@wildo-ai/saas-frontend-lib 1.1.3 → 1.1.5

package/dist/esm/core/security/StepUpAuthContext.js

@@ -10,28 +10,40 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
  * On success, the interceptor retries the original request with the new X-Reauth-Token header.
  */
 import { createContext, useCallback, useEffect, useMemo, useRef, useState } from 'react';
-import { AuthMethod } from '@wildo-ai/saas-models';
+import { AuthMethod, ReAuthenticationPurpose } from '@wildo-ai/saas-models';
 import { getManualCallsHttpClient } from '../../core/requests/wildo-http-client-manual-calls.frontend.service.js';
 import { useResourceRegistry } from '../../core/resources/useResourceRegistry.js';
+import { startAuthentication } from '@simplewebauthn/browser';
 import { StepUpAuthDialog } from '../../components/auth/StepUpAuthDialog.js';
+import { obtainFederatedReAuthenticationToken } from '../../core/security/federated-reauthentication.frontend.js';
 export const StepUpAuthContext = createContext(undefined);
 export const StepUpAuthProvider = ({ children }) => {
     const { setStepUpAuthHandler: setResourcesStepUpAuthHandler } = useResourceRegistry();
     const [isDialogOpen, setIsDialogOpen] = useState(false);
-    const [error, setError] = useState(null);
+    // The caught failure ITSELF, not text: the dialog resolves it into words through the i18n context, and
+    // a string made here could only have been the error's own `message` — for a backend error, its i18n key.
+    const [failure, setFailure] = useState(null);
     const [isLoading, setIsLoading] = useState(false);
+    // Which proof the pending refusal asked for (#1417): it decides what the dialog offers and what is minted.
+    const [purpose, setPurpose] = useState(ReAuthenticationPurpose.STEP_UP);
     const pendingResolveRef = useRef(null);
     const pendingRejectRef = useRef(null);
     const stepUpInFlightRef = useRef(null);
-    const stepUpAuthHandler = useCallback(() => {
-        // Deduplicate: if a step-up is already in flight, share the same promise
+    const abortRef = useRef(null);
+    const stepUpAuthHandler = useCallback((requestedPurpose) => {
+        // Deduplicate: if a step-up is already in flight, share the same promise. A STEP-UP refusal joining a
+        // pending BINDING prompt upgrades it: a step-up proof opens binding doors too, while a binding proof
+        // opens no step-up door, so the one shared proof must be the stronger kind (#1417).
         if (stepUpInFlightRef.current) {
+            if (requestedPurpose === ReAuthenticationPurpose.STEP_UP)
+                setPurpose(ReAuthenticationPurpose.STEP_UP);
             return stepUpInFlightRef.current;
         }
+        setPurpose(requestedPurpose);
         const promise = new Promise((resolve, reject) => {
             pendingResolveRef.current = resolve;
             pendingRejectRef.current = reject;
-            setError(null);
+            setFailure(null);
             setIsLoading(false);
             setIsDialogOpen(true);
         });
@@ -54,25 +66,34 @@ export const StepUpAuthProvider = ({ children }) => {
             pendingRejectRef.current = null;
         };
     }, [stepUpAuthHandler]);
-    const handleConfirm = useCallback(async (password) => {
+    const handleConfirm = useCallback(async (proof) => {
         setIsLoading(true);
-        setError(null);
+        setFailure(null);
+        // The dialog's Cancel ends a federated wait early (#1441); nothing else can, see
+        // `federated-reauthentication.frontend.ts`.
+        const abort = new AbortController();
+        abortRef.current = abort;
         try {
-            const { reAuthToken } = await getManualCallsHttpClient().reAuthenticate(AuthMethod.PASSWORD, { password });
+            const { reAuthToken } = await obtainStepUpToken(proof, purpose, abort.signal);
             setIsDialogOpen(false);
             pendingResolveRef.current?.(reAuthToken);
             pendingResolveRef.current = null;
             pendingRejectRef.current = null;
         }
         catch (e) {
-            const message = e instanceof Error ? e.message : 'Authentication failed';
-            setError(message);
+            // A cancelled attempt's failure is not shown: the dialog is already closed, and would open next
+            // time with it.
+            if (!abort.signal.aborted)
+                setFailure(e);
         }
         finally {
+            if (abortRef.current === abort)
+                abortRef.current = null;
             setIsLoading(false);
         }
-    }, []);
+    }, [purpose]);
     const handleCancel = useCallback(() => {
+        abortRef.current?.abort();
         setIsDialogOpen(false);
         pendingRejectRef.current?.(new Error('Step-up authentication cancelled'));
         pendingResolveRef.current = null;
@@ -81,6 +102,31 @@ export const StepUpAuthProvider = ({ children }) => {
     const value = useMemo(() => ({
         isStepUpPending: isDialogOpen,
     }), [isDialogOpen]);
-    return (_jsxs(StepUpAuthContext.Provider, { value: value, children: [children, _jsx(StepUpAuthDialog, { open: isDialogOpen, onConfirm: handleConfirm, onCancel: handleCancel, error: error, isLoading: isLoading })] }));
+    return (_jsxs(StepUpAuthContext.Provider, { value: value, children: [children, _jsx(StepUpAuthDialog, { open: isDialogOpen, purpose: purpose, onConfirm: handleConfirm, onCancel: handleCancel, failure: failure, isLoading: isLoading })] }));
 };
+/**
+ * Turn what the person supplied into a single-use step-up token.
+ *
+ * A passkey takes two round trips because WebAuthn is challenge-response: fetch the server's
+ * challenge, have the authenticator sign it, then present the assertion. Password and TOTP are one. A
+ * linked identity runs its provider in a popup and redeems the code it returns (#1441).
