tenneo-auth-plugin 0.1.11 → 1.0.2

package/dist/index.js

@@ -21,64 +21,6 @@ function getAuthRuntime() {
 function isLocalhost(hostname) {
   return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]" || hostname.startsWith("192.168.") || hostname.startsWith("10.") || hostname.endsWith(".local");
 }
-function extractTenantKeyFromDomain(urlOrHostname, config) {
-  try {
-    let hostname;
-    if (urlOrHostname.startsWith("http://") || urlOrHostname.startsWith("https://")) {
-      try {
-        const url = new URL(urlOrHostname);
-        hostname = url.hostname;
-      } catch {
-        hostname = urlOrHostname.replace(/^https?:\/\//, "").split("/")[0];
-      }
-    } else {
-      hostname = urlOrHostname;
-    }
-    const parts = hostname.split(".");
-    if (parts.length < 2) return config.getClientCode();
-    const tenantKey = parts[0];
-    if (!tenantKey || tenantKey.trim() === "") return config.getClientCode();
-    if (tenantKey.trim().toLowerCase() === "productlms") return config.getClientCode();
-    return tenantKey.trim();
-  } catch {
-    return config.getClientCode();
-  }
-}
-function extractTenantKeyFromUrl(url, config, getStorage3, getKey) {
-  try {
-    const propsConfigKey = getKey ? getKey("props_config") : "tenneo_auth_props_config";
-    const propsConfigStr = getStorage3(propsConfigKey);
-    if (propsConfigStr) {
-      try {
-        const propsConfig = JSON.parse(propsConfigStr);
-        if (propsConfig.tenantKey?.trim()) return propsConfig.tenantKey.trim();
-      } catch {
-      }
-    }
-    const tenantKeyStorageKey = getKey ? getKey("tenant_key") : "tenneo_auth_tenant_key";
-    const storedTenantKey = getStorage3(tenantKeyStorageKey);
-    if (storedTenantKey?.trim()) return storedTenantKey.trim();
-    const urlParams = new URLSearchParams(url.search);
-    const tenantKeyFromQuery = urlParams.get("t");
-    if (tenantKeyFromQuery?.trim()) {
-      const hostnameParts = url.hostname.split(".");
-      const baseDomain = hostnameParts.length >= 2 ? hostnameParts.slice(-2).join(".") : url.hostname;
-      const simulatedHostname = `${tenantKeyFromQuery.trim()}.${baseDomain}`;
-      const key = extractTenantKeyFromDomain(simulatedHostname, config);
-      if (key) return key;
-      return tenantKeyFromQuery.trim();
-    }
-    const keyFromHost = extractTenantKeyFromDomain(url.hostname, config);
-    if (keyFromHost) return keyFromHost;
-    const clientCode = config.getClientCode();
-    if (clientCode?.trim()) return clientCode.trim();
-    return config.getClientCode();
-  } catch {
-    const clientCode = config.getClientCode();
-    if (clientCode?.trim()) return clientCode.trim();
-    return config.getClientCode();
-  }
-}
 function isCallbackUrlFromUrl(url) {
   const params = new URLSearchParams(url.search);
   return params.has("code") && params.has("state");
@@ -139,8 +81,7 @@ var CONFIG_KEY_SUFFIXES = {
   stateMismatch: "state_mismatch",
   bootstrapInProgress: "bootstrap_in_progress",
   bootstrapTimestamp: "bootstrap_timestamp",
-  callbackHandled: "callback_handled",
-  idToken: "id_token"
+  callbackHandled: "callback_handled"
 };
 
 // src/infrastructure/storage/context.ts
@@ -434,10 +375,6 @@ function createCookieStorageAdapter(namespace, options) {
 
 // src/infrastructure/storage/api.ts
 var KEY_SUFFIXES = {
-  authServerUrl: "auth_server_url",
-  clientId: "client_id",
-  redirectUri: "redirect_uri",
-  tenantId: "tenant_id",
   tenantKey: "tenant_key",
   codeVerifier: "code_verifier",
   state: "state",
@@ -446,18 +383,6 @@ var KEY_SUFFIXES = {
   expiresAt: "expires_at"
 };
 var STORAGE_KEYS = {
-  get authServerUrl() {
-    return getStorageKey(KEY_SUFFIXES.authServerUrl);
-  },
-  get clientId() {
-    return getStorageKey(KEY_SUFFIXES.clientId);
-  },
-  get redirectUri() {
-    return getStorageKey(KEY_SUFFIXES.redirectUri);
-  },
-  get tenantId() {
-    return getStorageKey(KEY_SUFFIXES.tenantId);
-  },
   get tenantKey() {
     return getStorageKey(KEY_SUFFIXES.tenantKey);
   },
@@ -513,22 +438,22 @@ function removeStorage(key) {
   }
 }
 function clearAuthStorage() {
-  const adapter = getStorageAdapter();
-  if (!adapter?.clearSync) return;
-  try {
-    adapter.clearTokensSync?.();
-    adapter.clearSync();
-  } catch {
-  }
+  const keysToClear = [
+    STORAGE_KEYS.accessToken,
+    STORAGE_KEYS.refreshToken,
+    STORAGE_KEYS.expiresAt,
+    STORAGE_KEYS.codeVerifier,
+    STORAGE_KEYS.state,
+    getStorageKey("callback_processed"),
+    getStorageKey("props_config"),
+    getStorageKey("tenant_switched"),
+    getStorageKey("new_tenant_key"),
+    getStorageKey("preserved_tenant_key")
+  ];
+  for (const key of keysToClear) removeStorage(key);
 }
 function clearAuthSessionStorage() {
-  const adapter = getStorageAdapter();
-  if (!adapter?.clearSync) return;
-  try {
-    adapter.clearTokensSync?.();
-    adapter.clearSync();
-  } catch {
-  }
+  clearAuthStorage();
 }
 function clearAllCookies() {
   const runtime = getAuthRuntime();
@@ -537,27 +462,8 @@ function clearAllCookies() {
   } catch {
   }
 }
-function clearAllBrowserStorage() {
-  if (typeof window === "undefined") return;
-  try {
-    window.localStorage?.clear();
-  } catch {
-  }
-  try {
-    window.sessionStorage?.clear();
-  } catch {
-  }
-}
 function clearAllStorage() {
-  const forceLogin = getStorage(getStorageKey("force_login"));
-  const logoutInProgress = getStorage(getStorageKey("logout_in_progress"));
-  const preservedTenantKey = getStorage(getStorageKey("preserved_tenant_key"));
-  clearAuthSessionStorage();
   clearAuthStorage();
-  clearAllBrowserStorage();
-  if (forceLogin === "true") setStorage(getStorageKey("force_login"), "true");
-  if (logoutInProgress === "true") setStorage(getStorageKey("logout_in_progress"), "true");
-  if (preservedTenantKey) setStorage(getStorageKey("preserved_tenant_key"), preservedTenantKey);
   clearAllCookies();
 }
 function getAccessToken() {
@@ -593,14 +499,27 @@ function isAccessTokenExpired() {
   const buffer = 60 * 1e3;
   return Date.now() >= expiresAt - buffer;
 }
+function readHostConfig() {
+  try {
+    const raw = getStorage(getStorageKey("host_config"));
+    if (!raw) return {};
