@strapi/admin 5.48.0 → 5.49.0

package/dist/admin/admin/src/hooks/useEnterprise.js.map

@@ -1 +1 @@
-{"version":3,"file":"useEnterprise.js","sources":["../../../../../admin/src/hooks/useEnterprise.ts"],"sourcesContent":["import * as React from 'react';\n\nimport { useCallbackRef } from '@strapi/design-system';\n\nfunction isEnterprise() {\n  return window.strapi.isEE;\n}\n\nexport interface UseEnterpriseOptions<TCEData, TEEData, TDefaultValue, TCombinedValue> {\n  defaultValue?: TDefaultValue;\n  combine?: (ceData: TCEData, eeData: TEEData) => TCombinedValue;\n  enabled?: boolean;\n}\n\ntype UseEnterpriseReturn<TCEData, TEEData, TDefaultValue, TCombinedValue> =\n  TDefaultValue extends null\n    ? TCEData | TEEData | TCombinedValue | null\n    : TCEData | TEEData | TCombinedValue | TDefaultValue;\n\nexport const useEnterprise = <\n  TCEData,\n  TEEData = TCEData,\n  TCombinedValue = TEEData,\n  TDefaultValue = TCEData,\n>(\n  ceData: TCEData,\n  eeCallback: () => Promise<TEEData>,\n  opts: UseEnterpriseOptions<TCEData, TEEData, TDefaultValue, TCombinedValue> = {}\n): UseEnterpriseReturn<TCEData, TEEData, TDefaultValue, TCombinedValue> => {\n  const { defaultValue = null, combine = (_ceData, eeData) => eeData, enabled = true } = opts;\n  const eeCallbackRef = useCallbackRef(eeCallback);\n  const combineCallbackRef = useCallbackRef(combine);\n\n  // We have to use a nested object here, because functions (e.g. Components)\n  // can not be stored as value directly\n  const [{ data }, setData] = React.useState<{\n    data: TCEData | TEEData | TDefaultValue | TCombinedValue | null;\n  }>({\n    data: isEnterprise() && enabled ? defaultValue : ceData,\n  });\n\n  React.useEffect(() => {\n    async function importEE() {\n      const eeData = await eeCallbackRef();\n      const combinedValue = combineCallbackRef(ceData, eeData);\n\n      setData({ data: combinedValue ? combinedValue : eeData });\n    }\n\n    if (isEnterprise() && enabled) {\n      importEE();\n    }\n  }, [ceData, eeCallbackRef, combineCallbackRef, enabled]);\n\n  // @ts-expect-error – the hook type assertion works in practice. But seems to have issues here...\n  return data;\n};\n"],"names":["isEnterprise","window","strapi","isEE","useEnterprise","ceData","eeCallback","opts","defaultValue","combine","_ceData","eeData","enabled","eeCallbackRef","useCallbackRef","combineCallbackRef","data","setData","React","useState","useEffect","importEE","combinedValue"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAIA,SAASA,YAAAA,GAAAA;IACP,OAAOC,MAAAA,CAAOC,MAAM,CAACC,IAAI;AAC3B;MAaaC,aAAAA,GAAgB,CAM3BC,QACAC,UAAAA,EACAC,IAAAA,GAA8E,EAAE,GAAA;AAEhF,IAAA,MAAM,EAAEC,YAAAA,GAAe,IAAI,EAAEC,OAAAA,GAAU,CAACC,OAAAA,EAASC,MAAAA,GAAWA,MAAM,EAAEC,OAAAA,GAAU,IAAI,EAAE,GAAGL,IAAAA;AACvF,IAAA,MAAMM,gBAAgBC,2BAAAA,CAAeR,UAAAA,CAAAA;AACrC,IAAA,MAAMS,qBAAqBD,2BAAAA,CAAeL,OAAAA,CAAAA;;;IAI1C,MAAM,CAAC,EAAEO,IAAI,EAAE,EAAEC,OAAAA,CAAQ,GAAGC,gBAAAA,CAAMC,QAAQ,CAEvC;QACDH,IAAAA,EAAMhB,YAAAA,EAAAA,IAAkBY,UAAUJ,YAAAA,GAAeH;AACnD,KAAA,CAAA;AAEAa,IAAAA,gBAAAA,CAAME,SAAS,CAAC,IAAA;QACd,eAAeC,QAAAA,GAAAA;AACb,YAAA,MAAMV,SAAS,MAAME,aAAAA,EAAAA;YACrB,MAAMS,aAAAA,GAAgBP,mBAAmBV,MAAAA,EAAQM,MAAAA,CAAAA;YAEjDM,OAAAA,CAAQ;AAAED,gBAAAA,IAAAA,EAAMM,gBAAgBA,aAAAA,GAAgBX;AAAO,aAAA,CAAA;AACzD,QAAA;AAEA,QAAA,IAAIX,kBAAkBY,OAAAA,EAAS;AAC7BS,YAAAA,QAAAA,EAAAA;AACF,QAAA;IACF,CAAA,EAAG;AAAChB,QAAAA,MAAAA;AAAQQ,QAAAA,aAAAA;AAAeE,QAAAA,kBAAAA;AAAoBH,QAAAA;AAAQ,KAAA,CAAA;;IAGvD,OAAOI,IAAAA;AACT;;;;"}
+{"version":3,"file":"useEnterprise.js","sources":["../../../../../admin/src/hooks/useEnterprise.ts"],"sourcesContent":["import * as React from 'react';\n\nimport { useCallbackRef } from '@strapi/design-system';\n\nfunction isEnterprise() {\n  return window.strapi.isEE;\n}\n\nexport interface UseEnterpriseOptions<TCEData, TEEData, TDefaultValue, TCombinedValue> {\n  defaultValue?: TDefaultValue;\n  combine?: (ceData: TCEData, eeData: TEEData) => TCombinedValue;\n  enabled?: boolean;\n}\n\ntype UseEnterpriseReturn<TCEData, TEEData, TDefaultValue, TCombinedValue> =\n  TDefaultValue extends null\n    ? TCEData | TEEData | TCombinedValue | null\n    : TCEData | TEEData | TCombinedValue | TDefaultValue;\n\nexport const useEnterprise = <\n  TCEData,\n  TEEData = TCEData,\n  TCombinedValue = TEEData,\n  TDefaultValue = TCEData,\n>(\n  ceData: TCEData,\n  eeCallback: () => Promise<TEEData>,\n  opts: UseEnterpriseOptions<TCEData, TEEData, TDefaultValue, TCombinedValue> = {}\n): UseEnterpriseReturn<TCEData, TEEData, TDefaultValue, TCombinedValue> => {\n  const { defaultValue = null, combine = (_ceData, eeData) => eeData, enabled = true } = opts;\n  const eeCallbackRef = useCallbackRef(eeCallback);\n  const combineCallbackRef = useCallbackRef(combine);\n\n  // We have to use a nested object here, because functions (e.g. Components)\n  // can not be stored as value directly\n  const [{ data }, setData] = React.useState<{\n    data: TCEData | TEEData | TDefaultValue | TCombinedValue | null;\n  }>({\n    data: isEnterprise() && enabled ? defaultValue : ceData,\n  });\n\n  React.useEffect(() => {\n    async function importEE() {\n      const eeData = await eeCallbackRef();\n      const combinedValue = combineCallbackRef(ceData, eeData);\n\n      setData({ data: combinedValue ? combinedValue : eeData });\n    }\n\n    if (isEnterprise() && enabled) {\n      importEE();\n    }\n  }, [ceData, eeCallbackRef, combineCallbackRef, enabled]);\n\n  // @ts-expect-error – the hook type assertion works in practice. But seems to have issues here...\n  return data;\n};\n"],"names":["isEnterprise","window","strapi","isEE","useEnterprise","ceData","eeCallback","opts","defaultValue","combine","_ceData","eeData","enabled","eeCallbackRef","useCallbackRef","combineCallbackRef","data","setData","React","useState","useEffect","importEE","combinedValue"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAIA,SAASA,YAAAA,GAAAA;IACP,OAAOC,MAAAA,CAAOC,MAAM,CAACC,IAAI;AAC3B;MAaaC,aAAAA,GAAgB,CAM3BC,QACAC,UAAAA,EACAC,IAAAA,GAA8E,EAAE,GAAA;AAEhF,IAAA,MAAM,EAAEC,YAAAA,GAAe,IAAI,EAAEC,OAAAA,GAAU,CAACC,OAAAA,EAASC,MAAAA,GAAWA,MAAM,EAAEC,OAAAA,GAAU,IAAI,EAAE,GAAGL,IAAAA;AACvF,IAAA,MAAMM,gBAAgBC,2BAAAA,CAAeR,UAAAA,CAAAA;AACrC,IAAA,MAAMS,qBAAqBD,2BAAAA,CAAeL,OAAAA,CAAAA;;;IAI1C,MAAM,CAAC,EAAEO,IAAI,EAAE,EAAEC,OAAAA,CAAQ,GAAGC,gBAAAA,CAAMC,QAAQ,CAEvC;QACDH,IAAAA,EAAMhB,YAAAA,EAAAA,IAAkBY,UAAUJ,YAAAA,GAAeH;AACnD,KAAA,CAAA;AAEAa,IAAAA,gBAAAA,CAAME,SAAS,CAAC,IAAA;QACd,eAAeC,QAAAA,GAAAA;AACb,YAAA,MAAMV,SAAS,MAAME,aAAAA,EAAAA;YACrB,MAAMS,aAAAA,GAAgBP,mBAAmBV,MAAAA,EAAQM,MAAAA,CAAAA;YAEjDM,OAAAA,CAAQ;AAAED,gBAAAA,IAAAA,EAAMM,gBAAgBA,aAAAA,GAAgBX;AAAO,aAAA,CAAA;AACzD,QAAA;AAEA,QAAA,IAAIX,kBAAkBY,OAAAA,EAAS;AAC7BS,YAAAA,QAAAA,EAAAA;AACF,QAAA;IACF,CAAA,EAAG;AAAChB,QAAAA,MAAAA;AAAQQ,QAAAA,aAAAA;AAAeE,QAAAA,kBAAAA;AAAoBH,QAAAA;AAAQ,KAAA,CAAA;;IAGvD,OAAOI,IAAAA;AACT;;;;"}

package/dist/admin/admin/src/hooks/useFetchClient.js

@@ -3,7 +3,8 @@
 var React = require('react');
 var getFetchClient = require('../utils/getFetchClient.js');
 
-function _interopNamespaceDefault(e) {
+function _interopNamespace(e) {
+  if (e && e.__esModule) return e;
   var n = Object.create(null);
   if (e) {
     Object.keys(e).forEach(function (k) {
@@ -20,7 +21,7 @@ function _interopNamespaceDefault(e) {
   return Object.freeze(n);
 }
 
-var React__namespace = /*#__PURE__*/_interopNamespaceDefault(React);
+var React__namespace = /*#__PURE__*/_interopNamespace(React);
 
