@wildo-ai/saas-frontend-lib 1.1.4 → 1.1.6

package/dist/esm/core/security/StepUpAuthContext.js

@@ -10,28 +10,48 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
  * On success, the interceptor retries the original request with the new X-Reauth-Token header.
  */
 import { createContext, useCallback, useEffect, useMemo, useRef, useState } from 'react';
-import { AuthMethod } from '@wildo-ai/saas-models';
+import { AuthMethod, ReAuthenticationPurpose } from '@wildo-ai/saas-models';
 import { getManualCallsHttpClient } from '../../core/requests/wildo-http-client-manual-calls.frontend.service.js';
+import { StepUpRefusalOrigin } from '../../core/requests/wildo-http-client.frontend.service.js';
 import { useResourceRegistry } from '../../core/resources/useResourceRegistry.js';
+import { startAuthentication } from '@simplewebauthn/browser';
 import { StepUpAuthDialog } from '../../components/auth/StepUpAuthDialog.js';
+import { obtainFederatedReAuthenticationToken } from '../../core/security/federated-reauthentication.frontend.js';
 export const StepUpAuthContext = createContext(undefined);
 export const StepUpAuthProvider = ({ children }) => {
     const { setStepUpAuthHandler: setResourcesStepUpAuthHandler } = useResourceRegistry();
     const [isDialogOpen, setIsDialogOpen] = useState(false);
-    const [error, setError] = useState(null);
+    // The caught failure ITSELF, not text: the dialog resolves it into words through the i18n context, and
+    // a string made here could only have been the error's own `message` — for a backend error, its i18n key.
+    const [failure, setFailure] = useState(null);
     const [isLoading, setIsLoading] = useState(false);
+    // Which proof the pending refusal asked for (#1417): it decides what the dialog offers and what is minted.
+    const [purpose, setPurpose] = useState(ReAuthenticationPurpose.STEP_UP);
+    // Who asked (#1633): a client organization's policy asks a firm's expert for a second factor for that client only.
+    const [origin, setOrigin] = useState(StepUpRefusalOrigin.ACCOUNT_OR_OPERATION);
     const pendingResolveRef = useRef(null);
     const pendingRejectRef = useRef(null);
     const stepUpInFlightRef = useRef(null);
-    const stepUpAuthHandler = useCallback(() => {
-        // Deduplicate: if a step-up is already in flight, share the same promise
+    const abortRef = useRef(null);
+    const stepUpAuthHandler = useCallback((requestedPurpose, requestedOrigin = StepUpRefusalOrigin.ACCOUNT_OR_OPERATION) => {
+        // Deduplicate: if a step-up is already in flight, share the same promise. A STEP-UP refusal joining a
+        // pending BINDING prompt upgrades it: a step-up proof opens binding doors too, while a binding proof
+        // opens no step-up door, so the one shared proof must be the stronger kind (#1417).
         if (stepUpInFlightRef.current) {
+            if (requestedPurpose === ReAuthenticationPurpose.STEP_UP)
+                setPurpose(ReAuthenticationPurpose.STEP_UP);
+            // A client's refusal joining a pending prompt makes the shared proof a second factor: a password would satisfy
+            // the account's gate and still be refused by the client's, so the stricter origin wins.
+            if (requestedOrigin === StepUpRefusalOrigin.CLIENT_ORGANIZATION)
+                setOrigin(StepUpRefusalOrigin.CLIENT_ORGANIZATION);
             return stepUpInFlightRef.current;
         }
+        setPurpose(requestedPurpose);
+        setOrigin(requestedOrigin);
         const promise = new Promise((resolve, reject) => {
             pendingResolveRef.current = resolve;
             pendingRejectRef.current = reject;
-            setError(null);
+            setFailure(null);
             setIsLoading(false);
             setIsDialogOpen(true);
         });
@@ -54,25 +74,34 @@ export const StepUpAuthProvider = ({ children }) => {
             pendingRejectRef.current = null;
         };
     }, [stepUpAuthHandler]);
-    const handleConfirm = useCallback(async (password) => {
+    const handleConfirm = useCallback(async (proof) => {
         setIsLoading(true);
-        setError(null);
+        setFailure(null);
+        // The dialog's Cancel ends a federated wait early (#1441); nothing else can, see
+        // `federated-reauthentication.frontend.ts`.
+        const abort = new AbortController();
+        abortRef.current = abort;
         try {
-            const { reAuthToken } = await getManualCallsHttpClient().reAuthenticate(AuthMethod.PASSWORD, { password });
+            const { reAuthToken } = await obtainStepUpToken(proof, purpose, abort.signal);
             setIsDialogOpen(false);
             pendingResolveRef.current?.(reAuthToken);
             pendingResolveRef.current = null;
             pendingRejectRef.current = null;
         }
         catch (e) {
-            const message = e instanceof Error ? e.message : 'Authentication failed';
-            setError(message);
+            // A cancelled attempt's failure is not shown: the dialog is already closed, and would open next
+            // time with it.
+            if (!abort.signal.aborted)
+                setFailure(e);
         }
         finally {
+            if (abortRef.current === abort)
+                abortRef.current = null;
             setIsLoading(false);
         }
-    }, []);
+    }, [purpose]);
     const handleCancel = useCallback(() => {
+        abortRef.current?.abort();
         setIsDialogOpen(false);
         pendingRejectRef.current?.(new Error('Step-up authentication cancelled'));
         pendingResolveRef.current = null;
@@ -81,6 +110,31 @@ export const StepUpAuthProvider = ({ children }) => {
     const value = useMemo(() => ({
         isStepUpPending: isDialogOpen,
     }), [isDialogOpen]);
-    return (_jsxs(StepUpAuthContext.Provider, { value: value, children: [children, _jsx(StepUpAuthDialog, { open: isDialogOpen, onConfirm: handleConfirm, onCancel: handleCancel, error: error, isLoading: isLoading })] }));
+    return (_jsxs(StepUpAuthContext.Provider, { value: value, children: [children, _jsx(StepUpAuthDialog, { open: isDialogOpen, purpose: purpose, origin: origin, onConfirm: handleConfirm, onCancel: handleCancel, failure: failure, isLoading: isLoading })] }));
 };
+/**
+ * Turn what the person supplied into a single-use step-up token.
+ *
+ * A passkey takes two round trips because WebAuthn is challenge-response: fetch the server's
+ * challenge, have the authenticator sign it, then present the assertion. Password and TOTP are one. A
+ * linked identity runs its provider in a popup and redeems the code it returns (#1441).
