@wildo-ai/saas-frontend-lib 1.0.1

package/dist/esm/core/security/AuthSessionContext.js

@@ -0,0 +1,971 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { createContext, useState, useMemo, useEffect, useCallback, useRef } from 'react';
+import { startAuthentication } from '@simplewebauthn/browser';
+import { AuthMethod, AuthFactorLevel, AuthSessionPurpose, SessionType, isWildoBackendError, } from '@wildo-ai/saas-models';
+import { getManualCallsHttpClient } from '../../core/requests/wildo-http-client-manual-calls.frontend.service.js';
+import { useResourceRegistry } from '../../core/resources/useResourceRegistry.js';
+import { useI18n } from '../../core/i18n/useI18n.js';
+import { LoggerFrontendService } from '../../core/monitoring/logger.frontend.service.js';
+import { useError } from '../../core/errors/useError.js';
+import { useApplication } from '../../core/runtime/useApplication.js';
+import { useWebSocket } from '../../core/requests/websockets/useWebSocket.js';
+import { useAnonymousSession } from '../../core/security/AnonymousSessionContext.js';
+import { EMPTY_AUTH_STATE, } from './security.frontend.schemas.js';
+import { PersistentSessionTokenStorage, } from './session-token-storage.frontend.service.js';
+import { FrontendComponentType, MfaChallengeLabel, UserAuthLabel } from '@wildo-ai/presets-components-models';
+const logger = LoggerFrontendService.getLogger();
+const logDebug = logger.debugByType('AuthSessionContext');
+logger.setDebugTypeLogging('AuthSessionContext', false);
+/**
+ * AuthSession Context
+ * @internal - Use useAuthSession() hook instead of accessing this directly
+ */
+export const AuthSessionContext = createContext(undefined);
+export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }) => {
+    const tokenStorage = useMemo(() => tokenStorageProp ?? new PersistentSessionTokenStorage(), [tokenStorageProp]);
+    const { setAuthToken: setResourcesAuthToken, setTokenRenewalHandler: setResourcesTokenRenewalHandler, setConsumableToken: setResourcesConsumableToken } = useResourceRegistry();
+    const { handleError } = useError();
+    const { tComponent, isReady } = useI18n({ component: [FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH, FrontendComponentType.PUBLIC_LAYOUTS_MFA_CHALLENGE] });
+    const { appConfig } = useApplication();
+    const { connect, disconnect, switchOrganization: wsSwitchOrganization } = useWebSocket();
+    const { clearAnonymousSession } = useAnonymousSession();
+    const hasInitializedRef = useRef(false);
+    const broadcastChannelRef = useRef(null);
+    const refreshInFlightRef = useRef(null);
+    const [auth, setAuth] = useState({
+        ...EMPTY_AUTH_STATE,
+        accessToken: tokenStorage.getAccessToken(),
+        refreshToken: tokenStorage.getRefreshToken(),
+    });
+    const storeAuthTokens = (accessToken, refreshToken) => {
+        tokenStorage.storeTokens(accessToken, refreshToken);
+        if (accessToken) {
+            clearAnonymousSession();
+        }
+    };
+    /**
+     * Derive WebSocket URL from appConfig runtime endpoints
+     *
+     * IMPORTANT: Always use publicUrl (never internalUrl) since browsers cannot access
+     * internal Kubernetes service URLs. The publicUrl is the Traefik ingress URL
+     * that the browser can reach.
+     *
+     * Returns null if URL cannot be derived - WebSocket should not connect in this case.
+     */
+    const deriveWebSocketUrl = useCallback(() => {
+        if (!appConfig?.runtime?.endPoints?.main_backend_api) {
+            logger.warn('WebSocket: Cannot derive URL - appConfig.runtime.endPoints.main_backend_api not available');
+            return null;
+        }
+        const backendUrl = appConfig.runtime.endPoints.main_backend_api;
+        // CRITICAL: Always use publicUrl for WebSocket connections from browser
+        // internalUrl is only accessible within the Kubernetes cluster
+        const urlString = backendUrl.publicUrl;
+        if (!urlString) {
+            logger.warn('WebSocket: Cannot derive URL - publicUrl not available in main_backend_api config');
+            return null;
+        }
+        // Convert http:// to ws:// and https:// to wss://
+        // IMPORTANT: Do NOT append /socket.io to the URL - Socket.IO automatically
+        // uses /socket.io as the engine.io path. If we include it here, Socket.IO
+        // interprets it as a namespace, causing "Invalid namespace" errors.
