ankka-console 0.10.0

package/dist/context.js

@@ -0,0 +1,156 @@
+/**
+ * What every package route receives about the request it is serving: a control plane client that
+ * acts as the signed-in person, where the package is mounted, and how to send someone to sign in.
+ */
+import { createContext, data, redirect } from "react-router";
+import { ControlPlaneClient } from "./client/control-plane.js";
+import { ControlPlaneError, ControlPlaneUnreachable, SignInRequired } from "./client/errors.js";
+import { IdentityProviderUnavailable } from "./auth/oidc.js";
+export const consoleContext = createContext();
+/** The context the console's middleware put on this request; a clear error if the host did not install it. */
+export function useConsoleContext(context) {
+    try {
+        return context.get(consoleContext);
+    }
+    catch {
+        throw new Error("the console's middleware is not installed: add consoleMiddleware(options) to the root route's `middleware`");
+    }
+}
+function decodeClaims(token) {
+    try {
+        return JSON.parse(Buffer.from(token.split(".")[1], "base64url").toString("utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+export function principalOf(token) {
+    if (!token)
+        return null;
+    const claims = decodeClaims(token);
+    if (!claims || typeof claims.sub !== "string")
+        return null;
+    const roles = claims.realm_access?.roles ?? [];
+    return {
+        subject: claims.sub,
+        name: typeof claims.name === "string" ? claims.name : undefined,
+        email: typeof claims.email === "string" ? claims.email : undefined,
+        platformAdmin: roles.includes("platform-admin"),
+    };
+}
+/** Only a path within the console is ever returned to after sign-in; anything else lands on the front page. */
+export function safeReturnTo(runtime, value) {
+    if (!value || !value.startsWith(runtime.mount) || value.startsWith("//") || value.includes("\\"))
+        return runtime.mount;
+    try {
+        const url = new URL(value, "http://console.invalid");
+        if (url.origin !== "http://console.invalid")
+            return runtime.mount;
+        return url.pathname + url.search;
+    }
+    catch {
+        return runtime.mount;
+    }
+}
+export function createConsoleContext(runtime, request) {
+    const headers = new Headers();
+    let token;
+    let known = null;
+    const accessToken = (refresh = false) => {
+        if (refresh || !token) {
+            token = runtime.tokens.accessToken(request, headers, { refresh });
+            token.then((t) => (known = t)).catch(() => undefined);
+        }
+        return token;
+    };
+    const href = (path = "") => runtime.mount + path.replace(/^\/+/, "");
+    return {
+        runtime,
+        request,
+        headers,
+        mount: runtime.mount,
+        extensions: runtime.options.extensions ?? {},
+        client: new ControlPlaneClient({
+            baseUrl: runtime.options.controlPlane.url,
+            transport: runtime.controlPlaneFetch,
+            bearer: ({ refresh }) => accessToken(refresh),
+        }),
+        href,
+        signInUrl(returnTo) {
+            const url = new URL(request.url);
+            const back = returnTo ?? url.pathname.replace(/\.data$/, "") + url.search;
+            return `${href("auth/sign-in")}?returnTo=${encodeURIComponent(back)}`;
+        },
+        accessToken: () => accessToken(false),
+        async principal() {
+            return principalOf(await accessToken(false));
+        },
+        knownPrincipal: () => principalOf(known),
+    };
+}
+/**
+ * Runs a loader's or action's work, turning what the person should see into responses: sign in
+ * again, access lost, a refusal, something unavailable. Anything else is a bug and propagates.
+ */
+export async function guard(ctx, work) {
+    try {
+        return await work();
+    }
+    catch (e) {
+        throw failureResponse(ctx, e);
+    }
+}
+export function failureResponse(ctx, e) {
+    // The middleware adds any changed session to the redirect, as to every response.
+    if (e instanceof SignInRequired)
+        return redirect(ctx.signInUrl());
+    if (e instanceof IdentityProviderUnavailable) {
+        return data({ kind: "unavailable", what: "identity provider", reason: e.message }, { status: 503, headers: { "retry-after": "5" } });
+    }
+    if (e instanceof ControlPlaneUnreachable) {
+        return data({ kind: "unavailable", what: "control plane", reason: e.message }, { status: 503, headers: { "retry-after": "5" } });
+    }
+    if (e instanceof ControlPlaneError) {
+        if (e.status === 404)
+            return data({ kind: "lost", reason: e.reason }, { status: 404 });
+        if (e.retryable)
+            return data({ kind: "unavailable", what: "control plane", reason: e.reason }, { status: e.status });
+        return data({ kind: "refused", status: e.status, reason: e.reason }, { status: e.status });
+    }
+    return e;
+}
+/**
+ * Runs an action's work. A refusal the person can act on — a `400`, `403` or `409` — comes back as
+ * data for the page, with the form's values, so the form is shown again with the reason beside it.
+ * Everything else is what `guard` makes of it.
+ */
+export async function act(ctx, intent, form, work) {
+    try {
+        return await work();
+    }
+    catch (e) {
+        if (e instanceof ControlPlaneError && (e.status === 400 || e.status === 403 || e.status === 409)) {
+            const values = {};
+            for (const [k, v] of form.entries())
+                if (typeof v === "string" && k !== "password")
+                    values[k] = v;
+            return data({ intent, status: e.status, reason: e.reason, problems: e.problems, values }, { status: e.status });
+        }
+        throw failureResponse(ctx, e);
+    }
+}
+export const text = (form, name) => {
+    const v = form.get(name);
+    return typeof v === "string" ? v.trim() : "";
+};
+/**
+ * The page data every package page returns. It is also what makes a page require a session: nobody
+ * signed in is `SignInRequired`, which `guard` turns into the trip to sign in, even for a page whose
+ * loader asks the control plane nothing.
+ */
+export async function pageData(ctx) {
+    const principal = await ctx.principal();
+    if (!principal)
+        throw new SignInRequired();
+    return { mount: ctx.mount, principal, hidden: ctx.extensions.hidden ?? [] };
+}

