@zango-core/appbuilder 1.0.0-rc.1

package/dist/types/auth/contexts/LoginContext.d.ts

@@ -0,0 +1,6 @@
+interface LoginContextType {
+    onLogin: (result: unknown) => void;
+}
+export declare const LoginContext: import('react').Context<LoginContextType | null>;
+export declare const useLoginContext: () => LoginContextType | null;
+export {};

package/dist/types/auth/hocs/withMultiStepAuth.d.ts

@@ -0,0 +1,35 @@
+import { default as React } from 'react';
+interface WithMultiStepAuthOptions {
+    logo?: React.ReactNode;
+    roleSelectionTitle?: string;
+    roleSelectionSubtitle?: string;
+    twoFactorTitle?: string;
+    twoFactorSubtitle?: string;
+    passwordResetTitle?: string;
+    passwordResetSubtitle?: string;
+}
+/**
+ * Higher-Order Component that wraps custom login pages to provide automatic
+ * multi-step authentication handling (role selection, 2FA, password reset).
+ *
+ * @param CustomLoginCard - The custom login page component
+ * @param options - Optional configuration for auth flow screens
+ * @returns Wrapped component with multi-step auth support
+ *
+ * @example
+ * ```tsx
+ * const MyLogin = () => (
+ *   <div>
+ *     <OTPLoginForm />
+ *     <SSOButtons />
+ *   </div>
+ * );
+ *
+ * export default withMultiStepAuth(MyLogin, {
+ *   logo: <img src="/logo.png" />,
+ *   roleSelectionTitle: "Choose Your Role"
+ * });
+ * ```
+ */
+export declare const withMultiStepAuth: (CustomLoginCard: React.ComponentType<Record<string, unknown>>, options?: WithMultiStepAuthOptions) => (props: Record<string, unknown>) => React.JSX.Element;
+export {};

package/dist/types/auth/index.d.ts

@@ -0,0 +1,23 @@
+export { AuthProvider } from './components/AuthProvider';
+export { OTPLoginForm, PasswordLoginForm, SSOButtons } from './components/composable';
+export { DynamicLoginForm } from './components/DynamicLoginForm';
+export { ForgotPasswordForm } from './components/ForgotPasswordForm';
+export { LoginForm } from './components/LoginForm';
+export { LoginRouter } from './components/LoginRouter';
+export { OAuthCallback } from './components/OAuthCallback';
+export { OTPForm } from './components/OTPForm';
+export { OTPInput } from './components/OTPInput';
+export { PasswordResetRequired } from './components/PasswordResetRequired';
+export { ProviderButton } from './components/ProviderButton';
+export { ResetPasswordForm } from './components/ResetPasswordForm';
+export { RoleSelection } from './components/RoleSelection';
+export { SecondFactorAuth } from './components/SecondFactorAuth';
+export { LoginContext, useLoginContext } from './contexts/LoginContext';
+export { useAuth } from './hooks/useAuth';
+export { CompleteAuthFlow } from './pages/CompleteAuthFlow';
+export { LoginPage } from './pages/LoginPage';
+export { LoginPageWithRoleSelection } from './pages/LoginPageWithRoleSelection';
+export { OAuthCallbackPage } from './pages/OAuthCallbackPage';
+export { SAMLCallbackPage } from './pages/SAMLCallbackPage';
+export * from './services/authService';
+export * from './utils/authUtils';

package/dist/types/auth/pages/CompleteAuthFlow.d.ts

@@ -0,0 +1,24 @@
+import { default as React } from 'react';
+import { ApiConfig, AuthConfig, AuthResult, PendingAuthResult } from '../../types';
+interface CompleteAuthFlowProps {
+    logo?: React.ReactNode;
+    title?: string;
+    subtitle?: string;
+    apiConfig?: ApiConfig;
+    useDynamicConfig?: boolean;
+    staticConfig?: AuthConfig;
+    onAuthComplete: (result: AuthResult) => void;
+    roleSelectionTitle?: string;
+    roleSelectionSubtitle?: string;
+    twoFactorTitle?: string;
+    twoFactorSubtitle?: string;
+    passwordResetTitle?: string;
+    passwordResetSubtitle?: string;
+    initialAuthState?: PendingAuthResult;
+    redirectPath?: string;
+    initialRedirectUrl?: string | null;
+    skipLoginStep?: boolean;
+    initialNextParam?: string | null;
+}
+export declare const CompleteAuthFlow: React.FC<CompleteAuthFlowProps>;
+export {};