+        const wsUrl = urlString.replace(/^http/, 'ws');
+        return wsUrl;
+    }, [appConfig]);
+    /**
+     * Connect WebSocket with current authentication token
+     * Only connects if URL is available and token is valid
+     */
+    const connectWebSocket = useCallback((token, organizationId, consumableToken) => {
+        if (!token) {
+            logDebug('WebSocket: Cannot connect - no token provided');
+            return;
+        }
+        const wsUrl = deriveWebSocketUrl();
+        if (!wsUrl) {
+            logDebug('WebSocket: Cannot connect - URL is not available');
+            return;
+        }
+        try {
+            connect({
+                url: wsUrl,
+                token,
+                organizationId: organizationId || undefined,
+                consumableToken: consumableToken || undefined,
+                autoReconnect: true,
+                reconnectInterval: 5000,
+                maxReconnectAttempts: 5,
+            });
+            logDebug('WebSocket connection initiated', { wsUrl });
+        }
+        catch (error) {
+            logger.warn('Failed to connect WebSocket', { error });
+        }
+    }, [connect, deriveWebSocketUrl]);
+    /**
+     * Notify WebSocket of organization switch
+     */
+    const notifyOrganizationSwitch = useCallback((newOrgId, previousOrgId) => {
+        wsSwitchOrganization(newOrgId, previousOrgId);
+    }, [wsSwitchOrganization]);
+    const identifyByEmail = async (email) => {
+        setAuth(a => ({ ...a, isLoading: true, error: null }));
+        logDebug('Identifying user by email', { email });
+        try {
+            const resp = await getManualCallsHttpClient().identifyByEmail(email);
+            logDebug('User identification successful', { sessionId: resp.sessionId });
+            setAuth(a => ({
+                ...a,
+                isLoading: false,
+                identification: resp,
+                sessionId: resp.sessionId,
+                purpose: a.purpose ?? AuthSessionPurpose.LOGIN,
+            }));
+            return resp;
+        }
+        catch (e) {
+            const msg = e?.message || 'Identification failed';
+            handleError(e, 'Identification failed', { email, message: msg });
+            setAuth(a => ({ ...a, isLoading: false, error: msg }));
+            throw e;
+        }
+    };
+    const authenticateWithPassword = async (email, password) => {
+        setAuth(a => ({ ...a, isLoading: true, error: null }));
+        logDebug('Authenticating with password', { email, sessionId: auth.sessionId });
+        try {
+            const sessionId = auth.sessionId;
+            if (!sessionId) {
+                const error = new Error('No active session. Please identify user first.');
+                logger.warn('Authentication attempted without session', { email });
+                throw error;
+            }
+            // Use the general authenticate endpoint with proper request structure
+            const authRequest = {
+                sessionId,
+                method: AuthMethod.PASSWORD,
+                factorLevel: AuthFactorLevel.FIRST,
+                password,
+                rememberMe: false,
+                requestedIntegrations: []
+            };
+            const resp = await getManualCallsHttpClient().authenticate(authRequest);
+            if (resp.requiresMFA && !resp.accessToken) {
+                setAuth(a => ({
+                    ...a,
+                    isLoading: false,
+                    mfaRequired: true,
+                    mfaSessionId: resp.sessionId || sessionId,
+                    availableMfaMethods: resp.availableMFAMethods || [],
+                    availableEnrollmentMethods: resp.availableEnrollmentMethods || [],
+                    enrolledSecondFactorMethods: resp.enrolledSecondFactorMethods || [],
+                    usableSecondFactorMethods: resp.usableSecondFactorMethods || [],
+                }));
+                return resp;
+            }
+            const accessToken = resp.accessToken || null;
+            const refreshToken = resp.refreshToken || null;
+            storeAuthTokens(accessToken, refreshToken);
+            if (accessToken) {
+                getManualCallsHttpClient().setAuthToken(accessToken);
+                setResourcesAuthToken(accessToken);
+            }
+            logDebug('Authentication successful', { success: resp.success, hasAccessToken: !!accessToken });
+            if (resp.success && accessToken) {
+                setAuth(a => ({
+                    ...a,
+                    isLoading: false,
+                    accessToken,
+                    refreshToken,
+                    isRestoringSession: true,
+                    sessionRestored: false,
+                    sessionId: null,
+                }));
+                hasInitializedRef.current = true;
+            }
+            else {
+                setAuth(a => ({
+                    ...a,
+                    isLoading: false,
+                    accessToken,
+                    refreshToken,
+                    sessionId: resp.success ? null : sessionId,
+                }));
+            }
+            return resp;
+        }
+        catch (e) {
+            const msg = e?.message || 'Authentication failed';
+            handleError(e, 'Authentication failed', { email, message: msg });
+            setAuth(a => ({ ...a, isLoading: false, error: msg }));
+            throw e;
+        }
+    };
+    const authenticate = async (request) => {
+        setAuth(a => ({ ...a, isLoading: true, error: null }));
+        logDebug('Authenticating', { method: request.method, sessionId: request.sessionId || auth.sessionId });
+        try {
+            const sessionId = request.sessionId || auth.sessionId;
+            if (!sessionId) {
+                const error = new Error('No active session. Please identify user first.');
+                logger.warn('Authentication attempted without session', { method: request.method });