 /**
  * @public

package/dist/admin/admin/src/hooks/useFetchClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"useFetchClient.js","sources":["../../../../../admin/src/hooks/useFetchClient.ts"],"sourcesContent":["import * as React from 'react';\n\nimport { getFetchClient } from '../utils/getFetchClient';\n\n/**\n * @public\n * @description This is an abstraction around the native fetch exposed by a hook. It provides a simple interface to handle API calls\n * to the Strapi backend.\n * It handles request cancellations inside the hook with an {@link https://developer.mozilla.org/en-US/docs/Web/API/AbortController} AbortController.\n * This is typically triggered when the component is unmounted so all the requests that it is currently making are aborted.\n * The expected URL style includes either a protocol (such as HTTP or HTTPS) or a relative URL. The URLs with domain and path but not protocol are not allowed (ex: `www.example.com`).\n * @example\n * ```tsx\n * import * as React from 'react';\n * import { useFetchClient } from '@strapi/admin/admin';\n *\n * const MyComponent = () => {\n *   const [items, setItems] = React.useState([]);\n *   const { get } = useFetchClient();\n *   const requestURL = \"/some-endpoint\";\n *\n *   const handleGetData = async () => {\n *     const { data } = await get(requestURL);\n *     setItems(data.items);\n *   };\n *\n *   return (\n *    <div>\n *      <div>\n *       {\n *         items && items.map(item => <h2 key={item.uuid}>{item.name}</h2>))\n *       }\n *     </div>\n *    </div>\n *   );\n * };\n * ```\n * @see {@link https://developer.mozilla.org/en-US/docs/Web/API/AbortController} AbortController.\n */\nconst useFetchClient = () => {\n  const controller = React.useRef<AbortController | null>(null);\n\n  if (controller.current === null) {\n    controller.current = new AbortController();\n  }\n\n  React.useEffect(() => {\n    return () => {\n      controller.current!.abort();\n    };\n  }, []);\n\n  return React.useMemo(\n    () =>\n      getFetchClient({\n        signal: controller.current!.signal,\n      }),\n    []\n  );\n};\n\nexport { useFetchClient };\n"],"names":["useFetchClient","controller","React","useRef","current","AbortController","useEffect","abort","useMemo","getFetchClient","signal"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAIA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCC,UACKA,cAAAA,GAAiB,IAAA;IACrB,MAAMC,UAAAA,GAAaC,gBAAAA,CAAMC,MAAM,CAAyB,IAAA,CAAA;IAExD,IAAIF,UAAAA,CAAWG,OAAO,KAAK,IAAA,EAAM;QAC/BH,UAAAA,CAAWG,OAAO,GAAG,IAAIC,eAAAA,EAAAA;AAC3B,IAAA;AAEAH,IAAAA,gBAAAA,CAAMI,SAAS,CAAC,IAAA;QACd,OAAO,IAAA;YACLL,UAAAA,CAAWG,OAAO,CAAEG,KAAK,EAAA;AAC3B,QAAA,CAAA;AACF,IAAA,CAAA,EAAG,EAAE,CAAA;AAEL,IAAA,OAAOL,gBAAAA,CAAMM,OAAO,CAClB,IACEC,6BAAAA,CAAe;YACbC,MAAAA,EAAQT,UAAAA,CAAWG,OAAO,CAAEM;AAC9B,SAAA,CAAA,EACF,EAAE,CAAA;AAEN;;;;"}
+{"version":3,"file":"useFetchClient.js","sources":["../../../../../admin/src/hooks/useFetchClient.ts"],"sourcesContent":["import * as React from 'react';\n\nimport { getFetchClient } from '../utils/getFetchClient';\n\n/**\n * @public\n * @description This is an abstraction around the native fetch exposed by a hook. It provides a simple interface to handle API calls\n * to the Strapi backend.\n * It handles request cancellations inside the hook with an {@link https://developer.mozilla.org/en-US/docs/Web/API/AbortController} AbortController.\n * This is typically triggered when the component is unmounted so all the requests that it is currently making are aborted.\n * The expected URL style includes either a protocol (such as HTTP or HTTPS) or a relative URL. The URLs with domain and path but not protocol are not allowed (ex: `www.example.com`).\n * @example\n * ```tsx\n * import * as React from 'react';\n * import { useFetchClient } from '@strapi/admin/admin';\n *\n * const MyComponent = () => {\n *   const [items, setItems] = React.useState([]);\n *   const { get } = useFetchClient();\n *   const requestURL = \"/some-endpoint\";\n *\n *   const handleGetData = async () => {\n *     const { data } = await get(requestURL);\n *     setItems(data.items);\n *   };\n *\n *   return (\n *    <div>\n *      <div>\n *       {\n *         items && items.map(item => <h2 key={item.uuid}>{item.name}</h2>))\n *       }\n *     </div>\n *    </div>\n *   );\n * };\n * ```\n * @see {@link https://developer.mozilla.org/en-US/docs/Web/API/AbortController} AbortController.\n */\nconst useFetchClient = () => {\n  const controller = React.useRef<AbortController | null>(null);\n\n  if (controller.current === null) {\n    controller.current = new AbortController();\n  }\n\n  React.useEffect(() => {\n    return () => {\n      controller.current!.abort();\n    };\n  }, []);\n\n  return React.useMemo(\n    () =>\n      getFetchClient({\n        signal: controller.current!.signal,\n      }),\n    []\n  );\n};\n\nexport { useFetchClient };\n"],"names":["useFetchClient","controller","React","useRef","current","AbortController","useEffect","abort","useMemo","getFetchClient","signal"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAIA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCC,UACKA,cAAAA,GAAiB,IAAA;IACrB,MAAMC,UAAAA,GAAaC,gBAAAA,CAAMC,MAAM,CAAyB,IAAA,CAAA;IAExD,IAAIF,UAAAA,CAAWG,OAAO,KAAK,IAAA,EAAM;QAC/BH,UAAAA,CAAWG,OAAO,GAAG,IAAIC,eAAAA,EAAAA;AAC3B,IAAA;AAEAH,IAAAA,gBAAAA,CAAMI,SAAS,CAAC,IAAA;QACd,OAAO,IAAA;YACLL,UAAAA,CAAWG,OAAO,CAAEG,KAAK,EAAA;AAC3B,QAAA,CAAA;AACF,IAAA,CAAA,EAAG,EAAE,CAAA;AAEL,IAAA,OAAOL,gBAAAA,CAAMM,OAAO,CAClB,IACEC,6BAAAA,CAAe;YACbC,MAAAA,EAAQT,UAAAA,CAAWG,OAAO,CAAEM;AAC9B,SAAA,CAAA,EACF,EAAE,CAAA;AAEN;;;;"}

package/dist/admin/admin/src/hooks/useForceUpdate.js

@@ -3,7 +3,8 @@
 var React = require('react');
 var useIsMounted = require('./useIsMounted.js');
 
-function _interopNamespaceDefault(e) {
+function _interopNamespace(e) {
+  if (e && e.__esModule) return e;
   var n = Object.create(null);
   if (e) {
     Object.keys(e).forEach(function (k) {
@@ -20,7 +21,7 @@ function _interopNamespaceDefault(e) {
   return Object.freeze(n);
 }
 
-var React__namespace = /*#__PURE__*/_interopNamespaceDefault(React);
+var React__namespace = /*#__PURE__*/_interopNamespace(React);
 
 /**
  * @internal

package/dist/admin/admin/src/hooks/useForceUpdate.js.map

@@ -1 +1 @@
-{"version":3,"file":"useForceUpdate.js","sources":["../../../../../admin/src/hooks/useForceUpdate.ts"],"sourcesContent":["import * as React from 'react';\n\nimport { useIsMounted } from './useIsMounted';\n\n/**\n * @internal\n * @description Return a function that re-renders this component, if still mounted\n * @warning DO NOT USE EXCEPT SPECIAL CASES.\n */\nconst useForceUpdate = () => {\n  const [tick, update] = React.useState<number>();\n  const isMounted = useIsMounted();\n\n  const forceUpdate = React.useCallback(() => {\n    if (isMounted.current) {\n      update(Math.random());\n    }\n  }, [isMounted, update]);\n\n  return [tick, forceUpdate] as const;\n};\n\nexport { useForceUpdate };\n"],"names":["useForceUpdate","tick","update","React","useState","isMounted","useIsMounted","forceUpdate","useCallback","current","Math","random"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAIA;;;;AAIC,UACKA,cAAAA,GAAiB,IAAA;AACrB,IAAA,MAAM,CAACC,IAAAA,EAAMC,MAAAA,CAAO,GAAGC,iBAAMC,QAAQ,EAAA;AACrC,IAAA,MAAMC,SAAAA,GAAYC,yBAAAA,EAAAA;IAElB,MAAMC,WAAAA,GAAcJ,gBAAAA,CAAMK,WAAW,CAAC,IAAA;QACpC,IAAIH,SAAAA,CAAUI,OAAO,EAAE;AACrBP,YAAAA,MAAAA,CAAOQ,KAAKC,MAAM,EAAA,CAAA;AACpB,QAAA;IACF,CAAA,EAAG;AAACN,QAAAA,SAAAA;AAAWH,QAAAA;AAAO,KAAA,CAAA;IAEtB,OAAO;AAACD,QAAAA,IAAAA;AAAMM,QAAAA;AAAY,KAAA;AAC5B;;;;"}
+{"version":3,"file":"useForceUpdate.js","sources":["../../../../../admin/src/hooks/useForceUpdate.ts"],"sourcesContent":["import * as React from 'react';\n\nimport { useIsMounted } from './useIsMounted';\n\n/**\n * @internal\n * @description Return a function that re-renders this component, if still mounted\n * @warning DO NOT USE EXCEPT SPECIAL CASES.\n */\nconst useForceUpdate = () => {\n  const [tick, update] = React.useState<number>();\n  const isMounted = useIsMounted();\n\n  const forceUpdate = React.useCallback(() => {\n    if (isMounted.current) {\n      update(Math.random());\n    }\n  }, [isMounted, update]);\n\n  return [tick, forceUpdate] as const;\n};\n\nexport { useForceUpdate };\n"],"names":["useForceUpdate","tick","update","React","useState","isMounted","useIsMounted","forceUpdate","useCallback","current","Math","random"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAIA;;;;AAIC,UACKA,cAAAA,GAAiB,IAAA;AACrB,IAAA,MAAM,CAACC,IAAAA,EAAMC,MAAAA,CAAO,GAAGC,iBAAMC,QAAQ,EAAA;AACrC,IAAA,MAAMC,SAAAA,GAAYC,yBAAAA,EAAAA;IAElB,MAAMC,WAAAA,GAAcJ,gBAAAA,CAAMK,WAAW,CAAC,IAAA;QACpC,IAAIH,SAAAA,CAAUI,OAAO,EAAE;AACrBP,YAAAA,MAAAA,CAAOQ,KAAKC,MAAM,EAAA,CAAA;AACpB,QAAA;IACF,CAAA,EAAG;AAACN,QAAAA,SAAAA;AAAWH,QAAAA;AAAO,KAAA,CAAA;IAEtB,OAAO;AAACD,QAAAA,IAAAA;AAAMM,QAAAA;AAAY,KAAA;AAC5B;;;;"}

package/dist/admin/admin/src/hooks/useIdleSessionLogout.js

@@ -3,7 +3,8 @@
 var React = require('react');
 var jwt = require('../utils/jwt.js');
 
