@xyd-js/plugin-access-control 0.0.0-canary-188f589-20260429221601

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) LiveSession Sp.z.o.o
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE. 

package/dist/AccessControlContext.js

@@ -0,0 +1,130 @@
+// src/components/AccessControlContext.tsx
+import React, { createContext, useContext, useEffect, useState, useCallback } from "react";
+
+// src/devOnly.ts
+function isDevEnvironment() {
+  if (typeof window === "undefined") {
+    return process.env.NODE_ENV !== "production";
+  }
+  try {
+    return !!import.meta.env?.DEV;
+  } catch {
+    return false;
+  }
+}
+
+// src/components/AccessControlContext.tsx
+var AccessControlCtx = createContext(null);
+function useAccessControl() {
+  const ctx = useContext(AccessControlCtx);
+  if (!ctx) {
+    throw new Error("useAccessControl must be used inside <AccessControlProvider>");
+  }
+  return ctx;
+}
+function AccessControlProvider({ children }) {
+  const [config, setConfig] = useState(null);
+  const [error, setError] = useState("");
+  const [ready, setReady] = useState(false);
+  useEffect(() => {
+    const globalConfig = window.__xydAccessControlSettings?.accessControlConfig;
+    if (globalConfig) {
+      setConfig(globalConfig);
+      setReady(true);
+      return;
+    }
+    import("virtual:xyd-access-control-settings").then((mod) => {
+      setConfig(mod.accessControlConfig);
+      setReady(true);
+    }).catch(() => setReady(true));
+  }, []);
+  const providerType = config?.provider?.type || "jwt";
+  const loginUrl = config?.provider?.loginUrl || "";
+  const authorizationUrl = config?.provider?.authorizationUrl || "";
+  const hasExternalAuth = providerType === "oauth" ? !!authorizationUrl : !!loginUrl && loginUrl !== "/login";
+  const loginConfig = typeof config?.login === "string" ? {} : config?.login || {};
+  const title = loginConfig.title || "Sign in to access documentation";
+  const description = loginConfig.description || "";
+  const logo = loginConfig.logo || "";
+  const backgroundImage = loginConfig.backgroundImage || "";
+  const params = typeof window !== "undefined" ? new URLSearchParams(window.location.search) : null;
+  const redirectUrl = params?.get("redirect") || "/";
+  const storeTokenAndRedirect = useCallback((token) => {
+    const cookieName = config?.session?.cookieName || "xyd-auth-token";
+    localStorage.setItem(cookieName, token);
+    document.cookie = `${cookieName}=${token}; path=/; max-age=86400; SameSite=Lax`;
+    window.location.href = redirectUrl;
+  }, [config, redirectUrl]);
+  const signInWithOAuth = useCallback(() => {
+    if (!authorizationUrl) {
+      setError("No OAuth authorization URL configured");
+      return;
+    }
+    const callbackPath = config?.provider?.callbackPath || "/auth/callback";
+    const redirectUri = window.location.origin + callbackPath;
+    const scopes = config?.provider?.scopes || [];
+    const clientId = config?.provider?.clientId || "";
+    const oauthParams = new URLSearchParams({
+      client_id: clientId,
+      redirect_uri: redirectUri,
+      response_type: "code",
+      scope: scopes.join(" "),
+      state: redirectUrl
+    });
+    window.location.href = `${authorizationUrl}?${oauthParams.toString()}`;
+  }, [config, authorizationUrl, redirectUrl]);
+  const signInWithRedirect = useCallback(() => {
+    if (!loginUrl || loginUrl === "/login") {
+      setError("No external login URL configured");
+      return;
+    }
+    const sep = loginUrl.includes("?") ? "&" : "?";
+    window.location.href = `${loginUrl}${sep}redirect=${encodeURIComponent(redirectUrl)}`;
+  }, [loginUrl, redirectUrl]);
+  const signInWithGroups = useCallback((groups) => {
+    const hasDeploy = !!config?.deploy;
+    if (hasDeploy) {
+      const groupsParam = groups.length ? `&groups=${groups.join(",")}` : "";
+      window.location.href = `/auth/test-login?redirect=${encodeURIComponent(redirectUrl)}${groupsParam}`;
+      return;
+    }
+    if (!isDevEnvironment()) {
+      setError("Test login is only available in development mode.");
+      return;
+    }
+    const header = btoa(JSON.stringify({ alg: "HS256", typ: "JWT" }));
+    const payload = btoa(JSON.stringify({
+      sub: "test-user",
+      groups,
+      exp: Math.floor(Date.now() / 1e3) + 86400,
+      iat: Math.floor(Date.now() / 1e3)
+    }));
+    storeTokenAndRedirect(`${header}.${payload}.dGVzdA`);
+  }, [config, redirectUrl, storeTokenAndRedirect]);
+  const signInAsUser = useCallback(() => signInWithGroups([]), [signInWithGroups]);
+  const signInAsAdmin = useCallback(() => signInWithGroups(["admin"]), [signInWithGroups]);
+  const value = {
+    config,
+    ready,
+    error,
+    clearError: () => setError(""),
+    signInWithOAuth,
+    signInWithRedirect,
+    signInAsUser,
+    signInAsAdmin,
+    signInWithGroups,
+    providerType,
+    hasExternalAuth,
+    title,
+    description,
+    logo,
+    backgroundImage,
+    redirectUrl
+  };
+  return /* @__PURE__ */ React.createElement(AccessControlCtx.Provider, { value }, children);
+}
+export {
+  AccessControlProvider,
+  useAccessControl
+};
+//# sourceMappingURL=AccessControlContext.js.map

package/dist/AccessControlContext.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/components/AccessControlContext.tsx","../src/devOnly.ts"],"sourcesContent":["import React, { createContext, useContext, useEffect, useState, useCallback } from \"react\";\nimport { isDevEnvironment as isDevEnv } from \"../devOnly\";\n\nexport interface AccessControlActions {\n  /** Current auth config from docs.json */\n  config: any | null;\n  /** Whether config has loaded */\n  ready: boolean;\n  /** Last error message */\n  error: string;\n  /** Clear error */\n  clearError: () => void;\n\n  // --- Auth actions ---\n\n  /** Redirect to external OAuth provider */\n  signInWithOAuth: () => void;\n  /** Redirect to external JWT login URL */\n  signInWithRedirect: () => void;\n  /** Sign in with test token (dev/edge server) */\n  signInAsUser: () => void;\n  /** Sign in as admin with test token (dev/edge server) */\n  signInAsAdmin: () => void;\n  /** Sign in with specific groups */\n  signInWithGroups: (groups: string[]) => void;\n  // --- Info ---\n\n  /** Provider type: \"jwt\" | \"oauth\" */\n  providerType: string;\n  /** Whether an external auth URL is configured */\n  hasExternalAuth: boolean;\n  /** Login page title from config */\n  title: string;\n  /** Login page description from config */\n  description: string;\n  /** Login page logo URL from config */\n  logo: string;\n  /** Login page background image from config */\n  backgroundImage: string;\n  /** The redirect URL (where to go after login) */\n  redirectUrl: string;\n}\n\nconst AccessControlCtx = createContext<AccessControlActions | null>(null);\n\n/**\n * Hook to access auth actions in custom login pages.\n *\n * @example\n * ```tsx\n * import { useAccessControl } from \"@xyd-js/plugin-access-control\"\n *\n * function MyLoginPage() {\n *   const { signInWithOAuth, title, logo, error } = useAccessControl()\n *\n *   return (\n *     <div>\n *       {logo && <img src={logo} />}\n *       <h1>{title}</h1>\n *       {error && <p>{error}</p>}\n *       <button onClick={signInWithOAuth}>Sign in</button>\n *     </div>\n *   )\n * }\n * ```\n */\nexport function useAccessControl(): AccessControlActions {\n  const ctx = useContext(AccessControlCtx);\n  if (!ctx) {\n    throw new Error(\"useAccessControl must be used inside <AccessControlProvider>\");\n  }\n  return ctx;\n}\n\nexport function AccessControlProvider({ children }: { children: React.ReactNode }) {\n  const [config, setConfig] = useState<any>(null);\n  const [error, setError] = useState(\"\");\n  const [ready, setReady] = useState(false);\n\n  useEffect(() => {\n    const globalConfig = (window as any).