+                throw error;
+            }
+            const withSession = { ...request, sessionId };
+            const resp = await getManualCallsHttpClient().authenticate(withSession);
+            if (resp.requiresMFA && !resp.accessToken) {
+                setAuth(a => ({
+                    ...a,
+                    isLoading: false,
+                    mfaRequired: true,
+                    mfaSessionId: resp.sessionId || sessionId,
+                    availableMfaMethods: resp.availableMFAMethods || [],
+                    availableEnrollmentMethods: resp.availableEnrollmentMethods || [],
+                    enrolledSecondFactorMethods: resp.enrolledSecondFactorMethods || [],
+                    usableSecondFactorMethods: resp.usableSecondFactorMethods || [],
+                }));
+                return resp;
+            }
+            const accessToken = resp.accessToken || null;
+            const refreshToken = resp.refreshToken || null;
+            storeAuthTokens(accessToken, refreshToken);
+            if (accessToken) {
+                getManualCallsHttpClient().setAuthToken(accessToken);
+                setResourcesAuthToken(accessToken);
+            }
+            logDebug('Authentication successful', { success: resp.success, hasAccessToken: !!accessToken, method: request.method });
+            if (resp.success && accessToken) {
+                setAuth(a => ({
+                    ...a,
+                    isLoading: false,
+                    accessToken,
+                    refreshToken,
+                    isRestoringSession: true,
+                    sessionRestored: false,
+                    sessionId: null,
+                }));
+                hasInitializedRef.current = true;
+            }
+            else {
+                setAuth(a => ({
+                    ...a,
+                    isLoading: false,
+                    accessToken,
+                    refreshToken,
+                    sessionId: resp.success ? null : sessionId,
+                }));
+            }
+            return resp;
+        }
+        catch (e) {
+            handleError(e, 'Authentication failed', { method: request.method });
+            setAuth(a => ({ ...a, isLoading: false, error: e?.message || 'Authentication failed' }));
+            throw e;
+        }
+    };
+    const getSessionState = async (sessionId) => {
+        logDebug('Getting session state', { sessionId });
+        try {
+            const sessionState = await getManualCallsHttpClient().getSessionState(sessionId);
+            setAuth(a => ({ ...a, sessionState, purpose: sessionState?.purpose ?? a.purpose }));
+            logDebug('Session state retrieved', { sessionId });
+            return sessionState;
+        }
+        catch (e) {
+            handleError(e, 'Failed to get session state', { sessionId });
+            throw e;
+        }
+    };
+    const isAuthenticated = () => {
+        return !!auth.accessToken;
+    };
+    /**
+     * Initiate OAuth2 login by redirecting to the provider's authorization page.
+     * Calls GET /auth/oauth2/authorize/:providerRef to get the authorization URL,
+     * then performs a full-page redirect to that URL.
+     *
+     * [Capacitor] [OAuth2] [SAML]
+     * When running inside Ionic Capacitor, `window.location.href` must NOT be used
+     * because it navigates the WebView away from the app (losing state). Instead:
+     * - Use `@capacitor/browser` → `Browser.open({ url: authorizationUrl })` which opens
+     *   ASWebAuthenticationSession (iOS) / Chrome Custom Tabs (Android) per RFC 8252.
+     * - The return path uses deep links (Universal Links / App Links) instead of route navigation.
+     * - For Apple/Google on mobile, prefer initiateNativeSignIn() which uses the native SDK
+     *   and exchanges the identity token via POST /auth/native-token/exchange (F2).
+     *   This provides a seamless system sign-in UI and handles both consumer and enterprise accounts.
+     * - For other providers (GitHub, Microsoft), use Browser.open() + deep-link return.
+     * - This method should be refactored behind a platform abstraction: web → window.location.href,
+     *   Capacitor → Browser.open() or initiateNativeSignIn() depending on the provider.
+     */
+    const initiateOAuth2Login = useCallback(async (providerRef, returnUrl) => {
+        logDebug('Initiating OAuth2 login', { providerRef, returnUrl });
+        setAuth(a => ({ ...a, isLoading: true, error: null }));
+        try {
+            const { authorizationUrl } = await getManualCallsHttpClient().getOAuth2AuthorizationUrl(providerRef, returnUrl);
+            logDebug('Redirecting to OAuth2 provider', { providerRef, authorizationUrl });
+            // Full-page redirect to the OAuth2 provider
+            // [Capacitor] Replace with Browser.open({ url: authorizationUrl }) when Capacitor is introduced
+            window.location.href = authorizationUrl;
+        }
+        catch (e) {
+            const msg = e?.message || 'Failed to initiate OAuth2 login';
+            handleError(e, 'OAuth2 login initiation failed', { providerRef, message: msg });
+            setAuth(a => ({ ...a, isLoading: false, error: msg }));
+            throw e;
+        }
+    }, [handleError]);
+    /**
+     * Handle the OAuth2 callback by exchanging the one-time code for tokens.
+     * Called from the /auth/callback page after the backend redirects back.
+     * Flow: Backend callback → consumable token → redirect to /auth/callback?code=xxx → this method
+     *
+     * [Capacitor] [OAuth2] [SAML]
+     * This method is intentionally decoupled from React Router navigation — it accepts
+     * a `code` string and handles the exchange. On web, AuthPage_AuthCallback extracts
+     * the code from URL params and calls this. On Capacitor, the same method will be called
+     * from the App.addListener('appUrlOpen') deep link handler, parsing the code from the
+     * incoming URL. No changes needed to this method for Capacitor — the caller changes.
