@workos-inc/widgets 1.18.0 → 1.19.0-next.1790102694835

package/dist/esm/admin-portal-sso-connection.client.js

@@ -9,9 +9,10 @@ import {
 } from "./lib/admin-portal-sso-connection.js";
 import { ApiProvider, useApiReady } from "./api/api-provider.js";
 import {
-  useListSsoConnections,
-  useGenerateAdminPortalLink
-} from "./api/endpoint.js";
+  clientGraphqlQueryKey,
+  useClientGraphqlMutation,
+  useClientGraphqlQuery
+} from "./api/client-graphql/hooks.js";
 import { useWorkOsApiUrl } from "./lib/widgets-context.js";
 import { ErrorBoundary } from "./lib/error-boundary.js";
 import {
@@ -47,23 +48,22 @@ const AdminPortalSsoConnectionImpl = (props) => {
   if (isApiReady && currentDate === null) {
     setCurrentDate(/* @__PURE__ */ new Date());
   }
-  const { mutate: generateAdminPortalLink, isPending } = useGenerateAdminPortalLink({
-    mutation: {
-      onSuccess: (data) => {
-        openAdminPortalViaForm(data.link, {
-          target: "_blank",
-          rel: "noopener noreferrer"
-        });
-      }
+  const { mutate: generateAdminPortalLink, isPending } = useClientGraphqlMutation({
+    mutationFn: (sdk, intent) => sdk.CreateAdminPortalLink({ intent }),
+    onSuccess: (data) => {
+      openAdminPortalViaForm(data.createAdminPortalLink.link, {
+        target: "_blank",
+        rel: "noopener noreferrer"
+      });
     }
   });
-  const query = useListSsoConnections();
+  const query = useClientGraphqlQuery({
+    queryKey: clientGraphqlQueryKey("ListSsoConnections"),
+    queryFn: (sdk) => sdk.ListSsoConnections(),
+    select: (data) => data.ssoConnections
+  });
   const initConfig = () => {
-    generateAdminPortalLink({
-      params: {
-        intent: "sso"
-      }
-    });
+    generateAdminPortalLink("Sso");
   };
   if (query.isLoading) {
     return /* @__PURE__ */ jsx(AdminPortalSsoConnectionLoading, { ...props });
@@ -105,7 +105,7 @@ const AdminPortalSsoConnectionImpl = (props) => {
           connectionStatus: "NotConfigured"
         };
       }
-      const identityProvider = getIdentityProvider(connection);
+      const identityProvider = getIdentityProvider(connection.type);
       switch (connectionStatus) {
         case "Active":
           return {
@@ -192,74 +192,102 @@ function getConnectionState(connection, currentDate) {
       return unreachable(connection.state);
   }
 }
-function getIdentityProvider(connection) {
-  switch (connection.type) {
-    case "AdfsSaml":
-    case "EntraIdOidc":
+function getIdentityProvider(type) {
+  switch (type) {
+    case "ADFSSAML":
+    case "EntraIdOIDC":
+    case "MicrosoftOAuth":
       return "microsoft";
     case "Auth0Migration":
-    case "Auth0Saml":
+    case "Auth0SAML":
       return "auth0";
-    case "AzureSaml":
+    case "AzureSAML":
       return "azure";
-    case "CasSaml":
+    case "CasSAML":
       return "cas";
-    case "ClassLinkSaml":
+    case "ClassLinkSAML":
       return "classlink";
-    case "CloudflareSaml":
+    case "CloudflareSAML":
       return "cloudflare";
-    case "CyberArkSaml":
+    case "CyberArkSAML":
       return "cyberark";
-    case "DuoSaml":
+    case "DuoSAML":
       return "duo";
-    case "GenericSaml":
+    case "GenericSAML":
       return "generic-saml";
-    case "GoogleSaml":
-    case "GoogleOidc":
+    case "GoogleSAML":
+    case "GoogleOIDC":
+    case "GoogleOAuth":
       return "google";
-    case "JumpCloudSaml":
+    case "JumpCloudSAML":
       return "jumpcloud";
-    case "KeycloakSaml":
+    case "KeycloakSAML":
       return "keycloak";
-    case "LastPassSaml":
+    case "LastPassSAML":
       return "lastpass";
-    case "MiniOrangeSaml":
+    case "MiniOrangeSAML":
       return "miniorange";
-    case "NetIqSaml":
+    case "NetIqSAML":
       return "net-iq";
-    case "OktaOidc":
-    case "OktaSaml":
+    case "OktaOIDC":
+    case "OktaSAML":
       return "okta";
-    case "OneLoginSaml":
+    case "OneLoginSAML":
       return "onelogin";
-    case "OracleSaml":
+    case "OracleSAML":
       return "oracle";
-    case "PingFederateSaml":
-    case "PingOneSaml":
+    case "PingFederateSAML":
+    case "PingOneSAML":
       return "ping-identity";
-    case "RipplingSaml":
+    case "RipplingSAML":
       return "rippling";
-    case "SalesforceSaml":
+    case "SalesforceSAML":
+    case "SalesforceOAuth":
       return "salesforce";
-    case "ShibbolethGenericSaml":
-    case "ShibbolethSaml":
+    case "ShibbolethGenericSAML":
+    case "ShibbolethSAML":
       return "shibboleth";
-    case "SimpleSamlPhpSaml":
+    case "SimpleSamlPhpSAML":
       return "simple-saml-php";
     case "TestIdp":
       return "test-idp";
-    case "VmWareSaml":
+    case "VMwareSAML":
       return "vmware";
     case "AdpOidc":
       return "adp";
-    case "GenericOidc":
+    case "GenericOIDC":
       return "generic-oidc";
     case "LoginGovOidc":
       return "login-gov";
-    case "CleverOidc":
+    case "CleverOIDC":
       return "clever";
+    case "AppleOAuth":
+      return "apple";
+    case "BitbucketOAuth":
+      return "bitbucket";
+    case "DiscordOAuth":
+      return "discord";
+    case "GithubOAuth":
+      return "github";
+    case "GitLabOAuth":
+      return "gitlab";
+    case "IntuitOAuth":
+      return "intuit";
+    case "LinkedInOAuth":
+      return "linkedin";
+    case "SlackOAuth":
+      return "slack";
+    case "VercelOAuth":
+    case "VercelMarketplaceOAuth":
+      return "vercel";
+    case "XeroOAuth":
+      return "xero";
+    case "GrokOAuth":
+    case "XOAuth":
+    case "MagicLink":
+      return "workos";
     default:
-      return unreachable(connection);
+      return unreachable(type);
   }
 }
 export {

