env.DD_VERSION = version;
+      }
+      process.env.DD_AGENT_HOST = agentHost;
+      process.env.DD_TRACE_AGENT_PORT = agentPort;
+      const dbmPropagationMode = process.env.DD_DBM_PROPAGATION_MODE || "full";
+      process.env.DD_DBM_PROPAGATION_MODE = dbmPropagationMode;
+      try {
+        const ddTrace = __require("dd-trace");
+        tracer = ddTrace.init({
+          service: serviceName,
+          env: environment,
+          version,
+          logInjection: true,
+          runtimeMetrics: true,
+          appsec: false,
+          profiling: false,
+          startupLogs: true
+          // Enable for debugging
+        });
+        console.log(`[datadog] Tracer initialized: service=${serviceName}, env=${environment}, version=${version}, agent=${agentHost}:${agentPort}`);
+        tracer.use("dns", false);
+        tracer.use("net", false);
+        tracer.use("http", {
+          server: {
+            hooks: {
+              request: (span, req) => {
+                if (!span) return;
+                const url = req?.url || "";
+                const method = req?.method || "GET";
+                const path = url.split("?")[0];
+                if (path.startsWith("/_next/")) {
+                  span.context()._trace.isRecording = false;
+                  return;
+                }
+                const routePattern = getRoutePattern(path);
+                span.setTag("resource.name", `${method} ${routePattern}`);
+                span.setTag("http.route", routePattern);
+              }
+            }
+          }
+        });
+      } catch (err) {
+        console.error("[datadog] failed to initialize tracing", err);
+        tracer = null;
+      }
+    }
+    getRoutePattern = (path) => {
+      const routePatterns = [
+        // Update instance routes - normalize dynamic segments (capture suffix to preserve sub-routes)
+        { pattern: /^\/update\/instance\/[^/]+(.*)$/, replacement: "/update/instance/[instanceId]$1" }
+      ];
+      for (const { pattern, replacement } of routePatterns) {
+        if (pattern.test(path)) {
+          return path.replace(pattern, replacement);
+        }
+      }
+      return path;
+    };
+    tracer_default = tracer;
+  }
+});
+
+// src/utils/observability/tracing.ts
+var tracerCache = void 0;
+function getTracer() {
+  if (tracerCache !== void 0) {
+    return tracerCache;
+  }
+  const rawFlag2 = String(process.env.USE_DATADOG_APM || "").toLowerCase();
+  const isEnabled2 = rawFlag2 === "true";
+  if (!isEnabled2) {
+    tracerCache = null;
+    return null;
+  }
+  try {
+    const tracerModule = (init_tracer(), __toCommonJS(tracer_exports));
+    const tracer2 = tracerModule.default || tracerModule;
+    if (tracer2 && typeof tracer2.trace === "function") {
+      tracerCache = tracer2;
+      return tracerCache;
+    }
+  } catch (err) {
+    console.warn("Failed to load tracer:", err);
+  }
+  tracerCache = null;
+  return null;
+}
+async function withTrace(name, fn) {
+  const activeTracer = getTracer();
+  if (!activeTracer) {
+    return fn(void 0);
+  }
+  return activeTracer.trace(name, async (span) => {
+    if (span) {
+      span.setTag("component", "application");
+    }
+    try {
+      const result = await fn(span);
+      return result;
+    } catch (error) {
+      if (span) {
+        span.setTag("error", error);
+      }
+      throw error;
+    }
+  });
+}
+function traceServerAction(name, fn) {
+  const spanName = name.startsWith("server.action.") ? name : `server.action.${name}`;
+  const traced = async (...args) => {
+    return withTrace(spanName, async (span) => {
+      if (span) {
+        span.setTag("component", "server-action");
+      }
+      const result = await fn(...args);
+      return result;
+    });
+  };
+  return traced;
+}
+
+// src/utils/api-client.ts
+async function authenticatedFetch(url, options = {}) {
+  const { token, ...fetchOptions } = options;
+  const headers = new Headers(fetchOptions.headers);
+  if (token) {
+    headers.set("authorization", `Bearer ${token}`);
+  }
+  const response = await fetch(url, {
+    ...fetchOptions,
+    headers
+  });
+  if (response.status === 401) {
+    await handle401();
+  }
+  if (response.status === 502 || response.status === 503 || response.status === 504) {