+     */
+    const handleOAuth2Callback = useCallback(async (code) => {
+        logDebug('Handling OAuth2 callback', { codeLength: code.length });
+        setAuth(a => ({ ...a, isLoading: true, error: null }));
+        try {
+            const { accessToken, refreshToken } = await getManualCallsHttpClient().exchangeOAuth2Code(code);
+            storeAuthTokens(accessToken, refreshToken);
+            getManualCallsHttpClient().setAuthToken(accessToken);
+            setResourcesAuthToken(accessToken);
+            logDebug('OAuth2 callback successful, tokens stored');
+            // Update auth state — mark as restoring so UserOrgsContext picks up and loads user data
+            setAuth(a => ({
+                ...a,
+                isLoading: false,
+                accessToken,
+                refreshToken,
+                isRestoringSession: true,
+                sessionRestored: false,
+                // Clear any previous session (OAuth2 bypasses identify/authenticate flow)
+                sessionId: null,
+            }));
+            hasInitializedRef.current = true;
+        }
+        catch (e) {
+            const msg = e?.message || 'OAuth2 authentication failed';
+            handleError(e, 'OAuth2 callback failed', { message: msg });
+            setAuth(a => ({ ...a, isLoading: false, error: msg }));
+            throw e;
+        }
+    }, [setResourcesAuthToken, handleError]);
+    /**
+     * Exchange a native identity token (from Apple/Google SDK) for Wildo JWT tokens.
+     * Called after the Capacitor native SDK returns an identity token.
+     *
+     * This method is platform-agnostic — it sends the raw identity token to the backend.
+     * The caller (initiateNativeSignIn or a Capacitor plugin callback) provides the token.
+     *
+     * [Capacitor] The backend POST /auth/native-token/exchange endpoint validates the
+     * identity token via JWKS, provisions/links the user, and returns Wildo JWTs.
+     */
+    const handleNativeTokenExchange = useCallback(async (provider, identityToken, nonce) => {
+        logDebug('Handling native token exchange', { provider });
+        setAuth(a => ({ ...a, isLoading: true, error: null }));
+        try {
+            const result = await getManualCallsHttpClient().exchangeNativeToken({
+                provider,
+                identityToken,
+                nonce,
+            });
+            const accessToken = result.accessToken;
+            const refreshToken = result.refreshToken ?? null;
+            storeAuthTokens(accessToken, refreshToken);
+            getManualCallsHttpClient().setAuthToken(accessToken);
+            setResourcesAuthToken(accessToken);
+            logDebug('Native token exchange successful, tokens stored', { provider, isNewUser: result.isNewUser });
+            setAuth(a => ({
+                ...a,
+                isLoading: false,
+                accessToken,
+                refreshToken,
+                isRestoringSession: true,
+                sessionRestored: false,
+                sessionId: null,
+            }));
+            hasInitializedRef.current = true;
+        }
+        catch (e) {
+            const msg = e?.message || 'Native token exchange failed';
+            handleError(e, 'Native token exchange failed', { provider, message: msg });
+            setAuth(a => ({ ...a, isLoading: false, error: msg }));
+            throw e;
+        }
+    }, [setResourcesAuthToken, handleError]);
+    /**
+     * Trigger native Sign-In SDK flow for the given provider, then exchange the token.
+     *
+     * [Capacitor] NOT YET IMPLEMENTED — requires @capacitor-community/apple-sign-in
+     * (Apple) or @codetrix-studio/capacitor-google-auth (Google) to be installed and
+     * configured. Once implemented, this method will:
+     *   1. Call the native SDK to present the system sign-in UI
+     *   2. Receive the identity token + optional nonce
+     *   3. Call handleNativeTokenExchange() with the token
+     *
+     * For enterprise Google SSO on Capacitor, this same flow applies — the native
+     * Google SDK handles both consumer and Workspace accounts transparently.
+     */
+    const initiateNativeSignIn = useCallback(async (_provider) => {
+        throw new Error('Not yet implemented: Capacitor native SDK sign-in. ' +
+            'Install @capacitor-community/apple-sign-in or @codetrix-studio/capacitor-google-auth ' +
+            'and implement the native SDK call here.');
+    }, []);
+    /**
+     * Handle email verification by exchanging the verification token for JWT tokens.
+     * Called from the /confirm-email page after the user clicks the verification link.
+     * Flow: Email link → /confirm-email?token=xxx → this method
+     *
+     * On success, stores tokens and updates auth state (auto-login).