package/dist/esm/admin-portal-sso-connection.client.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/admin-portal-sso-connection.client.tsx"],"sourcesContent":["\"use client\";\n\nimport * as React from \"react\";\nimport {\n  AdminPortalOpenButton,\n  AdminPortalSsoConnectionError,\n  AdminPortalSsoConnectionLoading,\n  AdminPortalSsoConnection as AdminPortalSsoConnectionPresentational,\n} from \"./lib/admin-portal-sso-connection.js\";\nimport type {\n  AdminPortalSsoConnectionErrorProps,\n  AdminPortalSsoConnectionLoadingProps,\n  AdminPortalSsoConnectionStatusProps,\n} from \"./lib/admin-portal-sso-connection.js\";\nimport { ApiProvider, AuthToken, useApiReady } from \"./api/api-provider.js\";\nimport {\n  type SsoConnection,\n  useListSsoConnections,\n  useGenerateAdminPortalLink,\n} from \"./api/endpoint.js\";\nimport { useWorkOsApiUrl } from \"./lib/widgets-context.js\";\nimport { ErrorBoundary } from \"./lib/error-boundary.js\";\nimport {\n  openAdminPortalViaForm,\n  unreachable,\n  WidgetRootDomProps,\n} from \"./lib/utils.js\";\nimport { IdentityProvider } from \"./lib/identity-providers.js\";\n\ninterface AdminPortalSsoConnectionProps extends WidgetRootDomProps {\n  authToken: AuthToken;\n}\n\nconst AdminPortalSsoConnection: React.FC<AdminPortalSsoConnectionProps> = ({\n  authToken,\n  ...domProps\n}) => {\n  const baseUrl = useWorkOsApiUrl();\n  return (\n    <ErrorBoundary\n      fallbackRender={({ error }) => (\n        <AdminPortalSsoConnectionError error={error} {...domProps} />\n      )}\n    >\n      <ApiProvider\n        widgetType=\"admin-portal-sso-connection\"\n        authToken={authToken}\n        baseUrl={baseUrl}\n      >\n        <AdminPortalSsoConnectionImpl {...domProps} />\n      </ApiProvider>\n    </ErrorBoundary>\n  );\n};\n\nconst AdminPortalSsoConnectionImpl = (props: WidgetRootDomProps) => {\n  const isApiReady = useApiReady();\n  const [currentDate, setCurrentDate] = React.useState<Date | null>(() =>\n    isApiReady ? new Date() : null,\n  );\n  if (isApiReady && currentDate === null) {\n    setCurrentDate(new Date());\n  }\n\n  const { mutate: generateAdminPortalLink, isPending } =\n    useGenerateAdminPortalLink({\n      mutation: {\n        onSuccess: (data) => {\n          openAdminPortalViaForm(data.link, {\n            target: \"_blank\",\n            rel: \"noopener noreferrer\",\n          });\n        },\n      },\n    });\n\n  const query = useListSsoConnections();\n\n  const initConfig = () => {\n    generateAdminPortalLink({\n      params: {\n        intent: \"sso\",\n      },\n    });\n  };\n\n  if (query.isLoading) {\n    return <AdminPortalSsoConnectionLoading {...props} />;\n  }\n\n  if (query.isError) {\n    return <AdminPortalSsoConnectionError error={query.error} {...props} />;\n  }\n\n  if (query.data) {\n    const connection = query.data[0];\n    if (!connection) {\n      return (\n        <ErrorBoundary\n          fallbackRender={({ error }) => (\n            <AdminPortalSsoConnectionError error={error} {...props} />\n          )}\n        >\n          <AdminPortalSsoConnectionPresentational\n            {...props}\n            connectionStatus=\"NotConfigured\"\n            currentDate={currentDate}\n            lastSession={null}\n            adminPortalOpenButton={\n              <AdminPortalOpenButton\n                isPending={isPending}\n                initConfig={initConfig}\n              />\n            }\n          />\n        </ErrorBoundary>\n      );\n    }\n\n    const connectionState = getConnectionState(connection, currentDate);\n    const statusProps: AdminPortalSsoConnectionStatusProps = (() => {\n      const connectionStatus = connectionState.status;\n      if (!connection || connectionStatus === \"NotConfigured\") {\n        return {\n          connectionStatus: \"NotConfigured\",\n        } satisfies AdminPortalSsoConnectionStatusProps;\n      }\n\n      const identityProvider = getIdentityProvider(connection);\n      switch (connectionStatus) {\n        case \"Active\":\n          return {\n            connectionStatus,\n            identityProvider,\n          } satisfies AdminPortalSsoConnectionStatusProps;\n        case \"Inactive\":\n          return {\n            connectionStatus,\n            identityProvider,\n          } satisfies AdminPortalSsoConnectionStatusProps;\n        case \"Expired\":\n        case \"Expiring\":\n          return {\n            connectionStatus,\n            expiryDate: connectionState.expiryDate,\n            identityProvider,\n          } satisfies AdminPortalSsoConnectionStatusProps;\n        default:\n          return unreachable(connectionState);\n      }\n    })();\n\n    const lastSession = connection.lastSession\n      ? new Date(connection.lastSession.createdAt)\n      : null;\n\n    return (\n      <ErrorBoundary\n        fallbackRender={({ error }) => (\n          <AdminPortalSsoConnectionError error={error} {...props} />\n        )}\n      >\n        <AdminPortalSsoConnectionPresentational\n          {...props}\n          {...statusProps}\n          currentDate={currentDate}\n          lastSession={lastSession}\n          adminPortalOpenButton={\n            <AdminPortalOpenButton\n              isPending={isPending}\n              initConfig={initConfig}\n            />\n          }\n        />\n      </ErrorBoundary>\n    );\n  }\n};\n\ntype ConnectionState =\n  | { status: \"NotConfigured\" }\n  | { status: \"Active\" }\n  | { status: \"Inactive\" }\n  | {\n      status: \"Expiring\";\n      daysUntilExpiry: number | null;\n      expiryDate: Date | null;\n    }\n  | { status: \"Expired\"; expiryDate: Date | null };\n\nfunction getConnectionState(\n  connection: SsoConnection,\n  currentDate: Date | null,\n): ConnectionState {\n  switch (connection.state) {\n    case \"Active\":\n    case \"Validating\":\n    case \"Deleting\": {\n      const activeStatus = { status: \"Active\" } satisfies ConnectionState;\n      if (connection.providerTag !== \"Saml\") {\n        return activeStatus;\n      }\n\n      if (connection.latestExpiredCertificate) {\n        return {\n          status: \"Expired\",\n          expiryDate: connection.latestExpiredCertificate.notAfter\n            ? new Date(connection.latestExpiredCertificate.notAfter)\n            : null,\n        };\n      }\n\n      const expiryTime = connection.latestExpiringCertificate?.notAfter;\n      if (currentDate == null || expiryTime == null) {\n        return activeStatus;\n      }\n\n      const expiryDate = new Date(expiryTime);\n      const daysUntilExpiry = (() => {\n        const diff = expiryDate.getTime() - currentDate.getTime();\n        if (diff < 0) {\n          return -1;\n        }\n\n        return diff / (1000 * 60 * 60 * 24);\n      })();\n\n      if (daysUntilExpiry !