@wildo-ai/saas-frontend-lib 1.1.3 → 1.1.5

package/dist/esm/components/auth/Auth_Invitation.js

@@ -1,9 +1,9 @@
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
-import { Navigate, useLocation, useNavigate } from 'react-router-dom';
+import { Navigate, useLocation } from 'react-router-dom';
 import { useFormContext } from 'react-hook-form';
 import { CorePresetNames, FrontendComponentType, UserAuthLabel, UserInvitationLabel } from '@wildo-ai/presets-components-models';
-import { AuthMethod, AuthUtils, InvitationManagementMode, UserInvitationFormDtoSchema, } from '@wildo-ai/saas-models';
+import { AuthNextStep, AuthMethod, AuthUtils, InvitationManagementMode, UserInvitationFormDtoSchema, } from '@wildo-ai/saas-models';
 import { ValidationMode } from '@wildo-ai/zod-decorators';
 import { startRegistration } from '@simplewebauthn/browser';
 import { Button, ButtonVariants_Variant } from '../../components/actions/button.js';
@@ -12,12 +12,14 @@ import { Alert, AlertDescription } from '../../components/overlays/containers/al
 import { PasswordStrengthIndicator, DEFAULT_PASSWORD_POLICY } from '../../components/auth/utils/PasswordStrengthIndicator.js';
 import { CredentialUsernameAutofillField } from '../../components/auth/utils/CredentialUsernameAutofillField.js';
 import { LabeledDivider } from '../../components/auth/utils/LabeledDivider.js';
+import { AuthMethodChoiceList } from '../../components/auth/utils/AuthMethodChoiceList.js';
+import { resolveAuthMethodChoiceLabel } from '../../components/auth/methods/auth-method-presentation.js';
 import { FormField } from '../../components/form/automated/FormField.js';
 import { FormLayout } from '../../components/resources/skeleton/FormLayout.js';
 import { SubmitButton } from '../../components/resources/skeleton/SubmitButton.js';
 import { LoadingSpinner } from '../../components/feedback/loading-spinner.js';
 import { Heading } from '../../components/typography/heading.js';
-import { Link } from '../../components/typography/link.js';
+import { AuthSecondaryLink } from '../../components/auth/utils/AuthSecondaryLink.js';
 import { Text } from '../../components/typography/text.js';
 import { CommonRoutePaths } from '../../core/runtime/routes.frontend.definitions.js';
 import { useI18n } from '../../core/i18n/useI18n.js';
@@ -25,10 +27,12 @@ import { makeComponentLabelResolver } from '../../core/i18n/component-label-reso
 import { getManualCallsHttpClient } from '../../core/requests/wildo-http-client-manual-calls.frontend.service.js';
 import { useAuthSession } from '../../core/security/useAuthSession.js';
 import { useError } from '../../core/errors/useError.js';
+import { useUserFacingErrorMessage } from '../../core/errors/useUserFacingErrorMessage.js';
 import { useResolvedAuthConfig } from '../../core/security/useResolvedAuthConfig.js';
-import { resolvePostAuthRedirect } from '../../core/security/auth-redirect.frontend.utils.js';
+import { extractAuthRedirectFromSearch, resolvePostAuthRedirect } from '../../core/security/auth-redirect.frontend.utils.js';
+import { useMfaContinuationNavigation } from '../../components/auth/utils/useMfaContinuationNavigation.js';
 import { resolvePasswordViolationsToLabels, } from '../../components/auth/utils/resolvePasswordViolationsToLabels.js';
-import { AUTH_METHOD_COMPONENTS, sortMethodsByDisplayOrder, } from '../../components/auth/methods/auth-method-components.js';
+import { AUTH_METHOD_COMPONENTS, } from '../../components/auth/methods/auth-method-components.js';
 import { createComponentResolver } from '../../core/components-registry/component-resolver.frontend.helper.js';
 /**
  * First-factor methods the PUBLIC invitation-accept chooser knows how to render.