package/dist/extensions/render.d.ts

@@ -0,0 +1,20 @@
+import type { ConsoleContext } from "../context.ts";
+import type { Operation, PanelEntities, PanelKind } from "./types.ts";
+export type LoadedPanels = Record<string, {
+    ok: true;
+    data: unknown;
+} | {
+    ok: false;
+    error: string;
+}>;
+/** Runs every registered panel's `load` for this entity; used by the package's own loaders. */
+export declare function loadPanels<K extends PanelKind>(ctx: ConsoleContext, kind: K, entity: PanelEntities[K]): Promise<LoadedPanels>;
+export declare function Panels<K extends PanelKind>({ kind, entity, loaded }: {
+    kind: K;
+    entity: PanelEntities[K];
+    loaded?: LoadedPanels;
+}): import("react").JSX.Element | null;
+export declare function HostActions({ operation, entity }: {
+    operation: Operation;
+    entity?: unknown;
+}): import("react").JSX.Element;

package/dist/extensions/render.js

@@ -0,0 +1,49 @@
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * Where a host's extensions appear. Panels are loaded on the server with the page (a failure is
+ * that panel's, not the page's) and rendered inside their own error boundary; actions sit beside the
+ * operation they were declared for.
+ */
+import { Component } from "react";
+import { useConsole } from "../ui/console.js";
+/** Runs every registered panel's `load` for this entity; used by the package's own loaders. */
+export async function loadPanels(ctx, kind, entity) {
+    const panels = (ctx.extensions.panels?.[kind] ?? []);
+    const settled = await Promise.allSettled(panels.map((p) => (p.load ? p.load({ request: ctx.request, accessToken: () => ctx.accessToken() }, entity) : Promise.resolve(undefined))));
+    const out = {};
+    panels.forEach((p, i) => {
+        const r = settled[i];
+        out[p.id] = r.status === "fulfilled" ? { ok: true, data: r.value } : { ok: false, error: r.reason instanceof Error ? r.reason.message : String(r.reason) };
+    });
+    return out;
+}
+class PanelBoundary extends Component {
+    state = { error: null };
+    static getDerivedStateFromError(error) {
+        return { error: error instanceof Error ? error.message : String(error) };
+    }
+    componentDidCatch(_error, _info) {
+        // Contained: the page around the panel keeps working.
+    }
+    render() {
+        if (this.state.error !== null) {
+            return _jsxs("p", { className: "ac-panel-failed", children: [this.props.title, " could not be shown: ", this.state.error] });
+        }
+        return this.props.children;
+    }
+}
+export function Panels({ kind, entity, loaded }) {
+    const { extensions } = useConsole();
+    const panels = (extensions.panels?.[kind] ?? []);
+    if (panels.length === 0)
+        return null;
+    return (_jsx(_Fragment, { children: panels.map((p) => {
+            const result = loaded?.[p.id];
+            return (_jsxs("section", { className: "ac-panel", "aria-labelledby": `panel-${p.id}`, "data-panel": p.id, children: [_jsx("h2", { id: `panel-${p.id}`, children: p.title }), result && !result.ok ? (_jsxs("p", { className: "ac-panel-failed", children: [p.title, " could not be loaded: ", result.error] })) : (_jsx(PanelBoundary, { title: p.title, children: _jsx(p.Component, { entity: entity, data: result?.ok ? result.data : undefined }) }))] }, p.id));
+        }) }));
+}
+export function HostActions({ operation, entity }) {
+    const { extensions } = useConsole();
+    const actions = extensions.actions?.[operation] ?? [];
+    return (_jsx(_Fragment, { children: actions.map((a) => (_jsx("a", { className: "ac-button ac-button-quiet", href: a.href(entity), "data-action": a.id, children: a.label }, a.id))) }));
+}

