@wildo-ai/saas-frontend-lib 1.1.10 → 1.1.11

package/dist/esm/core/security/ApplicationRoleTablesContext.js

@@ -0,0 +1,27 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+/**
+ * The application's role tables, for every frontend role check (#2376).
+ *
+ * The backend decides authorization against the application's COMPLETE role tables: the defaults plus every custom
+ * role the application declares (`initializeRoles(customRoles)`). The frontend's visibility checks — which launcher
+ * rows, settings sections and action buttons to offer — must decide the same way, or they disagree with what the
+ * backend allows. Without the tables they could only guess: `userRolesSatisfyRequiredRoles` with the default tables
+ * passes any role it cannot expand, so a holder of a custom ORGANIZATION role passed an APPLICATION super-admin gate.
+ *
+ * The application hands its custom roles to `ApplicationMainProvider` (`customRoles: sharedRegistry.customRoles`);
+ * this context carries the resolved tables with `UnresolvableRoleTreatment.INERT`. Outside that provider (an
+ * isolated test, a surface mounted without the application shell) it answers the defaults with the old guess, so
+ * nothing is hidden for want of a table.
+ */
+import { createContext, useMemo } from 'react';
+import { resolveApplicationRoleConfigurations, UnresolvableRoleTreatment, } from '@wildo-ai/saas-models';
+const DEFAULT_ROLE_TABLES = {
+    ...resolveApplicationRoleConfigurations(undefined),
+    unresolvableRoles: UnresolvableRoleTreatment.ASSUME_POSSIBLE,
+};
+export const ApplicationRoleTablesContext = createContext(DEFAULT_ROLE_TABLES);
+export function ApplicationRoleTablesProvider({ customRoles, children, }) {
+    const tables = useMemo(() => ({ ...resolveApplicationRoleConfigurations(customRoles), unresolvableRoles: UnresolvableRoleTreatment.INERT }), [customRoles]);
+    return _jsx(ApplicationRoleTablesContext.Provider, { value: tables, children: children });
+}
+//# sourceMappingURL=ApplicationRoleTablesContext.js.map

package/dist/esm/core/security/ApplicationRoleTablesContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApplicationRoleTablesContext.js","sourceRoot":"","sources":["../../../../../src/core/security/ApplicationRoleTablesContext.tsx"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;AACH,OAAc,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AACtD,OAAO,EACL,oCAAoC,EACpC,yBAAyB,GAG1B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,mBAAmB,GAA0B;IACjD,GAAG,oCAAoC,CAAC,SAAS,CAAC;IAClD,iBAAiB,EAAE,yBAAyB,CAAC,eAAe;CAC7D,CAAC;AAEF,MAAM,CAAC,MAAM,4BAA4B,GAAG,aAAa,CAAwB,mBAAmB,CAAC,CAAC;AAEtG,MAAM,UAAU,6BAA6B,CAAC,EAC5C,WAAW,EACX,QAAQ,GAKT;IACC,MAAM,MAAM,GAAG,OAAO,CACpB,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,oCAAoC,CAAC,WAAW,CAAC,EAAE,iBAAiB,EAAE,yBAAyB,CAAC,KAAK,EAAE,CAAC,EACpH,CAAC,WAAW,CAAC,CACd,CAAC;IACF,OAAO,KAAC,4BAA4B,CAAC,QAAQ,IAAC,KAAK,EAAE,MAAM,YAAG,QAAQ,GAAyC,CAAC;AAClH,CAAC","sourcesContent":["/**\n * The application's role tables, for every frontend role check (#2376).\n *\n * The backend decides authorization against the application's COMPLETE role tables: the defaults plus every custom\n * role the application declares (`initializeRoles(customRoles)`). The frontend's visibility checks — which launcher\n * rows, settings sections and action buttons to offer — must decide the same way, or they disagree with what the\n * backend allows. Without the tables they could only guess: `userRolesSatisfyRequiredRoles` with the default tables\n * passes any role it cannot expand, so a holder of a custom ORGANIZATION role passed an APPLICATION super-admin gate.