+    await handleServerError(response.status);
+  }
+  return response;
+}
+async function handle401() {
+  const { redirect } = await import('next/navigation');
+  return redirect("/?expired=1");
+}
+function isErrorPage(url) {
+  try {
+    const urlObj = new URL(url);
+    return urlObj.pathname === "/error";
+  } catch {
+    return url === "/error" || url.startsWith("/error?");
+  }
+}
+async function handleServerError(statusCode) {
+  const { redirect } = await import('next/navigation');
+  const { cookies: cookies2 } = await import('next/headers');
+  let sourceUrl;
+  try {
+    const { headers } = await import('next/headers');
+    const headersList = await headers();
+    const referer = headersList.get("referer");
+    const host = headersList.get("host");
+    const pathname = headersList.get("x-invoke-path") || headersList.get("x-forwarded-path");
+    if (referer && !isErrorPage(referer)) {
+      sourceUrl = referer;
+    } else if (host && pathname) {
+      const protocol = headersList.get("x-forwarded-proto") || "https";
+      sourceUrl = `${protocol}://${host}${pathname}`;
+    }
+    if (!sourceUrl || isErrorPage(sourceUrl)) {
+      const cookieStore = await cookies2();
+      const preservedSource = cookieStore.get("portal_error_source");
+      if (preservedSource?.value) {
+        sourceUrl = decodeURIComponent(preservedSource.value);
+        cookieStore.delete("portal_error_source");
+      }
+    }
+  } catch (error) {
+    console.debug("[portal-components] Could not determine source URL", error);
+  }
+  const params = new URLSearchParams({ code: String(statusCode) });
+  if (sourceUrl) {
+    params.set("source", sourceUrl);
+  }
+  return redirect(`/error?${params.toString()}`);
+}
+
+// src/actions/index.ts
+var getApiOrigin = () => {
+  return (process.env.REPLICATED_APP_ORIGIN || "https://replicated.app").replace(/\/+$/, "");
+};
+var defineServerAction = (definition) => definition;
+var createServiceAccount = defineServerAction({
+  id: "service-account/create",
+  description: "Creates a service account for installing applications",
+  visibility: "customer",
+  tags: ["service-account", "install"],
+  async run({ token, name }) {
+    if (!token || typeof token !== "string") {
+      throw new Error("Service account creation requires a session token");
+    }
+    if (!name || typeof name !== "string" || !name.trim()) {
+      throw new Error("Service account name is required");
+    }
+    const endpoint = `${getApiOrigin()}/enterprise-portal/team/service-accounts`;
+    if (process.env.NODE_ENV !== "production") {
+      console.debug(
+        "[portal-components] creating service account via %s (Enterprise Portal API)",
+        endpoint
+      );
+    }
+    const response = await authenticatedFetch(endpoint, {
+      method: "POST",
+      token,
+      headers: {
+        "content-type": "application/json"
+      },
+      body: JSON.stringify({ account_name: name.trim() })
+    });
+    if (!response.ok) {
+      const errorText = await response.text();
+      throw new Error(
+        `Service account creation failed (${response.status} ${response.statusText}): ${errorText}`
+      );
+    }
+    const data = await response.json();
+    return data;
+  }
+});
+var fetchCustomBrandingImpl = async () => {
+  const appSlug = process.env.PORTAL_APP_SLUG;
+  if (!appSlug) {
+    throw new Error("PORTAL_APP_SLUG is not configured");
+  }
+  const url = `${getApiOrigin()}/enterprise-portal/public/branding?app_slug=${encodeURIComponent(
+    appSlug
+  )}`;
+  if (process.env.NODE_ENV !== "production") {
+    console.debug(
+      "[portal-components] fetching custom branding via %s (Enterprise Portal API)",
+      url
+    );
+  }
+  const response = await fetch(url, {
+    headers: {
+      accept: "application/json"
+    }
+  });
+  if (!response.ok) {
+    throw new Error(
+      `Custom branding request failed (${response.status} ${response.statusText})`
+    );
+  }
+  const payload = await response.json();
+  const brandingObject = {
+    logo: payload.logoUrl,
+    title: payload.title,
+    primaryColor: payload.primaryColor,
+    secondaryColor: payload.secondaryColor,
+    favicon: payload.faviconUrl,
+    supportPortalLink: payload.supportPortalLink || "",
+    background: payload.background,