@@ -56,19 +60,6 @@ const INVITATION_RENDERABLE_METHODS = new Set([
     AuthMethod.MAGIC_LINK,
     AuthMethod.PASSKEY,
 ]);
-/**
- * Method → display label for the alternative-method switcher buttons. Mirrors the
- * login chooser (`Auth_Main`); these labels live in the `USER_AUTH` namespace and are
- * resolved via `tAuth`. SAML and OIDC share the generic "org SSO" label.
- */
-const METHOD_LABEL_MAP = {
-    [AuthMethod.PASSWORD]: UserAuthLabel.METHOD_PASSWORD,
-    [AuthMethod.MAGIC_LINK]: UserAuthLabel.METHOD_MAGIC_LINK,
-    [AuthMethod.PASSKEY]: UserAuthLabel.METHOD_PASSKEY,
-    [AuthMethod.ORG_SAML]: UserAuthLabel.METHOD_ORG_SSO,
-    [AuthMethod.ORG_OPENID_CONNECT]: UserAuthLabel.METHOD_ORG_SSO,
-    [AuthMethod.EXTERNAL_OAUTH2]: UserAuthLabel.METHOD_EXTERNAL_OAUTH2,
-};
 /**
  * Password-method accept form body — first/last name + optional password with the
  * strength indicator + a hidden username field for password-manager autofill.
@@ -114,6 +105,7 @@ const InvitationMagicLinkTemplate = ({ invitationEmail, t, tAuth }) => {
  */
 const InvitationMagicLinkForm = ({ invitationEmail, disabled, onSubmit, t, tAuth }) => {
     const formMethodsRef = useRef(null);
+    const toUserFacingErrorMessage = useUserFacingErrorMessage();
     // Only the name fields — reuse the accept form schema's first/last (with their autocomplete
     // decorators); the credential is the emailed link, not a password.
     const schema = useMemo(() => UserInvitationFormDtoSchema.pick({ firstName: true, lastName: true }), []);
@@ -128,10 +120,10 @@ const InvitationMagicLinkForm = ({ invitationEmail, disabled, onSubmit, t, tAuth
         catch (e) {
             formMethodsRef.current?.setError('root', {
                 type: 'server',
-                message: e?.message || t(UserInvitationLabel.UNEXPECTED_ERROR),
+                message: toUserFacingErrorMessage(e, t(UserInvitationLabel.UNEXPECTED_ERROR)),
             });
         }
-    }, [onSubmit, t]);
+    }, [onSubmit, t, toUserFacingErrorMessage]);
     return (_jsx(AutomatedForm, { schema: schema, defaultValues: { firstName: '', lastName: '' }, onSubmit: handleSubmit, validationMode: ValidationMode.ON_BLUR, disabled: disabled, onFormReady: (formMethods) => { formMethodsRef.current = formMethods; }, labels: {
             fields: {
                 firstName: t(UserInvitationLabel.FIRST_NAME),
@@ -174,6 +166,7 @@ export const PublicLayoutPreset_UserInvitation_Default = ({ token, email, }) =>
     // calls `handleError` in its catch); the magic-link path calls the HTTP client directly, so it wires
     // `handleError` itself (below) to keep central logging + frontend-action execution symmetric.
     const { handleError } = useError();
+    const toUserFacingErrorMessage = useUserFacingErrorMessage();
     const resolvedAuth = useResolvedAuthConfig();
     // Load BOTH label namespaces: the invitation chrome (`USER_INVITATION`) plus the
     // login method components' namespace (`USER_AUTH`) — the reused SAML/OIDC/OAuth2/
@@ -184,7 +177,6 @@ export const PublicLayoutPreset_UserInvitation_Default = ({ token, email, }) =>
         FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH,
     ], []);
     const { tComponent, isReady } = useI18n({ component: i18nComponents });
-    const navigate = useNavigate();
     const location = useLocation();
     const formMethodsRef = useRef(null);
     const [isDeclining, setIsDeclining] = useState(false);
@@ -198,6 +190,8 @@ export const PublicLayoutPreset_UserInvitation_Default = ({ token, email, }) =>
     // token). On success we switch to a TERMINAL "check your email" state rather than leaving the
     // chooser visible (whose other methods + decline would now dead-end on the consumed token).
     const [magicLinkSent, setMagicLinkSent] = useState(false);
+    // #1158: accepted without a session; the invitee's policy requires signing in separately.
