@wildo-ai/saas-frontend-lib 1.1.4 → 1.1.5

package/dist/esm/core/security/pending-mfa-session-storage.frontend.utils.d.ts

@@ -0,0 +1,58 @@
+/**
+ * The tab-scoped memory of an MFA session that still owes a second factor (#1068).
+ *
+ * The auth context holds such a session only in memory, so a reload of the enrollment gate after an
+ * in-app arrival used to lose it and cost a sign-in. Three places could have carried it across the reload,
+ * and this is the one chosen:
+ *
+ * | option | why not / why |
+ * |---|---|
+ * | the gate URL | rejected. A REGISTRATION or INVITATION session reaches the gate this way on the ordinary path, issues tokens when a factor is enrolled, and lives 24h — its id would sit in browser history and every frontend/CDN request log |
+ * | `localStorage` | rejected. It outlives the tab and is shared by every tab of the origin, so an abandoned sign-up would be recoverable long after, from anywhere on the device |
+ * | **`sessionStorage`** | chosen. It survives a reload of THIS tab, dies with the tab, and never leaves the page. Script in the page can read it, exactly as it can already read the in-memory auth context this mirrors |
+ *
+ * "Dies with the tab" has one browser-defined exception worth stating: a DUPLICATED tab, and a tab opened by
+ * `window.open` without `noopener`, start with a COPY of the opener's `sessionStorage`. Such a tab can recover
+ * the same pending session — bounded by the same age ceiling below and the same server-side state check.
+ *
+ * Three rules keep the copy from outliving the session it describes, because a stale entry is a finished
+ * or abandoned session brought back:
+ * - ONE writer: `AuthSessionProvider` remembers and forgets from auth-state TRANSITIONS, never per call site;
+ * - explicit forgets on the terminal acts that do not pass through those transitions after a hard load —
+ *   logout, starting a new identification, and a recovery the server refuses;
+ * - a client-side ceiling ({@link PENDING_MFA_SESSION_MAX_AGE_MS}) measured from when the session FIRST
+ *   became pending, so re-remembering it on every recovery never extends its life.
+ *
+ * Nothing here is an authorization input. The server re-reads the session by id and admits second-factor
+ * work only on the states it allows; this module decides only whether the gate may ASK.
+ */
+/** The identity of a pending MFA session, as the enrollment gate needs it to recover one. */
+export interface PendingMfaSessionReference {
+    sessionId: string;
+    /** Pre-fills the challenge the gate may hand back to; empty when the session was recovered without it. */
+    email: string;
+}
+/**
+ * How long a remembered pending session may be recovered, from when it first became pending.
+ *
+ * Deliberately far shorter than the server's session lifetime: a second factor owed and not given within
+ * half an hour is an abandoned sign-in, and the cost of refusing to recover it is one sign-in. The cost of
+ * recovering it is handing an unattended tab's half-finished session to whoever uses that tab next.
+ */
+export declare const PENDING_MFA_SESSION_MAX_AGE_MS: number;
+/**
+ * Remember a session that owes a second factor. Re-remembering the SAME session keeps its original
+ * `rememberedAt` and, when the new reference carries no email, its known email — so a session recovered
+ * after a reload (which has no identification response behind it) neither loses its address nor resets
+ * its age.
+ */
+export declare function rememberPendingMfaSession(reference: PendingMfaSessionReference, now?: number): void;
+/**
+ * The remembered pending session, or `null`. An entry that is malformed or older than
+ * {@link PENDING_MFA_SESSION_MAX_AGE_MS} is FORGOTTEN on read, so it cannot be recovered on a later attempt
+ * either.
+ */
+export declare function readPendingMfaSession(now?: number): PendingMfaSessionReference | null;
+/** Forget the remembered pending session, if any. Safe to call when nothing is remembered. */
+export declare function forgetPendingMfaSession(): void;
+//# sourceMappingURL=pending-mfa-session-storage.frontend.utils.d.ts.map

package/dist/esm/core/security/pending-mfa-session-storage.frontend.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-mfa-session-storage.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/pending-mfa-session-storage.frontend.utils.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,6FAA6F;AAC7F,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,0GAA0G;IAC1G,KAAK,EAAE,MAAM,CAAC;CACf;AAOD;;;;;;GAMG;AACH,eAAO,MAAM,8BAA8B,EAAE,MAAuB,CAAC;AA8BrE;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,0BAA0B,EAAE,GAAG,GAAE,MAAmB,GAAG,IAAI,CAiB/G;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAmB,GAAG,0BAA0B,GAAG,IAAI,CAUjG;AAED,8FAA8F;AAC9F,wBAAgB,uBAAuB,IAAI,IAAI,CAM9C"}

package/dist/esm/core/security/pending-mfa-session-storage.frontend.utils.js

@@ -0,0 +1,88 @@
+import { SESSION_STORAGE_KEYS } from '../../core/commons/local-storage.frontend.schemas.js';
+/**
+ * How long a remembered pending session may be recovered, from when it first became pending.
+ *
+ * Deliberately far shorter than the server's session lifetime: a second factor owed and not given within
+ * half an hour is an abandoned sign-in, and the cost of refusing to recover it is one sign-in. The cost of
+ * recovering it is handing an unattended tab's half-finished session to whoever uses that tab next.
+ */
+export const PENDING_MFA_SESSION_MAX_AGE_MS = 30 * 60 * 1000;
+/**
+ * The tab's `sessionStorage`, or `undefined` when there is none — a non-browser realm, or a browser that
+ * refuses storage access. Probed through `globalThis` inside try/catch rather than by sniffing `window`, for
+ * the reason `client-instance-id.frontend.service.ts` records.
+ */
+function tabStorage() {
+    try {
+        return globalThis.sessionStorage ?? undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function readStored(area) {
+    try {
+        const raw = area.getItem(SESSION_STORAGE_KEYS.PENDING_MFA_SESSION);
+        if (!raw)
+            return null;
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed.sessionId !== 'string' || !parsed.sessionId
+            || typeof parsed.email !== 'string' || typeof parsed.rememberedAt !== 'number') {
+            return null;
+        }
+        return { sessionId: parsed.sessionId, email: parsed.email, rememberedAt: parsed.rememberedAt };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Remember a session that owes a second factor. Re-remembering the SAME session keeps its original
+ * `rememberedAt` and, when the new reference carries no email, its known email — so a session recovered
+ * after a reload (which has no identification response behind it) neither loses its address nor resets
+ * its age.
+ */
+export function rememberPendingMfaSession(reference, now = Date.now()) {
+    const area = tabStorage();
+    if (!area)
+        return;
+    const existing = readStored(area);
+    const sameSession = existing?.sessionId === reference.sessionId;
+    const stored = {
+        sessionId: reference.sessionId,
+        email: reference.email || (sameSession ? existing.email : ''),
+        rememberedAt: sameSession ? existing.rememberedAt : now,
+    };
+    try {
+        area.setItem(SESSION_STORAGE_KEYS.PENDING_MFA_SESSION, JSON.stringify(stored));
+    }
+    catch {
+        // Storage full or refused: the reload simply will not be recoverable, which is the prior behaviour.
+    }
+}
+/**
+ * The remembered pending session, or `null`. An entry that is malformed or older than
+ * {@link PENDING_MFA_SESSION_MAX_AGE_MS} is FORGOTTEN on read, so it cannot be recovered on a later attempt
+ * either.
+ */
+export function readPendingMfaSession(now = Date.now()) {
+    const area = tabStorage();
+    if (!area)
+        return null;
+    const stored = readStored(area);
+    if (!stored || now - stored.rememberedAt > PENDING_MFA_SESSION_MAX_AGE_MS || stored.rememberedAt > now) {
+        forgetPendingMfaSession();
+        return null;
+    }
+    return { sessionId: stored.sessionId, email: stored.email };
+}
+/** Forget the remembered pending session, if any. Safe to call when nothing is remembered. */
+export function forgetPendingMfaSession() {
+    try {
+        tabStorage()?.removeItem(SESSION_STORAGE_KEYS.PENDING_MFA_SESSION);
+    }
+    catch {
+        // Unavailable storage — nothing to forget there.
+    }
+}
+//# sourceMappingURL=pending-mfa-session-storage.frontend.utils.js.map