+ */
+export async function obtainStepUpToken(proof, purpose = ReAuthenticationPurpose.STEP_UP, signal) {
+    const client = getManualCallsHttpClient();
+    switch (proof.method) {
+        case AuthMethod.PASSWORD:
+            return client.reAuthenticate(AuthMethod.PASSWORD, { password: proof.password }, purpose);
+        case AuthMethod.TOTP:
+            return client.reAuthenticate(AuthMethod.TOTP, { code: proof.code }, purpose);
+        case AuthMethod.PASSKEY: {
+            const options = (await client.reAuthPasskeyOptions());
+            const assertion = await startAuthentication({ optionsJSON: options });
+            return client.reAuthenticate(AuthMethod.PASSKEY, { passkeyResponse: assertion }, purpose);
+        }
+        case AuthMethod.EXTERNAL_OAUTH2:
+        case AuthMethod.ORG_OPENID_CONNECT:
+        case AuthMethod.ORG_SAML:
+            return obtainFederatedReAuthenticationToken(proof.identityLinkId, purpose, proof.popup, signal);
+    }
+}
 //# sourceMappingURL=StepUpAuthContext.js.map

package/dist/esm/core/security/StepUpAuthContext.js.map

@@ -1 +1 @@
-{"version":3,"file":"StepUpAuthContext.js","sourceRoot":"","sources":["../../../../src/core/security/StepUpAuthContext.tsx"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;AAEH,OAAc,EAAE,aAAa,EAAa,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAC3G,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAC7H,OAAO,EAAE,mBAAmB,EAAE,MAAM,wDAAwD,CAAC;AAC7F,OAAO,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAMxF,MAAM,CAAC,MAAM,iBAAiB,GAAqD,aAAa,CAAoC,SAAS,CAAC,CAAC;AAE/I,MAAM,CAAC,MAAM,kBAAkB,GAAsC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;IACpF,MAAM,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,GAAG,mBAAmB,EAAE,CAAC;IACtF,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAElD,MAAM,iBAAiB,GAAG,MAAM,CAAmC,IAAI,CAAC,CAAC;IACzE,MAAM,gBAAgB,GAAG,MAAM,CAAmC,IAAI,CAAC,CAAC;IACxE,MAAM,iBAAiB,GAAG,MAAM,CAAyB,IAAI,CAAC,CAAC;IAE/D,MAAM,iBAAiB,GAAG,WAAW,CAAC,GAAoB,EAAE;QAC1D,yEAAyE;QACzE,IAAI,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC9B,OAAO,iBAAiB,CAAC,OAAO,CAAC;QACnC,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACtD,iBAAiB,CAAC,OAAO,GAAG,OAAO,CAAC;YACpC,gBAAgB,CAAC,OAAO,GAAG,MAAM,CAAC;YAClC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,eAAe,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;QACH,iBAAiB,CAAC,OAAO,GAAG,OAAO,CAAC;QACpC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,OAAO,OAAO,CAAC;IACjB,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,sBAAsB,GAAG,MAAM,CAAC,6BAA6B,CAAC,CAAC;IACrE,SAAS,CAAC,GAAG,EAAE;QACb,sBAAsB,CAAC,OAAO,GAAG,6BAA6B,CAAC;IACjE,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC,CAAC;IAEpC,SAAS,CAAC,GAAG,EAAE;QACb,wBAAwB,EAAE,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;QACnE,sBAAsB,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAClD,OAAO,GAAG,EAAE;YACV,wBAAwB,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;YACtD,sBAAsB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,gBAAgB,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;YACtE,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;YACjC,gBAAgB,CAAC,OAAO,GAAG,IAAI,CAAC;QAClC,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAExB,MAAM,aAAa,GAAG,WAAW,CAAC,KAAK,EAAE,QAAgB,EAAE,EAAE;QAC3D,YAAY,CAAC,IAAI,CAAC,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,CAAC;YACH,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,wBAAwB,EAAE,CAAC,cAAc,CACrE,UAAU,CAAC,QAAQ,EACnB,EAAE,QAAQ,EAAE,CACb,CAAC;YACF,eAAe,CAAC,KAAK,CAAC,CAAC;YACvB,iBAAiB,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC;YACzC,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;YACjC,gBAAgB,CAAC,OAAO,GAAG,IAAI,CAAC;QAClC,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC;YACzE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACpB,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;QACpC,eAAe,CAAC,KAAK,CAAC,CAAC;QACvB,gBAAgB,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC;QAC1E,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;QACjC,gBAAgB,CAAC,OAAO,GAAG,IAAI,CAAC;IAClC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,KAAK,GAAG,OAAO,CAAwB,GAAG,EAAE,CAAC,CAAC;QAClD,eAAe,EAAE,YAAY;KAC9B,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAEpB,OAAO,CACL,MAAC,iBAAiB,CAAC,QAAQ,IAAC,KAAK,EAAE,KAAK,aACrC,QAAQ,EACT,KAAC,gBAAgB,IACf,IAAI,EAAE,YAAY,EAClB,SAAS,EAAE,aAAa,EACxB,QAAQ,EAAE,YAAY,EACtB,KAAK,EAAE,KAAK,EACZ,SAAS,EAAE,SAAS,GACpB,IACyB,CAC9B,CAAC;AACJ,CAAC,CAAC","sourcesContent":["/**\n * StepUpAuthContext\n *\n * Manages the step-up re-authentication flow triggered by HTTP 403 STEP_UP_REQUIRED responses.\n *\n * The provider registers a handler on both HTTP clients (manual calls + resources).\n * When the backend rejects a request because the user's last authentication is stale,\n * the HTTP interceptor calls the handler, which opens a dialog for re-authentication.\n * On success, the interceptor retries the original request with the new X-Reauth-Token header.