== -1 && daysUntilExpiry <= 30) {\n        return { status: \"Expiring\", daysUntilExpiry, expiryDate };\n      }\n\n      return activeStatus;\n    }\n    case \"Inactive\": {\n      return { status: \"Inactive\" };\n    }\n    default:\n      return unreachable(connection.state);\n  }\n}\n\nfunction getIdentityProvider(connection: SsoConnection): IdentityProvider {\n  switch (connection.type) {\n    case \"AdfsSaml\":\n    case \"EntraIdOidc\":\n      return \"microsoft\";\n    case \"Auth0Migration\":\n    case \"Auth0Saml\":\n      return \"auth0\";\n    case \"AzureSaml\":\n      return \"azure\";\n    case \"CasSaml\":\n      return \"cas\";\n    case \"ClassLinkSaml\":\n      return \"classlink\";\n    case \"CloudflareSaml\":\n      return \"cloudflare\";\n    case \"CyberArkSaml\":\n      return \"cyberark\";\n    case \"DuoSaml\":\n      return \"duo\";\n    case \"GenericSaml\":\n      return \"generic-saml\";\n    case \"GoogleSaml\":\n    case \"GoogleOidc\":\n      return \"google\";\n    case \"JumpCloudSaml\":\n      return \"jumpcloud\";\n    case \"KeycloakSaml\":\n      return \"keycloak\";\n    case \"LastPassSaml\":\n      return \"lastpass\";\n    case \"MiniOrangeSaml\":\n      return \"miniorange\";\n    case \"NetIqSaml\":\n      return \"net-iq\";\n    case \"OktaOidc\":\n    case \"OktaSaml\":\n      return \"okta\";\n    case \"OneLoginSaml\":\n      return \"onelogin\";\n    case \"OracleSaml\":\n      return \"oracle\";\n    case \"PingFederateSaml\":\n    case \"PingOneSaml\":\n      return \"ping-identity\";\n    case \"RipplingSaml\":\n      return \"rippling\";\n    case \"SalesforceSaml\":\n      return \"salesforce\";\n    case \"ShibbolethGenericSaml\":\n    case \"ShibbolethSaml\":\n      return \"shibboleth\";\n    case \"SimpleSamlPhpSaml\":\n      return \"simple-saml-php\";\n    case \"TestIdp\":\n      return \"test-idp\";\n    case \"VmWareSaml\":\n      return \"vmware\";\n    case \"AdpOidc\":\n      return \"adp\";\n    case \"GenericOidc\":\n      return \"generic-oidc\";\n    case \"LoginGovOidc\":\n      return \"login-gov\";\n    case \"CleverOidc\":\n      return \"clever\";\n    default:\n      return unreachable(connection);\n  }\n}\n\nexport type {\n  AdminPortalSsoConnectionProps,\n  AdminPortalSsoConnectionLoadingProps,\n  AdminPortalSsoConnectionErrorProps,\n};\nexport {\n  AdminPortalSsoConnection,\n  AdminPortalSsoConnectionLoading,\n  AdminPortalSsoConnectionError,\n};\n"],"mappings":";AAyCQ;AAvCR,YAAY,WAAW;AACvB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA,4BAA4B;AAAA,OACvB;AAMP,SAAS,aAAwB,mBAAmB;AACpD;AAAA,EAEE;AAAA,EACA;AAAA,OACK;AACP,SAAS,uBAAuB;AAChC,SAAS,qBAAqB;AAC9B;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AAOP,MAAM,2BAAoE,CAAC;AAAA,EACzE;AAAA,EACA,GAAG;AACL,MAAM;AACJ,QAAM,UAAU,gBAAgB;AAChC,SACE;AAAA,IAAC;AAAA;AAAA,MACC,gBAAgB,CAAC,EAAE,MAAM,MACvB,oBAAC,iCAA8B,OAAe,GAAG,UAAU;AAAA,MAG7D;AAAA,QAAC;AAAA;AAAA,UACC,YAAW;AAAA,UACX;AAAA,UACA;AAAA,UAEA,8BAAC,gCAA8B,GAAG,UAAU;AAAA;AAAA,MAC9C;AAAA;AAAA,EACF;AAEJ;AAEA,MAAM,+BAA+B,CAAC,UAA8B;AAClE,QAAM,aAAa,YAAY;AAC/B,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM;AAAA,IAAsB,MAChE,aAAa,oBAAI,KAAK,IAAI;AAAA,EAC5B;AACA,MAAI,cAAc,gBAAgB,MAAM;AACtC,mBAAe,oBAAI,KAAK,CAAC;AAAA,EAC3B;AAEA,QAAM,EAAE,QAAQ,yBAAyB,UAAU,IACjD,2BAA2B;AAAA,IACzB,UAAU;AAAA,MACR,WAAW,CAAC,SAAS;AACnB,+BAAuB,KAAK,MAAM;AAAA,UAChC,QAAQ;AAAA,UACR,KAAK;AAAA,QACP,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF,CAAC;AAEH,QAAM,QAAQ,sBAAsB;AAEpC,QAAM,aAAa,MAAM;AACvB,4BAAwB;AAAA,MACtB,QAAQ;AAAA,QACN,QAAQ;AAAA,MACV;AAAA,IACF,CAAC;AAAA,EACH;AAEA,MAAI,MAAM,WAAW;AACnB,WAAO,oBAAC,mCAAiC,GAAG,OAAO;AAAA,EACrD;AAEA,MAAI,MAAM,SAAS;AACjB,WAAO,oBAAC,iCAA8B,OAAO,MAAM,OAAQ,GAAG,OAAO;AAAA,EACvE;AAEA,MAAI,MAAM,MAAM;AACd,UAAM,aAAa,MAAM,KAAK,CAAC;AAC/B,QAAI,CAAC,YAAY;AACf,aACE;AAAA,QAAC;AAAA;AAAA,UACC,gBAAgB,CAAC,EAAE,MAAM,MACvB,oBAAC,iCAA8B,OAAe,GAAG,OAAO;AAAA,UAG1D;AAAA,YAAC;AAAA;AAAA,cACE,GAAG;AAAA,cACJ,kBAAiB;AAAA,cACjB;AAAA,cACA,aAAa;AAAA,cACb,uBACE;AAAA,gBAAC;AAAA;AAAA,kBACC;AAAA,kBACA;AAAA;AAAA,cACF;AAAA;AAAA,UAEJ;AAAA;AAAA,MACF;AAAA,IAEJ;AAEA,UAAM,kBAAkB,mBAAmB,YAAY,WAAW;AAClE,UAAM,eAAoD,MAAM;AAC9D,YAAM,mBAAmB,gBAAgB;AACzC,UAAI,CAAC,cAAc,qBAAqB,iBAAiB;AACvD,eAAO;AAAA,UACL,kBAAkB;AAAA,QACpB;AAAA,MACF;AAEA,YAAM,mBAAmB,oBAAoB,UAAU;AACvD,cAAQ,kBAAkB;AAAA,QACxB,KAAK;AACH,iBAAO;AAAA,YACL;AAAA,YACA;AAAA,UACF;AAAA,QACF,KAAK;AACH,iBAAO;AAAA,YACL;AAAA,YACA;AAAA,UACF;AAAA,QACF,KAAK;AAAA,QACL,KAAK;AACH,iBAAO;AAAA,YACL;AAAA,YACA,YAAY,gBAAgB;AAAA,YAC5B;AAAA,UACF;AAAA,QACF;AACE,iBAAO,YAAY,eAAe;AAAA,MACtC;AAAA,IACF,GAAG;AAEH,UAAM,cAAc,WAAW,cAC3B,IAAI,KAAK,WAAW,YAAY,SAAS,IACzC;AAEJ,WACE;AAAA,MAAC;AAAA;AAAA,QACC,gBAAgB,CAAC,EAAE,MAAM,MACvB,oBAAC,iCAA8B,OAAe,GAAG,OAAO;AAAA,QAG1D;AAAA,UAAC;AAAA;AAAA,YACE,GAAG;AAAA,YACH,GAAG;AAAA,YACJ;AAAA,YACA;AAAA,YACA,uBACE;AAAA,cAAC;AAAA;AAAA,gBACC;AAAA,gBACA;AAAA;AAAA,YACF;AAAA;AAAA,QAEJ;AAAA;AAAA,IACF;AAAA,EAEJ;AACF;AAaA,SAAS,mBACP,YACA,aACiB;AACjB,UAAQ,WAAW,OAAO;AAAA,IACxB,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK,YAAY;AACf,YAAM,eAAe,EAAE,QAAQ,SAAS;AACxC,UAAI,WAAW,gBAAgB,QAAQ;AACrC,eAAO;AAAA,MACT;AAEA,UAAI,WAAW,0BAA0B;AACvC,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,YAAY,WAAW,yBAAyB,WAC5C,IAAI,KAAK,WAAW,yBAAyB,QAAQ,IACrD;AAAA,QACN;AAAA,MACF;AAEA,YAAM,aAAa,WAAW,2BAA2B;AACzD,UAAI,eAAe,QAAQ,cAAc,MAAM;AAC7C,eAAO;AAAA,MACT;AAEA,YAAM,aAAa,IAAI,KAAK,UAAU;AACtC,YAAM,mBAAmB,MAAM;AAC7B,cAAM,OAAO,WAAW,QAAQ,IAAI,YAAY,QAAQ;AACxD,YAAI,OAAO,GAAG;AACZ,iBAAO;AAAA,QACT;AAEA,eAAO,QAAQ,MAAO,KAAK,KAAK;AAAA,MAClC,GAAG;AAEH,UAAI,oBAAoB,MAAM,mBAAmB,IAAI;AACnD,eAAO,EAAE,QAAQ,YAAY,iBAAiB,WAAW;AAAA,MAC3D;AAEA,aAAO;AAAA,IACT;AAAA,IACA,KAAK,YAAY;AACf,aAAO,EAAE,QAAQ,WAAW;AAAA,IAC9B;AAAA,IACA;AACE,aAAO,YAAY,WAAW,KAAK;AAAA,EACvC;AACF;AAEA,SAAS,oBAAoB,YAA6C;AACxE,UAAQ,WAAW,MAAM;AAAA,IACvB,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO,YAAY,UAAU;AAAA,EACjC;AACF;","names":[]}