-function _interopNamespaceDefault(e) {
+function _interopNamespace(e) {
+  if (e && e.__esModule) return e;
   var n = Object.create(null);
   if (e) {
     Object.keys(e).forEach(function (k) {
@@ -20,21 +21,37 @@ function _interopNamespaceDefault(e) {
   return Object.freeze(n);
 }
 
-var React__namespace = /*#__PURE__*/_interopNamespaceDefault(React);
+var React__namespace = /*#__PURE__*/_interopNamespace(React);
 
 const SESSION_EXPIRY_BUFFER_MS = 1000;
 /**
- * Schedule a one-shot logout when the access token's `exp` elapses.
+ * How long before the access token's `exp` an active tab renews. Renewing
+ * ahead of expiry (rather than at it) means the refreshed token is already in
+ * shared storage by the time any *other* tab's logout timer fires — so an idle
+ * sibling re-syncs instead of racing the refresh and logging itself out.
+ */ const SESSION_RENEW_MARGIN_MS = 10000;
+/**
+ * Keep the admin session alive while the user is active, and end it when they
+ * are genuinely idle — without one tab tearing down another.
+ *
+ * The access token is short-lived (`accessTokenLifespan`, e.g. 30 min) and is
+ * meant to be refreshed, not to be the session length. Two timers are armed per
+ * token:
  *
- * The hook re-runs whenever `token` changes. While the user is active, every
- * API call that hits a 401 transparently refreshes the access token (see
- * `withTokenRefresh` in `getFetchClient.ts`), which dispatches `setToken` and
- * causes this effect to re-arm with the new, later `exp`.
+ * - Renew (at `exp` minus a margin): if the user interacted during this token's
+ *   lifetime, silently renew *ahead* of expiry. The new `setToken` re-arms the
+ *   hook; a server rejection (`onSessionDead`) ends the session globally.
+ *   Renewing early guarantees the refreshed token reaches shared storage before
+ *   any sibling tab's logout timer fires.
+ * - Logout (just after `exp`): the fallback when this tab did not renew. It
+ *   first re-syncs from a token another tab refreshed (so an idle tab rides on
+ *   an active sibling), then renews if activity arrived late, and only otherwise
+ *   logs out — locally, so idle tabs never force-logout active ones.
  *
- * If the JWT can't be decoded (malformed, missing `exp`), the timer is
- * skipped silently — the active-tab redirect on 401 still covers the
- * symptom on the next user-initiated request.
- */ const useIdleSessionLogout = ({ token, onExpired, disabled = false })=>{
+ * If the JWT can't be decoded (malformed, missing `exp`), the timers are skipped
+ * silently — the active-tab redirect on 401 still covers the symptom on the next
+ * user-initiated request.
+ */ const useIdleSessionLogout = ({ token, onExpired, onSessionDead, getStoredToken, onResync, getLastActivityAt, renewSession, disabled = false })=>{
     React__namespace.useEffect(()=>{
         if (!token || disabled) {
             return undefined;
@@ -43,20 +60,73 @@ const SESSION_EXPIRY_BUFFER_MS = 1000;
         if (expiry === null) {
             return undefined;
         }
-        const msUntilExpiry = expiry - Date.now() + SESSION_EXPIRY_BUFFER_MS;
-        const timeoutId = window.setTimeout(()=>{
+        // When this token became active. Activity recorded after this point means
+        // the user was present during the token's lifetime.
+        const armedAt = Date.now();
+        const wasActive = ()=>typeof getLastActivityAt === 'function' && getLastActivityAt() >= armedAt;
+        // Adopt a fresher token another tab wrote to shared storage. Returns true
+        // when it re-synced (caller should stop).
+        const tryResync = ()=>{
+            const storedToken = getStoredToken?.() ?? null;
+            if (storedToken && storedToken !== token && onResync) {
+                const storedExpiry = jwt.decodeAccessTokenExpiry(storedToken);
+                if (storedExpiry !== null && storedExpiry > expiry) {
+                    onResync(storedToken);
+                    return true;
+                }
+            }
+            return false;
+        };
+        const renew = ()=>{
+            renewSession().then((renewed)=>{
+                if (!renewed) {
+                    // Server rejected the refresh: the session is truly over.
+                    (onSessionDead ?? onExpired)();
+                }
+            // On success, storeToken -> setToken updates the token prop, which
+            // re-runs this effect and re-arms against the new exp.
+            });
+        };
+        // Renew ahead of expiry while the user is active.
+        const renewDelay = Math.max(expiry - armedAt - SESSION_RENEW_MARGIN_MS, 0);
+        const renewTimeoutId = window.setTimeout(()=>{
+            if (tryResync()) {
+                return;
+            }
+            if (wasActive() && renewSession) {
+                renew();
+            }
+        }, renewDelay);
+        // Fallback decision just after expiry, for tabs that did not renew.
+        const logoutDelay = Math.max(expiry - armedAt + SESSION_EXPIRY_BUFFER_MS, 0);
+        const logoutTimeoutId = window.setTimeout(()=>{
+            if (tryResync()) {
+                return;
+            }
+            if (wasActive() && renewSession) {
+                renew();
+                return;
+            }
+            // Genuinely idle: log out only this tab.
             onExpired();
-        }, Math.max(msUntilExpiry, 0));
+        }, logoutDelay);
         return ()=>{
-            window.clearTimeout(timeoutId);
+            window.clearTimeout(renewTimeoutId);
+            window.clearTimeout(logoutTimeoutId);
         };
     }, [
         token,
         onExpired,
+        onSessionDead,
+        getStoredToken,
+        onResync,
+        getLastActivityAt,
+        renewSession,
         disabled
     ]);
 };
 
 exports.SESSION_EXPIRY_BUFFER_MS = SESSION_EXPIRY_BUFFER_MS;
+exports.SESSION_RENEW_MARGIN_MS = SESSION_RENEW_MARGIN_MS;
 exports.useIdleSessionLogout = useIdleSessionLogout;
 //# sourceMappingURL=useIdleSessionLogout.js.map