package/dist/types/auth/pages/LoginPage.d.ts

@@ -0,0 +1,8 @@
+import { default as React } from 'react';
+import { LoginPageProps } from '../types';
+interface ExtendedLoginPageProps extends LoginPageProps {
+    useDynamicConfig?: boolean;
+    staticConfig?: Record<string, unknown> | null;
+}
+export declare const LoginPage: React.FC<ExtendedLoginPageProps>;
+export {};

package/dist/types/auth/pages/LoginPageWithRoleSelection.d.ts

@@ -0,0 +1,13 @@
+import { default as React } from 'react';
+export declare const LoginPageWithRoleSelection: ({ logo, title, subtitle, apiConfig, useDynamicConfig, staticConfig, onLoginSuccess, roleSelectionTitle, roleSelectionSubtitle, initialAuthResult, }: {
+    logo?: React.ReactNode;
+    title?: string;
+    subtitle?: string;
+    apiConfig?: Record<string, unknown>;
+    useDynamicConfig?: boolean;
+    staticConfig?: Record<string, unknown> | null;
+    onLoginSuccess?: (result: unknown) => void;
+    roleSelectionTitle?: string;
+    roleSelectionSubtitle?: string;
+    initialAuthResult?: unknown;
+}) => React.JSX.Element;

package/dist/types/auth/pages/OAuthCallbackPage.d.ts

@@ -0,0 +1,17 @@
+import { default as React } from 'react';
+import { AuthResult } from '../../types';
+import { ApiConfig } from '../types';
+interface OAuthCallbackPageProps {
+    logo?: React.ReactNode;
+    apiConfig?: ApiConfig;
+    onAuthComplete?: (result: AuthResult) => void;
+    roleSelectionTitle?: string;
+    roleSelectionSubtitle?: string;
+    twoFactorTitle?: string;
+    twoFactorSubtitle?: string;
+    passwordResetTitle?: string;
+    passwordResetSubtitle?: string;
+    redirectPath?: string;
+}
+export declare const OAuthCallbackPage: React.FC<OAuthCallbackPageProps>;
+export {};

package/dist/types/auth/pages/SAMLCallbackPage.d.ts

@@ -0,0 +1,16 @@
+import { default as React } from 'react';
+import { AuthResult } from '../../types';
+interface SAMLCallbackPageProps {
+    logo?: React.ReactNode;
+    title?: string;
+    subtitle?: string;
+    onAuthComplete?: (result: AuthResult) => void;
+    roleSelectionTitle?: string;
+    roleSelectionSubtitle?: string;
+    twoFactorTitle?: string;
+    twoFactorSubtitle?: string;
+    passwordResetTitle?: string;
+    passwordResetSubtitle?: string;
+}
+export declare const SAMLCallbackPage: React.FC<SAMLCallbackPageProps>;
+export {};