+    const [signInRequired, setSignInRequired] = useState(false);
     // In-flight flag for the magic-link accept (which bypasses the context's `auth.isLoading`), used
     // to gate the decline / alternative-method buttons so a click can't race the single-use token.
     const [magicLinkSubmitting, setMagicLinkSubmitting] = useState(false);
@@ -217,10 +211,8 @@ export const PublicLayoutPreset_UserInvitation_Default = ({ token, email, }) =>
     // label). Normalizing it to `''` would turn a missing label into an invisible
     // button and an empty heading — strictly worse than a visible key path.
     const tAuth = useCallback((key) => tComponent(FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH, key), [tComponent]);
-    // SEPARATE, miss-normalized resolver for the auth-method prop contract, which
-    // guarantees `''` on a miss so those components' `|| fallback` is live. Same
-    // split as `Auth_MfaChallenge`. Do NOT collapse the two: `tAuth` has six uses and
-    // only this one wants a normalized miss.
+    // The auth-method prop contract's resolver, built through the shared seam so the
+    // `USER_AUTH` namespace binding lives in one place. Same shape as `Auth_MfaChallenge`.
     const tAuthForMethodComponent = useMemo(() => makeComponentLabelResolver(tComponent, FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH), [tComponent]);
     const loginPath = CommonRoutePaths.login;
     // Where an already-authenticated invitee is forwarded — including one returning from
@@ -228,6 +220,7 @@ export const PublicLayoutPreset_UserInvitation_Default = ({ token, email, }) =>
     // this (auth) page, `Auth_AuthCallback` lands here after the code exchange, and this
     // resolves the post-auth destination (a `redirect` param if present, else app home).
     const postAuthRedirect = useMemo(() => resolvePostAuthRedirect(location.search), [location.search]);
+    const authRedirectTarget = useMemo(() => extractAuthRedirectFromSearch(location.search), [location.search]);
     // The invitation-info response is authoritative for the invitee email; fall back to
     // the URL `email` param until it resolves.
     const inviteeEmail = invitationInfo?.inviteeEmail ?? email;
@@ -262,7 +255,7 @@ export const PublicLayoutPreset_UserInvitation_Default = ({ token, email, }) =>
         })
             .catch((e) => {
             if (!cancelled)
-                setInfoError(e?.message || t(UserInvitationLabel.UNEXPECTED_ERROR));
+                setInfoError(toUserFacingErrorMessage(e, t(UserInvitationLabel.UNEXPECTED_ERROR)));
         })
             .finally(() => {
             if (!cancelled)
@@ -276,10 +269,16 @@ export const PublicLayoutPreset_UserInvitation_Default = ({ token, email, }) =>
         // fallback in the narrow window before i18n is ready.
         // eslint-disable-next-line react-hooks/exhaustive-deps
     }, [token, auth.accessToken]);
-    // Renderable, display-ordered first-factor methods from the org's policy.
+    /*
+     * Renderable first-factor methods from the org's policy, in the order the server sent (#1218).
+     *
+     * The invitation-info endpoint builds this list through the SAME `buildFirstFactorMethodsForPolicy` the sign-in
+     * page's `identify` uses, which orders by `AUTH_METHOD_PRECEDENCE`. That is why this page can stop re-sorting and
+     * why it inherits the fix rather than needing its own: filtering preserves order.