package/dist/admin/admin/src/hooks/useIdleSessionLogout.js.map

@@ -1 +1 @@
-{"version":3,"file":"useIdleSessionLogout.js","sources":["../../../../../admin/src/hooks/useIdleSessionLogout.ts"],"sourcesContent":["import * as React from 'react';\n\nimport { decodeAccessTokenExpiry } from '../utils/jwt';\n\nconst SESSION_EXPIRY_BUFFER_MS = 1000;\n\ninterface UseIdleSessionLogoutOptions {\n  /**\n   * The current admin access JWT (from Redux), or `null` when logged out.\n   */\n  token: string | null;\n  /**\n   * Called when the timer fires. Typically clears local auth state and\n   * navigates to /auth/login.\n   */\n  onExpired: () => void;\n  /**\n   * Escape hatch for tests / dev environments where we don't want the\n   * automatic logout behavior. Mirrors the existing `_disableRenewToken`\n   * prop on `<AuthProvider>`.\n   */\n  disabled?: boolean;\n}\n\n/**\n * Schedule a one-shot logout when the access token's `exp` elapses.\n *\n * The hook re-runs whenever `token` changes. While the user is active, every\n * API call that hits a 401 transparently refreshes the access token (see\n * `withTokenRefresh` in `getFetchClient.ts`), which dispatches `setToken` and\n * causes this effect to re-arm with the new, later `exp`.\n *\n * If the JWT can't be decoded (malformed, missing `exp`), the timer is\n * skipped silently — the active-tab redirect on 401 still covers the\n * symptom on the next user-initiated request.\n */\nconst useIdleSessionLogout = ({\n  token,\n  onExpired,\n  disabled = false,\n}: UseIdleSessionLogoutOptions): void => {\n  React.useEffect(() => {\n    if (!token || disabled) {\n      return undefined;\n    }\n\n    const expiry = decodeAccessTokenExpiry(token);\n    if (expiry === null) {\n      return undefined;\n    }\n\n    const msUntilExpiry = expiry - Date.now() + SESSION_EXPIRY_BUFFER_MS;\n\n    const timeoutId = window.setTimeout(\n      () => {\n        onExpired();\n      },\n      Math.max(msUntilExpiry, 0)\n    );\n\n    return () => {\n      window.clearTimeout(timeoutId);\n    };\n  }, [token, onExpired, disabled]);\n};\n\nexport { useIdleSessionLogout, SESSION_EXPIRY_BUFFER_MS };\nexport type { UseIdleSessionLogoutOptions };\n"],"names":["SESSION_EXPIRY_BUFFER_MS","useIdleSessionLogout","token","onExpired","disabled","React","useEffect","undefined","expiry","decodeAccessTokenExpiry","msUntilExpiry","Date","now","timeoutId","window","setTimeout","Math","max","clearTimeout"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAIA,MAAMA,wBAAAA,GAA2B;AAoBjC;;;;;;;;;;;IAYA,MAAMC,oBAAAA,GAAuB,CAAC,EAC5BC,KAAK,EACLC,SAAS,EACTC,QAAAA,GAAW,KAAK,EACY,GAAA;AAC5BC,IAAAA,gBAAAA,CAAMC,SAAS,CAAC,IAAA;QACd,IAAI,CAACJ,SAASE,QAAAA,EAAU;YACtB,OAAOG,SAAAA;AACT,QAAA;AAEA,QAAA,MAAMC,SAASC,2BAAAA,CAAwBP,KAAAA,CAAAA;AACvC,QAAA,IAAIM,WAAW,IAAA,EAAM;YACnB,OAAOD,SAAAA;AACT,QAAA;AAEA,QAAA,MAAMG,aAAAA,GAAgBF,MAAAA,GAASG,IAAAA,CAAKC,GAAG,EAAA,GAAKZ,wBAAAA;QAE5C,MAAMa,SAAAA,GAAYC,MAAAA,CAAOC,UAAU,CACjC,IAAA;AACEZ,YAAAA,SAAAA,EAAAA;QACF,CAAA,EACAa,IAAAA,CAAKC,GAAG,CAACP,aAAAA,EAAe,CAAA,CAAA,CAAA;QAG1B,OAAO,IAAA;AACLI,YAAAA,MAAAA,CAAOI,YAAY,CAACL,SAAAA,CAAAA;AACtB,QAAA,CAAA;IACF,CAAA,EAAG;AAACX,QAAAA,KAAAA;AAAOC,QAAAA,SAAAA;AAAWC,QAAAA;AAAS,KAAA,CAAA;AACjC;;;;;"}
+{"version":3,"file":"useIdleSessionLogout.js","sources":["../../../../../admin/src/hooks/useIdleSessionLogout.ts"],"sourcesContent":["import * as React from 'react';\n\nimport { decodeAccessTokenExpiry } from '../utils/jwt';\n\nconst SESSION_EXPIRY_BUFFER_MS = 1000;\n/**\n * How long before the access token's `exp` an active tab renews. Renewing\n * ahead of expiry (rather than at it) means the refreshed token is already in\n * shared storage by the time any *other* tab's logout timer fires — so an idle\n * sibling re-syncs instead of racing the refresh and logging itself out.\n */\nconst SESSION_RENEW_MARGIN_MS = 10_000;\n\ninterface UseIdleSessionLogoutOptions {\n  /**\n   * The current admin access JWT (from Redux), or `null` when logged out.\n   */\n  token: string | null;\n  /**\n   * Called when the timer fires and the user is genuinely idle. Should clear\n   * *this tab's* local auth state and navigate to /auth/login. It must NOT\n   * broadcast a global logout (e.g. by removing the shared `isLoggedIn` key),\n   * otherwise an idle tab firing on a stale token would log out other tabs that\n   * are still active — see the cross-tab handling below.\n   */\n  onExpired: () => void;\n  /**\n   * Called when a renewal attempt is rejected by the server (the session is\n   * truly over: refresh token idle/max window elapsed). This is a\n   * server-confirmed end of session, so unlike `onExpired` it SHOULD broadcast\n   * a global logout to every tab. Falls back to `onExpired` when omitted.\n   */\n  onSessionDead?: () => void;\n  /**\n   * Read the access token currently in shared storage (localStorage/cookie).\n   * Because every open tab shares the same refresh cookie, an active tab that\n   * refreshes writes a newer access token here. When omitted, the hook never\n   * re-syncs across tabs.\n   */\n  getStoredToken?: () => string | null;\n  /**\n   * Adopt a newer shared token instead of expiring. Typically dispatches\n   * `setToken`, which updates Redux and causes this hook to re-arm against the\n   * later `exp`. Only called when `getStoredToken` returns a token whose `exp`\n   * is later than the in-memory one.\n   */\n  onResync?: (token: string) => void;\n  /**\n   * Epoch ms of the user's last interaction (pointer, key, scroll, …). Used to\n   * decide whether to silently renew (active) or log out (idle) when the access\n   * token expires. When omitted, the hook always treats expiry as idle.\n   */\n  getLastActivityAt?: () => number;\n  /**\n   * Silently renew the session (rotate the refresh token + mint a new access\n   * token). Resolves `true` on success — the resulting `setToken` re-arms this\n   * hook against the new `exp` — or `false` when the server rejects it. Only\n   * called when the user was active during the current token's lifetime.\n   */\n  renewSession?: () => Promise<boolean>;\n  /**\n   * Escape hatch for tests / dev environments where we don't want the\n   * automatic logout behavior. Mirrors the existing `_disableRenewToken`\n   * prop on `<AuthProvider>`.\n   */\n  disabled?: boolean;\n}\n\n/**\n * Keep the admin session alive while the user is active, and end it when they\n * are genuinely idle — without one tab tearing down another.\n *\n * The access token is short-lived (`accessTokenLifespan`, e.g. 30 min) and is\n * meant to be refreshed, not to be the session length. Two timers are armed per\n * token:\n *\n * - Renew (at `exp` minus a margin): if the user interacted during this token's\n *   lifetime, silently renew *ahead* of expiry. The new `setToken` re-arms the\n *   hook; a server rejection (`onSessionDead`) ends the session globally.\n *   Renewing early guarantees the refreshed token reaches shared storage before\n *   any sibling tab's logout timer fires.\n * - Logout (just after `exp`): the fallback when this tab did not renew. It\n *   first re-syncs from a token another tab refreshed (so an idle tab rides on\n *   an active sibling), then renews if activity arrived late, and only otherwise\n *   logs out — locally, so idle tabs never force-logout active ones.\n *\n * If the JWT can't be decoded (malformed, missing `exp`), the timers are skipped\n * silently — the active-tab redirect on 401 still covers the symptom on the next\n * user-initiated request.\n */\nconst useIdleSessionLogout = ({\n  token,\n  onExpired,\n  onSessionDead,\n  getStoredToken,\n  onResync,\n  getLastActivityAt,\n  renewSession,\n  disabled = false,\n}: UseIdleSessionLogoutOptions): void => {\n  React.useEffect(() => {\n    if (!token || disabled) {\n      return undefined;\n    }\n\n    const expiry = decodeAccessTokenExpiry(token);\n    if (expiry === null) {\n      return undefined;\n    }\n\n    // When this token became active. Activity recorded after this point means\n    // the user was present during the token's lifetime.\n    const armedAt = Date.now();\n    const wasActive = () =>\n      typeof getLastActivityAt === 'function' && getLastActivityAt() >= armedAt;\n\n    // Adopt a fresher token another tab wrote to shared storage. Returns true\n    // when it re-synced (caller should stop).\n    const tryResync = (): boolean => {\n      const storedToken = getStoredToken?.() ?? null;\n      if (storedToken && storedToken !== token && onResync) {\n        const storedExpiry = decodeAccessTokenExpiry(storedToken);\n        if (storedExpiry !== null && storedExpiry > expiry) {\n          onResync(storedToken);\n          return true;\n        }\n      }\n      return false;\n    };\n\n    const renew = () => {\n      renewSession!().then((renewed) => {\n        if (!renewed) {\n          // Server rejected the refresh: the session is truly over.\n          (onSessionDead ?? onExpired)();\n        }\n        // On success, storeToken -> setToken updates the token prop, which\n        // re-runs this effect and re-arms against the new exp.\n      });\n    };\n\n    // Renew ahead of expiry while the user is active.\n    const renewDelay = Math.max(expiry - armedAt - SESSION_RENEW_MARGIN_MS, 0);\n    const renewTimeoutId = window.setTimeout(() => {\n      if (tryResync()) {\n        return;\n      }\n      if (wasActive() && renewSession) {\n        renew();\n      }\n    }, renewDelay);\n\n    // Fallback decision just after expiry, for tabs that did not renew.\n    const logoutDelay = Math.max(expiry - armedAt + SESSION_EXPIRY_BUFFER_MS, 0);\n    const logoutTimeoutId = window.setTimeout(() => {\n      if (tryResync()) {\n        return;\n      }\n      if (wasActive() && renewSession) {\n        renew();\n        return;\n      }\n      // Genuinely idle: log out only this tab.\n      onExpired();\n    }, logoutDelay);\n\n    return () => {\n      window.clearTimeout(renewTimeoutId);\n      window.clearTimeout(logoutTimeoutId);\n    };\n  }, [\n    token,\n    onExpired,\n    onSessionDead,\n    getStoredToken,\n    onResync,\n    getLastActivityAt,\n    renewSession,\n    disabled,\n  ]);\n};\n\nexport { useIdleSessionLogout, SESSION_EXPIRY_BUFFER_MS, SESSION_RENEW_MARGIN_MS };\nexport type { UseIdleSessionLogoutOptions };\n"],"names":["SESSION_EXPIRY_BUFFER_MS","SESSION_RENEW_MARGIN_MS","useIdleSessionLogout","token","onExpired","onSessionDead","getStoredToken","onResync","getLastActivityAt","renewSession","disabled","React","useEffect","undefined","expiry","decodeAccessTokenExpiry","armedAt","Date","now","wasActive","tryResync","storedToken","storedExpiry","renew","then","renewed","renewDelay","Math","max","renewTimeoutId","window","setTimeout","logoutDelay","logoutTimeoutId","clearTimeout"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAIA,MAAMA,wBAAAA,GAA2B;AACjC;;;;;AAKC,UACKC,uBAAAA,GAA0B;AAyDhC;;;;;;;;;;;;;;;;;;;;;IAsBA,MAAMC,uBAAuB,CAAC,EAC5BC,KAAK,EACLC,SAAS,EACTC,aAAa,EACbC,cAAc,EACdC,QAAQ,EACRC,iBAAiB,EACjBC,YAAY,EACZC,QAAAA,GAAW,KAAK,EACY,GAAA;AAC5BC,IAAAA,gBAAAA,CAAMC,SAAS,CAAC,IAAA;QACd,IAAI,CAACT,SAASO,QAAAA,EAAU;YACtB,OAAOG,SAAAA;AACT,QAAA;AAEA,QAAA,MAAMC,SAASC,2BAAAA,CAAwBZ,KAAAA,CAAAA;AACvC,QAAA,IAAIW,WAAW,IAAA,EAAM;YACnB,OAAOD,SAAAA;AACT,QAAA;;;QAIA,MAAMG,OAAAA,GAAUC,KAAKC,GAAG,EAAA;AACxB,QAAA,MAAMC,SAAAA,GAAY,IAChB,OAAOX,iBAAAA,KAAsB,cAAcA,iBAAAA,EAAAA,IAAuBQ,OAAAA;;;AAIpE,QAAA,MAAMI,SAAAA,GAAY,IAAA;AAChB,YAAA,MAAMC,cAAcf,cAAAA,IAAAA,IAAsB,IAAA;YAC1C,IAAIe,WAAAA,IAAeA,WAAAA,KAAgBlB,KAAAA,IAASI,QAAAA,EAAU;AACpD,gBAAA,MAAMe,eAAeP,2BAAAA,CAAwBM,WAAAA,CAAAA;gBAC7C,IAAIC,YAAAA,KAAiB,IAAA,IAAQA,YAAAA,GAAeR,MAAAA,EAAQ;oBAClDP,QAAAA,CAASc,WAAAA,CAAAA;oBACT,OAAO,IAAA;AACT,gBAAA;AACF,YAAA;YACA,OAAO,KAAA;AACT,QAAA,CAAA;AAEA,QAAA,MAAME,KAAAA,GAAQ,IAAA;YACZd,YAAAA,EAAAA,CAAgBe,IAAI,CAAC,CAACC,OAAAA,GAAAA;AACpB,gBAAA,IAAI,CAACA,OAAAA,EAAS;;AAEXpB,oBAAAA,CAAAA,iBAAiBD,SAAQ,GAAA;AAC5B,gBAAA;;;AAGF,YAAA,CAAA,CAAA;AACF,QAAA,CAAA;;AAGA,QAAA,MAAMsB,aAAaC,IAAAA,CAAKC,GAAG,CAACd,MAAAA,GAASE,UAAUf,uBAAAA,EAAyB,CAAA,CAAA;QACxE,MAAM4B,cAAAA,GAAiBC,MAAAA,CAAOC,UAAU,CAAC,IAAA;AACvC,YAAA,IAAIX,SAAAA,EAAAA,EAAa;AACf,gBAAA;AACF,YAAA;AACA,YAAA,IAAID,eAAeV,YAAAA,EAAc;AAC/Bc,gBAAAA,KAAAA,EAAAA;AACF,YAAA;QACF,CAAA,EAAGG,UAAAA,CAAAA;;AAGH,QAAA,MAAMM,cAAcL,IAAAA,CAAKC,GAAG,CAACd,MAAAA,GAASE,UAAUhB,wBAAAA,EAA0B,CAAA,CAAA;QAC1E,MAAMiC,eAAAA,GAAkBH,MAAAA,CAAOC,UAAU,CAAC,IAAA;AACxC,YAAA,IAAIX,SAAAA,EAAAA,EAAa;AACf,gBAAA;AACF,YAAA;AACA,YAAA,IAAID,eAAeV,YAAAA,EAAc;AAC/Bc,gBAAAA,KAAAA,EAAAA;AACA,gBAAA;AACF,YAAA;;AAEAnB,YAAAA,SAAAA,EAAAA;QACF,CAAA,EAAG4B,WAAAA,CAAAA;QAEH,OAAO,IAAA;AACLF,YAAAA,MAAAA,CAAOI,YAAY,CAACL,cAAAA,CAAAA;AACpBC,YAAAA,MAAAA,CAAOI,YAAY,CAACD,eAAAA,CAAAA;AACtB,QAAA,CAAA;IACF,CAAA,EAAG;AACD9B,QAAAA,KAAAA;AACAC,QAAAA,SAAAA;AACAC,QAAAA,aAAAA;AACAC,QAAAA,cAAAA;AACAC,QAAAA,QAAAA;AACAC,QAAAA,iBAAAA;AACAC,QAAAA,YAAAA;AACAC,QAAAA;AACD,KAAA,CAAA;AACH;;;;;;"}