__xydAccessControlSettings?.accessControlConfig;\n    if (globalConfig) {\n      setConfig(globalConfig);\n      setReady(true);\n      return;\n    }\n    // @ts-ignore\n    import(\"virtual:xyd-access-control-settings\")\n      .then((mod: any) => { setConfig(mod.accessControlConfig); setReady(true); })\n      .catch(() => setReady(true));\n  }, []);\n\n  const providerType = config?.provider?.type || \"jwt\";\n  const loginUrl = config?.provider?.loginUrl || \"\";\n  const authorizationUrl = config?.provider?.authorizationUrl || \"\";\n  const hasExternalAuth = providerType === \"oauth\"\n    ? !!authorizationUrl\n    : !!loginUrl && loginUrl !== \"/login\";\n\n  // login can be a string (custom component path) or an object (config)\n  const loginConfig = typeof config?.login === \"string\" ? {} : (config?.login || {});\n  const title = loginConfig.title || \"Sign in to access documentation\";\n  const description = loginConfig.description || \"\";\n  const logo = loginConfig.logo || \"\";\n  const backgroundImage = loginConfig.backgroundImage || \"\";\n\n  const params = typeof window !== \"undefined\" ? new URLSearchParams(window.location.search) : null;\n  const redirectUrl = params?.get(\"redirect\") || \"/\";\n\n  const storeTokenAndRedirect = useCallback((token: string) => {\n    const cookieName = config?.session?.cookieName || \"xyd-auth-token\";\n    localStorage.setItem(cookieName, token);\n    document.cookie = `${cookieName}=${token}; path=/; max-age=86400; SameSite=Lax`;\n    window.location.href = redirectUrl;\n  }, [config, redirectUrl]);\n\n  const signInWithOAuth = useCallback(() => {\n    if (!authorizationUrl) { setError(\"No OAuth authorization URL configured\"); return; }\n    const callbackPath = config?.provider?.callbackPath || \"/auth/callback\";\n    const redirectUri = window.location.origin + callbackPath;\n    const scopes = config?.provider?.scopes || [];\n    const clientId = config?.provider?.clientId || \"\";\n\n    const oauthParams = new URLSearchParams({\n      client_id: clientId,\n      redirect_uri: redirectUri,\n      response_type: \"code\",\n      scope: scopes.join(\" \"),\n      state: redirectUrl,\n    });\n    window.location.href = `${authorizationUrl}?${oauthParams.toString()}`;\n  }, [config, authorizationUrl, redirectUrl]);\n\n  const signInWithRedirect = useCallback(() => {\n    if (!loginUrl || loginUrl === \"/login\") { setError(\"No external login URL configured\"); return; }\n    const sep = loginUrl.includes(\"?\") ? \"&\" : \"?\";\n    window.location.href = `${loginUrl}${sep}redirect=${encodeURIComponent(redirectUrl)}`;\n  }, [loginUrl, redirectUrl]);\n\n  const signInWithGroups = useCallback((groups: string[]) => {\n    // Production with deploy config: use /auth/test-login (server-signed)\n    const hasDeploy = !!config?.deploy;\n    if (hasDeploy) {\n      const groupsParam = groups.length ? `&groups=${groups.join(\",\")}` : \"\";\n      window.location.href = `/auth/test-login?redirect=${encodeURIComponent(redirectUrl)}${groupsParam}`;\n      return;\n    }\n\n    // Dev only: generate unsigned client-side token\n    if (!isDevEnv()) {\n      setError(\"Test login is only available in development mode.\");\n      return;\n    }\n    const header = btoa(JSON.stringify({ alg: \"HS256\", typ: \"JWT\" }));\n    const payload = btoa(JSON.stringify({\n      sub: \"test-user\",\n      groups,\n      exp: Math.floor(Date.now() / 1000) + 86400,\n      iat: Math.floor(Date.now() / 1000),\n    }));\n    storeTokenAndRedirect(`${header}.${payload}.dGVzdA`);\n  }, [config, redirectUrl, storeTokenAndRedirect]);\n\n  const signInAsUser = useCallback(() => signInWithGroups([]), [signInWithGroups]);\n  const signInAsAdmin = useCallback(() => signInWithGroups([\"admin\"]), [signInWithGroups]);\n\n  const value: AccessControlActions = {\n    config,\n    ready,\n    error,\n    clearError: () => setError(\"\"),\n    signInWithOAuth,\n    signInWithRedirect,\n    signInAsUser,\n    signInAsAdmin,\n    signInWithGroups,\n    providerType,\n    hasExternalAuth,\n    title,\n    description,\n    logo,\n    backgroundImage,\n    redirectUrl,\n  };\n\n  return <AccessControlCtx.Provider value={value}>{children}</AccessControlCtx.Provider>;\n}","/**\n * Check if running in development mode.\n * Server-side: checks NODE_ENV\n * Client-side: checks import.meta.env (set by Vite)\n */\nexport function isDevEnvironment(): boolean {\n  // Server-side (Node.js)\n  if (typeof window === \"undefined\") {\n    return process.env.NODE_ENV !== \"production\";\n  }\n\n  // Client-side (Vite)\n  try {\n    return !!(import.meta as any).env?.DEV;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Check if auth bypass is enabled. Only works in development mode.\n * Controlled by XYD_AUTH_BYPASS=1 environment variable.\n */\nexport function isAuthBypassed(): boolean {\n  if (!isDevEnvironment()) return false;\n\n  return (\n    process.env.XYD_AUTH_BYPASS === \"1\" ||\n    process.env.XYD_AUTH_BYPASS === \"true\"\n  );\n}"],"mappings":";AAAA,OAAO,SAAS,eAAe,YAAY,WAAW,UAAU,mBAAmB;;;ACK5E,SAAS,mBAA4B;AAE1C,MAAI,OAAO,WAAW,aAAa;AACjC,WAAO,QAAQ,IAAI,aAAa;AAAA,EAClC;AAGA,MAAI;AACF,WAAO,CAAC,CAAE,YAAoB,KAAK;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AD0BA,IAAM,mBAAmB,cAA2C,IAAI;AAuBjE,SAAS,mBAAyC;AACvD,QAAM,MAAM,WAAW,gBAAgB;AACvC,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AACA,SAAO;AACT;AAEO,SAAS,sBAAsB,EAAE,SAAS,GAAkC;AACjF,QAAM,CAAC,QAAQ,SAAS,IAAI,SAAc,IAAI;AAC9C,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAS,EAAE;AACrC,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAS,KAAK;AAExC,YAAU,MAAM;AACd,UAAM,eAAgB,OAAe,4BAA4B;AACjE,QAAI,cAAc;AAChB,gBAAU,YAAY;AACtB,eAAS,IAAI;AACb;AAAA,IACF;AAEA,WAAO,qCAAqC,EACzC,KAAK,CAAC,QAAa;AAAE,gBAAU,IAAI,mBAAmB;AAAG,eAAS,IAAI;AAAA,IAAG,CAAC,EAC1E,MAAM,MAAM,SAAS,IAAI,CAAC;AAAA,EAC/B,GAAG,CAAC,CAAC;AAEL,QAAM,eAAe,QAAQ,UAAU,QAAQ;AAC/C,QAAM,WAAW,QAAQ,UAAU,YAAY;AAC/C,QAAM,mBAAmB,QAAQ,UAAU,oBAAoB;AAC/D,QAAM,kBAAkB,iBAAiB,UACrC,CAAC,CAAC,mBACF,CAAC,CAAC,YAAY,aAAa;AAG/B,QAAM,cAAc,OAAO,QAAQ,UAAU,WAAW,CAAC,IAAK,QAAQ,SAAS,CAAC;AAChF,QAAM,QAAQ,YAAY,SAAS;AACnC,QAAM,cAAc,YAAY,eAAe;AAC/C,QAAM,OAAO,YAAY,QAAQ;AACjC,QAAM,kBAAkB,YAAY,mBAAmB;AAEvD,QAAM,SAAS,OAAO,WAAW,cAAc,IAAI,gBAAgB,OAAO,SAAS,MAAM,IAAI;AAC7F,QAAM,cAAc,QAAQ,IAAI,UAAU,KAAK;AAE/C,QAAM,wBAAwB,YAAY,CAAC,UAAkB;AAC3D,UAAM,aAAa,QAAQ,SAAS,cAAc;AAClD,iBAAa,QAAQ,YAAY,KAAK;AACtC,aAAS,SAAS,GAAG,UAAU,IAAI,KAAK;AACxC,WAAO,SAAS,OAAO;AAAA,EACzB,GAAG,CAAC,QAAQ,WAAW,CAAC;AAExB,QAAM,kBAAkB,YAAY,MAAM;AACxC,QAAI,CAAC,kBAAkB;AAAE,eAAS,uCAAuC;AAAG;AAAA,IAAQ;AACpF,UAAM,eAAe,QAAQ,UAAU,gBAAgB;AACvD,UAAM,cAAc,OAAO,SAAS,SAAS;AAC7C,UAAM,SAAS,QAAQ,UAAU,UAAU,CAAC;AAC5C,UAAM,WAAW,QAAQ,UAAU,YAAY;AAE/C,UAAM,cAAc,IAAI,gBAAgB;AAAA,MACtC,WAAW;AAAA,MACX,cAAc;AAAA,MACd,eAAe;AAAA,MACf,OAAO,OAAO,KAAK,GAAG;AAAA,MACtB,OAAO;AAAA,IACT,CAAC;AACD,WAAO,SAAS,OAAO,GAAG,gBAAgB,IAAI,YAAY,SAAS,CAAC;AAAA,EACtE,GAAG,CAAC,QAAQ,kBAAkB,WAAW,CAAC;AAE1C,QAAM,qBAAqB,YAAY,MAAM;AAC3C,QAAI,CAAC,YAAY,aAAa,UAAU;AAAE,eAAS,kCAAkC;AAAG;AAAA,IAAQ;AAChG,UAAM,MAAM,SAAS,SAAS,GAAG,IAAI,MAAM;AAC3C,WAAO,SAAS,OAAO,GAAG,QAAQ,GAAG,GAAG,YAAY,mBAAmB,WAAW,CAAC;AAAA,EACrF,GAAG,CAAC,UAAU,WAAW,CAAC;AAE1B,QAAM,mBAAmB,YAAY,CAAC,WAAqB;AAEzD,UAAM,YAAY,CAAC,CAAC,QAAQ;AAC5B,QAAI,WAAW;AACb,YAAM,cAAc,OAAO,SAAS,WAAW,OAAO,KAAK,GAAG,CAAC,KAAK;AACpE,aAAO,SAAS,OAAO,6BAA6B,mBAAmB,WAAW,CAAC,GAAG,WAAW;AACjG;AAAA,IACF;AAGA,QAAI,CAAC,iBAAS,GAAG;AACf,eAAS,mDAAmD;AAC5D;AAAA,IACF;AACA,UAAM,SAAS,KAAK,KAAK,UAAU,EAAE,KAAK,SAAS,KAAK,MAAM,CAAC,CAAC;AAChE,UAAM,UAAU,KAAK,KAAK,UAAU;AAAA,MAClC,KAAK;AAAA,MACL;AAAA,MACA,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AAAA,MACrC,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,IACnC,CAAC,CAAC;AACF,0BAAsB,GAAG,MAAM,IAAI,OAAO,SAAS;AAAA,EACrD,GAAG,CAAC,QAAQ,aAAa,qBAAqB,CAAC;AAE/C,QAAM,eAAe,YAAY,MAAM,iBAAiB,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;AAC/E,QAAM,gBAAgB,YAAY,MAAM,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;AAEvF,QAAM,QAA8B;AAAA,IAClC;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,MAAM,SAAS,EAAE;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,SAAO,oCAAC,iBAAiB,UAAjB,EAA0B,SAAe,QAAS;AAC5D;","names":[]}