+     */
     const availableMethods = useMemo(() => {
         const methods = invitationInfo?.availableFirstFactorMethods ?? [];
-        return sortMethodsByDisplayOrder(methods.filter((m) => INVITATION_RENDERABLE_METHODS.has(m.method)));
+        return methods.filter((m) => INVITATION_RENDERABLE_METHODS.has(m.method));
     }, [invitationInfo]);
     // Every renderable method is actionable (PASSKEY now enrolls at accept — Phase 3). The empty
     // state (route to sign-in) is reserved for an org exposing NO renderable first-factor method
@@ -293,16 +292,19 @@ export const PublicLayoutPreset_UserInvitation_Default = ({ token, email, }) =>
     const defaultMethod = useMemo(() => availableMethods[0]?.method ?? null, [availableMethods]);
     const currentActiveMethod = activeMethod ?? defaultMethod;
     const alternativeMethods = availableMethods.filter((m) => m.method !== currentActiveMethod);
-    useEffect(() => {
-        if (!auth.mfaRequired || !auth.mfaSessionId)
-            return;
-        if (auth.availableEnrollmentMethods.length > 0) {
-            navigate(CommonRoutePaths.enrollmentRequired, { replace: true });
-            return;
-        }
-        const invitationEmail = inviteeEmail || '';
-        navigate(`${CommonRoutePaths.mfaChallenge}?sessionId=${auth.mfaSessionId}&email=${encodeURIComponent(invitationEmail)}`, { replace: true });
-    }, [auth.mfaRequired, auth.mfaSessionId, auth.availableEnrollmentMethods, navigate, inviteeEmail]);
+    /*
+     * The routing every auth screen shares (#972): nothing usable → the enrollment gate, which for an
+     * INVITATION session completes it and signs the invitee in (#603); something usable → the challenge.
+     * This screen already honours a `redirect` param for its post-auth destination, so the same target
+     * rides the MFA detour — the inline copy this replaced dropped it there.
+     */
+    useMfaContinuationNavigation({
+        mfaRequired: auth.mfaRequired,
+        mfaSessionId: auth.mfaSessionId,
+        usableSecondFactorMethods: auth.usableSecondFactorMethods,
+        email: inviteeEmail || undefined,
+        authRedirectTarget,
+    });
     const handleInvitationSubmit = useCallback(async (data) => {
         formMethodsRef.current?.clearErrors('root');
         if (data.password) {
@@ -320,22 +322,24 @@ export const PublicLayoutPreset_UserInvitation_Default = ({ token, email, }) =>
             return trimmed ? trimmed : undefined;
         };
         try {
-            await acceptInvitation({
+            const result = await acceptInvitation({
                 invitationToken: token,
                 firstName: normalizeText(data.firstName),
                 lastName: normalizeText(data.lastName),
                 password: data.password || undefined,
             });
+            if (result?.signInRequired)
+                setSignInRequired(true);
             // Session issued → the `auth.accessToken` guard forwards to the app (honoring
-            // `postAuthRedirect`); MFA-gated → the `mfaRequired` effect routes. Nothing to complete here.
+            // `postAuthRedirect`); MFA-gated → the `mfaRequired` effect routes; no session (#1158) → the sign-in state renders.
         }
         catch (e) {
             formMethodsRef.current?.setError('root', {
                 type: 'server',
-                message: e?.message || t(UserInvitationLabel.UNEXPECTED_ERROR),
+                message: toUserFacingErrorMessage(e, t(UserInvitationLabel.UNEXPECTED_ERROR)),
             });
         }
-    }, [acceptInvitation, passwordPolicy, t, token]);
+    }, [acceptInvitation, passwordPolicy, t, token, toUserFacingErrorMessage]);
     // Passkey enroll-at-accept: accept (bootstraps the session from the invitation token + returns a
     // WebAuthn challenge) → run the browser ceremony → verify against the authenticated
     // register-verify route. See `InvitationPasskeyForm`.
@@ -349,6 +353,11 @@ export const PublicLayoutPreset_UserInvitation_Default = ({ token, email, }) =>
                 lastName,
                 credentialMethod: AuthMethod.PASSKEY,
             });
+            if (result?.signInRequired) {
+                // #1158: no session, so there is no ceremony to run; the terminal sign-in state renders.
+                setSignInRequired(true);
+                return;
+            }
             const options = result?.passkeyRegistrationOptions;
             if (options) {
                 // Session issued + a challenge. Enrollment failure is NON-FATAL — the invitation token
@@ -370,25 +379,32 @@ export const PublicLayoutPreset_UserInvitation_Default = ({ token, email, }) =>
             // effect routes to enrollment (the invitee enrolls the passkey there via the existing route).
