@stigmer/react 0.0.71 → 0.0.73

package/src/identity-provider/presets.ts

@@ -0,0 +1,262 @@
+/**
+ * Provider presets for well-known OIDC identity providers.
+ *
+ * Each preset defines URL templates and required user variables for a
+ * specific provider. The {@link ProviderPreset.buildConfig} function
+ * constructs the full OIDC configuration from the user's input without
+ * any network calls — URL patterns are deterministic for known providers.
+ *
+ * The "custom" preset is a special case: it collects an issuer URL and
+ * delegates to OIDC Discovery for auto-population.
+ */
+
+/** OIDC configuration derived from a provider preset or discovery. */
+export interface ProviderConfig {
+  /** The OIDC issuer URL (e.g. `https://accounts.google.com`). */
+  readonly issuer: string;
+  /** URL of the JSON Web Key Set endpoint for token verification. */
+  readonly jwksUri: string;
+  /** Issuer URLs accepted during token validation (may include aliases). */
+  readonly allowedIssuers: readonly string[];
+  /** OIDC UserInfo endpoint for fetching profile claims. */
+  readonly userinfoEndpoint?: string;
+}
+
+/** A user-fillable variable required by a provider preset. */
+export interface ProviderVariable {
+  /** Unique identifier used as the key in the collected values record. */
+  readonly key: string;
+  /** Human-readable label displayed next to the input field. */
+  readonly label: string;
+  /** Placeholder text shown inside the empty input field. */
+  readonly placeholder: string;
+  /** Optional helper text displayed below the input field. */
+  readonly hint?: string;
+  /** Input type: `"text"` for free-form input, `"select"` for a dropdown. */
+  readonly type: "text" | "select";
+  /** Available options when `type` is `"select"`. */
+  readonly options?: readonly {
+    /** Option value submitted to the config builder. */
+    readonly value: string;
+    /** Display label shown in the dropdown. */
+    readonly label: string;
+  }[];
+}
+
+/** A well-known identity provider preset with URL templates. */
+export interface ProviderPreset {
+  /** Stable identifier for this preset (e.g. `"auth0"`, `"okta"`, `"custom"`). */
+  readonly id: string;
+  /** Display name shown in the provider selection UI. */
+  readonly label: string;
+  /** Short description of the provider, shown below the label. */
+  readonly description: string;
+  /** Variables the user must fill in to construct the OIDC configuration. */
+  readonly variables: readonly ProviderVariable[];
+  /**
+   * Build the OIDC configuration from the user's variable values.
+   *
+   * Returns `null` for the "custom" preset — custom providers use OIDC
+   * Discovery instead of template-based construction.
+   */
+  readonly buildConfig: (vars: Record<string, string>) => ProviderConfig | null;
+}
+
+// ---------------------------------------------------------------------------
+// Auth0
+// ---------------------------------------------------------------------------
+
+const auth0Preset: ProviderPreset = {
+  id: "auth0",
+  label: "Auth0",
+  description: "Auth0 by Okta — universal login and identity platform",
+  variables: [
+    {
+      key: "tenant",
+      label: "Tenant name",
+      placeholder: "acme-prod",
+      hint: "The subdomain from your Auth0 tenant URL",
+      type: "text",
+    },
+    {
+      key: "region",
+      label: "Region",
+      placeholder: "us",
+      type: "select",
+      options: [
+        { value: "us", label: "US" },
+        { value: "eu", label: "EU" },
+        { value: "au", label: "AU" },
+        { value: "jp", label: "JP" },
+      ],
+    },
+  ],
+  buildConfig(vars) {
+    const { tenant, region } = vars;
+    if (!tenant || !region) return null;
+    const domain = `${tenant}.${region}.auth0.com`;
+    const issuer = `https://${domain}/`;
+    return {
+      issuer,
+      jwksUri: `https://${domain}/.well-known/jwks.json`,
+      allowedIssuers: [issuer],
+      userinfoEndpoint: `https://${domain}/userinfo`,
+    };
+  },
+};
+
+// ---------------------------------------------------------------------------
+// Okta
+// ---------------------------------------------------------------------------
+
+const oktaPreset: ProviderPreset = {
+  id: "okta",
+  label: "Okta",
+  description: "Okta — enterprise identity and access management",