\n *\n * The application hands its custom roles to `ApplicationMainProvider` (`customRoles: sharedRegistry.customRoles`);\n * this context carries the resolved tables with `UnresolvableRoleTreatment.INERT`. Outside that provider (an\n * isolated test, a surface mounted without the application shell) it answers the defaults with the old guess, so\n * nothing is hidden for want of a table.\n */\nimport React, { createContext, useMemo } from 'react';\nimport {\n  resolveApplicationRoleConfigurations,\n  UnresolvableRoleTreatment,\n  type ApplicationRoleTables,\n  type RolesConfiguration,\n} from '@wildo-ai/saas-models';\n\nconst DEFAULT_ROLE_TABLES: ApplicationRoleTables = {\n  ...resolveApplicationRoleConfigurations(undefined),\n  unresolvableRoles: UnresolvableRoleTreatment.ASSUME_POSSIBLE,\n};\n\nexport const ApplicationRoleTablesContext = createContext<ApplicationRoleTables>(DEFAULT_ROLE_TABLES);\n\nexport function ApplicationRoleTablesProvider({\n  customRoles,\n  children,\n}: {\n  /** The application's declared custom roles (`sharedRegistry.customRoles`); absent when it declares none. */\n  customRoles: RolesConfiguration | undefined;\n  children: React.ReactNode;\n}): React.JSX.Element {\n  const tables = useMemo<ApplicationRoleTables>(\n    () => ({ ...resolveApplicationRoleConfigurations(customRoles), unresolvableRoles: UnresolvableRoleTreatment.INERT }),\n    [customRoles],\n  );\n  return <ApplicationRoleTablesContext.Provider value={tables}>{children}</ApplicationRoleTablesContext.Provider>;\n}\n"]}

package/dist/esm/core/security/AuthSessionContext.d.ts

@@ -1,5 +1,7 @@
 import React, { ReactNode } from 'react';
-import { AuthenticationResponse, AuthIdentificationResponse, AuthenticationRequest, AuthMethod, AuthenticationSessionState, type OnboardingObligation } from '@wildo-ai/saas-models';
+import { AuthenticationResponse, AuthIdentificationResponse, AuthenticationRequest, AuthMethod, AuthenticationSessionState, type OnboardingObligation, HttpMethod, ManualControllerRouteKey, type ManualControllerRouteBodyInput } from '@wildo-ai/saas-models';
+/** What accepting an invitation sends: the route's contract input (#2834), so a field the backend requires cannot be left out. */
+type InvitationAcceptance = ManualControllerRouteBodyInput<ManualControllerRouteKey.AUTH_ACCEPT_INVITATION, HttpMethod.POST>;
 /**
  * What an onboarding completion came to (#1374): the account signed in, or the session is still parked and owes
  * `pendingObligations` next. The onboarding step renders the next step from it.
@@ -39,6 +41,15 @@ export interface AuthSessionContextType {
     isAuthenticated: () => boolean;
     /** The person signs out of this tab — {@link SessionEndReason.SIGNED_OUT}. */
     logout: () => void;
+    /**
+     * The person signs out of EVERY session they hold, on every device, this one included (#2317).
+     *
+     * Resolves once the backend has fenced every token of the account, then ends this tab like
+     * {@link logout}. Rejects, leaving this tab signed in, when the backend could not fence them: a
+     * person who asked to be signed out everywhere must not be told they were while another device
+     * still holds a live session.
+     */
+    signOutEverywhere: () => Promise<void>;
     /**
      * End this tab's session for a reason other than the person's own sign-out (#1977) — the backend
      * refused it, it could not be restored, an error forced it. `USER_LOGOUT` carries the reason.
