@wildo-ai/saas-frontend-lib 1.1.3 → 1.1.5

package/dist/esm/components/auth/StepUpAuthDialog.js

@@ -1,41 +1,154 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useState, useCallback, useEffect, useRef } from 'react';
-import { FrontendComponentType, SecuritySettingsLabel } from '@wildo-ai/presets-components-models';
+import { AuthMethod } from '@wildo-ai/saas-models';
+import { ButtonSize, FrontendComponentType, SecuritySettingsLabel } from '@wildo-ai/presets-components-models';
 import { OperationsConfirmCritical } from '../../components/feedback/operations-confirm-critical.js';
 import { Text } from '../../components/typography/text.js';
 import { InputRoot } from '../../components/form/controls/input.js';
 import { Field, FieldLabel } from '../../components/form/chromes/field.js';
 import { Alert, AlertDescription } from '../../components/overlays/containers/alert.js';
+import { Button, ButtonVariants_Variant } from '../../components/actions/button.js';
 import { useI18n } from '../../core/i18n/useI18n.js';
-export const StepUpAuthDialog = ({ open, onConfirm, onCancel, error, isLoading, }) => {
+import { useUserFacingErrorMessage } from '../../core/errors/useUserFacingErrorMessage.js';
+import { getManualCallsHttpClient } from '../../core/requests/wildo-http-client-manual-calls.frontend.service.js';
+import { FederatedReAuthenticationFailure, FederatedReAuthenticationFailureReason, openReAuthenticationWindow, } from '../../core/security/federated-reauthentication.frontend.js';
+/**
+ * The methods a step-up can be made with, strongest first — the order the dialog offers them in.
+ *
+ * These are the three `POST /auth/reauth` accepts. A passkey leads because it is phishing-resistant;
+ * a password comes last because it is the one a stolen session's owner is most likely to have reused.
+ */
+export const STEP_UP_METHODS = [AuthMethod.PASSKEY, AuthMethod.TOTP, AuthMethod.PASSWORD];
+const FEDERATED_FAILURE_LABEL = {
+    [FederatedReAuthenticationFailureReason.POPUP_BLOCKED]: SecuritySettingsLabel.REAUTH_PROVIDER_POPUP_BLOCKED,
+    // Never displayed (a cancelled dialog is closed); mapped so the table stays total over the reasons.
+    [FederatedReAuthenticationFailureReason.CANCELLED]: SecuritySettingsLabel.REAUTH_PROVIDER_FAILED,
+    [FederatedReAuthenticationFailureReason.TIMED_OUT]: SecuritySettingsLabel.REAUTH_PROVIDER_TIMED_OUT,
+    [FederatedReAuthenticationFailureReason.FAILED]: SecuritySettingsLabel.REAUTH_PROVIDER_FAILED,
+};
+const METHOD_CHOICE_LABEL = {
+    [AuthMethod.PASSKEY]: SecuritySettingsLabel.REAUTH_WITH_PASSKEY,
+    [AuthMethod.TOTP]: SecuritySettingsLabel.REAUTH_WITH_TOTP,
+    [AuthMethod.PASSWORD]: SecuritySettingsLabel.REAUTH_WITH_PASSWORD,
+};
+/**
+ * What this account can re-authenticate with for `purpose`: its local methods, in {@link STEP_UP_METHODS}
+ * order, and the linked identities whose provider can re-authenticate it (#1441). One request answers both.
+ *
+ * Asked of the server each time the dialog opens (#1417): the answer changes as the person adds and
+ * removes authenticators, and for a step-up it is narrowed by the account's step-up policy, which only
+ * the server can resolve. Offering what the account merely HOLDS would show a password under a
+ * passkey-only policy, accept it, and have the server refuse it.
+ *
+ * An EMPTY answer is kept empty: it means no factor the account holds can produce this proof, and the
+ * dialog says so instead of offering one that would be refused. If the question itself fails, every
+ * local method is offered: showing one the account lacks costs a refusal the person can read, while
+ * offering nothing leaves them no way through at all. No linked identity is offered then: unlike a local
+ * method, a provider cannot be offered blind, because starting one needs the link the answer would name.
+ */
+export async function resolveStepUpOptions(purpose) {
+    try {
+        const { methods, identityLinks } = await getManualCallsHttpClient().getReAuthenticationMethods(purpose);
+        const accepted = new Set(methods);
+        return { methods: STEP_UP_METHODS.filter((method) => accepted.has(method)), identityLinks: identityLinks ?? [] };
+    }
+    catch {
+        return { methods: [...STEP_UP_METHODS], identityLinks: [] };
+    }
+}
+/**
+ * The proof the dialog would submit for `method`, or `null` while the input cannot yet be one. A TOTP
+ * code is 6 to 8 digits because the digit count is configurable (`totpOperational.digits`).
+ */
+export function buildStepUpProof(method, input) {
+    switch (method) {
+        case AuthMethod.PASSWORD:
+            return input.password.trim() ? { method, password: input.password } : null;
+        case AuthMethod.TOTP:
+            return /^\d{6,8}$/.test(input.code.trim()) ? { method, code: input.code.trim() } : null;
+        case AuthMethod.PASSKEY:
+            return { method };
+        default:
+            return null;
+    }
+}
+export const StepUpAuthDialog = ({ open, purpose, onConfirm, onCancel, failure, isLoading, }) => {
+    const toUserFacingErrorMessage = useUserFacingErrorMessage();
     const { tComponent, isReady } = useI18n({ component: FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS });
     const t = useCallback((key) => tComponent(FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS, key), [tComponent]);
+    // `null` while the server is being asked, so the no-method message never flashes before the answer.
+    const [available, setAvailable] = useState(null);
+    const [identityLinks, setIdentityLinks] = useState([]);
+    const [method, setMethod] = useState(null);
+    // The chosen linked identity (#1441). Exclusive with `method`: choosing one clears the other.
+    const [link, setLink] = useState(null);
+    // Set while the provider's window is open. Cancel stays available then: the person may abandon the
+    // provider, and nothing else would ever end the wait early.
+    const isFederatedPendingRef = useRef(false);
     const [password, setPassword] = useState('');
+    const [code, setCode] = useState('');
     // OperationsConfirmCritical calls onOpenChange(false) synchronously after validationCallback.
     // This ref prevents that premature close from cancelling the async re-auth flow.
     const isSubmittingRef = useRef(false);
     useEffect(() => {
-        if (open) {
-            setPassword('');
-            isSubmittingRef.current = false;
-        }
-    }, [open]);
+        if (!open)
+            return;
+        setPassword('');
+        setCode('');
+        isSubmittingRef.current = false;
+        isFederatedPendingRef.current = false;
+        setAvailable(null);
+        setIdentityLinks([]);
+        setMethod(null);
+        setLink(null);
+        let cancelled = false;
+        void resolveStepUpOptions(purpose).then((options) => {
+            if (cancelled)
+                return;
+            setAvailable(options.methods);
+            setIdentityLinks(options.identityLinks);
+            // A local method first when there is one; otherwise the first provider.
+            setMethod(options.methods[0] ?? null);
+            setLink(options.methods.length === 0 ? options.identityLinks[0] ?? null : null);
+        });
+        return () => { cancelled = true; };
+    }, [open, purpose]);
     // Reset submitting guard when async operation finishes (success closes dialog; error stays open)
     useEffect(() => {
         if (!isLoading) {
             isSubmittingRef.current = false;
+            isFederatedPendingRef.current = false;
         }
     }, [isLoading]);
+    const buildProof = useCallback(() => buildStepUpProof(method, { password, code }), [method, password, code]);
+    const nothingOffered = available?.length === 0 && identityLinks.length === 0;
     const handleValidation = useCallback(() => {
-        if (!password.trim() || isSubmittingRef.current)
+        // No method this account holds can produce the proof: the message already says what to do, so Confirm
+        // acknowledges it and closes rather than doing nothing (#1417).
+        if (nothingOffered) {
+            onCancel();
+            return;
+        }
+        if (link) {
+            if (isSubmittingRef.current)
+                return;
+            isSubmittingRef.current = true;
+            isFederatedPendingRef.current = true;
+            // Opened HERE, synchronously in the click, or the browser blocks it (#1441).