+     */
+    const handleEmailVerification = useCallback(async (token, email) => {
+        logDebug('Handling email verification', { tokenLength: token.length, email });
+        setAuth(a => ({ ...a, isLoading: true, error: null }));
+        try {
+            const response = await getManualCallsHttpClient().verifyEmail(token, email);
+            if (response.accessToken) {
+                storeAuthTokens(response.accessToken, response.refreshToken ?? null);
+                getManualCallsHttpClient().setAuthToken(response.accessToken);
+                setResourcesAuthToken(response.accessToken);
+                logDebug('Email verification successful, tokens stored');
+                setAuth(a => ({
+                    ...a,
+                    isLoading: false,
+                    accessToken: response.accessToken,
+                    refreshToken: response.refreshToken ?? null,
+                    isRestoringSession: true,
+                    sessionRestored: false,
+                    sessionId: null,
+                }));
+                hasInitializedRef.current = true;
+            }
+            else {
+                logDebug('Email verification succeeded but tokens not issued — pipeline requires further steps', {
+                    state: response.state,
+                    nextStep: response.nextStep,
+                });
+                setAuth(a => ({
+                    ...a,
+                    isLoading: false,
+                    sessionId: null,
+                    mfaRequired: response.requiresMFA ?? false,
+                    mfaSessionId: response.requiresMFA ? (response.sessionId ?? null) : null,
+                    availableMfaMethods: [],
+                    availableEnrollmentMethods: response.availableEnrollmentMethods || [],
+                    enrolledSecondFactorMethods: [],
+                    usableSecondFactorMethods: [],
+                    error: null,
+                }));
+            }
+        }
+        catch (e) {
+            const msg = e?.message || 'Email verification failed';
+            handleError(e, 'Email verification failed', { message: msg });
+            setAuth(a => ({ ...a, isLoading: false, error: msg }));
+            throw e;
+        }
+    }, [setResourcesAuthToken, handleError]);
+    const acceptInvitation = useCallback(async (params) => {
+        logDebug('Handling invitation acceptance', { hasPassword: !!params.password });
+        setAuth(a => ({ ...a, isLoading: true, error: null }));
+        try {
+            const response = await getManualCallsHttpClient().acceptInvitation(params);
+            if (response.accessToken) {
+                storeAuthTokens(response.accessToken, response.refreshToken ?? null);
+                getManualCallsHttpClient().setAuthToken(response.accessToken);
+                setResourcesAuthToken(response.accessToken);
+                logDebug('Invitation acceptance successful, tokens stored');
+                setAuth(a => ({
+                    ...a,
+                    isLoading: false,
+                    accessToken: response.accessToken,
+                    refreshToken: response.refreshToken ?? null,
+                    isRestoringSession: true,
+                    sessionRestored: false,
+                    sessionId: null,
+                    mfaRequired: false,
+                    mfaSessionId: null,
+                    availableMfaMethods: [],
+                    availableEnrollmentMethods: [],
+                    enrolledSecondFactorMethods: [],
+                    usableSecondFactorMethods: [],
+                    error: null,
+                }));
+                hasInitializedRef.current = true;
+            }
+            else {
+                logDebug('Invitation acceptance requires further auth steps', {
+                    state: response.state,
+                    nextStep: response.nextStep,
+                });
+                setAuth(a => ({
+                    ...a,
+                    isLoading: false,
+                    sessionId: null,
+                    mfaRequired: response.requiresMFA ?? false,
+                    mfaSessionId: response.requiresMFA ? (response.sessionId ?? null) : null,
+                    availableMfaMethods: [],
+                    availableEnrollmentMethods: response.availableEnrollmentMethods || [],
+                    enrolledSecondFactorMethods: [],
+                    usableSecondFactorMethods: [],
+                    error: null,
+                }));
+            }
+        }
+        catch (e) {
+            const msg = e?.message || 'Invitation acceptance failed';
+            handleError(e, 'Invitation acceptance failed', { message: msg });
+            setAuth(a => ({ ...a, isLoading: false, error: msg }));
+            throw e;
+        }
+    }, [setResourcesAuthToken, handleError]);
+    /**
+     * Handle magic link verification — verifies the token and auto-logs in the user.
+     * Called from the /auth/magic-link/verify page after the user clicks the email link.
+     * Returns the full AuthenticationResponse so the page can handle MFA-required state.
+     */
+    const handleMagicLinkVerify = useCallback(async (token, email) => {
+        logDebug('Handling magic link verification', { tokenLength: token.length, email });
+        setAuth(a => ({ ...a, isLoading: true, error: null }));
+        try {
+            const response = await getManualCallsHttpClient().magicLinkVerify(token, email);
+            if (response.requiresMFA && !response.accessToken) {
+                setAuth(a => ({
+                    ...a,
+                    isLoading: false,
+                    mfaRequired: true,
+                    mfaSessionId: response.sessionId || null,
+                    availableMfaMethods: response.availableMFAMethods || [],
+                    availableEnrollmentMethods: response.availableEnrollmentMethods || [],
+                    enrolledSecondFactorMethods: response.enrolledSecondFactorMethods || [],
+                    usableSecondFactorMethods: response.usableSecondFactorMethods || [],
+                }));
+                return response;
+            }
+            if (response.success && response.accessToken && response.refreshToken) {
+                storeAuthTokens(response.accessToken, response.refreshToken);
+                getManualCallsHttpClient().setAuthToken(response.accessToken);
+                setResourcesAuthToken(response.accessToken);
+                logDebug('Magic link verification successful, tokens stored');
+                setAuth(a => ({
+                    ...a,
+                    isLoading: false,
+                    accessToken: response.accessToken,
+                    refreshToken: response.refreshToken,
+                    isRestoringSession: true,
+                    sessionRestored: false,
+                    sessionId: null,
+                }));
+                hasInitializedRef.current = true;
+            }
+            else {
+                setAuth(a => ({ ...a, isLoading: false }));
+            }
+            return response;
+        }
+        catch (e) {
+            const msg = e?.message || 'Magic link verification failed';
+            handleError(e, 'Magic link verification failed', { message: msg });
+            setAuth(a => ({ ...a, isLoading: false, error: msg }));
+            throw e;
+        }
+    }, [setResourcesAuthToken, handleError]);
+    /**
+     * Handle MFA second-factor verification.
+     * Dispatches to the appropriate OTP verify method based on the selected auth method.
+     * On success, stores tokens and updates auth state (auto-login).