\n */\n\nimport React, { createContext, ReactNode, useCallback, useEffect, useMemo, useRef, useState } from 'react';\nimport { AuthMethod } from '@wildo-ai/saas-models';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport { useResourceRegistry } from '~wildo-frontend-lib/core/resources/useResourceRegistry';\nimport { StepUpAuthDialog } from '~wildo-frontend-lib/components/auth/StepUpAuthDialog';\n\nexport interface StepUpAuthContextType {\n  isStepUpPending: boolean;\n}\n\nexport const StepUpAuthContext: React.Context<StepUpAuthContextType | undefined> = createContext<StepUpAuthContextType | undefined>(undefined);\n\nexport const StepUpAuthProvider: React.FC<{ children: ReactNode }> = ({ children }) => {\n  const { setStepUpAuthHandler: setResourcesStepUpAuthHandler } = useResourceRegistry();\n  const [isDialogOpen, setIsDialogOpen] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n  const [isLoading, setIsLoading] = useState(false);\n\n  const pendingResolveRef = useRef<((token: string) => void) | null>(null);\n  const pendingRejectRef = useRef<((reason: Error) => void) | null>(null);\n  const stepUpInFlightRef = useRef<Promise<string> | null>(null);\n\n  const stepUpAuthHandler = useCallback((): Promise<string> => {\n    // Deduplicate: if a step-up is already in flight, share the same promise\n    if (stepUpInFlightRef.current) {\n      return stepUpInFlightRef.current;\n    }\n    const promise = new Promise<string>((resolve, reject) => {\n      pendingResolveRef.current = resolve;\n      pendingRejectRef.current = reject;\n      setError(null);\n      setIsLoading(false);\n      setIsDialogOpen(true);\n    });\n    stepUpInFlightRef.current = promise;\n    promise.finally(() => { stepUpInFlightRef.current = null; });\n    return promise;\n  }, []);\n\n  const setResourcesHandlerRef = useRef(setResourcesStepUpAuthHandler);\n  useEffect(() => {\n    setResourcesHandlerRef.current = setResourcesStepUpAuthHandler;\n  }, [setResourcesStepUpAuthHandler]);\n\n  useEffect(() => {\n    getManualCallsHttpClient().setStepUpAuthHandler(stepUpAuthHandler);\n    setResourcesHandlerRef.current(stepUpAuthHandler);\n    return () => {\n      getManualCallsHttpClient().setStepUpAuthHandler(null);\n      setResourcesHandlerRef.current(null);\n      pendingRejectRef.current?.(new Error('StepUpAuthProvider unmounted'));\n      pendingResolveRef.current = null;\n      pendingRejectRef.current = null;\n    };\n  }, [stepUpAuthHandler]);\n\n  const handleConfirm = useCallback(async (password: string) => {\n    setIsLoading(true);\n    setError(null);\n    try {\n      const { reAuthToken } = await getManualCallsHttpClient().reAuthenticate(\n        AuthMethod.PASSWORD,\n        { password }\n      );\n      setIsDialogOpen(false);\n      pendingResolveRef.current?.(reAuthToken);\n      pendingResolveRef.current = null;\n      pendingRejectRef.current = null;\n    } catch (e: unknown) {\n      const message = e instanceof Error ? e.message : 'Authentication failed';\n      setError(message);\n    } finally {\n      setIsLoading(false);\n    }\n  }, []);\n\n  const handleCancel = useCallback(() => {\n    setIsDialogOpen(false);\n    pendingRejectRef.current?.(new Error('Step-up authentication cancelled'));\n    pendingResolveRef.current = null;\n    pendingRejectRef.current = null;\n  }, []);\n\n  const value = useMemo<StepUpAuthContextType>(() => ({\n    isStepUpPending: isDialogOpen,\n  }), [isDialogOpen]);\n\n  return (\n    <StepUpAuthContext.Provider value={value}>\n      {children}\n      <StepUpAuthDialog\n        open={isDialogOpen}\n        onConfirm={handleConfirm}\n        onCancel={handleCancel}\n        error={error}\n        isLoading={isLoading}\n      />\n    </StepUpAuthContext.Provider>\n  );\n};\n"]}
+{"version":3,"file":"StepUpAuthContext.js","sourceRoot":"","sources":["../../../../../src/core/security/StepUpAuthContext.tsx"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;AAEH,OAAc,EAAE,aAAa,EAAa,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAC3G,OAAO,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAC5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAC7H,OAAO,EAAE,mBAAmB,EAAE,MAAM,wDAAwD,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,OAAO,EAAE,gBAAgB,EAAoB,MAAM,sDAAsD,CAAC;AAC1G,OAAO,EAAE,oCAAoC,EAAE,MAAM,uEAAuE,CAAC;AAM7H,MAAM,CAAC,MAAM,iBAAiB,GAAqD,aAAa,CAAoC,SAAS,CAAC,CAAC;AAE/I,MAAM,CAAC,MAAM,kBAAkB,GAAsC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;IACpF,MAAM,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,GAAG,mBAAmB,EAAE,CAAC;IACtF,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxD,uGAAuG;IACvG,yGAAyG;IACzG,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAU,IAAI,CAAC,CAAC;IACtD,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClD,2GAA2G;IAC3G,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAA0B,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAEjG,MAAM,iBAAiB,GAAG,MAAM,CAAmC,IAAI,CAAC,CAAC;IACzE,MAAM,gBAAgB,GAAG,MAAM,CAAmC,IAAI,CAAC,CAAC;IACxE,MAAM,iBAAiB,GAAG,MAAM,CAAyB,IAAI,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,MAAM,CAAyB,IAAI,CAAC,CAAC;IAEtD,MAAM,iBAAiB,GAAG,WAAW,CAAC,CAAC,gBAAyC,EAAmB,EAAE;QACnG,sGAAsG;QACtG,qGAAqG;QACrG,oFAAoF;QACpF,IAAI,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,gBAAgB,KAAK,uBAAuB,CAAC,OAAO;gBAAE,UAAU,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;YACtG,OAAO,iBAAiB,CAAC,OAAO,CAAC;QACnC,CAAC;QACD,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACtD,iBAAiB,CAAC,OAAO,GAAG,OAAO,CAAC;YACpC,gBAAgB,CAAC,OAAO,GAAG,MAAM,CAAC;YAClC,UAAU,CAAC,IAAI,CAAC,CAAC;YACjB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,eAAe,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;QACH,iBAAiB,CAAC,OAAO,GAAG,OAAO,CAAC;QACpC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,OAAO,OAAO,CAAC;IACjB,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,sBAAsB,GAAG,MAAM,CAAC,6BAA6B,CAAC,CAAC;IACrE,SAAS,CAAC,GAAG,EAAE;QACb,sBAAsB,CAAC,OAAO,GAAG,6BAA6B,CAAC;IACjE,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC,CAAC;IAEpC,SAAS,CAAC,GAAG,EAAE;QACb,wBAAwB,EAAE,