         }
         catch (e) {
-            setPasskeyError(e?.message || t(UserInvitationLabel.UNEXPECTED_ERROR));
+            setPasskeyError(toUserFacingErrorMessage(e, t(UserInvitationLabel.UNEXPECTED_ERROR)));
         }
         finally {
             setPasskeyCeremonyInProgress(false);
         }
-    }, [acceptInvitation, token, t]);
+    }, [acceptInvitation, token, t, toUserFacingErrorMessage]);
     // Magic-link accept: emails a link + accepts the invite (via the HTTP client directly — no
     // session to manage, like the login magic-link). On success the render switches to the terminal
     // "check your email" state; errors propagate to the sub-form's root error.
     const handleMagicLinkSubmit = useCallback(async (firstName, lastName) => {
         setMagicLinkSubmitting(true);
         try {
-            await getManualCallsHttpClient().acceptInvitation({
+            const response = await getManualCallsHttpClient().acceptInvitation({
                 invitationToken: token,
                 firstName,
                 lastName,
                 credentialMethod: AuthMethod.MAGIC_LINK,
+                // The emailed link is opened on another page, so the deep link must travel inside it (#1014). Already
+                // same-origin: `extractAuthRedirectFromSearch` sanitised it, and the client and backend check again.
+                redirect: authRedirectTarget,
             });
-            setMagicLinkSent(true);
+            // #1158: an accept that issued no session sends no link either; say so rather than "check your email".
+            if (response.nextStep === AuthNextStep.SIGN_IN_REQUIRED)
+                setSignInRequired(true);
+            else
+                setMagicLinkSent(true);
         }
         catch (e) {
             // Route through the central error handler (logging + frontend-action execution, e.g. the global
@@ -402,7 +418,7 @@ export const PublicLayoutPreset_UserInvitation_Default = ({ token, email, }) =>
             // The flag just releases the gate; the inline root error is owned by the sub-form's catch.
             setMagicLinkSubmitting(false);
         }
-    }, [token, handleError]);
+    }, [token, handleError, authRedirectTarget]);
     const handleDecline = useCallback(async () => {
         setDeclineError(null);
         if (!token) {
@@ -415,12 +431,12 @@ export const PublicLayoutPreset_UserInvitation_Default = ({ token, email, }) =>
             setDeclined(true);
         }
         catch (e) {
-            setDeclineError(e?.message || t(UserInvitationLabel.UNEXPECTED_ERROR));
+            setDeclineError(toUserFacingErrorMessage(e, t(UserInvitationLabel.UNEXPECTED_ERROR)));
         }
         finally {
             setIsDeclining(false);
         }
-    }, [t, token]);
+    }, [t, token, toUserFacingErrorMessage]);
     // The reused method components self-handle their outcome (SSO/OAuth do a full-page
     // redirect; magic-link shows its own "sent" state), so there is nothing to complete
     // here. On the rare in-place success the `auth.accessToken` guard below lands the
@@ -504,33 +520,49 @@ export const PublicLayoutPreset_UserInvitation_Default = ({ token, email, }) =>
     if (!isReady)
         return null;
     if (!token) {
-        return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "text-center space-y-item-xs mb-group", children: [_jsx(Heading, { children: t(UserInvitationLabel.ERROR_TITLE) }), _jsx(Text, { className: "max-w-sm mx-auto", children: t(UserInvitationLabel.INVALID_LINK) })] }), _jsx("div", { className: "text-center", children: _jsx(Link, { href: loginPath, children: t(UserInvitationLabel.LOGIN_LINK) }) })] }));
+        return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "text-center space-y-item-xs mb-group", children: [_jsx(Heading, { children: t(UserInvitationLabel.ERROR_TITLE) }), _jsx(Text, { className: "max-w-sm mx-auto", children: t(UserInvitationLabel.INVALID_LINK) })] }), _jsx("div", { className: "text-center", children: _jsx(AuthSecondaryLink, { href: loginPath, children: t(UserInvitationLabel.LOGIN_LINK) }) })] }));
     }
     if (declined) {
-        return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "text-center space-y-item-xs mb-group", children: [_jsx(Heading, { children: t(UserInvitationLabel.DECLINE_SUCCESS_TITLE) }), _jsx(Text, { className: "max-w-sm mx-auto", children: t(UserInvitationLabel.DECLINE_SUCCESS_MESSAGE) })] }), _jsx("div", { className: "text-center", children: _jsx(Link, { href: loginPath, children: t(UserInvitationLabel.CONTINUE_LINK) }) })] }));
+        return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "text-center space-y-item-xs mb-group", children: [_jsx(Heading, { children: t(UserInvitationLabel.DECLINE_SUCCESS_TITLE) }), _jsx(Text, { className: "max-w-sm mx-auto", children: t(UserInvitationLabel.DECLINE_SUCCESS_MESSAGE) })] }), _jsx("div", { className: "text-center", children: _jsx(AuthSecondaryLink, { href: loginPath, children: t(UserInvitationLabel.CONTINUE_LINK) }) })] }));
+    }
+    // Accepted without a session (#1158): the invitee's policy disables the email-possession sign-in the invitation link
+    // amounts to. Terminal: the membership exists, and they continue on the sign-in page.