+            onConfirm({ method: link.method, identityLinkId: link.identityLinkId, popup: openReAuthenticationWindow() });
+            return;
+        }
+        const proof = buildProof();
+        if (!proof || isSubmittingRef.current)
             return;
         isSubmittingRef.current = true;
-        onConfirm(password);
-    }, [password, onConfirm]);
+        onConfirm(proof);
+    }, [nothingOffered, link, buildProof, onCancel, onConfirm]);
     const handleCancel = useCallback(() => {
-        if (isSubmittingRef.current)
+        if (isSubmittingRef.current && !isFederatedPendingRef.current)
             return;
         setPassword('');
+        setCode('');
         onCancel();
     }, [onCancel]);
     const handleOpenChange = useCallback((nextOpen) => {
@@ -43,11 +156,14 @@ export const StepUpAuthDialog = ({ open, onConfirm, onCancel, error, isLoading,
             handleCancel();
         }
     }, [handleCancel]);
+    const submitOnEnter = (e) => {
+        if (e.key === 'Enter')
+            handleValidation();
+    };
     if (!isReady)
         return null;
-    return (_jsx(OperationsConfirmCritical, { open: open, onOpenChange: handleOpenChange, cancelCallback: handleCancel, validationCallback: handleValidation, label: t(SecuritySettingsLabel.REAUTH_TITLE), children: _jsxs("div", { className: "space-y-4 py-4", children: [_jsx(Text, { className: "text-sm", children: t(SecuritySettingsLabel.REAUTH_DESCRIPTION) }), error && (_jsx(Alert, { variant: "destructive", children: _jsx(AlertDescription, { children: error }) })), _jsxs(Field, { children: [_jsx(FieldLabel, { children: t(SecuritySettingsLabel.REAUTH_PASSWORD) }), _jsx(InputRoot, { type: "password", value: password, onChange: (e) => setPassword(e.target.value), placeholder: t(SecuritySettingsLabel.REAUTH_PASSWORD_PLACEHOLDER), disabled: isLoading, onKeyDown: (e) => {
-                                if (e.key === 'Enter')
-                                    handleValidation();
-                            } })] })] }) }));
+    return (_jsx(OperationsConfirmCritical, { open: open, onOpenChange: handleOpenChange, cancelCallback: handleCancel, validationCallback: handleValidation, label: t(SecuritySettingsLabel.REAUTH_TITLE), children: _jsxs("div", { className: "space-y-4 py-4", children: [_jsx(Text, { className: "text-sm", children: t(SecuritySettingsLabel.REAUTH_DESCRIPTION) }), failure !== null && (_jsx(Alert, { variant: "destructive", children: _jsx(AlertDescription, { children: failure instanceof FederatedReAuthenticationFailure
+                            ? t(FEDERATED_FAILURE_LABEL[failure.reason])
+                            : toUserFacingErrorMessage(failure, t(SecuritySettingsLabel.ERROR)) }) })), nothingOffered && (_jsx(Alert, { children: _jsx(AlertDescription, { children: t(SecuritySettingsLabel.REAUTH_NO_ACCEPTED_METHOD) }) })), available && available.length + identityLinks.length > 1 && (_jsxs("div", { className: "flex flex-wrap gap-2", role: "group", "aria-label": t(SecuritySettingsLabel.REAUTH_TITLE), children: [available.map((choice) => (_jsx(Button, { type: "button", size: ButtonSize.SM, variant: choice === method ? ButtonVariants_Variant.DEFAULT : ButtonVariants_Variant.OUTLINE, "aria-pressed": choice === method, disabled: isLoading, onClick: () => { setMethod(choice); setLink(null); }, children: t(METHOD_CHOICE_LABEL[choice]) }, choice))), identityLinks.map((choice) => (_jsx(Button, { type: "button", size: ButtonSize.SM, variant: choice.identityLinkId === link?.identityLinkId ? ButtonVariants_Variant.DEFAULT : ButtonVariants_Variant.OUTLINE, "aria-pressed": choice.identityLinkId === link?.identityLinkId, disabled: isLoading, onClick: () => { setLink(choice); setMethod(null); }, children: tComponent(FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS, SecuritySettingsLabel.REAUTH_WITH_PROVIDER, { provider: choice.displayName }) }, choice.identityLinkId)))] })), link && (_jsx(Text, { className: "text-sm", children: tComponent(FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS, SecuritySettingsLabel.REAUTH_PROVIDER_PROMPT, { provider: link.displayName }) })), method === AuthMethod.PASSWORD && (_jsxs(Field, { children: [_jsx(FieldLabel, { children: t(SecuritySettingsLabel.REAUTH_PASSWORD) }), _jsx(InputRoot, { type: "password", autoComplete: "current-password", value: password, onChange: (e) => setPassword(e.target.value), placeholder: t(SecuritySettingsLabel.REAUTH_PASSWORD_PLACEHOLDER), disabled: isLoading, onKeyDown: submitOnEnter })] })), method === AuthMethod.TOTP && (_jsxs(Field, { children: [_jsx(FieldLabel, { children: t(SecuritySettingsLabel.REAUTH_TOTP_CODE) }), _jsx(InputRoot, { inputMode: "numeric", autoComplete: "one-time-code", maxLength: 8, value: code, onChange: (e) => setCode(e.target.value.replace(/\D/g, '')), placeholder: t(SecuritySettingsLabel.REAUTH_TOTP_CODE_PLACEHOLDER), disabled: isLoading, onKeyDown: submitOnEnter })] })), method === AuthMethod.PASSKEY && (_jsx(Text, { className: "text-sm", children: t(SecuritySettingsLabel.REAUTH_PASSKEY_PROMPT) }))] }) }));
 };
 //# sourceMappingURL=StepUpAuthDialog.js.map

package/dist/esm/components/auth/StepUpAuthDialog.js.map

@@ -1 +1 @@
-{"version":3,"file":"StepUpAuthDialog.js","sourceRoot":"","sources":["../../../../src/components/auth/StepUpAuthDialog.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AACnG,OAAO,EAAE,yBAAyB,EAAE,MAAM,qEAAqE,CAAC;AAChH,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,oDAAoD,CAAC;AAC/E,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,mDAAmD,CAAC;AACtF,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAUhE,MAAM,CAAC,MAAM,gBAAgB,GAAoC,CAAC,EAChE,IAAI,EACJ,SAAS,EACT,QAAQ,EACR,KAAK,EACL,SAAS,GACV,EAAE,EAAE;IACH,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,6BAA6B,EAAE,CAAC,CAAC;IAC5G,MAAM,CAAC,GAAG,WAAW,CACnB,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,6BAA6B,EAAE,GAAG,CAAC,EACrF,CAAC,UAAU,CAAC,CACb,CAAC;IAEF,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7C,8FAA8F;IAC9F,iFAAiF;IACjF,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAEtC,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,IAAI,EAAE,CAAC;YACT,WAAW,CAAC,EAAE,CAAC,CAAC;YAChB,eAAe,CAAC,OAAO,GAAG,KAAK,CAAC;QAClC,CAAC;IACH,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAEX,iGAAiG;IACjG,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,eAAe,CAAC,OAAO,GAAG,KAAK,CAAC;QAClC,CAAC;IACH,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAEhB,MAAM,gBAAgB,GAAG,WAAW,CAAC,GAAG,EAAE;QACxC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,eAAe,CAAC,OAAO;YAAE,OAAO;QACxD,eAAe,CAAC,OAAO,GAAG,IAAI,CAAC;QAC/B,SAAS,CAAC,QAAQ,CAAC,CAAC;IACtB,CAAC,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;IAE1B,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;QACpC,IAAI,eAAe,CAAC,OAAO;YAAE,OAAO;QACpC,WAAW,CAAC,EAAE,CAAC,CAAC;QAChB,QAAQ,EAAE,CAAC;IACb,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEf,MAAM,gBAAgB,GAAG,WAAW,CAAC,CAAC,QAAiB,EAAE,EAAE;QACzD,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;YAC1C,YAAY,EAAE,CAAC;QACjB,CAAC;IACH,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAEnB,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,OAAO,CACL,KAAC,yBAAyB,IACxB,IAAI,EAAE,IAAI,EACV,YAAY,EAAE,gBAAgB,EAC9B,cAAc,EAAE,YAAY,EAC5B,kBAAkB,EAAE,gBAAgB,EACpC,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,YAE5C,eAAK,SAAS,EAAC,gBAAgB,aAC7B,KAAC,IAAI,IAAC,SAAS,EAAC,SAAS,YAAE,CAAC,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,GAAQ,EAC7E,KAAK,IAAI,CACR,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cAAE,KAAK,GAAoB,GACtC,CACT,EACD,MAAC,KAAK,eACJ,KAAC,UAAU,cAAE,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,GAAc,EACnE,KAAC,SAAS,IACR,IAAI,EAAC,UAAU,EACf,KAAK,EAAE,QAAQ,EACf,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAC5C,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,2BAA2B,CAAC,EACjE,QAAQ,EAAE,SAAS,EACnB,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE;gCACf,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO;oCAAE,gBAAgB,EAAE,CAAC;4BAC5C,CAAC,GACD,IACI,IACJ,GACoB,CAC7B,CAAC;AACJ,CAAC,CAAC","sourcesContent":["import React, { useState, useCallback, useEffect, useRef } from 'react';\nimport { FrontendComponentType, SecuritySettingsLabel } from '@wildo-ai/presets-components-models';\nimport { OperationsConfirmCritical } from '~wildo-frontend-lib/components/feedback/operations-confirm-critical';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { InputRoot } from '~wildo-frontend-lib/components/form/controls/input';\nimport { Field, FieldLabel } from '~wildo-frontend-lib/components/form/chromes/field';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\n\ninterface StepUpAuthDialogProps {\n  open: boolean;\n  onConfirm: (password: string) => void;\n  onCancel: () => void;\n  error: string | null;\n  isLoading: boolean;\n}\n\nexport const StepUpAuthDialog: React.FC<StepUpAuthDialogProps> = ({\n  open,\n  onConfirm,\n  onCancel,\n  error,\n  isLoading,\n}) => {\n  const { tComponent, isReady } = useI18n({ component: FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS });\n  const t = useCallback(\n    (key: string) => tComponent(FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS, key),\n    [tComponent],\n  );\n\n  const [password, setPassword] = useState('');\n  // OperationsConfirmCritical calls onOpenChange(false) synchronously after validationCallback.