package/dist/extensions/types.d.ts

@@ -0,0 +1,44 @@
+import type { ComponentType } from "react";
+import type { OrganizationSummary, ProjectDetail, ServiceStatus } from "../client/schemas.ts";
+/** Every operation the console offers, by the name a host uses to add beside it or hide it. */
+export declare const operations: readonly ["organization.create", "organization.rename", "organization.delete", "organization.disable", "organization.enable", "organization.quota.set", "organization.quota.clear", "member.invite", "member.role", "member.remove", "invitation.withdraw", "member.repair", "token.create", "token.revoke", "project.create", "project.rename", "project.delete", "registry.set", "registry.clear", "service.apply", "service.pause", "service.resume", "service.restart", "service.expose", "service.unexpose", "service.delete", "service.logs"];
+export type Operation = (typeof operations)[number];
+export interface PanelEntities {
+    organization: OrganizationSummary;
+    project: ProjectDetail;
+    service: ServiceStatus;
+}
+export type PanelKind = keyof PanelEntities;
+/** What a panel's `load` receives: the request and a bearer for calls of the host's own. */
+export interface PanelLoadContext {
+    request: Request;
+    accessToken(): Promise<string | null>;
+}
+/**
+ * A section a host adds to an organization's, project's or service's page. `load` runs on the
+ * server with the page's own data; a failure in it, or in `Component`, is shown in the panel's place
+ * and leaves the page intact.
+ */
+export interface Panel<E = unknown> {
+    id: string;
+    title: string;
+    load?: (context: PanelLoadContext, entity: E) => Promise<unknown>;
+    Component: ComponentType<{
+        entity: E;
+        data: unknown;
+    }>;
+}
+/** A control a host adds beside one of the console's operations: a link of the host's own. */
+export interface Action<E = unknown> {
+    id: string;
+    label: string;
+    href: (entity: E | undefined) => string;
+}
+export interface ConsoleExtensions {
+    panels?: {
+        [K in PanelKind]?: Panel<PanelEntities[K]>[];
+    };
+    actions?: Partial<Record<Operation, Action<never>[]>>;
+    /** Operations whose control is not shown. The control plane's own rule still stands if one is posted anyway. */
+    hidden?: Operation[];
+}

package/dist/extensions/types.js

@@ -0,0 +1,30 @@
+/** Every operation the console offers, by the name a host uses to add beside it or hide it. */
+export const operations = [
+    "organization.create",
+    "organization.rename",
+    "organization.delete",
+    "organization.disable",
+    "organization.enable",
+    "organization.quota.set",
+    "organization.quota.clear",
+    "member.invite",
+    "member.role",
+    "member.remove",
+    "invitation.withdraw",
+    "member.repair",
+    "token.create",
+    "token.revoke",
+    "project.create",
+    "project.rename",
+    "project.delete",
+    "registry.set",
+    "registry.clear",
+    "service.apply",
+    "service.pause",
+    "service.resume",
+    "service.restart",
+    "service.expose",
+    "service.unexpose",
+    "service.delete",
+    "service.logs",
+];