package/dist/admin/admin/src/hooks/useIdleSessionLogout.mjs

@@ -3,17 +3,33 @@ import { decodeAccessTokenExpiry } from '../utils/jwt.mjs';
 
 const SESSION_EXPIRY_BUFFER_MS = 1000;
 /**
- * Schedule a one-shot logout when the access token's `exp` elapses.
+ * How long before the access token's `exp` an active tab renews. Renewing
+ * ahead of expiry (rather than at it) means the refreshed token is already in
+ * shared storage by the time any *other* tab's logout timer fires — so an idle
+ * sibling re-syncs instead of racing the refresh and logging itself out.
+ */ const SESSION_RENEW_MARGIN_MS = 10000;
+/**
+ * Keep the admin session alive while the user is active, and end it when they
+ * are genuinely idle — without one tab tearing down another.
+ *
+ * The access token is short-lived (`accessTokenLifespan`, e.g. 30 min) and is
+ * meant to be refreshed, not to be the session length. Two timers are armed per
+ * token:
  *
- * The hook re-runs whenever `token` changes. While the user is active, every
- * API call that hits a 401 transparently refreshes the access token (see
- * `withTokenRefresh` in `getFetchClient.ts`), which dispatches `setToken` and
- * causes this effect to re-arm with the new, later `exp`.
+ * - Renew (at `exp` minus a margin): if the user interacted during this token's
+ *   lifetime, silently renew *ahead* of expiry. The new `setToken` re-arms the
+ *   hook; a server rejection (`onSessionDead`) ends the session globally.
+ *   Renewing early guarantees the refreshed token reaches shared storage before
+ *   any sibling tab's logout timer fires.
+ * - Logout (just after `exp`): the fallback when this tab did not renew. It
+ *   first re-syncs from a token another tab refreshed (so an idle tab rides on
+ *   an active sibling), then renews if activity arrived late, and only otherwise
+ *   logs out — locally, so idle tabs never force-logout active ones.
  *
- * If the JWT can't be decoded (malformed, missing `exp`), the timer is
- * skipped silently — the active-tab redirect on 401 still covers the
- * symptom on the next user-initiated request.
- */ const useIdleSessionLogout = ({ token, onExpired, disabled = false })=>{
+ * If the JWT can't be decoded (malformed, missing `exp`), the timers are skipped
+ * silently — the active-tab redirect on 401 still covers the symptom on the next
+ * user-initiated request.
+ */ const useIdleSessionLogout = ({ token, onExpired, onSessionDead, getStoredToken, onResync, getLastActivityAt, renewSession, disabled = false })=>{
     React.useEffect(()=>{
         if (!token || disabled) {
             return undefined;
@@ -22,19 +38,71 @@ const SESSION_EXPIRY_BUFFER_MS = 1000;
         if (expiry === null) {
             return undefined;
         }
-        const msUntilExpiry = expiry - Date.now() + SESSION_EXPIRY_BUFFER_MS;
-        const timeoutId = window.setTimeout(()=>{
+        // When this token became active. Activity recorded after this point means
+        // the user was present during the token's lifetime.
+        const armedAt = Date.now();
+        const wasActive = ()=>typeof getLastActivityAt === 'function' && getLastActivityAt() >= armedAt;
+        // Adopt a fresher token another tab wrote to shared storage. Returns true
+        // when it re-synced (caller should stop).
+        const tryResync = ()=>{
+            const storedToken = getStoredToken?.() ?? null;
+            if (storedToken && storedToken !== token && onResync) {
+                const storedExpiry = decodeAccessTokenExpiry(storedToken);
+                if (storedExpiry !== null && storedExpiry > expiry) {
+                    onResync(storedToken);
+                    return true;
+                }
+            }
+            return false;
+        };
+        const renew = ()=>{
+            renewSession().then((renewed)=>{
+                if (!renewed) {
+                    // Server rejected the refresh: the session is truly over.
+                    (onSessionDead ?? onExpired)();
+                }
+            // On success, storeToken -> setToken updates the token prop, which
+            // re-runs this effect and re-arms against the new exp.
+            });
+        };
+        // Renew ahead of expiry while the user is active.
+        const renewDelay = Math.max(expiry - armedAt - SESSION_RENEW_MARGIN_MS, 0);
+        const renewTimeoutId = window.setTimeout(()=>{
+            if (tryResync()) {
+                return;
+            }
+            if (wasActive() && renewSession) {
+                renew();
+            }
+        }, renewDelay);
+        // Fallback decision just after expiry, for tabs that did not renew.
+        const logoutDelay = Math.max(expiry - armedAt + SESSION_EXPIRY_BUFFER_MS, 0);
+        const logoutTimeoutId = window.setTimeout(()=>{
+            if (tryResync()) {
+                return;
+            }
+            if (wasActive() && renewSession) {
+                renew();
+                return;
+            }
+            // Genuinely idle: log out only this tab.
             onExpired();
-        }, Math.max(msUntilExpiry, 0));
+        }, logoutDelay);
         return ()=>{
-            window.clearTimeout(timeoutId);
+            window.clearTimeout(renewTimeoutId);
+            window.clearTimeout(logoutTimeoutId);
         };
     }, [
         token,
         onExpired,
+        onSessionDead,
+        getStoredToken,
+        onResync,
+        getLastActivityAt,
+        renewSession,
         disabled
     ]);
 };
 
-export { SESSION_EXPIRY_BUFFER_MS, useIdleSessionLogout };
+export { SESSION_EXPIRY_BUFFER_MS, SESSION_RENEW_MARGIN_MS, useIdleSessionLogout };
 //# sourceMappingURL=useIdleSessionLogout.mjs.map