@@ -48,6 +59,18 @@ export interface AuthSessionContextType {
     getSessionEstablishment: () => SessionEstablishment;
     /** Why this tab's last session ended — read when `USER_LOGOUT` is announced (#1977). */
     getSessionEndReason: () => SessionEndReason;
+    /**
+     * Why the BACKEND ended this tab's last session, while the person has not signed in again (#2541): `SESSION_ENDED`
+     * or `ACCOUNT_NOT_ACTIVE`, else `null`. Sign-in reads it to say why the person is there. `null` after a sign-out of
+     * their own, or another tab's, since they know why. Reset when a session is established.
+     */
+    endedSessionReason: SessionEndReason | null;
+    /**
+     * The same fact as {@link endedSessionReason}, read synchronously. For a caller deciding in the same tick a session
+     * ends (the global error handler, choosing whether a forced sign-out still needs a toast), the React state has not
+     * reached it yet.
+     */
+    getEndedSessionReason: () => SessionEndReason | null;
     /**
      * Begin a federated sign-in, carrying any governed-document releases the person accepted first.
      *
@@ -59,13 +82,7 @@ export interface AuthSessionContextType {
     initiateOAuth2Login: (providerRef: string, returnUrl?: string, acceptedGovernedDocumentReleaseIds?: readonly string[]) => Promise<void>;
     handleAuthCodeExchange: (code: string) => Promise<void>;
     handleEmailVerification: (token: string, email: string) => Promise<void>;
-    acceptInvitation: (params: {
-        invitationToken: string;
-        firstName?: string;
-        lastName?: string;
-        password?: string;
-        credentialMethod?: AuthMethod;
-    }) => Promise<{
+    acceptInvitation: (params: InvitationAcceptance) => Promise<{
         passkeyRegistrationOptions?: Record<string, unknown>;
         signInRequired?: boolean;
     }>;
@@ -153,4 +170,5 @@ export declare const AuthSessionProvider: React.FC<{
     children: ReactNode;
     tokenStorage?: SessionTokenStorage;
 }>;
+export {};
 //# sourceMappingURL=AuthSessionContext.d.ts.map

package/dist/esm/core/security/AuthSessionContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthSessionContext.d.ts","sourceRoot":"","sources":["../../../../src/core/security/AuthSessionContext.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAA2B,SAAS,EAA2C,MAAM,OAAO,CAAC;AAG3G,OAAO,EAEL,sBAAsB,EACtB,0BAA0B,EAC1B,qBAAqB,EACrB,UAAU,EAGV,0BAA0B,EAG1B,KAAK,oBAAoB,EAC1B,MAAM,uBAAuB,CAAC;AAE/B;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,OAAO,CAAC;IAClB,kBAAkB,EAAE,oBAAoB,EAAE,CAAC;CAC5C;AACD,OAAO,EAEL,KAAK,mCAAmC,EAExC,KAAK,sBAAsB,EAC5B,MAAM,mFAAmF,CAAC;AAC3F,OAAO,EAA+B,mBAAmB,EAAE,MAAM,uEAAuE,CAAC;AAazI,OAAO,EACL,SAAS,EAET,KAAK,aAAa,EAGlB,sBAAsB,EACvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,0CAA0C,CAAC;AAElD,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,yDAAyD,CAAC;AAgBjH;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,KAAK,CAAC,EAAE,0BAA0B,CAAC;IACnC,4BAA4B,CAAC,EAAE,SAAS,CAAC,qBAAqB,CAAC,CAAC;IAChE,0BAA0B,CAAC,EAAE,SAAS,CAAC,4BAA4B,CAAC,CAAC;IACrE,2BAA2B,CAAC,EAAE,SAAS,CAAC,6BAA6B,CAAC,CAAC;IACvE