@robosystems/core 0.6.2 → 0.7.0

package/auth-components/AuthGuard.js

@@ -2,6 +2,7 @@
 import { jsx as _jsx, Fragment as _Fragment } from "react/jsx-runtime";
 import { useRouter } from 'next/navigation';
 import { useEffect } from 'react';
+import { isSafeRelativePath } from '../auth-core/login-home';
 import { BrandSpinner } from '../ui-components';
 import { useAuth } from './AuthProvider';
 export function AuthGuard({ children, redirectTo = '/login', loadingComponent, }) {
@@ -9,15 +10,28 @@ export function AuthGuard({ children, redirectTo = '/login', loadingComponent, }
     const router = useRouter();
     useEffect(() => {
         if (!isLoading && !isAuthenticated) {
+            // Carry the intended destination so the login flow can land the user
+            // back where they were headed instead of the default landing page.
+            // A bare "/" carries no information — the default landing already
+            // covers it — so it is not forwarded.
+            let target = redirectTo;
+            if (typeof window !== 'undefined') {
+                const destination = window.location.pathname + window.location.search;
+                if (destination !== '/' &&
+                    destination !== redirectTo &&
+                    isSafeRelativePath(destination)) {
+                    target = `${redirectTo}?return_to=${encodeURIComponent(destination)}`;
+                }
+            }
             try {
-                router.push(redirectTo);
+                router.push(target);
             }
             catch (error) {
                 if (process.env.NODE_ENV === 'development') {
                     // Fallback to window.location if router.push fails
                     console.error('Router push failed, using window.location fallback:', error);
                 }
-                window.location.href = redirectTo;
+                window.location.href = target;
             }
         }
     }, [isAuthenticated, isLoading, router, redirectTo]);

package/auth-components/AuthProvider.d.ts

@@ -6,4 +6,11 @@ interface AuthProviderProps {
 }
 export declare function AuthProvider({ children, apiUrl, }: AuthProviderProps): import("react").JSX.Element;
 export declare function useAuth(): AuthContextType;
+/**
+ * Like `useAuth`, but returns `null` outside an `AuthProvider` instead of
+ * throwing. For components that integrate with auth when it is present but must
+ * still render without it — design-system previews and isolated component tests
+ * mount components with no provider around them.
+ */
+export declare function useOptionalAuth(): AuthContextType | null;
 export {};

package/auth-components/AuthProvider.js

@@ -5,7 +5,9 @@ import { clearEntitySelection } from '../actions/entity-actions';
 import { clearGraphSelection } from '../actions/graph-actions';
 import { performLogoutCleanup } from '../auth-core/cleanup';
 import { RoboSystemsAuthClient } from '../auth-core/client';
+import { CURRENT_APP, isLoginHome } from '../auth-core/config';
 import { useTokenExpiryHandler } from '../auth-core/hooks';
+import { buildLoginHomeUrl, buildReturnTo } from '../auth-core/login-home';
 import { getTimeUntilExpiry, getTokenStatus } from '../auth-core/token-storage';
 // Configuration constants
 const CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes
@@ -108,7 +110,7 @@ export function AuthProvider({ children, apiUrl = process.env.NEXT_PUBLIC_ROBOSY
             setIsLoading(false);
         }
     }, [authClient]);
-    const logout = useCallback(async (reason) => {
+    const logout = useCallback(async (reason, options) => {
         try {
             await authClient.logout();
         }
@@ -141,11 +143,29 @@ export function AuthProvider({ children, apiUrl = process.env.NEXT_PUBLIC_ROBOSY
             // authenticated tree tears down instead of AuthGuard flashing a blank
             // screen once user state clears. A forced logout (reason set, e.g.
             // session_expired) goes to the login page so it can explain why the
-            // session ended and let the user sign back in; a manual logout goes to
-            // the public homepage, since the user likely isn't trying to sign in
-            // again right away.
+            // session ended and let the user sign back in. A manual logout on a
+            // product app chains through the login home's /logout so the anchor
+            // session dies too — otherwise the next visit silently re-bridges and
+            // "log out" appears not to work. On the login home itself (and in
+            // single-app deployments, where the app is its own login home) manual
+            // logout goes to the public homepage. `options.redirectTo` overrides
+            // the destination — used by the login home's /logout route to land the
+            // user back on the app they came from.
             if (typeof window !== 'undefined') {
-                window.location.href = reason ? `/login?reason=${reason}` : '/';
+                if (options === null || options === void 0 ? void 0 : options.redirectTo) {
+                    window.location.href = options.redirectTo;
+                }
+                else if (reason) {
+                    window.location.href = `/login?reason=${reason}`;
+                }
+                else if (!isLoginHome()) {
+                    window.location.href = buildLoginHomeUrl('logout', {
+                        returnTo: buildReturnTo(CURRENT_APP),
+                    });
+                }
+                else {
+                    window.location.href = '/';
+                }
             }
         }
     }, [authClient]);
@@ -494,8 +514,8 @@ export function AuthProvider({ children, apiUrl = process.env.NEXT_PUBLIC_ROBOSY
             throw new Error(response.message || 'Registration failed');
         }
     };
-    const forgotPassword = async (email) => {
-        return authClient.forgotPassword(email);
+    const forgotPassword = async (email, options) => {
+        return authClient.forgotPassword(email, options);
     };
     const resetPassword = async (token, newPassword) => {
         const result = await authClient.resetPassword(token, newPassword);
@@ -534,8 +554,8 @@ export function AuthProvider({ children, apiUrl = process.env.NEXT_PUBLIC_ROBOSY
         }
         return result;
     };
-    const resendVerificationEmail = async (email) => {
-        return authClient.resendVerificationEmail(email);
+    const resendVerificationEmail = async (email, options) => {
+        return authClient.resendVerificationEmail(email, options);
     };
     const value = {
         user,
@@ -562,3 +582,12 @@ export function useAuth() {
     }
     return context;
 }
+/**
+ * Like `useAuth`, but returns `null` outside an `AuthProvider` instead of
+ * throwing. For components that integrate with auth when it is present but must
+ * still render without it — design-system previews and isolated component tests
+ * mount components with no provider around them.
+ */
+export function useOptionalAuth() {
+    return useContext(AuthContext);
+}