+  variables: [
+    {
+      key: "domain",
+      label: "Okta domain",
+      placeholder: "acme.okta.com",
+      hint: "Your Okta organization domain (e.g., acme.okta.com)",
+      type: "text",
+    },
+  ],
+  buildConfig(vars) {
+    const { domain } = vars;
+    if (!domain) return null;
+    const base = `https://${domain}/oauth2/default`;
+    return {
+      issuer: base,
+      jwksUri: `${base}/v1/keys`,
+      allowedIssuers: [base],
+      userinfoEndpoint: `${base}/v1/userinfo`,
+    };
+  },
+};
+
+// ---------------------------------------------------------------------------
+// Google
+// ---------------------------------------------------------------------------
+
+const googlePreset: ProviderPreset = {
+  id: "google",
+  label: "Google",
+  description: "Google Identity — Workspace and consumer accounts",
+  variables: [],
+  buildConfig() {
+    return {
+      issuer: "https://accounts.google.com",
+      jwksUri: "https://www.googleapis.com/oauth2/v3/certs",
+      allowedIssuers: ["https://accounts.google.com"],
+      userinfoEndpoint: "https://openidconnect.googleapis.com/v1/userinfo",
+    };
+  },
+};
+
+// ---------------------------------------------------------------------------
+// Microsoft Entra ID (Azure AD)
+// ---------------------------------------------------------------------------
+
+const azureAdPreset: ProviderPreset = {
+  id: "azure-ad",
+  label: "Microsoft Entra ID",
+  description: "Microsoft Entra ID (formerly Azure AD) — enterprise identity",
+  variables: [
+    {
+      key: "tenantId",
+      label: "Tenant ID",
+      placeholder: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
+      hint: "Your Entra ID / Azure AD tenant identifier (GUID)",
+      type: "text",
+    },
+  ],
+  buildConfig(vars) {
+    const { tenantId } = vars;
+    if (!tenantId) return null;
+    const issuer = `https://login.microsoftonline.com/${tenantId}/v2.0`;
+    return {
+      issuer,
+      jwksUri: `https://login.microsoftonline.com/${tenantId}/discovery/v2.0/keys`,
+      allowedIssuers: [issuer],
+      userinfoEndpoint: "https://graph.microsoft.com/oidc/userinfo",
+    };
+  },
+};
+
+// ---------------------------------------------------------------------------
+// AWS Cognito
+// ---------------------------------------------------------------------------
+
+const cognitoPreset: ProviderPreset = {
+  id: "aws-cognito",
+  label: "AWS Cognito",
+  description: "Amazon Cognito — user pools for AWS applications",
+  variables: [
+    {
+      key: "region",
+      label: "AWS region",
+      placeholder: "us-east-1",
+      hint: "The AWS region of your Cognito user pool",
+      type: "text",
+    },
+    {
+      key: "userPoolId",
+      label: "User Pool ID",
+      placeholder: "us-east-1_aBcDeFgHi",
+      hint: "Your Cognito user pool identifier",
+      type: "text",
+    },
+  ],
+  buildConfig(vars) {
+    const { region, userPoolId } = vars;
+    if (!region || !userPoolId) return null;
+    const base = `https://cognito-idp.${region}.amazonaws.com/${userPoolId}`;
+    return {
+      issuer: base,
+      jwksUri: `${base}/.well-known/jwks.json`,
+      allowedIssuers: [base],
+    };
+  },
+};
+
+// ---------------------------------------------------------------------------
+// Custom OIDC
+// ---------------------------------------------------------------------------
+
+const customPreset: ProviderPreset = {
+  id: "custom",
+  label: "Custom OIDC",
+  description: "Any OpenID Connect compliant identity provider",
+  variables: [
+    {
+      key: "issuerUrl",
+      label: "Issuer URL",
+      placeholder: "https://idp.example.com",
+      hint: "The OIDC issuer URL — configuration will be auto-discovered",
+      type: "text",
+    },
+  ],
+  buildConfig() {
+    return null;
+  },
+};
+
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+
+/** All available provider presets in display order. */
+export const PROVIDER_PRESETS: readonly ProviderPreset[] = [
+  auth0Preset,
+  oktaPreset,
+  googlePreset,
+  azureAdPreset,
+  cognitoPreset,
+  customPreset,
+];
+
+/** Look up a preset by ID. Returns `undefined` if not found. */
+export function getPreset(id: string): ProviderPreset | undefined {
+  return PROVIDER_PRESETS.find((p) => p.id === id);
+}