+{"version":3,"sources":["../../src/admin-portal-sso-connection.client.tsx"],"sourcesContent":["\"use client\";\n\nimport * as React from \"react\";\nimport {\n  AdminPortalOpenButton,\n  AdminPortalSsoConnectionError,\n  AdminPortalSsoConnectionLoading,\n  AdminPortalSsoConnection as AdminPortalSsoConnectionPresentational,\n} from \"./lib/admin-portal-sso-connection.js\";\nimport type {\n  AdminPortalSsoConnectionErrorProps,\n  AdminPortalSsoConnectionLoadingProps,\n  AdminPortalSsoConnectionStatusProps,\n} from \"./lib/admin-portal-sso-connection.js\";\nimport { ApiProvider, AuthToken, useApiReady } from \"./api/api-provider.js\";\nimport {\n  clientGraphqlQueryKey,\n  useClientGraphqlMutation,\n  useClientGraphqlQuery,\n} from \"./api/client-graphql/hooks.js\";\nimport type {\n  AdminPortalLinkIntent,\n  ConnectionFieldsFragment,\n  ConnectionType,\n} from \"./api/client-graphql/generated.js\";\nimport { useWorkOsApiUrl } from \"./lib/widgets-context.js\";\nimport { ErrorBoundary } from \"./lib/error-boundary.js\";\nimport {\n  openAdminPortalViaForm,\n  unreachable,\n  WidgetRootDomProps,\n} from \"./lib/utils.js\";\nimport { IdentityProvider } from \"./lib/identity-providers.js\";\n\ninterface AdminPortalSsoConnectionProps extends WidgetRootDomProps {\n  authToken: AuthToken;\n}\n\nconst AdminPortalSsoConnection: React.FC<AdminPortalSsoConnectionProps> = ({\n  authToken,\n  ...domProps\n}) => {\n  const baseUrl = useWorkOsApiUrl();\n  return (\n    <ErrorBoundary\n      fallbackRender={({ error }) => (\n        <AdminPortalSsoConnectionError error={error} {...domProps} />\n      )}\n    >\n      <ApiProvider\n        widgetType=\"admin-portal-sso-connection\"\n        authToken={authToken}\n        baseUrl={baseUrl}\n      >\n        <AdminPortalSsoConnectionImpl {...domProps} />\n      </ApiProvider>\n    </ErrorBoundary>\n  );\n};\n\nconst AdminPortalSsoConnectionImpl = (props: WidgetRootDomProps) => {\n  const isApiReady = useApiReady();\n  const [currentDate, setCurrentDate] = React.useState<Date | null>(() =>\n    isApiReady ? new Date() : null,\n  );\n  if (isApiReady && currentDate === null) {\n    setCurrentDate(new Date());\n  }\n\n  const { mutate: generateAdminPortalLink, isPending } =\n    useClientGraphqlMutation({\n      mutationFn: (sdk, intent: AdminPortalLinkIntent) =>\n        sdk.CreateAdminPortalLink({ intent }),\n      onSuccess: (data) => {\n        openAdminPortalViaForm(data.createAdminPortalLink.link, {\n          target: \"_blank\",\n          rel: \"noopener noreferrer\",\n        });\n      },\n    });\n\n  const query = useClientGraphqlQuery({\n    queryKey: clientGraphqlQueryKey(\"ListSsoConnections\"),\n    queryFn: (sdk) => sdk.ListSsoConnections(),\n    select: (data) => data.ssoConnections,\n  });\n\n  const initConfig = () => {\n    generateAdminPortalLink(\"Sso\");\n  };\n\n  if (query.isLoading) {\n    return <AdminPortalSsoConnectionLoading {...props} />;\n  }\n\n  if (query.isError) {\n    return <AdminPortalSsoConnectionError error={query.error} {...props} />;\n  }\n\n  if (query.data) {\n    const connection = query.data[0];\n    if (!connection) {\n      return (\n        <ErrorBoundary\n          fallbackRender={({ error }) => (\n            <AdminPortalSsoConnectionError error={error} {...props} />\n          )}\n        >\n          <AdminPortalSsoConnectionPresentational\n            {...props}\n            connectionStatus=\"NotConfigured\"\n            currentDate={currentDate}\n            lastSession={null}\n            adminPortalOpenButton={\n              <AdminPortalOpenButton\n                isPending={isPending}\n                initConfig={initConfig}\n              />\n            }\n          />\n        </ErrorBoundary>\n      );\n    }\n\n    const connectionState = getConnectionState(connection, currentDate);\n    const statusProps: AdminPortalSsoConnectionStatusProps = (() => {\n      const connectionStatus = connectionState.status;\n      if (!connection || connectionStatus === \"NotConfigured\") {\n        return {\n          connectionStatus: \"NotConfigured\",\n        } satisfies AdminPortalSsoConnectionStatusProps;\n      }\n\n      const identityProvider = getIdentityProvider(connection.type);\n      switch (connectionStatus) {\n        case \"Active\":\n          return {\n            connectionStatus,\n            identityProvider,\n          } satisfies AdminPortalSsoConnectionStatusProps;\n        case \"Inactive\":\n          return {\n            connectionStatus,\n            identityProvider,\n          } satisfies AdminPortalSsoConnectionStatusProps;\n        case \"Expired\":\n        case \"Expiring\":\n          return {\n            connectionStatus,\n            expiryDate: connectionState.expiryDate,\n            identityProvider,\n          } satisfies AdminPortalSsoConnectionStatusProps;\n        default:\n          return unreachable(connectionState);\n      }\n    })();\n\n    const lastSession = connection.lastSession\n      ? new Date(connection.lastSession.createdAt)\n      : null;\n\n    return (\n      <ErrorBoundary\n        fallbackRender={({ error }) => (\n          <AdminPortalSsoConnectionError error={error} {...props} />\n        )}\n      >\n        <AdminPortalSsoConnectionPresentational\n          {...props}\n          {...statusProps}\n          currentDate={currentDate}\n          lastSession={lastSession}\n          adminPortalOpenButton={\n            <AdminPortalOpenButton\n              isPending={isPending}\n              initConfig={initConfig}\n            />\n          }\n        />\n      </ErrorBoundary>\n    );\n  }\n};\n\ntype ConnectionState =\n  | { status: \"NotConfigured\" }\n  | { status: \"Active\" }\n  | { status: \"Inactive\" }\n  | {\n      status: \"Expiring\";\n      daysUntilExpiry: number | null;\n      expiryDate: Date | null;\n    }\n  | { status: \"Expired\"; expiryDate: Date | null };\n\nfunction getConnectionState(\n  connection: ConnectionFieldsFragment,\n  currentDate: Date | null,\n): ConnectionState {\n  switch (connection.state) {\n    case \"Active\":\n    case \"Validating\":\n    case \"Deleting\": {\n      const activeStatus = { status: \"Active\" } satisfies ConnectionState;\n      if (connection.providerTag !== \"Saml\") {\n        return activeStatus;\n      }\n\n      if (connection.latestExpiredCertificate) {\n        return {\n          status: \"Expired\",\n          expiryDate: connection.latestExpiredCertificate.notAfter\n            ? new Date(connection.latestExpiredCertificate.notAfter)\n            : null,\n        };\n      }\n\n      const expiryTime = connection.latestExpiringCertificate?.notAfter;\n      if (currentDate == null || expiryTime == null) {\n        return activeStatus;\n      }\n\n      const expiryDate = new Date(expiryTime);\n      const daysUntilExpiry = (() => {\n        const diff = expiryDate.getTime() - currentDate.getTime();\n        if (diff < 0) {\n          return -1;\n        }\n\n        return diff / (1000 * 60 * 60 * 24);\n      })();\n\n      if (daysUntilExpiry !