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
 function getClientId() {
-  return getStorage(STORAGE_KEYS.clientId);
+  const value = readHostConfig().clientId;
+  return typeof value === "string" && value.trim() ? value : null;
 }
 function getRedirectUri() {
-  return getStorage(STORAGE_KEYS.redirectUri);
+  const value = readHostConfig().redirectUri;
+  return typeof value === "string" && value.trim() ? value : null;
 }
 function getTenantId() {
-  return getStorage(STORAGE_KEYS.tenantId);
+  const value = readHostConfig().tenantId;
+  return typeof value === "string" && value.trim() ? value : null;
 }
 function getCodeVerifier() {
   return getStorage(STORAGE_KEYS.codeVerifier);
@@ -717,10 +636,8 @@ function resolveAuthLifecycleState(input) {
     hasRefreshToken,
     isTokenExpired
   } = input;
-  const forceLogin = getStorage3("force_login") === "true";
   const callbackProcessed = getStorage3("callback_processed") === "true";
   const tenantSwitched = getStorage3("tenant_switched") === "true";
-  if (forceLogin) return "FORCE_LOGIN" /* FORCE_LOGIN */;
   if (isCallbackUrl2(url)) return "PROCESSING_CALLBACK" /* PROCESSING_CALLBACK */;
   if (hasValidToken) return "AUTHENTICATED" /* AUTHENTICATED */;
   if (callbackProcessed && !hasToken) return "LOGIN_REQUIRED" /* LOGIN_REQUIRED */;
@@ -781,30 +698,58 @@ function setFlowFlags() {
   setFlowInProgress();
 }
 
-// src/strategies/oauth2-pkce/pkce.ts
-function generateCodeVerifier(length = 128) {
-  const array = new Uint8Array(length);
-  crypto.getRandomValues(array);
-  const base64 = btoa(String.fromCharCode(...array));
-  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+// src/application/events/AuthEvents.ts
+var AuthEventNames = {
+  LOGIN_STARTED: "LOGIN_STARTED",
+  LOGIN_SUCCESS: "LOGIN_SUCCESS",
+  LOGIN_FAILED: "LOGIN_FAILED",
+  CALLBACK_SUCCESS: "CALLBACK_SUCCESS",
+  CALLBACK_FAILED: "CALLBACK_FAILED",
+  TOKEN_REFRESH_SUCCESS: "TOKEN_REFRESH_SUCCESS",
+  TOKEN_REFRESH_FAILED: "TOKEN_REFRESH_FAILED",
+  TENANT_SWITCHED: "TENANT_SWITCHED",
+  LOGOUT_COMPLETED: "LOGOUT_COMPLETED",
+  BOOTSTRAP_STATE_DETECTED: "BOOTSTRAP_STATE_DETECTED",
+  REDIRECT_LOOP_RISK: "REDIRECT_LOOP_RISK"
+};
+var listeners = /* @__PURE__ */ new Map();
+function getHandlers(event) {
+  let set = listeners.get(event);
+  if (!set) {
+    set = /* @__PURE__ */ new Set();
+    listeners.set(event, set);
+  }
+  return set;
 }
-async function generateCodeChallenge(verifier) {
-  try {
-    const encoder = new TextEncoder();
-    const data = encoder.encode(verifier);
-    const hashBuffer = await crypto.subtle.digest("SHA-256", data);
-    const hashArray = Array.from(new Uint8Array(hashBuffer));
-    const base64 = btoa(String.fromCharCode(...hashArray));
-    return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-  } catch {
-    throw new Error("Failed to generate code challenge");
+function getWildcardHandlers() {
+  let set = listeners.get("*");
+  if (!set) {
+    set = /* @__PURE__ */ new Set();
+    listeners.set("*", set);
   }
+  return set;
 }
-function generateState() {
-  const array = new Uint8Array(32);
-  crypto.getRandomValues(array);
-  const base64 = btoa(String.fromCharCode(...array));
-  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+function emitAuthEvent(event, payload) {
+  const handlers = getHandlers(event);
+  const wildcard = getWildcardHandlers();
+  const p = payload ?? {};
+  handlers.forEach((fn) => {
+    try {
+      fn(p);
+    } catch {
+    }
+  });
+  wildcard.forEach((fn) => {
+    try {
+      fn({ ...p, event });
+    } catch {
+    }
+  });
+}
+function subscribeAuthEvent(event, handler) {
+  const set = event === "*" ? getWildcardHandlers() : getHandlers(event);
+  set.add(handler);
+  return () => set.delete(handler);
 }
 
 // src/config/constants.ts
@@ -848,12 +793,17 @@ function readHostConfigFromStorage() {
 function resolveMerged(overrides) {
   const stored = readHostConfigFromStorage();
   const cfg = { ...stored, ...inMemoryConfig, ...overrides ?? {} };
+  if (!cfg.tenantCode && cfg.tenantKey) {
+    cfg.tenantCode = cfg.tenantKey;
+  }
   const trimmed = (v) => v == null ? "" : String(v).trim();
   return {
     apiBaseUrl: trimmed(cfg.apiBaseUrl),
     authServerUrl: trimmed(cfg.authServerUrl),
     callbackUrl: trimmed(cfg.callbackUrl),
-    clientCode: trimmed(cfg.clientCode)
+    clientCode: trimmed(cfg.clientCode),
+    tenantCode: trimmed(cfg.tenantCode),
+    appId: trimmed(cfg.appId)
   };
 }
 function resolveConfig(overrides) {
@@ -862,6 +812,9 @@ function resolveConfig(overrides) {
 function getConfig() {
   return resolveMerged();
 }
+function getAuthConfig() {
+  return resolveMerged();
+}
 function setConfig(overrides) {
   inMemoryConfig = { ...inMemoryConfig, ...overrides };
 }
@@ -892,28 +845,121 @@ var Config = {
   }
 };
 
-// src/utils/validation.ts
-function isValidGuid(guid) {
-  if (!guid || typeof guid !== "string") {
-    return false;
+// src/infrastructure/tenant/TenantConfigCache.ts
+var DEFAULT_TTL_MS = 5 * 60 * 1e3;
+var TenantConfigCache = class {
+  constructor(ttlMs = DEFAULT_TTL_MS) {
+    this.cache = /* @__PURE__ */ new Map();
+    this.inFlight = /* @__PURE__ */ new Map();
+    this.ttlMs = ttlMs;
+  }
+  get(tenantKey) {
+    const entry = this.cache.get(tenantKey);
+    if (!entry) return null;
+    if (Date.now() >= entry.expiresAt) {
+      this.cache.delete(tenantKey);
+      return null;
+    }
+    return entry.config;
+  }
+  set(tenantKey, config) {
+    this.cache.set(tenantKey, {
+      config,
+      expiresAt: Date.now() + this.ttlMs
+    });
+  }
+  invalidate(tenantKey) {
+    if (tenantKey) {
+      this.cache.delete(tenantKey);
+      this.inFlight.delete(tenantKey);
+    } else {
+      this.cache.clear();
+      this.inFlight.clear();
+    }
+  }
+  async getOrResolve(tenantKey, resolver) {
+    if (!tenantKey || !tenantKey.trim()) return null;
+    const key = tenantKey.trim();
+    const cached = this.get(key);
+    if (cached) {
+      logger.debug("Tenant config from cache", { tenantKey: key });
+      return cached;
+    }
+    const existing = this.inFlight.get(key);
+    if (existing) {
+      logger.debug("Tenant resolution reused (in-flight)", { tenantKey: key });