,yBAAyB,CAAC,EAAE,SAAS,CAAC,2BAA2B,CAAC,CAAC;CACpE;AAED;;;GAGG;AAEH,MAAM,WAAW,sBAAsB;IAErC,IAAI,EAAE,SAAS,CAAC;IAGhB,YAAY,EAAE,mBAAmB,CAAC;IAGlC,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACxE,wBAAwB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/F,YAAY,EAAE,CAAC,OAAO,EAAE,qBAAqB,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAClF,eAAe,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;IACrD,eAAe,EAAE,MAAM,OAAO,CAAC;IAC/B,8EAA8E;IAC9E,MAAM,EAAE,MAAM,IAAI,CAAC;IACnB;;;OAGG;IACH,UAAU,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAC/C,oGAAoG;IACpG,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;IACpD,wFAAwF;IACxF,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;IAG5C;;;;;;;OAOG;IACH,mBAAmB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,kCAAkC,CAAC,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxI,sBAAsB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAGxD,uBAAuB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAKzE,gBAAgB,EAAE,CAAC,MAAM,EAAE;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,UAAU,CAAA;KAAE,KAAK,OAAO,CAAC;QAAE,0BAA0B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,cAAc,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAEhP;;;;;;OAMG;IACH,eAAe,EAAE,CAAC,MAAM,EAAE,sBAAsB,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAGlF,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAGzF,eAAe,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAE1G;;;;;;;OAOG;IACH,yBAAyB,EAAE,CAAC,UAAU,EAAE,mCAAmC,GAAG,SAAS,KAAK,OAAO,CAAC;IAEpG;;;;;;;OAOG;IACH,sBAAsB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,sBAAsB,GAAG,IAAI,GAAG,SAAS,KAAK,OAAO,CAAC;IAEhH;;;;;;;OAOG;IACH,8BAA8B,EAAE,CAAC,gBAAgB,EAAE,MAAM,KAAK,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAEnG;;;;OAIG;IACH,yBAAyB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAEzG;;;;;OAKG;IACH,6BAA6B,EAAE,MAAM,IAAI,CAAC;IAG1C,iBAAiB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,aAAa,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACvG;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,SAAS,CAAC,EAAE,sBAAsB,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAG3F,yBAAyB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAG5D;;;;;;;;;;OAUG;IACH,gCAAgC,EAAE,MAAM,IAAI,CAAC;IAG7C,mBAAmB,EAAE,MAAM,IAAI,CAAC;IAChC,mBAAmB,EAAE,CAAC,WAAW,EAAE,OAAO,KAAK,IAAI,CAAC;IAGpD,gBAAgB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC3G,wBAAwB,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7E;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAgE,CAAC;AAwBlJ,eAAO,MAAM,mBAAmB,EAAE,KAAK,CAAC,EAAE,CAAC;IACzC,QAAQ,EAAE,SAAS,CAAC;IACpB,YAAY,CAAC,EAAE,mBAAmB,CAAC;CACpC,CAyuDA,CAAC"}
