@woodsportal/hubspot-kit 1.0.41-dev.4 → 1.0.41-dev.6

package/examples/greenfield/module-hybrid-cdn-auth-full/src/features/auth/auth-navigation.ts

@@ -0,0 +1,81 @@
+import { Routes } from '@/config/routes'
+import { normalizeRouterPath } from '@/utils/normalize-router-path'
+import {
+  hardReplaceToHashPath,
+  historyReplaceFirstNavigate,
+  readHashPathname,
+  readRouterPathname,
+  type SafeAuthRouter,
+} from '@/utils/safe-router-navigation'
+import { resolvePostLoginPath, type PostLoginRouter } from '@/features/auth/resolve-post-login-path'
+
+export type AuthNavigationRouter = PostLoginRouter
+
+let navigationState = {
+  inFlight: false,
+  lastTarget: '',
+  lastAt: 0,
+}
+
+function normalizeTarget(path: string): string {
+  return normalizeRouterPath(path)
+}
+
+export function isRouterAtPath(router: SafeAuthRouter, path: string): boolean {
+  const target = normalizeTarget(path)
+  const pathname = normalizeTarget(readRouterPathname(router))
+  const hashPath = normalizeTarget(readHashPathname())
+  return pathname === target && hashPath === target
+}
+
+function shouldSkipNavigation(target: string): boolean {
+  const now = Date.now()
+  return (
+    navigationState.inFlight ||
+    (navigationState.lastTarget === target && now - navigationState.lastAt < 2000)
+  )
+}
+
+async function runCoordinatedNavigation(router: SafeAuthRouter, rawTarget: string): Promise<void> {
+  const target = normalizeTarget(rawTarget)
+  if (!target || isRouterAtPath(router, target) || shouldSkipNavigation(target)) {
+    return
+  }
+  navigationState = { inFlight: true, lastTarget: target, lastAt: Date.now() }
+  try {
+    await historyReplaceFirstNavigate(router, target)
+    await new Promise<void>((resolve) => window.setTimeout(resolve, 100))
+    if (!isRouterAtPath(router, target)) {
+      hardReplaceToHashPath(target)
+    }
+  } finally {
+    navigationState = { inFlight: false, lastTarget: target, lastAt: Date.now() }
+  }
+}
+
+export function navigateAfterFullAuth(router: AuthNavigationRouter, target?: string): void {
+  const resolved = target ?? resolvePostLoginPath(router)
+  if (isRouterAtPath(router, resolved)) {
+    return
+  }
+  void runCoordinatedNavigation(router, resolved)
+}
+
+export function navigateToMfaGate(router: SafeAuthRouter): void {
+  if (isRouterAtPath(router, Routes.twoFa)) {
+    return
+  }
+  void runCoordinatedNavigation(router, Routes.twoFa)
+}
+
+export function navigateToLogin(router: SafeAuthRouter, path: string = Routes.login): Promise<void> {
+  const target = normalizeTarget(path)
+  if (isRouterAtPath(router, target)) {
+    return Promise.resolve()
+  }
+  return runCoordinatedNavigation(router, target)
+}
+
+export function resetAuthNavigationState(): void {
+  navigationState = { inFlight: false, lastTarget: '', lastAt: 0 }
+}

package/examples/greenfield/module-hybrid-cdn-auth-full/src/features/auth/auth-route-paths.ts

@@ -0,0 +1,29 @@
+import { Routes } from '@/config/routes'
+import { normalizeRouterPath } from '@/utils/normalize-router-path'
+
+const PUBLIC_AUTH_PATHS = new Set<string>([
+  Routes.login,
+  Routes.twoFa,
+  Routes.unauthorized,
+  Routes.ssoLogin,
+])
+
+export function readHashPathname(): string {
+  if (typeof window === 'undefined') {
+    return Routes.app
+  }
+  const segment = window.location.hash.replace(/^#/, '').split('?')[0] || Routes.app
+  return normalizeRouterPath(segment.startsWith('/') ? segment : `/${segment}`)
+}
+
+export function isPublicAuthRoute(pathname: string): boolean {
+  const normalized = normalizeRouterPath(pathname)
+  if (PUBLIC_AUTH_PATHS.has(normalized)) {
+    return true
+  }
+  return normalized.startsWith('/login')
+}
+
+export function isProtectedHashPath(): boolean {
+  return !isPublicAuthRoute(readHashPathname())
+}

package/examples/greenfield/module-hybrid-cdn-auth-full/src/features/auth/auth-session-events.ts