package/dist/esm/core/security/pending-mfa-session-storage.frontend.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-mfa-session-storage.frontend.utils.js","sourceRoot":"","sources":["../../../../../src/core/security/pending-mfa-session-storage.frontend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,iEAAiE,CAAC;AA2CvG;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAW,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAErE;;;;GAIG;AACH,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,OAAO,UAAU,CAAC,cAAc,IAAI,SAAS,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAa;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,CAAC;QACnE,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4C,CAAC;QAC1E,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS;eACnE,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YACjF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,SAAqC,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IACvG,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,IAAI,CAAC,IAAI;QAAE,OAAO;IAElB,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,WAAW,GAAG,QAAQ,EAAE,SAAS,KAAK,SAAS,CAAC,SAAS,CAAC;IAChE,MAAM,MAAM,GAA4B;QACtC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,KAAK,EAAE,SAAS,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,QAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,QAAS,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG;KACzD,CAAC;IAEF,IAAI,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,mBAAmB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,oGAAoG;IACtG,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,IAAI,CAAC,GAAG,EAAE;IAC5D,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,YAAY,GAAG,8BAA8B,IAAI,MAAM,CAAC,YAAY,GAAG,GAAG,EAAE,CAAC;QACvG,uBAAuB,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AAC9D,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,uBAAuB;IACrC,IAAI,CAAC;QACH,UAAU,EAAE,EAAE,UAAU,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;IACnD,CAAC;AACH,CAAC","sourcesContent":["import { SESSION_STORAGE_KEYS } from '~wildo-frontend-lib/core/commons/local-storage.frontend.schemas';\n\n/**\n * The tab-scoped memory of an MFA session that still owes a second factor (#1068).\n *\n * The auth context holds such a session only in memory, so a reload of the enrollment gate after an\n * in-app arrival used to lose it and cost a sign-in. Three places could have carried it across the reload,\n * and this is the one chosen:\n *\n * | option | why not / why |\n * |---|---|\n * | the gate URL | rejected. A REGISTRATION or INVITATION session reaches the gate this way on the ordinary path, issues tokens when a factor is enrolled, and lives 24h — its id would sit in browser history and every frontend/CDN request log |\n * | `localStorage` | rejected. It outlives the tab and is shared by every tab of the origin, so an abandoned sign-up would be recoverable long after, from anywhere on the device |\n * | **`sessionStorage`** | chosen. It survives a reload of THIS tab, dies with the tab, and never leaves the page. Script in the page can read it, exactly as it can already read the in-memory auth context this mirrors |\n *\n * \"Dies with the tab\" has one browser-defined exception worth stating: a DUPLICATED tab, and a tab opened by\n * `window.open` without `noopener`, start with a COPY of the opener's `sessionStorage`. Such a tab can recover\n * the same pending session — bounded by the same age ceiling below and the same server-side state check.\n *\n * Three rules keep the copy from outliving the session it describes, because a stale entry is a finished\n * or abandoned session brought back:\n * - ONE writer: `AuthSessionProvider` remembers and forgets from auth-state TRANSITIONS, never per call site;\n * - explicit forgets on the terminal acts that do not pass through those transitions after a hard load —\n *   logout, starting a new identification, and a recovery the server refuses;\n * - a client-side ceiling ({@link PENDING_MFA_SESSION_MAX_AGE_MS}) measured from when the session FIRST\n *   became pending, so re-remembering it on every recovery never extends its life.\n *\n * Nothing here is an authorization input. The server re-reads the session by id and admits second-factor\n * work only on the states it allows; this module decides only whether the gate may ASK.\n */\n\n/** The identity of a pending MFA session, as the enrollment gate needs it to recover one. */\nexport interface PendingMfaSessionReference {\n  sessionId: string;\n  /** Pre-fills the challenge the gate may hand back to; empty when the session was recovered without it. */\n  email: string;\n}\n\ninterface StoredPendingMfaSession extends PendingMfaSessionReference {\n  /** Epoch milliseconds at which this session FIRST became pending in this tab. */\n  rememberedAt: number;\n}\n\n/**\n * How long a remembered pending session may be recovered, from when it first became pending.\n *\n * Deliberately far shorter than the server's session lifetime: a second factor owed and not given within\n * half an hour is an abandoned sign-in, and the cost of refusing to recover it is one sign-in. The cost of\n * recovering it is handing an unattended tab's half-finished session to whoever uses that tab next.\n */\nexport const PENDING_MFA_SESSION_MAX_AGE_MS: number = 30 * 60 * 1000;\n\n/**\n * The tab's `sessionStorage`, or `undefined` when there is none — a non-browser realm, or a browser that\n * refuses storage access. Probed through `globalThis` inside try/catch rather than by sniffing `window`, for\n * the reason `client-instance-id.frontend.service.ts` records.\n */\nfunction tabStorage(): Storage | undefined {\n  try {\n    return globalThis.sessionStorage ?? undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction readStored(area: Storage): StoredPendingMfaSession | null {\n  try {\n    const raw = area.getItem(SESSION_STORAGE_KEYS.PENDING_MFA_SESSION);\n    if (!raw) return null;\n    const parsed = JSON.parse(raw) as Partial<StoredPendingMfaSession> | null;\n    if (!parsed || typeof parsed.sessionId !== 'string' || !parsed.sessionId\n      || typeof parsed.email !== 'string' || typeof parsed.rememberedAt !== 'number') {\n      return null;\n    }\n    return { sessionId: parsed.sessionId, email: parsed.email, rememberedAt: parsed.rememberedAt };\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Remember a session that owes a second factor. Re-remembering the SAME session keeps its original\n * `rememberedAt` and, when the new reference carries no email, its known email — so a session recovered\n * after a reload (which has no identification response behind it) neither loses its address nor resets\n * its age.\n */\nexport function rememberPendingMfaSession(reference: PendingMfaSessionReference, now: number = Date.now()): void {\n  const area = tabStorage();\n  if (!area) return;\n\n  const existing = readStored(area);\n  const sameSession = existing?.sessionId === reference.sessionId;\n  const stored: StoredPendingMfaSession = {\n    sessionId: reference.sessionId,\n    email: reference.email || (sameSession ? existing!.email : ''),\n    rememberedAt: sameSession ? existing!.rememberedAt : now,\n  };\n\n  try {\n    area.setItem(SESSION_STORAGE_KEYS.PENDING_MFA_SESSION, JSON.stringify(stored));\n  } catch {\n    // Storage full or refused: the reload simply will not be recoverable, which is the prior behaviour.\n  }\n}\n\n/**\n * The remembered pending session, or `null`. An entry that is malformed or older than\n * {@link PENDING_MFA_SESSION_MAX_AGE_MS} is FORGOTTEN on read, so it cannot be recovered on a later attempt\n * either.\n */\nexport function readPendingMfaSession(now: number = Date.now()): PendingMfaSessionReference | null {\n  const area = tabStorage();\n  if (!area) return null;\n\n  const stored = readStored(area);\n  if (!stored || now - stored.rememberedAt > PENDING_MFA_SESSION_MAX_AGE_MS || stored.rememberedAt > now) {\n    forgetPendingMfaSession();\n    return null;\n  }\n  return { sessionId: stored.sessionId, email: stored.email };\n}\n\n/** Forget the remembered pending session, if any. Safe to call when nothing is remembered. */\nexport function forgetPendingMfaSession(): void {\n  try {\n    tabStorage()?.removeItem(SESSION_STORAGE_KEYS.PENDING_MFA_SESSION);\n  } catch {\n    // Unavailable storage — nothing to forget there.\n  }\n}\n"]}