+    if (signInRequired) {
+        return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "text-center space-y-item-xs mb-group", children: [_jsx(Heading, { children: t(UserInvitationLabel.SIGN_IN_REQUIRED_TITLE) }), _jsx(Text, { className: "max-w-sm mx-auto", children: t(UserInvitationLabel.SIGN_IN_REQUIRED_MESSAGE) })] }), _jsx("div", { className: "text-center", children: _jsx(AuthSecondaryLink, { href: loginPath, children: t(UserInvitationLabel.LOGIN_LINK) }) })] }));
     }
     // Magic-link accepted — the invite is consumed and a sign-in link was emailed. Terminal state:
     // the invitee finishes by clicking the emailed link (no chooser/decline — the token is gone, so
     // any other method would only 4xx).
     if (magicLinkSent) {
-        return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "text-center space-y-item-xs mb-group", children: [_jsx(Heading, { children: tAuth(UserAuthLabel.MAGIC_LINK_SENT_TITLE) }), _jsx(Text, { className: "max-w-sm mx-auto", children: tAuth(UserAuthLabel.MAGIC_LINK_SENT_DESCRIPTION) }), inviteeEmail && (_jsx(Text, { className: "text-sm text-muted-foreground", children: inviteeEmail }))] }), _jsx("div", { className: "text-center", children: _jsx(Link, { href: loginPath, children: t(UserInvitationLabel.LOGIN_LINK) }) })] }));
+        return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "text-center space-y-item-xs mb-group", children: [_jsx(Heading, { children: tAuth(UserAuthLabel.MAGIC_LINK_SENT_TITLE) }), _jsx(Text, { className: "max-w-sm mx-auto", children: tAuth(UserAuthLabel.MAGIC_LINK_SENT_DESCRIPTION) }), inviteeEmail && (_jsx(Text, { className: "text-sm text-muted-foreground", children: inviteeEmail }))] }), _jsx("div", { className: "text-center", children: _jsx(AuthSecondaryLink, { href: loginPath, children: t(UserInvitationLabel.LOGIN_LINK) }) })] }));
     }
     if (infoLoading) {
         return (_jsx("div", { className: "flex items-center justify-center py-group", children: _jsx(LoadingSpinner, { size: 40 }) }));
     }
     if (infoError || !invitationInfo) {
-        return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "text-center space-y-item-xs mb-group", children: [_jsx(Heading, { children: t(UserInvitationLabel.ERROR_TITLE) }), _jsx(Text, { className: "max-w-sm mx-auto", children: infoError || t(UserInvitationLabel.INVALID_LINK) })] }), _jsx("div", { className: "text-center", children: _jsx(Link, { href: loginPath, children: t(UserInvitationLabel.LOGIN_LINK) }) })] }));
+        return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "text-center space-y-item-xs mb-group", children: [_jsx(Heading, { children: t(UserInvitationLabel.ERROR_TITLE) }), _jsx(Text, { className: "max-w-sm mx-auto", children: infoError || t(UserInvitationLabel.INVALID_LINK) })] }), _jsx("div", { className: "text-center", children: _jsx(AuthSecondaryLink, { href: loginPath, children: t(UserInvitationLabel.LOGIN_LINK) }) })] }));
     }
     // SCIM-managed org → informational only, NO password/method form (locked decision:
     // the directory is the identity authority, so no local credential is set here).