@@ -0,0 +1,2 @@
+/** Fired after login/MFA stores tokens so route guards re-check session. */
+export const AUTH_SESSION_CHANGED = 'woodsportal:auth-session-changed'

package/examples/greenfield/module-hybrid-cdn-auth-full/src/features/auth/auth-session.ts

@@ -0,0 +1,51 @@
+import {
+  api,
+  clearMfaPendingAccessToken,
+  hydrateMfaPendingAccessToken,
+  recoverMfaGateOnBoot as sdkRecoverMfaGateOnBoot,
+} from '@/integrations/woodsportal-sdk'
+import { AUTH_SESSION_CHANGED } from '@/features/auth/auth-session-events'
+import { clearMfaPendingState, getMfaPendingContext } from '@/features/auth/mfa-pending-storage'
+
+export function isMfaPendingSession(): boolean {
+  return getMfaPendingContext() != null && Boolean(api.auth.session.getAccessToken())
+}
+
+export function isFullyAuthenticatedSession(): boolean {
+  if (isMfaPendingSession()) {
+    return false
+  }
+  return api.auth.session.isFullyAuthenticated()
+}
+
+export function clearMfaPendingLoginSession(): void {
+  clearMfaPendingState()
+  clearMfaPendingAccessToken('c')
+  api.auth.session.clearAccessToken()
+  if (typeof window !== 'undefined') {
+    window.dispatchEvent(new CustomEvent(AUTH_SESSION_CHANGED))
+  }
+}
+
+export type MfaBootRecoveryResult = 'pending' | 'orphan_cleared' | 'stale_token_cleared' | 'none'
+
+export async function recoverMfaGateOnBoot(): Promise<MfaBootRecoveryResult> {
+  return sdkRecoverMfaGateOnBoot({
+    hasMfaContext: () => getMfaPendingContext() != null,
+    hasAccessToken: () => Boolean(api.auth.session.getAccessToken()),
+    hasRefreshToken: () => Boolean(api.auth.session.getRefreshToken()),
+    clearMfaOrphan: () => clearMfaPendingLoginSession(),
+    clearStaleAccessToken: () => {
+      clearMfaPendingAccessToken('c')
+      api.auth.session.clearAccessToken()
+      if (typeof window !== 'undefined') {
+        window.dispatchEvent(new CustomEvent(AUTH_SESSION_CHANGED))
+      }
+    },
+    tryHydrateMfaAccessToken: () =>
+      hydrateMfaPendingAccessToken({
+        lane: 'c',
+        setAccessToken: (token, expiresIn) => api.auth.session.setAccessToken(token, expiresIn),
+      }),
+  })
+}

package/examples/greenfield/module-hybrid-cdn-auth-full/src/features/auth/clear-client-auth-session.ts