package/auth-components/LoginRedirector.d.ts

@@ -0,0 +1,20 @@
+export interface LoginRedirectorProps {
+    /** Which auth surface this page stands in for. */
+    mode?: 'login' | 'register';
+    apiUrl: string;
+    /** Where a completed bridge without a returnUrl lands. */
+    homePath?: string;
+}
+/**
+ * Product-app stand-in for the login/register pages under centralized login.
+ *
+ * Two jobs:
+ * - `?session_id=` present: consume the SSO bridge handoff exactly as the
+ *   full login page did. On failure it renders an error with a manual link
+ *   to the login home — never an automatic redirect, which with a live
+ *   anchor session would loop (login home re-bridges → fails → back again).
+ * - otherwise: redirect to the login home, upgrading a local `?return_to=`
+ *   path to app-qualified form and forwarding foreign query params
+ *   (e.g. `invite`) so mailed links keep working.
+ */
+export declare function LoginRedirector({ mode, apiUrl, homePath, }: LoginRedirectorProps): import("react").JSX.Element;

package/auth-components/LoginRedirector.js

@@ -0,0 +1,85 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useEffect, useRef, useState } from 'react';
+import { CURRENT_APP, isLoginHome } from '../auth-core/config';
+import { buildLoginHomeUrl, buildReturnTo, isSafeRelativePath, } from '../auth-core/login-home';
+import { useSSO } from '../auth-core/sso';
+import { BrandSpinner } from '../ui-components';
+/**
+ * Product-app stand-in for the login/register pages under centralized login.
+ *
+ * Two jobs:
+ * - `?session_id=` present: consume the SSO bridge handoff exactly as the
+ *   full login page did. On failure it renders an error with a manual link
+ *   to the login home — never an automatic redirect, which with a live
+ *   anchor session would loop (login home re-bridges → fails → back again).
+ * - otherwise: redirect to the login home, upgrading a local `?return_to=`
+ *   path to app-qualified form and forwarding foreign query params
+ *   (e.g. `invite`) so mailed links keep working.
+ */
+export function LoginRedirector({ mode = 'login', apiUrl, homePath = '/home', }) {
+    const { handleSSOLogin } = useSSO(apiUrl);
+    const [bridgeFailed, setBridgeFailed] = useState(false);
+    const [misconfigured, setMisconfigured] = useState(false);
+    const startedRef = useRef(false);
+    useEffect(() => {
+        var _a;
+        // Guard against StrictMode double-mount: the first run consumes
+        // session_id and strips it from the URL, so a second run would
+        // misread the state as a failed bridge.
+        if (startedRef.current) {
+            return;
+        }
+        startedRef.current = true;
+        const params = new URLSearchParams(window.location.search);
+        const sessionId = params.get('session_id');
+        if (sessionId) {
+            const returnUrl = params.get('returnUrl');
+            void handleSSOLogin().then((user) => {
+                if (user) {
+                    // With a returnUrl, handleSSOLogin navigates there itself.
+                    if (!returnUrl) {
+                        window.location.href = homePath;
+                    }
+                }
+                else {
+                    setBridgeFailed(true);
+                }
+            });
+            return;
+        }
+        // Never self-redirect: mounted on the app that IS the login home
+        // (misconfiguration — the login home renders real auth forms, not this
+        // redirector), buildLoginHomeUrl() resolves to this same app and
+        // window.location.replace() would loop. Fail safe with a static state,
+        // mirroring AuthProvider.logout's isLoginHome() guard.
+        if (isLoginHome()) {
+            console.error('[LoginRedirector] rendered on the login home app — refusing to self-redirect. Check NEXT_PUBLIC_LOGIN_HOME_APP / the centralized-login flag.');
+            setMisconfigured(true);
+            return;
+        }
+        const localReturnTo = params.get('return_to');
+        const path = localReturnTo && isSafeRelativePath(localReturnTo)
+            ? localReturnTo
+            : undefined;
+        const reason = (_a = params.get('reason')) !== null && _a !== void 0 ? _a : undefined;
+        // replace() keeps the redirector page out of history so Back returns
+        // to the page the user actually came from.
+        window.location.replace(buildLoginHomeUrl(mode, {
+            returnTo: buildReturnTo(CURRENT_APP, path),
+            reason,
+            forwardParams: params,
+        }));
+    }, [handleSSOLogin, mode, homePath]);
+    if (misconfigured) {
+        return (_jsxs("div", { className: "flex min-h-screen flex-col items-center justify-center gap-4 px-6 text-center", children: [_jsx("p", { className: "text-lg font-semibold text-gray-900 dark:text-white", children: "Sign-in is temporarily unavailable" }), _jsx("p", { className: "max-w-md text-sm text-gray-600 dark:text-gray-400", children: "This page is misconfigured. Please contact support if the problem persists." })] }));
+    }
+    if (bridgeFailed) {
+        const retryUrl = buildLoginHomeUrl(mode, {
+            returnTo: buildReturnTo(CURRENT_APP),
+            reason: 'bridge_failed',
+        });
+        return (_jsxs("div", { className: "flex min-h-screen flex-col items-center justify-center gap-4 px-6 text-center", children: [_jsx("p", { className: "text-lg font-semibold text-gray-900 dark:text-white", children: "Sign-in could not be completed" }), _jsx("p", { className: "max-w-md text-sm text-gray-600 dark:text-gray-400", children: "The sign-in handoff expired or was invalid. This can happen when a sign-in link is reused or takes too long to load." }), _jsx("a", { href: retryUrl, className: "rounded-lg bg-blue-600 px-4 py-2 text-sm font-medium text-white hover:bg-blue-700", children: "Continue to sign in" })] }));
+    }
+    return _jsx(BrandSpinner, { size: "xl", fullScreen: true });
+}