package/dist/esm/core/security/registration-outcome.frontend.utils.d.ts

@@ -0,0 +1,78 @@
+import type { RegisterAccountResponse } from '../../core/requests/wildo-http-client-manual-calls.frontend.service';
+/**
+ * What a public registration ANSWER means for the person who just submitted the form (#972).
+ *
+ * `POST /auth/register` does not have one outcome. Depending on the registrant's user-type policy it
+ * signs them in, parks them at a second-factor enrollment they owe, asks them to verify their address,
+ * or — for an address that already has an account — answers with a bare acknowledgement. The registration
+ * screen used to ignore all of that and announce "check your
+ * email" for every answer, which sent a registrant who had to enroll a second factor away without the
+ * session that enrollment completes, and told one who had just been signed in to go and verify.
+ *
+ * This is the ONE classification of that answer. `AuthSessionContext.registerAccount` adopts the auth
+ * state from it and the registration screen renders from it, so the two cannot disagree about which
+ * outcome an answer was. Separately-written predicates over the same answer are how the auth screens
+ * came to disagree before: their MFA routing copies differed on whether `availableEnrollmentMethods`
+ * or the usable-factor set decided enrollment.
+ */
+export declare enum RegistrationOutcome {
+    /**
+     * The registration pipeline COMPLETED (or entered the enrollment grace period) and an access token
+     * came back. The person is signed in; the refresh token arrived as an HttpOnly cookie.
+     */
+    SIGNED_IN = "signed_in",
+    /**
+     * The user type requires a second factor with no grace period and nothing is enrolled. The answer
+     * carries the registration session; enrolling on the enrollment gate completes it and signs the
+     * person in (#603). Tokens are deliberately withheld until then.
+     */
+    MFA_ENROLLMENT_REQUIRED = "mfa_enrollment_required",
+    /**
+     * The account exists and its address must be verified before it can sign in — OR the address
+     * already had an account. Both are the same answer: the bare acknowledgement.
+     *
+     * Since #1010 that sameness is the BACKEND's, not only this screen's. Under verification-required
+     * registration a new account's answer no longer carries a registration session (`sessionId`,
+     * `state: REGISTERED`) — the emailed link is the continuation — so the wire cannot tell a new address
+     * from a registered one either. Deferred verification is different by construction: it signs a new
+     * registrant in on the spot, which no acknowledgement can imitate.
+     */
+    EMAIL_VERIFICATION_PENDING = "email_verification_pending",
+    /** The address belongs to a domain whose organization enforces single sign-on; self-registration was refused. */
+    SSO_REDIRECT_REQUIRED = "sso_redirect_required",
+    /**
+     * A password-less registration: the account exists and a magic link is on its way. Clicking it proves
+     * the address and signs the person in, so there is no verification email to resend.
+     */
+    MAGIC_LINK_SENT = "magic_link_sent",
+    /**
+     * A passkey registration (#1093): the account exists, a magic link is on its way, and the passkey is
+     * enrolled once the link has signed the person in — a passkey proves an authenticator, never an
+     * address, so public passkey sign-up routes through the link. Like MAGIC_LINK_SENT, nothing to resend.
+     */
+    PASSKEY_ENROLLMENT_PENDING = "passkey_enrollment_pending",
+    /**
+     * The account's user type names its organization at onboarding and the answer parked the registration
+     * session there (`state: ONBOARDING_PENDING`, #1011). The context adopts the session and the person is sent
+     * to the organization-onboarding step, which creates the organization and signs them in (#1090).
+     */
+    ORGANIZATION_ONBOARDING_REQUIRED = "organization_onboarding_required",
+    /**
+     * Anything else: the account was (or may have been) created, but the answer names a step this screen
+     * does not carry out — an enrollment or onboarding answer with no session to continue on, or a state
+     * added to the pipeline after this was written. Rendered as
+     * "not finished, sign in to continue"; never as "complete".
+     */
+    UNFINISHED = "unfinished"
+}
+/**
+ * Classify a registration answer. Order matters and is the precedence the backend's branches imply:
+ * a signed-in answer wins; the SSO refusal and the magic-link answer carry no session state; an
+ * answer with no state, no next step and no session is the acknowledgement — a new account awaiting
+ * address verification and an already-registered address alike (#1010).
+ *
+ * There is no `state: REGISTERED` branch: no registration answer carries that state any more, so an
+ * answer that did would be one this was not written for, and lands in UNFINISHED like any other.
+ */
+export declare function classifyRegistrationOutcome(response: RegisterAccountResponse): RegistrationOutcome;
+//# sourceMappingURL=registration-outcome.frontend.utils.d.ts.map