package/dist/types/auth/services/authService.d.ts

@@ -0,0 +1,87 @@
+import { LoginCredentials } from '../../types';
+import { LoginSuccessResponse } from './network';
+import { clearSamlSessionToken, getSAMLAuthMeta, getSamlSessionToken, initiateSAMLAuth, oauthRedirect, processOAuthCallback, setRole } from './internal/oauthSamlService';
+export declare const authService: {
+    getAuthConfig(): Promise<Record<string, unknown>>;
+    getConfig(): Record<string, unknown> | null;
+    isPasswordLoginEnabled(): boolean;
+    isOTPLoginEnabled(): boolean;
+    isSSOEnabled(): boolean;
+    isOIDCEnabled(): boolean;
+    getOIDCProviders(): {};
+    getSSOProviders(): {};
+    getAllowedUsernames(): string[];
+    getOtpAllowedUsernames(): string[];
+    /**
+     * Identifier types to show for a given login method.
+     *
+     * Password and OTP draw their identifiers from different parts of the config
+     * — password from `login_methods.password.allowed_usernames`, OTP from
+     * `login_methods.otp.allowed_methods`. Callers that render either method were
+     * reaching for `getAllowedUsernames()` regardless, so an SMS-only OTP config
+     * still showed an email tab. Route method-dependent lookups through here so
+     * the choice is made in one place.
+     */
+    getAllowedUsernamesForMethod(method: "password" | "otp"): string[];
+    /**
+     * The login methods this deployment permits, in the order the UI offers them.
+     * Use instead of calling each `is*Enabled()` getter separately, so a screen
+     * cannot check three of the four and silently ignore the rest.
+     */
+    getEnabledLoginMethods(): Array<"password" | "otp" | "sso" | "oidc">;
+    isForgotPasswordEnabled(): boolean;
+    getPasswordResetLinkExpiry(): number;
+    getSessionPolicy(): {};
+    isRememberMeEnabled(): boolean;
+    getRememberMeDurationDays(): number;
+    getPasswordPolicy(): {};
+    getPasswordResetMethods(): import('./network').PasswordResetPolicyMethodEnum[];
+    isPasswordResetEnabled(): boolean;
+    getPasswordResetExpiry(): number;
+    isTwoFactorRequired(): boolean;
+    getTwoFactorMethods(): import('./network').TwoFactorAuthAllowedMethodsEnum[];
+    getTwoFactorHooks(): {
+        email: string | undefined;
+        sms: string | undefined;
+    };
+    login(credentials: LoginCredentials, _config?: Record<string, unknown>): Promise<Record<string, unknown> | LoginSuccessResponse | import('./network').LoginSuccessResponseAllOfResponse>;
+    logout(_config?: {}): Promise<void>;
+    getCurrentUser(): Promise<{
+        authenticated: boolean;
+    }>;
+    verifyToken(_token: string, _config?: {}): Promise<{
+        authenticated: boolean;
+    }>;
+    forgotPassword(data: {
+        email?: string;
+        phone?: string;
+    } | string): Promise<any>;
+    requestPasswordReset(data: {
+        email?: string;
+        phone?: string;
+    }): Promise<any>;
+    validatePasswordResetKey(key: string): Promise<any>;
+    confirmResetPassword(data: {
+        key: string;
+        password: string;
+    }): Promise<any>;
+    fetchLoginMethods(): Promise<{}>;
+    requestOTP(identifier: string): Promise<void | Record<string, unknown> | import('./network').LoginOTPResponseAllOfResponse | import('./network').LoginOTPResponseAllOfResponseData>;
+    verifyOTP(_identifier: string, otp: string): Promise<Record<string, unknown> | import('./network').LoginOTPResponseAllOfResponse | LoginSuccessResponse>;
+    selectRole(roleId: string): Promise<any>;
+    sendTwoFactorCode(method?: string): Promise<import('./network').GetMfaCodeResponse>;
+    verifyTwoFactorCode(code: string): Promise<LoginSuccessResponse>;
+    changePassword(currentPassword: string, newPassword: string): Promise<import('./network').SuccessResponse>;
+    setPassword(newPassword: string): Promise<Record<string, unknown> | import('./network').SetPassword200Response>;
+    processOAuthCallback: typeof processOAuthCallback;
+    clearConfig(): void;
+    isAuthenticated(): Promise<boolean>;
+    validatePassword(password: string): import('./internal/passwordValidator').PasswordValidationResult;
+    oauthRedirect: typeof oauthRedirect;
+    getUserProfile(): Promise<import('./network').ProfileResponse>;
+    initiateSAMLAuth: typeof initiateSAMLAuth;
+    getSAMLAuthMeta: typeof getSAMLAuthMeta;
+    setRole: typeof setRole;
+    clearSamlSessionToken: typeof clearSamlSessionToken;
+    getSamlSessionToken: typeof getSamlSessionToken;
+};