\n  // This ref prevents that premature close from cancelling the async re-auth flow.\n  const isSubmittingRef = useRef(false);\n\n  useEffect(() => {\n    if (open) {\n      setPassword('');\n      isSubmittingRef.current = false;\n    }\n  }, [open]);\n\n  // Reset submitting guard when async operation finishes (success closes dialog; error stays open)\n  useEffect(() => {\n    if (!isLoading) {\n      isSubmittingRef.current = false;\n    }\n  }, [isLoading]);\n\n  const handleValidation = useCallback(() => {\n    if (!password.trim() || isSubmittingRef.current) return;\n    isSubmittingRef.current = true;\n    onConfirm(password);\n  }, [password, onConfirm]);\n\n  const handleCancel = useCallback(() => {\n    if (isSubmittingRef.current) return;\n    setPassword('');\n    onCancel();\n  }, [onCancel]);\n\n  const handleOpenChange = useCallback((nextOpen: boolean) => {\n    if (!nextOpen && !isSubmittingRef.current) {\n      handleCancel();\n    }\n  }, [handleCancel]);\n\n  if (!isReady) return null;\n\n  return (\n    <OperationsConfirmCritical\n      open={open}\n      onOpenChange={handleOpenChange}\n      cancelCallback={handleCancel}\n      validationCallback={handleValidation}\n      label={t(SecuritySettingsLabel.REAUTH_TITLE)}\n    >\n      <div className=\"space-y-4 py-4\">\n        <Text className=\"text-sm\">{t(SecuritySettingsLabel.REAUTH_DESCRIPTION)}</Text>\n        {error && (\n          <Alert variant=\"destructive\">\n            <AlertDescription>{error}</AlertDescription>\n          </Alert>\n        )}\n        <Field>\n          <FieldLabel>{t(SecuritySettingsLabel.REAUTH_PASSWORD)}</FieldLabel>\n          <InputRoot\n            type=\"password\"\n            value={password}\n            onChange={(e) => setPassword(e.target.value)}\n            placeholder={t(SecuritySettingsLabel.REAUTH_PASSWORD_PLACEHOLDER)}\n            disabled={isLoading}\n            onKeyDown={(e) => {\n              if (e.key === 'Enter') handleValidation();\n            }}\n          />\n        </Field>\n      </div>\n    </OperationsConfirmCritical>\n  );\n};\n"]}
+{"version":3,"file":"StepUpAuthDialog.js","sourceRoot":"","sources":["../../../../../src/components/auth/StepUpAuthDialog.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AACxE,OAAO,EAAE,UAAU,EAAoG,MAAM,uBAAuB,CAAC;AACrJ,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC/G,OAAO,EAAE,yBAAyB,EAAE,MAAM,qEAAqE,CAAC;AAChH,OAAO,EAAE,IAAI,EAAE,MAAM,gDAAgD,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,oDAAoD,CAAC;AAC/E,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,mDAAmD,CAAC;AACtF,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,0DAA0D,CAAC;AACnG,OAAO,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,+CAA+C,CAAC;AAC/F,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AACtG,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAC7H,OAAO,EACL,gCAAgC,EAChC,sCAAsC,EACtC,0BAA0B,GAC3B,MAAM,uEAAuE,CAAC;AAE/E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAA4B,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;AAmBnH,MAAM,uBAAuB,GAA0E;IACrG,CAAC,sCAAsC,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC,6BAA6B;IAC3G,oGAAoG;IACpG,CAAC,sCAAsC,CAAC,SAAS,CAAC,EAAE,qBAAqB,CAAC,sBAAsB;IAChG,CAAC,sCAAsC,CAAC,SAAS,CAAC,EAAE,qBAAqB,CAAC,yBAAyB;IACnG,CAAC,sCAAsC,CAAC,MAAM,CAAC,EAAE,qBAAqB,CAAC,sBAAsB;CAC9F,CAAC;AAEF,MAAM,mBAAmB,GAAgD;IACvE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC,mBAAmB;IAC/D,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,qBAAqB,CAAC,gBAAgB;IACzD,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,qBAAqB,CAAC,oBAAoB;CAClE,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgC;IAEhC,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,wBAAwB,EAAE,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACxG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAa,OAAO,CAAC,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,aAAa,EAAE,aAAa,IAAI,EAAE,EAAE,CAAC;IACnH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,eAAe,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;IAC9D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAA2B,EAAE,KAAyC;IACrG,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,UAAU,CAAC,QAAQ;YACtB,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7E,KAAK,UAAU,CAAC,IAAI;YAClB,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1F,KAAK,UAAU,CAAC,OAAO;YACrB,OAAO,EAAE,MAAM,EAAE,CAAC;QACpB;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAiBD,MAAM,CAAC,MAAM,gBAAgB,GAAoC,CAAC,EAChE,IAAI,EACJ,OAAO,EACP,SAAS,EACT,QAAQ,EACR,OAAO,EACP,SAAS,GACV,EAAE,EAAE;IACH,MAAM,wBAAwB,GAAG,yBAAyB,EAAE,CAAC;IAC7D,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,qBAAqB,CAAC,6BAA6B,EAAE,CAAC,CAAC;IAC5G,MAAM,CAAC,GAAG,WAAW,CACnB,CAAC,GAAW,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,6BAA6B,EAAE,GAAG,CAAC,EACrF,CAAC,UAAU,CAAC,CACb,CAAC;IAEF,oGAAoG;IACpG,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAwB,IAAI,CAAC,CAAC;IACxE,MAAM,CAAC,aAAa,EAAE,gBAAgB,CAAC,GAAG,QAAQ,CAAiC,EAAE,CAAC,CAAC;IACvF,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAsB,IAAI,CAAC,CAAC;IAChE,8FAA8F;IAC9F,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAsC,IAAI,CAAC,CAAC;IAC5E,mGAAmG;IACnG,4DAA4D;IAC5D,MAAM,qBAAqB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7C,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IACrC,8FAA8F;IAC9F,iFAAiF;IACjF,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAEtC,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,WAAW,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,EAAE,CAAC,CAAC;QACZ,eAAe,CAAC,OAAO,GAAG,KAAK,CAAC;QAChC,qBAAqB,CAAC,OAAO,GAAG,KAAK,CAAC;QACtC,YAAY,CAAC,IAAI,CAAC,CAAC;QACnB,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACrB,SAAS,CAAC,IAAI,CAAC,CAAC;QAChB,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,KAAK,oBAAoB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAClD,IAAI,SAAS;gBAAE,OAAO;YACtB,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC9B,gBAAgB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;YACxC,wEAAwE;YACxE,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;YACtC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAEpB,iGAAiG;IACjG,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,eAAe,CAAC,OAAO,GAAG,KAAK,CAAC;YAChC,qBAAqB,CAAC,OAAO,GAAG,KAAK,CAAC;QACxC,CAAC;IACH,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAEhB,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IAE7G,MAAM,cAAc,GAAG,SAAS,EAAE,MAAM,KAAK,CAAC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC;IAE7E,MAAM,gBAAgB,GAAG,WAAW,CAAC,GAAG,EAAE;QACxC,sGAAsG;QACtG,gEAAgE;QAChE,IAAI,cAAc,EAAE,CAAC;YACnB,QAAQ,EAAE,CAAC;YACX,OAAO;QACT,CAAC;QACD,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,eAAe,CAAC,OAAO;gBAAE,OAAO;YACpC,eAAe,CAAC,OAAO,GAAG,IAAI,CAAC;YAC/B,qBAAqB,CAAC,OAAO,GAAG,IAAI,CAAC;YACrC,6EAA6E;YAC7E,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,CAAC,CAAC;YAC7G,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,IAAI,eAAe,CAAC,OAAO;YAAE,OAAO;QAC9C,eAAe,CAAC,OAAO,GAAG,IAAI,CAAC;QAC/B,SAAS,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;IAE5D,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;QACpC,IAAI,eAAe,CAAC,OAAO,IAAI,CAAC,qBAAqB,CAAC,OAAO;YAAE,OAAO;QACtE,WAAW,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,EAAE,CAAC,CAAC;QACZ,QAAQ,EAAE,CAAC;IACb,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEf,MAAM,gBAAgB,GAAG,WAAW,CAAC,CAAC,QAAiB,EAAE,EAAE;QACzD,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,CAAC;YAC1C,YAAY,EAAE,CAAC;QACjB,CAAC;IACH,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAEnB,MAAM,aAAa,GAAG,CAAC,CAAsB,EAAE,EAAE;QAC/C,