+      return existing;
+    }
+    const promise = (async () => {
+      try {
+        const config = await resolver(key);
+        if (config) this.set(key, config);
+        return config;
+      } finally {
+        this.inFlight.delete(key);
+      }
+    })();
+    this.inFlight.set(key, promise);
+    return promise;
+  }
+};
+
+// src/infrastructure/tenant/tenantResolution.ts
+var defaultTenantConfigCache = new TenantConfigCache();
+function consumePropsConfig() {
+  const propsConfigKey = getStorageKey("props_config");
+  try {
+    const propsConfigStr = getStorage(propsConfigKey);
+    if (!propsConfigStr) return null;
+    const parsed = JSON.parse(propsConfigStr);
+    return parsed && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  } finally {
+    removeStorage(propsConfigKey);
   }
-  const guidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-  return guidRegex.test(guid.trim());
 }
-function validateTenantId(tenantId) {
-  if (!tenantId || tenantId.trim() === "") {
-    return {
-      isValid: false,
-      error: "Tenant ID is required"
-    };
+function readHostConfig2() {
+  try {
+    const raw = getStorage(getStorageKey("host_config"));
+    if (!raw) return null;
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
   }
-  if (!isValidGuid(tenantId)) {
-    return {
-      isValid: false,
-      error: "Tenant ID must be a valid GUID format (00000000-0000-0000-0000-000000000001)"
-    };
+}
+function validateTenantKey(value) {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed ? trimmed : null;
+}
+function resolveTenantKey() {
+  const propsConfig = consumePropsConfig();
+  const tenantFromProps = validateTenantKey(propsConfig?.tenantKey);
+  if (tenantFromProps) return tenantFromProps;
+  const hostConfig = readHostConfig2();
+  if (!hostConfig) {
+    logger.warn("Missing host_config while resolving tenant");
+    return null;
   }
-  return { isValid: true };
+  const tenantFromHost = validateTenantKey(hostConfig?.tenantKey);
+  if (tenantFromHost) return tenantFromHost;
+  if (hostConfig.tenantKey != null) {
+    logger.warn("Invalid tenant key in host_config", { tenantKey: hostConfig.tenantKey });
+  }
+  return null;
+}
+async function resolveTenantConfig(tenantKey, tenantResolver) {
+  const resolved = await tenantResolver.resolve(tenantKey);
+  if (!resolved) return null;
+  return { ...resolved, tenantKey };
+}
+async function resolveTenantConfigCached(tenantKey, tenantResolver) {
+  return defaultTenantConfigCache.getOrResolve(
+    tenantKey,
+    (key) => resolveTenantConfig(key, tenantResolver)
+  );
 }
 
 // src/application/domain-facade.ts
@@ -923,33 +969,7 @@ function isLocalhost2() {
   return isLocalhost(hostname);
 }
 function extractTenantKey() {
-  const runtime = getAuthRuntime();
-  if (runtime) {
-    const url = runtime.urlProvider.getCurrentUrl();
-    return extractTenantKeyFromUrl(url, runtime.configProvider, getStorage, getStorageKey);
-  }
-  return extractTenantKeyLegacy();
-}
-function extractTenantKeyLegacy() {
-  if (typeof window === "undefined") return Config.getClientCode();
-  try {
-    const propsConfigStr = getStorage(getStorageKey("props_config"));
-    if (propsConfigStr) {
-      const propsConfig = JSON.parse(propsConfigStr);
-      if (propsConfig.tenantKey?.trim()) return propsConfig.tenantKey.trim();
-    }
-    const stored = getStorage(getStorageKey("tenant_key"));
-    if (stored?.trim()) return stored.trim();
-    const urlParams = new URLSearchParams(window.location.search);
-    const t = urlParams.get("t");
-    if (t?.trim()) return t.trim();
-    const hostname = window.location.hostname;
-    const parts = hostname.split(".");
-    if (parts.length >= 2 && parts[0] && parts[0].toLowerCase() !== "productlms") return parts[0].trim();
-    return Config.getClientCode();
-  } catch {
-    return Config.getClientCode();
-  }
+  return resolveTenantKey();
 }
 function isCallbackUrl() {
   const runtime = getAuthRuntime();
@@ -959,219 +979,6 @@ function isCallbackUrl() {
   return params.has("code") && params.has("state");
 }
 
-// src/application/events/AuthEvents.ts
-var AuthEventNames = {
-  LOGIN_STARTED: "LOGIN_STARTED",
-  LOGIN_SUCCESS: "LOGIN_SUCCESS",
-  LOGIN_FAILED: "LOGIN_FAILED",
-  CALLBACK_SUCCESS: "CALLBACK_SUCCESS",
-  CALLBACK_FAILED: "CALLBACK_FAILED",
-  TOKEN_REFRESH_SUCCESS: "TOKEN_REFRESH_SUCCESS",
-  TOKEN_REFRESH_FAILED: "TOKEN_REFRESH_FAILED",
-  TENANT_SWITCHED: "TENANT_SWITCHED",
-  LOGOUT_COMPLETED: "LOGOUT_COMPLETED",
-  BOOTSTRAP_STATE_DETECTED: "BOOTSTRAP_STATE_DETECTED",
-  REDIRECT_LOOP_RISK: "REDIRECT_LOOP_RISK"
-};
-var listeners = /* @__PURE__ */ new Map();
-function getHandlers(event) {
-  let set = listeners.get(event);
-  if (!set) {
-    set = /* @__PURE__ */ new Set();
-    listeners.set(event, set);
-  }
-  return set;
-}
-function getWildcardHandlers() {
-  let set = listeners.get("*");
-  if (!set) {
-    set = /* @__PURE__ */ new Set();
-    listeners.set("*", set);
-  }
-  return set;
-}
-function emitAuthEvent(event, payload) {
-  const handlers = getHandlers(event);
-  const wildcard = getWildcardHandlers();
-  const p = payload ?? {};
-  handlers.forEach((fn) => {
-    try {
-      fn(p);
-    } catch {
-    }
-  });
-  wildcard.forEach((fn) => {
-    try {
-      fn({ ...p, event });
-    } catch {
-    }
-  });
-}
-function subscribeAuthEvent(event, handler) {
-  const set = event === "*" ? getWildcardHandlers() : getHandlers(event);
-  set.add(handler);
-  return () => set.delete(handler);
-}
-
-// src/application/security/redirectLoopGuard.ts
-var DEFAULT_MAX_REDIRECTS = 5;
-var WINDOW_MS = 60 * 1e3;
-var redirectCount = 0;
-var firstRedirectAt = 0;
-function resetRedirectLoopGuard() {
-  redirectCount = 0;
-  firstRedirectAt = 0;
-}
-function checkAndIncrementRedirect(maxAttempts = DEFAULT_MAX_REDIRECTS) {
-  const now = Date.now();
-  if (now - firstRedirectAt > WINDOW_MS) {
-    redirectCount = 0;
-    firstRedirectAt = now;
-  }
-  if (redirectCount >= maxAttempts) {
-    emitAuthEvent(AuthEventNames.REDIRECT_LOOP_RISK, {
-      message: `Redirect attempt limit (${maxAttempts}) exceeded`
-    });
-    return false;
-  }
-  redirectCount++;