package/dist/AuthCallbackPage.js

@@ -0,0 +1,116 @@
+// src/components/AuthCallbackPage.tsx
+import React, { useEffect, useState } from "react";
+function AuthCallbackPage() {
+  const [error, setError] = useState("");
+  useEffect(() => {
+    if (typeof window === "undefined") return;
+    import("virtual:xyd-access-control-settings").then((mod) => {
+      const config = mod.accessControlConfig;
+      handleCallback(config);
+    }).catch(() => {
+      handleCallback(null);
+    });
+  }, []);
+  function storeTokenAndRedirect(token, groups, redirect, cookieName) {
+    localStorage.setItem(cookieName, token);
+    document.cookie = `${cookieName}=${token}; path=/; max-age=86400; SameSite=Lax`;
+    window.__xydAuthState = {
+      authenticated: true,
+      groups,
+      token
+    };
+    document.documentElement.setAttribute("data-auth", "authenticated");
+    window.location.href = redirect;
+  }
+  async function handleCallback(config) {
+    const params = new URLSearchParams(window.location.search);
+    const hash = window.location.hash.slice(1);
+    const code = params.get("code");
+    const state = params.get("state") || "/";
+    const cookieName = config?.session?.cookieName || "xyd-auth-token";
+    const groupsClaim = config?.provider?.groupsClaim || "groups";
+    if (code && config?.provider?.type === "oauth") {
+      try {
+        await handleOAuthCallback(code, state, config, cookieName, groupsClaim);
+      } catch (e) {
+        setError(e instanceof Error ? e.message : "OAuth authentication failed");
+      }
+      return;
+    }
+    const token = params.get("token") || hash;
+    const redirect = params.get("redirect") || state;
+    if (token) {
+      try {
+        handleJWTCallback(token, redirect, cookieName, groupsClaim);
+      } catch (e) {
+        setError(e instanceof Error ? e.message : "JWT authentication failed");
+      }
+      return;
+    }
+    setError("No authentication data found in callback URL.");
+  }
+  function handleJWTCallback(hash, redirect, cookieName, groupsClaim) {
+    const parts = hash.split(".");
+    if (parts.length !== 3) throw new Error("Invalid JWT format");
+    const payload = JSON.parse(atob(parts[1]));
+    if (payload.exp && payload.exp * 1e3 < Date.now()) {
+      throw new Error("Token has expired");
+    }
+    storeTokenAndRedirect(hash, payload[groupsClaim] || [], redirect, cookieName);
+  }
+  async function handleOAuthCallback(code, redirect, config, cookieName, groupsClaim) {
+    const tokenUrl = config.provider.tokenUrl;
+    const userInfoUrl = config.provider.userInfoUrl;
+    const clientId = config.provider.clientId || "";
+    const callbackPath = config.provider.callbackPath || "/auth/callback";
+    const redirectUri = window.location.origin + callbackPath;
+    if (!tokenUrl) throw new Error("No token URL configured");
+    const tokenRes = await fetch(tokenUrl, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        code,
+        client_id: clientId,
+        redirect_uri: redirectUri
+      }).toString()
+    });
+    if (!tokenRes.ok) {
+      throw new Error(`Token exchange failed: ${tokenRes.status}`);
+    }
+    const tokenData = await tokenRes.json();
+    const accessToken = tokenData.access_token;
+    if (!accessToken) throw new Error("No access token in response");
+    let groups = [];
+    if (userInfoUrl) {
+      try {
+        const userRes = await fetch(userInfoUrl, {
+          headers: { Authorization: `Bearer ${accessToken}` }
+        });
+        if (userRes.ok) {
+          const userInfo = await userRes.json();
+          groups = userInfo[groupsClaim] || userInfo.roles || userInfo.groups || [];
+        }
+      } catch {
+      }
+    }
+    const header = btoa(JSON.stringify({ alg: "HS256", typ: "JWT" }));
+    const payload = btoa(JSON.stringify({
+      sub: "oauth-user",
+      [groupsClaim]: groups,
+      exp: Math.floor(Date.now() / 1e3) + 86400,
+      iat: Math.floor(Date.now() / 1e3),
+      access_token: accessToken
+    }));
+    const sessionToken = `${header}.${payload}.oauth`;
+    storeTokenAndRedirect(sessionToken, groups, redirect, cookieName);
+  }
+  if (error) {
+    return /* @__PURE__ */ React.createElement("div", { className: "xyd-callback-page" }, /* @__PURE__ */ React.createElement("div", { part: "card" }, /* @__PURE__ */ React.createElement("h2", { part: "title", "data-error": "" }, "Authentication Error"), /* @__PURE__ */ React.createElement("p", { part: "message" }, error), /* @__PURE__ */ React.createElement("button", { part: "button", onClick: () => window.location.href = "/" }, "Go to homepage")));
+  }
+  return /* @__PURE__ */ React.createElement("div", { className: "xyd-callback-page" }, /* @__PURE__ */ React.createElement("div", { part: "card" }, /* @__PURE__ */ React.createElement("p", { part: "message" }, "Authenticating...")));
+}
+export {
+  AuthCallbackPage as default
+};
+//# sourceMappingURL=AuthCallbackPage.js.map

package/dist/AuthCallbackPage.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/components/AuthCallbackPage.tsx"],"sourcesContent":["import React, { useEffect, useState } from \"react\";\n\n/**\n * Handles both JWT and OAuth callback flows:\n *\n * JWT:   /auth/jwt-callback#eyJ...  → extract token from hash\n * OAuth: /auth/callback?code=XXX&state=/page → exchange code for token\n */\nexport default function AuthCallbackPage() {\n  const [error, setError] = useState(\"\");\n\n  useEffect(() => {\n    if (typeof window === \"undefined\") return;\n\n    // @ts-ignore - virtual module resolved by Vite at runtime\n    import(\"virtual:xyd-access-control-settings\")\n      .then((mod: any) => {\n        const config = mod.accessControlConfig;\n        handleCallback(config);\n      })\n      .catch(() => {\n        // Fallback: try JWT flow without config\n        handleCallback(null);\n      });\n  }, []);\n\n  function storeTokenAndRedirect(\n    token: string,\n    groups: string[],\n    redirect: string,\n    cookieName: string\n  ) {\n    localStorage.setItem(cookieName, token);\n    document.cookie = `${cookieName}=${token}; path=/; max-age=86400; SameSite=Lax`;\n\n    (window as any).__xydAuthState = {\n      authenticated: true,\n      groups,\n      token,\n    };\n    document.documentElement.setAttribute(\"data-auth\", \"authenticated\");\n    window.location.href = redirect;\n  }\n\n  async function handleCallback(config: any) {\n    const params = new URLSearchParams(window.location.search);\n    const hash = window.location.hash.slice(1);\n    const code = params.get(\"code\");\n    const state = params.get(\"state\") || \"/\";\n    const cookieName = config?.session?.cookieName || \"xyd-auth-token\";\n    const groupsClaim = config?.provider?.groupsClaim || \"groups\";\n\n    // OAuth flow: code in query params\n    if (code && config?.provider?.type === \"oauth\") {\n      try {\n        await handleOAuthCallback(code, state, config, cookieName, groupsClaim);\n      } catch (e) {\n        setError(e instanceof Error ? e.message : \"OAuth authentication failed\");\n      }\n      return;\n    }\n\n    // JWT flow: token in query param (?token=...) or hash fragment (#eyJ...)