package/dist/admin/admin/src/hooks/useIdleSessionLogout.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"useIdleSessionLogout.mjs","sources":["../../../../../admin/src/hooks/useIdleSessionLogout.ts"],"sourcesContent":["import * as React from 'react';\n\nimport { decodeAccessTokenExpiry } from '../utils/jwt';\n\nconst SESSION_EXPIRY_BUFFER_MS = 1000;\n\ninterface UseIdleSessionLogoutOptions {\n  /**\n   * The current admin access JWT (from Redux), or `null` when logged out.\n   */\n  token: string | null;\n  /**\n   * Called when the timer fires. Typically clears local auth state and\n   * navigates to /auth/login.\n   */\n  onExpired: () => void;\n  /**\n   * Escape hatch for tests / dev environments where we don't want the\n   * automatic logout behavior. Mirrors the existing `_disableRenewToken`\n   * prop on `<AuthProvider>`.\n   */\n  disabled?: boolean;\n}\n\n/**\n * Schedule a one-shot logout when the access token's `exp` elapses.\n *\n * The hook re-runs whenever `token` changes. While the user is active, every\n * API call that hits a 401 transparently refreshes the access token (see\n * `withTokenRefresh` in `getFetchClient.ts`), which dispatches `setToken` and\n * causes this effect to re-arm with the new, later `exp`.\n *\n * If the JWT can't be decoded (malformed, missing `exp`), the timer is\n * skipped silently — the active-tab redirect on 401 still covers the\n * symptom on the next user-initiated request.\n */\nconst useIdleSessionLogout = ({\n  token,\n  onExpired,\n  disabled = false,\n}: UseIdleSessionLogoutOptions): void => {\n  React.useEffect(() => {\n    if (!token || disabled) {\n      return undefined;\n    }\n\n    const expiry = decodeAccessTokenExpiry(token);\n    if (expiry === null) {\n      return undefined;\n    }\n\n    const msUntilExpiry = expiry - Date.now() + SESSION_EXPIRY_BUFFER_MS;\n\n    const timeoutId = window.setTimeout(\n      () => {\n        onExpired();\n      },\n      Math.max(msUntilExpiry, 0)\n    );\n\n    return () => {\n      window.clearTimeout(timeoutId);\n    };\n  }, [token, onExpired, disabled]);\n};\n\nexport { useIdleSessionLogout, SESSION_EXPIRY_BUFFER_MS };\nexport type { UseIdleSessionLogoutOptions };\n"],"names":["SESSION_EXPIRY_BUFFER_MS","useIdleSessionLogout","token","onExpired","disabled","React","useEffect","undefined","expiry","decodeAccessTokenExpiry","msUntilExpiry","Date","now","timeoutId","window","setTimeout","Math","max","clearTimeout"],"mappings":";;;AAIA,MAAMA,wBAAAA,GAA2B;AAoBjC;;;;;;;;;;;IAYA,MAAMC,oBAAAA,GAAuB,CAAC,EAC5BC,KAAK,EACLC,SAAS,EACTC,QAAAA,GAAW,KAAK,EACY,GAAA;AAC5BC,IAAAA,KAAAA,CAAMC,SAAS,CAAC,IAAA;QACd,IAAI,CAACJ,SAASE,QAAAA,EAAU;YACtB,OAAOG,SAAAA;AACT,QAAA;AAEA,QAAA,MAAMC,SAASC,uBAAAA,CAAwBP,KAAAA,CAAAA;AACvC,QAAA,IAAIM,WAAW,IAAA,EAAM;YACnB,OAAOD,SAAAA;AACT,QAAA;AAEA,QAAA,MAAMG,aAAAA,GAAgBF,MAAAA,GAASG,IAAAA,CAAKC,GAAG,EAAA,GAAKZ,wBAAAA;QAE5C,MAAMa,SAAAA,GAAYC,MAAAA,CAAOC,UAAU,CACjC,IAAA;AACEZ,YAAAA,SAAAA,EAAAA;QACF,CAAA,EACAa,IAAAA,CAAKC,GAAG,CAACP,aAAAA,EAAe,CAAA,CAAA,CAAA;QAG1B,OAAO,IAAA;AACLI,YAAAA,MAAAA,CAAOI,YAAY,CAACL,SAAAA,CAAAA;AACtB,QAAA,CAAA;IACF,CAAA,EAAG;AAACX,QAAAA,KAAAA;AAAOC,QAAAA,SAAAA;AAAWC,QAAAA;AAAS,KAAA,CAAA;AACjC;;;;"}
+{"version":3,"file":"useIdleSessionLogout.mjs","sources":["../../../../../admin/src/hooks/useIdleSessionLogout.ts"],"sourcesContent":["import * as React from 'react';\n\nimport { decodeAccessTokenExpiry } from '../utils/jwt';\n\nconst SESSION_EXPIRY_BUFFER_MS = 1000;\n/**\n * How long before the access token's `exp` an active tab renews. Renewing\n * ahead of expiry (rather than at it) means the refreshed token is already in\n * shared storage by the time any *other* tab's logout timer fires — so an idle\n * sibling re-syncs instead of racing the refresh and logging itself out.\n */\nconst SESSION_RENEW_MARGIN_MS = 10_000;\n\ninterface UseIdleSessionLogoutOptions {\n  /**\n   * The current admin access JWT (from Redux), or `null` when logged out.\n   */\n  token: string | null;\n  /**\n   * Called when the timer fires and the user is genuinely idle. Should clear\n   * *this tab's* local auth state and navigate to /auth/login. It must NOT\n   * broadcast a global logout (e.g. by removing the shared `isLoggedIn` key),\n   * otherwise an idle tab firing on a stale token would log out other tabs that\n   * are still active — see the cross-tab handling below.\n   */\n  onExpired: () => void;\n  /**\n   * Called when a renewal attempt is rejected by the server (the session is\n   * truly over: refresh token idle/max window elapsed). This is a\n   * server-confirmed end of session, so unlike `onExpired` it SHOULD broadcast\n   * a global logout to every tab. Falls back to `onExpired` when omitted.\n   */\n  onSessionDead?: () => void;\n  /**\n   * Read the access token currently in shared storage (localStorage/cookie).\n   * Because every open tab shares the same refresh cookie, an active tab that\n   * refreshes writes a newer access token here. When omitted, the hook never\n   * re-syncs across tabs.\n   */\n  getStoredToken?: () => string | null;\n  /**\n   * Adopt a newer shared token instead of expiring. Typically dispatches\n   * `setToken`, which updates Redux and causes this hook to re-arm against the\n   * later `exp`. Only called when `getStoredToken` returns a token whose `exp`\n   * is later than the in-memory one.\n   */\n  onResync?: (token: string) => void;\n  /**\n   * Epoch ms of the user's last interaction (pointer, key, scroll, …). Used to\n   * decide whether to silently renew (active) or log out (idle) when the access\n   * token expires. When omitted, the hook always treats expiry as idle.\n   */\n  getLastActivityAt?: () => number;\n  /**\n   * Silently renew the session (rotate the refresh token + mint a new access\n   * token). Resolves `true` on success — the resulting `setToken` re-arms this\n   * hook against the new `exp` — or `false` when the server rejects it. Only\n   * called when the user was active during the current token's lifetime.\n   */\n  renewSession?: () => Promise<boolean>;\n  /**\n   * Escape hatch for tests / dev environments where we don't want the\n   * automatic logout behavior. Mirrors the existing `_disableRenewToken`\n   * prop on `<AuthProvider>`.\n   */\n  disabled?: boolean;\n}\n\n/**\n * Keep the admin session alive while the user is active, and end it when they\n * are genuinely idle — without one tab tearing down another.\n *\n * The access token is short-lived (`accessTokenLifespan`, e.g. 30 min) and is\n * meant to be refreshed, not to be the session length. Two timers are armed per\n * token:\n *\n * - Renew (at `exp` minus a margin): if the user interacted during this token's\n *   lifetime, silently renew *ahead* of expiry. The new `setToken` re-arms the\n *   hook; a server rejection (`onSessionDead`) ends the session globally.\n *   Renewing early guarantees the refreshed token reaches shared storage before\n *   any sibling tab's logout timer fires.\n * - Logout (just after `exp`): the fallback when this tab did not renew. It\n *   first re-syncs from a token another tab refreshed (so an idle tab rides on\n *   an active sibling), then renews if activity arrived late, and only otherwise\n *   logs out — locally, so idle tabs never force-logout active ones.\n *\n * If the JWT can't be decoded (malformed, missing `exp`), the timers are skipped\n * silently — the active-tab redirect on 401 still covers the symptom on the next\n * user-initiated request.\n */\nconst useIdleSessionLogout = ({\n  token,\n  onExpired,\n  onSessionDead,\n  getStoredToken,\n  onResync,\n  getLastActivityAt,\n  renewSession,\n  disabled = false,\n}: UseIdleSessionLogoutOptions): void => {\n  React.useEffect(() => {\n    if (!token || disabled) {\n      return undefined;\n    }\n\n    const expiry = decodeAccessTokenExpiry(token);\n    if (expiry === null) {\n      return undefined;\n    }\n\n    // When this token became active. Activity recorded after this point means\n    // the user was present during the token's lifetime.\n    const armedAt = Date.now();\n    const wasActive = () =>\n      typeof getLastActivityAt === 'function' && getLastActivityAt() >= armedAt;\n\n    // Adopt a fresher token another tab wrote to shared storage. Returns true\n    // when it re-synced (caller should stop).\n    const tryResync = (): boolean => {\n      const storedToken = getStoredToken?.() ?? null;\n      if (storedToken && storedToken !== token && onResync) {\n        const storedExpiry = decodeAccessTokenExpiry(storedToken);\n        if (storedExpiry !== null && storedExpiry > expiry) {\n          onResync(storedToken);\n          return true;\n        }\n      }\n      return false;\n    };\n\n    const renew = () => {\n      renewSession!().then((renewed) => {\n        if (!renewed) {\n          // Server rejected the refresh: the session is truly over.\n          (onSessionDead ?? onExpired)();\n        }\n        // On success, storeToken -> setToken updates the token prop, which\n        // re-runs this effect and re-arms against the new exp.\n      });\n    };\n\n    // Renew ahead of expiry while the user is active.\n    const renewDelay = Math.max(expiry - armedAt - SESSION_RENEW_MARGIN_MS, 0);\n    const renewTimeoutId = window.setTimeout(() => {\n      if (tryResync()) {\n        return;\n      }\n      if (wasActive() && renewSession) {\n        renew();\n      }\n    }, renewDelay);\n\n    // Fallback decision just after expiry, for tabs that did not renew.\n    const logoutDelay = Math.max(expiry - armedAt + SESSION_EXPIRY_BUFFER_MS, 0);\n    const logoutTimeoutId = window.setTimeout(() => {\n      if (tryResync()) {\n        return;\n      }\n      if (wasActive() && renewSession) {\n        renew();\n        return;\n      }\n      // Genuinely idle: log out only this tab.\n      onExpired();\n    }, logoutDelay);\n\n    return () => {\n      window.clearTimeout(renewTimeoutId);\n      window.clearTimeout(logoutTimeoutId);\n    };\n  }, [\n    token,\n    onExpired,\n    onSessionDead,\n    getStoredToken,\n    onResync,\n    getLastActivityAt,\n    renewSession,\n    disabled,\n  ]);\n};\n\nexport { useIdleSessionLogout, SESSION_EXPIRY_BUFFER_MS, SESSION_RENEW_MARGIN_MS };\nexport type { UseIdleSessionLogoutOptions };\n"],"names":["SESSION_EXPIRY_BUFFER_MS","SESSION_RENEW_MARGIN_MS","useIdleSessionLogout","token","onExpired","onSessionDead","getStoredToken","onResync","getLastActivityAt","renewSession","disabled","React","useEffect","undefined","expiry","decodeAccessTokenExpiry","armedAt","Date","now","wasActive","tryResync","storedToken","storedExpiry","renew","then","renewed","renewDelay","Math","max","renewTimeoutId","window","setTimeout","logoutDelay","logoutTimeoutId","clearTimeout"],"mappings":";;;AAIA,MAAMA,wBAAAA,GAA2B;AACjC;;;;;AAKC,UACKC,uBAAAA,GAA0B;AAyDhC;;;;;;;;;;;;;;;;;;;;;IAsBA,MAAMC,uBAAuB,CAAC,EAC5BC,KAAK,EACLC,SAAS,EACTC,aAAa,EACbC,cAAc,EACdC,QAAQ,EACRC,iBAAiB,EACjBC,YAAY,EACZC,QAAAA,GAAW,KAAK,EACY,GAAA;AAC5BC,IAAAA,KAAAA,CAAMC,SAAS,CAAC,IAAA;QACd,IAAI,CAACT,SAASO,QAAAA,EAAU;YACtB,OAAOG,SAAAA;AACT,QAAA;AAEA,QAAA,MAAMC,SAASC,uBAAAA,CAAwBZ,KAAAA,CAAAA;AACvC,QAAA,IAAIW,WAAW,IAAA,EAAM;YACnB,OAAOD,SAAAA;AACT,QAAA;;;QAIA,MAAMG,OAAAA,GAAUC,KAAKC,GAAG,EAAA;AACxB,QAAA,MAAMC,SAAAA,GAAY,IAChB,OAAOX,iBAAAA,KAAsB,cAAcA,iBAAAA,EAAAA,IAAuBQ,OAAAA;;;AAIpE,QAAA,MAAMI,SAAAA,GAAY,IAAA;AAChB,YAAA,MAAMC,cAAcf,cAAAA,IAAAA,IAAsB,IAAA;YAC1C,IAAIe,WAAAA,IAAeA,WAAAA,KAAgBlB,KAAAA,IAASI,QAAAA,EAAU;AACpD,gBAAA,MAAMe,eAAeP,uBAAAA,CAAwBM,WAAAA,CAAAA;gBAC7C,IAAIC,YAAAA,KAAiB,IAAA,IAAQA,YAAAA,GAAeR,MAAAA,EAAQ;oBAClDP,QAAAA,CAASc,WAAAA,CAAAA;oBACT,OAAO,IAAA;AACT,gBAAA;AACF,YAAA;YACA,OAAO,KAAA;AACT,QAAA,CAAA;AAEA,QAAA,MAAME,KAAAA,GAAQ,IAAA;YACZd,YAAAA,EAAAA,CAAgBe,IAAI,CAAC,CAACC,OAAAA,GAAAA;AACpB,gBAAA,IAAI,CAACA,OAAAA,EAAS;;AAEXpB,oBAAAA,CAAAA,iBAAiBD,SAAQ,GAAA;AAC5B,gBAAA;;;AAGF,YAAA,CAAA,CAAA;AACF,QAAA,CAAA;;AAGA,QAAA,MAAMsB,aAAaC,IAAAA,CAAKC,GAAG,CAACd,MAAAA,GAASE,UAAUf,uBAAAA,EAAyB,CAAA,CAAA;QACxE,MAAM4B,cAAAA,GAAiBC,MAAAA,CAAOC,UAAU,CAAC,IAAA;AACvC,YAAA,IAAIX,SAAAA,EAAAA,EAAa;AACf,gBAAA;AACF,YAAA;AACA,YAAA,IAAID,eAAeV,YAAAA,EAAc;AAC/Bc,gBAAAA,KAAAA,EAAAA;AACF,YAAA;QACF,CAAA,EAAGG,UAAAA,CAAAA;;AAGH,QAAA,MAAMM,cAAcL,IAAAA,CAAKC,GAAG,CAACd,MAAAA,GAASE,UAAUhB,wBAAAA,EAA0B,CAAA,CAAA;QAC1E,MAAMiC,eAAAA,GAAkBH,MAAAA,CAAOC,UAAU,CAAC,IAAA;AACxC,YAAA,IAAIX,SAAAA,EAAAA,EAAa;AACf,gBAAA;AACF,YAAA;AACA,YAAA,IAAID,eAAeV,YAAAA,EAAc;AAC/Bc,gBAAAA,KAAAA,EAAAA;AACA,gBAAA;AACF,YAAA;;AAEAnB,YAAAA,SAAAA,EAAAA;QACF,CAAA,EAAG4B,WAAAA,CAAAA;QAEH,OAAO,IAAA;AACLF,YAAAA,MAAAA,CAAOI,YAAY,CAACL,cAAAA,CAAAA;AACpBC,YAAAA,MAAAA,CAAOI,YAAY,CAACD,eAAAA,CAAAA;AACtB,QAAA,CAAA;IACF,CAAA,EAAG;AACD9B,QAAAA,KAAAA;AACAC,QAAAA,SAAAA;AACAC,QAAAA,aAAAA;AACAC,QAAAA,cAAAA;AACAC,QAAAA,QAAAA;AACAC,QAAAA,iBAAAA;AACAC,QAAAA,YAAAA;AACAC,QAAAA;AACD,KAAA,CAAA;AACH;;;;"}