+ */
+export async function obtainStepUpToken(proof, purpose = ReAuthenticationPurpose.STEP_UP, signal) {
+    const client = getManualCallsHttpClient();
+    switch (proof.method) {
+        case AuthMethod.PASSWORD:
+            return client.reAuthenticate(AuthMethod.PASSWORD, { password: proof.password }, purpose);
+        case AuthMethod.TOTP:
+            return client.reAuthenticate(AuthMethod.TOTP, { code: proof.code }, purpose);
+        case AuthMethod.PASSKEY: {
+            const options = (await client.reAuthPasskeyOptions());
+            const assertion = await startAuthentication({ optionsJSON: options });
+            return client.reAuthenticate(AuthMethod.PASSKEY, { passkeyResponse: assertion }, purpose);
+        }
+        case AuthMethod.EXTERNAL_OAUTH2:
+        case AuthMethod.ORG_OPENID_CONNECT:
+        case AuthMethod.ORG_SAML:
+            return obtainFederatedReAuthenticationToken(proof.identityLinkId, purpose, proof.popup, signal);
+    }
+}
 //# sourceMappingURL=StepUpAuthContext.js.map

package/dist/esm/core/security/StepUpAuthContext.js.map

@@ -1 +1 @@
-{"version":3,"file":"StepUpAuthContext.js","sourceRoot":"","sources":["../../../../src/core/security/StepUpAuthContext.tsx"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;AAEH,OAAc,EAAE,aAAa,EAAa,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAC3G,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAC7H,OAAO,EAAE,mBAAmB,EAAE,MAAM,wDAAwD,CAAC;AAC7F,OAAO,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAMxF,MAAM,CAAC,MAAM,iBAAiB,GAAqD,aAAa,CAAoC,SAAS,CAAC,CAAC;AAE/I,MAAM,CAAC,MAAM,kBAAkB,GAAsC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;IACpF,MAAM,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,GAAG,mBAAmB,EAAE,CAAC;IACtF,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAElD,MAAM,iBAAiB,GAAG,MAAM,CAAmC,IAAI,CAAC,CAAC;IACzE,MAAM,gBAAgB,GAAG,MAAM,CAAmC,IAAI,CAAC,CAAC;IACxE,MAAM,iBAAiB,GAAG,MAAM,CAAyB,IAAI,CAAC,CAAC;IAE/D,MAAM,iBAAiB,GAAG,WAAW,CAAC,GAAoB,EAAE;QAC1D,yEAAyE;QACzE,IAAI,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC9B,OAAO,iBAAiB,CAAC,OAAO,CAAC;QACnC,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACtD,iBAAiB,CAAC,OAAO,GAAG,OAAO,CAAC;YACpC,gBAAgB,CAAC,OAAO,GAAG,MAAM,CAAC;YAClC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,eAAe,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;QACH,iBAAiB,CAAC,OAAO,GAAG,OAAO,CAAC;QACpC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,OAAO,OAAO,CAAC;IACjB,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,sBAAsB,GAAG,MAAM,CAAC,6BAA6B,CAAC,CAAC;IACrE,SAAS,CAAC,GAAG,EAAE;QACb,sBAAsB,CAAC,OAAO,GAAG,6BAA6B,CAAC;IACjE,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC,CAAC;IAEpC,SAAS,CAAC,GAAG,EAAE;QACb,wBAAwB,EAAE,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;QACnE,sBAAsB,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAClD,OAAO,GAAG,EAAE;YACV,wBAAwB,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;YACtD,sBAAsB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,gBAAgB,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;YACtE,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;YACjC,gBAAgB,CAAC,OAAO,GAAG,IAAI,CAAC;QAClC,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAExB,MAAM,aAAa,GAAG,WAAW,CAAC,KAAK,EAAE,QAAgB,EAAE,EAAE;QAC3D,YAAY,CAAC,IAAI,CAAC,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,CAAC;YACH,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,wBAAwB,EAAE,CAAC,cAAc,CACrE,UAAU,CAAC,QAAQ,EACnB,EAAE,QAAQ,EAAE,CACb,CAAC;YACF,eAAe,CAAC,KAAK,CAAC,CAAC;YACvB,iBAAiB,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC;YACzC,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;YACjC,gBAAgB,CAAC,OAAO,GAAG,IAAI,CAAC;QAClC,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC;YACzE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACpB,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;QACpC,eAAe,CAAC,KAAK,CAAC,CAAC;QACvB,gBAAgB,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC;QAC1E,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;QACjC,gBAAgB,CAAC,OAAO,GAAG,IAAI,CAAC;IAClC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,KAAK,GAAG,OAAO,CAAwB,GAAG,EAAE,CAAC,CAAC;QAClD,eAAe,EAAE,YAAY;KAC9B,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAEpB,OAAO,CACL,MAAC,iBAAiB,CAAC,QAAQ,IAAC,KAAK,EAAE,KAAK,aACrC,QAAQ,EACT,KAAC,gBAAgB,IACf,IAAI,EAAE,YAAY,EAClB,SAAS,EAAE,aAAa,EACxB,QAAQ,EAAE,YAAY,EACtB,KAAK,EAAE,KAAK,EACZ,SAAS,EAAE,SAAS,GACpB,IACyB,CAC9B,CAAC;AACJ,CAAC,CAAC","sourcesContent":["/**\n * StepUpAuthContext\n *\n * Manages the step-up re-authentication flow triggered by HTTP 403 STEP_UP_REQUIRED responses.\n *\n * The provider registers a handler on both HTTP clients (manual calls + resources).\n * When the backend rejects a request because the user's last authentication is stale,\n * the HTTP interceptor calls the handler, which opens a dialog for re-authentication.\n * On success, the interceptor retries the original request with the new X-Reauth-Token header.\n */\n\nimport React, { createContext, ReactNode, useCallback, useEffect, useMemo, useRef, useState } from 'react';\nimport { AuthMethod } from '@wildo-ai/saas-models';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport { useResourceRegistry } from '~wildo-frontend-lib/core/resources/useResourceRegistry';\nimport { StepUpAuthDialog } from '~wildo-frontend-lib/components/auth/StepUpAuthDialog';\n\nexport interface StepUpAuthContextType {\n  isStepUpPending: boolean;\n}\n\nexport const StepUpAuthContext: React.Context<StepUpAuthContextType | undefined> = createContext<StepUpAuthContextType | undefined>(undefined);\n\nexport const StepUpAuthProvider: React.FC<{ children: ReactNode }> = ({ children }) => {\n  const { setStepUpAuthHandler: setResourcesStepUpAuthHandler } = useResourceRegistry();\n  const [isDialogOpen, setIsDialogOpen] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n  const [isLoading, setIsLoading] = useState(false);\n\n  const pendingResolveRef = useRef<((token: string) => void) | null>(null);\n  const pendingRejectRef = useRef<((reason: Error) => void) | null>(null);\n  const stepUpInFlightRef = useRef<Promise<string> | null>(null);\n\n  const stepUpAuthHandler = useCallback((): Promise<string> => {\n    // Deduplicate: if a step-up is already in flight, share the same promise\n    if (stepUpInFlightRef.current) {\n      return stepUpInFlightRef.current;\n    }\n    const promise = new Promise<string>((resolve, reject) => {\n      pendingResolveRef.current = resolve;\n      pendingRejectRef.current = reject;\n      setError(null);\n      setIsLoading(false);\n      setIsDialogOpen(true);\n    });\n    stepUpInFlightRef.current = promise;\n    promise.finally(() => { stepUpInFlightRef.current = null; });\n    return promise;\n  }, []);\n\n  const setResourcesHandlerRef = useRef(setResourcesStepUpAuthHandler);\n  useEffect(() => {\n    setResourcesHandlerRef.current = setResourcesStepUpAuthHandler;\n  }, [setResourcesStepUpAuthHandler]);\n\n  useEffect(() => {\n    getManualCallsHttpClient().setStepUpAuthHandler(stepUpAuthHandler);\n    setResourcesHandlerRef.current(stepUpAuthHandler);\n    return () => {\n      getManualCallsHttpClient().setStepUpAuthHandler(null);\n      setResourcesHandlerRef.current(null);\n      pendingRejectRef.current?.(new Error('StepUpAuthProvider unmounted'));\n      pendingResolveRef.current = null;\n      pendingRejectRef.current = null;\n    };\n  }, [stepUpAuthHandler]);\n\n  const handleConfirm = useCallback(async (password: string) => {\n    setIsLoading(true);\n    setError(null);\n    try {\n      const { reAuthToken } = await getManualCallsHttpClient().reAuthenticate(\n        AuthMethod.PASSWORD,\n        { password }\n      );\n      setIsDialogOpen(false);\n      pendingResolveRef.current?.(reAuthToken);\n      pendingResolveRef.current = null;\n      pendingRejectRef.current = null;\n    } catch (e: unknown) {\n      const message = e instanceof Error ? e.message : 'Authentication failed';\n      setError(message);\n    } finally {\n      setIsLoading(false);\n    }\n  }, []);\n\n  const handleCancel = useCallback(() => {\n    setIsDialogOpen(false);\n    pendingRejectRef.current?.(new Error('Step-up authentication cancelled'));\n    pendingResolveRef.current = null;\n    pendingRejectRef.current = null;\n  }, []);\n\n  const value = useMemo<StepUpAuthContextType>(() => ({\n    isStepUpPending: isDialogOpen,\n  }), [isDialogOpen]);\n\n  return (\n    <StepUpAuthContext.Provider value={value}>\n      {children}\n      <StepUpAuthDialog\n        open={isDialogOpen}\n        onConfirm={handleConfirm}\n        onCancel={handleCancel}\n        error={error}\n        isLoading={isLoading}\n      />\n    </StepUpAuthContext.Provider>\n  );\n};\n"]}
+{"version":3,"file":"StepUpAuthContext.js","sourceRoot":"","sources":["../../../../../src/core/security/StepUpAuthContext.tsx"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;AAEH,OAAc,EAAE,aAAa,EAAa,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAC3G,OAAO,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAC5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAC7H,OAAO,EAAE,mBAAmB,EAAE,MAAM,sEAAsE,CAAC;AAC3G,OAAO,EAAE,mBAAmB,EAAE,MAAM,wDAAwD,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,OAAO,EAAE,gBAAgB,EAAoB,MAAM,sDAAsD,CAAC;AAC1G,OAAO,EAAE,oCAAoC,EAAE,MAAM,uEAAuE,CAAC;AAM7H,MAAM,CAAC,MAAM,iBAAiB,GAAqD,aAAa,CAAoC,SAAS,CAAC,CAAC;AAE/I,MAAM,CAAC,MAAM,kBAAkB,GAAsC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;IACpF,MAAM,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,GAAG,mBAAmB,EAAE,CAAC;IACtF,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxD,uGAAuG;IACvG,yGAAyG;IACzG,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAAU,IAAI,CAAC,CAAC;IACtD,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClD,2GAA2G;IAC3G,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,CAA0B,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACjG,mHAAmH;IACnH,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAsB,mBAAmB,CAAC,oBAAoB,CAAC,CAAC;IAEpG,MAAM,iBAAiB,GAAG,MAAM,CAAmC,IAAI,CAAC,CAAC;IACzE,MAAM,gBAAgB,GAAG,MAAM,CAAmC,IAAI,CAAC,CAAC;IACxE,MAAM,iBAAiB,GAAG,MAAM,CAAyB,IAAI,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,MAAM,CAAyB,IAAI,CAAC,CAAC;IAEtD,MAAM,iBAAiB,GAAG,WAAW,CAAC,CACpC,gBAAyC,EACzC,kBAAuC,mBAAmB,CAAC,oBAAoB,EAC9D,EAAE;QACnB,sGAAsG;QACtG,qGAAqG;QACrG,oFAAoF;QACpF,IAAI,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,gBAAgB,KAAK,uBAAuB,CAAC,OAAO;gBAAE,UAAU,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC;YACtG,+GAA+G;YAC/G,wFAAwF;YACxF,IAAI,eAAe,KAAK,mBAAmB,CAAC,mBAAmB;gBAAE,SAAS,CAAC,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;YACpH,OAAO,iBAAiB,CAAC,OAAO,CAAC;QACnC,CAAC;QACD,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAC7B,SAAS,CAAC,eAAe,CAAC,CAAC;QAC3B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACtD,iBAAiB,CAAC,OAAO,GAAG,OAAO,CAAC;YACpC,gBAAgB,CAAC,OAAO,GAAG,MAAM,CAAC;YAClC,UAAU,CAAC,IAAI,CAAC,CAAC;YACjB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,eAAe,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;QACH,iBAAiB,CAAC,OAAO,GAAG,OAAO,CAAC;QACpC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,OAAO,OAAO,CAAC;IACjB,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,sBAAsB,GAAG,MAAM,CAAC,6BAA6B,CAAC,CAAC;IACrE,SAAS,CAAC,GAAG,EAAE;QACb,sBAAsB,CAAC,OAAO,GAAG,6BAA6B,CAAC;IACjE,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC,CAAC;IAEpC,SAAS,CAAC,GAAG,EAAE;QACb,wBAAwB,EAAE,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,CAAC;QACnE,sBAAsB,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAClD,OAAO,GAAG,EAAE;YACV,wBAAwB,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;YACtD,sBAAsB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,gBAAgB,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;YACtE,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;YACjC,gBAAgB,CAAC,OAAO,GAAG,IAAI,CAAC;QAClC,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAExB,MAAM,aAAa,GAAG,WAAW,CAAC,KAAK,EAAE,KAAkB,EAAE,EAAE;QAC7D,YAAY,CAAC,IAAI,CAAC,CAAC;QACnB,UAAU,CAAC,IAAI,CAAC,CAAC;QACjB,iFAAiF;QACjF,4CAA4C;QAC5C,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,QAAQ,CAAC,OAAO,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC9E,eAAe,CAAC,KAAK,CAAC,CAAC;YACvB,iBAAiB,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC;YACzC,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;YACjC,gBAAgB,CAAC,OAAO,GAAG,IAAI,CAAC;QAClC,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,gGAAgG;YAChG,gBAAgB;YAChB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO;gBAAE,UAAU,CAAC,CAAC,CAAC,CAAC;QAC3C,CAAC;gBAAS,CAAC;YACT,IAAI,QAAQ,CAAC,OAAO,KAAK,KAAK;gBAAE,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC;YACxD,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAEd,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;QACpC,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;QAC1B,eAAe,CAAC,KAAK,CAAC,CAAC;QACvB,gBAAgB,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC;QAC1E,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;QACjC,gBAAgB,CAAC,OAAO,GAAG,IAAI,CAAC;IAClC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,KAAK,GAAG,OAAO,CAAwB,GAAG,EAAE,CAAC,CAAC;QAClD,eAAe,EAAE,YAAY;KAC9B,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAEpB,OAAO,CACL,MAAC,iBAAiB,CAAC,QAAQ,IAAC,KAAK,EAAE,KAAK,aACrC,QAAQ,EACT,KAAC,gBAAgB,IACf,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,aAAa,EACxB,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,SAAS,GACpB,IACyB,CAC9B,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAkB,EAClB,UAAmC,uBAAuB,CAAC,OAAO,EAClE,MAAoB;IAEpB,MAAM,MAAM,GAAG,wBAAwB,EAAE,CAAC;IAC1C,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;QACrB,KAAK,UAAU,CAAC,QAAQ;YACtB,OAAO,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;QAC3F,KAAK,UAAU,CAAC,IAAI;YAClB,OAAO,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/E,KAAK,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;YACxB,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,oBAAoB,EAAE,CAAqD,CAAC;YAC1G,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;YACtE,OAAO,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,eAAe,EAAE,SAA+C,EAAE,EAAE,OAAO,CAAC,CAAC;QAClI,CAAC;QACD,KAAK,UAAU,CAAC,eAAe,CAAC;QAChC,KAAK,UAAU,CAAC,kBAAkB,CAAC;QACnC,KAAK,UAAU,CAAC,QAAQ;YACtB,OAAO,oCAAoC,CAAC,KAAK,CAAC,cAAc,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACpG,CAAC;AACH,CAAC","sourcesContent":["/**\n * StepUpAuthContext\n *\n * Manages the step-up re-authentication flow triggered by HTTP 403 STEP_UP_REQUIRED responses.\n *\n * The provider registers a handler on both HTTP clients (manual calls + resources).\n * When the backend rejects a request because the user's last authentication is stale,\n * the HTTP interceptor calls the handler, which opens a dialog for re-authentication.\n * On success, the interceptor retries the original request with the new X-Reauth-Token header.\n */\n\nimport React, { createContext, ReactNode, useCallback, useEffect, useMemo, useRef, useState } from 'react';\nimport { AuthMethod, ReAuthenticationPurpose } from '@wildo-ai/saas-models';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport { StepUpRefusalOrigin } from '~wildo-frontend-lib/core/requests/wildo-http-client.frontend.service';\nimport { useResourceRegistry } from '~wildo-frontend-lib/core/resources/useResourceRegistry';\nimport { startAuthentication } from '@simplewebauthn/browser';\nimport type { PublicKeyCredentialRequestOptionsJSON } from '@simplewebauthn/browser';\nimport { StepUpAuthDialog, type StepUpProof } from '~wildo-frontend-lib/components/auth/StepUpAuthDialog';\nimport { obtainFederatedReAuthenticationToken } from '~wildo-frontend-lib/core/security/federated-reauthentication.frontend';\n\nexport interface StepUpAuthContextType {\n  isStepUpPending: boolean;\n}\n\nexport const StepUpAuthContext: React.Context<StepUpAuthContextType | undefined> = createContext<StepUpAuthContextType | undefined>(undefined);\n\nexport const StepUpAuthProvider: React.FC<{ children: ReactNode }> = ({ children }) => {\n  const { setStepUpAuthHandler: setResourcesStepUpAuthHandler } = useResourceRegistry();\n  const [isDialogOpen, setIsDialogOpen] = useState(false);\n  // The caught failure ITSELF, not text: the dialog resolves it into words through the i18n context, and\n  // a string made here could only have been the error's own `message` — for a backend error, its i18n key.\n  const [failure, setFailure] = useState<unknown>(null);\n  const [isLoading, setIsLoading] = useState(false);\n  // Which proof the pending refusal asked for (#1417): it decides what the dialog offers and what is minted.\n  const [purpose, setPurpose] = useState<ReAuthenticationPurpose>(ReAuthenticationPurpose.STEP_UP);\n  // Who asked (#1633): a client organization's policy asks a firm's expert for a second factor for that client only.\n  const [origin, setOrigin] = useState<StepUpRefusalOrigin>(StepUpRefusalOrigin.ACCOUNT_OR_OPERATION);\n\n  const pendingResolveRef = useRef<((token: string) => void) | null>(null);\n  const pendingRejectRef = useRef<((reason: Error) => void) | null>(null);\n  const stepUpInFlightRef = useRef<Promise<string> | null>(null);\n  const abortRef = useRef<AbortController | null>(null);\n\n  const stepUpAuthHandler = useCallback((\n    requestedPurpose: ReAuthenticationPurpose,\n    requestedOrigin: StepUpRefusalOrigin = StepUpRefusalOrigin.ACCOUNT_OR_OPERATION,\n  ): Promise<string> => {\n    // Deduplicate: if a step-up is already in flight, share the same promise. A STEP-UP refusal joining a\n    // pending BINDING prompt upgrades it: a step-up proof opens binding doors too, while a binding proof\n    // opens no step-up door, so the one shared proof must be the stronger kind (#1417).\n    if (stepUpInFlightRef.current) {\n      if (requestedPurpose === ReAuthenticationPurpose.STEP_UP) setPurpose(ReAuthenticationPurpose.STEP_UP);\n      // A client's refusal joining a pending prompt makes the shared proof a second factor: a password would satisfy\n      // the account's gate and still be refused by the client's, so the stricter origin wins.