acai-ui-library 0.1.13 → 0.1.14

package/dist/lib/impersonation.cjs

@@ -0,0 +1,127 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/lib/impersonation.ts
+var impersonation_exports = {};
+__export(impersonation_exports, {
+  INACTIVE_IMPERSONATION: () => INACTIVE_IMPERSONATION,
+  OPERATION_CLASSES: () => OPERATION_CLASSES,
+  approvedOpsOf: () => approvedOpsOf,
+  decodeJwtPayload: () => decodeJwtPayload,
+  modeOfOps: () => modeOfOps,
+  readImpersonation: () => readImpersonation,
+  useImpersonation: () => useImpersonation
+});
+module.exports = __toCommonJS(impersonation_exports);
+var React = __toESM(require("react"), 1);
+var OPERATION_CLASSES = ["READ", "WRITE", "DESTRUCTIVE", "FINANCIAL", "SECURITY"];
+var PLATFORM_BLOCKED = /* @__PURE__ */ new Set(["FINANCIAL", "SECURITY"]);
+var INACTIVE_IMPERSONATION = Object.freeze({
+  active: false,
+  mode: null,
+  ops: [],
+  actorSub: null,
+  actorUserType: null,
+  sessionId: null,
+  expiresAt: null
+});
+function base64UrlDecode(segment) {
+  const b64 = segment.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = b64 + "=".repeat((4 - b64.length % 4) % 4);
+  const binary = atob(padded);
+  const bytes = Uint8Array.from(binary, (c) => c.charCodeAt(0));
+  return new TextDecoder().decode(bytes);
+}
+function decodeJwtPayload(token) {
+  if (typeof token !== "string") return null;
+  const parts = token.split(".");
+  if (parts.length !== 3 || !parts[1]) return null;
+  try {
+    const payload = JSON.parse(base64UrlDecode(parts[1]));
+    return payload !== null && typeof payload === "object" && !Array.isArray(payload) ? payload : null;
+  } catch {
+    return null;
+  }
+}
+var nonEmpty = (v) => typeof v === "string" && v.trim() !== "" ? v : null;
+function approvedOpsOf(claims) {
+  let ops;
+  if (Array.isArray(claims.imp_ops)) ops = claims.imp_ops.filter((v) => typeof v === "string");
+  else if (claims.imp_mode === "WRITE") ops = ["READ", "WRITE"];
+  else ops = ["READ"];
+  const set = new Set(ops.filter((op) => !PLATFORM_BLOCKED.has(op)));
+  return OPERATION_CLASSES.filter((c) => set.has(c));
+}
+function modeOfOps(ops) {
+  return ops.every((op) => op === "READ") ? "READ" : "WRITE";
+}
+function readImpersonation(token, now = Date.now()) {
+  const claims = decodeJwtPayload(token);
+  if (!claims) return INACTIVE_IMPERSONATION;
+  const amr = Array.isArray(claims.amr) ? claims.amr : [];
+  if (!amr.includes("impersonation")) return INACTIVE_IMPERSONATION;
+  const act = claims.act !== null && typeof claims.act === "object" ? claims.act : {};
+  const actorSub = nonEmpty(act.sub);
+  const sessionId = nonEmpty(claims.imp_sid);
+  const expiresAt = typeof claims.exp === "number" ? new Date(claims.exp * 1e3) : null;
+  if (!actorSub || !sessionId || !expiresAt || expiresAt.getTime() <= now) return INACTIVE_IMPERSONATION;
+  const ops = approvedOpsOf(claims);
+  return {
+    active: true,
+    mode: modeOfOps(ops),
+    ops,
+    actorSub,
+    actorUserType: nonEmpty(act.userType),
+    sessionId,
+    expiresAt
+  };
+}
+function useImpersonation(token) {
+  const [tick, setTick] = React.useState(0);
+  const state = React.useMemo(() => readImpersonation(token), [token, tick]);
+  const expiresAtMs = state.expiresAt?.getTime() ?? null;
+  React.useEffect(() => {
+    if (expiresAtMs === null) return void 0;
+    const delay = Math.max(0, expiresAtMs - Date.now());
+    const timer = setTimeout(() => setTick((t) => t + 1), Math.min(delay + 50, 2147e6));
+    return () => clearTimeout(timer);
+  }, [expiresAtMs]);
+  return state;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  INACTIVE_IMPERSONATION,
+  OPERATION_CLASSES,
+  approvedOpsOf,