package/auth-components/SignInForm.d.ts

@@ -17,4 +17,10 @@ export interface SignInFormProps {
  * auth body) stays "Invalid email or password"; 5xx gets its own message.
  */
 export declare function loginErrorMessage(error: unknown): string;
+/**
+ * Messages for the `?reason=` a redirect into the login page can carry. The
+ * producer is `AuthProvider`'s `logout(reason)`, which sends the user to
+ * `/login?reason=<reason>`; without this the redirect arrives unexplained.
+ */
+export declare const SIGN_IN_NOTICES: Record<string, string>;
 export declare function SignInForm({ onSuccess, onRedirect, redirectTo, className, apiUrl, enableSSO, currentApp, }: SignInFormProps): React.JSX.Element;

package/auth-components/SignInForm.js

@@ -26,6 +26,16 @@ export function loginErrorMessage(error) {
     }
     return 'Invalid email or password';
 }
+/**
+ * Messages for the `?reason=` a redirect into the login page can carry. The
+ * producer is `AuthProvider`'s `logout(reason)`, which sends the user to
+ * `/login?reason=<reason>`; without this the redirect arrives unexplained.
+ */
+export const SIGN_IN_NOTICES = {
+    password_changed: 'Your password was updated. Please sign in with your new password.',
+    session_expired: 'Your session expired. Please sign in again.',
+    session_invalid: 'Your session is no longer valid. Please sign in again.',
+};
 export function SignInForm({ onSuccess, onRedirect, redirectTo = '/home', className = '', apiUrl, enableSSO = true, currentApp, }) {
     const [formData, setFormData] = useState({
         email: '',
@@ -35,6 +45,17 @@ export function SignInForm({ onSuccess, onRedirect, redirectTo = '/home', classN
     const [error, setError] = useState('');
     const [ssoChecking, setSSOChecking] = useState(enableSSO);
     const [redirecting, setRedirecting] = useState(false);
+    const [notice, setNotice] = useState('');
+    // Read via window.location rather than useSearchParams(): the latter forces
+    // the consuming app to wrap this component in a Suspense boundary during
+    // static prerender, and the login pages render it bare. Runs before the SSO
+    // effect below, which strips its own params from the URL.
+    useEffect(() => {
+        const reason = new URLSearchParams(window.location.search).get('reason');
+        if (reason && SIGN_IN_NOTICES[reason]) {
+            setNotice(SIGN_IN_NOTICES[reason]);
+        }
+    }, []);
     const authClient = useMemo(() => new RoboSystemsAuthClient(apiUrl), [apiUrl]);
     const { checkSSOAuthentication, handleSSOLogin } = useSSO(apiUrl);
     // Check for existing authentication or SSO login on mount
@@ -131,7 +152,7 @@ export function SignInForm({ onSuccess, onRedirect, redirectTo = '/home', classN
     if (ssoChecking || redirecting) {
         return (_jsx("div", { className: "via-primary-950 flex min-h-screen items-center justify-center bg-linear-to-br from-black to-zinc-900 p-6", children: _jsx("div", { className: "w-full max-w-md", children: _jsxs("div", { className: "text-center", children: [_jsx(LogoBadge, { animate: "loop", className: "mx-auto h-16 w-16" }), _jsx("h1", { className: "font-heading mt-4 text-center text-2xl font-semibold tracking-tight text-white", children: appName })] }) }) }));
     }
-    return (_jsx("div", { className: "via-primary-950 flex min-h-screen items-center justify-center bg-linear-to-br from-black to-zinc-900 px-4 py-12 sm:px-6 lg:px-8", children: _jsxs("div", { className: "w-full max-w-lg space-y-8", children: [_jsxs("div", { className: "text-center", children: [_jsx(LogoBadge, { animate: "once", className: "mx-auto h-14 w-14" }), _jsx("h1", { className: "font-heading mt-4 text-center text-2xl font-semibold tracking-tight text-white", children: appName }), _jsx("h2", { className: "mt-2 text-center text-xl font-semibold tracking-tight text-gray-300", children: "Sign in to your account" })] }), _jsxs("form", { className: ['mt-8 space-y-6', className].filter(Boolean).join(' '), onSubmit: handleSubmit, children: [error && (_jsx("div", { className: "rounded-md border border-red-800 bg-red-900/50 p-4", children: _jsx("div", { className: "text-sm text-red-300", children: error }) })), _jsxs("div", { className: "space-y-4", children: [_jsxs("div", { children: [_jsx("label", { htmlFor: "email", className: "sr-only", children: "Email address" }), _jsx("input", { id: "email", name: "email", type: "email", autoComplete: "email", required: true, value: formData.email, onChange: handleInputChange, className: "focus:ring-primary-500 relative block w-full rounded-md border-0 bg-gray-800 px-5 py-4 text-base leading-7 text-white ring-1 ring-gray-600 ring-inset placeholder:text-gray-400 focus:z-10 focus:ring-2 focus:ring-inset", placeholder: "Email address", disabled: loading || redirecting })] }), _jsxs("div", { children: [_jsx("label", { htmlFor: "password", className: "sr-only", children: "Password" }), _jsx("input", { id: "password", name: "password", type: "password", autoComplete: "current-password", required: true, value: formData.password, onChange: handleInputChange, className: "focus:ring-primary-500 relative block w-full rounded-md border-0 bg-gray-800 px-5 py-4 text-base leading-7 text-white ring-1 ring-gray-600 ring-inset placeholder:text-gray-400 focus:z-10 focus:ring-2 focus:ring-inset", placeholder: "Password", disabled: loading || redirecting })] })] }), _jsx("div", { children: _jsxs("button", { type: "submit", disabled: loading || redirecting, className: "group bg-primary-600 hover:bg-primary-700 focus-visible:outline-primary-500 relative flex w-full justify-center rounded-md px-4 py-3 text-sm font-semibold text-white focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-solid disabled:cursor-not-allowed disabled:opacity-50", children: [loading && _jsx(Spinner, { size: "sm", className: "mr-2 text-white" }), redirecting
+    return (_jsx("div", { className: "via-primary-950 flex min-h-screen items-center justify-center bg-linear-to-br from-black to-zinc-900 px-4 py-12 sm:px-6 lg:px-8", children: _jsxs("div", { className: "w-full max-w-lg space-y-8", children: [_jsxs("div", { className: "text-center", children: [_jsx(LogoBadge, { animate: "once", className: "mx-auto h-14 w-14" }), _jsx("h1", { className: "font-heading mt-4 text-center text-2xl font-semibold tracking-tight text-white", children: appName }), _jsx("h2", { className: "mt-2 text-center text-xl font-semibold tracking-tight text-gray-300", children: "Sign in to your account" })] }), _jsxs("form", { className: ['mt-8 space-y-6', className].filter(Boolean).join(' '), onSubmit: handleSubmit, children: [error && (_jsx("div", { className: "rounded-md border border-red-800 bg-red-900/50 p-4", children: _jsx("div", { className: "text-sm text-red-300", children: error }) })), notice && !error && (_jsx("div", { className: "border-primary-800 bg-primary-900/50 rounded-md border p-4", children: _jsx("div", { className: "text-primary-200 text-sm", children: notice }) })), _jsxs("div", { className: "space-y-4", children: [_jsxs("div", { children: [_jsx("label", { htmlFor: "email", className: "sr-only", children: "Email address" }), _jsx("input", { id: "email", name: "email", type: "email", autoComplete: "email", required: true, value: formData.email, onChange: handleInputChange, className: "focus:ring-primary-500 relative block w-full rounded-md border-0 bg-gray-800 px-5 py-4 text-base leading-7 text-white ring-1 ring-gray-600 ring-inset placeholder:text-gray-400 focus:z-10 focus:ring-2 focus:ring-inset", placeholder: "Email address", disabled: loading || redirecting })] }), _jsxs("div", { children: [_jsx("label", { htmlFor: "password", className: "sr-only", children: "Password" }), _jsx("input", { id: "password", name: "password", type: "password", autoComplete: "current-password", required: true, value: formData.password, onChange: handleInputChange, className: "focus:ring-primary-500 relative block w-full rounded-md border-0 bg-gray-800 px-5 py-4 text-base leading-7 text-white ring-1 ring-gray-600 ring-inset placeholder:text-gray-400 focus:z-10 focus:ring-2 focus:ring-inset", placeholder: "Password", disabled: loading || redirecting })] })] }), _jsx("div", { children: _jsxs("button", { type: "submit", disabled: loading || redirecting, className: "group bg-primary-600 hover:bg-primary-700 focus-visible:outline-primary-500 relative flex w-full justify-center rounded-md px-4 py-3 text-sm font-semibold text-white focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-solid disabled:cursor-not-allowed disabled:opacity-50", children: [loading && _jsx(Spinner, { size: "sm", className: "mr-2 text-white" }), redirecting
                                         ? 'Redirecting...'
                                         : loading
                                             ? 'Signing in...'