-  return true;
-}
-
-// src/strategies/oauth2-pkce/oauth.ts
-function storeTenantConfig(config) {
-  const validation = validateTenantId(config.tenantId);
-  if (!validation.isValid) {
-    logger.warn("Tenant ID validation failed", { tenantId: config.tenantId });
-  }
-  const authServerToStore = Config.getAuthServerUrl() || config.authServer;
-  setStorage(STORAGE_KEYS.authServerUrl, authServerToStore);
-  setStorage(STORAGE_KEYS.clientId, config.client.clientId);
-  setStorage(STORAGE_KEYS.redirectUri, Config.getRedirectUri());
-  setStorage(STORAGE_KEYS.tenantId, config.tenantId);
-  if (config.tenantKey) {
-    setStorage(STORAGE_KEYS.tenantKey, config.tenantKey);
-  }
-}
-async function initiateAuthFlow(config) {
-  try {
-    logger.info("Initiating OAuth authorization flow");
-    const authServerFromProps = Config.getAuthServerUrl();
-    const authServerEffective = (authServerFromProps || config?.authServer || "").replace(/\/+$/, "");
-    const redirectUriEffective = Config.getRedirectUri();
-    const storedTenantId = getStorage(STORAGE_KEYS.tenantId);
-    const storedClientId = getStorage(STORAGE_KEYS.clientId);
-    const tenantIdEffective = storedTenantId || config?.tenantId || "";
-    const clientIdEffective = storedClientId || config?.client?.clientId || "";
-    logger.debug("[initiateAuthFlow] Resolved inputs", {
-      authServerFromProps: authServerFromProps ? "(provided)" : "(empty)",
-      authServerEffective,
-      redirectUriEffective,
-      tenantIdEffective,
-      clientIdEffective,
-      scopes: config?.client?.scopes,
-      hasRuntime: !!getAuthRuntime()
-    });
-    const token = getAccessToken();
-    if (token && !isAccessTokenExpired()) {
-      logger.debug("Valid token already exists, skipping auth flow");
-      clearFlowFlags();
-      return;
-    }
-    if (isCallbackUrl()) {
-      logger.debug("Callback URL detected - clearing flow flag to allow callback processing");
-      clearFlowFlags();
-      return;
-    }
-    if (isFlowInProgress()) {
-      if (isFlowFlagStale(3e3)) {
-        logger.info("Stale auth flow flag detected, clearing and proceeding");
-        clearFlowFlags();
-      } else {
-        logger.debug("Auth flow already in progress (recent), skipping duplicate redirect");
-        return;
-      }
-    }
-    setFlowFlags();
-    if (!(Config.getAuthServerUrl() || config?.authServer) || !config.client?.clientId || !config.client?.redirectUri) {
-      logger.error("[initiateAuthFlow] Missing required tenant config", {
-        authServerEffective,
-        clientId: config?.client?.clientId,
-        redirectUriFromTenantApi: config?.client?.redirectUri,
-        redirectUriEffective
-      });
-      throw new Error("Invalid tenant configuration for auth flow");
-    }
-    storeTenantConfig(config);
-    logger.debug("[initiateAuthFlow] Stored tenant config, generating PKCE");
-    const codeVerifier = generateCodeVerifier();
-    const codeChallenge = await generateCodeChallenge(codeVerifier);
-    const state = generateState();
-    removeStorage(STORAGE_KEYS.codeVerifier);
-    removeStorage(STORAGE_KEYS.state);
-    setStorage(STORAGE_KEYS.codeVerifier, codeVerifier);
-    setStorage(STORAGE_KEYS.state, state);
-    const authUrl = buildAuthorizationUrl(config, codeChallenge, state);
-    logger.debug("[initiateAuthFlow] Built authorization URL", {
-      authServerEffective,
-      urlPrefix: authUrl?.slice(0, 80)
-    });
-    if (!authUrl || !(authUrl.startsWith("http://") || authUrl.startsWith("https://"))) {
-      throw new Error("Invalid authorization URL generated");
-    }
-    if (!checkAndIncrementRedirect()) {
-      logger.warn("Redirect loop protection: max redirect attempts exceeded");
-      clearFlowFlags();
-      return;
-    }
-    logger.info("Redirecting to authorization server");
-    emitAuthEvent(AuthEventNames.LOGIN_STARTED, { tenantKey: config.tenantKey });
-    const runtime = getAuthRuntime();
-    if (runtime) {
-      logger.debug("[initiateAuthFlow] Redirect via runtime.urlProvider.redirect");
-      runtime.urlProvider.redirect(authUrl);
-    } else if (typeof window !== "undefined") {
-      logger.debug("[initiateAuthFlow] Redirect via window.location.replace");
-      window.location.replace(authUrl);
-    } else {
-      logger.error("[initiateAuthFlow] No runtime and no window; cannot redirect", { authUrl });
-    }
-  } catch (error) {
-    clearFlowFlags();
-    logger.error("Failed to initiate auth flow", {
-      error: error instanceof Error ? error.message : String(error)
-    });
-    throw error;
-  }
-}
-function buildAuthorizationUrl(config, codeChallenge, state) {
-  const authServerBase = (Config.getAuthServerUrl() || config.authServer || "").replace(/\/+$/, "");
-  if (isLocalhost2()) {
-    logger.debug("Building authorization URL", {
-      authServer: authServerBase,
-      clientId: config.client.clientId,
-      redirectUri: config.client.redirectUri,
-      scopes: config.client.scopes
-    });
-  }
-  const storedTenantId = getStorage(STORAGE_KEYS.tenantId);
-  const storedClientId = getStorage(STORAGE_KEYS.clientId);
-  const tenantIdToUse = storedTenantId || config.tenantId;
-  const clientIdToUse = storedClientId || config.client.clientId;
-  const redirectUriToUse = Config.getRedirectUri();
-  const params = new URLSearchParams({
-    client_id: `public-${clientIdToUse}`,
-    tenant_id: tenantIdToUse,
-    redirect_uri: redirectUriToUse,
-    response_type: DEFAULT_RESPONSE_TYPE,
-    scope: config.client.scopes,
-    state,
-    code_challenge: codeChallenge,
-    code_challenge_method: DEFAULT_CODE_CHALLENGE_METHOD
-  });
-  return `${authServerBase}/connect/authorize?${params.toString()}`;
-}
-
 // src/strategies/oauth2-pkce/token-exchange.ts
 function storeTokens(tokenData) {
   const expiresIn = tokenData.expires_in || 3600;
@@ -1331,6 +1138,31 @@ async function refreshAccessToken() {
   })();
   return refreshPromise;
 }
+
+// src/application/security/redirectLoopGuard.ts
+var DEFAULT_MAX_REDIRECTS = 5;
+var WINDOW_MS = 60 * 1e3;
+var redirectCount = 0;
+var firstRedirectAt = 0;
+function resetRedirectLoopGuard() {
+  redirectCount = 0;
+  firstRedirectAt = 0;
+}