+  decodeJwtPayload,
+  modeOfOps,
+  readImpersonation,
+  useImpersonation
+});
+//# sourceMappingURL=impersonation.cjs.map

package/dist/lib/impersonation.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/lib/impersonation.ts"],"sourcesContent":["import * as React from \"react\"\n\n/**\n * Support impersonation helpers (acai-ai-platform#1274).\n *\n * An impersonation access token is issued by auth-sso-server (#1272) for the target user and carries:\n *   amr: [\"impersonation\"], act: { sub, userType }, imp_sid, imp_ops, imp_mode, exp\n * imp_ops is the set of approved operation classes (READ, WRITE, DESTRUCTIVE). imp_mode is READ when only READ is\n * approved, otherwise WRITE.\n *\n * Everything here decodes the token on the client FOR DISPLAY ONLY. Nothing is verified. Backends enforce the\n * session; never use these values to grant access.\n */\n\nexport const OPERATION_CLASSES = [\"READ\", \"WRITE\", \"DESTRUCTIVE\", \"FINANCIAL\", \"SECURITY\"] as const\nexport type OperationClass = (typeof OPERATION_CLASSES)[number]\nexport type ImpersonationMode = \"READ\" | \"WRITE\"\n\n/** Classes no support session can ever use, whatever a token says. */\nconst PLATFORM_BLOCKED: ReadonlySet<string> = new Set([\"FINANCIAL\", \"SECURITY\"])\n\nexport interface ImpersonationState {\n  /** True only for an unexpired token with amr \"impersonation\", an actor and a session id. */\n  active: boolean\n  /** READ or WRITE; null when not active. */\n  mode: ImpersonationMode | null\n  /** Approved operation classes (never FINANCIAL or SECURITY); empty when not active. */\n  ops: OperationClass[]\n  /** ssoUserId of the support person acting (act.sub). */\n  actorSub: string | null\n  /** SUPER_ADMIN or ACAI_STAFF (act.userType), when the token says. */\n  actorUserType: string | null\n  /** The SSO impersonation session id (imp_sid). */\n  sessionId: string | null\n  /** When the token stops working. */\n  expiresAt: Date | null\n}\n\nexport const INACTIVE_IMPERSONATION: ImpersonationState = Object.freeze({\n  active: false,\n  mode: null,\n  ops: [],\n  actorSub: null,\n  actorUserType: null,\n  sessionId: null,\n  expiresAt: null,\n}) as ImpersonationState\n\nfunction base64UrlDecode(segment: string): string {\n  const b64 = segment.replace(/-/g, \"+\").replace(/_/g, \"/\")\n  const padded = b64 + \"=\".repeat((4 - (b64.length % 4)) % 4)\n  const binary = atob(padded)\n  const bytes = Uint8Array.from(binary, (c) => c.charCodeAt(0))\n  return new TextDecoder().decode(bytes)\n}\n\n/** The JWT payload, or null when the token is not a decodable JWT. Not verified. */\nexport function decodeJwtPayload(token: string | null | undefined): Record<string, unknown> | null {\n  if (typeof token !== \"string\") return null\n  const parts = token.split(\".\")\n  if (parts.length !== 3 || !parts[1]) return null\n  try {\n    const payload = JSON.parse(base64UrlDecode(parts[1])) as unknown\n    return payload !== null && typeof payload === \"object\" && !Array.isArray(payload)\n      ? (payload as Record<string, unknown>)\n      : null\n  } catch {\n    return null\n  }\n}\n\nconst nonEmpty = (v: unknown): string | null => (typeof v === \"string\" && v.trim() !