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;QACnE,sBAAsB,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAClD,OAAO,GAAG,EAAE;YACV,wBAAwB,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;YACtD,sBAAsB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,gBAAgB,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;YACtE,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;YACjC,gBAAgB,CAAC,OAAO,GAAG,IAAI,CAAC;QAClC,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAExB,MAAM,aAAa,GAAG,WAAW,CAAC,KAAK,EAAE,KAAkB,EAAE,EAAE;QAC7D,YAAY,CAAC,IAAI,CAAC,CAAC;QACnB,UAAU,CAAC,IAAI,CAAC,CAAC;QACjB,iFAAiF;QACjF,4CAA4C;QAC5C,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,QAAQ,CAAC,OAAO,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC9E,eAAe,CAAC,KAAK,CAAC,CAAC;YACvB,iBAAiB,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC;YACzC,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;YACjC,gBAAgB,CAAC,OAAO,GAAG,IAAI,CAAC;QAClC,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,gGAAgG;YAChG,gBAAgB;YAChB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO;gBAAE,UAAU,CAAC,CAAC,CAAC,CAAC;QAC3C,CAAC;gBAAS,CAAC;YACT,IAAI,QAAQ,CAAC,OAAO,KAAK,KAAK;gBAAE,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC;YACxD,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEd,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;QACpC,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;QAC1B,eAAe,CAAC,KAAK,CAAC,CAAC;QACvB,gBAAgB,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC;QAC1E,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;QACjC,gBAAgB,CAAC,OAAO,GAAG,IAAI,CAAC;IAClC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,KAAK,GAAG,OAAO,CAAwB,GAAG,EAAE,CAAC,CAAC;QAClD,eAAe,EAAE,YAAY;KAC9B,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAEpB,OAAO,CACL,MAAC,iBAAiB,CAAC,QAAQ,IAAC,KAAK,EAAE,KAAK,aACrC,QAAQ,EACT,KAAC,gBAAgB,IACf,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,aAAa,EACxB,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,SAAS,GACpB,IACyB,CAC9B,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAkB,EAClB,UAAmC,uBAAuB,CAAC,OAAO,EAClE,MAAoB;IAEpB,MAAM,MAAM,GAAG,wBAAwB,EAAE,CAAC;IAC1C,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;QACrB,KAAK,UAAU,CAAC,QAAQ;YACtB,OAAO,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;QAC3F,KAAK,UAAU,CAAC,IAAI;YAClB,OAAO,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/E,KAAK,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;YACxB,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,oBAAoB,EAAE,CAAqD,CAAC;YAC1G,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;YACtE,OAAO,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,eAAe,EAAE,SAA+C,EAAE,EAAE,OAAO,CAAC,CAAC;QAClI,CAAC;QACD,KAAK,UAAU,CAAC,eAAe,CAAC;QAChC,KAAK,UAAU,CAAC,kBAAkB,CAAC;QACnC,KAAK,UAAU,CAAC,QAAQ;YACtB,OAAO,oCAAoC,CAAC,KAAK,CAAC,cAAc,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACpG,CAAC;AACH,CAAC","sourcesContent":["/**\n * StepUpAuthContext\n *\n * Manages the step-up re-authentication flow triggered by HTTP 403 STEP_UP_REQUIRED responses.\n *\n * The provider registers a handler on both HTTP clients (manual calls + resources).\n * When the backend rejects a request because the user's last authentication is stale,\n * the HTTP interceptor calls the handler, which opens a dialog for re-authentication.\n * On success, the interceptor retries the original request with the new X-Reauth-Token header.\n */\n\nimport React, { createContext, ReactNode, useCallback, useEffect, useMemo, useRef, useState } from 'react';\nimport { AuthMethod, ReAuthenticationPurpose } from '@wildo-ai/saas-models';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport { useResourceRegistry } from '~wildo-frontend-lib/core/resources/useResourceRegistry';\nimport { startAuthentication } from '@simplewebauthn/browser';\nimport type { PublicKeyCredentialRequestOptionsJSON } from '@simplewebauthn/browser';\nimport { StepUpAuthDialog, type StepUpProof } from '~wildo-frontend-lib/components/auth/StepUpAuthDialog';\nimport { obtainFederatedReAuthenticationToken } from '~wildo-frontend-lib/core/security/federated-reauthentication.frontend';\n\nexport interface StepUpAuthContextType {\n  isStepUpPending: boolean;\n}\n\nexport const StepUpAuthContext: React.Context<StepUpAuthContextType | undefined> = createContext<StepUpAuthContextType | undefined>(undefined);\n\nexport const StepUpAuthProvider: React.FC<{ children: ReactNode }> = ({ children }) => {\n  const { setStepUpAuthHandler: setResourcesStepUpAuthHandler } = useResourceRegistry();\n  const [isDialogOpen, setIsDialogOpen] = useState(false);\n  // The caught failure ITSELF, not text: the dialog resolves it into words through the i18n context, and\n  // a string made here could only have been the error's own `message` — for a backend error, its i18n key.\n  const [failure, setFailure] = useState<unknown>(null);\n  const [isLoading, setIsLoading] = useState(false);\n  // Which proof the pending refusal asked for (#1417): it decides what the dialog offers and what is minted.\n  const [purpose, setPurpose] = useState<ReAuthenticationPurpose>(ReAuthenticationPurpose.STEP_UP);\n\n  const pendingResolveRef = useRef<((token: string) => void) | null>(null);\n  const pendingRejectRef = useRef<((reason: Error) => void) | null>(null);\n  const stepUpInFlightRef = useRef<Promise<string> | null>(null);\n  const abortRef = useRef<AbortController | null>(null);\n\n  const stepUpAuthHandler = useCallback((requestedPurpose: ReAuthenticationPurpose): Promise<string> => {\n    // Deduplicate: if a step-up is already in flight, share the same promise. A STEP-UP refusal joining a\n    // pending BINDING prompt upgrades it: a step-up proof opens binding doors too, while a binding proof\n    // opens no step-up door, so the one shared proof must be the stronger kind (#1417).