+function checkAndIncrementRedirect(maxAttempts = DEFAULT_MAX_REDIRECTS) {
+  const now = Date.now();
+  if (now - firstRedirectAt > WINDOW_MS) {
+    redirectCount = 0;
+    firstRedirectAt = now;
+  }
+  if (redirectCount >= maxAttempts) {
+    emitAuthEvent(AuthEventNames.REDIRECT_LOOP_RISK, {
+      message: `Redirect attempt limit (${maxAttempts}) exceeded`
+    });
+    return false;
+  }
+  redirectCount++;
+  return true;
+}
 function isProcessed() {
   return getStorage(getStorageKey("callback_processed")) === "true";
 }
@@ -1349,15 +1181,6 @@ function clearProcessing() {
   removeStorage(getStorageKey("callback_processed"));
 }
 var urlCleaned = false;
-function cleanUrl() {
-  if (urlCleaned) return;
-  if (isProcessing()) return;
-  const runtime = getAuthRuntime();
-  const clean = runtime ? `${runtime.urlProvider.getCurrentUrl().origin}${runtime.urlProvider.getCurrentUrl().pathname}` : typeof window !== "undefined" ? `${window.location.origin}${window.location.pathname}` : "/";
-  if (runtime) runtime.urlProvider.redirect(clean);
-  else if (typeof window !== "undefined") window.location.replace(clean);
-  urlCleaned = true;
-}
 function cleanUrlSoft() {
   if (urlCleaned) return;
   if (isProcessing()) return;
@@ -1368,13 +1191,20 @@ function cleanUrlSoft() {
   urlCleaned = true;
 }
 function clearAllAuthFlags() {
-  removeStorage(getStorageKey("force_login"));
-  removeStorage(getStorageKey("logout_in_progress"));
   clearFlowFlags();
 }
 async function handleCallback() {
+  const runtimeSearch = getAuthRuntime()?.urlProvider.getCurrentUrl().search;
+  const windowSearch = typeof window !== "undefined" ? window.location.search : "";
+  logger.debug("[Callback] handleCallback invoked", {
+    isProcessed: isProcessed(),
+    isProcessing: isProcessing(),
+    isCallbackUrl: isCallbackUrl(),
+    runtimeSearch: runtimeSearch ?? "(none)",
+    windowSearch: windowSearch || "(none)"
+  });
   if (isProcessed()) {
-    logger.debug("Callback already processed in this session - preventing duplicate processing");
+    logger.warn("[Callback] Early exit: callback already processed");
     if (isCallbackUrl()) {
       if (!isProcessing()) cleanUrlSoft();
     }
@@ -1382,31 +1212,16 @@ async function handleCallback() {
     return true;
   }
   if (isProcessing()) {
-    logger.debug("Callback processing already in progress - waiting for completion");
+    logger.warn("[Callback] Early exit: callback processing already in progress");
     return true;
   }
-  if (getStorage(getStorageKey("force_login")) === "true") {
-    logger.info("Force-login flag present \u2192 callback skipped (logout occurred)");
-    const runtime = getAuthRuntime();
-    if (runtime && runtime.urlProvider.getCurrentUrl().search) cleanUrlSoft();
-    else if (typeof window !== "undefined" && window.location.search) cleanUrlSoft();
-    clearAllAuthFlags();
-    clearProcessing();
-    return false;
-  }
   const storedTenantKey = getTenantKey();
-  let currentTenantKey = null;
-  try {
-    const propsConfigStr = getStorage(getStorageKey("props_config"));
-    if (propsConfigStr) {
-      const propsConfig = JSON.parse(propsConfigStr);
-      currentTenantKey = propsConfig.tenantKey || null;
-    }
-  } catch {
-  }
-  if (!currentTenantKey) currentTenantKey = storedTenantKey;
+  const currentTenantKey = resolveTenantKey() ?? storedTenantKey;
   if (currentTenantKey && storedTenantKey && currentTenantKey !== storedTenantKey) {
-    logger.info("TenantKey changed - bypassing callback, starting fresh login");
+    logger.warn("[Callback] Early exit: tenant key changed before exchange", {
+      currentTenantKey,
+      storedTenantKey
+    });
     clearAllStorage();
     clearAllAuthFlags();
     clearProcessing();
@@ -1416,7 +1231,10 @@ async function handleCallback() {
     if (isCallbackUrl()) cleanUrlSoft();
     return false;
   }
-  if (!isCallbackUrl()) return false;
+  if (!isCallbackUrl()) {
+    logger.warn("[Callback] Early exit: URL is not callback URL");
+    return false;
+  }
   markProcessing();
   clearFlowFlags();
   urlCleaned = false;
@@ -1427,44 +1245,33 @@ async function handleCallback() {
     const state = params.get("state");
     const error = params.get("error");
     if (error || !code || !state) {
-      logger.error("Invalid OAuth callback params", { error, code, state });
+      logger.error("[Callback] Early exit: invalid OAuth callback params", { error, code, state });
       clearAllAuthFlags();
       clearProcessing();
-      markProcessed();
       cleanUrlSoft();
       return false;
     }
     const storedState = getState();
     if (!storedState || storedState !== state) {
       const currentTenantKeyFromUrl = extractTenantKey();
-      let storedTenantKeyFromProps = null;
-      try {
-        const propsConfigStr = getStorage(getStorageKey("props_config"));
-        if (propsConfigStr) {
-          const propsConfig = JSON.parse(propsConfigStr);
-          storedTenantKeyFromProps = propsConfig.tenantKey || null;
-        }
-      } catch {
-      }
-      const tenantKeyChanged = currentTenantKeyFromUrl && storedTenantKeyFromProps && currentTenantKeyFromUrl !== storedTenantKeyFromProps;
+      const resolvedTenantKey = resolveTenantKey();
+      const tenantKeyChanged = currentTenantKeyFromUrl && resolvedTenantKey && currentTenantKeyFromUrl !== resolvedTenantKey;
       if (tenantKeyChanged) {
-        logger.info("OAuth state mismatch due to tenantKey change - expected behavior, starting fresh login");
+        logger.warn("[Callback] Early exit: state mismatch due to tenant key change");
       } else {
-        logger.error("OAuth state mismatch - redirecting to login");
+        logger.error("[Callback] Early exit: OAuth state mismatch - redirecting to login");
       }
       clearAllAuthFlags();
       clearProcessing();
-      markProcessed();
       cleanUrlSoft();
       setStorage(getStorageKey("state_mismatch"), "true");
       return false;
     }
     const codeVerifier = getCodeVerifier();
     if (!codeVerifier) {
-      logger.error("Missing PKCE verifier");
+      logger.error("[Callback] Early exit: missing PKCE verifier");
       clearAllAuthFlags();