== \"\" ? v : null)\n\n/** Approved classes, read the same way the backends do: imp_ops, else imp_mode WRITE = READ+WRITE, else READ. */\nexport function approvedOpsOf(claims: Record<string, unknown>): OperationClass[] {\n  let ops: string[]\n  if (Array.isArray(claims.imp_ops)) ops = claims.imp_ops.filter((v): v is string => typeof v === \"string\")\n  else if (claims.imp_mode === \"WRITE\") ops = [\"READ\", \"WRITE\"]\n  else ops = [\"READ\"]\n  const set = new Set(ops.filter((op) => !PLATFORM_BLOCKED.has(op)))\n  return OPERATION_CLASSES.filter((c) => set.has(c))\n}\n\nexport function modeOfOps(ops: readonly string[]): ImpersonationMode {\n  return ops.every((op) => op === \"READ\") ? \"READ\" : \"WRITE\"\n}\n\n/** Decode an access token's impersonation state. For display only: the token is not verified. */\nexport function readImpersonation(token: string | null | undefined, now: number = Date.now()): ImpersonationState {\n  const claims = decodeJwtPayload(token)\n  if (!claims) return INACTIVE_IMPERSONATION\n  const amr = Array.isArray(claims.amr) ? claims.amr : []\n  if (!amr.includes(\"impersonation\")) return INACTIVE_IMPERSONATION\n  const act = claims.act !== null && typeof claims.act === \"object\" ? (claims.act as Record<string, unknown>) : {}\n  const actorSub = nonEmpty(act.sub)\n  const sessionId = nonEmpty(claims.imp_sid)\n  const expiresAt = typeof claims.exp === \"number\" ? new Date(claims.exp * 1000) : null\n  if (!actorSub || !sessionId || !expiresAt || expiresAt.getTime() <= now) return INACTIVE_IMPERSONATION\n  const ops = approvedOpsOf(claims)\n  return {\n    active: true,\n    mode: modeOfOps(ops),\n    ops,\n    actorSub,\n    actorUserType: nonEmpty(act.userType),\n    sessionId,\n    expiresAt,\n  }\n}\n\n/**\n * `useImpersonation(token)`: the impersonation state of an access token, for display (banner, disabled controls).\n * Re-renders when the token expires, so `active` turns false on time. Not a security check.\n */\nexport function useImpersonation(token: string | null | undefined): ImpersonationState {\n  // Bumped when the token expires; the state is always computed against the current clock.\n  const [tick, setTick] = React.useState(0)\n  // eslint-disable-next-line react-hooks/exhaustive-deps\n  const state = React.useMemo(() => readImpersonation(token), [token, tick])\n  const expiresAtMs = state.expiresAt?.getTime() ?? null\n\n  React.useEffect(() => {\n    if (expiresAtMs === null) return undefined\n    const delay = Math.max(0, expiresAtMs - Date.now())\n    // setTimeout caps at about 24.8 days; impersonation tokens live at most an hour.\n    const timer = setTimeout(() => setTick((t) => t + 1), Math.min(delay + 50, 2_147_000_000))\n    return () => clearTimeout(timer)\n  }, [expiresAtMs])\n\n  return state\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAAuB;AAchB,IAAM,oBAAoB,CAAC,QAAQ,SAAS,eAAe,aAAa,UAAU;AAKzF,IAAM,mBAAwC,oBAAI,IAAI,CAAC,aAAa,UAAU,CAAC;AAmBxE,IAAM,yBAA6C,OAAO,OAAO;AAAA,EACtE,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,KAAK,CAAC;AAAA,EACN,UAAU;AAAA,EACV,eAAe;AAAA,EACf,WAAW;AAAA,EACX,WAAW;AACb,CAAC;AAED,SAAS,gBAAgB,SAAyB;AAChD,QAAM,MAAM,QAAQ,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACxD,QAAM,SAAS,MAAM,IAAI,QAAQ,IAAK,IAAI,SAAS,KAAM,CAAC;AAC1D,QAAM,SAAS,KAAK,MAAM;AAC1B,QAAM,QAAQ,WAAW,KAAK,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAC5D,SAAO,IAAI,YAAY,EAAE,OAAO,KAAK;AACvC;AAGO,SAAS,iBAAiB,OAAkE;AACjG,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,MAAI,MAAM,WAAW,KAAK,CAAC,MAAM,CAAC,EAAG,QAAO;AAC5C,MAAI;AACF,UAAM,UAAU,KAAK,MAAM,gBAAgB,MAAM,CAAC,CAAC,CAAC;AACpD,WAAO,YAAY,QAAQ,OAAO,YAAY,YAAY,CAAC,MAAM,QAAQ,OAAO,IAC3E,UACD;AAAA,EACN,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,IAAM,WAAW,CAAC,MAA+B,OAAO,MAAM,YAAY,EAAE,KAAK,MAAM,KAAK,IAAI;AAGzF,SAAS,cAAc,QAAmD;AAC/E,MAAI;AACJ,MAAI,MAAM,QAAQ,OAAO,OAAO,EAAG,OAAM,OAAO,QAAQ,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ;AAAA,WAC/F,OAAO,aAAa,QAAS,OAAM,CAAC,QAAQ,OAAO;AAAA,MACvD,OAAM,CAAC,MAAM;AAClB,QAAM,MAAM,IAAI,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;AACjE,SAAO,kBAAkB,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;AACnD;AAEO,SAAS,UAAU,KAA2C;AACnE,SAAO,IAAI,MAAM,CAAC,OAAO,OAAO,MAAM,IAAI,SAAS;AACrD;AAGO,SAAS,kBAAkB,OAAkC,MAAc,KAAK,IAAI,GAAuB;AAChH,QAAM,SAAS,iBAAiB,KAAK;AACrC,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,MAAM,MAAM,QAAQ,OAAO,GAAG,IAAI,OAAO,MAAM,CAAC;AACtD,MAAI,CAAC,IAAI,SAAS,eAAe,EAAG,QAAO;AAC3C,QAAM,MAAM,OAAO,QAAQ,QAAQ,OAAO,OAAO,QAAQ,WAAY,OAAO,MAAkC,CAAC;AAC/G,QAAM,WAAW,SAAS,IAAI,GAAG;AACjC,QAAM,YAAY,SAAS,OAAO,OAAO;AACzC,QAAM,YAAY,OAAO,OAAO,QAAQ,WAAW,IAAI,KAAK,OAAO,MAAM,GAAI,IAAI;AACjF,MAAI,CAAC,YAAY,CAAC,aAAa,CAAC,aAAa,UAAU,QAAQ,KAAK,IAAK,QAAO;AAChF,QAAM,MAAM,cAAc,MAAM;AAChC,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,MAAM,UAAU,GAAG;AAAA,IACnB;AAAA,IACA;AAAA,IACA,eAAe,SAAS,IAAI,QAAQ;AAAA,IACpC;AAAA,IACA;AAAA,EACF;AACF;AAMO,SAAS,iBAAiB,OAAsD;AAErF,QAAM,CAAC,MAAM,OAAO,IAAU,eAAS,CAAC;AAExC,QAAM,QAAc,cAAQ,MAAM,kBAAkB,KAAK,GAAG,CAAC,OAAO,IAAI,CAAC;AACzE,QAAM,cAAc,MAAM,WAAW,QAAQ,KAAK;AAElD,EAAM,gBAAU,MAAM;AACpB,QAAI,gBAAgB,KAAM,QAAO;AACjC,UAAM,QAAQ,KAAK,IAAI,GAAG,cAAc,KAAK,IAAI,CAAC;AAElD,UAAM,QAAQ,WAAW,MAAM,QAAQ,CAAC,MAAM,IAAI,CAAC,GAAG,KAAK,IAAI,QAAQ,IAAI,MAAa,CAAC;AACzF,WAAO,MAAM,aAAa,KAAK;AAAA,EACjC,GAAG,CAAC,WAAW,CAAC;AAEhB,SAAO;AACT;","names":[]}

package/dist/lib/impersonation.d.cts

@@ -0,0 +1,45 @@
+/**
+ * Support impersonation helpers (acai-ai-platform#1274).
+ *
+ * An impersonation access token is issued by auth-sso-server (#1272) for the target user and carries:
+ *   amr: ["impersonation"], act: { sub, userType }, imp_sid, imp_ops, imp_mode, exp
+ * imp_ops is the set of approved operation classes (READ, WRITE, DESTRUCTIVE). imp_mode is READ when only READ is
+ * approved, otherwise WRITE.
+ *
+ * Everything here decodes the token on the client FOR DISPLAY ONLY. Nothing is verified. Backends enforce the
+ * session; never use these values to grant access.
+ */
+declare const OPERATION_CLASSES: readonly ["READ", "WRITE", "DESTRUCTIVE", "FINANCIAL", "SECURITY"];
+type OperationClass = (typeof OPERATION_CLASSES)[number];
+type ImpersonationMode = "READ" | "WRITE";
+interface ImpersonationState {
+    /** True only for an unexpired token with amr "impersonation", an actor and a session id. */
+    active: boolean;
+    /** READ or WRITE; null when not active. */
+    mode: ImpersonationMode | null;
+    /** Approved operation classes (never FINANCIAL or SECURITY); empty when not active. */
+    ops: OperationClass[];
+    /** ssoUserId of the support person acting (act.sub). */
+    actorSub: string | null;
+    /** SUPER_ADMIN or ACAI_STAFF (act.userType), when the token says. */
+    actorUserType: string | null;
+    /** The SSO impersonation session id (imp_sid). */
+    sessionId: string | null;
+    /** When the token stops working. */
+    expiresAt: Date | null;
+}
+declare const INACTIVE_IMPERSONATION: ImpersonationState;
+/** The JWT payload, or null when the token is not a decodable JWT. Not verified. */
+declare function decodeJwtPayload(token: string | null | undefined): Record<string, unknown> | null;
+/** Approved classes, read the same way the backends do: imp_ops, else imp_mode WRITE = READ+WRITE, else READ. */
+declare function approvedOpsOf(claims: Record<string, unknown>): OperationClass[];
+declare function modeOfOps(ops: readonly string[]): ImpersonationMode;
+/** Decode an access token's impersonation state. For display only: the token is not verified. */
+declare function readImpersonation(token: string | null | undefined, now?: number): ImpersonationState;
+/**
+ * `useImpersonation(token)`: the impersonation state of an access token, for display (banner, disabled controls).
+ * Re-renders when the token expires, so `active` turns false on time. Not a security check.