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO;YAAE,gBAAgB,EAAE,CAAC;IAC5C,CAAC,CAAC;IAEF,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,OAAO,CACL,KAAC,yBAAyB,IACxB,IAAI,EAAE,IAAI,EACV,YAAY,EAAE,gBAAgB,EAC9B,cAAc,EAAE,YAAY,EAC5B,kBAAkB,EAAE,gBAAgB,EACpC,KAAK,EAAE,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,YAE5C,eAAK,SAAS,EAAC,gBAAgB,aAC7B,KAAC,IAAI,IAAC,SAAS,EAAC,SAAS,YAAE,CAAC,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,GAAQ,EAC7E,OAAO,KAAK,IAAI,IAAI,CACnB,KAAC,KAAK,IAAC,OAAO,EAAC,aAAa,YAC1B,KAAC,gBAAgB,cACd,OAAO,YAAY,gCAAgC;4BAClD,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;4BAC5C,CAAC,CAAC,wBAAwB,CAAC,OAAO,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,GACpD,GACb,CACT,EACA,cAAc,IAAI,CACjB,KAAC,KAAK,cACJ,KAAC,gBAAgB,cAAE,CAAC,CAAC,qBAAqB,CAAC,yBAAyB,CAAC,GAAoB,GACnF,CACT,EACA,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,CAC3D,eAAK,SAAS,EAAC,sBAAsB,EAAC,IAAI,EAAC,OAAO,gBAAa,CAAC,CAAC,qBAAqB,CAAC,YAAY,CAAC,aACjG,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CACzB,KAAC,MAAM,IAEL,IAAI,EAAC,QAAQ,EACb,IAAI,EAAE,UAAU,CAAC,EAAE,EACnB,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,kBAC9E,MAAM,KAAK,MAAM,EAC/B,QAAQ,EAAE,SAAS,EACnB,OAAO,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAEnD,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,IAR1B,MAAM,CASJ,CACV,CAAC,EACD,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAC7B,KAAC,MAAM,IAEL,IAAI,EAAC,QAAQ,EACb,IAAI,EAAE,UAAU,CAAC,EAAE,EACnB,OAAO,EAAE,MAAM,CAAC,cAAc,KAAK,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,kBAC3G,MAAM,CAAC,cAAc,KAAK,IAAI,EAAE,cAAc,EAC5D,QAAQ,EAAE,SAAS,EACnB,OAAO,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAEnD,UAAU,CAAC,qBAAqB,CAAC,6BAA6B,EAAE,qBAAqB,CAAC,oBAAoB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,IARzI,MAAM,CAAC,cAAc,CASnB,CACV,CAAC,IACE,CACP,EACA,IAAI,IAAI,CACP,KAAC,IAAI,IAAC,SAAS,EAAC,SAAS,YACtB,UAAU,CAAC,qBAAqB,CAAC,6BAA6B,EAAE,qBAAqB,CAAC,sBAAsB,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,GACzI,CACR,EACA,MAAM,KAAK,UAAU,CAAC,QAAQ,IAAI,CACjC,MAAC,KAAK,eACJ,KAAC,UAAU,cAAE,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,GAAc,EACnE,KAAC,SAAS,IACR,IAAI,EAAC,UAAU,EACf,YAAY,EAAC,kBAAkB,EAC/B,KAAK,EAAE,QAAQ,EACf,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAC5C,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,2BAA2B,CAAC,EACjE,QAAQ,EAAE,SAAS,EACnB,SAAS,EAAE,aAAa,GACxB,IACI,CACT,EACA,MAAM,KAAK,UAAU,CAAC,IAAI,IAAI,CAC7B,MAAC,KAAK,eACJ,KAAC,UAAU,cAAE,CAAC,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,GAAc,EACpE,KAAC,SAAS,IACR,SAAS,EAAC,SAAS,EACnB,YAAY,EAAC,eAAe,EAC5B,SAAS,EAAE,CAAC,EACZ,KAAK,EAAE,IAAI,EACX,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAC3D,WAAW,EAAE,CAAC,CAAC,qBAAqB,CAAC,4BAA4B,CAAC,EAClE,QAAQ,EAAE,SAAS,EACnB,SAAS,EAAE,aAAa,GACxB,IACI,CACT,EACA,MAAM,KAAK,UAAU,CAAC,OAAO,IAAI,CAChC,KAAC,IAAI,IAAC,SAAS,EAAC,SAAS,YAAE,CAAC,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,GAAQ,CAClF,IACG,GACoB,CAC7B,CAAC;AACJ,CAAC,CAAC","sourcesContent":["import React, { useState, useCallback, useEffect, useRef } from 'react';\nimport { AuthMethod, ReAuthenticationPurpose, type FederatedReAuthenticationMethod, type ReAuthenticationIdentityLink } from '@wildo-ai/saas-models';\nimport { ButtonSize, FrontendComponentType, SecuritySettingsLabel } from '@wildo-ai/presets-components-models';\nimport { OperationsConfirmCritical } from '~wildo-frontend-lib/components/feedback/operations-confirm-critical';\nimport { Text } from '~wildo-frontend-lib/components/typography/text';\nimport { InputRoot } from '~wildo-frontend-lib/components/form/controls/input';\nimport { Field, FieldLabel } from '~wildo-frontend-lib/components/form/chromes/field';\nimport { Alert, AlertDescription } from '~wildo-frontend-lib/components/overlays/containers/alert';\nimport { Button, ButtonVariants_Variant } from '~wildo-frontend-lib/components/actions/button';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { useUserFacingErrorMessage } from '~wildo-frontend-lib/core/errors/useUserFacingErrorMessage';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport {\n  FederatedReAuthenticationFailure,\n  FederatedReAuthenticationFailureReason,\n  openReAuthenticationWindow,\n} from '~wildo-frontend-lib/core/security/federated-reauthentication.frontend';\n\n/**\n * The methods a step-up can be made with, strongest first — the order the dialog offers them in.\n *\n * These are the three `POST /auth/reauth` accepts. A passkey leads because it is phishing-resistant;\n * a password comes last because it is the one a stolen session's owner is most likely to have reused.\n */\nexport const STEP_UP_METHODS: readonly StepUpMethod[] = [AuthMethod.PASSKEY, AuthMethod.TOTP, AuthMethod.PASSWORD];\n\nexport type StepUpMethod = AuthMethod.PASSKEY | AuthMethod.TOTP | AuthMethod.PASSWORD;\n\n/**\n * What the person supplied to prove they are still the account holder. The dialog collects it; the\n * step-up context turns it into a single-use token. A passkey carries nothing here because its\n * ceremony runs after the dialog confirms — it needs a server challenge first.\n *\n * A federated proof (#1441) carries the linked identity and the window the provider will run in. The\n * window is opened BY THE DIALOG, in the Confirm click, because a browser allows a popup only there;\n * `null` means it refused.\n */\nexport type StepUpProof =\n  | { method: AuthMethod.PASSWORD; password: string }\n  | { method: AuthMethod.TOTP; code: string }\n  | { method: AuthMethod.PASSKEY }\n  | { method: FederatedReAuthenticationMethod; identityLinkId: string; popup: Window | null };\n\nconst FEDERATED_FAILURE_LABEL: Record<FederatedReAuthenticationFailureReason, SecuritySettingsLabel> = {\n  [FederatedReAuthenticationFailureReason.POPUP_BLOCKED]: SecuritySettingsLabel.REAUTH_PROVIDER_POPUP_BLOCKED,\n  // Never displayed (a cancelled dialog is closed); mapped so the table stays total over the reasons.\n  [FederatedReAuthenticationFailureReason.CANCELLED]: SecuritySettingsLabel.REAUTH_PROVIDER_FAILED,\n  [FederatedReAuthenticationFailureReason.TIMED_OUT]: SecuritySettingsLabel.REAUTH_PROVIDER_TIMED_OUT,\n  [FederatedReAuthenticationFailureReason.FAILED]: SecuritySettingsLabel.REAUTH_PROVIDER_FAILED,\n};\n\nconst METHOD_CHOICE_LABEL: Record<StepUpMethod, SecuritySettingsLabel> = {\n  [AuthMethod.PASSKEY]: SecuritySettingsLabel.REAUTH_WITH_PASSKEY,\n  [AuthMethod.TOTP]: SecuritySettingsLabel.REAUTH_WITH_TOTP,\n  [AuthMethod.PASSWORD]: SecuritySettingsLabel.REAUTH_WITH_PASSWORD,\n};\n\n/**\n * What this account can re-authenticate with for `purpose`: its local methods, in {@link STEP_UP_METHODS}\n * order, and the linked identities whose provider can re-authenticate it (#1441). One request answers both.\n *\n * Asked of the server each time the dialog opens (#1417): the answer changes as the person adds and\n * removes authenticators, and for a step-up it is narrowed by the account's step-up policy, which only\n * the server can resolve. Offering what the account merely HOLDS would show a password under a\n * passkey-only policy, accept it, and have the server refuse it.\n *\n * An EMPTY answer is kept empty: it means no factor the account holds can produce this proof, and the\n * dialog says so instead of offering one that would be refused. If the question itself fails, every\n * local method is offered: showing one the account lacks costs a refusal the person can read, while\n * offering nothing leaves them no way through at all. No linked identity is offered then: unlike a local\n * method, a provider cannot be offered blind, because starting one needs the link the answer would name.\n */\nexport async function resolveStepUpOptions(\n  purpose: ReAuthenticationPurpose,\n): Promise<{ methods: StepUpMethod[]; identityLinks: ReAuthenticationIdentityLink[] }> {\n  try {\n    const { methods, identityLinks } = await getManualCallsHttpClient().getReAuthenticationMethods(purpose);\n    const accepted = new Set<AuthMethod>(methods);\n    return { methods: STEP_UP_METHODS.filter((method) => accepted.has(method)), identityLinks: identityLinks ?? [] };\n  } catch {\n    return { methods: [...STEP_UP_METHODS], identityLinks: [] };\n  }\n}\n\n/**\n * The proof the dialog would submit for `method`, or `null` while the input cannot yet be one. A TOTP\n * code is 6 to 8 digits because the digit count is configurable (`totpOperational.digits`).