package/dist/esm/core/security/registration-outcome.frontend.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration-outcome.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/registration-outcome.frontend.utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mFAAmF,CAAC;AAGjI;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,mBAAmB;IAC7B;;;OAGG;IACH,SAAS,cAAc;IACvB;;;;OAIG;IACH,uBAAuB,4BAA4B;IACnD;;;;;;;;;OASG;IACH,0BAA0B,+BAA+B;IACzD,iHAAiH;IACjH,qBAAqB,0BAA0B;IAC/C;;;OAGG;IACH,eAAe,oBAAoB;IACnC;;;;OAIG;IACH,0BAA0B,+BAA+B;IACzD;;;;OAIG;IACH,gCAAgC,qCAAqC;IACrE;;;;;OAKG;IACH,UAAU,eAAe;CAC1B;AAYD;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,uBAAuB,GAAG,mBAAmB,CAgClG"}

package/dist/esm/core/security/registration-outcome.frontend.utils.js

@@ -0,0 +1,114 @@
+import { AuthenticationSessionState, AuthNextStep } from '@wildo-ai/saas-models';
+import { parkedOrganizationOnboardingSessionId } from '../../core/security/organization-onboarding.frontend.utils.js';
+/**
+ * What a public registration ANSWER means for the person who just submitted the form (#972).
+ *
+ * `POST /auth/register` does not have one outcome. Depending on the registrant's user-type policy it
+ * signs them in, parks them at a second-factor enrollment they owe, asks them to verify their address,
+ * or — for an address that already has an account — answers with a bare acknowledgement. The registration
+ * screen used to ignore all of that and announce "check your
+ * email" for every answer, which sent a registrant who had to enroll a second factor away without the
+ * session that enrollment completes, and told one who had just been signed in to go and verify.
+ *
+ * This is the ONE classification of that answer. `AuthSessionContext.registerAccount` adopts the auth
+ * state from it and the registration screen renders from it, so the two cannot disagree about which
+ * outcome an answer was. Separately-written predicates over the same answer are how the auth screens
+ * came to disagree before: their MFA routing copies differed on whether `availableEnrollmentMethods`
+ * or the usable-factor set decided enrollment.
+ */
+export var RegistrationOutcome;
+(function (RegistrationOutcome) {
+    /**
+     * The registration pipeline COMPLETED (or entered the enrollment grace period) and an access token
+     * came back. The person is signed in; the refresh token arrived as an HttpOnly cookie.
+     */
+    RegistrationOutcome["SIGNED_IN"] = "signed_in";
+    /**
+     * The user type requires a second factor with no grace period and nothing is enrolled. The answer
+     * carries the registration session; enrolling on the enrollment gate completes it and signs the
+     * person in (#603). Tokens are deliberately withheld until then.
+     */
+    RegistrationOutcome["MFA_ENROLLMENT_REQUIRED"] = "mfa_enrollment_required";
+    /**
+     * The account exists and its address must be verified before it can sign in — OR the address
+     * already had an account. Both are the same answer: the bare acknowledgement.
+     *
+     * Since #1010 that sameness is the BACKEND's, not only this screen's. Under verification-required
+     * registration a new account's answer no longer carries a registration session (`sessionId`,
+     * `state: REGISTERED`) — the emailed link is the continuation — so the wire cannot tell a new address
+     * from a registered one either. Deferred verification is different by construction: it signs a new
+     * registrant in on the spot, which no acknowledgement can imitate.
+     */
+    RegistrationOutcome["EMAIL_VERIFICATION_PENDING"] = "email_verification_pending";
+    /** The address belongs to a domain whose organization enforces single sign-on; self-registration was refused. */
+    RegistrationOutcome["SSO_REDIRECT_REQUIRED"] = "sso_redirect_required";
+    /**
+     * A password-less registration: the account exists and a magic link is on its way. Clicking it proves
+     * the address and signs the person in, so there is no verification email to resend.
+     */
+    RegistrationOutcome["MAGIC_LINK_SENT"] = "magic_link_sent";
+    /**
+     * A passkey registration (#1093): the account exists, a magic link is on its way, and the passkey is
+     * enrolled once the link has signed the person in — a passkey proves an authenticator, never an
+     * address, so public passkey sign-up routes through the link. Like MAGIC_LINK_SENT, nothing to resend.
+     */
+    RegistrationOutcome["PASSKEY_ENROLLMENT_PENDING"] = "passkey_enrollment_pending";
+    /**
+     * The account's user type names its organization at onboarding and the answer parked the registration
+     * session there (`state: ONBOARDING_PENDING`, #1011). The context adopts the session and the person is sent
+     * to the organization-onboarding step, which creates the organization and signs them in (#1090).
+     */
+    RegistrationOutcome["ORGANIZATION_ONBOARDING_REQUIRED"] = "organization_onboarding_required";
+    /**
+     * Anything else: the account was (or may have been) created, but the answer names a step this screen
+     * does not carry out — an enrollment or onboarding answer with no session to continue on, or a state
+     * added to the pipeline after this was written. Rendered as
+     * "not finished, sign in to continue"; never as "complete".
+     */
+    RegistrationOutcome["UNFINISHED"] = "unfinished";
+})(RegistrationOutcome || (RegistrationOutcome = {}));
+/**
+ * The session states in which the registration pipeline issues tokens — the backend's own issuance
+ * predicate (`registerUser`, deferred-verification branch), restated as data so a token arriving beside
+ * any OTHER state is not adopted as a finished sign-in.
+ */
+const TOKEN_ISSUING_REGISTRATION_STATES = new Set([
+    AuthenticationSessionState.COMPLETED,
+    AuthenticationSessionState.MFA_ENROLLMENT_GRACE,
+]);
+/**
+ * Classify a registration answer. Order matters and is the precedence the backend's branches imply:
+ * a signed-in answer wins; the SSO refusal and the magic-link answer carry no session state; an
+ * answer with no state, no next step and no session is the acknowledgement — a new account awaiting
+ * address verification and an already-registered address alike (#1010).
+ *
+ * There is no `state: REGISTERED` branch: no registration answer carries that state any more, so an
+ * answer that did would be one this was not written for, and lands in UNFINISHED like any other.
+ */
+export function classifyRegistrationOutcome(response) {
+    if (response.accessToken && response.state !== undefined && TOKEN_ISSUING_REGISTRATION_STATES.has(response.state)) {
+        return RegistrationOutcome.SIGNED_IN;
+    }
+    if (response.ssoRedirectHint === true) {
+        return RegistrationOutcome.SSO_REDIRECT_REQUIRED;
+    }
+    if (response.state === AuthenticationSessionState.MFA_ENROLLMENT_REQUIRED) {
+        // The gate enrolls ON the session. Without one there is nothing to complete, and routing there would
+        // strand the person on a screen that bounces them to sign-in.
+        return response.sessionId ? RegistrationOutcome.MFA_ENROLLMENT_REQUIRED : RegistrationOutcome.UNFINISHED;
+    }
+    if (parkedOrganizationOnboardingSessionId(response)) {
+        return RegistrationOutcome.ORGANIZATION_ONBOARDING_REQUIRED;
+    }
+    if (response.nextStep === AuthNextStep.MAGIC_LINK_SENT) {
+        return RegistrationOutcome.MAGIC_LINK_SENT;
+    }
+    if (response.nextStep === AuthNextStep.PASSKEY_ENROLLMENT) {
+        return RegistrationOutcome.PASSKEY_ENROLLMENT_PENDING;
+    }
+    if (response.state === undefined && response.nextStep === undefined && response.sessionId === undefined && !response.accessToken) {
+        return RegistrationOutcome.EMAIL_VERIFICATION_PENDING;
+    }
+    return RegistrationOutcome.UNFINISHED;
+}
+//# sourceMappingURL=registration-outcome.frontend.utils.js.map