\n    const token = params.get(\"token\") || hash;\n    const redirect = params.get(\"redirect\") || state;\n    if (token) {\n      try {\n        handleJWTCallback(token, redirect, cookieName, groupsClaim);\n      } catch (e) {\n        setError(e instanceof Error ? e.message : \"JWT authentication failed\");\n      }\n      return;\n    }\n\n    setError(\"No authentication data found in callback URL.\");\n  }\n\n  function handleJWTCallback(\n    hash: string,\n    redirect: string,\n    cookieName: string,\n    groupsClaim: string\n  ) {\n    const parts = hash.split(\".\");\n    if (parts.length !== 3) throw new Error(\"Invalid JWT format\");\n\n    const payload = JSON.parse(atob(parts[1]));\n    if (payload.exp && payload.exp * 1000 < Date.now()) {\n      throw new Error(\"Token has expired\");\n    }\n\n    storeTokenAndRedirect(hash, payload[groupsClaim] || [], redirect, cookieName);\n  }\n\n  async function handleOAuthCallback(\n    code: string,\n    redirect: string,\n    config: any,\n    cookieName: string,\n    groupsClaim: string\n  ) {\n    const tokenUrl = config.provider.tokenUrl;\n    const userInfoUrl = config.provider.userInfoUrl;\n    const clientId = config.provider.clientId || \"\";\n    const callbackPath = config.provider.callbackPath || \"/auth/callback\";\n    const redirectUri = window.location.origin + callbackPath;\n\n    if (!tokenUrl) throw new Error(\"No token URL configured\");\n\n    // Exchange code for access token\n    const tokenRes = await fetch(tokenUrl, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n      body: new URLSearchParams({\n        grant_type: \"authorization_code\",\n        code,\n        client_id: clientId,\n        redirect_uri: redirectUri,\n      }).toString(),\n    });\n\n    if (!tokenRes.ok) {\n      throw new Error(`Token exchange failed: ${tokenRes.status}`);\n    }\n\n    const tokenData = await tokenRes.json();\n    const accessToken = tokenData.access_token;\n    if (!accessToken) throw new Error(\"No access token in response\");\n\n    // Fetch user info to get groups/roles\n    let groups: string[] = [];\n    if (userInfoUrl) {\n      try {\n        const userRes = await fetch(userInfoUrl, {\n          headers: { Authorization: `Bearer ${accessToken}` },\n        });\n        if (userRes.ok) {\n          const userInfo = await userRes.json();\n          groups = userInfo[groupsClaim] || userInfo.roles || userInfo.groups || [];\n        }\n      } catch {\n        // User info fetch failed — continue without groups\n      }\n    }\n\n    // Create a session JWT from the access token info\n    const header = btoa(JSON.stringify({ alg: \"HS256\", typ: \"JWT\" }));\n    const payload = btoa(JSON.stringify({\n      sub: \"oauth-user\",\n      [groupsClaim]: groups,\n      exp: Math.floor(Date.now() / 1000) + 86400,\n      iat: Math.floor(Date.now() / 1000),\n      access_token: accessToken,\n    }));\n    const sessionToken = `${header}.${payload}.oauth`;\n\n    storeTokenAndRedirect(sessionToken, groups, redirect, cookieName);\n  }\n\n  if (error) {\n    return (\n      <div className=\"xyd-callback-page\">\n        <div part=\"card\">\n          <h2 part=\"title\" data-error=\"\">Authentication Error</h2>\n          <p part=\"message\">{error}</p>\n          <button part=\"button\" onClick={() => (window.location.href = \"/\")}>\n            Go to homepage\n          </button>\n        </div>\n      </div>\n    );\n  }\n\n  return (\n    <div className=\"xyd-callback-page\">\n      <div part=\"card\">\n        <p part=\"message\">Authenticating...</p>\n      </div>\n    </div>\n  );\n}\n"],"mappings":";AAAA,OAAO,SAAS,WAAW,gBAAgB;AAQ5B,SAAR,mBAAoC;AACzC,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAS,EAAE;AAErC,YAAU,MAAM;AACd,QAAI,OAAO,WAAW,YAAa;AAGnC,WAAO,qCAAqC,EACzC,KAAK,CAAC,QAAa;AAClB,YAAM,SAAS,IAAI;AACnB,qBAAe,MAAM;AAAA,IACvB,CAAC,EACA,MAAM,MAAM;AAEX,qBAAe,IAAI;AAAA,IACrB,CAAC;AAAA,EACL,GAAG,CAAC,CAAC;AAEL,WAAS,sBACP,OACA,QACA,UACA,YACA;AACA,iBAAa,QAAQ,YAAY,KAAK;AACtC,aAAS,SAAS,GAAG,UAAU,IAAI,KAAK;AAExC,IAAC,OAAe,iBAAiB;AAAA,MAC/B,eAAe;AAAA,MACf;AAAA,MACA;AAAA,IACF;AACA,aAAS,gBAAgB,aAAa,aAAa,eAAe;AAClE,WAAO,SAAS,OAAO;AAAA,EACzB;AAEA,iBAAe,eAAe,QAAa;AACzC,UAAM,SAAS,IAAI,gBAAgB,OAAO,SAAS,MAAM;AACzD,UAAM,OAAO,OAAO,SAAS,KAAK,MAAM,CAAC;AACzC,UAAM,OAAO,OAAO,IAAI,MAAM;AAC9B,UAAM,QAAQ,OAAO,IAAI,OAAO,KAAK;AACrC,UAAM,aAAa,QAAQ,SAAS,cAAc;AAClD,UAAM,cAAc,QAAQ,UAAU,eAAe;AAGrD,QAAI,QAAQ,QAAQ,UAAU,SAAS,SAAS;AAC9C,UAAI;AACF,cAAM,oBAAoB,MAAM,OAAO,QAAQ,YAAY,WAAW;AAAA,MACxE,SAAS,GAAG;AACV,iBAAS,aAAa,QAAQ,EAAE,UAAU,6BAA6B;AAAA,MACzE;AACA;AAAA,IACF;AAGA,UAAM,QAAQ,OAAO,IAAI,OAAO,KAAK;AACrC,UAAM,WAAW,OAAO,IAAI,UAAU,KAAK;AAC3C,QAAI,OAAO;AACT,UAAI;AACF,0BAAkB,OAAO,UAAU,YAAY,WAAW;AAAA,MAC5D,SAAS,GAAG;AACV,iBAAS,aAAa,QAAQ,EAAE,UAAU,2BAA2B;AAAA,MACvE;AACA;AAAA,IACF;AAEA,aAAS,+CAA+C;AAAA,EAC1D;AAEA,WAAS,kBACP,MACA,UACA,YACA,aACA;AACA,UAAM,QAAQ,KAAK,MAAM,GAAG;AAC5B,QAAI,MAAM,WAAW,EAAG,OAAM,IAAI,MAAM,oBAAoB;AAE5D,UAAM,UAAU,KAAK,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC;AACzC,QAAI,QAAQ,OAAO,QAAQ,MAAM,MAAO,KAAK,IAAI,GAAG;AAClD,YAAM,IAAI,MAAM,mBAAmB;AAAA,IACrC;AAEA,0BAAsB,MAAM,QAAQ,WAAW,KAAK,CAAC,GAAG,UAAU,UAAU;AAAA,EAC9E;AAEA,iBAAe,oBACb,MACA,UACA,QACA,YACA,aACA;AACA,UAAM,WAAW,OAAO,SAAS;AACjC,UAAM,cAAc,OAAO,SAAS;AACpC,UAAM,WAAW,OAAO,SAAS,YAAY;AAC7C,UAAM,eAAe,OAAO,SAAS,gBAAgB;AACrD,UAAM,cAAc,OAAO,SAAS,SAAS;AAE7C,QAAI,CAAC,SAAU,OAAM,IAAI,MAAM,yBAAyB;AAGxD,UAAM,WAAW,MAAM,MAAM,UAAU;AAAA,MACrC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,MAC/D,MAAM,IAAI,gBAAgB;AAAA,QACxB,YAAY;AAAA,QACZ;AAAA,QACA,WAAW;AAAA,QACX,cAAc;AAAA,MAChB,CAAC,EAAE,SAAS;AAAA,IACd,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,MAAM,0BAA0B,SAAS,MAAM,EAAE;AAAA,IAC7D;AAEA,UAAM,YAAY,MAAM,SAAS,KAAK;AACtC,UAAM,cAAc,UAAU;AAC9B,QAAI,CAAC,YAAa,OAAM,IAAI,MAAM,6BAA6B;AAG/D,QAAI,SAAmB,CAAC;AACxB,QAAI,aAAa;AACf,UAAI;AACF,cAAM,UAAU,MAAM,MAAM,aAAa;AAAA,UACvC,SAAS,EAAE,eAAe,UAAU,WAAW,GAAG;AAAA,QACpD,CAAC;AACD,YAAI,QAAQ,IAAI;AACd,gBAAM,WAAW,MAAM,QAAQ,KAAK;AACpC,mBAAS,SAAS,WAAW,KAAK,SAAS,SAAS,SAAS,UAAU,CAAC;AAAA,QAC1E;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AAGA,UAAM,SAAS,KAAK,KAAK,UAAU,EAAE,KAAK,SAAS,KAAK,MAAM,CAAC,CAAC;AAChE,UAAM,UAAU,KAAK,KAAK,UAAU;AAAA,MAClC,KAAK;AAAA,MACL,CAAC,WAAW,GAAG;AAAA,MACf,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AAAA,MACrC,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,MACjC,cAAc;AAAA,IAChB,CAAC,CAAC;AACF,UAAM,eAAe,GAAG,MAAM,IAAI,OAAO;AAEzC,0BAAsB,cAAc,QAAQ,UAAU,UAAU;AAAA,EAClE;AAEA,MAAI,OAAO;AACT,WACE,oCAAC,SAAI,WAAU,uBACb,oCAAC,SAAI,MAAK,UACR,oCAAC,QAAG,MAAK,SAAQ,cAAW,MAAG,sBAAoB,GACnD,oCAAC,OAAE,MAAK,aAAW,KAAM,GACzB,oCAAC,YAAO,MAAK,UAAS,SAAS,MAAO,OAAO,SAAS,OAAO,OAAM,gBAEnE,CACF,CACF;AAAA,EAEJ;AAEA,SACE,oCAAC,SAAI,WAAU,uBACb,oCAAC,SAAI,MAAK,UACR,oCAAC,OAAE,MAAK,aAAU,mBAAiB,CACrC,CACF;AAEJ;","names":[]}

package/dist/AuthGuard.js

@@ -0,0 +1,115 @@
+// src/components/AuthGuard.tsx
+import React, {
+  createContext,
+  useContext,
+  useEffect,
+  useState,
+  useMemo
+} from "react";
+var AuthContext = createContext({
+  authenticated: false,
+  groups: [],
+  token: null
+});
+function buildLoginUrl(loginUrl, returnPath) {
+  const separator = loginUrl.includes("?") ? "&" : "?";
+  return `${loginUrl}${separator}redirect=${encodeURIComponent(returnPath)}`;
+}
+function AuthGuard({ children, accessMap, config }) {
+  const [authState, setAuthState] = useState(() => {
+    if (typeof window !== "undefined" && window.__xydAuthState) {
+      return window.__xydAuthState;
+    }
+    return { authenticated: false, groups: [], token: null };
+  });
+  useEffect(() => {
+    const handleStorage = (e) => {
+      const cookieName = config.session?.cookieName || "xyd-auth-token";