\n */\nexport function buildStepUpProof(method: StepUpMethod | null, input: { password: string; code: string }): StepUpProof | null {\n  switch (method) {\n    case AuthMethod.PASSWORD:\n      return input.password.trim() ? { method, password: input.password } : null;\n    case AuthMethod.TOTP:\n      return /^\\d{6,8}$/.test(input.code.trim()) ? { method, code: input.code.trim() } : null;\n    case AuthMethod.PASSKEY:\n      return { method };\n    default:\n      return null;\n  }\n}\n\ninterface StepUpAuthDialogProps {\n  open: boolean;\n  /** Which proof the refusal asked for; decides which methods are offered (#1417). */\n  purpose: ReAuthenticationPurpose;\n  onConfirm: (proof: StepUpProof) => void;\n  onCancel: () => void;\n  /**\n   * The caught re-authentication failure, `null` when there is none. Passed as the error itself rather\n   * than as text so it is resolved HERE, through the i18n context: a wrong password used to reach the\n   * dialog as the backend's i18n reference (`authentication_user_credentials_invalid`).\n   */\n  failure: unknown;\n  isLoading: boolean;\n}\n\nexport const StepUpAuthDialog: React.FC<StepUpAuthDialogProps> = ({\n  open,\n  purpose,\n  onConfirm,\n  onCancel,\n  failure,\n  isLoading,\n}) => {\n  const toUserFacingErrorMessage = useUserFacingErrorMessage();\n  const { tComponent, isReady } = useI18n({ component: FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS });\n  const t = useCallback(\n    (key: string) => tComponent(FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS, key),\n    [tComponent],\n  );\n\n  // `null` while the server is being asked, so the no-method message never flashes before the answer.\n  const [available, setAvailable] = useState<StepUpMethod[] | null>(null);\n  const [identityLinks, setIdentityLinks] = useState<ReAuthenticationIdentityLink[]>([]);\n  const [method, setMethod] = useState<StepUpMethod | null>(null);\n  // The chosen linked identity (#1441). Exclusive with `method`: choosing one clears the other.\n  const [link, setLink] = useState<ReAuthenticationIdentityLink | null>(null);\n  // Set while the provider's window is open. Cancel stays available then: the person may abandon the\n  // provider, and nothing else would ever end the wait early.\n  const isFederatedPendingRef = useRef(false);\n  const [password, setPassword] = useState('');\n  const [code, setCode] = useState('');\n  // OperationsConfirmCritical calls onOpenChange(false) synchronously after validationCallback.\n  // This ref prevents that premature close from cancelling the async re-auth flow.\n  const isSubmittingRef = useRef(false);\n\n  useEffect(() => {\n    if (!open) return;\n    setPassword('');\n    setCode('');\n    isSubmittingRef.current = false;\n    isFederatedPendingRef.current = false;\n    setAvailable(null);\n    setIdentityLinks([]);\n    setMethod(null);\n    setLink(null);\n    let cancelled = false;\n    void resolveStepUpOptions(purpose).then((options) => {\n      if (cancelled) return;\n      setAvailable(options.methods);\n      setIdentityLinks(options.identityLinks);\n      // A local method first when there is one; otherwise the first provider.\n      setMethod(options.methods[0] ?? null);\n      setLink(options.methods.length === 0 ? options.identityLinks[0] ?? null : null);\n    });\n    return () => { cancelled = true; };\n  }, [open, purpose]);\n\n  // Reset submitting guard when async operation finishes (success closes dialog; error stays open)\n  useEffect(() => {\n    if (!isLoading) {\n      isSubmittingRef.current = false;\n      isFederatedPendingRef.current = false;\n    }\n  }, [isLoading]);\n\n  const buildProof = useCallback(() => buildStepUpProof(method, { password, code }), [method, password, code]);\n\n  const nothingOffered = available?.length === 0 && identityLinks.length === 0;\n\n  const handleValidation = useCallback(() => {\n    // No method this account holds can produce the proof: the message already says what to do, so Confirm\n    // acknowledges it and closes rather than doing nothing (#1417).\n    if (nothingOffered) {\n      onCancel();\n      return;\n    }\n    if (link) {\n      if (isSubmittingRef.current) return;\n      isSubmittingRef.current = true;\n      isFederatedPendingRef.current = true;\n      // Opened HERE, synchronously in the click, or the browser blocks it (#1441).\n      onConfirm({ method: link.method, identityLinkId: link.identityLinkId, popup: openReAuthenticationWindow() });\n      return;\n    }\n    const proof = buildProof();\n    if (!proof || isSubmittingRef.current) return;\n    isSubmittingRef.current = true;\n    onConfirm(proof);\n  }, [nothingOffered, link, buildProof, onCancel, onConfirm]);\n\n  const handleCancel = useCallback(() => {\n    if (isSubmittingRef.current && !isFederatedPendingRef.current) return;\n    setPassword('');\n    setCode('');\n    onCancel();\n  }, [onCancel]);\n\n  const handleOpenChange = useCallback((nextOpen: boolean) => {\n    if (!nextOpen && !isSubmittingRef.current) {\n      handleCancel();\n    }\n  }, [handleCancel]);\n\n  const submitOnEnter = (e: React.KeyboardEvent) => {\n    if (e.key === 'Enter') handleValidation();\n  };\n\n  if (!isReady) return null;\n\n  return (\n    <OperationsConfirmCritical\n      open={open}\n      onOpenChange={handleOpenChange}\n      cancelCallback={handleCancel}\n      validationCallback={handleValidation}\n      label={t(SecuritySettingsLabel.REAUTH_TITLE)}\n    >\n      <div className=\"space-y-4 py-4\">\n        <Text className=\"text-sm\">{t(SecuritySettingsLabel.REAUTH_DESCRIPTION)}</Text>\n        {failure !== null && (\n          <Alert variant=\"destructive\">\n            <AlertDescription>\n              {failure instanceof FederatedReAuthenticationFailure\n                ? t(FEDERATED_FAILURE_LABEL[failure.reason])\n                : toUserFacingErrorMessage(failure, t(SecuritySettingsLabel.ERROR))}\n            </AlertDescription>\n          </Alert>\n        )}\n        {nothingOffered && (\n          <Alert>\n            <AlertDescription>{t(SecuritySettingsLabel.REAUTH_NO_ACCEPTED_METHOD)}</AlertDescription>\n          </Alert>\n        )}\n        {available && available.length + identityLinks.length > 1 && (\n          <div className=\"flex flex-wrap gap-2\" role=\"group\" aria-label={t(SecuritySettingsLabel.REAUTH_TITLE)}>\n            {available.map((choice) => (\n              <Button\n                key={choice}\n                type=\"button\"\n                size={ButtonSize.SM}\n                variant={choice === method ? ButtonVariants_Variant.DEFAULT : ButtonVariants_Variant.OUTLINE}\n                aria-pressed={choice === method}\n                disabled={isLoading}\n                onClick={() => { setMethod(choice); setLink(null); }}\n              >\n                {t(METHOD_CHOICE_LABEL[choice])}\n              </Button>\n            ))}\n            {identityLinks.map((choice) => (\n              <Button\n                key={choice.identityLinkId}\n                type=\"button\"\n                size={ButtonSize.SM}\n                variant={choice.identityLinkId === link?.identityLinkId ? ButtonVariants_Variant.DEFAULT : ButtonVariants_Variant.OUTLINE}\n                aria-pressed={choice.identityLinkId === link?.identityLinkId}\n                disabled={isLoading}\n                onClick={() => { setLink(choice); setMethod(null); }}\n              >\n                {tComponent(FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS, SecuritySettingsLabel.REAUTH_WITH_PROVIDER, { provider: choice.displayName })}\n              </Button>\n            ))}\n          </div>\n        )}\n        {link && (\n          <Text className=\"text-sm\">\n            {tComponent(FrontendComponentType.APP_LAYOUTS_SECURITY_SETTINGS, SecuritySettingsLabel.REAUTH_PROVIDER_PROMPT, { provider: link.displayName })}\n          </Text>\n        )}\n        {method === AuthMethod.PASSWORD && (\n          <Field>\n            <FieldLabel>{t(SecuritySettingsLabel.REAUTH_PASSWORD)}</FieldLabel>\n            <InputRoot\n              type=\"password\"\n              autoComplete=\"current-password\"\n              value={password}\n              onChange={(e) => setPassword(e.target.value)}\n              placeholder={t(SecuritySettingsLabel.REAUTH_PASSWORD_PLACEHOLDER)}\n              disabled={isLoading}\n              onKeyDown={submitOnEnter}\n            />\n          </Field>\n        )}\n        {method === AuthMethod.TOTP && (\n          <Field>\n            <FieldLabel>{t(SecuritySettingsLabel.REAUTH_TOTP_CODE)}</FieldLabel>\n            <InputRoot\n              inputMode=\"numeric\"\n              autoComplete=\"one-time-code\"\n              maxLength={8}\n              value={code}\n              onChange={(e) => setCode(e.target.value.replace(/\\D/g, ''))}\n              placeholder={t(SecuritySettingsLabel.REAUTH_TOTP_CODE_PLACEHOLDER)}\n              disabled={isLoading}\n              onKeyDown={submitOnEnter}\n            />\n          </Field>\n        )}\n        {method === AuthMethod.PASSKEY && (\n          <Text className=\"text-sm\">{t(SecuritySettingsLabel.REAUTH_PASSKEY_PROMPT)}</Text>\n        )}\n      </div>\n    </OperationsConfirmCritical>\n  );\n};\n"]}