package/auth-components/index.d.ts

@@ -1,6 +1,7 @@
 export { AppSwitcher } from './AppSwitcher';
 export { AuthGuard } from './AuthGuard';
-export { AuthProvider, useAuth } from './AuthProvider';
+export { AuthProvider, useAuth, useOptionalAuth } from './AuthProvider';
+export { LoginRedirector } from './LoginRedirector';
 export { SignInForm } from './SignInForm';
 export { SignUpForm } from './SignUpForm';
 export { TurnstileWidget, useTurnstile } from './TurnstileWidget';

package/auth-components/index.js

@@ -1,6 +1,7 @@
 export { AppSwitcher } from './AppSwitcher';
 export { AuthGuard } from './AuthGuard';
-export { AuthProvider, useAuth } from './AuthProvider';
+export { AuthProvider, useAuth, useOptionalAuth } from './AuthProvider';
+export { LoginRedirector } from './LoginRedirector';
 export { SignInForm } from './SignInForm';
 export { SignUpForm } from './SignUpForm';
 export { TurnstileWidget, useTurnstile } from './TurnstileWidget';

package/auth-core/client.d.ts

@@ -35,7 +35,9 @@ export declare class RoboSystemsAuthClient {
      */
     private syncClientConfigToken;
     login(email: string, password: string): Promise<AuthResponse>;
-    register(email: string, password: string, name?: string, captchaToken?: string, inviteToken?: string): Promise<AuthResponse>;
+    register(email: string, password: string, name?: string, captchaToken?: string, inviteToken?: string, options?: {
+        appSource?: string;
+    }): Promise<AuthResponse>;
     logout(): Promise<void>;
     getCurrentUser(): Promise<AuthUser>;
     private performAuthCheck;
@@ -57,7 +59,9 @@ export declare class RoboSystemsAuthClient {
     /**
      * Send password reset email
      */
-    forgotPassword(email: string): Promise<{
+    forgotPassword(email: string, options?: {
+        appSource?: string;
+    }): Promise<{
         success: boolean;
         message?: string;
     }>;
@@ -87,7 +91,9 @@ export declare class RoboSystemsAuthClient {
     /**
      * Resend verification email
      */
-    resendVerificationEmail(email: string): Promise<{
+    resendVerificationEmail(email: string, options?: {
+        appSource?: string;
+    }): Promise<{
         success: boolean;
         message?: string;
     }>;