== -1 && daysUntilExpiry <= 30) {\n        return { status: \"Expiring\", daysUntilExpiry, expiryDate };\n      }\n\n      return activeStatus;\n    }\n    case \"Inactive\": {\n      return { status: \"Inactive\" };\n    }\n    default:\n      return unreachable(connection.state);\n  }\n}\n\nfunction getIdentityProvider(type: ConnectionType): IdentityProvider {\n  switch (type) {\n    case \"ADFSSAML\":\n    case \"EntraIdOIDC\":\n    case \"MicrosoftOAuth\":\n      return \"microsoft\";\n    case \"Auth0Migration\":\n    case \"Auth0SAML\":\n      return \"auth0\";\n    case \"AzureSAML\":\n      return \"azure\";\n    case \"CasSAML\":\n      return \"cas\";\n    case \"ClassLinkSAML\":\n      return \"classlink\";\n    case \"CloudflareSAML\":\n      return \"cloudflare\";\n    case \"CyberArkSAML\":\n      return \"cyberark\";\n    case \"DuoSAML\":\n      return \"duo\";\n    case \"GenericSAML\":\n      return \"generic-saml\";\n    case \"GoogleSAML\":\n    case \"GoogleOIDC\":\n    case \"GoogleOAuth\":\n      return \"google\";\n    case \"JumpCloudSAML\":\n      return \"jumpcloud\";\n    case \"KeycloakSAML\":\n      return \"keycloak\";\n    case \"LastPassSAML\":\n      return \"lastpass\";\n    case \"MiniOrangeSAML\":\n      return \"miniorange\";\n    case \"NetIqSAML\":\n      return \"net-iq\";\n    case \"OktaOIDC\":\n    case \"OktaSAML\":\n      return \"okta\";\n    case \"OneLoginSAML\":\n      return \"onelogin\";\n    case \"OracleSAML\":\n      return \"oracle\";\n    case \"PingFederateSAML\":\n    case \"PingOneSAML\":\n      return \"ping-identity\";\n    case \"RipplingSAML\":\n      return \"rippling\";\n    case \"SalesforceSAML\":\n    case \"SalesforceOAuth\":\n      return \"salesforce\";\n    case \"ShibbolethGenericSAML\":\n    case \"ShibbolethSAML\":\n      return \"shibboleth\";\n    case \"SimpleSamlPhpSAML\":\n      return \"simple-saml-php\";\n    case \"TestIdp\":\n      return \"test-idp\";\n    case \"VMwareSAML\":\n      return \"vmware\";\n    case \"AdpOidc\":\n      return \"adp\";\n    case \"GenericOIDC\":\n      return \"generic-oidc\";\n    case \"LoginGovOidc\":\n      return \"login-gov\";\n    case \"CleverOIDC\":\n      return \"clever\";\n    case \"AppleOAuth\":\n      return \"apple\";\n    case \"BitbucketOAuth\":\n      return \"bitbucket\";\n    case \"DiscordOAuth\":\n      return \"discord\";\n    case \"GithubOAuth\":\n      return \"github\";\n    case \"GitLabOAuth\":\n      return \"gitlab\";\n    case \"IntuitOAuth\":\n      return \"intuit\";\n    case \"LinkedInOAuth\":\n      return \"linkedin\";\n    case \"SlackOAuth\":\n      return \"slack\";\n    case \"VercelOAuth\":\n    case \"VercelMarketplaceOAuth\":\n      return \"vercel\";\n    case \"XeroOAuth\":\n      return \"xero\";\n    case \"GrokOAuth\":\n    case \"XOAuth\":\n    case \"MagicLink\":\n      return \"workos\";\n    default:\n      return unreachable(type);\n  }\n}\n\nexport type {\n  AdminPortalSsoConnectionProps,\n  AdminPortalSsoConnectionLoadingProps,\n  AdminPortalSsoConnectionErrorProps,\n};\nexport {\n  AdminPortalSsoConnection,\n  AdminPortalSsoConnectionLoading,\n  AdminPortalSsoConnectionError,\n};\n"],"mappings":";AA8CQ;AA5CR,YAAY,WAAW;AACvB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA,4BAA4B;AAAA,OACvB;AAMP,SAAS,aAAwB,mBAAmB;AACpD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAMP,SAAS,uBAAuB;AAChC,SAAS,qBAAqB;AAC9B;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AAOP,MAAM,2BAAoE,CAAC;AAAA,EACzE;AAAA,EACA,GAAG;AACL,MAAM;AACJ,QAAM,UAAU,gBAAgB;AAChC,SACE;AAAA,IAAC;AAAA;AAAA,MACC,gBAAgB,CAAC,EAAE,MAAM,MACvB,oBAAC,iCAA8B,OAAe,GAAG,UAAU;AAAA,MAG7D;AAAA,QAAC;AAAA;AAAA,UACC,YAAW;AAAA,UACX;AAAA,UACA;AAAA,UAEA,8BAAC,gCAA8B,GAAG,UAAU;AAAA;AAAA,MAC9C;AAAA;AAAA,EACF;AAEJ;AAEA,MAAM,+BAA+B,CAAC,UAA8B;AAClE,QAAM,aAAa,YAAY;AAC/B,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM;AAAA,IAAsB,MAChE,aAAa,oBAAI,KAAK,IAAI;AAAA,EAC5B;AACA,MAAI,cAAc,gBAAgB,MAAM;AACtC,mBAAe,oBAAI,KAAK,CAAC;AAAA,EAC3B;AAEA,QAAM,EAAE,QAAQ,yBAAyB,UAAU,IACjD,yBAAyB;AAAA,IACvB,YAAY,CAAC,KAAK,WAChB,IAAI,sBAAsB,EAAE,OAAO,CAAC;AAAA,IACtC,WAAW,CAAC,SAAS;AACnB,6BAAuB,KAAK,sBAAsB,MAAM;AAAA,QACtD,QAAQ;AAAA,QACR,KAAK;AAAA,MACP,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AAEH,QAAM,QAAQ,sBAAsB;AAAA,IAClC,UAAU,sBAAsB,oBAAoB;AAAA,IACpD,SAAS,CAAC,QAAQ,IAAI,mBAAmB;AAAA,IACzC,QAAQ,CAAC,SAAS,KAAK;AAAA,EACzB,CAAC;AAED,QAAM,aAAa,MAAM;AACvB,4BAAwB,KAAK;AAAA,EAC/B;AAEA,MAAI,MAAM,WAAW;AACnB,WAAO,oBAAC,mCAAiC,GAAG,OAAO;AAAA,EACrD;AAEA,MAAI,MAAM,SAAS;AACjB,WAAO,oBAAC,iCAA8B,OAAO,MAAM,OAAQ,GAAG,OAAO;AAAA,EACvE;AAEA,MAAI,MAAM,MAAM;AACd,UAAM,aAAa,MAAM,KAAK,CAAC;AAC/B,QAAI,CAAC,YAAY;AACf,aACE;AAAA,QAAC;AAAA;AAAA,UACC,gBAAgB,CAAC,EAAE,MAAM,MACvB,oBAAC,iCAA8B,OAAe,GAAG,OAAO;AAAA,UAG1D;AAAA,YAAC;AAAA;AAAA,cACE,GAAG;AAAA,cACJ,kBAAiB;AAAA,cACjB;AAAA,cACA,aAAa;AAAA,cACb,uBACE;AAAA,gBAAC;AAAA;AAAA,kBACC;AAAA,kBACA;AAAA;AAAA,cACF;AAAA;AAAA,UAEJ;AAAA;AAAA,MACF;AAAA,IAEJ;AAEA,UAAM,kBAAkB,mBAAmB,YAAY,WAAW;AAClE,UAAM,eAAoD,MAAM;AAC9D,YAAM,mBAAmB,gBAAgB;AACzC,UAAI,CAAC,cAAc,qBAAqB,iBAAiB;AACvD,eAAO;AAAA,UACL,kBAAkB;AAAA,QACpB;AAAA,MACF;AAEA,YAAM,mBAAmB,oBAAoB,WAAW,IAAI;AAC5D,cAAQ,kBAAkB;AAAA,QACxB,KAAK;AACH,iBAAO;AAAA,YACL;AAAA,YACA;AAAA,UACF;AAAA,QACF,KAAK;AACH,iBAAO;AAAA,YACL;AAAA,YACA;AAAA,UACF;AAAA,QACF,KAAK;AAAA,QACL,KAAK;AACH,iBAAO;AAAA,YACL;AAAA,YACA,YAAY,gBAAgB;AAAA,YAC5B;AAAA,UACF;AAAA,QACF;AACE,iBAAO,YAAY,eAAe;AAAA,MACtC;AAAA,IACF,GAAG;AAEH,UAAM,cAAc,WAAW,cAC3B,IAAI,KAAK,WAAW,YAAY,SAAS,IACzC;AAEJ,WACE;AAAA,MAAC;AAAA;AAAA,QACC,gBAAgB,CAAC,EAAE,MAAM,MACvB,oBAAC,iCAA8B,OAAe,GAAG,OAAO;AAAA,QAG1D;AAAA,UAAC;AAAA;AAAA,YACE,GAAG;AAAA,YACH,GAAG;AAAA,YACJ;AAAA,YACA;AAAA,YACA,uBACE;AAAA,cAAC;AAAA;AAAA,gBACC;AAAA,gBACA;AAAA;AAAA,YACF;AAAA;AAAA,QAEJ;AAAA;AAAA,IACF;AAAA,EAEJ;AACF;AAaA,SAAS,mBACP,YACA,aACiB;AACjB,UAAQ,WAAW,OAAO;AAAA,IACxB,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK,YAAY;AACf,YAAM,eAAe,EAAE,QAAQ,SAAS;AACxC,UAAI,WAAW,gBAAgB,QAAQ;AACrC,eAAO;AAAA,MACT;AAEA,UAAI,WAAW,0BAA0B;AACvC,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,YAAY,WAAW,yBAAyB,WAC5C,IAAI,KAAK,WAAW,yBAAyB,QAAQ,IACrD;AAAA,QACN;AAAA,MACF;AAEA,YAAM,aAAa,WAAW,2BAA2B;AACzD,UAAI,eAAe,QAAQ,cAAc,MAAM;AAC7C,eAAO;AAAA,MACT;AAEA,YAAM,aAAa,IAAI,KAAK,UAAU;AACtC,YAAM,mBAAmB,MAAM;AAC7B,cAAM,OAAO,WAAW,QAAQ,IAAI,YAAY,QAAQ;AACxD,YAAI,OAAO,GAAG;AACZ,iBAAO;AAAA,QACT;AAEA,eAAO,QAAQ,MAAO,KAAK,KAAK;AAAA,MAClC,GAAG;AAEH,UAAI,oBAAoB,MAAM,mBAAmB,IAAI;AACnD,eAAO,EAAE,QAAQ,YAAY,iBAAiB,WAAW;AAAA,MAC3D;AAEA,aAAO;AAAA,IACT;AAAA,IACA,KAAK,YAAY;AACf,aAAO,EAAE,QAAQ,WAAW;AAAA,IAC9B;AAAA,IACA;AACE,aAAO,YAAY,WAAW,KAAK;AAAA,EACvC;AACF;AAEA,SAAS,oBAAoB,MAAwC;AACnE,UAAQ,MAAM;AAAA,IACZ,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO,YAAY,IAAI;AAAA,EAC3B;AACF;","names":[]}