+{"version":3,"file":"AuthSessionContext.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/AuthSessionContext.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAA2B,SAAS,EAA2C,MAAM,OAAO,CAAC;AAG3G,OAAO,EAEL,sBAAsB,EACtB,0BAA0B,EAC1B,qBAAqB,EACrB,UAAU,EAGV,0BAA0B,EAG1B,KAAK,oBAAoB,EACzB,UAAU,EACV,wBAAwB,EACxB,KAAK,8BAA8B,EACpC,MAAM,uBAAuB,CAAC;AAE/B,kIAAkI;AAClI,KAAK,oBAAoB,GAAG,8BAA8B,CAAC,wBAAwB,CAAC,sBAAsB,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;AAE7H;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,OAAO,CAAC;IAClB,kBAAkB,EAAE,oBAAoB,EAAE,CAAC;CAC5C;AACD,OAAO,EAEL,KAAK,mCAAmC,EAExC,KAAK,sBAAsB,EAC5B,MAAM,mFAAmF,CAAC;AAC3F,OAAO,EAA+B,mBAAmB,EAAE,MAAM,uEAAuE,CAAC;AAazI,OAAO,EACL,SAAS,EAET,KAAK,aAAa,EAGlB,sBAAsB,EACvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,0CAA0C,CAAC;AAElD,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,yDAAyD,CAAC;AAyBjH;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,KAAK,CAAC,EAAE,0BAA0B,CAAC;IACnC,4BAA4B,CAAC,EAAE,SAAS,CAAC,qBAAqB,CAAC,CAAC;IAChE,0BAA0B,CAAC,EAAE,SAAS,CAAC,4BAA4B,CAAC,CAAC;IACrE,2BAA2B,CAAC,EAAE,SAAS,CAAC,6BAA6B,CAAC,CAAC;IACvE,yBAAyB,CAAC,EAAE,SAAS,CAAC,2BAA2B,CAAC,CAAC;CACpE;AAED;;;GAGG;AAEH,MAAM,WAAW,sBAAsB;IAErC,IAAI,EAAE,SAAS,CAAC;IAGhB,YAAY,EAAE,mBAAmB,CAAC;IAGlC,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACxE,wBAAwB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC/F,YAAY,EAAE,CAAC,OAAO,EAAE,qBAAqB,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAClF,eAAe,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;IACrD,eAAe,EAAE,MAAM,OAAO,CAAC;IAC/B,8EAA8E;IAC9E,MAAM,EAAE,MAAM,IAAI,CAAC;IACnB;;;;;;;OAOG;IACH,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC;;;OAGG;IACH,UAAU,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAC/C,oGAAoG;IACpG,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;IACpD,wFAAwF;IACxF,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;IAC5C;;;;OAIG;IACH,kBAAkB,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC5C;;;;OAIG;IACH,qBAAqB,EAAE,MAAM,gBAAgB,GAAG,IAAI,CAAC;IAGrD;;;;;;;OAOG;IACH,mBAAmB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,kCAAkC,CAAC,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxI,sBAAsB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAGxD,uBAAuB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAKzE,gBAAgB,EAAE,CAAC,MAAM,EAAE,oBAAoB,KAAK,OAAO,CAAC;QAAE,0BAA0B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,cAAc,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAEhJ;;;;;;OAMG;IACH,eAAe,EAAE,CAAC,MAAM,EAAE,sBAAsB,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAGlF,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAGzF,eAAe,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAE1G;;;;;;;OAOG;IACH,yBAAyB,EAAE,CAAC,UAAU,EAAE,mCAAmC,GAAG,SAAS,KAAK,OAAO,CAAC;IAEpG;;;;;;;OAOG;IACH,sBAAsB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,sBAAsB,GAAG,IAAI,GAAG,SAAS,KAAK,OAAO,CAAC;IAEhH;;;;;;;OAOG;IACH,8BAA8B,EAAE,CAAC,gBAAgB,EAAE,MAAM,KAAK,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAEnG;;;;OAIG;IACH,yBAAyB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAEzG;;;;;OAKG;IACH,6BAA6B,EAAE,MAAM,IAAI,CAAC;IAG1C,iBAAiB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,aAAa,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACvG;;;;OAIG;IACH,iBAAiB,EAAE,CAAC,SAAS,CAAC,EAAE,sBAAsB,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAG3F,yBAAyB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAG5D;;;;;;;;;;OAUG;IACH,gCAAgC,EAAE,MAAM,IAAI,CAAC;IAG7C,mBAAmB,EAAE,MAAM,IAAI,CAAC;IAChC,mBAAmB,EAAE,CAAC,WAAW,EAAE,OAAO,KAAK,IAAI,CAAC;IAGpD,gBAAgB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IAC3G,wBAAwB,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7E;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAgE,CAAC;AAwBlJ,eAAO,MAAM,mBAAmB,EAAE,KAAK,CAAC,EAAE,CAAC;IACzC,QAAQ,EAAE,SAAS,CAAC;IACpB,YAAY,CAAC,EAAE,mBAAmB,CAAC;CACpC,CAoyDA,CAAC"}