package/auth-core/client.js

@@ -18,6 +18,15 @@ const setSDKClientConfig = (_a = sdkClientsModule.setSDKClientConfig) !== null &
 // Configuration constants
 const CACHE_TTL_MS = 30 * 1000; // 30 seconds - optimized for performance
 const ERROR_CACHE_TTL_MS = 5 * 1000; // 5 seconds - allow reasonable retry delay
+/**
+ * Identifies which product app an auth request originates from, for email
+ * branding. Under centralized login every interactive auth request comes
+ * from the login home, so Referer-based detection on the backend collapses
+ * to one app — the originating app (from `return_to`) rides this header
+ * instead.
+ */
+const APP_SOURCE_HEADER = 'X-App-Source';
+const appSourceHeaders = (appSource) => appSource ? { [APP_SOURCE_HEADER]: appSource } : undefined;
 // Custom error class for token expiry
 export class TokenExpiredError extends Error {
     constructor(message = 'Token expired') {
@@ -200,7 +209,7 @@ export class RoboSystemsAuthClient {
             refresh_threshold: sdkResponse.refresh_threshold,
         };
     }
-    async register(email, password, name, captchaToken, inviteToken) {
+    async register(email, password, name, captchaToken, inviteToken, options) {
         const response = await registerUser({
             client: this.client,
             body: {
@@ -210,6 +219,7 @@ export class RoboSystemsAuthClient {
                 captcha_token: captchaToken || undefined,
                 invite_token: inviteToken || undefined,
             },
+            headers: appSourceHeaders(options === null || options === void 0 ? void 0 : options.appSource),
         });
         // Check for error responses (4xx/5xx)
         if (response.error) {
@@ -490,11 +500,12 @@ export class RoboSystemsAuthClient {
     /**
      * Send password reset email
      */
-    async forgotPassword(email) {
+    async forgotPassword(email, options) {
         try {
             await forgotPassword({
                 client: this.client,
                 body: { email },
+                headers: appSourceHeaders(options === null || options === void 0 ? void 0 : options.appSource),
             });
             return {
                 success: true,
@@ -616,11 +627,12 @@ export class RoboSystemsAuthClient {
     /**
      * Resend verification email
      */
-    async resendVerificationEmail(email) {
+    async resendVerificationEmail(email, options) {
         try {
             await resendVerificationEmail({
                 client: this.client,
                 body: { email },
+                headers: appSourceHeaders(options === null || options === void 0 ? void 0 : options.appSource),
             });
             return {
                 success: true,

package/auth-core/config.d.ts

@@ -17,3 +17,11 @@ export declare const BRAND_COLORS: Record<AppName, string>;
 export declare const BRAND_GRADIENTS: Record<AppName, string>;
 export declare const APP_CONFIGS: Record<string, AppConfig>;
 export declare const getAppConfig: (appName: string) => AppConfig;
+/**
+ * The app hosting the interactive auth surface ("login home"). Product apps
+ * redirect login/register there; single-app deployments designate their own
+ * app key so the architecture degrades to local auth by config.
+ */
+export declare const LOGIN_HOME_APP: AppName;
+export declare const getLoginHomeUrl: () => string;
+export declare const isLoginHome: () => boolean;

package/auth-core/config.js

@@ -54,3 +54,11 @@ export const APP_CONFIGS = {
 export const getAppConfig = (appName) => {
     return APP_CONFIGS[appName] || APP_CONFIGS.robosystems;
 };
+/**
+ * The app hosting the interactive auth surface ("login home"). Product apps
+ * redirect login/register there; single-app deployments designate their own
+ * app key so the architecture degrades to local auth by config.
+ */
+export const LOGIN_HOME_APP = process.env.NEXT_PUBLIC_LOGIN_HOME_APP || 'robosystems';
+export const getLoginHomeUrl = () => getAppConfig(LOGIN_HOME_APP).url;
+export const isLoginHome = () => CURRENT_APP === LOGIN_HOME_APP;

package/auth-core/index.d.ts

@@ -2,5 +2,6 @@ export * from './cleanup';
 export * from './client';
 export * from './config';
 export * from './hooks';
+export * from './login-home';
 export * from './sso';
 export * from './types';

package/auth-core/index.js

@@ -2,5 +2,6 @@ export * from './cleanup';
 export * from './client';
 export * from './config';
 export * from './hooks';
+export * from './login-home';
 export * from './sso';
 export * from './types';

package/auth-core/login-home.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Helpers for the centralized login home.
+ *
+ * Interactive auth (login/register/verify/reset) renders on one designated
+ * app — the "login home" — and product apps redirect to it carrying a
+ * `return_to` value so the user is bridged back after authenticating.
+ *
+ * `return_to` grammar: `app` or `app:/path`. The app segment is validated
+ * against APP_CONFIGS; the path must be a same-app relative path. Never a
+ * free-form URL — an open redirect on a login surface is a phishing
+ * amplifier.
+ */
+export interface ParsedReturnTo {
+    app: string;
+    /** Relative path on the target app, or null for its default landing. */
+    path: string | null;
+}
+/**
+ * True when `path` is a same-app relative path. Rejects scheme-relative
+ * URLs ("//host"), absolute URLs, backslashes (browsers normalize
+ * "/\host" to "//host"), and ASCII tab/newline characters (browsers
+ * strip those before URL parsing, so "/<TAB>/host" would normalize
+ * to "//host").
+ */
+export declare function isSafeRelativePath(path: string): boolean;
+/** Build a `return_to` value. An unsafe path degrades to app-only. */
+export declare function buildReturnTo(app: string, path?: string | null): string;
+/**
+ * Parse a raw `return_to` query value (already URL-decoded by
+ * URLSearchParams — do not decode again). Unknown apps return null;
+ * an unsafe path degrades to the app's default landing.
+ */
+export declare function parseReturnTo(raw: string | null | undefined): ParsedReturnTo | null;
+export interface LoginHomeUrlOptions {
+    /** `return_to` value (build with buildReturnTo). */
+    returnTo?: string;
+    /** Sign-in notice key (e.g. session_expired) rendered by the login home. */
+    reason?: string;
+    /**
+     * Query params to carry through to the login home (e.g. `invite`).
+     * Params owned by the redirect/bridge flow are dropped.
+     */
+    forwardParams?: URLSearchParams;
+}
+/** Build an absolute URL on the login home for the given auth surface. */
+export declare function buildLoginHomeUrl(mode: 'login' | 'register' | 'logout', options?: LoginHomeUrlOptions): string;