\n    if (stepUpInFlightRef.current) {\n      if (requestedPurpose === ReAuthenticationPurpose.STEP_UP) setPurpose(ReAuthenticationPurpose.STEP_UP);\n      return stepUpInFlightRef.current;\n    }\n    setPurpose(requestedPurpose);\n    const promise = new Promise<string>((resolve, reject) => {\n      pendingResolveRef.current = resolve;\n      pendingRejectRef.current = reject;\n      setFailure(null);\n      setIsLoading(false);\n      setIsDialogOpen(true);\n    });\n    stepUpInFlightRef.current = promise;\n    promise.finally(() => { stepUpInFlightRef.current = null; });\n    return promise;\n  }, []);\n\n  const setResourcesHandlerRef = useRef(setResourcesStepUpAuthHandler);\n  useEffect(() => {\n    setResourcesHandlerRef.current = setResourcesStepUpAuthHandler;\n  }, [setResourcesStepUpAuthHandler]);\n\n  useEffect(() => {\n    getManualCallsHttpClient().setStepUpAuthHandler(stepUpAuthHandler);\n    setResourcesHandlerRef.current(stepUpAuthHandler);\n    return () => {\n      getManualCallsHttpClient().setStepUpAuthHandler(null);\n      setResourcesHandlerRef.current(null);\n      pendingRejectRef.current?.(new Error('StepUpAuthProvider unmounted'));\n      pendingResolveRef.current = null;\n      pendingRejectRef.current = null;\n    };\n  }, [stepUpAuthHandler]);\n\n  const handleConfirm = useCallback(async (proof: StepUpProof) => {\n    setIsLoading(true);\n    setFailure(null);\n    // The dialog's Cancel ends a federated wait early (#1441); nothing else can, see\n    // `federated-reauthentication.frontend.ts`.\n    const abort = new AbortController();\n    abortRef.current = abort;\n    try {\n      const { reAuthToken } = await obtainStepUpToken(proof, purpose, abort.signal);\n      setIsDialogOpen(false);\n      pendingResolveRef.current?.(reAuthToken);\n      pendingResolveRef.current = null;\n      pendingRejectRef.current = null;\n    } catch (e: unknown) {\n      // A cancelled attempt's failure is not shown: the dialog is already closed, and would open next\n      // time with it.\n      if (!abort.signal.aborted) setFailure(e);\n    } finally {\n      if (abortRef.current === abort) abortRef.current = null;\n      setIsLoading(false);\n    }\n  }, [purpose]);\n\n  const handleCancel = useCallback(() => {\n    abortRef.current?.abort();\n    setIsDialogOpen(false);\n    pendingRejectRef.current?.(new Error('Step-up authentication cancelled'));\n    pendingResolveRef.current = null;\n    pendingRejectRef.current = null;\n  }, []);\n\n  const value = useMemo<StepUpAuthContextType>(() => ({\n    isStepUpPending: isDialogOpen,\n  }), [isDialogOpen]);\n\n  return (\n    <StepUpAuthContext.Provider value={value}>\n      {children}\n      <StepUpAuthDialog\n        open={isDialogOpen}\n        purpose={purpose}\n        onConfirm={handleConfirm}\n        onCancel={handleCancel}\n        failure={failure}\n        isLoading={isLoading}\n      />\n    </StepUpAuthContext.Provider>\n  );\n};\n\n/**\n * Turn what the person supplied into a single-use step-up token.\n *\n * A passkey takes two round trips because WebAuthn is challenge-response: fetch the server's\n * challenge, have the authenticator sign it, then present the assertion. Password and TOTP are one. A\n * linked identity runs its provider in a popup and redeems the code it returns (#1441).\n */\nexport async function obtainStepUpToken(\n  proof: StepUpProof,\n  purpose: ReAuthenticationPurpose = ReAuthenticationPurpose.STEP_UP,\n  signal?: AbortSignal,\n): Promise<{ reAuthToken: string }> {\n  const client = getManualCallsHttpClient();\n  switch (proof.method) {\n    case AuthMethod.PASSWORD:\n      return client.reAuthenticate(AuthMethod.PASSWORD, { password: proof.password }, purpose);\n    case AuthMethod.TOTP:\n      return client.reAuthenticate(AuthMethod.TOTP, { code: proof.code }, purpose);\n    case AuthMethod.PASSKEY: {\n      const options = (await client.reAuthPasskeyOptions()) as unknown as PublicKeyCredentialRequestOptionsJSON;\n      const assertion = await startAuthentication({ optionsJSON: options });\n      return client.reAuthenticate(AuthMethod.PASSKEY, { passkeyResponse: assertion as unknown as Record<string, unknown> }, purpose);\n    }\n    case AuthMethod.EXTERNAL_OAUTH2:\n    case AuthMethod.ORG_OPENID_CONNECT:\n    case AuthMethod.ORG_SAML:\n      return obtainFederatedReAuthenticationToken(proof.identityLinkId, purpose, proof.popup, signal);\n  }\n}\n"]}

package/dist/esm/core/security/UserOrgsContext.d.ts

@@ -1,5 +1,5 @@
 import React, { ReactNode } from 'react';
-import { UserContext, OrganizationContext, ExecutionContext_InitiatorIds, UserPrivacy } from '@wildo-ai/saas-models';
+import { UserContext, OrganizationContext, ExecutionContext_InitiatorIds, UserPrivacy, type ConsentPurpose } from '@wildo-ai/saas-models';
 import { EffectivePermissions } from './security.frontend.schemas';
 import { useAuthSession } from './useAuthSession';
 /**
@@ -28,6 +28,20 @@ export interface UserOrgsContextType {
     getCurrentOrganization: () => OrganizationContext | null;
     refreshOrganizations: () => Promise<void>;
     getPrivacy: () => UserPrivacy | null;
+    /**
+     * Record the signed-in person's consent decision: exactly the purposes they granted (#534).