package/dist/esm/api/client-graphql/client.js

@@ -13,6 +13,7 @@ import {
 } from "../../lib/errors.js";
 import { getSdk } from "./generated.js";
 import { CLIENT_API_GRAPHQL_PATH } from "./constants.js";
+const GUARD_DENIAL_MESSAGE = "Forbidden resource";
 function isAuthError(error) {
   const status = error.response.status;
   if (status === 401 || status === 403) {
@@ -20,7 +21,7 @@ function isAuthError(error) {
   }
   return (error.response.errors ?? []).some((graphQlError) => {
     const code = graphQlError.extensions?.code;
-    return code === "UNAUTHENTICATED" || code === "FORBIDDEN";
+    return code === "UNAUTHENTICATED" || code === "FORBIDDEN" || graphQlError.message === GUARD_DENIAL_MESSAGE;
   });
 }
 function normalizeErrorStatus(status) {

package/dist/esm/api/client-graphql/client.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/api/client-graphql/client.ts"],"sourcesContent":["import { useQueryClient } from \"@tanstack/react-query\";\nimport { ClientError, GraphQLClient } from \"graphql-request\";\nimport * as React from \"react\";\nimport {\n  AuthTokenQueryData,\n  authTokenQueryKey,\n  useApi,\n  WidgetType,\n} from \"../api-provider.js\";\nimport { WIDGETS_API_VERSION } from \"../constants.js\";\nimport { ApiError, FetchError } from \"../errors.js\";\nimport {\n  ExpiredTokenError,\n  IncorrectPermissionsError,\n} from \"../../lib/errors.js\";\nimport { getSdk, Sdk, SdkFunctionWrapper } from \"./generated.js\";\nimport { CLIENT_API_GRAPHQL_PATH } from \"./constants.js\";\n\ntype QueryType = \"query\" | \"mutation\";\n\n/**\n * A GraphQL request failed because the request was unauthenticated or the token\n * no longer carries the required permissions.\n *\n * The Client API's auth guard fails closed by returning `false`, which NestJS\n * turns into a `ForbiddenException`. Because the GraphQL layer runs with\n * `autoTransformHttpErrors: false`, that surfaces as an HTTP 200 whose\n * `errors[].extensions.code` is `\"FORBIDDEN\"` — not as a 401/403 status. So the\n * `code` check below is load-bearing; the HTTP-status check is only a safety net\n * for transport-level rejections (proxies, gateways) that never reach GraphQL.\n * `\"UNAUTHENTICATED\"` is included defensively in case the backend adds it later.\n */\nfunction isAuthError(error: ClientError): boolean {\n  const status = error.response.status;\n  if (status === 401 || status === 403) {\n    return true;\n  }\n\n  return (error.response.errors ?? []).some((graphQlError) => {\n    const code = graphQlError.extensions?.code;\n    return code === \"UNAUTHENTICATED\" || code === \"FORBIDDEN\";\n  });\n}\n\n/**\n * The Client API returns GraphQL-level errors (validation, not-found, etc.) as\n * an HTTP 200 with an `errors` array. Surfacing that raw `200` on an `ApiError`\n * is misleading for downstream consumers and telemetry, so normalize any\n * non-error HTTP status to a 500.\n */\nfunction normalizeErrorStatus(status: number): number {\n  return status >= 400 ? status : 500;\n}\n\n/**\n * Translate a graphql-request failure into the same error classes the REST\n * Widgets client throws, so presentational components and error boundaries can\n * handle both transports uniformly.\n */\nfunction toWidgetError(\n  error: unknown,\n  queryType: QueryType,\n  isExpiredToken: boolean,\n): Error {\n  if (error instanceof ClientError) {\n    if (isAuthError(error)) {\n      const context = { status: error.response.status, queryType } as const;\n      return isExpiredToken\n        ? new ExpiredTokenError({ context })\n        : new IncorrectPermissionsError({ context });\n    }\n\n    const firstError = error.response.errors?.[0];\n    return new ApiError({\n      message: firstError?.message ?? error.message,\n      status: normalizeErrorStatus(error.response.status),\n      queryType,\n      context: { errors: error.response.errors },\n    });\n  }\n\n  return new FetchError({\n    message: error instanceof Error ? error.message : \"GraphQL request failed\",\n    queryType,\n    context: { error },\n  });\n}\n\n/**\n * Returns a typed SDK for the WorkOS Client GraphQL API, wired up to the same\n * `ApiProvider` auth plumbing the REST Widgets client uses:\n *\n * - Sends the current bearer token plus the widget-type / version headers.\n * - On an auth failure, re-mints the token via the shared `authToken` query and\n *   retries the operation once (mirrors the REST client's 403 retry).\n * - Maps GraphQL/network failures onto the widget error classes.\n *\n * Elevated-access tokens are intentionally not attached here; the Client API\n * takes them as mutation input fields, so call sites read them from\n * `useElevatedAccessToken` and pass them through the relevant inputs.\n */\nexport function useClientGraphql(): Sdk {\n  const { authToken, baseUrl, widgetType } = useApi();\n  const queryClient = useQueryClient();\n\n  return React.useMemo(() => {\n    const endpoint = new URL(baseUrl);\n    endpoint.pathname = CLIENT_API_GRAPHQL_PATH;\n    const client = new GraphQLClient(endpoint.toString());\n\n    const buildHeaders = (\n      token: string | undefined,\n    ): Record<string, string> => {\n      const headers: Record<string, string> = {\n        \"WorkOS-Widgets-Version\": WIDGETS_API_VERSION,\n        \"WorkOS-Widgets-Type\": widgetType,\n      };\n      if (token) {\n        headers.Authorization = `Bearer ${token}`;\n      }\n      return headers;\n    };\n\n    const refetchToken = async (\n      currentWidgetType: WidgetType,\n    ): Promise<string | undefined> => {\n      const tokenQueryKey = authTokenQueryKey(currentWidgetType);\n      await queryClient.refetchQueries({ queryKey: tokenQueryKey });\n      const refreshed =\n        queryClient.getQueryData<AuthTokenQueryData>(tokenQueryKey);\n      return refreshed?.authToken;\n    };\n\n    const isTokenExpired = (): boolean => {\n      const refreshed = queryClient.getQueryData<AuthTokenQueryData>(\n        authTokenQueryKey(widgetType),\n      );\n      const exp = refreshed?.exp;\n      return exp !