+    backgroundImage: payload.backgroundImage,
+    customColor1: payload.customColor1,
+    customColor2: payload.customColor2
+  };
+  const brandingData = buffer.Buffer.from(JSON.stringify(brandingObject)).toString("base64");
+  return {
+    brandingData,
+    documentation: null
+    // Documentation not included in new API's public endpoint
+  };
+};
+react.cache(fetchCustomBrandingImpl);
+var decodeJwtPayload = (token) => {
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    throw new Error("Invalid JWT received");
+  }
+  const payloadSegment = parts[1];
+  if (!payloadSegment) {
+    throw new Error("JWT payload segment missing");
+  }
+  const padded = payloadSegment.padEnd(
+    payloadSegment.length + (4 - payloadSegment.length % 4) % 4,
+    "="
+  );
+  const decoded = buffer.Buffer.from(padded, "base64").toString("utf-8");
+  return JSON.parse(decoded);
+};
+var getCustomerIdFromToken = (token) => {
+  const payload = decodeJwtPayload(token);
+  const customerId = payload?.customer_id || payload?.customerId;
+  if (typeof customerId !== "string" || !customerId.trim()) {
+    throw new Error("Unable to determine customer_id from session token");
+  }
+  return customerId.trim();
+};
+async function listReleasesImpl() {
+  const { cookies: cookies2 } = await import('next/headers');
+  const sessionStore = await cookies2();
+  const session = sessionStore.get("portal_session");
+  const token = session?.value;
+  if (!token) {
+    throw new Error("List releases requires a session token");
+  }
+  const endpoint = `${getApiOrigin()}/enterprise-portal/releases`;
+  if (process.env.NODE_ENV !== "production") {
+    console.debug("[portal-components] fetching releases via %s (Enterprise Portal API)", endpoint);
+  }
+  const response = await authenticatedFetch(endpoint, {
+    method: "GET",
+    token,
+    headers: {
+      accept: "application/json"
+    }
+  });
+  if (!response.ok) {
+    throw new Error(
+      `List releases request failed (${response.status} ${response.statusText})`
+    );
+  }
+  const envelope = await response.json();
+  const data = envelope.data;
+  return {
+    releases: Array.isArray(data?.releases) ? data.releases : [],
+    totalCount: data?.totalCount || 0
+  };
+}
+traceServerAction("listReleases", listReleasesImpl);
+var fetchTeamUsers = defineServerAction({
+  id: "team/fetch-users",
+  description: "Fetches paginated list of team users and pending invites",
+  visibility: "customer",
+  tags: ["team", "users"],
+  async run({ token, limit = 25, offset = 0 }, context) {
+    if (!token || typeof token !== "string") {
+      throw new Error("Fetch team users requires a session token");
+    }
+    const customerId = getCustomerIdFromToken(token);
+    const params = new URLSearchParams({
+      customer_id: customerId,
+      limit: limit.toString(),
+      offset: offset.toString()
+    });
+    const endpoint = `${getApiOrigin()}/enterprise-portal/team/users?${params.toString()}`;
+    if (process.env.NODE_ENV !== "production") {
+      console.debug("[portal-components] fetching team users via %s", endpoint);
+    }
+    const response = await authenticatedFetch(endpoint, {
+      method: "GET",
+      token,
+      headers: { accept: "application/json" },
+      signal: context?.signal
+    });
+    if (!response.ok) {
+      throw new Error(
+        `Fetch team users request failed (${response.status} ${response.statusText})`
+      );
+    }
+    const data = await response.json();
+    return {
+      users: data.users || [],
+      total: data.total || 0
+    };
+  }
+});
+var inviteUser = defineServerAction({
+  id: "team/invite-user",
+  description: "Sends an invitation email to join the team",
+  visibility: "customer",
+  tags: ["team", "users", "invite"],
+  async run({ token, email }, context) {
+    if (!token || typeof token !== "string") {
+      throw new Error("Invite user requires a session token");
+    }
+    if (!email || typeof email !== "string") {
+      throw new Error("Invite user requires an email address");
+    }
+    getCustomerIdFromToken(token);
+    const params = new URLSearchParams({
+      email_address: email
+    });
+    const endpoint = `${getApiOrigin()}/enterprise-portal/team/invite?${params.toString()}`;
+    if (process.env.NODE_ENV !== "production") {