@@ -0,0 +1,62 @@
+import {
+  clearClientIframeRefreshLocalKeys,
+  clearClientSessionStorageKeys,
+  resetSessionStores,
+  signalSessionChanged,
+  WP_STORAGE_KEYS,
+} from 'woodsportal-client-sdk'
+import { api } from '@/integrations/woodsportal-sdk'
+import { clearClientAuthCookies } from '@/utils/cookie'
+import {
+  captureLoginEmailBeforeSessionClear,
+  clearLoginPreAuthSession,
+  extractLoginEmailFromPayload,
+  getStoredLoginEmail,
+} from '@/features/auth/login-email-storage'
+import { clearMfaPendingLoginSession } from '@/features/auth/auth-session'
+import { AUTH_SESSION_CHANGED } from '@/features/auth/auth-session-events'
+
+let queryCacheClearHandler: (() => void) | undefined
+
+export function registerClientSessionQueryClear(handler: () => void): void {
+  queryCacheClearHandler = handler
+}
+
+export function clearClientAuthSession(options?: { signalCrossTab?: boolean }): void {
+  captureLoginEmailBeforeSessionClear(() => {
+    const details = api.auth.session.getLoggedInDetails?.() as Record<string, unknown> | undefined
+    return (
+      extractLoginEmailFromPayload(details) ??
+      extractLoginEmailFromPayload({ email: getStoredLoginEmail() }) ??
+      undefined
+    )
+  })
+
+  clearClientAuthCookies()
+  clearMfaPendingLoginSession()
+  clearLoginPreAuthSession()
+  clearClientSessionStorageKeys()
+  clearClientIframeRefreshLocalKeys()
+  try {
+    window.localStorage?.removeItem(WP_STORAGE_KEYS.c.auth.refreshLock)
+  } catch {
+    // ignore
+  }
+  api.auth.session.clearAccessToken()
+  resetSessionStores()
+  api.auth.session.resetSessionAuthState()
+  api.auth.session.clearSessionRefreshExhaustedState?.()
+
+  try {
+    queryCacheClearHandler?.()
+  } catch {
+    // ignore
+  }
+
+  if (typeof window !== 'undefined') {
+    if (options?.signalCrossTab !== false) {
+      signalSessionChanged('rev')
+    }
+    window.dispatchEvent(new CustomEvent(AUTH_SESSION_CHANGED))
+  }
+}

package/examples/greenfield/module-hybrid-cdn-auth-full/src/features/auth/components/starter-login.tsx

@@ -0,0 +1,83 @@
+import { useState } from 'react'
+import { useRouter } from '@tanstack/react-router'
+import { toast } from 'sonner'
+import { Button } from '@/components/ui/Button'
+import { Form, FormField } from '@/components/ui/Form'
+import { Input } from '@/components/ui/Input'
+import { SsoLoginButton } from '@/components/ui/auth/SsoLoginButton'
+import { api } from '@/integrations/woodsportal-sdk'
+import { handleAuthLoginResponse, MFA_REQUIRED_SCAFFOLD_MESSAGE } from '@/features/auth/login-session-bridge'
+import { resolveAuthLoginErrorMessage } from '@/features/auth/resolve-auth-login-error-message'
+import {
+  getStoredLoginEmail,
+  setStoredLoginEmail,
+} from '@/features/auth/login-email-storage'
+
+export function StarterLogin() {
+  const router = useRouter()
+  const [email, setEmail] = useState(getStoredLoginEmail() ?? '')
+  const [password, setPassword] = useState('')
+  const [isSubmitting, setIsSubmitting] = useState(false)
+
+  const onSubmit = async (event: React.FormEvent) => {
+    event.preventDefault()
+    setIsSubmitting(true)
+    try {
+      setStoredLoginEmail(email)
+      const { login } = api.auth.login({})
+      const response = await login({ username: email.trim(), password })
+      const result = await handleAuthLoginResponse(response, router)
+      if (!result.success) {
+        if (result.reason === 'mfa_required') {
+          toast.error(MFA_REQUIRED_SCAFFOLD_MESSAGE)
+        } else {
+          toast.error('Login failed — no access token returned.')
+        }
+        return
+      }
+      if (!result.mfaRequired) {
+        toast.success('Signed in')
+      }
+    } catch (error) {
+      toast.error(resolveAuthLoginErrorMessage(error))
+    } finally {
+      setIsSubmitting(false)
+    }
+  }
+
+  return (
+    <div className="w-full max-w-md rounded-lg border border-gray-200 bg-white p-6 shadow-sm">
+      <h1 className="mb-2 text-xl font-semibold text-gray-900">Sign in</h1>
+      <p className="mb-6 text-sm text-gray-600">Use your portal email and password or SSO.</p>
+      <Form onSubmit={onSubmit}>
+        <FormField label="Email">
+          <Input
+            type="email"
+            autoComplete="email"
+            required
+            value={email}
+            onChange={(e) => setEmail(e.target.value)}
+          />
+        </FormField>
+        <FormField label="Password">
+          <Input
+            type="password"
+            autoComplete="current-password"
+            required
+            value={password}
+            onChange={(e) => setPassword(e.target.value)}
+          />
+        </FormField>
+        <Button type="submit" className="w-full" disabled={isSubmitting}>
+          {isSubmitting ? 'Signing in…' : 'Sign in'}
+        </Button>
+      </Form>
+      <div className="my-4 flex items-center gap-3 text-xs text-gray-500">
+        <span className="h-px flex-1 bg-gray-200" />
+        or
+        <span className="h-px flex-1 bg-gray-200" />
+      </div>
+      <SsoLoginButton />
+    </div>
+  )
+}