+      if (e.key === cookieName) {
+        if (e.newValue) {
+          try {
+            const payload = JSON.parse(atob(e.newValue.split(".")[1]));
+            setAuthState({
+              authenticated: true,
+              groups: payload.groups || [],
+              token: e.newValue
+            });
+          } catch {
+            setAuthState({ authenticated: false, groups: [], token: null });
+          }
+        } else {
+          setAuthState({ authenticated: false, groups: [], token: null });
+        }
+      }
+    };
+    window.addEventListener("storage", handleStorage);
+    return () => window.removeEventListener("storage", handleStorage);
+  }, [config.session?.cookieName]);
+  const value = useMemo(() => authState, [authState]);
+  return /* @__PURE__ */ React.createElement(AuthContext.Provider, { value }, /* @__PURE__ */ React.createElement(AuthEnforcer, { accessMap, config }, children));
+}
+function AuthEnforcer({
+  children,
+  accessMap,
+  config
+}) {
+  const authState = useContext(AuthContext);
+  useEffect(() => {
+    if (typeof window === "undefined") return;
+    const pathname = window.location.pathname;
+    const pageAccess = accessMap[pathname];
+    if (!pageAccess || pageAccess === "public") return;
+    if (!authState.authenticated) {
+      const loginUrl = config.provider.loginUrl;
+      if (loginUrl) {
+        window.location.href = buildLoginUrl(loginUrl, pathname);
+      }
+      return;
+    }
+    if (pageAccess !== "authenticated") {
+      const requiredGroups = pageAccess.split(",");
+      const hasAccess = requiredGroups.some(
+        (g) => authState.groups.includes(g)
+      );
+      if (!hasAccess) {
+        if (config.unauthorizedBehavior === "404") {
+          window.location.href = "/404";
+        } else {
+          const loginUrl = config.provider.loginUrl;
+          if (loginUrl) {
+            window.location.href = buildLoginUrl(loginUrl, pathname);
+          }
+        }
+      }
+    }
+  }, [authState, accessMap, config]);
+  return /* @__PURE__ */ React.createElement(React.Fragment, null, children);
+}
+function useAuth() {
+  const state = useContext(AuthContext);
+  return {
+    ...state,
+    login() {
+      console.warn("[xyd:access-control] login() called without config");
+    },
+    logout() {
+      if (typeof window === "undefined") return;
+      const cookieName = "xyd-auth-token";
+      localStorage.removeItem(cookieName);
+      document.cookie = `${cookieName}=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/`;
+      document.cookie = `${cookieName}-state=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/`;
+      window.__xydAuthState = {
+        authenticated: false,
+        groups: [],
+        token: null
+      };
+      document.documentElement.setAttribute("data-auth", "anonymous");
+      window.location.reload();
+    }
+  };
+}
+export {
+  AuthGuard as default,
+  useAuth
+};
+//# sourceMappingURL=AuthGuard.js.map

package/dist/AuthGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/components/AuthGuard.tsx"],"sourcesContent":["import React, {\n  createContext,\n  useContext,\n  useEffect,\n  useState,\n  useMemo,\n} from \"react\";\n\nexport interface AuthState {\n  authenticated: boolean;\n  groups: string[];\n  token: string | null;\n}\n\nconst AuthContext = createContext<AuthState>({\n  authenticated: false,\n  groups: [],\n  token: null,\n});\n\ndeclare global {\n  interface Window {\n    __xydAuthState?: AuthState;\n    __xydAuthDebug?: any;\n  }\n}\n\ninterface AuthGuardProps {\n  children: React.ReactNode;\n  accessMap: Record<string, string>;\n  config: {\n    provider: { type: string; loginUrl?: string };\n    unauthorizedBehavior?: \"redirect\" | \"404\";\n    session?: { cookieName?: string };\n  };\n}\n\nfunction buildLoginUrl(loginUrl: string, returnPath: string): string {\n  const separator = loginUrl.includes(\"?\") ? \"&\" : \"?\";\n  return `${loginUrl}${separator}redirect=${encodeURIComponent(returnPath)}`;\n}\n\n/**\n * AuthGuard wraps the application and enforces access control.\n * It reads auth state from window.__xydAuthState (set by pre-hydration script)\n * and checks the access map for the current route.\n */\nexport default function AuthGuard({ children, accessMap, config }: AuthGuardProps) {\n  const [authState, setAuthState] = useState<AuthState>(() => {\n    if (typeof window !== \"undefined\" && window.__xydAuthState) {\n      return window.__xydAuthState;\n    }\n    return { authenticated: false, groups: [], token: null };\n  });\n\n  useEffect(() => {\n    // Listen for auth state changes (e.g., after login callback)\n    const handleStorage = (e: StorageEvent) => {\n      const cookieName = config.session?.cookieName || \"xyd-auth-token\";\n      if (e.key === cookieName) {\n        if (e.newValue) {\n          try {\n            const payload = JSON.parse(atob(e.newValue.split(\".\")[1]));\n            setAuthState({\n              authenticated: true,\n              groups: payload.groups || [],\n              token: e.newValue,\n            });\n          } catch {\n            setAuthState({ authenticated: false, groups: [], token: null });\n          }\n        } else {\n          setAuthState({ authenticated: false, groups: [], token: null });\n        }\n      }\n    };\n\n    window.addEventListener(\"storage\", handleStorage);\n    return () => window.removeEventListener(\"storage\", handleStorage);\n  }, [config.session?.cookieName]);\n\n  const value = useMemo(() => authState, [authState]);\n\n  return (\n    <AuthContext.Provider value={value}>\n      <AuthEnforcer accessMap={accessMap} config={config}>\n        {children}\n      </AuthEnforcer>\n    </AuthContext.Provider>\n  );\n}\n\n/**\n * Enforces access control on route changes.\n */\nfunction AuthEnforcer({\n  children,\n  accessMap,\n  config,\n}: {\n  children: React.ReactNode;\n  accessMap: Record<string, string>;\n  config: AuthGuardProps[\"config\"];\n}) {\n  const authState = useContext(AuthContext);\n\n  useEffect(() => {\n    if (typeof window === \"undefined\") return;\n\n    const pathname = window.location.pathname;\n    const pageAccess = accessMap[pathname];\n\n    // No access entry or public = allow\n    if (!pageAccess || pageAccess === \"public\") return;\n\n    // Requires auth but user is not authenticated\n    if (!authState.authenticated) {\n      const loginUrl = config.provider.loginUrl;\n      if (loginUrl) {\n        window.location.href = buildLoginUrl(loginUrl, pathname);\n      }\n      return;\n    }\n\n    // Group-based access\n    if (pageAccess !== \"authenticated\") {\n      const requiredGroups = pageAccess.split(\",\");\n      const hasAccess = requiredGroups.some((g) =>\n        authState.groups.includes(g)\n      );\n      if (!hasAccess) {\n        if (config.unauthorizedBehavior === \"404\") {\n          // Replace with a 404-like state\n          window.location.href = \"/404\";\n        } else {\n          const loginUrl = config.provider.loginUrl;\n          if (loginUrl) {\n            window.location.href = buildLoginUrl(loginUrl, pathname);\n          }\n        }\n      }\n    }\n  }, [authState, accessMap, config]);\n\n  return <>{children}</>;\n}\n\n/**\n * Hook to access authentication state.\n */\nexport function useAuth(): AuthState & {\n  login: () => void;\n  logout: () => void;\n} {\n  const state = useContext(AuthContext);\n\n  return {\n    ...state,\n    login() {\n      // Will be overridden by config at runtime\n      console.warn(\"[xyd:access-control] login() called without config\");\n    },\n    logout() {\n      if (typeof window === \"undefined\") return;\n\n      const cookieName = \"xyd-auth-token\";\n      localStorage.removeItem(cookieName);\n      document.cookie = `${cookieName}=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/`;\n      document.cookie = `${cookieName}-state=; expires=Thu, 01 Jan 1970 00:00:00 GMT; path=/`;\n\n      window.