+      console.debug("[portal-components] inviting user via %s", endpoint);
+    }
+    const response = await authenticatedFetch(endpoint, {
+      method: "POST",
+      token,
+      headers: { accept: "application/json" },
+      signal: context?.signal
+    });
+    if (!response.ok) {
+      let errorMessage = "Failed to invite user";
+      try {
+        const data = await response.json();
+        errorMessage = data.message || data.error || errorMessage;
+      } catch {
+      }
+      throw new Error(errorMessage);
+    }
+    return { success: true };
+  }
+});
+var deleteUser = defineServerAction({
+  id: "team/delete-user",
+  description: "Removes a user or pending invite from the team by ID",
+  visibility: "customer",
+  tags: ["team", "users", "delete"],
+  async run({ token, id, isPendingInvite }, context) {
+    if (!token || typeof token !== "string") {
+      throw new Error("Delete user requires a session token");
+    }
+    if (!id || typeof id !== "string") {
+      throw new Error("Delete user requires an ID");
+    }
+    const resource = isPendingInvite ? "invites" : "users";
+    const endpoint = `${getApiOrigin()}/enterprise-portal/team/${resource}/${encodeURIComponent(id)}`;
+    if (process.env.NODE_ENV !== "production") {
+      console.debug("[portal-components] deleting %s %s via %s", resource, id, endpoint);
+    }
+    const response = await authenticatedFetch(endpoint, {
+      method: "DELETE",
+      token,
+      headers: { accept: "application/json" },
+      signal: context?.signal
+    });
+    if (!response.ok) {
+      let errorMessage = isPendingInvite ? "Failed to delete invite" : "Failed to delete user";
+      try {
+        const data = await response.json();
+        errorMessage = data.message || data.error || errorMessage;
+      } catch {
+      }
+      throw new Error(errorMessage);
+    }
+    return { success: true };
+  }
+});
+var fetchServiceAccounts = defineServerAction({
+  id: "team/fetch-service-accounts",
+  description: "Fetches paginated list of service accounts",
+  visibility: "customer",
+  tags: ["team", "service-accounts"],
+  async run({ token, limit = 50, offset = 0, includeRevoked = false }, context) {
+    if (!token || typeof token !== "string") {
+      throw new Error("Fetch service accounts requires a session token");
+    }
+    const customerId = getCustomerIdFromToken(token);
+    const params = new URLSearchParams({
+      customer_id: customerId,
+      limit: limit.toString(),
+      offset: offset.toString()
+    });
+    if (!includeRevoked) {
+      params.set("filterRevoked", "false");
+    }
+    const endpoint = `${getApiOrigin()}/enterprise-portal/team/service-accounts?${params.toString()}`;
+    if (process.env.NODE_ENV !== "production") {
+      console.debug("[portal-components] fetching service accounts via %s", endpoint);
+    }
+    const response = await authenticatedFetch(endpoint, {
+      method: "GET",
+      token,
+      headers: { accept: "application/json" },
+      signal: context?.signal
+    });
+    if (!response.ok) {
+      throw new Error(
+        `Fetch service accounts request failed (${response.status} ${response.statusText})`
+      );
+    }
+    const data = await response.json();
+    return {
+      serviceAccounts: data.serviceAccounts || [],
+      total: data.total || 0
+    };
+  }
+});
+var revokeServiceAccount = defineServerAction({
+  id: "team/revoke-service-account",
+  description: "Revokes a service account (soft delete)",
+  visibility: "customer",
+  tags: ["team", "service-accounts", "revoke"],
+  async run({ token, accountId }, context) {
+    if (!token || typeof token !== "string") {
+      throw new Error("Revoke service account requires a session token");
+    }
+    if (!accountId || typeof accountId !== "string") {
+      throw new Error("Revoke service account requires an account ID");
+    }
+    getCustomerIdFromToken(token);
+    const endpoint = `${getApiOrigin()}/enterprise-portal/team/service-accounts/${encodeURIComponent(accountId)}`;
+    if (process.env.NODE_ENV !== "production") {
+      console.debug("[portal-components] revoking service account via %s", endpoint);
+    }
+    const response = await authenticatedFetch(endpoint, {
+      method: "DELETE",