+     */
+    const handleMfaVerify = useCallback(async (sessionId, method, code) => {
+        logDebug('Handling MFA verification', { sessionId, method });
+        setAuth(a => ({ ...a, isLoading: true, error: null }));
+        try {
+            const client = getManualCallsHttpClient();
+            const response = await client.authenticate({
+                sessionId,
+                method,
+                factorLevel: AuthFactorLevel.SECOND,
+                token: code,
+                rememberMe: false,
+                requestedIntegrations: [],
+            });
+            if (response.success && response.accessToken && response.refreshToken) {
+                storeAuthTokens(response.accessToken, response.refreshToken);
+                client.setAuthToken(response.accessToken);
+                setResourcesAuthToken(response.accessToken);
+                logDebug('MFA verification successful, tokens stored');
+                setAuth(a => ({
+                    ...a,
+                    isLoading: false,
+                    accessToken: response.accessToken,
+                    refreshToken: response.refreshToken,
+                    isRestoringSession: true,
+                    sessionRestored: false,
+                    sessionId: null,
+                    mfaRequired: false,
+                    mfaSessionId: null,
+                    availableMfaMethods: [],
+                    enrolledSecondFactorMethods: [],
+                    usableSecondFactorMethods: [],
+                }));
+                hasInitializedRef.current = true;
+            }
+            else {
+                setAuth(a => ({ ...a, isLoading: false, error: response.error || 'MFA verification failed' }));
+            }
+            return response;
+        }
+        catch (e) {
+            const msg = e?.message || 'MFA verification failed';
+            handleError(e, 'MFA verification failed', { method, message: msg });
+            setAuth(a => ({ ...a, isLoading: false, error: msg }));
+            throw e;
+        }
+    }, [setResourcesAuthToken, handleError]);
+    const handlePasskeyAuth = useCallback(async (sessionId, factorLevel = 'first') => {
+        logDebug('Handling passkey authentication', { sessionId, factorLevel });
+        setAuth(a => ({ ...a, isLoading: true, error: null }));
+        const componentType = factorLevel === 'first' ? FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH : FrontendComponentType.PUBLIC_LAYOUTS_MFA_CHALLENGE;
+        const t = (key) => tComponent(componentType, key);
+        const passkeyErrorLabel = factorLevel === 'first' ? UserAuthLabel.PASSKEY_ERROR : MfaChallengeLabel.PASSKEY_ERROR;
+        const passkeyCancelledLabel = factorLevel === 'first' ? UserAuthLabel.PASSKEY_CANCELLED : MfaChallengeLabel.PASSKEY_CANCELLED;
+        try {
+            const client = getManualCallsHttpClient();
+            const options = await client.passkeyAuthOptions(sessionId);
+            const credential = await startAuthentication({ optionsJSON: options });
+            const verifyBody = { response: credential, sessionId, factorLevel };
+            const response = await client.passkeyAuthVerify(verifyBody);
+            if (response.requiresMFA && !response.accessToken) {
+                setAuth(a => ({
+                    ...a,
+                    isLoading: false,
+                    mfaRequired: true,
+                    mfaSessionId: response.sessionId || sessionId,
+                    availableMfaMethods: response.availableMFAMethods || [],
+                    availableEnrollmentMethods: response.availableEnrollmentMethods || [],
+                    enrolledSecondFactorMethods: response.enrolledSecondFactorMethods || [],
+                    usableSecondFactorMethods: response.usableSecondFactorMethods || [],
+                }));
+                return response;
+            }
+            if (response.success && response.accessToken && response.refreshToken) {
+                storeAuthTokens(response.accessToken, response.refreshToken);
+                client.setAuthToken(response.accessToken);
+                setResourcesAuthToken(response.accessToken);
+                logDebug('Passkey authentication successful, tokens stored');
+                setAuth(a => ({
+                    ...a,
+                    isLoading: false,
+                    accessToken: response.accessToken,
+                    refreshToken: response.refreshToken,
+                    isRestoringSession: true,
+                    sessionRestored: false,
+                    sessionId: null,
+                    mfaRequired: false,
+                    mfaSessionId: null,
+                    availableMfaMethods: [],
+                    availableEnrollmentMethods: [],
+                    enrolledSecondFactorMethods: [],
+                    usableSecondFactorMethods: [],
+                }));
+                hasInitializedRef.current = true;
+            }
+            else {
+                setAuth(a => ({ ...a, isLoading: false, error: response.error || t(passkeyErrorLabel) }));
+            }
+            return response;
+        }
+        catch (e) {
+            const err = e;
+            let msg;
+            if (err?.name === 'NotAllowedError') {
+                msg = t(passkeyCancelledLabel);
+            }
+            else if (isWildoBackendError(e)) {
+                const wErr = e;
+                msg = wErr.userGuidance?.explanation || wErr.message || t(passkeyErrorLabel);
+            }
+            else {
+                msg = err?.message || t(passkeyErrorLabel);
+            }
+            handleError(e, 'Passkey authentication failed', { sessionId, message: msg });
+            setAuth(a => ({ ...a, isLoading: false, error: msg }));
+            throw e;
+        }
+    }, [setResourcesAuthToken, handleError, tComponent]);
+    /**
+     * W7.3b: Exchange a consumable token for a one-off session.
+     * Authenticates via the backend exchange endpoint, sets up HTTP clients
+     * with both JWT and consumable token headers, and connects WebSocket.