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { ConsoleProvider, useConsole, ConsoleLink, ConsoleForm } from "./ui/console.tsx";
+export type { UseConsole } from "./ui/console.tsx";
+export type { Principal } from "./context.ts";
+export { operations } from "./extensions/types.ts";
+export type { Action, ConsoleExtensions, Operation, Panel, PanelKind, PanelLoadContext } from "./extensions/types.ts";

package/dist/index.js

@@ -0,0 +1,5 @@
+// The browser-safe entry point: what a host's layout and its own components use. Everything that
+// runs only on the server — the routes table, the middleware, sessions, the server itself — is
+// `ankka-console/server`, so a host's browser bundle never resolves a Node module.
+export { ConsoleProvider, useConsole, ConsoleLink, ConsoleForm } from "./ui/console.js";
+export { operations } from "./extensions/types.js";

package/dist/middleware.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The console's middleware, installed on the host's root route. It builds the request's context,
+ * refuses a state-changing request from another site, forbids caching of anything a signed-in person
+ * sees, writes back a session that changed while the request was served, and logs one line.
+ */
+import type { MiddlewareFunction } from "react-router";
+import type { ConsoleOptions } from "./options.ts";
+/**
+ * Whether a state-changing request came from the console's own pages. `SameSite=Lax` already keeps
+ * the session cookie off a cross-site POST; this is the second lock, and the one that holds for a
+ * host whose sessions are not cookies.
+ */
+export declare function crossSite(request: Request, publicOrigin: string): boolean;
+export declare function consoleMiddleware(options: ConsoleOptions | (() => ConsoleOptions)): MiddlewareFunction<Response>;

package/dist/middleware.js

@@ -0,0 +1,48 @@
+import { consoleContext, createConsoleContext } from "./context.js";
+import { createRuntime } from "./runtime.js";
+const SAFE = new Set(["GET", "HEAD", "OPTIONS"]);
+/**
+ * Whether a state-changing request came from the console's own pages. `SameSite=Lax` already keeps
+ * the session cookie off a cross-site POST; this is the second lock, and the one that holds for a
+ * host whose sessions are not cookies.
+ */
+export function crossSite(request, publicOrigin) {
+    if (SAFE.has(request.method))
+        return false;
+    if (request.headers.get("sec-fetch-site") === "cross-site")
+        return true;
+    const origin = request.headers.get("origin");
+    if (!origin || origin === "null")
+        return origin === "null";
+    return origin !== new URL(publicOrigin).origin && origin !== new URL(request.url).origin;
+}
+export function consoleMiddleware(options) {
+    let runtime;
+    const get = () => (runtime ??= createRuntime(typeof options === "function" ? options() : options));
+    return async ({ request, context }, next) => {
+        const rt = get();
+        const started = performance.now();
+        const path = new URL(request.url).pathname;
+        if (crossSite(request, rt.options.publicOrigin)) {
+            rt.log({ at: new Date().toISOString(), method: request.method, path, status: 403, reason: "cross-site" });
+            return new Response("cross-site request refused", { status: 403 });
+        }
+        const ctx = createConsoleContext(rt, request);
+        context.set(consoleContext, ctx);
+        const response = await next();
+        for (const cookie of ctx.headers.getSetCookie())
+            response.headers.append("set-cookie", cookie);
+        // Nothing a signed-in person was shown may be kept by any cache, including the browser's back
+        // button after sign-out.
+        response.headers.set("cache-control", "no-store");
+        rt.log({
+            at: new Date().toISOString(),
+            method: request.method,
+            path,
+            status: response.status,
+            durationMs: Math.round(performance.now() - started),
+            subject: ctx.knownPrincipal()?.subject,
+        });
+        return response;
+    };
+}