+     *
+     * The argument is the WHOLE granted set, never a delta — a purpose left out is a purpose not granted,
+     * so an unticked box is a withdrawal rather than "no change". The write always carries a decision
+     * claim, which is what lets "grant nothing" be recorded as a decision instead of reading as a person
+     * who was never asked; the recorded instant is the server's (`buildConsentDecisionPatch`).
+     *
+     * Resolves with the stored privacy block once it is in state, so a caller gating on consent (the
+     * consent gate) sees the new decision on the next render. Rejects when the application mounts no
+     * self-preferences UPDATE door or the write fails — a consent surface must say it could not save,
+     * never behave as though it had.
+     */
+    recordConsentDecision: (grantedPurposes: readonly ConsentPurpose[]) => Promise<UserPrivacy>;
 }
 /**
  * UserOrgs Context

package/dist/esm/core/security/UserOrgsContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"UserOrgsContext.d.ts","sourceRoot":"","sources":["../../../../src/core/security/UserOrgsContext.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAA2B,SAAS,EAA2C,MAAM,OAAO,CAAC;AAC3G,OAAO,EACL,WAAW,EACX,mBAAmB,EAMnB,6BAA6B,EAC7B,WAAW,EAGZ,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,oBAAoB,EACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AA0BlD;;;;GAIG;AAEH,MAAM,WAAW,mBAAmB;IAElC,IAAI,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;IAChD,eAAe,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACtE,wBAAwB,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,0BAA0B,CAAC,CAAC;IACxF,YAAY,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,cAAc,CAAC,CAAC;IAChE,eAAe,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACtE,eAAe,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACtE,MAAM,EAAE,MAAM,IAAI,CAAC;IACnB,cAAc,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAGvC,mBAAmB,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,qBAAqB,CAAC,CAAC;IAC9E,sBAAsB,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,wBAAwB,CAAC,CAAC;IAGpF,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IAGzB,aAAa,EAAE,mBAAmB,EAAE,CAAC;IACrC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,WAAW,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACzC,wBAAwB,EAAE,6BAA6B,GAAG,IAAI,CAAC;IAG/D,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAG5B,sBAAsB,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,IAAI,CAAC;IACzD,sBAAsB,EAAE,MAAM,mBAAmB,GAAG,IAAI,CAAC;IACzD,oBAAoB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAG1C,UAAU,EAAE,MAAM,WAAW,GAAG,IAAI,CAAC;CACtC;AAED;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAA6D,CAAC;AAEzI,eAAO,MAAM,gBAAgB,EAAE,KAAK,CAAC,EAAE,CAAC;IAAE,QAAQ,EAAE,SAAS,CAAA;CAAE,CA6sB9D,CAAC"}
+{"version":3,"file":"UserOrgsContext.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/UserOrgsContext.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAA2B,SAAS,EAA2C,MAAM,OAAO,CAAC;AAC3G,OAAO,EACL,WAAW,EACX,mBAAmB,EAMnB,6BAA6B,EAC7B,WAAW,EAIX,KAAK,cAAc,EACpB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,oBAAoB,EACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AA2BlD;;;;GAIG;AAEH,MAAM,WAAW,mBAAmB;IAElC,IAAI,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;IAChD,eAAe,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACtE,wBAAwB,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,0BAA0B,CAAC,CAAC;IACxF,YAAY,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,cAAc,CAAC,CAAC;IAChE,eAAe,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACtE,eAAe,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACtE,MAAM,EAAE,MAAM,IAAI,CAAC;IACnB,cAAc,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAGvC,mBAAmB,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,qBAAqB,CAAC,CAAC;IAC9E,sBAAsB,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,wBAAwB,CAAC,CAAC;IAGpF,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IAGzB,aAAa,EAAE,mBAAmB,EAAE,CAAC;IACrC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,WAAW,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACzC,wBAAwB,EAAE,6BAA6B,GAAG,IAAI,CAAC;IAG/D,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAG5B,sBAAsB,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,IAAI,CAAC;IACzD,sBAAsB,EAAE,MAAM,mBAAmB,GAAG,IAAI,CAAC;IACzD,oBAAoB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAG1C,UAAU,EAAE,MAAM,WAAW,GAAG,IAAI,CAAC;IAErC;;;;;;;;;;;;OAYG;IACH,qBAAqB,EAAE,CAAC,eAAe,EAAE,SAAS,cAAc,EAAE,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;CAC7F;AAED;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAA6D,CAAC;AAEzI,eAAO,MAAM,gBAAgB,EAAE,KAAK,CAAC,EAAE,CAAC;IAAE,QAAQ,EAAE,SAAS,CAAA;CAAE,CAkzB9D,CAAC"}

package/dist/esm/core/security/UserOrgsContext.js

@@ -1,6 +1,6 @@
 import { jsx as _jsx } from "react/jsx-runtime";
 import { createContext, useState, useMemo, useEffect, useCallback, useRef } from 'react';
-import { CoreResourceType, ResourcesConfig_OperationPathUtils, CoreResourceOperation, ResourceOperationVariantType, OPERATION_VARIANT_KEY, SessionType, } from '@wildo-ai/saas-models';
+import { CoreResourceType, ResourcesConfig_OperationPathUtils, CoreResourceOperation, ResourceOperationVariantType, OPERATION_VARIANT_KEY, SessionType, normalizeConsentPurposes, } from '@wildo-ai/saas-models';
 import { useResourceRegistry } from '../../core/resources/useResourceRegistry.js';
 import { LoggerFrontendService } from '../../core/monitoring/logger.frontend.service.js';
 import { useEventBus } from '../../core/events/useEventBus.js';
@@ -12,6 +12,7 @@ import { decodeJwtPayload } from './jwt.frontend.utils.js';
 import { useAppScope } from '../../core/scope/useAppScope.js';
 import { useAppScopeInternal } from '../../core/scope/AppScopeContext.js';
 import { ScopeUtilsService } from '../../core/scope/scope.utils.frontend.service.js';