package/dist/admin/admin/src/hooks/useIsMounted.js

@@ -2,7 +2,8 @@
 
 var React = require('react');
 
-function _interopNamespaceDefault(e) {
+function _interopNamespace(e) {
+  if (e && e.__esModule) return e;
   var n = Object.create(null);
   if (e) {
     Object.keys(e).forEach(function (k) {
@@ -19,7 +20,7 @@ function _interopNamespaceDefault(e) {
   return Object.freeze(n);
 }
 
-var React__namespace = /*#__PURE__*/_interopNamespaceDefault(React);
+var React__namespace = /*#__PURE__*/_interopNamespace(React);
 
 const useIsMounted = ()=>{
     const isMounted = React__namespace.useRef(false);

package/dist/admin/admin/src/hooks/useIsMounted.js.map

@@ -1 +1 @@
-{"version":3,"file":"useIsMounted.js","sources":["../../../../../admin/src/hooks/useIsMounted.ts"],"sourcesContent":["import * as React from 'react';\n\nconst useIsMounted = () => {\n  const isMounted = React.useRef(false);\n\n  React.useLayoutEffect(() => {\n    isMounted.current = true;\n\n    return () => {\n      isMounted.current = false;\n    };\n  }, []);\n\n  return isMounted;\n};\n\nexport { useIsMounted };\n"],"names":["useIsMounted","isMounted","React","useRef","useLayoutEffect","current"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAEA,MAAMA,YAAAA,GAAe,IAAA;IACnB,MAAMC,SAAAA,GAAYC,gBAAAA,CAAMC,MAAM,CAAC,KAAA,CAAA;AAE/BD,IAAAA,gBAAAA,CAAME,eAAe,CAAC,IAAA;AACpBH,QAAAA,SAAAA,CAAUI,OAAO,GAAG,IAAA;QAEpB,OAAO,IAAA;AACLJ,YAAAA,SAAAA,CAAUI,OAAO,GAAG,KAAA;AACtB,QAAA,CAAA;AACF,IAAA,CAAA,EAAG,EAAE,CAAA;IAEL,OAAOJ,SAAAA;AACT;;;;"}
+{"version":3,"file":"useIsMounted.js","sources":["../../../../../admin/src/hooks/useIsMounted.ts"],"sourcesContent":["import * as React from 'react';\n\nconst useIsMounted = () => {\n  const isMounted = React.useRef(false);\n\n  React.useLayoutEffect(() => {\n    isMounted.current = true;\n\n    return () => {\n      isMounted.current = false;\n    };\n  }, []);\n\n  return isMounted;\n};\n\nexport { useIsMounted };\n"],"names":["useIsMounted","isMounted","React","useRef","useLayoutEffect","current"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAEA,MAAMA,YAAAA,GAAe,IAAA;IACnB,MAAMC,SAAAA,GAAYC,gBAAAA,CAAMC,MAAM,CAAC,KAAA,CAAA;AAE/BD,IAAAA,gBAAAA,CAAME,eAAe,CAAC,IAAA;AACpBH,QAAAA,SAAAA,CAAUI,OAAO,GAAG,IAAA;QAEpB,OAAO,IAAA;AACLJ,YAAAA,SAAAA,CAAUI,OAAO,GAAG,KAAA;AACtB,QAAA,CAAA;AACF,IAAA,CAAA,EAAG,EAAE,CAAA;IAEL,OAAOJ,SAAAA;AACT;;;;"}

package/dist/admin/admin/src/hooks/useMediaQuery.js

@@ -3,7 +3,8 @@
 var React = require('react');
 var styled = require('styled-components');
 
-function _interopNamespaceDefault(e) {
+function _interopNamespace(e) {
+  if (e && e.__esModule) return e;
   var n = Object.create(null);
   if (e) {
     Object.keys(e).forEach(function (k) {
@@ -20,7 +21,7 @@ function _interopNamespaceDefault(e) {
   return Object.freeze(n);
 }
 
-var React__namespace = /*#__PURE__*/_interopNamespaceDefault(React);
+var React__namespace = /*#__PURE__*/_interopNamespace(React);
 