package/dist/esm/components/auth/admin-config/AppPage_SecuritySettings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AppPage_SecuritySettings.d.ts","sourceRoot":"","sources":["../../../../../src/components/auth/admin-config/AppPage_SecuritySettings.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAoD,MAAM,OAAO,CAAC;AAoKzE,eAAO,MAAM,wBAAwB,EAAE,KAAK,CAAC,EA+b5C,CAAC"}
+{"version":3,"file":"AppPage_SecuritySettings.d.ts","sourceRoot":"","sources":["../../../../../../src/components/auth/admin-config/AppPage_SecuritySettings.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAoD,MAAM,OAAO,CAAC;AAqKzE,eAAO,MAAM,wBAAwB,EAAE,KAAK,CAAC,EAwZ5C,CAAC"}

package/dist/esm/components/auth/admin-config/AppPage_SecuritySettings.js

@@ -4,17 +4,18 @@ import { ButtonSize, FrontendComponentType, SecuritySettingsLabel } from '@wildo
 import { Card, CardContent } from '../../../components/sections/card.js';
 import { Badge } from '../../../components/data-display/badge.js';
 import { useIconRegistry } from '../../../core/icons/useIconRegistry.js';
-import { StandardIconReference, IconSize } from '../../../core/icons/icon-registry.frontend.schemas.js';
+import { IconSize } from '../../../core/icons/icon-registry.frontend.schemas.js';
+import { AUTH_METHOD_ICON_REFERENCES } from '../../../components/auth/methods/auth-method-presentation.js';
 import { cn } from '../../../core/ui/cn.js';
 import { Button, ButtonVariants_Variant } from '../../../components/actions/button.js';
 import { Text } from '../../../components/typography/text.js';
 import { Alert, AlertDescription } from '../../../components/overlays/containers/alert.js';
 import { InputRoot } from '../../../components/form/controls/input.js';
 import { Field, FieldLabel } from '../../../components/form/chromes/field.js';
-import { OperationsConfirmCritical } from '../../../components/feedback/operations-confirm-critical.js';
-import { AuthMethod, isWildoBackendError, } from '@wildo-ai/saas-models';
+import { AuthMethod, AuthUtils, isWildoBackendError, } from '@wildo-ai/saas-models';
 import { FormProvider, useForm } from 'react-hook-form';
 import { useI18n } from '../../../core/i18n/useI18n.js';
+import { useUserFacingErrorMessage } from '../../../core/errors/useUserFacingErrorMessage.js';
 import { useApplication } from '../../../core/runtime/useApplication.js';
 import { useAuthSession } from '../../../core/security/useAuthSession.js';
 import { useResolvedAuthConfig } from '../../../core/security/useResolvedAuthConfig.js';
@@ -65,6 +66,7 @@ export const AppPage_SecuritySettings = () => {
     const { auth: authState } = useAuthSession();
     const { user } = useUserOrgs();
     const resolvedAuth = useResolvedAuthConfig();
+    const toUserFacingErrorMessage = useUserFacingErrorMessage();
     const [methods, setMethods] = useState([]);
     const [passkeys, setPasskeys] = useState([]);
     const [identityLinks, setIdentityLinks] = useState([]);
@@ -74,8 +76,6 @@ export const AppPage_SecuritySettings = () => {
     const [showTotpEnroll, setShowTotpEnroll] = useState(false);
     const [showPhoneEnroll, setShowPhoneEnroll] = useState(false);
     const [passkeyRegistering, setPasskeyRegistering] = useState(false);
-    const [reauthOpen, setReauthOpen] = useState(false);
-    const [reauthPassword, setReauthPassword] = useState('');
     const identityProviderLabelKeys = useMemo(() => collectFrontendProviderDisplayLabelKeys(identityLinks.map((link) => frontendProviderRegistry?.getProviderByRef(link.providerRef)?.metadata.displayNameLabelKey)), [frontendProviderRegistry, identityLinks]);
     const { tComponent, t: translateProvider, isReady } = useI18n({
         component: [
@@ -91,7 +91,6 @@ export const AppPage_SecuritySettings = () => {
     const methodManagement = resolvedAuth.userTypeAuth?.methodManagement;
     const passwordPolicy = resolvedAuth.passwordPolicy;
     const maxPasskeys = passkeyConfig?.maxPasskeysPerUser ?? 10;
-    const requireReauth = methodManagement?.requireReauthForMethodChanges ?? false;
     const allowRemoval = methodManagement?.allowUserMethodRemoval ?? true;
     const refresh = useCallback(async () => {
         setLoading(true);
@@ -110,12 +109,12 @@ export const AppPage_SecuritySettings = () => {
         catch (e) {
             if (isWildoBackendError(e))
                 throw e;
-            setError(e?.message ?? t(SecuritySettingsLabel.ERROR));
+            setError(toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR)));
         }
         finally {
             setLoading(false);
         }
-    }, [t]);
+    }, [t, toUserFacingErrorMessage]);
     useEffect(() => {
         refresh();
     }, [refresh]);
@@ -125,8 +124,13 @@ export const AppPage_SecuritySettings = () => {
         const timer = setTimeout(() => setSuccessMsg(null), 5000);
         return () => clearTimeout(timer);
     }, [successMsg]);
+    // Derived, not listed. The literal `[TOTP, PASSKEY, SMS_OTP]` that stood here was the
+    // second-factor vocabulary minus the factors that need no enrollment — correct on the day it was
+    // written and silently short the day a fifth second factor is added, since a method missing from
+    // the list simply never counts as enrolled.
+    const enrollableSecondFactorMethods = AuthUtils.getEnrollableSecondFactorMethods();
     const enrolledSecondFactor = methods
-        .filter((m) => m.enrolled && [AuthMethod.TOTP, AuthMethod.PASSKEY, AuthMethod.SMS_OTP].includes(m.method))
+        .filter((m) => m.enrolled && enrollableSecondFactorMethods.includes(m.method))
         .map((m) => m.method);
     const completeness = AuthSessionUtils.evaluateAccountCompleteness(authState.identification?.requiresMFA ?? false, authState.identification?.secondFactorMethods?.map((m) => m.method) ?? [], enrolledSecondFactor.length > 0 ? enrolledSecondFactor : authState.enrolledSecondFactorMethods, resolvedAuth.userTypeAuth?.mfaPolicy?.acceptableMFAMethods ?? []);
     const hasPassword = methods.some((m) => m.method === AuthMethod.PASSWORD && m.enrolled);
@@ -165,13 +169,13 @@ export const AppPage_SecuritySettings = () => {
         catch (e) {
             if (isWildoBackendError(e))
                 throw e;
-            const msg = e?.name === 'NotAllowedError' ? t(SecuritySettingsLabel.PASSKEY_CANCELLED) : (e?.message ?? t(SecuritySettingsLabel.ERROR));
+            const msg = e?.name === 'NotAllowedError' ? t(SecuritySettingsLabel.PASSKEY_CANCELLED) : toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR));
             setError(msg);
         }
         finally {
             setPasskeyRegistering(false);
         }
-    }, [maxPasskeys, passkeys.length, refresh, t]);
+    }, [maxPasskeys, passkeys.length, refresh, t, toUserFacingErrorMessage]);
     const handlePasskeyRemove = useCallback(async (credentialId) => {
         if (!allowRemoval)
             return;
@@ -183,39 +187,19 @@ export const AppPage_SecuritySettings = () => {
         catch (e) {
             if (isWildoBackendError(e))
                 throw e;
-            setError(e?.message ?? t(SecuritySettingsLabel.ERROR));
+            setError(toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR)));
         }
-    }, [allowRemoval, refresh, t]);
+    }, [allowRemoval, refresh, t, toUserFacingErrorMessage]);
+    /*
+     * No re-authentication handling here, deliberately. Where the user type asks for it, the server
+     * answers `STEP_UP_REQUIRED` and the HTTP client answers that by itself — the shared step-up dialog
+     * (`StepUpAuthProvider`), then a replay carrying `X-Reauth-Token`. The same is true of adding a
+     * passkey, confirming TOTP and confirming a phone below. This page used to carry its own password-only
+     * copy of that dialog for this one action, and nothing for the binding actions at all.