package/auth-core/login-home.js

@@ -0,0 +1,61 @@
+import { APP_CONFIGS, getLoginHomeUrl } from './config';
+/**
+ * True when `path` is a same-app relative path. Rejects scheme-relative
+ * URLs ("//host"), absolute URLs, backslashes (browsers normalize
+ * "/\host" to "//host"), and ASCII tab/newline characters (browsers
+ * strip those before URL parsing, so "/<TAB>/host" would normalize
+ * to "//host").
+ */
+export function isSafeRelativePath(path) {
+    if (!path.startsWith('/') || path.startsWith('//')) {
+        return false;
+    }
+    return !/[\\\t\n\r]/.test(path);
+}
+/** Build a `return_to` value. An unsafe path degrades to app-only. */
+export function buildReturnTo(app, path) {
+    if (path && isSafeRelativePath(path)) {
+        return `${app}:${path}`;
+    }
+    return app;
+}
+/**
+ * Parse a raw `return_to` query value (already URL-decoded by
+ * URLSearchParams — do not decode again). Unknown apps return null;
+ * an unsafe path degrades to the app's default landing.
+ */
+export function parseReturnTo(raw) {
+    if (!raw) {
+        return null;
+    }
+    const separator = raw.indexOf(':');
+    const app = separator === -1 ? raw : raw.slice(0, separator);
+    const path = separator === -1 ? null : raw.slice(separator + 1);
+    if (!APP_CONFIGS[app]) {
+        return null;
+    }
+    if (path !== null && !isSafeRelativePath(path)) {
+        return { app, path: null };
+    }
+    return { app, path };
+}
+/** Params the redirect/bridge flow owns; never forwarded verbatim. */
+const OWNED_PARAMS = new Set(['session_id', 'returnUrl', 'return_to', 'reason']);
+/** Build an absolute URL on the login home for the given auth surface. */
+export function buildLoginHomeUrl(mode, options = {}) {
+    const url = new URL(`/${mode}`, getLoginHomeUrl());
+    if (options.forwardParams) {
+        options.forwardParams.forEach((value, key) => {
+            if (!OWNED_PARAMS.has(key)) {
+                url.searchParams.append(key, value);
+            }
+        });
+    }
+    if (options.returnTo) {
+        url.searchParams.set('return_to', options.returnTo);
+    }
+    if (options.reason) {
+        url.searchParams.set('reason', options.reason);
+    }
+    return url.toString();
+}

package/auth-core/types.d.ts

@@ -71,10 +71,14 @@ export interface AuthContextType {
     };
     login: (email: string, password: string) => Promise<AuthUser>;
     register: (email: string, password: string, name?: string) => Promise<AuthUser>;
-    logout: () => Promise<void>;
+    logout: (reason?: string, options?: {
+        redirectTo?: string;
+    }) => Promise<void>;
     refreshUser: () => Promise<AuthUser | null>;
     refreshSession: (force?: boolean) => Promise<void>;
-    forgotPassword: (email: string) => Promise<{
+    forgotPassword: (email: string, options?: {
+        appSource?: string;
+    }) => Promise<{
         success: boolean;
         message?: string;
     }>;
@@ -92,7 +96,9 @@ export interface AuthContextType {
         message?: string;
         user?: AuthUser;
     }>;
-    resendVerificationEmail: (email: string) => Promise<{
+    resendVerificationEmail: (email: string, options?: {
+        appSource?: string;
+    }) => Promise<{
         success: boolean;
         message?: string;
     }>;

package/index.d.ts

@@ -1,7 +1,7 @@
 export * as AuthCore from './auth-core';
 export { clearToken, getAuthHeader, getToken, getValidToken, handleAuthResponse, hasValidToken, storeToken, } from './auth-core/token-storage';
 export { clearUserCookies, clearUserLocalStorage, clearUserSessionStorage, listUserData, performLogoutCleanup, resetUIState, } from './auth-core/cleanup';
-export { AppSwitcher, AuthGuard, AuthProvider, SignInForm, SignUpForm, useAuth, } from './auth-components';
+export { AppSwitcher, AuthGuard, AuthProvider, LoginRedirector, SignInForm, SignUpForm, useAuth, } from './auth-components';
 export { useApiError, useMediaQuery, useToast, useUser, useUserLimits, type ToastMessage, } from './hooks';
 export { createGraphContext, createGraphProvider, createUseGraphContext, EntityProvider, GraphContext, GraphProvider, OrgProvider, ServiceOfferingsProvider, SidebarProvider, useEntity, useGraphContext, useOrg, useServiceOfferings, useSidebarContext, type EntityContextValue, type EntityProviderProps, type GraphContextValue, type GraphProviderProps, type GraphState, type OrgContextState, type OrgContextValue, type OrgProviderProps, type ServiceOfferings, } from './contexts';
 export { clientGraphCookie, clientSidebarCookie, createMcpConnectorUrl, entityCookie, graphCookie, sidebarCookie, type EntityCookie, type GraphCookie, type McpConnectorUrl, type SidebarCookie, } from './lib';
@@ -28,3 +28,6 @@ import { client } from '@robosystems/client';
 export { client };
 export type { APIKey, AppName, AuthContextType, AuthUser } from './auth-core';
 export { CURRENT_APP } from './auth-core/config';
+export { getLoginHomeUrl, isLoginHome, LOGIN_HOME_APP, } from './auth-core/config';
+export { buildLoginHomeUrl, buildReturnTo, isSafeRelativePath, parseReturnTo, } from './auth-core/login-home';
+export type { LoginHomeUrlOptions, ParsedReturnTo, } from './auth-core/login-home';