     if (invitationInfo.managementMode === InvitationManagementMode.SCIM) {
-        return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "text-center space-y-item-xs mb-group", children: [_jsx(Heading, { children: t(UserInvitationLabel.SCIM_MANAGED_TITLE) }), _jsx(Text, { className: "max-w-sm mx-auto", children: t(UserInvitationLabel.SCIM_MANAGED_MESSAGE) }), inviteeEmail && (_jsx(Text, { className: "text-sm text-muted-foreground", children: inviteeEmail }))] }), declineError && (_jsx(Alert, { variant: "destructive", className: "mb-group", children: _jsx(AlertDescription, { children: declineError }) })), _jsxs("div", { className: "text-center mt-group space-y-item-sm", children: [_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: handleDecline, disabled: isDeclining, className: "w-full", children: isDeclining ? t(UserInvitationLabel.DECLINING_INVITATION) : t(UserInvitationLabel.DECLINE_INVITATION) }), _jsx(Link, { href: loginPath, children: t(UserInvitationLabel.LOGIN_LINK) })] })] }));
+        return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "text-center space-y-item-xs mb-group", children: [_jsx(Heading, { children: t(UserInvitationLabel.SCIM_MANAGED_TITLE) }), _jsx(Text, { className: "max-w-sm mx-auto", children: t(UserInvitationLabel.SCIM_MANAGED_MESSAGE) }), inviteeEmail && (_jsx(Text, { className: "text-sm text-muted-foreground", children: inviteeEmail }))] }), declineError && (_jsx(Alert, { variant: "destructive", className: "mb-group", children: _jsx(AlertDescription, { children: declineError }) })), _jsxs("div", { className: "text-center mt-group space-y-item-sm", children: [_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: handleDecline, disabled: isDeclining, className: "w-full", children: isDeclining ? t(UserInvitationLabel.DECLINING_INVITATION) : t(UserInvitationLabel.DECLINE_INVITATION) }), _jsx(AuthSecondaryLink, { href: loginPath, children: t(UserInvitationLabel.LOGIN_LINK) })] })] }));
     }
     // OPEN / SSO org → the method chooser.
-    return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "text-center space-y-item-xs mb-group", children: [_jsx(Heading, { children: t(UserInvitationLabel.TITLE) }), _jsx(Text, { className: "max-w-sm mx-auto", children: t(UserInvitationLabel.SUB_TITLE) }), invitationInfo.organizationName && (_jsx(Text, { className: "text-sm text-muted-foreground", children: invitationInfo.organizationName })), inviteeEmail && (_jsx(Text, { className: "text-sm text-muted-foreground", children: inviteeEmail }))] }), hasActionableMethod ? (_jsxs(_Fragment, { children: [_jsx(Text, { className: "text-sm text-muted-foreground text-center mb-element", children: t(UserInvitationLabel.METHOD_CHOICE_HINT) }), renderActiveMethod(), alternativeMethods.length > 0 && (_jsxs(_Fragment, { children: [_jsx(LabeledDivider, { label: tAuth(UserAuthLabel.OTHER_METHODS_DIVIDER) }), _jsx("div", { className: "space-y-item", children: alternativeMethods.map((method) => {
-                                    const labelKey = METHOD_LABEL_MAP[method.method];
-                                    return (_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, className: "w-full", onClick: () => { setActiveMethod(method.method); setPasskeyError(null); }, disabled: methodSubmitInFlight || isDeclining, children: labelKey ? tAuth(labelKey) : method.method }, method.method));
-                                }) })] }))] })) : (
+    return (_jsxs(_Fragment, { children: [_jsxs("div", { className: "text-center space-y-item-xs mb-group", children: [_jsx(Heading, { children: t(UserInvitationLabel.TITLE) }), _jsx(Text, { className: "max-w-sm mx-auto", children: t(UserInvitationLabel.SUB_TITLE) }), invitationInfo.organizationName && (_jsx(Text, { className: "text-sm text-muted-foreground", children: invitationInfo.organizationName })), inviteeEmail && (_jsx(Text, { className: "text-sm text-muted-foreground", children: inviteeEmail }))] }), hasActionableMethod ? (_jsxs(_Fragment, { children: [_jsx(Text, { className: "text-sm text-muted-foreground text-center mb-element", children: t(UserInvitationLabel.METHOD_CHOICE_HINT) }), renderActiveMethod(), alternativeMethods.length > 0 && (_jsxs(_Fragment, { children: [_jsx(LabeledDivider, { label: tAuth(UserAuthLabel.OTHER_METHODS_DIVIDER) }), _jsx(AuthMethodChoiceList, { methods: alternativeMethods.map((method) => method.method), 
+                                /*
+                                 * The descriptor names an enterprise connection, so an invitee choosing their
+                                 * organization's provider sees ITS name rather than "Organization sign-in".