+ */
+declare function useImpersonation(token: string | null | undefined): ImpersonationState;
+
+export { INACTIVE_IMPERSONATION, type ImpersonationMode, type ImpersonationState, OPERATION_CLASSES, type OperationClass, approvedOpsOf, decodeJwtPayload, modeOfOps, readImpersonation, useImpersonation };

package/dist/lib/impersonation.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Support impersonation helpers (acai-ai-platform#1274).
+ *
+ * An impersonation access token is issued by auth-sso-server (#1272) for the target user and carries:
+ *   amr: ["impersonation"], act: { sub, userType }, imp_sid, imp_ops, imp_mode, exp
+ * imp_ops is the set of approved operation classes (READ, WRITE, DESTRUCTIVE). imp_mode is READ when only READ is
+ * approved, otherwise WRITE.
+ *
+ * Everything here decodes the token on the client FOR DISPLAY ONLY. Nothing is verified. Backends enforce the
+ * session; never use these values to grant access.
+ */
+declare const OPERATION_CLASSES: readonly ["READ", "WRITE", "DESTRUCTIVE", "FINANCIAL", "SECURITY"];
+type OperationClass = (typeof OPERATION_CLASSES)[number];
+type ImpersonationMode = "READ" | "WRITE";
+interface ImpersonationState {
+    /** True only for an unexpired token with amr "impersonation", an actor and a session id. */
+    active: boolean;
+    /** READ or WRITE; null when not active. */
+    mode: ImpersonationMode | null;
+    /** Approved operation classes (never FINANCIAL or SECURITY); empty when not active. */
+    ops: OperationClass[];
+    /** ssoUserId of the support person acting (act.sub). */
+    actorSub: string | null;
+    /** SUPER_ADMIN or ACAI_STAFF (act.userType), when the token says. */
+    actorUserType: string | null;
+    /** The SSO impersonation session id (imp_sid). */
+    sessionId: string | null;
+    /** When the token stops working. */
+    expiresAt: Date | null;
+}
+declare const INACTIVE_IMPERSONATION: ImpersonationState;
+/** The JWT payload, or null when the token is not a decodable JWT. Not verified. */
+declare function decodeJwtPayload(token: string | null | undefined): Record<string, unknown> | null;
+/** Approved classes, read the same way the backends do: imp_ops, else imp_mode WRITE = READ+WRITE, else READ. */
+declare function approvedOpsOf(claims: Record<string, unknown>): OperationClass[];
+declare function modeOfOps(ops: readonly string[]): ImpersonationMode;
+/** Decode an access token's impersonation state. For display only: the token is not verified. */
+declare function readImpersonation(token: string | null | undefined, now?: number): ImpersonationState;
+/**
+ * `useImpersonation(token)`: the impersonation state of an access token, for display (banner, disabled controls).
+ * Re-renders when the token expires, so `active` turns false on time. Not a security check.
+ */
+declare function useImpersonation(token: string | null | undefined): ImpersonationState;
+
+export { INACTIVE_IMPERSONATION, type ImpersonationMode, type ImpersonationState, OPERATION_CLASSES, type OperationClass, approvedOpsOf, decodeJwtPayload, modeOfOps, readImpersonation, useImpersonation };

package/dist/lib/impersonation.js

@@ -0,0 +1,86 @@
+// src/lib/impersonation.ts
+import * as React from "react";
+var OPERATION_CLASSES = ["READ", "WRITE", "DESTRUCTIVE", "FINANCIAL", "SECURITY"];
+var PLATFORM_BLOCKED = /* @__PURE__ */ new Set(["FINANCIAL", "SECURITY"]);
+var INACTIVE_IMPERSONATION = Object.freeze({
+  active: false,
+  mode: null,
+  ops: [],
+  actorSub: null,
+  actorUserType: null,
+  sessionId: null,
+  expiresAt: null
+});
+function base64UrlDecode(segment) {
+  const b64 = segment.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = b64 + "=".repeat((4 - b64.length % 4) % 4);
+  const binary = atob(padded);