\n      if (requestedOrigin === StepUpRefusalOrigin.CLIENT_ORGANIZATION) setOrigin(StepUpRefusalOrigin.CLIENT_ORGANIZATION);\n      return stepUpInFlightRef.current;\n    }\n    setPurpose(requestedPurpose);\n    setOrigin(requestedOrigin);\n    const promise = new Promise<string>((resolve, reject) => {\n      pendingResolveRef.current = resolve;\n      pendingRejectRef.current = reject;\n      setFailure(null);\n      setIsLoading(false);\n      setIsDialogOpen(true);\n    });\n    stepUpInFlightRef.current = promise;\n    promise.finally(() => { stepUpInFlightRef.current = null; });\n    return promise;\n  }, []);\n\n  const setResourcesHandlerRef = useRef(setResourcesStepUpAuthHandler);\n  useEffect(() => {\n    setResourcesHandlerRef.current = setResourcesStepUpAuthHandler;\n  }, [setResourcesStepUpAuthHandler]);\n\n  useEffect(() => {\n    getManualCallsHttpClient().setStepUpAuthHandler(stepUpAuthHandler);\n    setResourcesHandlerRef.current(stepUpAuthHandler);\n    return () => {\n      getManualCallsHttpClient().setStepUpAuthHandler(null);\n      setResourcesHandlerRef.current(null);\n      pendingRejectRef.current?.(new Error('StepUpAuthProvider unmounted'));\n      pendingResolveRef.current = null;\n      pendingRejectRef.current = null;\n    };\n  }, [stepUpAuthHandler]);\n\n  const handleConfirm = useCallback(async (proof: StepUpProof) => {\n    setIsLoading(true);\n    setFailure(null);\n    // The dialog's Cancel ends a federated wait early (#1441); nothing else can, see\n    // `federated-reauthentication.frontend.ts`.\n    const abort = new AbortController();\n    abortRef.current = abort;\n    try {\n      const { reAuthToken } = await obtainStepUpToken(proof, purpose, abort.signal);\n      setIsDialogOpen(false);\n      pendingResolveRef.current?.(reAuthToken);\n      pendingResolveRef.current = null;\n      pendingRejectRef.current = null;\n    } catch (e: unknown) {\n      // A cancelled attempt's failure is not shown: the dialog is already closed, and would open next\n      // time with it.\n      if (!abort.signal.aborted) setFailure(e);\n    } finally {\n      if (abortRef.current === abort) abortRef.current = null;\n      setIsLoading(false);\n    }\n  }, [purpose]);\n\n  const handleCancel = useCallback(() => {\n    abortRef.current?.abort();\n    setIsDialogOpen(false);\n    pendingRejectRef.current?.(new Error('Step-up authentication cancelled'));\n    pendingResolveRef.current = null;\n    pendingRejectRef.current = null;\n  }, []);\n\n  const value = useMemo<StepUpAuthContextType>(() => ({\n    isStepUpPending: isDialogOpen,\n  }), [isDialogOpen]);\n\n  return (\n    <StepUpAuthContext.Provider value={value}>\n      {children}\n      <StepUpAuthDialog\n        open={isDialogOpen}\n        purpose={purpose}\n        origin={origin}\n        onConfirm={handleConfirm}\n        onCancel={handleCancel}\n        failure={failure}\n        isLoading={isLoading}\n      />\n    </StepUpAuthContext.Provider>\n  );\n};\n\n/**\n * Turn what the person supplied into a single-use step-up token.\n *\n * A passkey takes two round trips because WebAuthn is challenge-response: fetch the server's\n * challenge, have the authenticator sign it, then present the assertion. Password and TOTP are one. A\n * linked identity runs its provider in a popup and redeems the code it returns (#1441).\n */\nexport async function obtainStepUpToken(\n  proof: StepUpProof,\n  purpose: ReAuthenticationPurpose = ReAuthenticationPurpose.STEP_UP,\n  signal?: AbortSignal,\n): Promise<{ reAuthToken: string }> {\n  const client = getManualCallsHttpClient();\n  switch (proof.method) {\n    case AuthMethod.PASSWORD:\n      return client.reAuthenticate(AuthMethod.PASSWORD, { password: proof.password }, purpose);\n    case AuthMethod.TOTP:\n      return client.reAuthenticate(AuthMethod.TOTP, { code: proof.code }, purpose);\n    case AuthMethod.PASSKEY: {\n      const options = (await client.reAuthPasskeyOptions()) as unknown as PublicKeyCredentialRequestOptionsJSON;\n      const assertion = await startAuthentication({ optionsJSON: options });\n      return client.reAuthenticate(AuthMethod.PASSKEY, { passkeyResponse: assertion as unknown as Record<string, unknown> }, purpose);\n    }\n    case AuthMethod.EXTERNAL_OAUTH2:\n    case AuthMethod.ORG_OPENID_CONNECT:\n    case AuthMethod.ORG_SAML:\n      return obtainFederatedReAuthenticationToken(proof.identityLinkId, purpose, proof.popup, signal);\n  }\n}\n"]}

package/dist/esm/core/security/UserOrgsContext.d.ts

@@ -1,5 +1,5 @@
 import React, { ReactNode } from 'react';
-import { UserContext, OrganizationContext, ExecutionContext_InitiatorIds, UserPrivacy } from '@wildo-ai/saas-models';
+import { UserContext, OrganizationContext, ExecutionContext_InitiatorIds, UserPrivacy, type ConsentPurpose } from '@wildo-ai/saas-models';
 import { EffectivePermissions } from './security.frontend.schemas';
 import { useAuthSession } from './useAuthSession';
 /**
@@ -28,6 +28,20 @@ export interface UserOrgsContextType {
     getCurrentOrganization: () => OrganizationContext | null;
     refreshOrganizations: () => Promise<void>;
     getPrivacy: () => UserPrivacy | null;
+    /**
+     * Record the signed-in person's consent decision: exactly the purposes they granted (#534).
+     *
+     * The argument is the WHOLE granted set, never a delta — a purpose left out is a purpose not granted,
+     * so an unticked box is a withdrawal rather than "no change". The write always carries a decision
+     * claim, which is what lets "grant nothing" be recorded as a decision instead of reading as a person
+     * who was never asked; the recorded instant is the server's (`buildConsentDecisionPatch`).
+     *
+     * Resolves with the stored privacy block once it is in state, so a caller gating on consent (the
+     * consent gate) sees the new decision on the next render. Rejects when the application mounts no
+     * self-preferences UPDATE door or the write fails — a consent surface must say it could not save,
+     * never behave as though it had.