== undefined && exp * 1000 <= Date.now();\n    };\n\n    const wrapper: SdkFunctionWrapper = async (\n      action,\n      _operationName,\n      operationType,\n    ) => {\n      const queryType: QueryType =\n        operationType === \"mutation\" ? \"mutation\" : \"query\";\n\n      try {\n        return await action(buildHeaders(authToken));\n      } catch (error) {\n        if (error instanceof ClientError && isAuthError(error)) {\n          let freshToken: string | undefined;\n          try {\n            freshToken = await refetchToken(widgetType);\n          } catch (refetchError) {\n            throw new ExpiredTokenError({\n              context: { queryType, refetchError },\n            });\n          }\n\n          if (freshToken && freshToken !== authToken) {\n            try {\n              return await action(buildHeaders(freshToken));\n            } catch (retryError) {\n              throw toWidgetError(retryError, queryType, isTokenExpired());\n            }\n          }\n        }\n\n        throw toWidgetError(error, queryType, isTokenExpired());\n      }\n    };\n\n    return getSdk(client, wrapper);\n  }, [authToken, baseUrl, widgetType, queryClient]);\n}\n"],"mappings":"AAAA,SAAS,sBAAsB;AAC/B,SAAS,aAAa,qBAAqB;AAC3C,YAAY,WAAW;AACvB;AAAA,EAEE;AAAA,EACA;AAAA,OAEK;AACP,SAAS,2BAA2B;AACpC,SAAS,UAAU,kBAAkB;AACrC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,cAAuC;AAChD,SAAS,+BAA+B;AAgBxC,SAAS,YAAY,OAA6B;AAChD,QAAM,SAAS,MAAM,SAAS;AAC9B,MAAI,WAAW,OAAO,WAAW,KAAK;AACpC,WAAO;AAAA,EACT;AAEA,UAAQ,MAAM,SAAS,UAAU,CAAC,GAAG,KAAK,CAAC,iBAAiB;AAC1D,UAAM,OAAO,aAAa,YAAY;AACtC,WAAO,SAAS,qBAAqB,SAAS;AAAA,EAChD,CAAC;AACH;AAQA,SAAS,qBAAqB,QAAwB;AACpD,SAAO,UAAU,MAAM,SAAS;AAClC;AAOA,SAAS,cACP,OACA,WACA,gBACO;AACP,MAAI,iBAAiB,aAAa;AAChC,QAAI,YAAY,KAAK,GAAG;AACtB,YAAM,UAAU,EAAE,QAAQ,MAAM,SAAS,QAAQ,UAAU;AAC3D,aAAO,iBACH,IAAI,kBAAkB,EAAE,QAAQ,CAAC,IACjC,IAAI,0BAA0B,EAAE,QAAQ,CAAC;AAAA,IAC/C;AAEA,UAAM,aAAa,MAAM,SAAS,SAAS,CAAC;AAC5C,WAAO,IAAI,SAAS;AAAA,MAClB,SAAS,YAAY,WAAW,MAAM;AAAA,MACtC,QAAQ,qBAAqB,MAAM,SAAS,MAAM;AAAA,MAClD;AAAA,MACA,SAAS,EAAE,QAAQ,MAAM,SAAS,OAAO;AAAA,IAC3C,CAAC;AAAA,EACH;AAEA,SAAO,IAAI,WAAW;AAAA,IACpB,SAAS,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IAClD;AAAA,IACA,SAAS,EAAE,MAAM;AAAA,EACnB,CAAC;AACH;AAeO,SAAS,mBAAwB;AACtC,QAAM,EAAE,WAAW,SAAS,WAAW,IAAI,OAAO;AAClD,QAAM,cAAc,eAAe;AAEnC,SAAO,MAAM,QAAQ,MAAM;AACzB,UAAM,WAAW,IAAI,IAAI,OAAO;AAChC,aAAS,WAAW;AACpB,UAAM,SAAS,IAAI,cAAc,SAAS,SAAS,CAAC;AAEpD,UAAM,eAAe,CACnB,UAC2B;AAC3B,YAAM,UAAkC;AAAA,QACtC,0BAA0B;AAAA,QAC1B,uBAAuB;AAAA,MACzB;AACA,UAAI,OAAO;AACT,gBAAQ,gBAAgB,UAAU,KAAK;AAAA,MACzC;AACA,aAAO;AAAA,IACT;AAEA,UAAM,eAAe,OACnB,sBACgC;AAChC,YAAM,gBAAgB,kBAAkB,iBAAiB;AACzD,YAAM,YAAY,eAAe,EAAE,UAAU,cAAc,CAAC;AAC5D,YAAM,YACJ,YAAY,aAAiC,aAAa;AAC5D,aAAO,WAAW;AAAA,IACpB;AAEA,UAAM,iBAAiB,MAAe;AACpC,YAAM,YAAY,YAAY;AAAA,QAC5B,kBAAkB,UAAU;AAAA,MAC9B;AACA,YAAM,MAAM,WAAW;AACvB,aAAO,QAAQ,UAAa,MAAM,OAAQ,KAAK,IAAI;AAAA,IACrD;AAEA,UAAM,UAA8B,OAClC,QACA,gBACA,kBACG;AACH,YAAM,YACJ,kBAAkB,aAAa,aAAa;AAE9C,UAAI;AACF,eAAO,MAAM,OAAO,aAAa,SAAS,CAAC;AAAA,MAC7C,SAAS,OAAO;AACd,YAAI,iBAAiB,eAAe,YAAY,KAAK,GAAG;AACtD,cAAI;AACJ,cAAI;AACF,yBAAa,MAAM,aAAa,UAAU;AAAA,UAC5C,SAAS,cAAc;AACrB,kBAAM,IAAI,kBAAkB;AAAA,cAC1B,SAAS,EAAE,WAAW,aAAa;AAAA,YACrC,CAAC;AAAA,UACH;AAEA,cAAI,cAAc,eAAe,WAAW;AAC1C,gBAAI;AACF,qBAAO,MAAM,OAAO,aAAa,UAAU,CAAC;AAAA,YAC9C,SAAS,YAAY;AACnB,oBAAM,cAAc,YAAY,WAAW,eAAe,CAAC;AAAA,YAC7D;AAAA,UACF;AAAA,QACF;AAEA,cAAM,cAAc,OAAO,WAAW,eAAe,CAAC;AAAA,MACxD;AAAA,IACF;AAEA,WAAO,OAAO,QAAQ,OAAO;AAAA,EAC/B,GAAG,CAAC,WAAW,SAAS,YAAY,WAAW,CAAC;AAClD;","names":[]}
+{"version":3,"sources":["../../../../src/api/client-graphql/client.ts"],"sourcesContent":["import { useQueryClient } from \"@tanstack/react-query\";\nimport { ClientError, GraphQLClient } from \"graphql-request\";\nimport * as React from \"react\";\nimport {\n  AuthTokenQueryData,\n  authTokenQueryKey,\n  useApi,\n  WidgetType,\n} from \"../api-provider.js\";\nimport { WIDGETS_API_VERSION } from \"../constants.js\";\nimport { ApiError, FetchError } from \"../errors.js\";\nimport {\n  ExpiredTokenError,\n  IncorrectPermissionsError,\n} from \"../../lib/errors.js\";\nimport { getSdk, Sdk, SdkFunctionWrapper } from \"./generated.js\";\nimport { CLIENT_API_GRAPHQL_PATH } from \"./constants.js\";\n\ntype QueryType = \"query\" | \"mutation\";\n\n/**\n * Message NestJS attaches to a bare `ForbiddenException`, which is what the\n * Client API's auth guard produces when it rejects a token (expired, revoked,\n * or otherwise invalid). The GraphQL layer reports it as an HTTP 200 whose\n * error carries `extensions.code: \"INTERNAL_SERVER_ERROR\"`, so the message is\n * the only signal that distinguishes it from a genuine server fault.\n */\nconst GUARD_DENIAL_MESSAGE = \"Forbidden resource\";\n\n/**\n * A GraphQL request failed because the request was unauthenticated or the token\n * no longer carries the required permissions.\n *\n * Permission denials surface as an HTTP 200 whose `errors[].extensions.code`\n * is `\"FORBIDDEN\"`; token rejections from the auth guard surface as described\n * on `GUARD_DENIAL_MESSAGE`. The HTTP-status check is only a safety net for\n * transport-level rejections (proxies, gateways) that never reach GraphQL.\n * `\"UNAUTHENTICATED\"` is included for when the backend reports it directly.\n */\nfunction isAuthError(error: ClientError): boolean {\n  const status = error.response.status;\n  if (status === 401 || status === 403) {\n    return true;\n  }\n\n  return (error.response.errors ?? []).some((graphQlError) => {\n    const code = graphQlError.extensions?.code;\n    return (\n      code === \"UNAUTHENTICATED\" ||\n      code === \"FORBIDDEN\" ||\n      graphQlError.message === GUARD_DENIAL_MESSAGE\n    );\n  });\n}\n\n/**\n * The Client API returns GraphQL-level errors (validation, not-found, etc.) as\n * an HTTP 200 with an `errors` array. Surfacing that raw `200` on an `ApiError`\n * is misleading for downstream consumers and telemetry, so normalize any\n * non-error HTTP status to a 500.\n */\nfunction normalizeErrorStatus(status: number): number {\n  return status >= 400 ? status : 500;\n}\n\n/**\n * Translate a graphql-request failure into the same error classes the REST\n * Widgets client throws, so presentational components and error boundaries can\n * handle both transports uniformly.