+import { findDefaultApiReadOperation } from './route-organization-access.frontend.utils.js';
 const logger = LoggerFrontendService.getLogger();
 const logDebug = logger.debugByType('UserOrgsContext');
 logger.setDebugTypeLogging('UserOrgsContext', false);
@@ -176,20 +177,72 @@ export const UserOrgsProvider = ({ children }) => {
                 logger.warn('ORGANIZATIONS resource not available');
                 return { organizationsList, selectedOrgId: null };
             }
-            const orgsReadOp = organizationsConfig.operations.find((op) => op.operationIdentifier === CoreResourceOperation.READ &&
-                op.isOperationDefault === true &&
-                op.isBulkOperation !== true &&
-                (op.variantType === ResourceOperationVariantType.API_CALL ||
-                    op.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK));
+            // Shared with the route organization-access probe, which must address the same READ.
+            const orgsReadOp = findDefaultApiReadOperation(organizationsConfig);
             if (!orgsReadOp) {
                 logger.warn('ORGANIZATIONS READ operation not found');
                 return { organizationsList, selectedOrgId: null };
             }
             const organizationsOperationPath = ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(orgsReadOp);
+            /**
+             * The tenant's preference record is fetched SEPARATELY, and that is a decision rather than an
+             * omission (#563).
+             *
+             * `OrganizationContextSchema` declares `preferences`, and `doOperation<OrganizationContext>`
+             * is a CAST — nothing validates the response against it — so the field read as available
+             * while no producer existed: the ORGANIZATIONS **default** READ returns a plain
+             * `Organization`, and the organisation's regional block therefore never reached
+             * `I18nContext`. Every date and number in every generated application formatted at the
+             * framework floor as a result.
+             *
+             * The rejected alternative was to switch this call to the ORGANIZATIONS **context** variant,
+             * which does populate the child. Measured against the running stack on 2026-09-10, that
+             * response carries every context-enabled child of an organisation — `auditLogs`, `todos`,
+             * `tasks`, `knowledgeDocuments`, `organizationMembers`, … — so session restore would pull an
+             * unbounded page of tenant data per membership to obtain four regional fields. (#583 has since
+             * taken the audit and delivery logs off the context surface and capped every 1:many child at
+             * `contextPolicy.limit`, 20 by default. The page is bounded now, but it is still a page of tenant
+             * data per membership, so the reasoning stands.) The
+             * preference record has its own default READ (`GET /organizations/{id}/organization-preference`,
+             * reachable by an ordinary `ORG_MEMBER`), which is one small request with a stable shape.
+             *
+             * Best-effort by construction: a tenant whose preferences cannot be read still yields a
+             * usable organisation, and `organizationPreferencesPayload(undefined)` then contributes
+             * nothing to the i18n event rather than clearing the member's own settings.
+             */
+            const organizationPreferencesConfig = registry.resourceConfigurations[CoreResourceType.ORGANIZATION_PREFERENCES];
+            const organizationPreferencesReadOp = findDefaultApiReadOperation(organizationPreferencesConfig);
+            if (!organizationPreferencesReadOp) {
+                logger.warn('ORGANIZATION_PREFERENCES READ operation not found — tenant regional defaults will not be applied');
+            }
+            const organizationPreferencesOperationPath = organizationPreferencesReadOp
+                ? ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(organizationPreferencesReadOp)
+                : null;
+            const fetchOrganizationPreferences = async (organizationId) => {
+                if (!organizationPreferencesOperationPath)
+                    return undefined;
+                try {
+                    return await doOperation(organizationPreferencesOperationPath, { contextualParameters: { organizationId } }) ?? undefined;
+                }
+                catch (error) {
+                    logger.warn('Failed to fetch organization preferences', { organizationId, error });
+                    return undefined;
+                }
+            };
             const orgPromises = memberships.map(async (membership) => {
                 try {
-                    const org = await doOperation(organizationsOperationPath, { contextualParameters: { organizationId: membership.organizationId } });
-                    return org;
+                    const [org, preferences] = await Promise.all([
+                        doOperation(organizationsOperationPath, { contextualParameters: { organizationId: membership.organizationId } }),
+                        fetchOrganizationPreferences(membership.organizationId),
+                    ]);
+                    if (!org)
+                        return null;
+                    // OMIT the key when the read failed rather than attaching `null`. The payload builder
+                    // reads the two differently: `undefined`/absent contributes nothing to the i18n event,
+                    // while `null` means "the tenant has cleared its preferences" and actively resets the
+                    // organisation half — which would silently downgrade a member to the framework floor
+                    // because one request failed.