__xydAuthState = {\n        authenticated: false,\n        groups: [],\n        token: null,\n      };\n      document.documentElement.setAttribute(\"data-auth\", \"anonymous\");\n      window.location.reload();\n    },\n  };\n}\n"],"mappings":";AAAA,OAAO;AAAA,EACL;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAQP,IAAM,cAAc,cAAyB;AAAA,EAC3C,eAAe;AAAA,EACf,QAAQ,CAAC;AAAA,EACT,OAAO;AACT,CAAC;AAmBD,SAAS,cAAc,UAAkB,YAA4B;AACnE,QAAM,YAAY,SAAS,SAAS,GAAG,IAAI,MAAM;AACjD,SAAO,GAAG,QAAQ,GAAG,SAAS,YAAY,mBAAmB,UAAU,CAAC;AAC1E;AAOe,SAAR,UAA2B,EAAE,UAAU,WAAW,OAAO,GAAmB;AACjF,QAAM,CAAC,WAAW,YAAY,IAAI,SAAoB,MAAM;AAC1D,QAAI,OAAO,WAAW,eAAe,OAAO,gBAAgB;AAC1D,aAAO,OAAO;AAAA,IAChB;AACA,WAAO,EAAE,eAAe,OAAO,QAAQ,CAAC,GAAG,OAAO,KAAK;AAAA,EACzD,CAAC;AAED,YAAU,MAAM;AAEd,UAAM,gBAAgB,CAAC,MAAoB;AACzC,YAAM,aAAa,OAAO,SAAS,cAAc;AACjD,UAAI,EAAE,QAAQ,YAAY;AACxB,YAAI,EAAE,UAAU;AACd,cAAI;AACF,kBAAM,UAAU,KAAK,MAAM,KAAK,EAAE,SAAS,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;AACzD,yBAAa;AAAA,cACX,eAAe;AAAA,cACf,QAAQ,QAAQ,UAAU,CAAC;AAAA,cAC3B,OAAO,EAAE;AAAA,YACX,CAAC;AAAA,UACH,QAAQ;AACN,yBAAa,EAAE,eAAe,OAAO,QAAQ,CAAC,GAAG,OAAO,KAAK,CAAC;AAAA,UAChE;AAAA,QACF,OAAO;AACL,uBAAa,EAAE,eAAe,OAAO,QAAQ,CAAC,GAAG,OAAO,KAAK,CAAC;AAAA,QAChE;AAAA,MACF;AAAA,IACF;AAEA,WAAO,iBAAiB,WAAW,aAAa;AAChD,WAAO,MAAM,OAAO,oBAAoB,WAAW,aAAa;AAAA,EAClE,GAAG,CAAC,OAAO,SAAS,UAAU,CAAC;AAE/B,QAAM,QAAQ,QAAQ,MAAM,WAAW,CAAC,SAAS,CAAC;AAElD,SACE,oCAAC,YAAY,UAAZ,EAAqB,SACpB,oCAAC,gBAAa,WAAsB,UACjC,QACH,CACF;AAEJ;AAKA,SAAS,aAAa;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AACF,GAIG;AACD,QAAM,YAAY,WAAW,WAAW;AAExC,YAAU,MAAM;AACd,QAAI,OAAO,WAAW,YAAa;AAEnC,UAAM,WAAW,OAAO,SAAS;AACjC,UAAM,aAAa,UAAU,QAAQ;AAGrC,QAAI,CAAC,cAAc,eAAe,SAAU;AAG5C,QAAI,CAAC,UAAU,eAAe;AAC5B,YAAM,WAAW,OAAO,SAAS;AACjC,UAAI,UAAU;AACZ,eAAO,SAAS,OAAO,cAAc,UAAU,QAAQ;AAAA,MACzD;AACA;AAAA,IACF;AAGA,QAAI,eAAe,iBAAiB;AAClC,YAAM,iBAAiB,WAAW,MAAM,GAAG;AAC3C,YAAM,YAAY,eAAe;AAAA,QAAK,CAAC,MACrC,UAAU,OAAO,SAAS,CAAC;AAAA,MAC7B;AACA,UAAI,CAAC,WAAW;AACd,YAAI,OAAO,yBAAyB,OAAO;AAEzC,iBAAO,SAAS,OAAO;AAAA,QACzB,OAAO;AACL,gBAAM,WAAW,OAAO,SAAS;AACjC,cAAI,UAAU;AACZ,mBAAO,SAAS,OAAO,cAAc,UAAU,QAAQ;AAAA,UACzD;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF,GAAG,CAAC,WAAW,WAAW,MAAM,CAAC;AAEjC,SAAO,0DAAG,QAAS;AACrB;AAKO,SAAS,UAGd;AACA,QAAM,QAAQ,WAAW,WAAW;AAEpC,SAAO;AAAA,IACL,GAAG;AAAA,IACH,QAAQ;AAEN,cAAQ,KAAK,oDAAoD;AAAA,IACnE;AAAA,IACA,SAAS;AACP,UAAI,OAAO,WAAW,YAAa;AAEnC,YAAM,aAAa;AACnB,mBAAa,WAAW,UAAU;AAClC,eAAS,SAAS,GAAG,UAAU;AAC/B,eAAS,SAAS,GAAG,UAAU;AAE/B,aAAO,iBAAiB;AAAA,QACtB,eAAe;AAAA,QACf,QAAQ,CAAC;AAAA,QACT,OAAO;AAAA,MACT;AACA,eAAS,gBAAgB,aAAa,aAAa,WAAW;AAC9D,aAAO,SAAS,OAAO;AAAA,IACzB;AAAA,EACF;AACF;","names":[]}

package/dist/LoginPage.js

@@ -0,0 +1,158 @@
+// src/components/LoginPage.tsx
+import React2 from "react";
+
+// src/components/AccessControlContext.tsx
+import React, { createContext, useContext, useEffect, useState, useCallback } from "react";
+
+// src/devOnly.ts
+function isDevEnvironment() {
+  if (typeof window === "undefined") {
+    return process.env.NODE_ENV !== "production";
+  }
+  try {
+    return !!import.meta.env?.DEV;
+  } catch {
+    return false;
+  }
+}
+
+// src/components/AccessControlContext.tsx
+var AccessControlCtx = createContext(null);
+function useAccessControl() {
+  const ctx = useContext(AccessControlCtx);
+  if (!ctx) {
+    throw new Error("useAccessControl must be used inside <AccessControlProvider>");
+  }
+  return ctx;
+}
+function AccessControlProvider({ children }) {
+  const [config, setConfig] = useState(null);
+  const [error, setError] = useState("");
+  const [ready, setReady] = useState(false);
+  useEffect(() => {
+    const globalConfig = window.__xydAccessControlSettings?.accessControlConfig;
+    if (globalConfig) {
+      setConfig(globalConfig);
+      setReady(true);
+      return;
+    }
+    import("virtual:xyd-access-control-settings").then((mod) => {
+      setConfig(mod.accessControlConfig);
+      setReady(true);
+    }).catch(() => setReady(true));
+  }, []);
+  const providerType = config?.provider?.type || "jwt";
+  const loginUrl = config?.provider?.loginUrl || "";
+  const authorizationUrl = config?.provider?.authorizationUrl || "";
+  const hasExternalAuth = providerType === "oauth" ? !!authorizationUrl : !!loginUrl && loginUrl !== "/login";
+  const loginConfig = typeof config?.login === "string" ? {} : config?.login || {};
+  const title = loginConfig.title || "Sign in to access documentation";
+  const description = loginConfig.description || "";
+  const logo = loginConfig.logo || "";
+  const backgroundImage = loginConfig.backgroundImage || "";
+  const params = typeof window !== "undefined" ? new URLSearchParams(window.location.search) : null;
+  const redirectUrl = params?.get("redirect") || "/";
+  const storeTokenAndRedirect = useCallback((token) => {
+    const cookieName = config?.session?.cookieName || "xyd-auth-token";
+    localStorage.setItem(cookieName, token);
+    document.cookie = `${cookieName}=${token}; path=/; max-age=86400; SameSite=Lax`;
+    window.location.href = redirectUrl;
+  }, [config, redirectUrl]);
+  const signInWithOAuth = useCallback(() => {
+    if (!authorizationUrl) {
+      setError("No OAuth authorization URL configured");
+      return;
+    }
+    const callbackPath = config?.provider?.callbackPath || "/auth/callback";
+    const redirectUri = window.location.origin + callbackPath;
+    const scopes = config?.provider?.scopes || [];
+    const clientId = config?.provider?.clientId || "";
+    const oauthParams = new URLSearchParams({
+      client_id: clientId,
+      redirect_uri: redirectUri,
+      response_type: "code",
+      scope: scopes.join(" "),
+      state: redirectUrl
+    });
+    window.location.href = `${authorizationUrl}?${oauthParams.toString()}`;
+  }, [config, authorizationUrl, redirectUrl]);
+  const signInWithRedirect = useCallback(() => {
+    if (!loginUrl || loginUrl === "/login") {
+      setError("No external login URL configured");
+      return;
+    }
+    const sep = loginUrl.includes("?") ? "&" : "?";
+    window.location.href = `${loginUrl}${sep}redirect=${encodeURIComponent(redirectUrl)}`;
+  }, [loginUrl, redirectUrl]);
+  const signInWithGroups = useCallback((groups) => {
+    const hasDeploy = !!config?.deploy;
+    if (hasDeploy) {
+      const groupsParam = groups.length ? `&groups=${groups.join(",")}` : "";
+      window.location.href = `/auth/test-login?redirect=${encodeURIComponent(redirectUrl)}${groupsParam}`;
+      return;
+    }
+    if (!isDevEnvironment()) {
+      setError("Test login is only available in development mode.");
+      return;
+    }
+    const header = btoa(JSON.stringify({ alg: "HS256", typ: "JWT" }));
+    const payload = btoa(JSON.stringify({
+      sub: "test-user",
+      groups,
+      exp: Math.floor(Date.now() / 1e3) + 86400,
+      iat: Math.floor(Date.now() / 1e3)
+    }));
+    storeTokenAndRedirect(`${header}.${payload}.dGVzdA`);
+  }, [config, redirectUrl, storeTokenAndRedirect]);
+  const signInAsUser = useCallback(() => signInWithGroups([]), [signInWithGroups]);
+  const signInAsAdmin = useCallback(() => signInWithGroups(["admin"]), [signInWithGroups]);
+  const value = {
+    config,
+    ready,
+    error,
+    clearError: () => setError(""),
+    signInWithOAuth,
+    signInWithRedirect,
+    signInAsUser,
+    signInAsAdmin,
+    signInWithGroups,
+    providerType,
+    hasExternalAuth,