package/src/identity-provider/useCreateIdentityProvider.ts

@@ -0,0 +1,68 @@
+"use client";
+
+import { useCallback, useState } from "react";
+import type { IdentityProviderInput } from "@stigmer/sdk";
+import type { IdentityProvider } from "@stigmer/protos/ai/stigmer/iam/identityprovider/v1/api_pb";
+import { useStigmer } from "../hooks";
+import { toError } from "../internal/toError";
+
+/** Return value of {@link useCreateIdentityProvider}. */
+export interface UseCreateIdentityProviderReturn {
+  /** Submit an {@link IdentityProviderInput} to create a new identity provider. Resolves with the server-created resource. */
+  readonly create: (input: IdentityProviderInput) => Promise<IdentityProvider>;
+  /** `true` while the create request is in flight. */
+  readonly isCreating: boolean;
+  /** Error from the last failed create, or `null` when healthy. */
+  readonly error: Error | null;
+  /** Reset `error` to `null`. */
+  readonly clearError: () => void;
+}
+
+/**
+ * Mutation hook that wraps `identityProvider.create()` with loading
+ * and error state.
+ *
+ * Creates an identity provider resource within an organization. The
+ * caller provides an {@link IdentityProviderInput} with the required
+ * metadata (name, org) and spec fields (JWKS URI, allowed issuers,
+ * expected audience).
+ *
+ * @example
+ * ```tsx
+ * const { create, isCreating, error } = useCreateIdentityProvider();
+ *
+ * const idp = await create({
+ *   name: "Acme Corp SSO",
+ *   org: "acme",
+ *   jwksUri: "https://acme.us.auth0.com/.well-known/jwks.json",
+ *   allowedIssuers: ["https://acme.us.auth0.com/"],
+ *   expectedAudience: "stigmer-api",
+ * });
+ * ```
+ */
+export function useCreateIdentityProvider(): UseCreateIdentityProviderReturn {
+  const stigmer = useStigmer();
+  const [isCreating, setIsCreating] = useState(false);
+  const [error, setError] = useState<Error | null>(null);
+
+  const clearError = useCallback(() => setError(null), []);
+
+  const create = useCallback(
+    async (input: IdentityProviderInput): Promise<IdentityProvider> => {
+      setIsCreating(true);
+      setError(null);
+
+      try {
+        return await stigmer.identityProvider.create(input);
+      } catch (err) {
+        setError(toError(err));
+        throw err;
+      } finally {
+        setIsCreating(false);
+      }
+    },
+    [stigmer],
+  );
+
+  return { create, isCreating, error, clearError };
+}