+     */
     const handleTotpDisable = useCallback(async () => {
-        const doDisable = async (reauthToken) => {
-            const opts = reauthToken ? { headers: { 'X-Reauth-Token': reauthToken } } : undefined;
-            await getManualCallsHttpClient().mfaTOTPDisable(opts);
-            setSuccessMsg(t(SecuritySettingsLabel.SUCCESS));
-            setShowTotpEnroll(false);
-            refresh();
-        };
-        if (requireReauth) {
-            setReauthOpen(true);
-        }
-        else {
-            try {
-                await doDisable();
-            }
-            catch (e) {
-                if (isWildoBackendError(e))
-                    throw e;
-                setError(e?.message ?? t(SecuritySettingsLabel.ERROR));
-            }
-        }
-    }, [requireReauth, refresh, t]);
-    const handleReauthConfirm = useCallback(async () => {
-        if (!reauthPassword.trim())
-            return;
         try {
-            const { reAuthToken } = await getManualCallsHttpClient().reAuthenticate(AuthMethod.PASSWORD, { password: reauthPassword });
-            setReauthOpen(false);
-            setReauthPassword('');
-            await getManualCallsHttpClient().mfaTOTPDisable({ headers: { 'X-Reauth-Token': reAuthToken } });
+            await getManualCallsHttpClient().mfaTOTPDisable();
             setSuccessMsg(t(SecuritySettingsLabel.SUCCESS));
             setShowTotpEnroll(false);
             refresh();
@@ -223,9 +207,9 @@ export const AppPage_SecuritySettings = () => {
         catch (e) {
             if (isWildoBackendError(e))
                 throw e;
-            setError(e?.message ?? t(SecuritySettingsLabel.ERROR));
+            setError(toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR)));
         }
-    }, [reauthPassword, refresh, t]);
+    }, [refresh, t, toUserFacingErrorMessage]);
     const handleUnlinkIdentity = useCallback(async (linkId) => {
         if (!allowRemoval)
             return;
@@ -237,9 +221,9 @@ export const AppPage_SecuritySettings = () => {
         catch (e) {
             if (isWildoBackendError(e))
                 throw e;
-            setError(e?.message ?? t(SecuritySettingsLabel.ERROR));
+            setError(toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR)));
         }
-    }, [allowRemoval, refresh, t]);
+    }, [allowRemoval, refresh, t, toUserFacingErrorMessage]);
     if (!isReady)
         return null;
     // Passkeys are only offerable where WebAuthn exists; an unsupported browser is
@@ -255,11 +239,11 @@ export const AppPage_SecuritySettings = () => {
             case SecurityFactorState.INACTIVE: return t(SecuritySettingsLabel.STATUS_NOT_CONFIGURED);
         }
     };
-    const PasskeySection = (_jsxs(SecurityFactorCard, { icon: StandardIconReference.FINGERPRINT, title: t(SecuritySettingsLabel.SECTION_PASSKEYS), description: t(SecuritySettingsLabel.PASSKEYS_DESCRIPTION), state: passkeyState, statusLabel: statusLabelFor(passkeyState), meta: passkeysSupported && passkeys.length > 0
+    const PasskeySection = (_jsxs(SecurityFactorCard, { icon: AUTH_METHOD_ICON_REFERENCES[AuthMethod.PASSKEY], title: t(SecuritySettingsLabel.SECTION_PASSKEYS), description: t(SecuritySettingsLabel.PASSKEYS_DESCRIPTION), state: passkeyState, statusLabel: statusLabelFor(passkeyState), meta: passkeysSupported && passkeys.length > 0
             ? _jsx(Text, { className: "text-sm", children: t(SecuritySettingsLabel.PASSKEY_COUNT, { count: passkeys.length }) })
             : undefined, action: passkeysSupported && passkeys.length < maxPasskeys ? (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: handlePasskeyAdd, disabled: passkeyRegistering, children: passkeyRegistering ? t(SecuritySettingsLabel.PASSKEY_ADDING) : t(SecuritySettingsLabel.PASSKEY_ADD) })) : undefined, children: [!passkeysSupported && (_jsx(Alert, { children: _jsx(AlertDescription, { children: t(SecuritySettingsLabel.PASSKEY_UNSUPPORTED) }) })), passkeysSupported && (_jsxs(_Fragment, { children: [passkeys.length === 0 && (_jsx(Text, { className: "text-sm text-muted-foreground", children: t(SecuritySettingsLabel.PASSKEY_EMPTY) })), passkeys.length > 0 && (_jsx("ul", { className: "flex flex-col gap-element", children: passkeys.map((pk) => (_jsxs("li", { className: "flex items-center justify-between gap-item rounded-md border p-card-sm", children: [_jsxs("div", { className: "flex min-w-0 flex-col", children: [_jsx(Text, { className: "truncate font-medium", children: pk.name }), pk.createdAt && (_jsx(Text, { className: "text-xs text-muted-foreground", children: t(SecuritySettingsLabel.PASSKEY_ADDED, { date: new Date(pk.createdAt).toLocaleDateString() }) }))] }), allowRemoval && (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, size: ButtonSize.SM, onClick: () => handlePasskeyRemove(pk.credentialId), children: t(SecuritySettingsLabel.PASSKEY_REMOVE) }))] }, pk.credentialId))) }))] }))] }));
     const totpState = hasTotp ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE;
-    const TotpSection = (_jsx(SecurityFactorCard, { icon: StandardIconReference.SMARTPHONE, title: t(SecuritySettingsLabel.SECTION_TOTP), description: t(SecuritySettingsLabel.TOTP_DESCRIPTION), state: totpState, statusLabel: statusLabelFor(totpState), meta: _jsx(Text, { className: "text-sm", children: hasTotp ? t(SecuritySettingsLabel.TOTP_ENABLED) : t(SecuritySettingsLabel.TOTP_NOT_SETUP) }), action: hasTotp
+    const TotpSection = (_jsx(SecurityFactorCard, { icon: AUTH_METHOD_ICON_REFERENCES[AuthMethod.TOTP], title: t(SecuritySettingsLabel.SECTION_TOTP), description: t(SecuritySettingsLabel.TOTP_DESCRIPTION), state: totpState, statusLabel: statusLabelFor(totpState), meta: _jsx(Text, { className: "text-sm", children: hasTotp ? t(SecuritySettingsLabel.TOTP_ENABLED) : t(SecuritySettingsLabel.TOTP_NOT_SETUP) }), action: hasTotp
             ? (allowRemoval ? (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: handleTotpDisable, children: t(SecuritySettingsLabel.TOTP_DISABLE) })) : undefined)
             // While the enrolment flow is open its own controls own the row, so the
             // opener is withdrawn rather than left as a second way in.
@@ -268,7 +252,7 @@ export const AppPage_SecuritySettings = () => {
                 refresh();
             }, onError: (msg) => setError(msg), isLoading: false, t: (k) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_ENROLLMENT_REQUIRED, k) })) : null }));
     const phoneState = phoneVerified ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE;
-    const PhoneSection = (_jsx(SecurityFactorCard, { icon: StandardIconReference.MAIL, title: t(SecuritySettingsLabel.SECTION_PHONE), description: t(SecuritySettingsLabel.PHONE_DESCRIPTION), state: phoneState, statusLabel: statusLabelFor(phoneState), meta: _jsx(Text, { className: "text-sm", children: phoneVerified
+    const PhoneSection = (_jsx(SecurityFactorCard, { icon: AUTH_METHOD_ICON_REFERENCES[AuthMethod.SMS_OTP], title: t(SecuritySettingsLabel.SECTION_PHONE), description: t(SecuritySettingsLabel.PHONE_DESCRIPTION), state: phoneState, statusLabel: statusLabelFor(phoneState), meta: _jsx(Text, { className: "text-sm", children: phoneVerified
                 ? `${t(SecuritySettingsLabel.PHONE_VERIFIED)}: ${phoneMasked ?? '***'}`
                 : t(SecuritySettingsLabel.PHONE_NOT_VERIFIED) }), action: phoneVerified ? (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: () => setShowPhoneEnroll(true), children: t(SecuritySettingsLabel.PHONE_CHANGE) })) : (showPhoneEnroll ? undefined : (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: () => setShowPhoneEnroll(true), children: t(SecuritySettingsLabel.PHONE_VERIFY) }))), children: phoneVerified && !showPhoneEnroll ? null : showPhoneEnroll ? (_jsx(PhoneEnrollmentMethod, { onComplete: () => {
                 setShowPhoneEnroll(false);
@@ -291,12 +275,10 @@ export const AppPage_SecuritySettings = () => {
     return (_jsxs("div", { className: "flex flex-col gap-section", children: [_jsxs("div", { className: "flex flex-col gap-item-xs", children: [_jsx("h3", { className: "text-base font-semibold tracking-tight", children: t(SecuritySettingsLabel.PAGE_TITLE) }), _jsx(Text, { className: "text-sm text-muted-foreground", children: t(SecuritySettingsLabel.PAGE_DESCRIPTION) })] }), error && (_jsx(Alert, { variant: "destructive", children: _jsx(AlertDescription, { children: error }) })), successMsg && (_jsx(Alert, { children: _jsx(AlertDescription, { children: successMsg }) })), loading ? (_jsx(Text, { className: "text-muted-foreground", children: t(SecuritySettingsLabel.LOADING) })) : (_jsxs("div", { className: "flex flex-col gap-item", children: [PasskeySection, TotpSection, PhoneSection, _jsx(PasswordSection, { hasPassword: hasPassword, passwordPolicy: passwordPolicy, userEmail: user?.email, t: t, tPolicy: tPolicy, onSuccess: () => {