+      token,
+      headers: { accept: "application/json" },
+      signal: context?.signal
+    });
+    if (!response.ok) {
+      let errorMessage = "Failed to revoke service account";
+      try {
+        const data = await response.json();
+        errorMessage = data.message || data.error || errorMessage;
+      } catch {
+      }
+      throw new Error(errorMessage);
+    }
+    return { success: true };
+  }
+});
+var rotateServiceAccountToken = defineServerAction({
+  id: "team/rotate-service-account-token",
+  description: "Generates a new token for a service account",
+  visibility: "customer",
+  tags: ["team", "service-accounts", "rotate"],
+  async run({ token, accountId }, context) {
+    if (!token || typeof token !== "string") {
+      throw new Error("Rotate service account token requires a session token");
+    }
+    if (!accountId || typeof accountId !== "string") {
+      throw new Error("Rotate service account token requires an account ID");
+    }
+    getCustomerIdFromToken(token);
+    const endpoint = `${getApiOrigin()}/enterprise-portal/team/service-accounts/${encodeURIComponent(accountId)}/rotate-token`;
+    if (process.env.NODE_ENV !== "production") {
+      console.debug("[portal-components] rotating service account token via %s", endpoint);
+    }
+    const response = await authenticatedFetch(endpoint, {
+      method: "POST",
+      token,
+      headers: { accept: "application/json" },
+      signal: context?.signal
+    });
+    if (!response.ok) {
+      let errorMessage = "Failed to rotate service account token";
+      try {
+        const data2 = await response.json();
+        errorMessage = data2.message || data2.error || errorMessage;
+      } catch {
+      }
+      throw new Error(errorMessage);
+    }
+    const data = await response.json();
+    return {
+      serviceAccount: data.service_account,
+      helmLoginCommand: data.helm_login_cmd || "",
+      redeployHelm: data.redeploy_helm || []
+    };
+  }
+});
+var fetchInstances = defineServerAction({
+  id: "team/fetch-instances",
+  description: "Fetches instances to determine service account usage",
+  visibility: "customer",
+  tags: ["team", "instances"],
+  async run({ token }, context) {
+    if (!token || typeof token !== "string") {
+      throw new Error("Fetch instances requires a session token");
+    }
+    const customerId = getCustomerIdFromToken(token);
+    const endpoint = `${getApiOrigin()}/v3/instances?customer_id=${encodeURIComponent(customerId)}`;
+    if (process.env.NODE_ENV !== "production") {
+      console.debug("[portal-components] fetching instances via %s", endpoint);
+    }
+    const response = await authenticatedFetch(endpoint, {
+      method: "GET",
+      token,
+      headers: { accept: "application/json" },
+      signal: context?.signal
+    });
+    if (!response.ok) {
+      throw new Error(
+        `Fetch instances request failed (${response.status} ${response.statusText})`
+      );
+    }
+    const data = await response.json();
+    return {
+      instances: data.instances || []
+    };
+  }
+});
+var fetchSamlConfig = defineServerAction({
+  id: "team/fetch-saml-config",
+  description: "Fetches SAML SSO configuration for the team",
+  visibility: "customer",
+  tags: ["team", "saml"],
+  async run({ token }, context) {
+    if (!token || typeof token !== "string") {
+      throw new Error("Fetch SAML config requires a session token");
+    }
+    const customerId = getCustomerIdFromToken(token);
+    const endpoint = `${getApiOrigin()}/v3/customer/saml/config?customer_id=${encodeURIComponent(customerId)}`;
+    if (process.env.NODE_ENV !== "production") {
+      console.debug("[portal-components] fetching SAML config via %s", endpoint);
+    }
+    const response = await authenticatedFetch(endpoint, {
+      method: "GET",
+      token,
+      headers: { accept: "application/json" },
+      signal: context?.signal
+    });
+    if (!response.ok) {
+      throw new Error(
+        `Fetch SAML config request failed (${response.status} ${response.statusText})`
+      );
+    }
+    const data = await response.json();
+    return {
+      config: {
+        samlAllowed: data.samlAllowed || false,
+        samlEnabled: data.samlEnabled || false,
+        entityId: data.entityId || "",