package/examples/greenfield/module-hybrid-cdn-auth-full/src/features/auth/login-email-storage.ts

@@ -0,0 +1,64 @@
+import { WP_STORAGE_KEYS } from 'woodsportal-client-sdk'
+
+const LOGIN_EMAIL_KEY = WP_STORAGE_KEYS.c.login.email
+
+function isValidEmail(value: string): boolean {
+  return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value.trim())
+}
+
+export function extractLoginEmailFromPayload(
+  payload: Record<string, unknown> | null | undefined,
+): string | null {
+  if (!payload || typeof payload !== 'object') {
+    return null
+  }
+  const loggedInDetails = payload.loggedInDetails
+  if (loggedInDetails && typeof loggedInDetails === 'object') {
+    const email = (loggedInDetails as Record<string, unknown>).email
+    if (typeof email === 'string' && isValidEmail(email)) {
+      return email.trim().toLowerCase()
+    }
+  }
+  for (const key of ['email', 'username'] as const) {
+    const value = payload[key]
+    if (typeof value === 'string' && isValidEmail(value)) {
+      return value.trim().toLowerCase()
+    }
+  }
+  return null
+}
+
+export function captureLoginEmailBeforeSessionClear(
+  resolveLoggedInEmail?: () => string | null | undefined,
+): void {
+  if (getStoredLoginEmail()) {
+    return
+  }
+  const email = resolveLoggedInEmail?.()
+  if (email) {
+    setStoredLoginEmail(email)
+  }
+}
+
+export function getStoredLoginEmail(): string | null {
+  if (typeof window === 'undefined') {
+    return null
+  }
+  const stored = sessionStorage.getItem(LOGIN_EMAIL_KEY)?.trim().toLowerCase() ?? ''
+  return stored && isValidEmail(stored) ? stored : null
+}
+
+export function setStoredLoginEmail(email: string): void {
+  if (typeof window === 'undefined') {
+    return
+  }
+  const normalized = email.trim().toLowerCase()
+  if (!isValidEmail(normalized)) {
+    return
+  }
+  sessionStorage.setItem(LOGIN_EMAIL_KEY, normalized)
+}
+
+export function clearLoginPreAuthSession(): void {
+  // starter scaffold: no pre-login passkey state
+}

package/examples/greenfield/module-hybrid-cdn-auth-full/src/features/auth/login-session-bridge.ts