+     */
+    recordConsentDecision: (grantedPurposes: readonly ConsentPurpose[]) => Promise<UserPrivacy>;
 }
 /**
  * UserOrgs Context

package/dist/esm/core/security/UserOrgsContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"UserOrgsContext.d.ts","sourceRoot":"","sources":["../../../../src/core/security/UserOrgsContext.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAA2B,SAAS,EAA2C,MAAM,OAAO,CAAC;AAC3G,OAAO,EACL,WAAW,EACX,mBAAmB,EAMnB,6BAA6B,EAC7B,WAAW,EAGZ,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,oBAAoB,EACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AA0BlD;;;;GAIG;AAEH,MAAM,WAAW,mBAAmB;IAElC,IAAI,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;IAChD,eAAe,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACtE,wBAAwB,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,0BAA0B,CAAC,CAAC;IACxF,YAAY,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,cAAc,CAAC,CAAC;IAChE,eAAe,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACtE,eAAe,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACtE,MAAM,EAAE,MAAM,IAAI,CAAC;IACnB,cAAc,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAGvC,mBAAmB,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,qBAAqB,CAAC,CAAC;IAC9E,sBAAsB,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,wBAAwB,CAAC,CAAC;IAGpF,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IAGzB,aAAa,EAAE,mBAAmB,EAAE,CAAC;IACrC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,WAAW,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACzC,wBAAwB,EAAE,6BAA6B,GAAG,IAAI,CAAC;IAG/D,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAG5B,sBAAsB,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,IAAI,CAAC;IACzD,sBAAsB,EAAE,MAAM,mBAAmB,GAAG,IAAI,CAAC;IACzD,oBAAoB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAG1C,UAAU,EAAE,MAAM,WAAW,GAAG,IAAI,CAAC;CACtC;AAED;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAA6D,CAAC;AAEzI,eAAO,MAAM,gBAAgB,EAAE,KAAK,CAAC,EAAE,CAAC;IAAE,QAAQ,EAAE,SAAS,CAAA;CAAE,CA+wB9D,CAAC"}
+{"version":3,"file":"UserOrgsContext.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/UserOrgsContext.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAA2B,SAAS,EAA2C,MAAM,OAAO,CAAC;AAC3G,OAAO,EACL,WAAW,EACX,mBAAmB,EAMnB,6BAA6B,EAC7B,WAAW,EAIX,KAAK,cAAc,EACpB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,oBAAoB,EACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AA2BlD;;;;GAIG;AAEH,MAAM,WAAW,mBAAmB;IAElC,IAAI,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;IAChD,eAAe,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACtE,wBAAwB,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,0BAA0B,CAAC,CAAC;IACxF,YAAY,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,cAAc,CAAC,CAAC;IAChE,eAAe,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACtE,eAAe,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACtE,MAAM,EAAE,MAAM,IAAI,CAAC;IACnB,cAAc,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAGvC,mBAAmB,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,qBAAqB,CAAC,CAAC;IAC9E,sBAAsB,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,wBAAwB,CAAC,CAAC;IAGpF,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IAGzB,aAAa,EAAE,mBAAmB,EAAE,CAAC;IACrC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,WAAW,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACzC,wBAAwB,EAAE,6BAA6B,GAAG,IAAI,CAAC;IAG/D,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAG5B,sBAAsB,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,IAAI,CAAC;IACzD,sBAAsB,EAAE,MAAM,mBAAmB,GAAG,IAAI,CAAC;IACzD,oBAAoB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAG1C,UAAU,EAAE,MAAM,WAAW,GAAG,IAAI,CAAC;IAErC;;;;;;;;;;;;OAYG;IACH,qBAAqB,EAAE,CAAC,eAAe,EAAE,SAAS,cAAc,EAAE,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;CAC7F;AAED;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAA6D,CAAC;AAEzI,eAAO,MAAM,gBAAgB,EAAE,KAAK,CAAC,EAAE,CAAC;IAAE,QAAQ,EAAE,SAAS,CAAA;CAAE,CAo3B9D,CAAC"}

package/dist/esm/core/security/UserOrgsContext.js

@@ -1,10 +1,10 @@
 import { jsx as _jsx } from "react/jsx-runtime";
 import { createContext, useState, useMemo, useEffect, useCallback, useRef } from 'react';
-import { CoreResourceType, ResourcesConfig_OperationPathUtils, CoreResourceOperation, ResourceOperationVariantType, OPERATION_VARIANT_KEY, SessionType, } from '@wildo-ai/saas-models';
+import { CoreResourceType, ResourcesConfig_OperationPathUtils, CoreResourceOperation, ResourceOperationVariantType, OPERATION_VARIANT_KEY, SessionType, normalizeConsentPurposes, } from '@wildo-ai/saas-models';
 import { useResourceRegistry } from '../../core/resources/useResourceRegistry.js';
 import { LoggerFrontendService } from '../../core/monitoring/logger.frontend.service.js';
 import { useEventBus } from '../../core/events/useEventBus.js';
-import { FrontendEvents } from '../../core/events/events.frontend.schemas.js';
+import { FrontendEvents, SessionEndReason } from '../../core/events/events.frontend.schemas.js';
 import { useAuthSession } from './useAuthSession.js';
 import { AuthSessionUtils } from './auth-session.utils.js';
 import { isTransientBackendFailure } from '../../core/requests/auth-refresh-resilience.frontend.js';
@@ -12,6 +12,7 @@ import { decodeJwtPayload } from './jwt.frontend.utils.js';
 import { useAppScope } from '../../core/scope/useAppScope.js';
 import { useAppScopeInternal } from '../../core/scope/AppScopeContext.js';
 import { ScopeUtilsService } from '../../core/scope/scope.utils.frontend.service.js';
+import { findDefaultApiReadOperation } from './route-organization-access.frontend.utils.js';
 const logger = LoggerFrontendService.getLogger();
 const logDebug = logger.debugByType('UserOrgsContext');
 logger.setDebugTypeLogging('UserOrgsContext', false);
@@ -39,7 +40,7 @@ export const UserOrgsProvider = ({ children }) => {
     const { emit } = useEventBus();
     // Consume auth session context
     const authSession = useAuthSession();
-    const { auth, tokenStorage, identifyByEmail, authenticateWithPassword, authenticate, getSessionState, isAuthenticated, logout: authLogout, initiateOAuth2Login, handleAuthCodeExchange, markSessionRestored, setSessionRestoring, connectWebSocket, } = authSession;
+    const { auth, tokenStorage, identifyByEmail, authenticateWithPassword, authenticate, getSessionState, isAuthenticated, logout: authLogout, endSession, getSessionEstablishment, getSessionEndReason, initiateOAuth2Login, handleAuthCodeExchange, markSessionRestored, setSessionRestoring, connectWebSocket, } = authSession;
     const appScope = useAppScope();
     const { commitOrganizationScopeValue } = useAppScopeInternal();
     const currentOrganizationId = appScope.currentOrganizationId;
@@ -103,6 +104,66 @@ export const UserOrgsProvider = ({ children }) => {
             ...(preferences?.privacy !== undefined ? { privacy: preferences.privacy } : {}),
         });
     }, [emit]);
+    /*
+     * `USER_LOGIN` / `USER_LOGOUT` — announced HERE, once per transition of the known person (#1977).