+  const bytes = Uint8Array.from(binary, (c) => c.charCodeAt(0));
+  return new TextDecoder().decode(bytes);
+}
+function decodeJwtPayload(token) {
+  if (typeof token !== "string") return null;
+  const parts = token.split(".");
+  if (parts.length !== 3 || !parts[1]) return null;
+  try {
+    const payload = JSON.parse(base64UrlDecode(parts[1]));
+    return payload !== null && typeof payload === "object" && !Array.isArray(payload) ? payload : null;
+  } catch {
+    return null;
+  }
+}
+var nonEmpty = (v) => typeof v === "string" && v.trim() !== "" ? v : null;
+function approvedOpsOf(claims) {
+  let ops;
+  if (Array.isArray(claims.imp_ops)) ops = claims.imp_ops.filter((v) => typeof v === "string");
+  else if (claims.imp_mode === "WRITE") ops = ["READ", "WRITE"];
+  else ops = ["READ"];
+  const set = new Set(ops.filter((op) => !PLATFORM_BLOCKED.has(op)));
+  return OPERATION_CLASSES.filter((c) => set.has(c));
+}
+function modeOfOps(ops) {
+  return ops.every((op) => op === "READ") ? "READ" : "WRITE";
+}
+function readImpersonation(token, now = Date.now()) {
+  const claims = decodeJwtPayload(token);
+  if (!claims) return INACTIVE_IMPERSONATION;
+  const amr = Array.isArray(claims.amr) ? claims.amr : [];
+  if (!amr.includes("impersonation")) return INACTIVE_IMPERSONATION;
+  const act = claims.act !== null && typeof claims.act === "object" ? claims.act : {};
+  const actorSub = nonEmpty(act.sub);
+  const sessionId = nonEmpty(claims.imp_sid);
+  const expiresAt = typeof claims.exp === "number" ? new Date(claims.exp * 1e3) : null;
+  if (!actorSub || !sessionId || !expiresAt || expiresAt.getTime() <= now) return INACTIVE_IMPERSONATION;
+  const ops = approvedOpsOf(claims);
+  return {
+    active: true,
+    mode: modeOfOps(ops),
+    ops,
+    actorSub,
+    actorUserType: nonEmpty(act.userType),
+    sessionId,
+    expiresAt
+  };
+}
+function useImpersonation(token) {
+  const [tick, setTick] = React.useState(0);
+  const state = React.useMemo(() => readImpersonation(token), [token, tick]);
+  const expiresAtMs = state.expiresAt?.getTime() ?? null;
+  React.useEffect(() => {
+    if (expiresAtMs === null) return void 0;
+    const delay = Math.max(0, expiresAtMs - Date.now());
+    const timer = setTimeout(() => setTick((t) => t + 1), Math.min(delay + 50, 2147e6));
+    return () => clearTimeout(timer);
+  }, [expiresAtMs]);
+  return state;
+}
+export {
+  INACTIVE_IMPERSONATION,
+  OPERATION_CLASSES,
+  approvedOpsOf,
+  decodeJwtPayload,
+  modeOfOps,
+  readImpersonation,
+  useImpersonation
+};
+//# sourceMappingURL=impersonation.js.map

package/dist/lib/impersonation.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/lib/impersonation.ts"],"sourcesContent":["import * as React from \"react\"\n\n/**\n * Support impersonation helpers (acai-ai-platform#1274).\n *\n * An impersonation access token is issued by auth-sso-server (#1272) for the target user and carries:\n *   amr: [\"impersonation\"], act: { sub, userType }, imp_sid, imp_ops, imp_mode, exp\n * imp_ops is the set of approved operation classes (READ, WRITE, DESTRUCTIVE). imp_mode is READ when only READ is\n * approved, otherwise WRITE.\n *\n * Everything here decodes the token on the client FOR DISPLAY ONLY. Nothing is verified. Backends enforce the\n * session; never use these values to grant access.