package/dist/esm/core/security/registration-outcome.frontend.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration-outcome.frontend.utils.js","sourceRoot":"","sources":["../../../../../src/core/security/registration-outcome.frontend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAEjF,OAAO,EAAE,qCAAqC,EAAE,MAAM,0EAA0E,CAAC;AAEjI;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAN,IAAY,mBAiDX;AAjDD,WAAY,mBAAmB;IAC7B;;;OAGG;IACH,8CAAuB,CAAA;IACvB;;;;OAIG;IACH,0EAAmD,CAAA;IACnD;;;;;;;;;OASG;IACH,gFAAyD,CAAA;IACzD,iHAAiH;IACjH,sEAA+C,CAAA;IAC/C;;;OAGG;IACH,0DAAmC,CAAA;IACnC;;;;OAIG;IACH,gFAAyD,CAAA;IACzD;;;;OAIG;IACH,4FAAqE,CAAA;IACrE;;;;;OAKG;IACH,gDAAyB,CAAA;AAC3B,CAAC,EAjDW,mBAAmB,KAAnB,mBAAmB,QAiD9B;AAED;;;;GAIG;AACH,MAAM,iCAAiC,GAA4C,IAAI,GAAG,CAAC;IACzF,0BAA0B,CAAC,SAAS;IACpC,0BAA0B,CAAC,oBAAoB;CAChD,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,UAAU,2BAA2B,CAAC,QAAiC;IAC3E,IAAI,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,IAAI,iCAAiC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAClH,OAAO,mBAAmB,CAAC,SAAS,CAAC;IACvC,CAAC;IAED,IAAI,QAAQ,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;QACtC,OAAO,mBAAmB,CAAC,qBAAqB,CAAC;IACnD,CAAC;IAED,IAAI,QAAQ,CAAC,KAAK,KAAK,0BAA0B,CAAC,uBAAuB,EAAE,CAAC;QAC1E,qGAAqG;QACrG,8DAA8D;QAC9D,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,uBAAuB,CAAC,CAAC,CAAC,mBAAmB,CAAC,UAAU,CAAC;IAC3G,CAAC;IAED,IAAI,qCAAqC,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,OAAO,mBAAmB,CAAC,gCAAgC,CAAC;IAC9D,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,YAAY,CAAC,eAAe,EAAE,CAAC;QACvD,OAAO,mBAAmB,CAAC,eAAe,CAAC;IAC7C,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,YAAY,CAAC,kBAAkB,EAAE,CAAC;QAC1D,OAAO,mBAAmB,CAAC,0BAA0B,CAAC;IACxD,CAAC;IAED,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACjI,OAAO,mBAAmB,CAAC,0BAA0B,CAAC;IACxD,CAAC;IAED,OAAO,mBAAmB,CAAC,UAAU,CAAC;AACxC,CAAC","sourcesContent":["import { AuthenticationSessionState, AuthNextStep } from '@wildo-ai/saas-models';\nimport type { RegisterAccountResponse } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport { parkedOrganizationOnboardingSessionId } from '~wildo-frontend-lib/core/security/organization-onboarding.frontend.utils';\n\n/**\n * What a public registration ANSWER means for the person who just submitted the form (#972).\n *\n * `POST /auth/register` does not have one outcome. Depending on the registrant's user-type policy it\n * signs them in, parks them at a second-factor enrollment they owe, asks them to verify their address,\n * or — for an address that already has an account — answers with a bare acknowledgement. The registration\n * screen used to ignore all of that and announce \"check your\n * email\" for every answer, which sent a registrant who had to enroll a second factor away without the\n * session that enrollment completes, and told one who had just been signed in to go and verify.\n *\n * This is the ONE classification of that answer. `AuthSessionContext.registerAccount` adopts the auth\n * state from it and the registration screen renders from it, so the two cannot disagree about which\n * outcome an answer was. Separately-written predicates over the same answer are how the auth screens\n * came to disagree before: their MFA routing copies differed on whether `availableEnrollmentMethods`\n * or the usable-factor set decided enrollment.\n */\nexport enum RegistrationOutcome {\n  /**\n   * The registration pipeline COMPLETED (or entered the enrollment grace period) and an access token\n   * came back. The person is signed in; the refresh token arrived as an HttpOnly cookie.\n   */\n  SIGNED_IN = 'signed_in',\n  /**\n   * The user type requires a second factor with no grace period and nothing is enrolled. The answer\n   * carries the registration session; enrolling on the enrollment gate completes it and signs the\n   * person in (#603). Tokens are deliberately withheld until then.\n   */\n  MFA_ENROLLMENT_REQUIRED = 'mfa_enrollment_required',\n  /**\n   * The account exists and its address must be verified before it can sign in — OR the address\n   * already had an account. Both are the same answer: the bare acknowledgement.\n   *\n   * Since #1010 that sameness is the BACKEND's, not only this screen's. Under verification-required\n   * registration a new account's answer no longer carries a registration session (`sessionId`,\n   * `state: REGISTERED`) — the emailed link is the continuation — so the wire cannot tell a new address\n   * from a registered one either. Deferred verification is different by construction: it signs a new\n   * registrant in on the spot, which no acknowledgement can imitate.\n   */\n  EMAIL_VERIFICATION_PENDING = 'email_verification_pending',\n  /** The address belongs to a domain whose organization enforces single sign-on; self-registration was refused. */\n  SSO_REDIRECT_REQUIRED = 'sso_redirect_required',\n  /**\n   * A password-less registration: the account exists and a magic link is on its way. Clicking it proves\n   * the address and signs the person in, so there is no verification email to resend.\n   */\n  MAGIC_LINK_SENT = 'magic_link_sent',\n  /**\n   * A passkey registration (#1093): the account exists, a magic link is on its way, and the passkey is\n   * enrolled once the link has signed the person in — a passkey proves an authenticator, never an\n   * address, so public passkey sign-up routes through the link. Like MAGIC_LINK_SENT, nothing to resend.\n   */\n  PASSKEY_ENROLLMENT_PENDING = 'passkey_enrollment_pending',\n  /**\n   * The account's user type names its organization at onboarding and the answer parked the registration\n   * session there (`state: ONBOARDING_PENDING`, #1011). The context adopts the session and the person is sent\n   * to the organization-onboarding step, which creates the organization and signs them in (#1090).\n   */\n  ORGANIZATION_ONBOARDING_REQUIRED = 'organization_onboarding_required',\n  /**\n   * Anything else: the account was (or may have been) created, but the answer names a step this screen\n   * does not carry out — an enrollment or onboarding answer with no session to continue on, or a state\n   * added to the pipeline after this was written. Rendered as\n   * \"not finished, sign in to continue\"; never as \"complete\".\n   */\n  UNFINISHED = 'unfinished',\n}\n\n/**\n * The session states in which the registration pipeline issues tokens — the backend's own issuance\n * predicate (`registerUser`, deferred-verification branch), restated as data so a token arriving beside\n * any OTHER state is not adopted as a finished sign-in.\n */\nconst TOKEN_ISSUING_REGISTRATION_STATES: ReadonlySet<AuthenticationSessionState> = new Set([\n  AuthenticationSessionState.COMPLETED,\n  AuthenticationSessionState.MFA_ENROLLMENT_GRACE,\n]);\n\n/**\n * Classify a registration answer. Order matters and is the precedence the backend's branches imply:\n * a signed-in answer wins; the SSO refusal and the magic-link answer carry no session state; an\n * answer with no state, no next step and no session is the acknowledgement — a new account awaiting\n * address verification and an already-registered address alike (#1010).\n *\n * There is no `state: REGISTERED` branch: no registration answer carries that state any more, so an\n * answer that did would be one this was not written for, and lands in UNFINISHED like any other.\n */\nexport function classifyRegistrationOutcome(response: RegisterAccountResponse): RegistrationOutcome {\n  if (response.accessToken && response.state !== undefined && TOKEN_ISSUING_REGISTRATION_STATES.has(response.state)) {\n    return RegistrationOutcome.SIGNED_IN;\n  }\n\n  if (response.ssoRedirectHint === true) {\n    return RegistrationOutcome.SSO_REDIRECT_REQUIRED;\n  }\n\n  if (response.state === AuthenticationSessionState.MFA_ENROLLMENT_REQUIRED) {\n    // The gate enrolls ON the session. Without one there is nothing to complete, and routing there would\n    // strand the person on a screen that bounces them to sign-in.\n    return response.sessionId ? RegistrationOutcome.MFA_ENROLLMENT_REQUIRED : RegistrationOutcome.UNFINISHED;\n  }\n\n  if (parkedOrganizationOnboardingSessionId(response)) {\n    return RegistrationOutcome.ORGANIZATION_ONBOARDING_REQUIRED;\n  }\n\n  if (response.nextStep === AuthNextStep.MAGIC_LINK_SENT) {\n    return RegistrationOutcome.MAGIC_LINK_SENT;\n  }\n\n  if (response.nextStep === AuthNextStep.PASSKEY_ENROLLMENT) {\n    return RegistrationOutcome.PASSKEY_ENROLLMENT_PENDING;\n  }\n\n  if (response.state === undefined && response.nextStep === undefined && response.sessionId === undefined && !response.accessToken) {\n    return RegistrationOutcome.EMAIL_VERIFICATION_PENDING;\n  }\n\n  return RegistrationOutcome.UNFINISHED;\n}\n"]}