+     */
+    const handleOneOffTokenExchange = useCallback(async (token) => {
+        logDebug('Handling one-off token exchange', { tokenLength: token.length });
+        setAuth(a => ({ ...a, isLoading: true, error: null }));
+        try {
+            const client = getManualCallsHttpClient();
+            const response = await client.exchangeOneOffToken(token);
+            const { accessToken, refreshToken, consumableTokenValue, tokenExpiresAt, context } = response;
+            storeAuthTokens(accessToken, refreshToken);
+            client.setAuthToken(accessToken);
+            setResourcesAuthToken(accessToken);
+            if (consumableTokenValue) {
+                client.setConsumableToken(consumableTokenValue);
+                setResourcesConsumableToken(consumableTokenValue);
+            }
+            if (context.organizationId) {
+                tokenStorage.setOrganizationId(context.organizationId);
+            }
+            connectWebSocket(accessToken, context.organizationId, consumableTokenValue);
+            setAuth({
+                ...EMPTY_AUTH_STATE,
+                accessToken,
+                refreshToken,
+                sessionType: SessionType.ONE_OFF,
+                oneOffContext: {
+                    originTokenId: context.tokenId,
+                    tokenType: context.tokenType,
+                    consumableTokenValue,
+                    tokenExpiresAt,
+                    scopedInitiatorIds: context.targeting?.initiatorIds,
+                    applicationId: context.applicationId,
+                },
+                sessionRestored: true,
+            });
+            hasInitializedRef.current = true;
+            logDebug('One-off token exchange successful', { tokenType: context.tokenType });
+        }
+        catch (e) {
+            const msg = e?.message || 'One-off token exchange failed';
+            handleError(e, 'One-off token exchange failed', { message: msg });
+            setAuth(a => ({ ...a, isLoading: false, error: msg }));
+            throw e;
+        }
+    }, [tokenStorage, setResourcesAuthToken, setResourcesConsumableToken, connectWebSocket, handleError]);
+    const logout = useCallback(() => {
+        logDebug('Logging out user');
+        // Attempt to revoke refresh token on the backend (fire-and-forget).
+        // We read the token BEFORE clearing storage so we have the value.
+        const storedRefreshToken = tokenStorage.getRefreshToken();
+        if (storedRefreshToken) {
+            getManualCallsHttpClient()
+                .logoutFromBackend(storedRefreshToken)
+                .catch((e) => {
+                logger.warn('Backend logout call failed (token revocation)', { error: e });
+            });
+        }
+        broadcastChannelRef.current?.postMessage({ type: 'LOGOUT' });
+        disconnect();
+        // Clear consumable token from HTTP client singletons (prevents stale header leakage)
+        getManualCallsHttpClient().setConsumableToken(null);
+        getManualCallsHttpClient().setAuthToken(null);
+        setResourcesConsumableToken(null);
+        setResourcesAuthToken(null);
+        tokenStorage.clear();
+        setAuth(EMPTY_AUTH_STATE);
+        hasInitializedRef.current = false;
+        logger.info('User logged out successfully');
+    }, [disconnect, tokenStorage, setResourcesAuthToken, setResourcesConsumableToken]);
+    /**
+     * Mark session as restored (called by UserOrgsContext when it finishes loading user data)
+     */
+    const markSessionRestored = useCallback(() => {
+        setAuth(a => ({
+            ...a,
+            sessionRestored: true,
+            isRestoringSession: false,
+        }));
+    }, []);
+    /**
+     * Set session restoring state (called by UserOrgsContext)
+     */
+    const setSessionRestoring = useCallback((isRestoring) => {
+        setAuth(a => ({
+            ...a,
+            isRestoringSession: isRestoring,
+        }));
+    }, []);
+    // ─────────────────────────────────────────────────────────────────────────
+    // Token refresh handler (re-entrant safe)
+    // ─────────────────────────────────────────────────────────────────────────
+    /**
+     * Token renewal handler registered on HTTP clients.
+     * Called automatically by the interceptor when a 401 OUTDATED_AUTH_JWT is received.
+     *
+     * Re-entrant safe: if multiple requests get 401 simultaneously, only one refresh
+     * call is made and all callers share the same promise.
+     */
+    const tokenRenewalHandler = useCallback(async () => {
+        // If a refresh is already in flight, piggyback on it
+        if (refreshInFlightRef.current) {
+            logDebug('Token refresh already in flight, waiting for result');
+            return refreshInFlightRef.current;
+        }
+        const doRefresh = async () => {
+            const storedRefreshToken = tokenStorage.getRefreshToken();
+            if (!storedRefreshToken) {
+                throw new Error('No refresh token available');
+            }
+            logDebug('Refreshing access token');
+            const result = await getManualCallsHttpClient().refreshTokens(storedRefreshToken);
+            // Store the new tokens
+            storeAuthTokens(result.accessToken, result.refreshToken ?? null);
+            // Update HTTP clients with new access token
+            getManualCallsHttpClient().setAuthToken(result.accessToken);
+            setResourcesAuthToken(result.accessToken);
+            // Update React state
+            setAuth(a => ({
+                ...a,
+                accessToken: result.accessToken,
+                refreshToken: result.refreshToken ?? a.refreshToken,
+            }));
+            // Broadcast refreshed tokens to other tabs to prevent concurrent refresh
+            // race conditions that trigger rotation detection and force-logout all tabs
+            broadcastChannelRef.current?.postMessage({
+                type: 'TOKEN_REFRESHED',
+                accessToken: result.accessToken,
+                refreshToken: result.refreshToken ?? null,
+            });
+            logDebug('Token refresh successful');
+            return result.accessToken;
+        };
+        // Store the promise so concurrent callers share it
+        refreshInFlightRef.current = doRefresh().finally(() => {
+            refreshInFlightRef.current = null;
+        });
+        try {
+            return await refreshInFlightRef.current;
+        }
+        catch (error) {
+            // Refresh failed — trigger logout
+            logger.warn('Token refresh failed, logging out', { error });
+            logout();
+            throw error;
+        }
+    }, [setResourcesAuthToken, logout, tokenStorage]);
+    // Register the token renewal handler on both HTTP clients
+    useEffect(() => {
+        getManualCallsHttpClient().setTokenRenewalHandler(tokenRenewalHandler);
+        setResourcesTokenRenewalHandler(tokenRenewalHandler);
+    }, [tokenRenewalHandler, setResourcesTokenRenewalHandler]);
+    // Cross-tab token coordination via BroadcastChannel.