\n */\n\nexport const OPERATION_CLASSES = [\"READ\", \"WRITE\", \"DESTRUCTIVE\", \"FINANCIAL\", \"SECURITY\"] as const\nexport type OperationClass = (typeof OPERATION_CLASSES)[number]\nexport type ImpersonationMode = \"READ\" | \"WRITE\"\n\n/** Classes no support session can ever use, whatever a token says. */\nconst PLATFORM_BLOCKED: ReadonlySet<string> = new Set([\"FINANCIAL\", \"SECURITY\"])\n\nexport interface ImpersonationState {\n  /** True only for an unexpired token with amr \"impersonation\", an actor and a session id. */\n  active: boolean\n  /** READ or WRITE; null when not active. */\n  mode: ImpersonationMode | null\n  /** Approved operation classes (never FINANCIAL or SECURITY); empty when not active. */\n  ops: OperationClass[]\n  /** ssoUserId of the support person acting (act.sub). */\n  actorSub: string | null\n  /** SUPER_ADMIN or ACAI_STAFF (act.userType), when the token says. */\n  actorUserType: string | null\n  /** The SSO impersonation session id (imp_sid). */\n  sessionId: string | null\n  /** When the token stops working. */\n  expiresAt: Date | null\n}\n\nexport const INACTIVE_IMPERSONATION: ImpersonationState = Object.freeze({\n  active: false,\n  mode: null,\n  ops: [],\n  actorSub: null,\n  actorUserType: null,\n  sessionId: null,\n  expiresAt: null,\n}) as ImpersonationState\n\nfunction base64UrlDecode(segment: string): string {\n  const b64 = segment.replace(/-/g, \"+\").replace(/_/g, \"/\")\n  const padded = b64 + \"=\".repeat((4 - (b64.length % 4)) % 4)\n  const binary = atob(padded)\n  const bytes = Uint8Array.from(binary, (c) => c.charCodeAt(0))\n  return new TextDecoder().decode(bytes)\n}\n\n/** The JWT payload, or null when the token is not a decodable JWT. Not verified. */\nexport function decodeJwtPayload(token: string | null | undefined): Record<string, unknown> | null {\n  if (typeof token !== \"string\") return null\n  const parts = token.split(\".\")\n  if (parts.length !== 3 || !parts[1]) return null\n  try {\n    const payload = JSON.parse(base64UrlDecode(parts[1])) as unknown\n    return payload !== null && typeof payload === \"object\" && !Array.isArray(payload)\n      ? (payload as Record<string, unknown>)\n      : null\n  } catch {\n    return null\n  }\n}\n\nconst nonEmpty = (v: unknown): string | null => (typeof v === \"string\" && v.trim() !== \"\" ? v : null)\n\n/** Approved classes, read the same way the backends do: imp_ops, else imp_mode WRITE = READ+WRITE, else READ. */\nexport function approvedOpsOf(claims: Record<string, unknown>): OperationClass[] {\n  let ops: string[]\n  if (Array.isArray(claims.imp_ops)) ops = claims.imp_ops.filter((v): v is string => typeof v === \"string\")\n  else if (claims.imp_mode === \"WRITE\") ops = [\"READ\", \"WRITE\"]\n  else ops = [\"READ\"]\n  const set = new Set(ops.filter((op) => !PLATFORM_BLOCKED.has(op)))\n  return OPERATION_CLASSES.filter((c) => set.has(c))\n}\n\nexport function modeOfOps(ops: readonly string[]): ImpersonationMode {\n  return ops.every((op) => op === \"READ\") ? \"READ\" : \"WRITE\"\n}\n\n/** Decode an access token's impersonation state. For display only: the token is not verified. */\nexport function readImpersonation(token: string | null | undefined, now: number = Date.now()): ImpersonationState {\n  const claims = decodeJwtPayload(token)\n  if (!claims) return INACTIVE_IMPERSONATION\n  const amr = Array.isArray(claims.amr) ? claims.amr : []\n  if (!amr.includes(\"impersonation\")) return INACTIVE_IMPERSONATION\n  const act = claims.act !== null && typeof claims.act === \"object\" ? (claims.act as Record<string, unknown>) : {}\n  const actorSub = nonEmpty(act.sub)\n  const sessionId = nonEmpty(claims.imp_sid)\n  const expiresAt = typeof claims.exp === \"number\" ? new Date(claims.exp * 1000) : null\n  if (!actorSub || !sessionId || !expiresAt || expiresAt.getTime() <= now) return INACTIVE_IMPERSONATION\n  const ops = approvedOpsOf(claims)\n  return {\n    active: true,\n    mode: modeOfOps(ops),\n    ops,\n    actorSub,\n    actorUserType: nonEmpty(act.userType),\n    sessionId,\n    expiresAt,\n  }\n}\n\n/**\n * `useImpersonation(token)`: the impersonation state of an access token, for display (banner, disabled controls).