+        acsUrl: data.acsUrl || "",
+        hasIdpMetadata: data.hasIdpMetadata || false,
+        hasIdpCert: data.hasIdpCert || false
+      }
+    };
+  }
+});
+var updateSamlConfig = defineServerAction({
+  id: "team/update-saml-config",
+  description: "Uploads IdP metadata and certificate for SAML SSO",
+  visibility: "customer",
+  tags: ["team", "saml", "update"],
+  async run({ token, idpMetadataXml, idpPublicCert }, context) {
+    if (!token || typeof token !== "string") {
+      throw new Error("Update SAML config requires a session token");
+    }
+    if (!idpMetadataXml || !idpPublicCert) {
+      throw new Error("Both IdP metadata and certificate are required");
+    }
+    const customerId = getCustomerIdFromToken(token);
+    const endpoint = `${getApiOrigin()}/v3/customer/saml/config?customer_id=${encodeURIComponent(customerId)}`;
+    if (process.env.NODE_ENV !== "production") {
+      console.debug("[portal-components] updating SAML config via %s", endpoint);
+    }
+    const response = await authenticatedFetch(endpoint, {
+      method: "PUT",
+      token,
+      headers: {
+        "content-type": "application/json",
+        accept: "application/json"
+      },
+      body: JSON.stringify({
+        idpMetadataXml,
+        idpPublicCert
+      }),
+      signal: context?.signal
+    });
+    if (!response.ok) {
+      let errorMessage = "Failed to update SAML configuration";
+      try {
+        const data = await response.json();
+        errorMessage = data.message || data.error || errorMessage;
+      } catch {
+      }
+      throw new Error(errorMessage);
+    }
+    return { success: true };
+  }
+});
+var toggleSamlEnabled = defineServerAction({
+  id: "team/toggle-saml-enabled",
+  description: "Enables or disables SAML authentication",
+  visibility: "customer",
+  tags: ["team", "saml", "toggle"],
+  async run({ token, enabled }, context) {
+    if (!token || typeof token !== "string") {
+      throw new Error("Toggle SAML enabled requires a session token");
+    }
+    const customerId = getCustomerIdFromToken(token);
+    const endpoint = `${getApiOrigin()}/v3/customer/saml/enable?customer_id=${encodeURIComponent(customerId)}`;
+    if (process.env.NODE_ENV !== "production") {
+      console.debug("[portal-components] toggling SAML enabled via %s", endpoint);
+    }
+    const response = await authenticatedFetch(endpoint, {
+      method: "PUT",
+      token,
+      headers: {
+        "content-type": "application/json",
+        accept: "application/json"
+      },
+      body: JSON.stringify({ enabled }),
+      signal: context?.signal
+    });
+    if (!response.ok) {
+      let errorMessage = "Failed to toggle SAML";
+      try {
+        const data2 = await response.json();
+        errorMessage = data2.message || data2.error || errorMessage;
+      } catch {
+      }
+      throw new Error(errorMessage);
+    }
+    const data = await response.json();
+    return {
+      success: true,
+      samlEnabled: data.samlEnabled || enabled
+    };
+  }
+});
+var deprovisionSaml = defineServerAction({
+  id: "team/deprovision-saml",
+  description: "Removes all SAML configuration",
+  visibility: "customer",
+  tags: ["team", "saml", "delete"],
+  async run({ token }, context) {
+    if (!token || typeof token !== "string") {
+      throw new Error("Deprovision SAML requires a session token");
+    }
+    const customerId = getCustomerIdFromToken(token);
+    const endpoint = `${getApiOrigin()}/v3/customer/saml/config?customer_id=${encodeURIComponent(customerId)}`;
+    if (process.env.NODE_ENV !== "production") {
+      console.debug("[portal-components] deprovisioning SAML via %s", endpoint);
+    }
+    const response = await authenticatedFetch(endpoint, {
+      method: "DELETE",
+      token,
+      headers: { accept: "application/json" },
+      signal: context?.signal
+    });
+    if (!response.ok) {
+      let errorMessage = "Failed to remove SAML configuration";
+      try {
+        const data = await response.json();
+        errorMessage = data.message || data.error || errorMessage;
+      } catch {
+      }
+      throw new Error(errorMessage);
+    }
+    return { success: true };
+  }
+});
+
+// src/actions/team-settings.ts
+async function fetchTeamUsersActionImpl(limit = 25, offset = 0) {