package/dist/esm/core/security/AuthSessionContext.js

@@ -6,7 +6,7 @@ import { getManualCallsHttpClient, } from '../../core/requests/wildo-http-client
 import { classifyRegistrationOutcome, RegistrationOutcome } from '../../core/security/registration-outcome.frontend.utils.js';
 import { isSpentOrganizationOnboardingSession, parkedOrganizationOnboardingSessionId } from '../../core/security/organization-onboarding.frontend.utils.js';
 import { forgetPendingMfaSession, rememberPendingMfaSession } from '../../core/security/pending-mfa-session-storage.frontend.utils.js';
-import { isAuthoritativeRefreshRejection, isRefreshDevLenient } from '../../core/requests/auth-refresh-resilience.frontend.js';
+import { isAuthoritativeRefreshRejection, isRefreshDevLenient, sessionEndReasonForRefusal } from '../../core/requests/auth-refresh-resilience.frontend.js';
 import { useResourceRegistry } from '../../core/resources/useResourceRegistry.js';
 import { useI18n } from '../../core/i18n/useI18n.js';
 import { resolveComponentLabel } from '../../core/i18n/component-label-resolution.utils.js';
@@ -22,6 +22,14 @@ import { FrontendComponentType, MfaChallengeLabel, UserAuthLabel } from '@wildo-
 import { SessionEndReason, SessionEstablishment } from '../../core/events/events.frontend.schemas.js';
 const logger = LoggerFrontendService.getLogger();
 const logDebug = logger.debugByType('AuthSessionContext');
+/**
+ * The session ends sign-in explains (#2541): the ones the BACKEND decided. A person who signed out, here or in
+ * another tab, knows why; a session replaced by another person's sign-in leaves nobody to tell.
+ */
+const SESSION_REASONS_SIGN_IN_EXPLAINS = new Set([
+    SessionEndReason.SESSION_ENDED,
+    SessionEndReason.ACCOUNT_NOT_ACTIVE,
+]);
 logger.setDebugTypeLogging('AuthSessionContext', false);
 /**
  * The session states on which the server still admits second-factor work — a challenge or an enrollment
@@ -116,6 +124,21 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
     const sessionEndReasonRef = useRef(SessionEndReason.SESSION_ENDED);
     const getSessionEstablishment = useCallback(() => sessionEstablishmentRef.current, []);
     const getSessionEndReason = useCallback(() => sessionEndReasonRef.current, []);
+    /**
+     * Whether the session this tab held has already ended (#2541). A dying session is torn down by more than one
+     * caller: the refresh handler refuses it first, knowing exactly why (`ACCOUNT_NOT_ACTIVE`), and session restore or the
+     * forced-logout error path tear it down again a beat later, knowing only that a request failed. The FIRST end of a
+     * session records its reason; the later ones still tear down, but must not overwrite it with a vaguer one.
+     * Reset when a session is established.