+    // When one tab refreshes tokens, it broadcasts the new tokens so other tabs
+    // adopt them instead of independently refreshing (which triggers rotation detection).
+    useEffect(() => {
+        if (typeof BroadcastChannel === 'undefined')
+            return;
+        const channel = new BroadcastChannel('wildo-auth-tokens');
+        broadcastChannelRef.current = channel;
+        channel.onmessage = (event) => {
+            const { type, accessToken, refreshToken } = event.data ?? {};
+            if (type === 'TOKEN_REFRESHED' && accessToken) {
+                logDebug('Received refreshed tokens from another tab');
+                storeAuthTokens(accessToken, refreshToken);
+                getManualCallsHttpClient().setAuthToken(accessToken);
+                setResourcesAuthToken(accessToken);
+                setAuth(a => ({ ...a, accessToken, refreshToken: refreshToken ?? a.refreshToken }));
+            }
+            if (type === 'LOGOUT') {
+                logDebug('Received logout signal from another tab');
+                disconnect();
+                tokenStorage.clear();
+                getManualCallsHttpClient().setConsumableToken(null);
+                setResourcesConsumableToken(null);
+                storeAuthTokens(null, null);
+                getManualCallsHttpClient().setAuthToken(null);
+                setResourcesAuthToken(null);
+                setAuth(EMPTY_AUTH_STATE);
+            }
+        };
+        return () => {
+            channel.close();
+            broadcastChannelRef.current = null;
+        };
+    }, [setResourcesAuthToken, setResourcesConsumableToken, disconnect, tokenStorage]);
+    // Initialize auth tokens on mount (from storage)
+    useEffect(() => {
+        // Prevent multiple initializations
+        if (hasInitializedRef.current) {
+            return;
+        }
+        const storedAccessToken = tokenStorage.getAccessToken();
+        const storedRefreshToken = tokenStorage.getRefreshToken();
+        // If no tokens in storage, nothing to do
+        if (!storedAccessToken && !storedRefreshToken) {
+            logDebug('No stored tokens found');
+            hasInitializedRef.current = true;
+            return;
+        }
+        logDebug('Found stored tokens, initializing auth state');
+        hasInitializedRef.current = true;
+        // Set tokens in state and HTTP clients
+        setAuth(a => ({
+            ...a,
+            accessToken: storedAccessToken,
+            refreshToken: storedRefreshToken,
+            isRestoringSession: true,
+        }));
+        // Set token in HTTP clients
+        if (storedAccessToken) {
+            getManualCallsHttpClient().setAuthToken(storedAccessToken);
+            setResourcesAuthToken(storedAccessToken);
+        }
+        // UserOrgsContext will handle fetching user data and marking session as restored
+    }, [setResourcesAuthToken, tokenStorage]);
+    const value = useMemo(() => ({
+        auth,
+        tokenStorage,
+        // Authentication methods
+        identifyByEmail,
+        authenticateWithPassword,
+        authenticate,
+        getSessionState,
+        isAuthenticated,
+        logout,
+        // OAuth2 methods
+        initiateOAuth2Login,
+        handleOAuth2Callback,
+        // Native SDK token exchange (Capacitor mobile)
+        handleNativeTokenExchange,
+        initiateNativeSignIn,
+        // Email verification
+        handleEmailVerification,
+        acceptInvitation,
+        // Magic link verification
+        handleMagicLinkVerify,
+        // MFA verification
+        handleMfaVerify,
+        handlePasskeyAuth,
+        // One-off session exchange (W7.3b)
+        handleOneOffTokenExchange,
+        // Session management
+        markSessionRestored,
+        setSessionRestoring,
+        // WebSocket
+        connectWebSocket,
+        notifyOrganizationSwitch,
+    }), [
+        auth,
+        tokenStorage,
+        logout,
+        initiateOAuth2Login,
+        handleOAuth2Callback,
+        handleNativeTokenExchange,
+        initiateNativeSignIn,
+        handleEmailVerification,
+        acceptInvitation,
+        handleMagicLinkVerify,
+        handleMfaVerify,
+        handlePasskeyAuth,
+        handleOneOffTokenExchange,
+        markSessionRestored,
+        setSessionRestoring,
+        connectWebSocket,
+        notifyOrganizationSwitch,
+    ]);
+    return _jsx(AuthSessionContext.Provider, { value: value, children: children });
+};
+//# sourceMappingURL=AuthSessionContext.js.map