       clearProcessing();
-      markProcessed();
       cleanUrlSoft();
       return false;
     }
@@ -1472,25 +1279,29 @@ async function handleCallback() {
     const redirectUri = getRedirectUri();
     const tenantId = getTenantId();
     if (!clientId || !redirectUri || !tenantId) {
-      logger.error("Missing OAuth config during callback");
+      logger.error("[Callback] Early exit: missing OAuth config during callback", {
+        hasClientId: !!clientId,
+        hasRedirectUri: !!redirectUri,
+        hasTenantId: !!tenantId
+      });
       clearAllAuthFlags();
       clearProcessing();
-      markProcessed();
       cleanUrlSoft();
       return false;
     }
     const existingToken = getAccessToken();
     if (existingToken && !isAccessTokenExpired()) {
-      logger.debug("Valid token already exists - skipping code exchange");
+      logger.warn("[Callback] Early exit: valid token already exists - skipping code exchange");
       removeStorage(STORAGE_KEYS.codeVerifier);
       removeStorage(STORAGE_KEYS.state);
       clearAllAuthFlags();
       markProcessed();
-      cleanUrl();
+      cleanUrlSoft();
       resetRedirectLoopGuard();
       emitAuthEvent(AuthEventNames.CALLBACK_SUCCESS);
       return true;
     }
+    logger.info("[Callback] Entering token exchange");
     const tokenData = await exchangeCodeForTokens({
       code,
       codeVerifier,
@@ -1510,7 +1321,7 @@ async function handleCallback() {
     removeStorage(STORAGE_KEYS.state);
     clearAllAuthFlags();
     markProcessed();
-    cleanUrl();
+    cleanUrlSoft();
     logger.info("OAuth callback processed successfully");
     resetRedirectLoopGuard();
     emitAuthEvent(AuthEventNames.CALLBACK_SUCCESS);
@@ -1557,170 +1368,19 @@ async function handleCallback() {
     const tokenValid = existingToken && !isAccessTokenExpired();
     if (tokenValid) {
       markProcessed();
-      cleanUrlSoft();
-      resetRedirectLoopGuard();
-      emitAuthEvent(AuthEventNames.CALLBACK_SUCCESS);
-      return true;
-    }
-    emitAuthEvent(AuthEventNames.CALLBACK_FAILED, {
-      error: err instanceof Error ? err.message : String(err)
-    });
-    clearProcessing();
-    if (isCallbackUrl()) cleanUrlSoft();
-    return false;
-  }
-}
-
-// src/infrastructure/tenant/TenantConfigCache.ts
-var DEFAULT_TTL_MS = 5 * 60 * 1e3;
-var TenantConfigCache = class {
-  constructor(ttlMs = DEFAULT_TTL_MS) {
-    this.cache = /* @__PURE__ */ new Map();
-    this.inFlight = /* @__PURE__ */ new Map();
-    this.ttlMs = ttlMs;
-  }
-  get(tenantKey) {
-    const entry = this.cache.get(tenantKey);
-    if (!entry) return null;
-    if (Date.now() >= entry.expiresAt) {
-      this.cache.delete(tenantKey);
-      return null;
-    }
-    return entry.config;
-  }
-  set(tenantKey, config) {
-    this.cache.set(tenantKey, {
-      config,
-      expiresAt: Date.now() + this.ttlMs
-    });
-  }
-  invalidate(tenantKey) {
-    if (tenantKey) {
-      this.cache.delete(tenantKey);
-      this.inFlight.delete(tenantKey);
-    } else {
-      this.cache.clear();
-      this.inFlight.clear();
-    }
-  }
-  async getOrResolve(tenantKey, resolver) {
-    if (!tenantKey || !tenantKey.trim()) return null;
-    const key = tenantKey.trim();
-    const cached = this.get(key);
-    if (cached) {
-      logger.debug("Tenant config from cache", { tenantKey: key });
-      return cached;
-    }
-    const existing = this.inFlight.get(key);
-    if (existing) {
-      logger.debug("Tenant resolution reused (in-flight)", { tenantKey: key });
-      return existing;
-    }
-    const promise = (async () => {
-      try {
-        const config = await resolver(key);
-        if (config) this.set(key, config);
-        return config;
-      } finally {
-        this.inFlight.delete(key);
-      }
-    })();
-    this.inFlight.set(key, promise);
-    return promise;
-  }
-};
-
-// src/infrastructure/tenant/tenantResolution.ts
-var defaultTenantConfigCache = new TenantConfigCache();
-function getTenantKeyFromRuntime(url, config) {
-  try {
-    const propsConfigStr = getStorage(getStorageKey("props_config"));
-    if (propsConfigStr) {
-      const propsConfig = JSON.parse(propsConfigStr);
-      if (propsConfig.tenantKey?.trim()) return propsConfig.tenantKey.trim();
-      return null;
-    }
-  } catch {
-  }
-  return extractTenantKeyFromUrl(url, config, getStorage, getStorageKey);
-}
-function getPropsConfig() {
-  try {
-    const propsConfigStr = getStorage(getStorageKey("props_config"));
-    if (!propsConfigStr) return null;
-    const parsed = JSON.parse(propsConfigStr);
-    if (parsed && typeof parsed === "object" && "authServerUrl" in parsed) {
-      delete parsed.authServerUrl;
-    }
-    return parsed;
-  } catch {
-    removeStorage(getStorageKey("props_config"));
-    return null;
-  }
-}
-function mergeConfigWithProps(apiEnvConfig, propsConfig, tenantKey) {
-  return {
-    tenantId: propsConfig.tenantId || apiEnvConfig.tenantId,
-    authServer: apiEnvConfig.authServer,
-    tenantKey: tenantKey || apiEnvConfig.tenantKey,
-    client: {
-      clientId: propsConfig.clientId || apiEnvConfig.client.clientId,
-      redirectUri: apiEnvConfig.client.redirectUri,
-      scopes: apiEnvConfig.client.scopes
-    }
-  };
-}
-async function resolveTenantConfig(tenantKey, tenantResolver) {
-  if (!tenantKey) return null;
-  const propsConfig = getPropsConfig();
-  const resolved = await tenantResolver.resolve(tenantKey);
-  if (!resolved) return null;
-  removeStorage(getStorageKey("props_config"));
-  return {
-    ...propsConfig ? mergeConfigWithProps(resolved, propsConfig, tenantKey) : resolved,
-    tenantKey: tenantKey || resolved.tenantKey
-  };
-}
-async function resolveTenantConfigCached(tenantKey, tenantResolver) {
-  if (!tenantKey) return null;
-  return defaultTenantConfigCache.getOrResolve(
-    tenantKey,
-    (key) => resolveTenantConfig(key, tenantResolver)
-  );
-}
-
-// src/application/flows/ForceLoginFlow.ts
-var ForceLoginFlow = class {
-  async execute(context) {
-    const { runtime } = context;
-    const { urlProvider, logger: log } = runtime;
-    const getUrl = () => urlProvider.getCurrentUrl();
-    if (isCallbackUrlFromUrl(getUrl())) {