\n * Re-renders when the token expires, so `active` turns false on time. Not a security check.\n */\nexport function useImpersonation(token: string | null | undefined): ImpersonationState {\n  // Bumped when the token expires; the state is always computed against the current clock.\n  const [tick, setTick] = React.useState(0)\n  // eslint-disable-next-line react-hooks/exhaustive-deps\n  const state = React.useMemo(() => readImpersonation(token), [token, tick])\n  const expiresAtMs = state.expiresAt?.getTime() ?? null\n\n  React.useEffect(() => {\n    if (expiresAtMs === null) return undefined\n    const delay = Math.max(0, expiresAtMs - Date.now())\n    // setTimeout caps at about 24.8 days; impersonation tokens live at most an hour.\n    const timer = setTimeout(() => setTick((t) => t + 1), Math.min(delay + 50, 2_147_000_000))\n    return () => clearTimeout(timer)\n  }, [expiresAtMs])\n\n  return state\n}\n"],"mappings":";AAAA,YAAY,WAAW;AAchB,IAAM,oBAAoB,CAAC,QAAQ,SAAS,eAAe,aAAa,UAAU;AAKzF,IAAM,mBAAwC,oBAAI,IAAI,CAAC,aAAa,UAAU,CAAC;AAmBxE,IAAM,yBAA6C,OAAO,OAAO;AAAA,EACtE,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,KAAK,CAAC;AAAA,EACN,UAAU;AAAA,EACV,eAAe;AAAA,EACf,WAAW;AAAA,EACX,WAAW;AACb,CAAC;AAED,SAAS,gBAAgB,SAAyB;AAChD,QAAM,MAAM,QAAQ,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACxD,QAAM,SAAS,MAAM,IAAI,QAAQ,IAAK,IAAI,SAAS,KAAM,CAAC;AAC1D,QAAM,SAAS,KAAK,MAAM;AAC1B,QAAM,QAAQ,WAAW,KAAK,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;AAC5D,SAAO,IAAI,YAAY,EAAE,OAAO,KAAK;AACvC;AAGO,SAAS,iBAAiB,OAAkE;AACjG,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,MAAI,MAAM,WAAW,KAAK,CAAC,MAAM,CAAC,EAAG,QAAO;AAC5C,MAAI;AACF,UAAM,UAAU,KAAK,MAAM,gBAAgB,MAAM,CAAC,CAAC,CAAC;AACpD,WAAO,YAAY,QAAQ,OAAO,YAAY,YAAY,CAAC,MAAM,QAAQ,OAAO,IAC3E,UACD;AAAA,EACN,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,IAAM,WAAW,CAAC,MAA+B,OAAO,MAAM,YAAY,EAAE,KAAK,MAAM,KAAK,IAAI;AAGzF,SAAS,cAAc,QAAmD;AAC/E,MAAI;AACJ,MAAI,MAAM,QAAQ,OAAO,OAAO,EAAG,OAAM,OAAO,QAAQ,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ;AAAA,WAC/F,OAAO,aAAa,QAAS,OAAM,CAAC,QAAQ,OAAO;AAAA,MACvD,OAAM,CAAC,MAAM;AAClB,QAAM,MAAM,IAAI,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;AACjE,SAAO,kBAAkB,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;AACnD;AAEO,SAAS,UAAU,KAA2C;AACnE,SAAO,IAAI,MAAM,CAAC,OAAO,OAAO,MAAM,IAAI,SAAS;AACrD;AAGO,SAAS,kBAAkB,OAAkC,MAAc,KAAK,IAAI,GAAuB;AAChH,QAAM,SAAS,iBAAiB,KAAK;AACrC,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,MAAM,MAAM,QAAQ,OAAO,GAAG,IAAI,OAAO,MAAM,CAAC;AACtD,MAAI,CAAC,IAAI,SAAS,eAAe,EAAG,QAAO;AAC3C,QAAM,MAAM,OAAO,QAAQ,QAAQ,OAAO,OAAO,QAAQ,WAAY,OAAO,MAAkC,CAAC;AAC/G,QAAM,WAAW,SAAS,IAAI,GAAG;AACjC,QAAM,YAAY,SAAS,OAAO,OAAO;AACzC,QAAM,YAAY,OAAO,OAAO,QAAQ,WAAW,IAAI,KAAK,OAAO,MAAM,GAAI,IAAI;AACjF,MAAI,CAAC,YAAY,CAAC,aAAa,CAAC,aAAa,UAAU,QAAQ,KAAK,IAAK,QAAO;AAChF,QAAM,MAAM,cAAc,MAAM;AAChC,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,MAAM,UAAU,GAAG;AAAA,IACnB;AAAA,IACA;AAAA,IACA,eAAe,SAAS,IAAI,QAAQ;AAAA,IACpC;AAAA,IACA;AAAA,EACF;AACF;AAMO,SAAS,iBAAiB,OAAsD;AAErF,QAAM,CAAC,MAAM,OAAO,IAAU,eAAS,CAAC;AAExC,QAAM,QAAc,cAAQ,MAAM,kBAAkB,KAAK,GAAG,CAAC,OAAO,IAAI,CAAC;AACzE,QAAM,cAAc,MAAM,WAAW,QAAQ,KAAK;AAElD,EAAM,gBAAU,MAAM;AACpB,QAAI,gBAAgB,KAAM,QAAO;AACjC,UAAM,QAAQ,KAAK,IAAI,GAAG,cAAc,KAAK,IAAI,CAAC;AAElD,UAAM,QAAQ,WAAW,MAAM,QAAQ,CAAC,MAAM,IAAI,CAAC,GAAG,KAAK,IAAI,QAAQ,IAAI,MAAa,CAAC;AACzF,WAAO,MAAM,aAAa,KAAK;AAAA,EACjC,GAAG,CAAC,WAAW,CAAC;AAEhB,SAAO;AACT;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "acai-ui-library",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "description": "A production-ready, fully-branded React component library.",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",