package/dist/esm/core/security/route-organization-access.frontend.utils.d.ts

@@ -0,0 +1,75 @@
+import { OrganizationMemberStatus } from '@wildo-ai/saas-models';
+import type { AnyFrontendResourceConfiguration, FrontendResourceConfiguration_Operation } from '../../core/resources/resources.frontend.schemas';
+/**
+ * Whether the signed-in account may open the organization a route addresses (`/organizations/:id/…`).
+ *
+ * ## Why the route needs its own answer
+ *
+ * The AppScope organization is membership-checked: `UserOrgsContext` only commits an organization the
+ * account belongs to. A route's organization segment is not. `ScopeUtilsService.buildResourceOperationContextIdentifiers`
+ * places the URL's identifiers LAST, so they override the checked scope, and the page issues its reads
+ * against whatever organization the link names. The link is not always the account's own: a session
+ * that expires on `/organizations/A/tasks` saves that URL as the post-login `redirect`, and a DIFFERENT
+ * account signing in is sent straight to it. Every read then answered 403, and the person was left on
+ * a page that could never load.
+ *
+ * ## Why the server decides, and the membership list only short-circuits
+ *
+ * The user context embeds `organizationMembers`, but that array is a context projection capped at
+ * `DEFAULT_RELATIONSHIP_CONTEXT_POLICY.limit` (20, newest first) and "cannot say it was truncated".
+ * A refusal computed from it would eject a member of a 21st organization, and it would also eject a
+ * platform operator on a crossing the server admits. So an ACTIVE membership found in the list is
+ * trusted (a positive answer cannot be invented by truncation), and anything else is asked of the
+ * server with one silent READ of the organization. Only a refusal from that READ redirects.
+ */
+export declare enum RouteOrganizationAccess {
+    /** The current route carries no organization segment. There is nothing to decide. */
+    NOT_ADDRESSED = "NOT_ADDRESSED",
+    /**
+     * The route addresses an organization, but the session cannot be judged yet or at all: restore is
+     * unresolved, no user context was loaded, or the loaded user is not the token's subject (a stale
+     * context from the previous account). The route renders as it would without this check.
+     */
+    UNDECIDABLE = "UNDECIDABLE",
+    /** The loaded user context carries an ACTIVE membership in the addressed organization. No request is made. */
+    ACTIVE_MEMBERSHIP = "ACTIVE_MEMBERSHIP",
+    /** No active membership is known, and the server is being asked. The page must not load meanwhile. */
+    VERIFYING = "VERIFYING",
+    /** The server answered the organization READ. The account may open it (a membership past the context cap, or an admitted crossing). */
+    ADMITTED = "ADMITTED",
+    /**
+     * The server refused the organization READ (403, or the deliberate 404 a non-member receives so the
+     * answer is not an existence oracle). The route must not render.
+     *
+     * A link to an organization that does not exist lands here too, and on purpose: the server answers it
+     * with the same 404, so the frontend cannot tell the two apart, and must not try to.
+     */
+    REFUSED = "REFUSED",
+    /**
+     * The READ failed for a reason that says nothing about access (network, 5xx, no READ operation mounted).
+     * The route renders, and its own requests report whatever is wrong: a transient failure must never
+     * eject someone from a page they may open.
+     */
+    INCONCLUSIVE = "INCONCLUSIVE"
+}
+/** The membership fields this decision reads, structurally, so the check does not depend on the context's population shape. */
+export interface RouteOrganizationMembershipFacts {
+    organizationId?: string | null;
+    status?: OrganizationMemberStatus | string | null;
+}
+/**
+ * True when the memberships carry an ACTIVE membership in `organizationId`.
+ *
+ * Only ACTIVE counts: an INVITED, INACTIVE or SUSPENDED membership confers no access on the server, so
+ * treating it as a pass would let exactly the refused reads through. Such a membership falls through to
+ * the server probe instead, which answers correctly either way.
+ */
+export declare function hasActiveMembershipInOrganization(memberships: ReadonlyArray<RouteOrganizationMembershipFacts> | null | undefined, organizationId: string): boolean;
+/**
+ * The default, non-bulk API READ of a resource — the operation that fetches one row by its identifier.
+ *
+ * Shared by the session's organization loading and the route access probe, which must address the same
+ * operation: if they disagreed, the probe could admit an organization the session cannot load.
+ */
+export declare function findDefaultApiReadOperation(resourceConfiguration: AnyFrontendResourceConfiguration | undefined): FrontendResourceConfiguration_Operation | undefined;
+//# sourceMappingURL=route-organization-access.frontend.utils.d.ts.map