                             setSuccessMsg(t(SecuritySettingsLabel.SUCCESS));
                             refresh();
-                        }, onError: (msg) => setError(msg) }), _jsx(IdentityLinksSection, { links: resolvedIdentityLinks, allowRemoval: allowRemoval, t: t, onUnlink: handleUnlinkIdentity })] })), _jsx(OperationsConfirmCritical, { open: reauthOpen, onOpenChange: setReauthOpen, cancelCallback: () => {
-                    setReauthOpen(false);
-                    setReauthPassword('');
-                }, validationCallback: handleReauthConfirm, label: t(SecuritySettingsLabel.REAUTH_TITLE), children: _jsxs("div", { className: "space-y-4 py-4", children: [_jsx(Text, { className: "text-sm", children: t(SecuritySettingsLabel.REAUTH_DESCRIPTION) }), _jsxs(Field, { children: [_jsx(FieldLabel, { children: t(SecuritySettingsLabel.REAUTH_PASSWORD) }), _jsx(InputRoot, { type: "password", autoComplete: "current-password", value: reauthPassword, onChange: (e) => setReauthPassword(e.target.value), placeholder: t(SecuritySettingsLabel.REAUTH_PASSWORD_PLACEHOLDER) })] })] }) })] }));
+                        }, onError: (msg) => setError(msg) }), _jsx(IdentityLinksSection, { links: resolvedIdentityLinks, allowRemoval: allowRemoval, t: t, onUnlink: handleUnlinkIdentity })] }))] }));
 };
 const PasswordSection = ({ hasPassword, passwordPolicy, userEmail, t, tPolicy, onSuccess, onError }) => {
+    const toUserFacingErrorMessage = useUserFacingErrorMessage();
     const [submitting, setSubmitting] = useState(false);
     // The credential form is a DISCLOSURE, not the row's resting state. Rendered
     // eagerly it was four inputs plus a strength meter permanently open beneath a
@@ -325,12 +307,12 @@ const PasswordSection = ({ hasPassword, passwordPolicy, userEmail, t, tPolicy, o
         catch (e) {
             if (isWildoBackendError(e))
                 throw e;
-            onError(e?.message ?? t(SecuritySettingsLabel.ERROR));
+            onError(toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR)));
         }
         finally {
             setSubmitting(false);
         }
-    }, [changeForm, onError, onSuccess, t]);
+    }, [changeForm, onError, onSuccess, t, toUserFacingErrorMessage]);
     const handleSet = useCallback(async (data) => {
         if (data.newPassword !== data.confirmPassword) {
             onError(t(SecuritySettingsLabel.PASSWORD_MISMATCH));
@@ -346,20 +328,20 @@ const PasswordSection = ({ hasPassword, passwordPolicy, userEmail, t, tPolicy, o
         catch (e) {
             if (isWildoBackendError(e))
                 throw e;
-            onError(e?.message ?? t(SecuritySettingsLabel.ERROR));
+            onError(toUserFacingErrorMessage(e, t(SecuritySettingsLabel.ERROR)));
         }
         finally {
             setSubmitting(false);
         }
-    }, [onError, onSuccess, setForm, t]);
+    }, [onError, onSuccess, setForm, t, toUserFacingErrorMessage]);
     const state = hasPassword ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE;
-    return (_jsx(SecurityFactorCard, { icon: StandardIconReference.KEY, title: t(SecuritySettingsLabel.SECTION_PASSWORD), description: t(SecuritySettingsLabel.PASSWORD_DESCRIPTION), state: state, statusLabel: t(hasPassword ? SecuritySettingsLabel.STATUS_ACTIVE : SecuritySettingsLabel.STATUS_NOT_CONFIGURED), meta: _jsx(Text, { className: "text-sm", children: t(hasPassword ? SecuritySettingsLabel.PASSWORD_SET_STATUS : SecuritySettingsLabel.PASSWORD_NOT_SET_STATUS) }), action: editing ? (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: () => {
+    return (_jsx(SecurityFactorCard, { icon: AUTH_METHOD_ICON_REFERENCES[AuthMethod.PASSWORD], title: t(SecuritySettingsLabel.SECTION_PASSWORD), description: t(SecuritySettingsLabel.PASSWORD_DESCRIPTION), state: state, statusLabel: t(hasPassword ? SecuritySettingsLabel.STATUS_ACTIVE : SecuritySettingsLabel.STATUS_NOT_CONFIGURED), meta: _jsx(Text, { className: "text-sm", children: t(hasPassword ? SecuritySettingsLabel.PASSWORD_SET_STATUS : SecuritySettingsLabel.PASSWORD_NOT_SET_STATUS) }), action: editing ? (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: () => {
                 setEditing(false);
                 changeForm.reset();
                 setForm.reset();
             }, children: t(SecuritySettingsLabel.CANCEL) })) : (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: () => setEditing(true), children: t(hasPassword ? SecuritySettingsLabel.PASSWORD_CHANGE : SecuritySettingsLabel.PASSWORD_SET) })), children: !editing ? null : hasPassword ? (_jsx(FormProvider, { ...changeForm, children: _jsxs("form", { onSubmit: changeForm.handleSubmit(handleChange), className: "space-y-4", children: [_jsx(CredentialUsernameAutofillField, { email: userEmail }), _jsxs(Field, { children: [_jsx(FieldLabel, { children: t(SecuritySettingsLabel.PASSWORD_CURRENT) }), _jsx(InputRoot, { type: "password", autoComplete: "current-password", ...changeForm.register('currentPassword', { required: true }) })] }), _jsxs(Field, { children: [_jsx(FieldLabel, { children: t(SecuritySettingsLabel.PASSWORD_NEW) }), _jsx(InputRoot, { type: "password", autoComplete: "new-password", ...changeForm.register('newPassword', { required: true }) }), _jsx(PasswordStrengthIndicator, { fieldName: "newPassword", policy: passwordPolicy, t: tPolicy })] }), _jsxs(Field, { children: [_jsx(FieldLabel, { children: t(SecuritySettingsLabel.PASSWORD_CONFIRM) }), _jsx(InputRoot, { type: "password", autoComplete: "new-password", ...changeForm.register('confirmPassword', { required: true }) })] }), _jsx(Button, { type: "submit", disabled: submitting, children: t(SecuritySettingsLabel.PASSWORD_CHANGE) })] }) })) : (_jsx(FormProvider, { ...setForm, children: _jsxs("form", { onSubmit: setForm.handleSubmit(handleSet), className: "space-y-4", children: [_jsx(CredentialUsernameAutofillField, { email: userEmail }), _jsxs(Field, { children: [_jsx(FieldLabel, { children: t(SecuritySettingsLabel.PASSWORD_NEW) }), _jsx(InputRoot, { type: "password", autoComplete: "new-password", ...setForm.register('newPassword', { required: true }) }), _jsx(PasswordStrengthIndicator, { fieldName: "newPassword", policy: passwordPolicy, t: tPolicy })] }), _jsxs(Field, { children: [_jsx(FieldLabel, { children: t(SecuritySettingsLabel.PASSWORD_CONFIRM) }), _jsx(InputRoot, { type: "password", autoComplete: "new-password", ...setForm.register('confirmPassword', { required: true }) })] }), _jsx(Button, { type: "submit", disabled: submitting, children: t(SecuritySettingsLabel.PASSWORD_SET) })] }) })) }));
 };
-const IdentityLinksSection = ({ links, allowRemoval, t, onUnlink }) => (_jsx(SecurityFactorCard, { icon: StandardIconReference.LINK, title: t(SecuritySettingsLabel.SECTION_IDENTITY_LINKS), description: t(SecuritySettingsLabel.IDENTITY_LINKS_DESCRIPTION), state: links.length > 0 ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE, statusLabel: t(links.length > 0 ? SecuritySettingsLabel.STATUS_ACTIVE : SecuritySettingsLabel.STATUS_NOT_CONFIGURED), meta: links.length > 0
+const IdentityLinksSection = ({ links, allowRemoval, t, onUnlink }) => (_jsx(SecurityFactorCard, { icon: AUTH_METHOD_ICON_REFERENCES[AuthMethod.EXTERNAL_OAUTH2], title: t(SecuritySettingsLabel.SECTION_IDENTITY_LINKS), description: t(SecuritySettingsLabel.IDENTITY_LINKS_DESCRIPTION), state: links.length > 0 ? SecurityFactorState.ACTIVE : SecurityFactorState.INACTIVE, statusLabel: t(links.length > 0 ? SecuritySettingsLabel.STATUS_ACTIVE : SecuritySettingsLabel.STATUS_NOT_CONFIGURED), meta: links.length > 0
         ? _jsx(Text, { className: "text-sm", children: t(SecuritySettingsLabel.IDENTITY_LINKS_COUNT, { count: links.length }) })
         : undefined, children: links.length === 0 ? (_jsx(Text, { className: "text-sm text-muted-foreground", children: t(SecuritySettingsLabel.IDENTITY_LINKS_EMPTY) })) : (_jsx("ul", { className: "flex flex-col gap-element", children: links.map((link) => (_jsxs("li", { className: "flex items-center justify-between gap-item rounded-md border p-card-sm", children: [_jsxs("div", { className: "flex min-w-0 flex-col", children: [_jsx(Text, { className: "truncate font-medium", children: link.providerLabel }), _jsx(Text, { className: "truncate text-xs text-muted-foreground", children: link.providerEmail })] }), allowRemoval && (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, size: ButtonSize.SM, onClick: () => onUnlink(link._id), children: t(SecuritySettingsLabel.IDENTITY_LINKS_UNLINK) }))] }, link._id))) })) }));
 //# sourceMappingURL=AppPage_SecuritySettings.js.map