package/src/identity-provider/useDeleteIdentityProvider.ts

@@ -0,0 +1,65 @@
+"use client";
+
+import { useCallback, useState } from "react";
+import type { DeleteResourceInput } from "@stigmer/sdk";
+import type { IdentityProvider } from "@stigmer/protos/ai/stigmer/iam/identityprovider/v1/api_pb";
+import { useStigmer } from "../hooks";
+import { toError } from "../internal/toError";
+
+/** Return value of {@link useDeleteIdentityProvider}. */
+export interface UseDeleteIdentityProviderReturn {
+  /** Delete an identity provider. Resolves with the deleted resource for confirmation display. */
+  readonly deleteProvider: (input: DeleteResourceInput) => Promise<IdentityProvider>;
+  /** `true` while the delete request is in flight. */
+  readonly isDeleting: boolean;
+  /** Error from the last failed delete, or `null` when healthy. */
+  readonly error: Error | null;
+  /** Reset `error` to `null`. */
+  readonly clearError: () => void;
+}
+
+/**
+ * Mutation hook that wraps `identityProvider.delete()` with loading
+ * and error state.
+ *
+ * Deletes an identity provider by its resource ID. Returns the deleted
+ * {@link IdentityProvider} on success so callers can confirm which
+ * provider was removed.
+ *
+ * Deletion is blocked by the backend if any platform-managed
+ * organizations still reference this identity provider.
+ *
+ * @example
+ * ```tsx
+ * const { deleteProvider, isDeleting, error } = useDeleteIdentityProvider();
+ *
+ * await deleteProvider({ resourceId: "idp-abc123" });
+ * refetch(); // refresh the list after deletion
+ * ```
+ */
+export function useDeleteIdentityProvider(): UseDeleteIdentityProviderReturn {
+  const stigmer = useStigmer();
+  const [isDeleting, setIsDeleting] = useState(false);
+  const [error, setError] = useState<Error | null>(null);
+
+  const clearError = useCallback(() => setError(null), []);
+
+  const deleteProvider = useCallback(
+    async (input: DeleteResourceInput): Promise<IdentityProvider> => {
+      setIsDeleting(true);
+      setError(null);
+
+      try {
+        return await stigmer.identityProvider.delete(input);
+      } catch (err) {
+        setError(toError(err));
+        throw err;
+      } finally {
+        setIsDeleting(false);
+      }
+    },
+    [stigmer],
+  );
+
+  return { deleteProvider, isDeleting, error, clearError };
+}

package/src/identity-provider/useIdentityProvider.ts

@@ -0,0 +1,86 @@
+"use client";
+
+import { useCallback, useEffect, useState } from "react";
+import type { IdentityProvider } from "@stigmer/protos/ai/stigmer/iam/identityprovider/v1/api_pb";
+import { useStigmer } from "../hooks";
+import { toError } from "../internal/toError";
+
+/** Return value of {@link useIdentityProvider}. */
+export interface UseIdentityProviderReturn {
+  /** The fetched IdentityProvider, or `null` while loading or on error. */
+  readonly identityProvider: IdentityProvider | null;
+  /** `true` while the initial fetch or a refetch is in flight. */
+  readonly isLoading: boolean;
+  /** Error from the last failed request, or `null` when healthy. */
+  readonly error: Error | null;
+  /** Discard cached data and re-fetch from the server. */
+  readonly refetch: () => void;
+}
+
+/**
+ * Data hook that fetches a single IdentityProvider by ID.
+ *
+ * Pass `null` to skip fetching (stable no-op). When the `id` changes,
+ * the previous in-flight request is discarded and a fresh fetch begins.
+ *
+ * Returns the full proto {@link IdentityProvider} resource so consumers
+ * have access to metadata, spec (JWKS URI, issuers, SSO config), and
+ * status without additional calls.
+ *
+ * @example
+ * ```tsx
+ * function IdpDetail({ idpId }: { idpId: string }) {
+ *   const { identityProvider, isLoading, error } = useIdentityProvider(idpId);
+ *
+ *   if (isLoading) return <Skeleton />;
+ *   if (error) return <ErrorMessage error={error} />;
+ *   if (!identityProvider) return <NotFound />;
+ *
+ *   return <h1>{identityProvider.spec?.displayName}</h1>;
+ * }
+ * ```
+ */
+export function useIdentityProvider(
+  id: string | null,
+): UseIdentityProviderReturn {
+  const stigmer = useStigmer();
+  const [identityProvider, setIdentityProvider] =
+    useState<IdentityProvider | null>(null);
+  const [isLoading, setIsLoading] = useState(false);
+  const [error, setError] = useState<Error | null>(null);
+  const [fetchKey, setFetchKey] = useState(0);
+
+  const refetch = useCallback(() => setFetchKey((k) => k + 1), []);
+
+  useEffect(() => {
+    if (!id) {
+      setIdentityProvider(null);
+      setIsLoading(false);
+      setError(null);
+      return;
+    }
+
+    const cancelled = { current: false };
+    setIsLoading(true);
+    setError(null);
+
+    stigmer.identityProvider.get(id).then(
+      (result) => {
+        if (cancelled.current) return;
+        setIdentityProvider(result);
+        setIsLoading(false);
+      },
+      (err) => {
+        if (cancelled.current) return;
+        setError(toError(err));
+        setIsLoading(false);
+      },
+    );
+
+    return () => {
+      cancelled.current = true;
+    };
+  }, [id, stigmer, fetchKey]);
+
+  return { identityProvider, isLoading, error, refetch };
+}