+  const sessionStore = await headers.cookies();
+  const session = sessionStore.get("portal_session");
+  if (!session?.value) {
+    throw new Error("No session found");
+  }
+  const result = await fetchTeamUsers.run({
+    token: session.value,
+    limit,
+    offset
+  });
+  let currentUserEmail;
+  try {
+    const payload = decodeJwtPayload(session.value);
+    currentUserEmail = payload?.email;
+  } catch {
+  }
+  return {
+    users: result.users,
+    total: result.total,
+    currentUserEmail
+  };
+}
+var fetchTeamUsersAction = traceServerAction("fetchTeamUsersAction", fetchTeamUsersActionImpl);
+async function inviteUserActionImpl(email) {
+  const sessionStore = await headers.cookies();
+  const session = sessionStore.get("portal_session");
+  if (!session?.value) {
+    throw new Error("No session found");
+  }
+  await inviteUser.run({
+    token: session.value,
+    email
+  });
+  cache.revalidatePath("/team-settings");
+  return { success: true };
+}
+var inviteUserAction = traceServerAction("inviteUserAction", inviteUserActionImpl);
+async function deleteUserActionImpl(id, isPendingInvite) {
+  const sessionStore = await headers.cookies();
+  const session = sessionStore.get("portal_session");
+  if (!session?.value) {
+    throw new Error("No session found");
+  }
+  await deleteUser.run({
+    token: session.value,
+    id,
+    isPendingInvite
+  });
+  cache.revalidatePath("/team-settings");
+  return { success: true };
+}
+var deleteUserAction = traceServerAction("deleteUserAction", deleteUserActionImpl);
+async function fetchServiceAccountsActionImpl(limit = 50, offset = 0, includeRevoked = false) {
+  const sessionStore = await headers.cookies();
+  const session = sessionStore.get("portal_session");
+  if (!session?.value) {
+    throw new Error("No session found");
+  }
+  const result = await fetchServiceAccounts.run({
+    token: session.value,
+    limit,
+    offset,
+    includeRevoked
+  });
+  return {
+    serviceAccounts: result.serviceAccounts,
+    total: result.total
+  };
+}
+var fetchServiceAccountsAction = traceServerAction("fetchServiceAccountsAction", fetchServiceAccountsActionImpl);
+async function createServiceAccountActionImpl(name) {
+  const sessionStore = await headers.cookies();
+  const session = sessionStore.get("portal_session");
+  if (!session?.value) {
+    throw new Error("No session found");
+  }
+  const result = await createServiceAccount.run({
+    token: session.value,
+    name
+  });
+  cache.revalidatePath("/team-settings");
+  return {
+    serviceAccount: {
+      id: result.service_account.id,
+      accountName: result.service_account.accountName
+    },
+    token: result.token
+  };
+}
+var createServiceAccountAction = traceServerAction("createServiceAccountAction", createServiceAccountActionImpl);
+async function revokeServiceAccountActionImpl(accountId) {
+  const sessionStore = await headers.cookies();
+  const session = sessionStore.get("portal_session");
+  if (!session?.value) {
+    throw new Error("No session found");
+  }
+  await revokeServiceAccount.run({
+    token: session.value,
+    accountId
+  });
+  cache.revalidatePath("/team-settings");
+  return { success: true };
+}
+var revokeServiceAccountAction = traceServerAction("revokeServiceAccountAction", revokeServiceAccountActionImpl);
+async function rotateServiceAccountTokenActionImpl(accountId) {
+  const sessionStore = await headers.cookies();
+  const session = sessionStore.get("portal_session");
+  if (!session?.value) {
+    throw new Error("No session found");
+  }
+  const result = await rotateServiceAccountToken.run({
+    token: session.value,
+    accountId
+  });
+  cache.revalidatePath("/team-settings");
+  return result;
+}
+var rotateServiceAccountTokenAction = traceServerAction("rotateServiceAccountTokenAction", rotateServiceAccountTokenActionImpl);
+async function fetchInstancesActionImpl() {
+  const sessionStore = await headers.cookies();
+  const session = sessionStore.get("portal_session");
+  if (!session?.value) {
+    throw new Error("No session found");
+  }
+  const result = await fetchInstances.run({
+    token: session.value
+  });
+  return result.instances;
+}
+var fetchInstancesAction = traceServerAction("fetchInstancesAction", fetchInstancesActionImpl);