+    title,
+    description,
+    logo,
+    backgroundImage,
+    redirectUrl
+  };
+  return /* @__PURE__ */ React.createElement(AccessControlCtx.Provider, { value }, children);
+}
+
+// src/components/LoginPage.tsx
+function LoginPage() {
+  return /* @__PURE__ */ React2.createElement(AccessControlProvider, null, /* @__PURE__ */ React2.createElement(LoginPageUI, null));
+}
+function LoginPageUI() {
+  const {
+    providerType,
+    hasExternalAuth,
+    title,
+    description,
+    logo,
+    backgroundImage,
+    error,
+    signInWithOAuth,
+    signInWithRedirect,
+    signInAsUser,
+    signInAsAdmin
+  } = useAccessControl();
+  const handleSignIn = () => {
+    if (providerType === "oauth") signInWithOAuth();
+    else signInWithRedirect();
+  };
+  const bgOverride = backgroundImage ? { backgroundImage: `url(${backgroundImage})`, backgroundSize: "cover", backgroundPosition: "center", background: "none" } : void 0;
+  return /* @__PURE__ */ React2.createElement("div", { className: "xyd-login-page", style: bgOverride }, /* @__PURE__ */ React2.createElement("div", { part: "card" }, logo && /* @__PURE__ */ React2.createElement("img", { part: "logo", src: logo, alt: "" }), /* @__PURE__ */ React2.createElement("h1", { part: "title" }, title), description && /* @__PURE__ */ React2.createElement("p", { part: "description" }, description), error && /* @__PURE__ */ React2.createElement("p", { part: "error" }, error), hasExternalAuth ? /* @__PURE__ */ React2.createElement("button", { part: "button", onClick: handleSignIn }, "Sign in") : /* @__PURE__ */ React2.createElement("div", { part: "actions" }, /* @__PURE__ */ React2.createElement("button", { part: "button", onClick: signInAsUser }, "Sign in as User"), /* @__PURE__ */ React2.createElement("button", { part: "button", "data-kind": "secondary", onClick: signInAsAdmin }, "Sign in as Admin"))));
+}
+export {
+  LoginPage as default
+};
+//# sourceMappingURL=LoginPage.js.map

package/dist/LoginPage.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/components/LoginPage.tsx","../src/components/AccessControlContext.tsx","../src/devOnly.ts"],"sourcesContent":["import React from \"react\";\nimport { AccessControlProvider, useAccessControl } from \"./AccessControlContext\";\n\n/**\n * Default login page. Wraps itself with AccessControlProvider\n * so it works regardless of the host wrapper.\n */\nexport default function LoginPage() {\n  return (\n    <AccessControlProvider>\n      <LoginPageUI />\n    </AccessControlProvider>\n  );\n}\n\nfunction LoginPageUI() {\n  const {\n    providerType,\n    hasExternalAuth,\n    title,\n    description,\n    logo,\n    backgroundImage,\n    error,\n    signInWithOAuth,\n    signInWithRedirect,\n    signInAsUser,\n    signInAsAdmin,\n  } = useAccessControl();\n\n  const handleSignIn = () => {\n    if (providerType === \"oauth\") signInWithOAuth();\n    else signInWithRedirect();\n  };\n\n  const bgOverride = backgroundImage\n    ? { backgroundImage: `url(${backgroundImage})`, backgroundSize: \"cover\" as const, backgroundPosition: \"center\", background: \"none\" }\n    : undefined;\n\n  return (\n    <div className=\"xyd-login-page\" style={bgOverride}>\n      <div part=\"card\">\n        {logo && <img part=\"logo\" src={logo} alt=\"\" />}\n\n        <h1 part=\"title\">{title}</h1>\n\n        {description && <p part=\"description\">{description}</p>}\n\n        {error && <p part=\"error\">{error}</p>}\n\n        {hasExternalAuth ? (\n          <button part=\"button\" onClick={handleSignIn}>Sign in</button>\n        ) : (\n          <div part=\"actions\">\n            <button part=\"button\" onClick={signInAsUser}>Sign in as User</button>\n            <button part=\"button\" data-kind=\"secondary\" onClick={signInAsAdmin}>Sign in as Admin</button>\n          </div>\n        )}\n      </div>\n    </div>\n  );\n}","import React, { createContext, useContext, useEffect, useState, useCallback } from \"react\";\nimport { isDevEnvironment as isDevEnv } from \"../devOnly\";\n\nexport interface AccessControlActions {\n  /** Current auth config from docs.json */\n  config: any | null;\n  /** Whether config has loaded */\n  ready: boolean;\n  /** Last error message */\n  error: string;\n  /** Clear error */\n  clearError: () => void;\n\n  // --- Auth actions ---\n\n  /** Redirect to external OAuth provider */\n  signInWithOAuth: () => void;\n  /** Redirect to external JWT login URL */\n  signInWithRedirect: () => void;\n  /** Sign in with test token (dev/edge server) */\n  signInAsUser: () => void;\n  /** Sign in as admin with test token (dev/edge server) */\n  signInAsAdmin: () => void;\n  /** Sign in with specific groups */\n  signInWithGroups: (groups: string[]) => void;\n  // --- Info ---\n\n  /** Provider type: \"jwt\" | \"oauth\" */\n  providerType: string;\n  /** Whether an external auth URL is configured */\n  hasExternalAuth: boolean;\n  /** Login page title from config */\n  title: string;\n  /** Login page description from config */\n  description: string;\n  /** Login page logo URL from config */\n  logo: string;\n  /** Login page background image from config */\n  backgroundImage: string;\n  /** The redirect URL (where to go after login) */\n  redirectUrl: string;\n}\n\nconst AccessControlCtx = createContext<AccessControlActions | null>(null);\n\n/**\n * Hook to access auth actions in custom login pages.\n *\n * @example\n * ```tsx\n * import { useAccessControl } from \"@xyd-js/plugin-access-control\"\n *\n * function MyLoginPage() {\n *   const { signInWithOAuth, title, logo, error } = useAccessControl()\n *\n *   return (\n *     <div>\n *       {logo && <img src={logo} />}\n *       <h1>{title}</h1>\n *       {error && <p>{error}</p>}\n *       <button onClick={signInWithOAuth}>Sign in</button>\n *     </div>\n *   )\n * }\n * ```\n */\nexport function useAccessControl(): AccessControlActions {\n  const ctx = useContext(AccessControlCtx);\n  if (!ctx) {\n    throw new Error(\"useAccessControl must be used inside <AccessControlProvider>\");\n  }\n  return ctx;\n}\n\nexport function AccessControlProvider({ children }: { children: React.ReactNode }) {\n  const [config, setConfig] = useState<any>(null);\n  const [error, setError] = useState(\"\");\n  const [ready, setReady] = useState(false);\n\n  useEffect(() => {\n    const globalConfig = (window as any).__xydAccessControlSettings?.accessControlConfig;\n    if (globalConfig) {\n      setConfig(globalConfig);\n      setReady(true);\n      return;\n    }\n    // @ts-ignore\n    import(\"virtual:xyd-access-control-settings\")\n      .then((mod: any) => { setConfig(mod.accessControlConfig); setReady(true); })\n      .catch(() => setReady(true));\n  }, []);\n\n  const providerType = config?.provider?.type || \"jwt\";\n  const loginUrl = config?.provider?.loginUrl || \"\";\n  const authorizationUrl = config?.provider?.authorizationUrl || \"\";\n  const hasExternalAuth = providerType === \"oauth\"\n    ? !!authorizationUrl\n    : !!loginUrl && loginUrl !== \"/login\";\n\n  // login can be a string (custom component path) or an object (config)\n  const loginConfig = typeof config?.login === \"string\" ? {} : (config?.login || {});\n  const title = loginConfig.title || \"Sign in to access documentation\";\n  const description = loginConfig.description || \"\";\n  const logo = loginConfig.logo || \"\";\n  const backgroundImage = loginConfig.backgroundImage || \"\";\n\n  const params = typeof window !