package/dist/options.d.ts

@@ -0,0 +1,45 @@
+import type { SessionStore } from "./session/cookie-store.ts";
+import type { TokenSource } from "./session/token-source.ts";
+import type { ConsoleExtensions } from "./extensions/types.ts";
+import type { TlsFiles } from "./server/transport.ts";
+/** Everything the console needs from its host. `consoleOptionsFromEnv` builds it from the environment. */
+export interface ConsoleOptions {
+    controlPlane: {
+        url: string;
+        /** The console's certificate, presented to the control plane, and the authority to verify it by. */
+        tls?: TlsFiles;
+    };
+    auth: {
+        clientId: string;
+        clientSecret: string;
+        /** Where server-side calls to the identity provider go when its external name does not resolve here. */
+        backchannelUrl?: string;
+        /** The authority the backchannel is verified by. */
+        ca?: string;
+        /** Permits a plain-HTTP issuer: the development Keycloak. */
+        allowInsecure?: boolean;
+        /** The issuer; read from the control plane's `GET /auth` when absent, so the two cannot disagree. */
+        issuer?: string;
+    };
+    /** The console's own origin as a browser sees it, e.g. `https://console.example.com`. */
+    publicOrigin: string;
+    /** The path the package's routes are mounted under; `/` unless the host prefixed them. */
+    mount?: string;
+    /** Seals the default session store and the one-time values; required unless both are supplied. */
+    sessionSecret?: string;
+    session?: SessionStore;
+    /** A host that signs people in itself supplies this; the package's `/auth` routes are then not mounted. */
+    tokens?: TokenSource;
+    /** Server-side halves of the host's extensions: the panels' `load` functions. */
+    extensions?: ConsoleExtensions;
+    /** One structured line per request. Defaults to stdout. Never given a cookie, header or token. */
+    log?: (line: Record<string, unknown>) => void;
+}
+type Env = Record<string, string | undefined>;
+/**
+ * The options, from the variables the installation's manifests set (see `platform/console.md`).
+ * `ANKKA_CONSOLE_TLS_DIR` is what makes this a cluster console: HTTPS on the public origin, a
+ * `__Host-` cookie, and the certificate in it presented to the control plane.
+ */
+export declare function consoleOptionsFromEnv(env?: Env, extensions?: ConsoleExtensions): ConsoleOptions;
+export {};

package/dist/options.js

@@ -0,0 +1,39 @@
+function required(env, name) {
+    const value = env[name]?.trim();
+    if (!value)
+        throw new Error(`${name} is not set`);
+    return value;
+}
+/**
+ * The options, from the variables the installation's manifests set (see `platform/console.md`).
+ * `ANKKA_CONSOLE_TLS_DIR` is what makes this a cluster console: HTTPS on the public origin, a
+ * `__Host-` cookie, and the certificate in it presented to the control plane.
+ */
+export function consoleOptionsFromEnv(env = process.env, extensions) {
+    const tlsDir = env.ANKKA_CONSOLE_TLS_DIR?.trim();
+    // In a cluster the console's own address is not guessable, and a wrong one is a sign-in the
+    // identity provider refuses to return from; only a laptop's console defaults to localhost.
+    const authority = tlsDir
+        ? required(env, "ANKKA_CONSOLE_AUTHORITY")
+        : env.ANKKA_CONSOLE_AUTHORITY?.trim() || `localhost:${env.ANKKA_CONSOLE_PORT?.trim() || "3000"}`;
+    if (/[A-Z_]{6,}/.test(authority))
+        throw new Error(`ANKKA_CONSOLE_AUTHORITY is '${authority}', an unfilled placeholder`);
+    return {
+        controlPlane: {
+            url: env.ANKKA_CONSOLE_CONTROL_PLANE_URL?.trim() || "http://localhost:9000",
+            tls: tlsDir ? { ca: `${tlsDir}/ca.crt`, cert: `${tlsDir}/tls.crt`, key: `${tlsDir}/tls.key` } : undefined,
+        },
+        auth: {
+            clientId: env.ANKKA_CONSOLE_CLIENT_ID?.trim() || "ankka-console",
+            clientSecret: required(env, "ANKKA_CONSOLE_CLIENT_SECRET"),
+            backchannelUrl: env.ANKKA_CONSOLE_AUTH_BACKCHANNEL_URL?.trim() || undefined,
+            ca: env.ANKKA_CONSOLE_AUTH_CA?.trim() || undefined,
+            allowInsecure: env.ANKKA_CONSOLE_ALLOW_INSECURE_ISSUER === "true",
+            issuer: env.ANKKA_CONSOLE_AUTH_ISSUER?.trim() || undefined,
+        },
+        publicOrigin: `${tlsDir ? "https" : "http"}://${authority}`,
+        mount: env.ANKKA_CONSOLE_MOUNT?.trim() || "/",
+        sessionSecret: required(env, "ANKKA_CONSOLE_SESSION_SECRET"),
+        extensions,
+    };
+}