+async function fetchSamlConfigActionImpl() {
+  const sessionStore = await headers.cookies();
+  const session = sessionStore.get("portal_session");
+  if (!session?.value) {
+    throw new Error("No session found");
+  }
+  const result = await fetchSamlConfig.run({
+    token: session.value
+  });
+  return result.config;
+}
+var fetchSamlConfigAction = traceServerAction("fetchSamlConfigAction", fetchSamlConfigActionImpl);
+async function updateSamlConfigActionImpl(idpMetadataXml, idpPublicCert) {
+  const sessionStore = await headers.cookies();
+  const session = sessionStore.get("portal_session");
+  if (!session?.value) {
+    throw new Error("No session found");
+  }
+  await updateSamlConfig.run({
+    token: session.value,
+    idpMetadataXml,
+    idpPublicCert
+  });
+  cache.revalidatePath("/team-settings");
+  return { success: true };
+}
+var updateSamlConfigAction = traceServerAction("updateSamlConfigAction", updateSamlConfigActionImpl);
+async function toggleSamlEnabledActionImpl(enabled) {
+  const sessionStore = await headers.cookies();
+  const session = sessionStore.get("portal_session");
+  if (!session?.value) {
+    throw new Error("No session found");
+  }
+  const result = await toggleSamlEnabled.run({
+    token: session.value,
+    enabled
+  });
+  cache.revalidatePath("/team-settings");
+  return result;
+}
+var toggleSamlEnabledAction = traceServerAction("toggleSamlEnabledAction", toggleSamlEnabledActionImpl);
+async function deprovisionSamlActionImpl() {
+  const sessionStore = await headers.cookies();
+  const session = sessionStore.get("portal_session");
+  if (!session?.value) {
+    throw new Error("No session found");
+  }
+  await deprovisionSaml.run({
+    token: session.value
+  });
+  cache.revalidatePath("/team-settings");
+  return { success: true };
+}
+var deprovisionSamlAction = traceServerAction("deprovisionSamlAction", deprovisionSamlActionImpl);
+async function fetchAppFeaturesImpl() {
+  const sessionStore = await headers.cookies();
+  const session = sessionStore.get("portal_session");
+  const appSlug = process.env.PORTAL_APP_SLUG;
+  if (!appSlug) {
+    throw new Error("PORTAL_APP_SLUG is not configured");
+  }
+  const params = new URLSearchParams({ app_slug: appSlug });
+  if (session?.value) {
+    try {
+      const payload = decodeJwtPayload(session.value);
+      const customerId = payload?.customer_id;
+      if (customerId) {
+        params.set("customer_id", customerId);
+      }
+    } catch {
+    }
+  }
+  const url = `${getApiOrigin()}/enterprise-portal/public/app-features?${params.toString()}`;
+  const response = await fetch(url, {
+    headers: {
+      Accept: "application/json"
+    }
+  });
+  if (!response.ok) {
+    throw new Error(`Failed to fetch app features: ${response.status} ${response.statusText}`);
+  }
+  const data = await response.json();
+  return {
+    epEnabled: data.ep_enabled ?? false,
+    trialSignupEnabled: data.trial_signup_enabled ?? false,
+    trialExpirationDays: data.trial_expiration_days ?? 30,
+    licenseType: data.license_type ?? "trial",
+    termsAndConditionsUrl: data.terms_and_conditions_url ?? "",
+    epSecurityCenterEnabled: data.ep_security_center_enabled ?? false,
+    epSamlAuthEnabled: data.ep_saml_auth_enabled ?? false,
+    epHideSupportBundleUploadEnabled: data.ep_hide_support_bundle_upload_enabled ?? false
+  };
+}
+var fetchAppFeatures = traceServerAction("fetchAppFeatures", fetchAppFeaturesImpl);
+
+exports.createServiceAccountAction = createServiceAccountAction;
+exports.deleteUserAction = deleteUserAction;
+exports.deprovisionSamlAction = deprovisionSamlAction;
+exports.fetchAppFeatures = fetchAppFeatures;
+exports.fetchInstancesAction = fetchInstancesAction;
+exports.fetchSamlConfigAction = fetchSamlConfigAction;
+exports.fetchServiceAccountsAction = fetchServiceAccountsAction;
+exports.fetchTeamUsersAction = fetchTeamUsersAction;
+exports.inviteUserAction = inviteUserAction;
+exports.revokeServiceAccountAction = revokeServiceAccountAction;
+exports.rotateServiceAccountTokenAction = rotateServiceAccountTokenAction;
+exports.toggleSamlEnabledAction = toggleSamlEnabledAction;
+exports.updateSamlConfigAction = updateSamlConfigAction;
+//# sourceMappingURL=team-settings.js.map
+//# sourceMappingURL=team-settings.js.map