== \"undefined\" ? new URLSearchParams(window.location.search) : null;\n  const redirectUrl = params?.get(\"redirect\") || \"/\";\n\n  const storeTokenAndRedirect = useCallback((token: string) => {\n    const cookieName = config?.session?.cookieName || \"xyd-auth-token\";\n    localStorage.setItem(cookieName, token);\n    document.cookie = `${cookieName}=${token}; path=/; max-age=86400; SameSite=Lax`;\n    window.location.href = redirectUrl;\n  }, [config, redirectUrl]);\n\n  const signInWithOAuth = useCallback(() => {\n    if (!authorizationUrl) { setError(\"No OAuth authorization URL configured\"); return; }\n    const callbackPath = config?.provider?.callbackPath || \"/auth/callback\";\n    const redirectUri = window.location.origin + callbackPath;\n    const scopes = config?.provider?.scopes || [];\n    const clientId = config?.provider?.clientId || \"\";\n\n    const oauthParams = new URLSearchParams({\n      client_id: clientId,\n      redirect_uri: redirectUri,\n      response_type: \"code\",\n      scope: scopes.join(\" \"),\n      state: redirectUrl,\n    });\n    window.location.href = `${authorizationUrl}?${oauthParams.toString()}`;\n  }, [config, authorizationUrl, redirectUrl]);\n\n  const signInWithRedirect = useCallback(() => {\n    if (!loginUrl || loginUrl === \"/login\") { setError(\"No external login URL configured\"); return; }\n    const sep = loginUrl.includes(\"?\") ? \"&\" : \"?\";\n    window.location.href = `${loginUrl}${sep}redirect=${encodeURIComponent(redirectUrl)}`;\n  }, [loginUrl, redirectUrl]);\n\n  const signInWithGroups = useCallback((groups: string[]) => {\n    // Production with deploy config: use /auth/test-login (server-signed)\n    const hasDeploy = !!config?.deploy;\n    if (hasDeploy) {\n      const groupsParam = groups.length ? `&groups=${groups.join(\",\")}` : \"\";\n      window.location.href = `/auth/test-login?redirect=${encodeURIComponent(redirectUrl)}${groupsParam}`;\n      return;\n    }\n\n    // Dev only: generate unsigned client-side token\n    if (!isDevEnv()) {\n      setError(\"Test login is only available in development mode.\");\n      return;\n    }\n    const header = btoa(JSON.stringify({ alg: \"HS256\", typ: \"JWT\" }));\n    const payload = btoa(JSON.stringify({\n      sub: \"test-user\",\n      groups,\n      exp: Math.floor(Date.now() / 1000) + 86400,\n      iat: Math.floor(Date.now() / 1000),\n    }));\n    storeTokenAndRedirect(`${header}.${payload}.dGVzdA`);\n  }, [config, redirectUrl, storeTokenAndRedirect]);\n\n  const signInAsUser = useCallback(() => signInWithGroups([]), [signInWithGroups]);\n  const signInAsAdmin = useCallback(() => signInWithGroups([\"admin\"]), [signInWithGroups]);\n\n  const value: AccessControlActions = {\n    config,\n    ready,\n    error,\n    clearError: () => setError(\"\"),\n    signInWithOAuth,\n    signInWithRedirect,\n    signInAsUser,\n    signInAsAdmin,\n    signInWithGroups,\n    providerType,\n    hasExternalAuth,\n    title,\n    description,\n    logo,\n    backgroundImage,\n    redirectUrl,\n  };\n\n  return <AccessControlCtx.Provider value={value}>{children}</AccessControlCtx.Provider>;\n}","/**\n * Check if running in development mode.\n * Server-side: checks NODE_ENV\n * Client-side: checks import.meta.env (set by Vite)\n */\nexport function isDevEnvironment(): boolean {\n  // Server-side (Node.js)\n  if (typeof window === \"undefined\") {\n    return process.env.NODE_ENV !== \"production\";\n  }\n\n  // Client-side (Vite)\n  try {\n    return !!(import.meta as any).env?.DEV;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Check if auth bypass is enabled. Only works in development mode.\n * Controlled by XYD_AUTH_BYPASS=1 environment variable.\n */\nexport function isAuthBypassed(): boolean {\n  if (!isDevEnvironment()) return false;\n\n  return (\n    process.env.XYD_AUTH_BYPASS === \"1\" ||\n    process.env.XYD_AUTH_BYPASS === \"true\"\n  );\n}"],"mappings":";AAAA,OAAOA,YAAW;;;ACAlB,OAAO,SAAS,eAAe,YAAY,WAAW,UAAU,mBAAmB;;;ACK5E,SAAS,mBAA4B;AAE1C,MAAI,OAAO,WAAW,aAAa;AACjC,WAAO,QAAQ,IAAI,aAAa;AAAA,EAClC;AAGA,MAAI;AACF,WAAO,CAAC,CAAE,YAAoB,KAAK;AAAA,EACrC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AD0BA,IAAM,mBAAmB,cAA2C,IAAI;AAuBjE,SAAS,mBAAyC;AACvD,QAAM,MAAM,WAAW,gBAAgB;AACvC,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,MAAM,8DAA8D;AAAA,EAChF;AACA,SAAO;AACT;AAEO,SAAS,sBAAsB,EAAE,SAAS,GAAkC;AACjF,QAAM,CAAC,QAAQ,SAAS,IAAI,SAAc,IAAI;AAC9C,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAS,EAAE;AACrC,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAS,KAAK;AAExC,YAAU,MAAM;AACd,UAAM,eAAgB,OAAe,4BAA4B;AACjE,QAAI,cAAc;AAChB,gBAAU,YAAY;AACtB,eAAS,IAAI;AACb;AAAA,IACF;AAEA,WAAO,qCAAqC,EACzC,KAAK,CAAC,QAAa;AAAE,gBAAU,IAAI,mBAAmB;AAAG,eAAS,IAAI;AAAA,IAAG,CAAC,EAC1E,MAAM,MAAM,SAAS,IAAI,CAAC;AAAA,EAC/B,GAAG,CAAC,CAAC;AAEL,QAAM,eAAe,QAAQ,UAAU,QAAQ;AAC/C,QAAM,WAAW,QAAQ,UAAU,YAAY;AAC/C,QAAM,mBAAmB,QAAQ,UAAU,oBAAoB;AAC/D,QAAM,kBAAkB,iBAAiB,UACrC,CAAC,CAAC,mBACF,CAAC,CAAC,YAAY,aAAa;AAG/B,QAAM,cAAc,OAAO,QAAQ,UAAU,WAAW,CAAC,IAAK,QAAQ,SAAS,CAAC;AAChF,QAAM,QAAQ,YAAY,SAAS;AACnC,QAAM,cAAc,YAAY,eAAe;AAC/C,QAAM,OAAO,YAAY,QAAQ;AACjC,QAAM,kBAAkB,YAAY,mBAAmB;AAEvD,QAAM,SAAS,OAAO,WAAW,cAAc,IAAI,gBAAgB,OAAO,SAAS,MAAM,IAAI;AAC7F,QAAM,cAAc,QAAQ,IAAI,UAAU,KAAK;AAE/C,QAAM,wBAAwB,YAAY,CAAC,UAAkB;AAC3D,UAAM,aAAa,QAAQ,SAAS,cAAc;AAClD,iBAAa,QAAQ,YAAY,KAAK;AACtC,aAAS,SAAS,GAAG,UAAU,IAAI,KAAK;AACxC,WAAO,SAAS,OAAO;AAAA,EACzB,GAAG,CAAC,QAAQ,WAAW,CAAC;AAExB,QAAM,kBAAkB,YAAY,MAAM;AACxC,QAAI,CAAC,kBAAkB;AAAE,eAAS,uCAAuC;AAAG;AAAA,IAAQ;AACpF,UAAM,eAAe,QAAQ,UAAU,gBAAgB;AACvD,UAAM,cAAc,OAAO,SAAS,SAAS;AAC7C,UAAM,SAAS,QAAQ,UAAU,UAAU,CAAC;AAC5C,UAAM,WAAW,QAAQ,UAAU,YAAY;AAE/C,UAAM,cAAc,IAAI,gBAAgB;AAAA,MACtC,WAAW;AAAA,MACX,cAAc;AAAA,MACd,eAAe;AAAA,MACf,OAAO,OAAO,KAAK,GAAG;AAAA,MACtB,OAAO;AAAA,IACT,CAAC;AACD,WAAO,SAAS,OAAO,GAAG,gBAAgB,IAAI,YAAY,SAAS,CAAC;AAAA,EACtE,GAAG,CAAC,QAAQ,kBAAkB,WAAW,CAAC;AAE1C,QAAM,qBAAqB,YAAY,MAAM;AAC3C,QAAI,CAAC,YAAY,aAAa,UAAU;AAAE,eAAS,kCAAkC;AAAG;AAAA,IAAQ;AAChG,UAAM,MAAM,SAAS,SAAS,GAAG,IAAI,MAAM;AAC3C,WAAO,SAAS,OAAO,GAAG,QAAQ,GAAG,GAAG,YAAY,mBAAmB,WAAW,CAAC;AAAA,EACrF,GAAG,CAAC,UAAU,WAAW,CAAC;AAE1B,QAAM,mBAAmB,YAAY,CAAC,WAAqB;AAEzD,UAAM,YAAY,CAAC,CAAC,QAAQ;AAC5B,QAAI,WAAW;AACb,YAAM,cAAc,OAAO,SAAS,WAAW,OAAO,KAAK,GAAG,CAAC,KAAK;AACpE,aAAO,SAAS,OAAO,6BAA6B,mBAAmB,WAAW,CAAC,GAAG,WAAW;AACjG;AAAA,IACF;AAGA,QAAI,CAAC,iBAAS,GAAG;AACf,eAAS,mDAAmD;AAC5D;AAAA,IACF;AACA,UAAM,SAAS,KAAK,KAAK,UAAU,EAAE,KAAK,SAAS,KAAK,MAAM,CAAC,CAAC;AAChE,UAAM,UAAU,KAAK,KAAK,UAAU;AAAA,MAClC,KAAK;AAAA,MACL;AAAA,MACA,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AAAA,MACrC,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAAA,IACnC,CAAC,CAAC;AACF,0BAAsB,GAAG,MAAM,IAAI,OAAO,SAAS;AAAA,EACrD,GAAG,CAAC,QAAQ,aAAa,qBAAqB,CAAC;AAE/C,QAAM,eAAe,YAAY,MAAM,iBAAiB,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;AAC/E,QAAM,gBAAgB,YAAY,MAAM,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;AAEvF,QAAM,QAA8B;AAAA,IAClC;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,MAAM,SAAS,EAAE;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,SAAO,oCAAC,iBAAiB,UAAjB,EAA0B,SAAe,QAAS;AAC5D;;;ADnLe,SAAR,YAA6B;AAClC,SACE,gBAAAC,OAAA,cAAC,6BACC,gBAAAA,OAAA,cAAC,iBAAY,CACf;AAEJ;AAEA,SAAS,cAAc;AACrB,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI,iBAAiB;AAErB,QAAM,eAAe,MAAM;AACzB,QAAI,iBAAiB,QAAS,iBAAgB;AAAA,QACzC,oBAAmB;AAAA,EAC1B;AAEA,QAAM,aAAa,kBACf,EAAE,iBAAiB,OAAO,eAAe,KAAK,gBAAgB,SAAkB,oBAAoB,UAAU,YAAY,OAAO,IACjI;AAEJ,SACE,gBAAAA,OAAA,cAAC,SAAI,WAAU,kBAAiB,OAAO,cACrC,gBAAAA,OAAA,cAAC,SAAI,MAAK,UACP,QAAQ,gBAAAA,OAAA,cAAC,SAAI,MAAK,QAAO,KAAK,MAAM,KAAI,IAAG,GAE5C,gBAAAA,OAAA,cAAC,QAAG,MAAK,WAAS,KAAM,GAEvB,eAAe,gBAAAA,OAAA,cAAC,OAAE,MAAK,iBAAe,WAAY,GAElD,SAAS,gBAAAA,OAAA,cAAC,OAAE,MAAK,WAAS,KAAM,GAEhC,kBACC,gBAAAA,OAAA,cAAC,YAAO,MAAK,UAAS,SAAS,gBAAc,SAAO,IAEpD,gBAAAA,OAAA,cAAC,SAAI,MAAK,aACR,gBAAAA,OAAA,cAAC,YAAO,MAAK,UAAS,SAAS,gBAAc,iBAAe,GAC5D,gBAAAA,OAAA,cAAC,YAAO,MAAK,UAAS,aAAU,aAAY,SAAS,iBAAe,kBAAgB,CACtF,CAEJ,CACF;AAEJ;","names":["React","React"]}