@@ -0,0 +1,74 @@
+import { api } from '@/integrations/woodsportal-sdk'
+import {
+  navigateAfterFullAuth,
+  navigateToMfaGate,
+  type AuthNavigationRouter,
+} from '@/features/auth/auth-navigation'
+import { clearMfaPendingState, storeMfaPendingContext } from '@/features/auth/mfa-pending-storage'
+import { resolvePostLoginPath } from '@/features/auth/resolve-post-login-path'
+import { AUTH_SESSION_CHANGED } from '@/features/auth/auth-session-events'
+import { signalSessionChanged, storeMfaPendingAccessToken } from 'woodsportal-client-sdk'
+import {
+  extractLoginEmailFromPayload,
+  setStoredLoginEmail,
+} from '@/features/auth/login-email-storage'
+
+function notifyAuthSessionChanged(): void {
+  if (typeof window === 'undefined') return
+  signalSessionChanged('login')
+  window.dispatchEvent(new CustomEvent(AUTH_SESSION_CHANGED))
+}
+
+type AuthRouter = AuthNavigationRouter
+
+function unwrapLoginPayload(
+  response: { data?: Record<string, unknown>; statusMsg?: string } | Record<string, unknown>,
+): Record<string, unknown> {
+  return (response?.data ?? response ?? {}) as Record<string, unknown>
+}
+
+export type HandleAuthLoginResponseOptions = {
+  clearPreHashQuery?: () => void
+  onSubscriptionType?: (subscriptionType: string) => void
+}
+
+export type HandleAuthLoginResponseResult =
+  | { success: false; reason: 'no_token' }
+  | { success: true; mfaRequired: true }
+  | { success: true; mfaRequired: false }
+
+export async function handleAuthLoginResponse(
+  response: { data?: Record<string, unknown>; statusMsg?: string } | Record<string, unknown>,
+  router: AuthRouter,
+  options: HandleAuthLoginResponseOptions = {},
+): Promise<HandleAuthLoginResponseResult> {
+  const data = unwrapLoginPayload(response)
+  const tokenData = (data.tokenData ?? {}) as { token?: string; expiresIn?: number }
+  const sessionToken = api.auth.session.getAccessToken()
+  const token = tokenData.token ?? sessionToken ?? undefined
+
+  if (!token) {
+    return { success: false, reason: 'no_token' }
+  }
+
+  const loginEmail = extractLoginEmailFromPayload(data)
+  if (loginEmail) {
+    setStoredLoginEmail(loginEmail)
+  }
+
+  if (data.twoFactorRequired === true) {
+    storeMfaPendingContext(data)
+    storeMfaPendingAccessToken('c', token, tokenData.expiresIn)
+    api.auth.session.setAccessToken(token, tokenData.expiresIn)
+    options.clearPreHashQuery?.()
+    notifyAuthSessionChanged()
+    navigateToMfaGate(router)
+    return { success: true, mfaRequired: true }
+  }
+
+  clearMfaPendingState()
+  options.clearPreHashQuery?.()
+  notifyAuthSessionChanged()
+  navigateAfterFullAuth(router, resolvePostLoginPath(router))
+  return { success: true, mfaRequired: false }
+}

package/examples/greenfield/module-hybrid-cdn-auth-full/src/features/auth/mfa-otp-utils.ts

@@ -0,0 +1,24 @@
+import type { MfaMethod } from '@/integrations/woodsportal-sdk'
+
+const OTP_DELIVERY_METHODS: MfaMethod[] = ['EMAIL_OTP', 'SMS_OTP']
+
+export const MFA_OTP_RESEND_COOLDOWN_MS = 30_000
+
+export function isOtpDeliveryMethod(method: MfaMethod): boolean {
+  return OTP_DELIVERY_METHODS.includes(method)
+}
+
+export function getResendSecondsLeft(cooldownUntil: number | null): number {
+  if (cooldownUntil == null) {
+    return 0
+  }
+  return Math.max(0, Math.ceil((cooldownUntil - Date.now()) / 1000))
+}
+
+export function normalizeOtpCode(value: string): string {
+  return value.replace(/\D/g, '').slice(0, 6)
+}
+
+export function isValidOtpCode(value: string): boolean {
+  return /^\d{6}$/.test(normalizeOtpCode(value))
+}

package/examples/greenfield/module-hybrid-cdn-auth-full/src/features/auth/mfa-pending-storage.ts