package/dist/routes/auth.callback.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Finishes a sign-in. The callback is accepted only with the state this browser was given, the
+ * identity token is checked for issuer, audience, nonce, signature and expiry, and only the refresh
+ * token is kept — sealed in a cookie script cannot read.
+ */
+import { type LoaderFunctionArgs, type MetaFunction } from "react-router";
+import { ConsoleErrorBoundary } from "../ui/errors.tsx";
+export declare const meta: MetaFunction;
+export declare function loader({ request, context }: LoaderFunctionArgs): Promise<Response>;
+export default function Callback(): null;
+export declare const ErrorBoundary: typeof ConsoleErrorBoundary;

package/dist/routes/auth.callback.js

@@ -0,0 +1,43 @@
+/**
+ * Finishes a sign-in. The callback is accepted only with the state this browser was given, the
+ * identity token is checked for issuer, audience, nonce, signature and expiry, and only the refresh
+ * token is kept — sealed in a cookie script cannot read.
+ */
+import { data, redirect } from "react-router";
+import { failureResponse, useConsoleContext } from "../context.js";
+import { IdentityProviderUnavailable } from "../auth/oidc.js";
+import { ConsoleErrorBoundary } from "../ui/errors.js";
+export const meta = () => [{ title: "Signing in · ankka" }];
+const startAgain = (reason) => data({ kind: "refused", status: 400, reason }, { status: 400 });
+export async function loader({ request, context }) {
+    const ctx = useConsoleContext(context);
+    const rt = ctx.runtime;
+    if (!rt.issuer || !rt.sessionTokens)
+        throw new Response("This console signs people in elsewhere.", { status: 404 });
+    const pending = await rt.pendingLogin.take(request, ctx.headers);
+    if (!pending)
+        throw startAgain("This sign-in was not started here, or took longer than ten minutes. Sign in again.");
+    const incoming = new URL(request.url);
+    if (incoming.searchParams.get("error")) {
+        throw startAgain(`The identity provider did not sign you in: ${incoming.searchParams.get("error_description") ?? incoming.searchParams.get("error")}.`);
+    }
+    // The address the identity provider was told to return to, whatever this request's own URL looks
+    // like behind the gateway.
+    const callback = new URL(ctx.href("auth/callback") + incoming.search, rt.options.publicOrigin);
+    try {
+        const issuer = await rt.issuer();
+        const tokens = await issuer.finishSignIn(callback, pending);
+        await rt.store.write({ refreshToken: tokens.refreshToken, issuedAt: Math.floor(Date.now() / 1000) }, ctx.headers);
+        rt.sessionTokens.remember(tokens);
+        return redirect(pending.returnTo);
+    }
+    catch (e) {
+        if (e instanceof IdentityProviderUnavailable)
+            throw failureResponse(ctx, e);
+        throw startAgain("This sign-in could not be completed. Sign in again.");
+    }
+}
+export default function Callback() {
+    return null;
+}
+export const ErrorBoundary = ConsoleErrorBoundary;

package/dist/routes/auth.sign-in.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Starts a sign-in: a PKCE verifier, a state and a nonce sealed into a short-lived cookie, and the
+ * browser sent to the identity provider. The page itself is only ever seen when the identity
+ * provider cannot be reached.
+ */
+import { type LoaderFunctionArgs, type MetaFunction } from "react-router";
+import { ConsoleErrorBoundary } from "../ui/errors.tsx";
+export declare const meta: MetaFunction;
+export declare function loader({ request, context }: LoaderFunctionArgs): Promise<Response>;
+export default function SignIn(): null;
+export declare const ErrorBoundary: typeof ConsoleErrorBoundary;