package/index.js

@@ -6,7 +6,7 @@ export { clearToken, getAuthHeader, getToken, getValidToken, handleAuthResponse,
 // Export auth cleanup utilities
 export { clearUserCookies, clearUserLocalStorage, clearUserSessionStorage, listUserData, performLogoutCleanup, resetUIState, } from './auth-core/cleanup';
 // Export auth-components
-export { AppSwitcher, AuthGuard, AuthProvider, SignInForm, SignUpForm, useAuth, } from './auth-components';
+export { AppSwitcher, AuthGuard, AuthProvider, LoginRedirector, SignInForm, SignUpForm, useAuth, } from './auth-components';
 // Export hooks
 export { useApiError, useMediaQuery, useToast, useUser, useUserLimits, } from './hooks';
 // Export contexts
@@ -75,3 +75,6 @@ if (process.env.NODE_ENV !== 'test') {
 export { client };
 // App identity
 export { CURRENT_APP } from './auth-core/config';
+// Centralized login home
+export { getLoginHomeUrl, isLoginHome, LOGIN_HOME_APP, } from './auth-core/config';
+export { buildLoginHomeUrl, buildReturnTo, isSafeRelativePath, parseReturnTo, } from './auth-core/login-home';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@robosystems/core",
-  "version": "0.6.2",
+  "version": "0.7.0",
   "description": "Shared RoboSystems frontend core library (auth, contexts, task monitoring, UI components) for the RoboSystems Next.js apps",
   "license": "MIT",
   "private": false,