 /**
  * Hook to detect if a media query matches

package/dist/admin/admin/src/hooks/useMediaQuery.js.map

@@ -1 +1 @@
-{"version":3,"file":"useMediaQuery.js","sources":["../../../../../admin/src/hooks/useMediaQuery.ts"],"sourcesContent":["import * as React from 'react';\n\nimport { useTheme } from 'styled-components';\n\n/**\n * Hook to detect if a media query matches\n * @param query - Media query string (e.g., '(min-width: 768px)' or theme.breakpoints.large)\n * @returns boolean indicating if the media query matches\n */\nexport const useMediaQuery = (query: string): boolean => {\n  const cleanQuery = query.replace('@media', '').trim();\n\n  const [matches, setMatches] = React.useState(() => window.matchMedia(cleanQuery).matches);\n\n  React.useEffect(() => {\n    const mediaQuery = window.matchMedia(cleanQuery);\n    const handler = (e: MediaQueryListEvent) => setMatches(e.matches);\n\n    mediaQuery.addEventListener('change', handler);\n\n    return () => mediaQuery.removeEventListener('change', handler);\n  }, [cleanQuery]);\n\n  return matches;\n};\n\n/**\n * Hook to detect if the current viewport is desktop size\n * Uses the theme's large breakpoint\n */\nexport const useIsDesktop = (): boolean => {\n  const theme = useTheme();\n  return useMediaQuery(theme.breakpoints.large);\n};\n\n/**\n * Hook to detect if the current viewport is tablet size\n * Uses the theme's medium breakpoint\n */\nexport const useIsTablet = (): boolean => {\n  const theme = useTheme();\n  const isTabletOrAbove = useMediaQuery(theme.breakpoints.medium);\n  const isDesktop = useMediaQuery(theme.breakpoints.large);\n  return isTabletOrAbove && !isDesktop;\n};\n\n/**\n * Hook to detect if the current viewport is mobile size\n * Uses the theme's medium breakpoint (inverted)\n */\nexport const useIsMobile = (): boolean => {\n  const theme = useTheme();\n  return !useMediaQuery(theme.breakpoints.medium);\n};\n"],"names":["useMediaQuery","query","cleanQuery","replace","trim","matches","setMatches","React","useState","window","matchMedia","useEffect","mediaQuery","handler","e","addEventListener","removeEventListener","useIsDesktop","theme","useTheme","breakpoints","large","useIsTablet","isTabletOrAbove","medium","isDesktop","useIsMobile"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAIA;;;;IAKO,MAAMA,aAAAA,GAAgB,CAACC,KAAAA,GAAAA;AAC5B,IAAA,MAAMC,aAAaD,KAAAA,CAAME,OAAO,CAAC,QAAA,EAAU,IAAIC,IAAI,EAAA;AAEnD,IAAA,MAAM,CAACC,OAAAA,EAASC,UAAAA,CAAW,GAAGC,gBAAAA,CAAMC,QAAQ,CAAC,IAAMC,MAAAA,CAAOC,UAAU,CAACR,UAAAA,CAAAA,CAAYG,OAAO,CAAA;AAExFE,IAAAA,gBAAAA,CAAMI,SAAS,CAAC,IAAA;QACd,MAAMC,UAAAA,GAAaH,MAAAA,CAAOC,UAAU,CAACR,UAAAA,CAAAA;AACrC,QAAA,MAAMW,OAAAA,GAAU,CAACC,CAAAA,GAA2BR,UAAAA,CAAWQ,EAAET,OAAO,CAAA;QAEhEO,UAAAA,CAAWG,gBAAgB,CAAC,QAAA,EAAUF,OAAAA,CAAAA;AAEtC,QAAA,OAAO,IAAMD,UAAAA,CAAWI,mBAAmB,CAAC,QAAA,EAAUH,OAAAA,CAAAA;IACxD,CAAA,EAAG;AAACX,QAAAA;AAAW,KAAA,CAAA;IAEf,OAAOG,OAAAA;AACT;AAEA;;;UAIaY,YAAAA,GAAe,IAAA;AAC1B,IAAA,MAAMC,KAAAA,GAAQC,eAAAA,EAAAA;AACd,IAAA,OAAOnB,aAAAA,CAAckB,KAAAA,CAAME,WAAW,CAACC,KAAK,CAAA;AAC9C;AAEA;;;UAIaC,WAAAA,GAAc,IAAA;AACzB,IAAA,MAAMJ,KAAAA,GAAQC,eAAAA,EAAAA;AACd,IAAA,MAAMI,eAAAA,GAAkBvB,aAAAA,CAAckB,KAAAA,CAAME,WAAW,CAACI,MAAM,CAAA;AAC9D,IAAA,MAAMC,SAAAA,GAAYzB,aAAAA,CAAckB,KAAAA,CAAME,WAAW,CAACC,KAAK,CAAA;AACvD,IAAA,OAAOE,mBAAmB,CAACE,SAAAA;AAC7B;AAEA;;;UAIaC,WAAAA,GAAc,IAAA;AACzB,IAAA,MAAMR,KAAAA,GAAQC,eAAAA,EAAAA;AACd,IAAA,OAAO,CAACnB,aAAAA,CAAckB,KAAAA,CAAME,WAAW,CAACI,MAAM,CAAA;AAChD;;;;;;;"}
+{"version":3,"file":"useMediaQuery.js","sources":["../../../../../admin/src/hooks/useMediaQuery.ts"],"sourcesContent":["import * as React from 'react';\n\nimport { useTheme } from 'styled-components';\n\n/**\n * Hook to detect if a media query matches\n * @param query - Media query string (e.g., '(min-width: 768px)' or theme.breakpoints.large)\n * @returns boolean indicating if the media query matches\n */\nexport const useMediaQuery = (query: string): boolean => {\n  const cleanQuery = query.replace('@media', '').trim();\n\n  const [matches, setMatches] = React.useState(() => window.matchMedia(cleanQuery).matches);\n\n  React.useEffect(() => {\n    const mediaQuery = window.matchMedia(cleanQuery);\n    const handler = (e: MediaQueryListEvent) => setMatches(e.matches);\n\n    mediaQuery.addEventListener('change', handler);\n\n    return () => mediaQuery.removeEventListener('change', handler);\n  }, [cleanQuery]);\n\n  return matches;\n};\n\n/**\n * Hook to detect if the current viewport is desktop size\n * Uses the theme's large breakpoint\n */\nexport const useIsDesktop = (): boolean => {\n  const theme = useTheme();\n  return useMediaQuery(theme.breakpoints.large);\n};\n\n/**\n * Hook to detect if the current viewport is tablet size\n * Uses the theme's medium breakpoint\n */\nexport const useIsTablet = (): boolean => {\n  const theme = useTheme();\n  const isTabletOrAbove = useMediaQuery(theme.breakpoints.medium);\n  const isDesktop = useMediaQuery(theme.breakpoints.large);\n  return isTabletOrAbove && !isDesktop;\n};\n\n/**\n * Hook to detect if the current viewport is mobile size\n * Uses the theme's medium breakpoint (inverted)\n */\nexport const useIsMobile = (): boolean => {\n  const theme = useTheme();\n  return !useMediaQuery(theme.breakpoints.medium);\n};\n"],"names":["useMediaQuery","query","cleanQuery","replace","trim","matches","setMatches","React","useState","window","matchMedia","useEffect","mediaQuery","handler","e","addEventListener","removeEventListener","useIsDesktop","theme","useTheme","breakpoints","large","useIsTablet","isTabletOrAbove","medium","isDesktop","useIsMobile"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAIA;;;;IAKO,MAAMA,aAAAA,GAAgB,CAACC,KAAAA,GAAAA;AAC5B,IAAA,MAAMC,aAAaD,KAAAA,CAAME,OAAO,CAAC,QAAA,EAAU,IAAIC,IAAI,EAAA;AAEnD,IAAA,MAAM,CAACC,OAAAA,EAASC,UAAAA,CAAW,GAAGC,gBAAAA,CAAMC,QAAQ,CAAC,IAAMC,MAAAA,CAAOC,UAAU,CAACR,UAAAA,CAAAA,CAAYG,OAAO,CAAA;AAExFE,IAAAA,gBAAAA,CAAMI,SAAS,CAAC,IAAA;QACd,MAAMC,UAAAA,GAAaH,MAAAA,CAAOC,UAAU,CAACR,UAAAA,CAAAA;AACrC,QAAA,MAAMW,OAAAA,GAAU,CAACC,CAAAA,GAA2BR,UAAAA,CAAWQ,EAAET,OAAO,CAAA;QAEhEO,UAAAA,CAAWG,gBAAgB,CAAC,QAAA,EAAUF,OAAAA,CAAAA;AAEtC,QAAA,OAAO,IAAMD,UAAAA,CAAWI,mBAAmB,CAAC,QAAA,EAAUH,OAAAA,CAAAA;IACxD,CAAA,EAAG;AAACX,QAAAA;AAAW,KAAA,CAAA;IAEf,OAAOG,OAAAA;AACT;AAEA;;;UAIaY,YAAAA,GAAe,IAAA;AAC1B,IAAA,MAAMC,KAAAA,GAAQC,eAAAA,EAAAA;AACd,IAAA,OAAOnB,aAAAA,CAAckB,KAAAA,CAAME,WAAW,CAACC,KAAK,CAAA;AAC9C;AAEA;;;UAIaC,WAAAA,GAAc,IAAA;AACzB,IAAA,MAAMJ,KAAAA,GAAQC,eAAAA,EAAAA;AACd,IAAA,MAAMI,eAAAA,GAAkBvB,aAAAA,CAAckB,KAAAA,CAAME,WAAW,CAACI,MAAM,CAAA;AAC9D,IAAA,MAAMC,SAAAA,GAAYzB,aAAAA,CAAckB,KAAAA,CAAME,WAAW,CAACC,KAAK,CAAA;AACvD,IAAA,OAAOE,mBAAmB,CAACE,SAAAA;AAC7B;AAEA;;;UAIaC,WAAAA,GAAc,IAAA;AACzB,IAAA,MAAMR,KAAAA,GAAQC,eAAAA,EAAAA;AACd,IAAA,OAAO,CAACnB,aAAAA,CAAckB,KAAAA,CAAME,WAAW,CAACI,MAAM,CAAA;AAChD;;;;;;;"}

package/dist/admin/admin/src/hooks/useMenu.js

@@ -7,7 +7,10 @@ var hooks = require('../core/store/hooks.js');
 var Auth = require('../features/Auth.js');
 var StrapiApp = require('../features/StrapiApp.js');
 
-function _interopNamespaceDefault(e) {
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+function _interopNamespace(e) {
+  if (e && e.__esModule) return e;
   var n = Object.create(null);
   if (e) {
     Object.keys(e).forEach(function (k) {
@@ -24,11 +27,15 @@ function _interopNamespaceDefault(e) {
   return Object.freeze(n);
 }
 
-var React__namespace = /*#__PURE__*/_interopNamespaceDefault(React);
+var React__namespace = /*#__PURE__*/_interopNamespace(React);
+var cloneDeep__default = /*#__PURE__*/_interopDefault(cloneDeep);
 
 const useMenu = (shouldUpdateStrapi)=>{
     const checkUserHasPermissions = Auth.useAuth('useMenu', (state)=>state.checkUserHasPermissions);
-    const menu = StrapiApp.useStrapiApp('useMenu', (state)=>state.menu);
+    const rawMenu = StrapiApp.useStrapiApp('useMenu', (state)=>state.menu);
+    const menu = React__namespace.useMemo(()=>normalizeMenuLinks(rawMenu), [
+        rawMenu
+    ]);
     const permissions = hooks.useTypedSelector((state)=>state.admin_app.permissions);
     const [menuWithUserPermissions, setMenuWithUserPermissions] = React__namespace.useState({
         generalSectionLinks: [
@@ -115,21 +122,53 @@ const useMenu = (shouldUpdateStrapi)=>{
 /* -------------------------------------------------------------------------------------------------
  * Utils
  * -----------------------------------------------------------------------------------------------*/ const getGeneralLinks = async (generalSectionRawLinks, shouldUpdateStrapi = false, checkUserHasPermissions)=>{
-    const generalSectionLinksPermissions = await Promise.all(generalSectionRawLinks.map(({ permissions })=>checkUserHasPermissions(permissions)));
-    const authorizedGeneralSectionLinks = generalSectionRawLinks.filter((_, index)=>generalSectionLinksPermissions[index].length > 0);
+    const generalSectionLinks = normalizeMenuLinks(generalSectionRawLinks);
+    const generalSectionLinksPermissions = await Promise.all(generalSectionLinks.map(({ permissions })=>checkUserHasPermissions(permissions)));
+    const authorizedGeneralSectionLinks = generalSectionLinks.filter((_, index)=>generalSectionLinksPermissions[index].length > 0);
     const settingsLinkIndex = authorizedGeneralSectionLinks.findIndex((obj)=>obj.to === '/settings');
     if (settingsLinkIndex === -1) {
         return [];
     }
-    const authorizedGeneralLinksClone = cloneDeep(authorizedGeneralSectionLinks);
+    const authorizedGeneralLinksClone = cloneDeep__default.default(authorizedGeneralSectionLinks);
     authorizedGeneralLinksClone[settingsLinkIndex].notificationsCount = shouldUpdateStrapi ? 1 : 0;
     return authorizedGeneralLinksClone;
 };
 const getPluginSectionLinks = async (pluginsSectionRawLinks, checkUserHasPermissions)=>{
-    const pluginSectionLinksPermissions = await Promise.all(pluginsSectionRawLinks.map(({ permissions })=>checkUserHasPermissions(permissions)));
-    const authorizedPluginSectionLinks = pluginsSectionRawLinks.filter((_, index)=>pluginSectionLinksPermissions[index].length > 0);
+    const pluginSectionLinks = normalizeMenuLinks(pluginsSectionRawLinks);
+    const pluginSectionLinksPermissions = await Promise.all(pluginSectionLinks.map(({ permissions })=>checkUserHasPermissions(permissions)));
+    const authorizedPluginSectionLinks = pluginSectionLinks.filter((_, index)=>pluginSectionLinksPermissions[index].length > 0);
     return authorizedPluginSectionLinks;
 };
+const normalizeMenuLinks = (links)=>{
+    if (!Array.isArray(links)) {
+        return [];
+    }
+    const isValidIcon = (icon)=>{
+        if (typeof icon === 'string' || typeof icon === 'function' || React__namespace.isValidElement(icon)) {
+            return true;
+        }
+        if (!icon || typeof icon !== 'object') {
+            return false;
+        }
+        const reactType = icon.$$typeof;
+        return reactType === Symbol.for('react.forward_ref') || reactType === Symbol.for('react.memo') || reactType === Symbol.for('react.lazy');
+    };
+    return links.reduce((acc, link)=>{
+        if (!link || typeof link !== 'object') {
+            return acc;
+        }
+        const candidate = link;
+        if (typeof candidate.to !== 'string' || !isValidIcon(candidate.icon) || typeof candidate.intlLabel?.id !== 'string' || typeof candidate.intlLabel.defaultMessage !== 'string') {
+            return acc;
+        }
+        acc.push({
+            ...candidate,
+            permissions: Array.isArray(candidate.permissions) ? candidate.permissions : []
+        });
+        return acc;
+    }, []);
+};
 
+exports.normalizeMenuLinks = normalizeMenuLinks;
 exports.useMenu = useMenu;
 //# sourceMappingURL=useMenu.js.map