package/dist/esm/core/security/route-organization-access.frontend.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-organization-access.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/route-organization-access.frontend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,wBAAwB,EAEzB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EACV,gCAAgC,EAChC,uCAAuC,EACxC,MAAM,+DAA+D,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,oBAAY,uBAAuB;IACjC,qFAAqF;IACrF,aAAa,kBAAkB;IAC/B;;;;OAIG;IACH,WAAW,gBAAgB;IAC3B,8GAA8G;IAC9G,iBAAiB,sBAAsB;IACvC,sGAAsG;IACtG,SAAS,cAAc;IACvB,uIAAuI;IACvI,QAAQ,aAAa;IACrB;;;;;;OAMG;IACH,OAAO,YAAY;IACnB;;;;OAIG;IACH,YAAY,iBAAiB;CAC9B;AAED,+HAA+H;AAC/H,MAAM,WAAW,gCAAgC;IAC/C,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,MAAM,CAAC,EAAE,wBAAwB,GAAG,MAAM,GAAG,IAAI,CAAC;CACnD;AAED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAC/C,WAAW,EAAE,aAAa,CAAC,gCAAgC,CAAC,GAAG,IAAI,GAAG,SAAS,EAC/E,cAAc,EAAE,MAAM,GACrB,OAAO,CAIT;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,qBAAqB,EAAE,gCAAgC,GAAG,SAAS,GAClE,uCAAuC,GAAG,SAAS,CAWrD"}

package/dist/esm/core/security/route-organization-access.frontend.utils.js

@@ -0,0 +1,78 @@
+import { CoreResourceOperation, OrganizationMemberStatus, ResourceOperationVariantType, } from '@wildo-ai/saas-models';
+/**
+ * Whether the signed-in account may open the organization a route addresses (`/organizations/:id/…`).
+ *
+ * ## Why the route needs its own answer
+ *
+ * The AppScope organization is membership-checked: `UserOrgsContext` only commits an organization the
+ * account belongs to. A route's organization segment is not. `ScopeUtilsService.buildResourceOperationContextIdentifiers`
+ * places the URL's identifiers LAST, so they override the checked scope, and the page issues its reads
+ * against whatever organization the link names. The link is not always the account's own: a session
+ * that expires on `/organizations/A/tasks` saves that URL as the post-login `redirect`, and a DIFFERENT
+ * account signing in is sent straight to it. Every read then answered 403, and the person was left on
+ * a page that could never load.
+ *
+ * ## Why the server decides, and the membership list only short-circuits
+ *
+ * The user context embeds `organizationMembers`, but that array is a context projection capped at
+ * `DEFAULT_RELATIONSHIP_CONTEXT_POLICY.limit` (20, newest first) and "cannot say it was truncated".
+ * A refusal computed from it would eject a member of a 21st organization, and it would also eject a
+ * platform operator on a crossing the server admits. So an ACTIVE membership found in the list is
+ * trusted (a positive answer cannot be invented by truncation), and anything else is asked of the
+ * server with one silent READ of the organization. Only a refusal from that READ redirects.
+ */
+export var RouteOrganizationAccess;
+(function (RouteOrganizationAccess) {
+    /** The current route carries no organization segment. There is nothing to decide. */
+    RouteOrganizationAccess["NOT_ADDRESSED"] = "NOT_ADDRESSED";
+    /**
+     * The route addresses an organization, but the session cannot be judged yet or at all: restore is
+     * unresolved, no user context was loaded, or the loaded user is not the token's subject (a stale
+     * context from the previous account). The route renders as it would without this check.
+     */
+    RouteOrganizationAccess["UNDECIDABLE"] = "UNDECIDABLE";
+    /** The loaded user context carries an ACTIVE membership in the addressed organization. No request is made. */
+    RouteOrganizationAccess["ACTIVE_MEMBERSHIP"] = "ACTIVE_MEMBERSHIP";
+    /** No active membership is known, and the server is being asked. The page must not load meanwhile. */
+    RouteOrganizationAccess["VERIFYING"] = "VERIFYING";
+    /** The server answered the organization READ. The account may open it (a membership past the context cap, or an admitted crossing). */
+    RouteOrganizationAccess["ADMITTED"] = "ADMITTED";
+    /**
+     * The server refused the organization READ (403, or the deliberate 404 a non-member receives so the
+     * answer is not an existence oracle). The route must not render.
+     *
+     * A link to an organization that does not exist lands here too, and on purpose: the server answers it
+     * with the same 404, so the frontend cannot tell the two apart, and must not try to.
+     */
+    RouteOrganizationAccess["REFUSED"] = "REFUSED";
+    /**
+     * The READ failed for a reason that says nothing about access (network, 5xx, no READ operation mounted).
+     * The route renders, and its own requests report whatever is wrong: a transient failure must never
+     * eject someone from a page they may open.
+     */
+    RouteOrganizationAccess["INCONCLUSIVE"] = "INCONCLUSIVE";
+})(RouteOrganizationAccess || (RouteOrganizationAccess = {}));
+/**
+ * True when the memberships carry an ACTIVE membership in `organizationId`.
+ *
+ * Only ACTIVE counts: an INVITED, INACTIVE or SUSPENDED membership confers no access on the server, so
+ * treating it as a pass would let exactly the refused reads through. Such a membership falls through to
+ * the server probe instead, which answers correctly either way.
+ */
+export function hasActiveMembershipInOrganization(memberships, organizationId) {
+    return (memberships ?? []).some((membership) => membership.organizationId === organizationId && membership.status === OrganizationMemberStatus.ACTIVE);
+}
+/**
+ * The default, non-bulk API READ of a resource — the operation that fetches one row by its identifier.
+ *
+ * Shared by the session's organization loading and the route access probe, which must address the same
+ * operation: if they disagreed, the probe could admit an organization the session cannot load.
+ */
+export function findDefaultApiReadOperation(resourceConfiguration) {
+    return resourceConfiguration?.operations?.find((operation) => operation.operationIdentifier === CoreResourceOperation.READ
+        && operation.isOperationDefault === true
+        && operation.isBulkOperation !== true
+        && (operation.variantType === ResourceOperationVariantType.API_CALL
+            || operation.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK));
+}
+//# sourceMappingURL=route-organization-access.frontend.utils.js.map