package/ui-components/settings/PasswordInformationCard.js

@@ -4,6 +4,8 @@ import * as SDK from '@robosystems/client';
 import { Button } from 'flowbite-react';
 import { useCallback, useEffect, useRef, useState } from 'react';
 import { HiLockClosed } from 'react-icons/hi';
+import { useOptionalAuth } from '../../auth-components/AuthProvider';
+import { ConfirmModal } from '../ConfirmModal';
 import { Spinner } from '../Spinner';
 import { SettingsCard } from '../forms/SettingsCard';
 import { SettingsFormField } from '../forms/SettingsFormField';
@@ -15,7 +17,10 @@ export const PasswordInformationCard = ({ theme, onUpdate = undefined, onSuccess
     const [newPassword, setNewPassword] = useState('');
     const [passwordStrength, setPasswordStrength] = useState(null);
     const [checkingPassword, setCheckingPassword] = useState(false);
+    const [pendingUpdate, setPendingUpdate] = useState(null);
     const debounceRef = useRef(null);
+    const formRef = useRef(null);
+    const auth = useOptionalAuth();
     const checkPassword = useCallback(async (password) => {
         if (password.length < 4) {
             setPasswordStrength(null);
@@ -57,8 +62,7 @@ export const PasswordInformationCard = ({ theme, onUpdate = undefined, onSuccess
                 clearTimeout(debounceRef.current);
         };
     }, [newPassword, checkPassword]);
-    const handleSubmit = async (event) => {
-        var _a, _b, _c;
+    const handleSubmit = (event) => {
         event.preventDefault();
         setError(null);
         setSuccess(false);
@@ -95,18 +99,25 @@ export const PasswordInformationCard = ({ theme, onUpdate = undefined, onSuccess
             }
             return;
         }
+        // A password change ends every session, this one included, so take an
+        // explicit confirmation before doing something the user can't walk back.
+        setPendingUpdate(updateData);
+    };
+    const handleConfirm = async () => {
+        var _a, _b, _c, _d;
+        if (!pendingUpdate)
+            return;
         setIsLoading(true);
-        const form = event.currentTarget;
         try {
             if (onUpdate) {
-                await onUpdate(updateData);
+                await onUpdate(pendingUpdate);
             }
             else {
                 const response = await SDK.updateUserPassword({
                     body: {
-                        current_password: updateData.currentPassword,
-                        new_password: updateData.newPassword,
-                        confirm_password: updateData.confirmPassword,
+                        current_password: pendingUpdate.currentPassword,
+                        new_password: pendingUpdate.newPassword,
+                        confirm_password: pendingUpdate.confirmPassword,
                     },
                 });
                 if (response.error) {
@@ -116,14 +127,28 @@ export const PasswordInformationCard = ({ theme, onUpdate = undefined, onSuccess
                     throw new Error(typeof detail === 'string' ? detail : 'Failed to update password.');
                 }
             }
+            setPendingUpdate(null);
             if (onSuccess) {
                 onSuccess('Password updated successfully.');
             }
             else {
                 setSuccess(true);
             }
+            // The server invalidates every session on a password change, so the token
+            // this app holds is already dead. Sign out deliberately instead of
+            // letting it fail on the next request as an unexplained error.
+            if (auth) {
+                try {
+                    await auth.logout('password_changed');
+                    return; // navigating away — leave the card as-is
+                }
+                catch (_e) {
+                    // The password did change; only the redirect failed. Fall through so
+                    // the card resets rather than sitting on a spinner.
+                }
+            }
             // Clear form fields and strength state
-            form.reset();
+            (_d = formRef.current) === null || _d === void 0 ? void 0 : _d.reset();
             setNewPassword('');
             setPasswordStrength(null);
             setTimeout(() => {
@@ -141,6 +166,7 @@ export const PasswordInformationCard = ({ theme, onUpdate = undefined, onSuccess
             else {
                 setError(msg);
             }
+            setPendingUpdate(null);
             setIsLoading(false);
         }
     };
@@ -162,6 +188,6 @@ export const PasswordInformationCard = ({ theme, onUpdate = undefined, onSuccess
                 : passwordStrength.score < 80
                     ? 'text-primary-300'
                     : 'text-green-400';
-    return (_jsxs(SettingsCard, { title: "Password information", description: "Update your password to keep your account secure", icon: HiLockClosed, theme: theme === null || theme === void 0 ? void 0 : theme.card, className: className, children: [_jsxs("div", { className: "space-y-4", children: [error && (_jsx(StatusAlert, { type: "error", message: error, theme: theme === null || theme === void 0 ? void 0 : theme.alert })), success && (_jsx(StatusAlert, { type: "success", message: "Password updated successfully.", theme: theme === null || theme === void 0 ? void 0 : theme.alert }))] }), _jsx("form", { onSubmit: handleSubmit, children: _jsxs("div", { className: "space-y-4", children: [_jsx("div", { className: "grid gap-4 md:grid-cols-2", children: _jsx(SettingsFormField, { id: "currentPassword", label: "Current password", type: "password", placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022", theme: theme }) }), _jsxs("div", { className: "grid items-start gap-4 md:grid-cols-2", children: [_jsxs("div", { children: [_jsx(SettingsFormField, { id: "newPassword", label: "New password", type: "password", placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022", theme: theme, onChange: (e) => setNewPassword(e.target.value) }), _jsx("div", { className: "mt-2 min-h-[2.75rem]", children: passwordStrength && (_jsxs("div", { className: "space-y-1.5", children: [_jsxs("div", { className: "flex items-center gap-2", children: [_jsx("div", { className: "h-1.5 flex-1 overflow-hidden rounded-full bg-gray-700", children: _jsx("div", { className: `h-full rounded-full transition-all duration-300 ${strengthBarColor}`, style: { width: `${passwordStrength.score}%` } }) }), _jsx("span", { className: `text-xs font-medium capitalize ${strengthTextColor}`, children: passwordStrength.strength.replace('-', ' ') })] }), passwordStrength.errors.length > 0 && (_jsx("p", { className: "text-xs text-red-400", children: passwordStrength.errors[0] })), passwordStrength.errors.length === 0 &&
-                                                        passwordStrength.suggestions.length > 0 && (_jsx("p", { className: "text-xs text-gray-400", children: passwordStrength.suggestions[0] }))] })) })] }), _jsx(SettingsFormField, { id: "confirmPassword", label: "Confirm password", type: "password", placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022", theme: theme })] }), _jsx("div", { className: "flex justify-end pt-2", children: _jsx(Button, { theme: theme === null || theme === void 0 ? void 0 : theme.button, color: "blue", type: "submit", disabled: isLoading || checkingPassword, children: isLoading ? (_jsx(Spinner, { size: "sm", className: "text-white" })) : ('Update Password') }) })] }) })] }));
+    return (_jsxs(SettingsCard, { title: "Password information", description: "Update your password to keep your account secure", icon: HiLockClosed, theme: theme === null || theme === void 0 ? void 0 : theme.card, className: className, children: [_jsxs("div", { className: "space-y-4", children: [error && (_jsx(StatusAlert, { type: "error", message: error, theme: theme === null || theme === void 0 ? void 0 : theme.alert })), success && (_jsx(StatusAlert, { type: "success", message: "Password updated successfully.", theme: theme === null || theme === void 0 ? void 0 : theme.alert }))] }), _jsx("form", { ref: formRef, onSubmit: handleSubmit, children: _jsxs("div", { className: "space-y-4", children: [_jsx("div", { className: "grid gap-4 md:grid-cols-2", children: _jsx(SettingsFormField, { id: "currentPassword", label: "Current password", type: "password", placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022", theme: theme }) }), _jsxs("div", { className: "grid items-start gap-4 md:grid-cols-2", children: [_jsxs("div", { children: [_jsx(SettingsFormField, { id: "newPassword", label: "New password", type: "password", placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022", theme: theme, onChange: (e) => setNewPassword(e.target.value) }), _jsx("div", { className: "mt-2 min-h-[2.75rem]", children: passwordStrength && (_jsxs("div", { className: "space-y-1.5", children: [_jsxs("div", { className: "flex items-center gap-2", children: [_jsx("div", { className: "h-1.5 flex-1 overflow-hidden rounded-full bg-gray-700", children: _jsx("div", { className: `h-full rounded-full transition-all duration-300 ${strengthBarColor}`, style: { width: `${passwordStrength.score}%` } }) }), _jsx("span", { className: `text-xs font-medium capitalize ${strengthTextColor}`, children: passwordStrength.strength.replace('-', ' ') })] }), passwordStrength.errors.length > 0 && (_jsx("p", { className: "text-xs text-red-400", children: passwordStrength.errors[0] })), passwordStrength.errors.length === 0 &&
+                                                        passwordStrength.suggestions.length > 0 && (_jsx("p", { className: "text-xs text-gray-400", children: passwordStrength.suggestions[0] }))] })) })] }), _jsx(SettingsFormField, { id: "confirmPassword", label: "Confirm password", type: "password", placeholder: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022", theme: theme })] }), _jsx("div", { className: "flex justify-end pt-2", children: _jsx(Button, { theme: theme === null || theme === void 0 ? void 0 : theme.button, color: "blue", type: "submit", disabled: isLoading || checkingPassword, children: isLoading ? (_jsx(Spinner, { size: "sm", className: "text-white" })) : ('Update Password') }) })] }) }), _jsx(ConfirmModal, { show: pendingUpdate !== null, onClose: () => setPendingUpdate(null), onConfirm: handleConfirm, loading: isLoading, title: "Change password", confirmLabel: "Change password", loadingLabel: "Changing\u2026", confirmColor: "blue", confirmIcon: HiLockClosed, children: _jsx("p", { className: "text-sm text-gray-300", children: "Changing your password signs you out everywhere, including on this device. You'll need to sign in again with your new password." }) })] }));
 };