package/dist/routes/auth.sign-in.js

@@ -0,0 +1,29 @@
+/**
+ * Starts a sign-in: a PKCE verifier, a state and a nonce sealed into a short-lived cookie, and the
+ * browser sent to the identity provider. The page itself is only ever seen when the identity
+ * provider cannot be reached.
+ */
+import { redirect } from "react-router";
+import { failureResponse, safeReturnTo, useConsoleContext } from "../context.js";
+import { ConsoleErrorBoundary } from "../ui/errors.js";
+export const meta = () => [{ title: "Sign in · ankka" }];
+export async function loader({ request, context }) {
+    const ctx = useConsoleContext(context);
+    const rt = ctx.runtime;
+    if (!rt.issuer)
+        throw new Response("This console signs people in elsewhere.", { status: 404 });
+    const returnTo = safeReturnTo(rt, new URL(request.url).searchParams.get("returnTo"));
+    try {
+        const issuer = await rt.issuer();
+        const began = await issuer.beginSignIn(new URL(ctx.href("auth/callback"), rt.options.publicOrigin).toString());
+        await rt.pendingLogin.write({ state: began.state, nonce: began.nonce, verifier: began.verifier, returnTo }, ctx.headers);
+        return redirect(began.url.toString());
+    }
+    catch (e) {
+        throw failureResponse(ctx, e);
+    }
+}
+export default function SignIn() {
+    return null;
+}
+export const ErrorBoundary = ConsoleErrorBoundary;

package/dist/routes/auth.sign-out.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Signs out: the session cookie is cleared, this instance forgets the access token, and the
+ * identity provider's session is ended server to server, so the next visit asks for a sign-in rather
+ * than passing silently through single sign-on. Only a POST signs anyone out.
+ */
+import { type ActionFunctionArgs, type LoaderFunctionArgs, type MetaFunction } from "react-router";
+import { ConsoleErrorBoundary } from "../ui/errors.tsx";
+export declare const meta: MetaFunction;
+export declare function loader({ request, context }: LoaderFunctionArgs): Promise<{
+    console: import("../context.ts").ConsolePageData | {
+        mount: string;
+        principal: null;
+        hidden: never[];
+    };
+    signedIn: boolean;
+}>;
+export declare function action({ request, context }: ActionFunctionArgs): Promise<Response>;
+export default function SignOut(): import("react").JSX.Element;
+export declare const ErrorBoundary: typeof ConsoleErrorBoundary;

package/dist/routes/auth.sign-out.js

@@ -0,0 +1,37 @@
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * Signs out: the session cookie is cleared, this instance forgets the access token, and the
+ * identity provider's session is ended server to server, so the next visit asks for a sign-in rather
+ * than passing silently through single sign-on. Only a POST signs anyone out.
+ */
+import { redirect, useLoaderData } from "react-router";
+import { pageData, useConsoleContext } from "../context.js";
+import { ConsoleErrorBoundary } from "../ui/errors.js";
+import { ConsoleForm, ConsoleLink, Submit } from "../ui/console.js";
+export const meta = () => [{ title: "Sign out · ankka" }];
+export async function loader({ request, context }) {
+    const ctx = useConsoleContext(context);
+    const signedIn = (await ctx.runtime.store.read(request)) !== null;
+    return { console: await pageData(ctx).catch(() => ({ mount: ctx.mount, principal: null, hidden: [] })), signedIn };
+}
+export async function action({ request, context }) {
+    const ctx = useConsoleContext(context);
+    const rt = ctx.runtime;
+    const session = await rt.store.read(request);
+    await rt.store.clear(ctx.headers);
+    if (session) {
+        rt.sessionTokens?.forget(session.refreshToken);
+        // A session that cannot be ended now ends on its own at the realm's idle timeout; the browser is
+        // signed out of the console either way.
+        await rt
+            .issuer?.()
+            .then((issuer) => issuer.endSession(session.refreshToken))
+            .catch((e) => rt.log({ at: new Date().toISOString(), event: "sign-out", error: e instanceof Error ? e.message : String(e) }));
+    }
+    return redirect(ctx.href("auth/sign-out"));
+}
+export default function SignOut() {
+    const { signedIn } = useLoaderData();
+    return (_jsx("section", { className: "ac-page", children: signedIn ? (_jsxs(_Fragment, { children: [_jsx("h1", { children: "Sign out" }), _jsx(ConsoleForm, { to: "auth/sign-out", children: _jsx(Submit, { children: "Sign out" }) })] })) : (_jsxs(_Fragment, { children: [_jsx("h1", { children: "You are signed out" }), _jsx("p", { children: "Your session in this console and in the identity provider has ended." }), _jsx("p", { children: _jsx(ConsoleLink, { to: "auth/sign-in", className: "ac-button", children: "Sign in" }) })] })) }));
+}
+export const ErrorBoundary = ConsoleErrorBoundary;