@@ -0,0 +1,108 @@
+import type { MfaMethod, MfaMethodOption } from '@/integrations/woodsportal-sdk'
+import { clearMfaPendingAccessToken, WP_STORAGE_KEYS } from 'woodsportal-client-sdk'
+
+const MFA_METHODS_KEY = WP_STORAGE_KEYS.c.mfa.methods
+const MFA_DEFAULT_METHOD_KEY = WP_STORAGE_KEYS.c.mfa.default
+const MFA_OTP_DELIVERY_KEY = WP_STORAGE_KEYS.c.mfa.otp
+const MFA_OTP_MASKED_KEY = WP_STORAGE_KEYS.c.mfa.otp
+const MFA_SCOPE_KEY = WP_STORAGE_KEYS.c.mfa.scope
+const MFA_PORTAL_ID_KEY = WP_STORAGE_KEYS.c.mfa.portalId
+const MFA_PORTAL_NAME_KEY = WP_STORAGE_KEYS.c.mfa.portalName
+const MFA_PORTAL_URL_KEY = WP_STORAGE_KEYS.c.mfa.portalUrl
+
+export type MfaPendingContext = {
+  methods: Array<MfaMethodOption>
+  defaultMethod: MfaMethod
+  otpDelivery?: string
+  otpDestination?: string
+  scopeKey?: string
+  portalId?: number
+  portalName?: string
+  portalUrl?: string
+}
+
+function readOptionalString(payload: Record<string, unknown>, key: string): string | undefined {
+  const value = payload[key]
+  if (value == null || value === '') {
+    return undefined
+  }
+  return String(value)
+}
+
+function readOptionalNumber(payload: Record<string, unknown>, key: string): number | undefined {
+  const value = payload[key]
+  if (value == null || value === '') {
+    return undefined
+  }
+  const parsed = Number(value)
+  return Number.isNaN(parsed) ? undefined : parsed
+}
+
+export function storeMfaPendingContext(payload: Record<string, unknown>): void {
+  sessionStorage.setItem(MFA_METHODS_KEY, JSON.stringify(payload.mfaMethods ?? []))
+  sessionStorage.setItem(MFA_DEFAULT_METHOD_KEY, String(payload.defaultMethod ?? 'EMAIL_OTP'))
+  const otpDestination =
+    typeof payload.otpDestination === 'string'
+      ? payload.otpDestination
+      : typeof payload.otpDestinationMasked === 'string'
+        ? payload.otpDestinationMasked
+        : undefined
+  if (payload.otpDelivery != null) {
+    sessionStorage.setItem(MFA_OTP_DELIVERY_KEY, String(payload.otpDelivery))
+  }
+  if (otpDestination != null) {
+    sessionStorage.setItem(MFA_OTP_MASKED_KEY, otpDestination)
+  }
+  const portalId = readOptionalNumber(payload, 'portalId')
+  if (readOptionalString(payload, 'scopeKey')) {
+    sessionStorage.setItem(MFA_SCOPE_KEY, readOptionalString(payload, 'scopeKey')!)
+  }
+  if (portalId != null) {
+    sessionStorage.setItem(MFA_PORTAL_ID_KEY, String(portalId))
+  }
+  if (readOptionalString(payload, 'portalName')) {
+    sessionStorage.setItem(MFA_PORTAL_NAME_KEY, readOptionalString(payload, 'portalName')!)
+  }
+  if (readOptionalString(payload, 'portalUrl')) {
+    sessionStorage.setItem(MFA_PORTAL_URL_KEY, readOptionalString(payload, 'portalUrl')!)
+  }
+}
+
+export function getMfaPendingContext(): MfaPendingContext | null {
+  const methodsRaw = sessionStorage.getItem(MFA_METHODS_KEY)
+  if (!methodsRaw) {
+    return null
+  }
+  let methods: Array<MfaMethodOption> = []
+  try {
+    methods = JSON.parse(methodsRaw) as Array<MfaMethodOption>
+  } catch {
+    methods = []
+  }
+  const defaultMethod = (sessionStorage.getItem(MFA_DEFAULT_METHOD_KEY) ?? 'EMAIL_OTP') as MfaMethod
+  const portalIdRaw = sessionStorage.getItem(MFA_PORTAL_ID_KEY)
+  const portalId =
+    portalIdRaw != null && portalIdRaw !== '' ? Number(portalIdRaw) : undefined
+  return {
+    methods,
+    defaultMethod,
+    otpDelivery: sessionStorage.getItem(MFA_OTP_DELIVERY_KEY) ?? undefined,
+    otpDestination: sessionStorage.getItem(MFA_OTP_MASKED_KEY) ?? undefined,
+    scopeKey: sessionStorage.getItem(MFA_SCOPE_KEY) ?? undefined,
+    portalId: portalId != null && !Number.isNaN(portalId) ? portalId : undefined,
+    portalName: sessionStorage.getItem(MFA_PORTAL_NAME_KEY) ?? undefined,
+    portalUrl: sessionStorage.getItem(MFA_PORTAL_URL_KEY) ?? undefined,
+  }
+}
+
+export function clearMfaPendingState(): void {
+  sessionStorage.removeItem(MFA_METHODS_KEY)
+  sessionStorage.removeItem(MFA_DEFAULT_METHOD_KEY)
+  sessionStorage.removeItem(MFA_OTP_DELIVERY_KEY)
+  sessionStorage.removeItem(MFA_OTP_MASKED_KEY)
+  sessionStorage.removeItem(MFA_SCOPE_KEY)
+  sessionStorage.removeItem(MFA_PORTAL_ID_KEY)
+  sessionStorage.removeItem(MFA_PORTAL_NAME_KEY)
+  sessionStorage.removeItem(MFA_PORTAL_URL_KEY)
+  clearMfaPendingAccessToken('c')
+}