+     *
+     * Nothing emitted them before, so every listener — error-report attribution, analytics identify and
+     * reset, the sign-in and sign-out analytics events — was dead code that read as if sign-in were
+     * observed. This is the one place every sign-in method and every way a session ends converge: each
+     * authentication stores a token, the auto-load effect below restores the user from it, and every
+     * sign-out, refused refresh, failed restore and cross-tab sign-out clears the token, which clears the
+     * user. Emitting at each auth method instead would be a dozen call sites, and the next method added
+     * would be the one that forgot. Declared BEFORE the preferences effect, because effects run in
+     * declaration order and a person's arrival must precede their preferences.
+     *
+     * The id last announced is the guard, so a re-render, a preferences write that replaces the user
+     * object, or StrictMode re-running an effect announces nothing, and a direct switch from one person to
+     * another announces the first one's departure before the second one's arrival. HOW the session began
+     * and WHY it ended are recorded by `AuthSessionProvider`, the only code that knows, and read at the
+     * moment of announcing.
+     *
+     * A DEPARTURE is announced by the two places that clear the user, BEFORE they publish `privacy: null`:
+     * a listener that must act while the person's consent still holds (the sign-out analytics event, sent
+     * before the destinations are reset) needs the announcement first, and the consent-based providers
+     * stop on the `privacy: null` that follows. The effect announces ARRIVALS, and a departure only as a
+     * backstop for a path that cleared the user without announcing. An unmount announces nothing: the
+     * provider going away is not the person signing out.
+     */
+    const announcedUserIdRef = useRef(null);
+    const announceDeparture = useCallback((reason) => {
+        const departedUserId = announcedUserIdRef.current;
+        if (departedUserId === null)
+            return;
+        announcedUserIdRef.current = null;
+        emit(FrontendEvents.USER_LOGOUT, { userId: departedUserId, reason });
+    }, [emit]);
+    const knownUserId = user?._id ?? null;
+    useEffect(() => {
+        const previousUserId = announcedUserIdRef.current;
+        if (previousUserId === knownUserId)
+            return;
+        if (previousUserId !== null && knownUserId !== null) {
+            /*
+             * One person REPLACED by another with no sign-out between them. Believed unreachable today: a sign-in
+             * while someone is loaded sets `isRestoringSession` with `hasInitializedRef` already true, so the
+             * auto-load effect below skips it, and `restoreSession` returns early while a user is loaded. Handled
+             * anyway, because the consequence of getting it wrong is the next person's analytics running under
+             * the previous person's consent: the departure is followed by the same `privacy: null` a sign-out
+             * publishes, BEFORE the arrival, so the next person is judged on their own preferences, which the
+             * preferences effect below publishes after this one.
+             */
+            announceDeparture(SessionEndReason.REPLACED);
+            setPrivacy(null);
+            emitPreferencesChanged(null);
+        }
+        else if (previousUserId !== null) {
+            announceDeparture(getSessionEndReason());
+        }
+        if (knownUserId !== null) {
+            announcedUserIdRef.current = knownUserId;
+            emit(FrontendEvents.USER_LOGIN, { userId: knownUserId, establishment: getSessionEstablishment() });
+        }
+    }, [knownUserId, emit, announceDeparture, emitPreferencesChanged, getSessionEndReason, getSessionEstablishment]);
     const primaryScopeInitiatorIds = useMemo(() => {
         return ScopeUtilsService.buildInitiatorIds({
             userId: appScope.currentUserId,
@@ -176,11 +237,8 @@ export const UserOrgsProvider = ({ children }) => {
                 logger.warn('ORGANIZATIONS resource not available');
                 return { organizationsList, selectedOrgId: null };
             }
-            const orgsReadOp = organizationsConfig.operations.find((op) => op.operationIdentifier === CoreResourceOperation.READ &&
-                op.isOperationDefault === true &&
-                op.isBulkOperation !== true &&
-                (op.variantType === ResourceOperationVariantType.API_CALL ||
-                    op.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK));
+            // Shared with the route organization-access probe, which must address the same READ.
+            const orgsReadOp = findDefaultApiReadOperation(organizationsConfig);
             if (!orgsReadOp) {
                 logger.warn('ORGANIZATIONS READ operation not found');
                 return { organizationsList, selectedOrgId: null };
@@ -201,7 +259,10 @@ export const UserOrgsProvider = ({ children }) => {
              * which does populate the child. Measured against the running stack on 2026-09-10, that
              * response carries every context-enabled child of an organisation — `auditLogs`, `todos`,
              * `tasks`, `knowledgeDocuments`, `organizationMembers`, … — so session restore would pull an
-             * unbounded page of tenant data per membership to obtain four regional fields. The
+             * unbounded page of tenant data per membership to obtain four regional fields. (#583 has since
+             * taken the audit and delivery logs off the context surface and capped every 1:many child at
+             * `contextPolicy.limit`, 20 by default. The page is bounded now, but it is still a page of tenant
+             * data per membership, so the reasoning stands.) The
              * preference record has its own default READ (`GET /organizations/{id}/organization-preference`,
              * reachable by an ordinary `ORG_MEMBER`), which is one small request with a stable shape.
              *
@@ -210,11 +271,7 @@ export const UserOrgsProvider = ({ children }) => {
              * nothing to the i18n event rather than clearing the member's own settings.