+                                 *
+                                 * No `socialProviders`: this screen configures no social buttons of its own, and the
+                                 * resolver declines to name a provider it cannot resolve rather than printing a raw
+                                 * `providerRef` — so a social alternative keeps the generic kind here, deliberately.
+                                 */
+                                labelFor: (method) => resolveAuthMethodChoiceLabel(method, {
+                                    offeredMethod: alternativeMethods.find((candidate) => candidate.method === method),
+                                    continueWithTemplate: tAuth(UserAuthLabel.CONTINUE_WITH),
+                                    translateLabel: (label) => tAuth(label),
+                                    resolveSocialProviderLabel: (provider) => provider.displayName ?? provider.providerRef,
+                                }), onSelect: (method) => { setActiveMethod(method); setPasskeyError(null); }, disabled: methodSubmitInFlight || isDeclining })] }))] })) : (
             /*
               No renderable first-factor method on this screen — a valid state, not an error. The
               common case is an SSO-only org whose invitee arrives before directory provisioning: the
@@ -538,7 +570,7 @@ export const PublicLayoutPreset_UserInvitation_Default = ({ token, email, }) =>
               resolved, yielding an empty set with mode OPEN. Route the invitee to the sign-in page,
               where email→domain SSO resolution works and the enterprise / OAuth JIT consumes the invite.
             */
-            _jsx(Alert, { children: _jsx(AlertDescription, { children: t(UserInvitationLabel.NO_METHOD_AVAILABLE_HINT) }) })), declineError && (_jsx(Alert, { variant: "destructive", className: "mt-group", children: _jsx(AlertDescription, { children: declineError }) })), _jsxs("div", { className: "text-center mt-group space-y-item-sm", children: [_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: handleDecline, disabled: methodSubmitInFlight || isDeclining, className: "w-full", children: isDeclining ? t(UserInvitationLabel.DECLINING_INVITATION) : t(UserInvitationLabel.DECLINE_INVITATION) }), _jsx(Link, { href: loginPath, children: t(UserInvitationLabel.LOGIN_LINK) })] })] }));
+            _jsx(Alert, { children: _jsx(AlertDescription, { children: t(UserInvitationLabel.NO_METHOD_AVAILABLE_HINT) }) })), declineError && (_jsx(Alert, { variant: "destructive", className: "mt-group", children: _jsx(AlertDescription, { children: declineError }) })), _jsxs("div", { className: "text-center mt-group space-y-item-sm", children: [_jsx(Button, { variant: ButtonVariants_Variant.OUTLINE, onClick: handleDecline, disabled: methodSubmitInFlight || isDeclining, className: "w-full", children: isDeclining ? t(UserInvitationLabel.DECLINING_INVITATION) : t(UserInvitationLabel.DECLINE_INVITATION) }), _jsx(AuthSecondaryLink, { href: loginPath, children: t(UserInvitationLabel.LOGIN_LINK) })] })] }));
 };
 export function Auth_Invitation({ preset = CorePresetNames.DEFAULT, ...props }) {
     const Component = createComponentResolver(FrontendComponentType.PUBLIC_LAYOUTS_USER_INVITATION, 'Auth_Invitation')(preset);