package/examples/greenfield/module-hybrid-cdn-auth-full/src/features/auth/mfa-portal.ts

@@ -0,0 +1,45 @@
+import { env } from '@/env'
+import { getMfaPendingContext } from '@/features/auth/mfa-pending-storage'
+
+export type MfaPortalContext = {
+  portalId?: number
+  portalName?: string
+  portalUrl?: string
+  scopeKey?: string
+}
+
+function parsePortalId(value: unknown): number | undefined {
+  if (value == null || value === '') {
+    return undefined
+  }
+  const parsed = Number(value)
+  return Number.isNaN(parsed) ? undefined : parsed
+}
+
+export function resolveMfaPortalContext(): MfaPortalContext {
+  const pending = getMfaPendingContext()
+  if (pending?.portalId != null) {
+    return {
+      portalId: pending.portalId,
+      portalName: pending.portalName,
+      portalUrl: pending.portalUrl,
+      scopeKey: pending.scopeKey,
+    }
+  }
+  if (env.VITE_DEV_PORTAL_ID != null && env.VITE_DEV_PORTAL_ID !== '') {
+    return { portalId: parsePortalId(env.VITE_DEV_PORTAL_ID) }
+  }
+  const hubPortalId =
+    typeof window !== 'undefined'
+      ? (window as Window & { hubSpotData?: { portalId?: unknown } }).hubSpotData?.portalId
+      : undefined
+  const parsed = parsePortalId(hubPortalId)
+  if (parsed != null) {
+    return { portalId: parsed }
+  }
+  return {}
+}
+
+export function resolveMfaPortalId(): number | undefined {
+  return resolveMfaPortalContext().portalId
+}

package/examples/greenfield/module-hybrid-cdn-auth-full/src/features/auth/post-login-path.ts

@@ -0,0 +1,17 @@
+import { Routes } from '@/config/routes'
+import { normalizeRouterPath } from '@/utils/normalize-router-path'
+
+const AUTH_RETURN_PATHS = new Set<string>([
+  Routes.login,
+  Routes.twoFa,
+  Routes.unauthorized,
+  Routes.ssoLogin,
+])
+
+export function isBlockedPostLoginPath(path: string): boolean {
+  const normalized = normalizeRouterPath(path)
+  if (AUTH_RETURN_PATHS.has(normalized)) {
+    return true
+  }
+  return normalized.startsWith('/login')
+}