-      await handleCallback();
-      if (isCallbackUrlFromUrl(getUrl())) {
-        log.warn("Callback URL still present after cleanup, forcing URL clean");
-        const u = getUrl();
-        urlProvider.redirect(`${u.origin}${u.pathname}`);
-        return { completed: true };
-      }
-    }
-    clearFlowFlags();
-    const tenantKey = getTenantKeyFromRuntime(getUrl(), runtime.configProvider);
-    if (!tenantKey) return { completed: true };
-    const tenantConfig = await resolveTenantConfigCached(tenantKey, runtime.tenantResolver);
-    if (!tenantConfig) {
-      log.error("Tenant config resolution failed for force login", { tenantKey });
-      throw new SanitizedError(
-        "TENANT_CONFIG_RESOLUTION_FAILED",
-        "Unable to resolve tenant configuration",
-        new Error(`Tenant config resolution failed for tenantKey: ${tenantKey}`)
-      );
+      cleanUrlSoft();
+      resetRedirectLoopGuard();
+      emitAuthEvent(AuthEventNames.CALLBACK_SUCCESS);
+      return true;
     }
-    storeTenantConfig(tenantConfig);
-    await initiateAuthFlow(tenantConfig);
-    return { completed: true };
+    emitAuthEvent(AuthEventNames.CALLBACK_FAILED, {
+      error: err instanceof Error ? err.message : String(err)
+    });
+    clearProcessing();
+    if (isCallbackUrl()) cleanUrlSoft();
+    return false;
   }
-};
+}
 
 // src/application/flows/CallbackFlow.ts
 var CallbackFlow = class {
@@ -1791,6 +1451,206 @@ function getAccessToken2() {
   return getAccessToken();
 }
 
+// src/strategies/oauth2-pkce/pkce.ts
+function generateCodeVerifier(length = 128) {
+  const array = new Uint8Array(length);
+  crypto.getRandomValues(array);
+  const base64 = btoa(String.fromCharCode(...array));
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+async function generateCodeChallenge(verifier) {
+  try {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(verifier);
+    const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+    const hashArray = Array.from(new Uint8Array(hashBuffer));
+    const base64 = btoa(String.fromCharCode(...hashArray));
+    return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+  } catch {
+    throw new Error("Failed to generate code challenge");
+  }
+}
+function generateState() {
+  const array = new Uint8Array(32);
+  crypto.getRandomValues(array);
+  const base64 = btoa(String.fromCharCode(...array));
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+
+// src/utils/validation.ts
+function isValidGuid(guid) {
+  if (!guid || typeof guid !== "string") {
+    return false;
+  }
+  const guidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  return guidRegex.test(guid.trim());
+}
+function validateTenantId(tenantId) {
+  if (!tenantId || tenantId.trim() === "") {
+    return {
+      isValid: false,
+      error: "Tenant ID is required"
+    };
+  }
+  if (!isValidGuid(tenantId)) {
+    return {
+      isValid: false,
+      error: "Tenant ID must be a valid GUID format (00000000-0000-0000-0000-000000000001)"
+    };
+  }
+  return { isValid: true };
+}
+
+// src/strategies/oauth2-pkce/oauth.ts
+function storeTenantConfig(config) {
+  const validation = validateTenantId(config.tenantId);
+  if (!validation.isValid) {
+    logger.warn("Tenant ID validation failed", { tenantId: config.tenantId });
+  }
+  const authServerToStore = Config.getAuthServerUrl() || config.authServer;
+  const redirectUriToStore = Config.getRedirectUri();
+  const hostConfigKey = getStorageKey("host_config");
+  let existing = {};
+  try {
+    const raw = getStorage(hostConfigKey);
+    if (raw) existing = JSON.parse(raw);
+  } catch {
+    existing = {};
+  }
+  setStorage(
+    hostConfigKey,
+    JSON.stringify({
+      ...existing,
+      authServerUrl: authServerToStore,
+      clientId: config.client.clientId,
+      redirectUri: redirectUriToStore,
+      tenantId: config.tenantId,
+      tenantKey: config.tenantKey ?? existing.tenantKey ?? "",
+      tenantCode: config.tenantKey ?? existing.tenantCode ?? ""
+    })
+  );
+  if (config.tenantKey) {
+    setStorage(STORAGE_KEYS.tenantKey, config.tenantKey);
+  }
+}
+async function initiateAuthFlow(config) {
+  try {
+    logger.info("Initiating OAuth authorization flow");
+    const authServerFromProps = Config.getAuthServerUrl();
+    const authServerEffective = (authServerFromProps || config?.authServer || "").replace(/\/+$/, "");
+    const redirectUriEffective = Config.getRedirectUri();
+    const tenantIdEffective = config?.tenantId || "";
+    const clientIdEffective = config?.client?.clientId || "";
+    logger.debug("[initiateAuthFlow] Resolved inputs", {
+      authServerFromProps: authServerFromProps ? "(provided)" : "(empty)",
+      authServerEffective,
+      redirectUriEffective,
+      tenantIdEffective,
+      clientIdEffective,
+      scopes: config?.client?.scopes,
+      hasRuntime: !!getAuthRuntime()
+    });
+    const token = getAccessToken();
+    if (token && !isAccessTokenExpired()) {
+      logger.debug("Valid token already exists, skipping auth flow");
+      clearFlowFlags();
+      return;
+    }
+    if (isCallbackUrl()) {
+      logger.debug("Callback URL detected - clearing flow flag to allow callback processing");
+      clearFlowFlags();
+      return;
+    }
+    if (isFlowInProgress()) {
+      if (isFlowFlagStale(3e3)) {
+        logger.info("Stale auth flow flag detected, clearing and proceeding");
+        clearFlowFlags();
+      } else {
+        logger.debug("Auth flow already in progress (recent), skipping duplicate redirect");
+        return;
+      }
+    }
+    setFlowFlags();
+    if (!(Config.getAuthServerUrl() || config?.authServer) || !config.client?.clientId || !config.client?.redirectUri) {
+      logger.error("[initiateAuthFlow] Missing required tenant config", {
+        authServerEffective,
+        clientId: config?.client?.clientId,
+        redirectUriFromTenantApi: config?.client?.redirectUri,
+        redirectUriEffective
+      });
+      throw new Error("Invalid tenant configuration for auth flow");
+    }
+    storeTenantConfig(config);
+    logger.debug("[initiateAuthFlow] Stored tenant config, generating PKCE");
+    removeStorage(getStorageKey("callback_processed"));