+     */
+    const sessionEndRecordedRef = useRef(false);
+    const [endedSessionReason, setEndedSessionReasonState] = useState(null);
+    const endedSessionReasonRef = useRef(null);
+    const setEndedSessionReason = (reason) => {
+        endedSessionReasonRef.current = reason;
+        setEndedSessionReasonState(reason);
+    };
+    const getEndedSessionReason = useCallback(() => endedSessionReasonRef.current, []);
     /**
      * Auth-hardening Slice A Step 3 (2026-04-13) — `storeAuthTokens` now only
      * carries the access token. The refresh token travels via the
@@ -128,8 +151,14 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
     const storeAuthTokens = (accessToken, establishment) => {
         tokenStorage.storeTokens(accessToken, null);
         sessionEstablishmentRef.current = establishment;
+        markSessionLive();
         clearAnonymousSession();
     };
+    /** A session is held again: the next end is a new one, and sign-in has nothing left to explain (#2541). */
+    const markSessionLive = () => {
+        sessionEndRecordedRef.current = false;
+        setEndedSessionReason(null);
+    };
     /**
      * Store a ROTATED access token — a refresh, or a token another tab rotated or minted. Unlike
      * {@link storeAuthTokens} it says nothing about how the session was established (#1977): a rotation
@@ -138,6 +167,7 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
      */
     const storeRotatedAccessToken = (accessToken) => {
         tokenStorage.storeTokens(accessToken, null);
+        markSessionLive();
         clearAnonymousSession();
     };
     /**
@@ -349,8 +379,6 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
                 method: AuthMethod.PASSWORD,
                 factorLevel: AuthFactorLevel.FIRST,
                 password,
-                rememberMe: false,
-                requestedIntegrations: []
             };
             const resp = await getManualCallsHttpClient().authenticate(authRequest);
             // #1091: a sign-in by an account that still owes its organization resumes onboarding instead of minting.
@@ -840,8 +868,6 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
                 method,
                 factorLevel: AuthFactorLevel.SECOND,
                 token: code,
-                rememberMe: false,
-                requestedIntegrations: [],
             });
             // #1091: the second factor completed a sign-in whose account still owes its organization.
             const parkedOnboardingSessionId = parkedOrganizationOnboardingSessionId(response);
@@ -1295,12 +1321,21 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
      * End this tab's session, recording WHY (#1977): `UserOrgsProvider` reads the reason when it announces
      * `USER_LOGOUT`, and a listener that counts sign-outs must not count a session the backend ended.
      * `logout` is the person's own sign-out; the refresh handler, session restore and the forced-logout
-     * error path end the session with {@link SessionEndReason.SESSION_ENDED}.
+     * error path end it with the reason the backend's refusal names (`sessionEndReasonForRefusal`): an account that
+     * can no longer sign in is {@link SessionEndReason.ACCOUNT_NOT_ACTIVE}, any other refusal
+     * {@link SessionEndReason.SESSION_ENDED} (#2541).
+     *
+     * The FIRST end of a session records its reason and, for a backend-ended one, the sign-in notice; later teardowns of
+     * the same dead session still tear down, but do not overwrite it.
      */
-    const endSession = useCallback((reason) => {
-        logDebug('Ending session', { reason });
+    const endSessionLocally = useCallback((reason, revokeOnBackend) => {
+        logDebug('Ending session', { reason, revokeOnBackend, alreadyEnded: sessionEndRecordedRef.current });
         identificationGenerationRef.current += 1;
-        sessionEndReasonRef.current = reason;
+        if (!sessionEndRecordedRef.current) {
+            sessionEndRecordedRef.current = true;
+            sessionEndReasonRef.current = reason;
+            setEndedSessionReason(SESSION_REASONS_SIGN_IN_EXPLAINS.has(reason) ? reason : null);
+        }
         sessionEstablishmentRef.current = SessionEstablishment.RESUMED;
         // Auth-hardening Slice A Step 3 (2026-04-13) — refresh token now travels
         // via the `__wildo_refresh` `HttpOnly` cookie. JS can't read it (and
@@ -1311,12 +1346,16 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
         // when the JS access token was lost (e.g., post tab crash). We keep
         // this unconditional now — there's no JS-visible "is there a session
         // to revoke?" signal anymore.
-        getManualCallsHttpClient()
-            .logoutFromBackend()
-            .catch((e) => {
-            logger.warn('Backend logout call failed (token revocation)', { error: e });
-        });
-        broadcastChannelRef.current?.postMessage({ type: 'LOGOUT' });
+        if (revokeOnBackend) {
+            getManualCallsHttpClient()
+                .logoutFromBackend()
+                .catch((e) => {
+                logger.warn('Backend logout call failed (token revocation)', { error: e });
+            });
+        }
+        // The reason travels with it (#2541 review): a session the backend refused is refused for every tab sharing its
+        // refresh cookie, so the other tabs' sign-in must say the same thing rather than "you signed out elsewhere".