+                    return preferences ? { ...org, preferences } : org;
                 }
                 catch (error) {
                     logger.warn('Failed to fetch organization', { organizationId: membership.organizationId, error });
@@ -226,11 +279,7 @@ export const UserOrgsProvider = ({ children }) => {
         }
         // Get USER_SELF resource config
         const userSelfConfig = registry.resourceConfigurations[CoreResourceType.USER_SELF];
-        const readOperation = userSelfConfig?.operations?.find((op) => op.operationIdentifier === CoreResourceOperation.READ &&
-            op.isOperationDefault === true &&
-            op.isBulkOperation !== true &&
-            (op.variantType === ResourceOperationVariantType.API_CALL ||
-                op.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK));
+        const readOperation = findDefaultApiReadOperation(userSelfConfig);
         if (!readOperation) {
             logger.warn('USER_SELF READ operation not found');
             return false;
@@ -276,7 +325,7 @@ export const UserOrgsProvider = ({ children }) => {
         const { organizationsList, selectedOrgId } = await loadOrganizations(userContext);
         // Store preferences after organization loading so i18n receives user and
         // active-organization language policy in the same event.
-        const preferences = userContext.userSelfPreference;
+        const preferences = userContext.userSelfPreferences;
         if (preferences) {
             const currentOrganization = selectedOrgId
                 ? organizationsList.find((organization) => organization._id === selectedOrgId)
@@ -447,13 +496,13 @@ export const UserOrgsProvider = ({ children }) => {
         await loadOrganizations(user);
     }, [user, loadOrganizations]);
     useEffect(() => {
-        if (!user?.userSelfPreference) {
+        if (!user?.userSelfPreferences) {
             return;
         }
         const currentOrganization = currentOrganizationId
             ? organizations.find((organization) => organization._id === currentOrganizationId)
             : null;
-        emitPreferencesChanged(user.userSelfPreference, currentOrganization?.preferences);
+        emitPreferencesChanged(user.userSelfPreferences, currentOrganization?.preferences);
     }, [currentOrganizationId, emitPreferencesChanged, organizations, user]);
     /**
      * Set the current active organization
@@ -488,6 +537,49 @@ export const UserOrgsProvider = ({ children }) => {
     const getPrivacy = useCallback(() => {
         return privacy;
     }, [privacy]);
+    // Depend on the builder alone: the whole AppScope value changes with every custom scope value, and through
+    // this callback it would re-render every `useUserOrgs` consumer.
+    const buildScopeContextualParameters = appScope.buildContextualParameters;
+    const recordConsentDecision = useCallback(async (grantedPurposes) => {
+        const operation = registry.resourceConfigurations[CoreResourceType.USER_SELF_PREFERENCES]?.operations.find((candidate) => candidate.operationIdentifier === CoreResourceOperation.UPDATE
+            && candidate.isOperationDefault === true
+            && candidate.isBulkOperation !== true
+            && (candidate.variantType === ResourceOperationVariantType.API_CALL
+                || candidate.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK));
+        if (!operation) {
+            throw new Error('Cannot record a consent decision: this application mounts no user self-preferences UPDATE operation');
+        }
+        const updated = await doOperation(ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(operation), {
+            // This provider sits ABOVE `ScopedResourceRegistryProvider`, so the `doOperation` it holds injects
+            // no scope: the user id the self-preferences route is addressed by has to be supplied here. With an
+            // empty set the client could not build the URL and every decision failed before a request left
+            // (`frontend_resource_no_endpoint_available`, #977 — found by driving the prompt in a browser).
+            contextualParameters: buildScopeContextualParameters(),
+            requestData: {
+                // The client instant is only a CLAIM that this write is a decision; the server replaces it.
+                privacy: { consentedPurposes: normalizeConsentPurposes(grantedPurposes), consentDecidedAt: new Date() },
+            },
+        });
+        const storedPrivacy = updated?.privacy;
+        if (!storedPrivacy) {
+            throw new Error('Consent decision was written but the response carried no privacy block');
+        }
+        setPrivacy(storedPrivacy);
+        // Updating the user's preferences record re-emits USER_PREFERENCES_CHANGED through the effect
+        // above, which is how the analytics provider learns the new set without a second channel.
+        setUser((previous) => previous
+            ? { ...previous, userSelfPreferences: { ...(previous.userSelfPreferences ?? {}), privacy: storedPrivacy } }
+            : previous);
+        // While a required purpose was missing the backend refused this person's organization reads, so
+        // session restore may have loaded none (#534 re-review N1). Re-load them now that the decision is
+        // stored; a failure leaves the decision recorded and is retried on the next restore.
+        if (organizations.length === 0) {
+            await refreshOrganizations().catch((error) => {
+                logger.warn('Organizations could not be re-loaded after a consent decision', { error });
+            });
+        }
+        return storedPrivacy;
+    }, [buildScopeContextualParameters, doOperation, registry, organizations.length, refreshOrganizations]);
     /**
      * Logout wrapper that also clears user/org data
      */
@@ -575,6 +667,7 @@ export const UserOrgsProvider = ({ children }) => {
         refreshOrganizations,
         // Privacy getter
         getPrivacy,
+        recordConsentDecision,
     }), [
         auth,
         identifyByEmail,
@@ -596,6 +689,7 @@ export const UserOrgsProvider = ({ children }) => {
         getCurrentOrganization,
         refreshOrganizations,
         getPrivacy,
+        recordConsentDecision,
     ]);
     return _jsx(UserOrgsContext.Provider, { value: value, children: children });
 };