package/dist/types/auth/services/internal/apiClients.d.ts

@@ -0,0 +1,9 @@
+import { ApplicationConfigurationApi, AuthenticationApi, Configuration, LoginWithOTPApi, MultiFactorAuthenticationApi, OAuthApi, PasswordManagementApi, RoleManagementApi } from '../network';
+export declare const apiConfig: Configuration;
+export declare const authApi: AuthenticationApi;
+export declare const configApi: ApplicationConfigurationApi;
+export declare const otpApi: LoginWithOTPApi;
+export declare const mfaApi: MultiFactorAuthenticationApi;
+export declare const passwordApi: PasswordManagementApi;
+export declare const roleApi: RoleManagementApi;
+export declare const oauthApi: OAuthApi;

package/dist/types/auth/services/internal/authState.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Shared mutable state for authService.
+ *
+ * Why an object: `let` exports become snapshots when imported, breaking
+ * cross-module mutation. Wrapping state on an object keeps a single source
+ * of truth that all sub-modules can read AND write to.
+ */
+export declare const authState: {
+    config: Record<string, unknown> | null;
+    configPromise: Promise<Record<string, unknown>> | null;
+    samlSessionToken: string | null;
+};

package/dist/types/auth/services/internal/errorHelper.d.ts

@@ -0,0 +1 @@
+export declare const extractErrorMessage: (error: unknown) => string;

package/dist/types/auth/services/internal/oauthSamlService.d.ts

@@ -0,0 +1,46 @@
+import { RawAxiosRequestConfig } from 'axios';
+import { LoginSuccessResponse, OauthCallbackProviderEnum, OauthRedirectProviderEnum } from '../network';
+/**
+ * Process the callback from an OAuth provider (Google, etc).
+ * Returns either the login data or a multi-step auth response.
+ */
+export declare function processOAuthCallback(provider: OauthCallbackProviderEnum, state: string, code: string, scope: string, authUser?: string, hd?: string, prompt?: string, options?: RawAxiosRequestConfig): Promise<LoginSuccessResponse | import('../network').LoginSuccessResponseAllOfResponse | import('../network').LoginSuccessResponseAllOfResponseData | {
+    status?: number;
+    data?: {
+        next_step?: unknown;
+    };
+} | {
+    success?: boolean;
+    response?: {
+        status?: number;
+        data?: {
+            next_step?: unknown;
+        };
+    };
+    data?: {
+        next_step?: unknown;
+    };
+}>;
+/**
+ * Initiate OAuth redirect to the provider.
+ * Optionally encodes a `next` parameter so the backend can resume after callback.
+ */
+export declare function oauthRedirect(provider: OauthRedirectProviderEnum, callbackUrl: string, nextParam?: string | null): Promise<import('../network').OAuthRedirectResponse>;
+/**
+ * Initiate SAML SSO flow. Returns a redirect URL to the IdP.
+ */
+export declare function initiateSAMLAuth(samlId: string, nextParam?: string | null): Promise<any>;
+/**
+ * Get authentication metadata from a SAML callback (token + request_id).
+ * Stores the SAML session token if present, since the SAML flow may not set
+ * the sessionid cookie immediately.
+ */
+export declare function getSAMLAuthMeta(token: string, requestId: string): Promise<any>;
+/**
+ * Set the user's role after multi-step authentication.
+ * Includes the SAML session token header if available (SAML flow may not
+ * have set the sessionid cookie yet).
+ */
+export declare function setRole(roleId: string): Promise<any>;
+export declare function clearSamlSessionToken(): void;
+export declare function getSamlSessionToken(): string | null;

package/dist/types/auth/services/internal/passwordValidator.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Validate a password against a policy from auth config.
+ */
+type PasswordPolicy = {
+    min_length?: number;
+    max_length?: number;
+    require_numbers?: boolean;
+    require_lowercase?: boolean;
+    require_uppercase?: boolean;
+    require_special_chars?: boolean;
+};
+export interface PasswordValidationResult {
+    valid: boolean;
+    errors: string[];
+}
+export declare const validatePasswordAgainstPolicy: (password: string, policy: PasswordPolicy) => PasswordValidationResult;
+export {};