package/dist/esm/core/security/route-organization-access.frontend.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-organization-access.frontend.utils.js","sourceRoot":"","sources":["../../../../../src/core/security/route-organization-access.frontend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAM/B;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAN,IAAY,uBA6BX;AA7BD,WAAY,uBAAuB;IACjC,qFAAqF;IACrF,0DAA+B,CAAA;IAC/B;;;;OAIG;IACH,sDAA2B,CAAA;IAC3B,8GAA8G;IAC9G,kEAAuC,CAAA;IACvC,sGAAsG;IACtG,kDAAuB,CAAA;IACvB,uIAAuI;IACvI,gDAAqB,CAAA;IACrB;;;;;;OAMG;IACH,8CAAmB,CAAA;IACnB;;;;OAIG;IACH,wDAA6B,CAAA;AAC/B,CAAC,EA7BW,uBAAuB,KAAvB,uBAAuB,QA6BlC;AAQD;;;;;;GAMG;AACH,MAAM,UAAU,iCAAiC,CAC/C,WAA+E,EAC/E,cAAsB;IAEtB,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,CAC7B,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,cAAc,KAAK,cAAc,IAAI,UAAU,CAAC,MAAM,KAAK,wBAAwB,CAAC,MAAM,CACtH,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,qBAAmE;IAEnE,OAAO,qBAAqB,EAAE,UAAU,EAAE,IAAI,CAC5C,CAAC,SAAkD,EAAE,EAAE,CACrD,SAAS,CAAC,mBAAmB,KAAK,qBAAqB,CAAC,IAAI;WACzD,SAAS,CAAC,kBAAkB,KAAK,IAAI;WACrC,SAAS,CAAC,eAAe,KAAK,IAAI;WAClC,CACD,SAAS,CAAC,WAAW,KAAK,4BAA4B,CAAC,QAAQ;eAC5D,SAAS,CAAC,WAAW,KAAK,4BAA4B,CAAC,sBAAsB,CACjF,CACJ,CAAC;AACJ,CAAC","sourcesContent":["import {\n  CoreResourceOperation,\n  OrganizationMemberStatus,\n  ResourceOperationVariantType,\n} from '@wildo-ai/saas-models';\nimport type {\n  AnyFrontendResourceConfiguration,\n  FrontendResourceConfiguration_Operation,\n} from '~wildo-frontend-lib/core/resources/resources.frontend.schemas';\n\n/**\n * Whether the signed-in account may open the organization a route addresses (`/organizations/:id/…`).\n *\n * ## Why the route needs its own answer\n *\n * The AppScope organization is membership-checked: `UserOrgsContext` only commits an organization the\n * account belongs to. A route's organization segment is not. `ScopeUtilsService.buildResourceOperationContextIdentifiers`\n * places the URL's identifiers LAST, so they override the checked scope, and the page issues its reads\n * against whatever organization the link names. The link is not always the account's own: a session\n * that expires on `/organizations/A/tasks` saves that URL as the post-login `redirect`, and a DIFFERENT\n * account signing in is sent straight to it. Every read then answered 403, and the person was left on\n * a page that could never load.\n *\n * ## Why the server decides, and the membership list only short-circuits\n *\n * The user context embeds `organizationMembers`, but that array is a context projection capped at\n * `DEFAULT_RELATIONSHIP_CONTEXT_POLICY.limit` (20, newest first) and \"cannot say it was truncated\".\n * A refusal computed from it would eject a member of a 21st organization, and it would also eject a\n * platform operator on a crossing the server admits. So an ACTIVE membership found in the list is\n * trusted (a positive answer cannot be invented by truncation), and anything else is asked of the\n * server with one silent READ of the organization. Only a refusal from that READ redirects.\n */\nexport enum RouteOrganizationAccess {\n  /** The current route carries no organization segment. There is nothing to decide. */\n  NOT_ADDRESSED = 'NOT_ADDRESSED',\n  /**\n   * The route addresses an organization, but the session cannot be judged yet or at all: restore is\n   * unresolved, no user context was loaded, or the loaded user is not the token's subject (a stale\n   * context from the previous account). The route renders as it would without this check.\n   */\n  UNDECIDABLE = 'UNDECIDABLE',\n  /** The loaded user context carries an ACTIVE membership in the addressed organization. No request is made. */\n  ACTIVE_MEMBERSHIP = 'ACTIVE_MEMBERSHIP',\n  /** No active membership is known, and the server is being asked. The page must not load meanwhile. */\n  VERIFYING = 'VERIFYING',\n  /** The server answered the organization READ. The account may open it (a membership past the context cap, or an admitted crossing). */\n  ADMITTED = 'ADMITTED',\n  /**\n   * The server refused the organization READ (403, or the deliberate 404 a non-member receives so the\n   * answer is not an existence oracle). The route must not render.\n   *\n   * A link to an organization that does not exist lands here too, and on purpose: the server answers it\n   * with the same 404, so the frontend cannot tell the two apart, and must not try to.\n   */\n  REFUSED = 'REFUSED',\n  /**\n   * The READ failed for a reason that says nothing about access (network, 5xx, no READ operation mounted).\n   * The route renders, and its own requests report whatever is wrong: a transient failure must never\n   * eject someone from a page they may open.\n   */\n  INCONCLUSIVE = 'INCONCLUSIVE',\n}\n\n/** The membership fields this decision reads, structurally, so the check does not depend on the context's population shape. */\nexport interface RouteOrganizationMembershipFacts {\n  organizationId?: string | null;\n  status?: OrganizationMemberStatus | string | null;\n}\n\n/**\n * True when the memberships carry an ACTIVE membership in `organizationId`.\n *\n * Only ACTIVE counts: an INVITED, INACTIVE or SUSPENDED membership confers no access on the server, so\n * treating it as a pass would let exactly the refused reads through. Such a membership falls through to\n * the server probe instead, which answers correctly either way.\n */\nexport function hasActiveMembershipInOrganization(\n  memberships: ReadonlyArray<RouteOrganizationMembershipFacts> | null | undefined,\n  organizationId: string,\n): boolean {\n  return (memberships ?? []).some(\n    (membership) => membership.organizationId === organizationId && membership.status === OrganizationMemberStatus.ACTIVE,\n  );\n}\n\n/**\n * The default, non-bulk API READ of a resource — the operation that fetches one row by its identifier.\n *\n * Shared by the session's organization loading and the route access probe, which must address the same\n * operation: if they disagreed, the probe could admit an organization the session cannot load.\n */\nexport function findDefaultApiReadOperation(\n  resourceConfiguration: AnyFrontendResourceConfiguration | undefined,\n): FrontendResourceConfiguration_Operation | undefined {\n  return resourceConfiguration?.operations?.find(\n    (operation: FrontendResourceConfiguration_Operation) =>\n      operation.operationIdentifier === CoreResourceOperation.READ\n      && operation.isOperationDefault === true\n      && operation.isBulkOperation !== true\n      && (\n        operation.variantType === ResourceOperationVariantType.API_CALL\n        || operation.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK\n      ),\n  );\n}\n"]}