package/src/identity-provider/useIdentityProviderList.ts

@@ -0,0 +1,100 @@
+"use client";
+
+import { useCallback, useEffect, useState } from "react";
+import { create } from "@bufbuild/protobuf";
+import type { IdentityProvider } from "@stigmer/protos/ai/stigmer/iam/identityprovider/v1/api_pb";
+import { ListIdentityProvidersByOrgInputSchema } from "@stigmer/protos/ai/stigmer/iam/identityprovider/v1/io_pb";
+import { useStigmer } from "../hooks";
+import { toError } from "../internal/toError";
+
+/** Return value of {@link useIdentityProviderList}. */
+export interface UseIdentityProviderListReturn {
+  /** All identity providers for the organization. Empty while loading or on error. */
+  readonly identityProviders: readonly IdentityProvider[];
+  /** `true` while the initial fetch or a refetch is in flight. */
+  readonly isLoading: boolean;
+  /** Error from the last failed request, or `null` when healthy. */
+  readonly error: Error | null;
+  /** Discard cached data and re-fetch from the server. */
+  readonly refetch: () => void;
+}
+
+/**
+ * Data hook that fetches all identity providers for an organization.
+ *
+ * Identity providers are admin-level resources with small cardinality
+ * (typically 1–3 per org), so results are returned as a flat list
+ * without pagination.
+ *
+ * Pass `null` to skip fetching (stable no-op). Call `refetch()` to
+ * re-query after mutations (create / update / delete).
+ *
+ * @example
+ * ```tsx
+ * function IdpSettings({ orgId }: { orgId: string }) {
+ *   const { identityProviders, isLoading, error } = useIdentityProviderList(orgId);
+ *
+ *   if (isLoading) return <Skeleton />;
+ *   if (error) return <ErrorMessage error={error} />;
+ *
+ *   return (
+ *     <ul>
+ *       {identityProviders.map((idp) => (
+ *         <li key={idp.metadata?.id}>{idp.metadata?.name}</li>
+ *       ))}
+ *     </ul>
+ *   );
+ * }
+ * ```
+ *
+ * @example
+ * ```tsx
+ * // Skip fetching until org is known
+ * const { identityProviders } = useIdentityProviderList(org ?? null);
+ * ```
+ */
+export function useIdentityProviderList(
+  org: string | null,
+): UseIdentityProviderListReturn {
+  const stigmer = useStigmer();
+  const [identityProviders, setIdentityProviders] = useState<
+    IdentityProvider[]
+  >([]);
+  const [isLoading, setIsLoading] = useState(false);
+  const [error, setError] = useState<Error | null>(null);
+  const [fetchKey, setFetchKey] = useState(0);
+
+  const refetch = useCallback(() => setFetchKey((k) => k + 1), []);
+
+  useEffect(() => {
+    if (!org) {
+      setIdentityProviders([]);
+      setIsLoading(false);
+      setError(null);
+      return;
+    }
+
+    const cancelled = { current: false };
+    setIsLoading(true);
+    setError(null);
+
+    stigmer.identityProvider.listByOrg(create(ListIdentityProvidersByOrgInputSchema, { org })).then(
+      (result) => {
+        if (cancelled.current) return;
+        setIdentityProviders([...result.entries]);
+        setIsLoading(false);
+      },
+      (err) => {
+        if (cancelled.current) return;
+        setError(toError(err));
+        setIsLoading(false);
+      },
+    );
+
+    return () => {
+      cancelled.current = true;
+    };
+  }, [org, stigmer, fetchKey]);
+
+  return { identityProviders, isLoading, error, refetch };
+}