\n */\nfunction toWidgetError(\n  error: unknown,\n  queryType: QueryType,\n  isExpiredToken: boolean,\n): Error {\n  if (error instanceof ClientError) {\n    if (isAuthError(error)) {\n      const context = { status: error.response.status, queryType } as const;\n      return isExpiredToken\n        ? new ExpiredTokenError({ context })\n        : new IncorrectPermissionsError({ context });\n    }\n\n    const firstError = error.response.errors?.[0];\n    return new ApiError({\n      message: firstError?.message ?? error.message,\n      status: normalizeErrorStatus(error.response.status),\n      queryType,\n      context: { errors: error.response.errors },\n    });\n  }\n\n  return new FetchError({\n    message: error instanceof Error ? error.message : \"GraphQL request failed\",\n    queryType,\n    context: { error },\n  });\n}\n\n/**\n * Returns a typed SDK for the WorkOS Client GraphQL API, wired up to the same\n * `ApiProvider` auth plumbing the REST Widgets client uses:\n *\n * - Sends the current bearer token plus the widget-type / version headers.\n * - On an auth failure, re-mints the token via the shared `authToken` query and\n *   retries the operation once (mirrors the REST client's 403 retry).\n * - Maps GraphQL/network failures onto the widget error classes.\n *\n * Elevated-access tokens are intentionally not attached here; the Client API\n * takes them as mutation input fields, so call sites read them from\n * `useElevatedAccessToken` and pass them through the relevant inputs.\n */\nexport function useClientGraphql(): Sdk {\n  const { authToken, baseUrl, widgetType } = useApi();\n  const queryClient = useQueryClient();\n\n  return React.useMemo(() => {\n    const endpoint = new URL(baseUrl);\n    endpoint.pathname = CLIENT_API_GRAPHQL_PATH;\n    const client = new GraphQLClient(endpoint.toString());\n\n    const buildHeaders = (\n      token: string | undefined,\n    ): Record<string, string> => {\n      const headers: Record<string, string> = {\n        \"WorkOS-Widgets-Version\": WIDGETS_API_VERSION,\n        \"WorkOS-Widgets-Type\": widgetType,\n      };\n      if (token) {\n        headers.Authorization = `Bearer ${token}`;\n      }\n      return headers;\n    };\n\n    const refetchToken = async (\n      currentWidgetType: WidgetType,\n    ): Promise<string | undefined> => {\n      const tokenQueryKey = authTokenQueryKey(currentWidgetType);\n      await queryClient.refetchQueries({ queryKey: tokenQueryKey });\n      const refreshed =\n        queryClient.getQueryData<AuthTokenQueryData>(tokenQueryKey);\n      return refreshed?.authToken;\n    };\n\n    const isTokenExpired = (): boolean => {\n      const refreshed = queryClient.getQueryData<AuthTokenQueryData>(\n        authTokenQueryKey(widgetType),\n      );\n      const exp = refreshed?.exp;\n      return exp !== undefined && exp * 1000 <= Date.now();\n    };\n\n    const wrapper: SdkFunctionWrapper = async (\n      action,\n      _operationName,\n      operationType,\n    ) => {\n      const queryType: QueryType =\n        operationType === \"mutation\" ? \"mutation\" : \"query\";\n\n      try {\n        return await action(buildHeaders(authToken));\n      } catch (error) {\n        if (error instanceof ClientError && isAuthError(error)) {\n          let freshToken: string | undefined;\n          try {\n            freshToken = await refetchToken(widgetType);\n          } catch (refetchError) {\n            throw new ExpiredTokenError({\n              context: { queryType, refetchError },\n            });\n          }\n\n          if (freshToken && freshToken !== authToken) {\n            try {\n              return await action(buildHeaders(freshToken));\n            } catch (retryError) {\n              throw toWidgetError(retryError, queryType, isTokenExpired());\n            }\n          }\n        }\n\n        throw toWidgetError(error, queryType, isTokenExpired());\n      }\n    };\n\n    return getSdk(client, wrapper);\n  }, [authToken, baseUrl, widgetType, queryClient]);\n}\n"],"mappings":"AAAA,SAAS,sBAAsB;AAC/B,SAAS,aAAa,qBAAqB;AAC3C,YAAY,WAAW;AACvB;AAAA,EAEE;AAAA,EACA;AAAA,OAEK;AACP,SAAS,2BAA2B;AACpC,SAAS,UAAU,kBAAkB;AACrC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,cAAuC;AAChD,SAAS,+BAA+B;AAWxC,MAAM,uBAAuB;AAY7B,SAAS,YAAY,OAA6B;AAChD,QAAM,SAAS,MAAM,SAAS;AAC9B,MAAI,WAAW,OAAO,WAAW,KAAK;AACpC,WAAO;AAAA,EACT;AAEA,UAAQ,MAAM,SAAS,UAAU,CAAC,GAAG,KAAK,CAAC,iBAAiB;AAC1D,UAAM,OAAO,aAAa,YAAY;AACtC,WACE,SAAS,qBACT,SAAS,eACT,aAAa,YAAY;AAAA,EAE7B,CAAC;AACH;AAQA,SAAS,qBAAqB,QAAwB;AACpD,SAAO,UAAU,MAAM,SAAS;AAClC;AAOA,SAAS,cACP,OACA,WACA,gBACO;AACP,MAAI,iBAAiB,aAAa;AAChC,QAAI,YAAY,KAAK,GAAG;AACtB,YAAM,UAAU,EAAE,QAAQ,MAAM,SAAS,QAAQ,UAAU;AAC3D,aAAO,iBACH,IAAI,kBAAkB,EAAE,QAAQ,CAAC,IACjC,IAAI,0BAA0B,EAAE,QAAQ,CAAC;AAAA,IAC/C;AAEA,UAAM,aAAa,MAAM,SAAS,SAAS,CAAC;AAC5C,WAAO,IAAI,SAAS;AAAA,MAClB,SAAS,YAAY,WAAW,MAAM;AAAA,MACtC,QAAQ,qBAAqB,MAAM,SAAS,MAAM;AAAA,MAClD;AAAA,MACA,SAAS,EAAE,QAAQ,MAAM,SAAS,OAAO;AAAA,IAC3C,CAAC;AAAA,EACH;AAEA,SAAO,IAAI,WAAW;AAAA,IACpB,SAAS,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IAClD;AAAA,IACA,SAAS,EAAE,MAAM;AAAA,EACnB,CAAC;AACH;AAeO,SAAS,mBAAwB;AACtC,QAAM,EAAE,WAAW,SAAS,WAAW,IAAI,OAAO;AAClD,QAAM,cAAc,eAAe;AAEnC,SAAO,MAAM,QAAQ,MAAM;AACzB,UAAM,WAAW,IAAI,IAAI,OAAO;AAChC,aAAS,WAAW;AACpB,UAAM,SAAS,IAAI,cAAc,SAAS,SAAS,CAAC;AAEpD,UAAM,eAAe,CACnB,UAC2B;AAC3B,YAAM,UAAkC;AAAA,QACtC,0BAA0B;AAAA,QAC1B,uBAAuB;AAAA,MACzB;AACA,UAAI,OAAO;AACT,gBAAQ,gBAAgB,UAAU,KAAK;AAAA,MACzC;AACA,aAAO;AAAA,IACT;AAEA,UAAM,eAAe,OACnB,sBACgC;AAChC,YAAM,gBAAgB,kBAAkB,iBAAiB;AACzD,YAAM,YAAY,eAAe,EAAE,UAAU,cAAc,CAAC;AAC5D,YAAM,YACJ,YAAY,aAAiC,aAAa;AAC5D,aAAO,WAAW;AAAA,IACpB;AAEA,UAAM,iBAAiB,MAAe;AACpC,YAAM,YAAY,YAAY;AAAA,QAC5B,kBAAkB,UAAU;AAAA,MAC9B;AACA,YAAM,MAAM,WAAW;AACvB,aAAO,QAAQ,UAAa,MAAM,OAAQ,KAAK,IAAI;AAAA,IACrD;AAEA,UAAM,UAA8B,OAClC,QACA,gBACA,kBACG;AACH,YAAM,YACJ,kBAAkB,aAAa,aAAa;AAE9C,UAAI;AACF,eAAO,MAAM,OAAO,aAAa,SAAS,CAAC;AAAA,MAC7C,SAAS,OAAO;AACd,YAAI,iBAAiB,eAAe,YAAY,KAAK,GAAG;AACtD,cAAI;AACJ,cAAI;AACF,yBAAa,MAAM,aAAa,UAAU;AAAA,UAC5C,SAAS,cAAc;AACrB,kBAAM,IAAI,kBAAkB;AAAA,cAC1B,SAAS,EAAE,WAAW,aAAa;AAAA,YACrC,CAAC;AAAA,UACH;AAEA,cAAI,cAAc,eAAe,WAAW;AAC1C,gBAAI;AACF,qBAAO,MAAM,OAAO,aAAa,UAAU,CAAC;AAAA,YAC9C,SAAS,YAAY;AACnB,oBAAM,cAAc,YAAY,WAAW,eAAe,CAAC;AAAA,YAC7D;AAAA,UACF;AAAA,QACF;AAEA,cAAM,cAAc,OAAO,WAAW,eAAe,CAAC;AAAA,MACxD;AAAA,IACF;AAEA,WAAO,OAAO,QAAQ,OAAO;AAAA,EAC/B,GAAG,CAAC,WAAW,SAAS,YAAY,WAAW,CAAC;AAClD;","names":[]}