+        broadcastChannelRef.current?.postMessage({ type: 'LOGOUT', reason: sessionEndReasonRef.current });
         disconnect();
         // Clear consumable token from HTTP client singletons (prevents stale header leakage)
         getManualCallsHttpClient().setConsumableToken(null);
@@ -1331,8 +1370,18 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
         hasInitializedRef.current = false;
         logger.info('User logged out successfully');
     }, [disconnect, tokenStorage, setResourcesAuthToken, setResourcesConsumableToken]);
+    const endSession = useCallback((reason) => endSessionLocally(reason, true), [endSessionLocally]);
     /** The person signs out of this tab. */
     const logout = useCallback(() => endSession(SessionEndReason.SIGNED_OUT), [endSession]);
+    /**
+     * The person signs out everywhere (#2317). The backend fences every token of the account and clears
+     * this tab's refresh cookie, so the local teardown that follows skips the single-session logout call:
+     * there is nothing left for it to revoke.
+     */
+    const signOutEverywhere = useCallback(async () => {
+        await getManualCallsHttpClient().logoutAllFromBackend();
+        endSessionLocally(SessionEndReason.SIGNED_OUT, false);
+    }, [endSessionLocally]);
     /**
      * Single-use clear for the cross-frontend-handoff context.
      *
@@ -1483,7 +1532,8 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
                         ? error.customMessageReference
                         : (error instanceof Error ? error.message : 'Unknown error'),
                 });
-                endSession(SessionEndReason.SESSION_ENDED);
+                // The refusal says why (#2541): an account that can no longer sign in is told so, not just signed out.
+                endSession(sessionEndReasonForRefusal(error));
             }
             else {
                 logger.warn('Auth token renewal failed but session is preserved (will retry on the next request)', {
@@ -1534,7 +1584,15 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
             if (type === 'LOGOUT') {
                 logDebug('Received logout signal from another tab');
                 identificationGenerationRef.current += 1;
-                sessionEndReasonRef.current = SessionEndReason.SIGNED_OUT_IN_ANOTHER_TAB;
+                // First end wins here too: this tab may already have recorded why its own session ended. Otherwise the
+                // sender's reason decides — a backend refusal is this tab's refusal as well; anything else was the person.
+                if (!sessionEndRecordedRef.current) {
+                    const sentReason = event.data?.reason;
+                    const backendEnded = SESSION_REASONS_SIGN_IN_EXPLAINS.has(sentReason);
+                    sessionEndRecordedRef.current = true;
+                    sessionEndReasonRef.current = backendEnded ? sentReason : SessionEndReason.SIGNED_OUT_IN_ANOTHER_TAB;
+                    setEndedSessionReason(backendEnded ? sentReason : null);
+                }
                 sessionEstablishmentRef.current = SessionEstablishment.RESUMED;
                 disconnect();
                 tokenStorage.clear();
@@ -1590,9 +1648,12 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
         getSessionState,
         isAuthenticated,
         logout,
+        signOutEverywhere,
         endSession,
         getSessionEstablishment,
         getSessionEndReason,
+        endedSessionReason,
+        getEndedSessionReason,
         // OAuth2 + cross-frontend-handoff (shared AUTH_CODE_EXCHANGE primitive)
         initiateOAuth2Login,
         handleAuthCodeExchange,
@@ -1625,9 +1686,12 @@ export const AuthSessionProvider = ({ children, tokenStorage: tokenStorageProp }
         auth,
         tokenStorage,
         logout,
+        signOutEverywhere,
         endSession,
         getSessionEstablishment,
         getSessionEndReason,
+        endedSessionReason,
+        getEndedSessionReason,
         initiateOAuth2Login,
         handleAuthCodeExchange,
         handleEmailVerification,