              */
             const organizationPreferencesConfig = registry.resourceConfigurations[CoreResourceType.ORGANIZATION_PREFERENCES];
-            const organizationPreferencesReadOp = organizationPreferencesConfig?.operations?.find((op) => op.operationIdentifier === CoreResourceOperation.READ &&
-                op.isOperationDefault === true &&
-                op.isBulkOperation !== true &&
-                (op.variantType === ResourceOperationVariantType.API_CALL ||
-                    op.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK));
+            const organizationPreferencesReadOp = findDefaultApiReadOperation(organizationPreferencesConfig);
             if (!organizationPreferencesReadOp) {
                 logger.warn('ORGANIZATION_PREFERENCES READ operation not found — tenant regional defaults will not be applied');
             }
@@ -282,11 +339,7 @@ export const UserOrgsProvider = ({ children }) => {
         }
         // Get USER_SELF resource config
         const userSelfConfig = registry.resourceConfigurations[CoreResourceType.USER_SELF];
-        const readOperation = userSelfConfig?.operations?.find((op) => op.operationIdentifier === CoreResourceOperation.READ &&
-            op.isOperationDefault === true &&
-            op.isBulkOperation !== true &&
-            (op.variantType === ResourceOperationVariantType.API_CALL ||
-                op.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK));
+        const readOperation = findDefaultApiReadOperation(userSelfConfig);
         if (!readOperation) {
             logger.warn('USER_SELF READ operation not found');
             return false;
@@ -411,7 +464,7 @@ export const UserOrgsProvider = ({ children }) => {
                 }
                 else {
                     logger.warn('Session restoration could not build a valid authenticated context; logging out to avoid a half-restored state');
-                    authLogout();
+                    endSession(SessionEndReason.SESSION_ENDED);
                 }
                 return restored;
             }
@@ -462,7 +515,7 @@ export const UserOrgsProvider = ({ children }) => {
                         errorType: error?.wildoError?.type || error?.response?.data?.error?.type,
                         status: error?.response?.status,
                     });
-                    authLogout();
+                    endSession(SessionEndReason.SESSION_ENDED);
                     return false;
                 }
                 // Fail closed on unexpected NON-transient errors. A partially restored
@@ -472,7 +525,7 @@ export const UserOrgsProvider = ({ children }) => {
                     error: errorMessage,
                     errorType: error?.wildoError?.type,
                 });
-                authLogout();
+                endSession(SessionEndReason.SESSION_ENDED);
                 return false;
             }
         }
@@ -482,7 +535,7 @@ export const UserOrgsProvider = ({ children }) => {
         auth.sessionType,
         auth.accessToken,
         user,
-        authLogout,
+        endSession,
         markSessionRestored,
         setSessionRestoring,
         connectWebSocket,
@@ -544,11 +597,56 @@ export const UserOrgsProvider = ({ children }) => {
     const getPrivacy = useCallback(() => {
         return privacy;
     }, [privacy]);
+    // Depend on the builder alone: the whole AppScope value changes with every custom scope value, and through
+    // this callback it would re-render every `useUserOrgs` consumer.
+    const buildScopeContextualParameters = appScope.buildContextualParameters;
+    const recordConsentDecision = useCallback(async (grantedPurposes) => {
+        const operation = registry.resourceConfigurations[CoreResourceType.USER_SELF_PREFERENCES]?.operations.find((candidate) => candidate.operationIdentifier === CoreResourceOperation.UPDATE
+            && candidate.isOperationDefault === true
+            && candidate.isBulkOperation !== true
+            && (candidate.variantType === ResourceOperationVariantType.API_CALL
+                || candidate.variantType === ResourceOperationVariantType.API_CALL_WITH_CALLBACK));
+        if (!operation) {
+            throw new Error('Cannot record a consent decision: this application mounts no user self-preferences UPDATE operation');
+        }
+        const updated = await doOperation(ResourcesConfig_OperationPathUtils.buildOperationPathKeyFromOperation(operation), {
+            // This provider sits ABOVE `ScopedResourceRegistryProvider`, so the `doOperation` it holds injects
+            // no scope: the user id the self-preferences route is addressed by has to be supplied here. With an
+            // empty set the client could not build the URL and every decision failed before a request left
+            // (`frontend_resource_no_endpoint_available`, #977 — found by driving the prompt in a browser).
+            contextualParameters: buildScopeContextualParameters(),
+            requestData: {
+                // The client instant is only a CLAIM that this write is a decision; the server replaces it.
+                privacy: { consentedPurposes: normalizeConsentPurposes(grantedPurposes), consentDecidedAt: new Date() },
+            },
+        });
+        const storedPrivacy = updated?.privacy;
+        if (!storedPrivacy) {
+            throw new Error('Consent decision was written but the response carried no privacy block');
+        }
+        setPrivacy(storedPrivacy);
+        // Updating the user's preferences record re-emits USER_PREFERENCES_CHANGED through the effect
+        // above, which is how the analytics provider learns the new set without a second channel.
+        setUser((previous) => previous
+            ? { ...previous, userSelfPreferences: { ...(previous.userSelfPreferences ?? {}), privacy: storedPrivacy } }
+            : previous);
+        // While a required purpose was missing the backend refused this person's organization reads, so
+        // session restore may have loaded none (#534 re-review N1). Re-load them now that the decision is
+        // stored; a failure leaves the decision recorded and is retried on the next restore.
+        if (organizations.length === 0) {
+            await refreshOrganizations().catch((error) => {
+                logger.warn('Organizations could not be re-loaded after a consent decision', { error });
+            });
+        }
+        return storedPrivacy;
+    }, [buildScopeContextualParameters, doOperation, registry, organizations.length, refreshOrganizations]);
     /**
      * Logout wrapper that also clears user/org data
      */
     const logout = useCallback(() => {
         logDebug('Logging out user', { userId: user?._id, organizationId: currentOrganizationId });
+        // Announced first, while the person's consent still holds — see the block above (#1977).
+        announceDeparture(SessionEndReason.SIGNED_OUT);
         // Clear user/org data first
         setUser(null);
         setOrganizations([]);
@@ -561,7 +659,7 @@ export const UserOrgsProvider = ({ children }) => {
         previousTokenRef.current = null;
         // Call auth logout (clears tokens, disconnects WebSocket)
         authLogout();
-    }, [user?._id, currentOrganizationId, authLogout, commitOrganizationScopeValue, emitPreferencesChanged]);
+    }, [user?._id, currentOrganizationId, authLogout, announceDeparture, commitOrganizationScopeValue, emitPreferencesChanged]);
     // Auto-load user/org data when token becomes available
     useEffect(() => {
         const accessToken = auth.accessToken;
@@ -593,6 +691,8 @@ export const UserOrgsProvider = ({ children }) => {
     useEffect(() => {
         if (!auth.accessToken && previousTokenRef.current) {
             logDebug('Token removed, clearing user/org data');
+            // Announced before `privacy: null`, with the reason the auth session recorded (#1977).
+            announceDeparture(getSessionEndReason());
             setUser(null);
             setOrganizations([]);
             commitOrganizationScopeValue(null);
@@ -602,7 +702,7 @@ export const UserOrgsProvider = ({ children }) => {
             previousTokenRef.current = null;
             hasInitializedRef.current = false;
         }
-    }, [auth.accessToken, commitOrganizationScopeValue, emitPreferencesChanged]);
+    }, [auth.accessToken, announceDeparture, commitOrganizationScopeValue, emitPreferencesChanged, getSessionEndReason]);
     const value = useMemo(() => ({
         // Re-exported from AuthSession for backward compatibility
         auth,
@@ -631,6 +731,7 @@ export const UserOrgsProvider = ({ children }) => {
         refreshOrganizations,
         // Privacy getter
         getPrivacy,
+        recordConsentDecision,
     }), [
         auth,
         identifyByEmail,
@@ -652,6 +753,7 @@ export const UserOrgsProvider = ({ children }) => {
         getCurrentOrganization,
         refreshOrganizations,
         getPrivacy,
+        recordConsentDecision,
     ]);
     return _jsx(UserOrgsContext.Provider, { value: value, children: children });
 };