+    removeStorage(getStorageKey("state_mismatch"));
+    clearCallbackProcessing();
+    const codeVerifier = generateCodeVerifier();
+    const codeChallenge = await generateCodeChallenge(codeVerifier);
+    const state = generateState();
+    removeStorage(STORAGE_KEYS.codeVerifier);
+    removeStorage(STORAGE_KEYS.state);
+    setStorage(STORAGE_KEYS.codeVerifier, codeVerifier);
+    setStorage(STORAGE_KEYS.state, state);
+    const authUrl = buildAuthorizationUrl(config, codeChallenge, state);
+    logger.debug("[initiateAuthFlow] Built authorization URL", {
+      authServerEffective,
+      urlPrefix: authUrl?.slice(0, 80)
+    });
+    if (!authUrl || !(authUrl.startsWith("http://") || authUrl.startsWith("https://"))) {
+      throw new Error("Invalid authorization URL generated");
+    }
+    if (!checkAndIncrementRedirect()) {
+      logger.warn("Redirect loop protection: max redirect attempts exceeded");
+      clearFlowFlags();
+      return;
+    }
+    logger.info("Redirecting to authorization server");
+    emitAuthEvent(AuthEventNames.LOGIN_STARTED, { tenantKey: config.tenantKey });
+    const runtime = getAuthRuntime();
+    if (runtime) {
+      logger.debug("[initiateAuthFlow] Redirect via runtime.urlProvider.redirect");
+      runtime.urlProvider.redirect(authUrl);
+    } else if (typeof window !== "undefined") {
+      logger.debug("[initiateAuthFlow] Redirect via window.location.replace");
+      window.location.replace(authUrl);
+    } else {
+      logger.error("[initiateAuthFlow] No runtime and no window; cannot redirect", { authUrl });
+    }
+  } catch (error) {
+    clearFlowFlags();
+    logger.error("Failed to initiate auth flow", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+    throw error;
+  }
+}
+function buildAuthorizationUrl(config, codeChallenge, state) {
+  const authServerBase = (Config.getAuthServerUrl() || config.authServer || "").replace(/\/+$/, "");
+  if (isLocalhost2()) {
+    logger.debug("Building authorization URL", {
+      authServer: authServerBase,
+      clientId: config.client.clientId,
+      redirectUri: config.client.redirectUri,
+      scopes: config.client.scopes
+    });
+  }
+  const tenantIdToUse = config.tenantId;
+  const clientIdToUse = config.client.clientId;
+  const redirectUriToUse = Config.getRedirectUri();
+  const params = new URLSearchParams({
+    client_id: `public-${clientIdToUse}`,
+    tenant_id: tenantIdToUse,
+    redirect_uri: redirectUriToUse,
+    response_type: DEFAULT_RESPONSE_TYPE,
+    scope: config.client.scopes,
+    state,
+    code_challenge: codeChallenge,
+    code_challenge_method: DEFAULT_CODE_CHALLENGE_METHOD
+  });
+  return `${authServerBase}/connect/authorize?${params.toString()}`;
+}
+
 // src/application/flows/RefreshFlow.ts
 var RefreshFlow = class {
   async execute(context) {
@@ -1809,12 +1669,16 @@ var RefreshFlow = class {
         error: error instanceof Error ? error.message : String(error)
       });
     }
-    const tenantKey = getTenantKeyFromRuntime(getUrl(), runtime.configProvider);
+    const tenantKey = resolveTenantKey();
+    log.debug("[RefreshFlow] Tenant key resolved", {
+      tenantKey: tenantKey ?? "(null)",
+      source: tenantKey ? "resolved" : "none"
+    });
     if (!tenantKey) {
       throw new SanitizedError(
         "TENANT_KEY_RESOLUTION_FAILED",
         "Unable to resolve tenant",
-        new Error("Tenant key missing")
+        new Error(`Tenant key missing for refresh flow at url=${getUrl().href}`)
       );
     }
     const tenantConfig = await resolveTenantConfigCached(tenantKey, runtime.tenantResolver);
@@ -1843,12 +1707,17 @@ var TenantSwitchFlow = class {
     emitAuthEvent(AuthEventNames.TENANT_SWITCHED, { tenantKey: newTenantKey ?? void 0 });
     removeStorage(getStorageKey("tenant_switched"));
     removeStorage(getStorageKey("new_tenant_key"));
-    const tenantKey = newTenantKey || getTenantKeyFromRuntime(getUrl(), runtime.configProvider);
+    const tenantKey = (newTenantKey || resolveTenantKey())?.trim() || null;
+    log.debug("[TenantSwitchFlow] Tenant key resolved", {
+      tenantKey: tenantKey ?? "(null)",
+      fromNewTenantKey: newTenantKey ?? "(null)",
+      source: newTenantKey ? "new_tenant_key" : tenantKey ? "resolved" : "none"
+    });
     if (!tenantKey) {
       throw new SanitizedError(
         "TENANT_KEY_RESOLUTION_FAILED",
         "Unable to resolve tenant after switch",
-        new Error("Tenant key missing after switch")
+        new Error(`Tenant key missing after switch at url=${getUrl().href}`)
       );
     }
     const tenantConfig = await resolveTenantConfigCached(tenantKey, runtime.tenantResolver);
@@ -1859,6 +1728,16 @@ var TenantSwitchFlow = class {
         new Error(`Tenant config resolution failed for tenantKey: ${tenantKey}`)
       );
     }
+    try {
+      const cfg = getAuthConfig();
+      setStorage(getStorageKey("host_config"), JSON.stringify({
+        ...cfg,
+        tenantKey,
+        tenantCode: tenantKey,
+        clientCode: tenantConfig.client?.clientCode ?? cfg.clientCode ?? ""
+      }));
+    } catch {
+    }
     setTenantKey(tenantKey);
     storeTenantConfig(tenantConfig);
     await initiateAuthFlow(tenantConfig);
@@ -1883,13 +1762,16 @@ var LoginFlow = class {
     }
     const wasStateMismatch = getStorage(getStorageKey("state_mismatch")) === "true";
     if (wasStateMismatch) removeStorage(getStorageKey("state_mismatch"));
-    const tenantKey = getTenantKeyFromRuntime(url, runtime.configProvider);
-    log.debug("[LoginFlow] Tenant key resolved", { tenantKey: tenantKey ?? "(null)" });
+    const tenantKey = resolveTenantKey();
+    log.debug("[LoginFlow] Tenant key resolved", {
+      tenantKey: tenantKey ?? "(null)",
+      source: tenantKey ? "resolved" : "none"
+    });
     if (!tenantKey) {
       throw new SanitizedError(
         "TENANT_KEY_RESOLUTION_FAILED",
         "Unable to resolve tenant",
-        new Error("Tenant key missing")
+        new Error(`Tenant key missing for login flow at url=${url.href}`)
       );
     }
     log.debug("[LoginFlow] Resolving tenant config", { tenantKey });
@@ -1918,7 +1800,6 @@ var LoginFlow = class {
 };
 
 // src/application/flows/getFlowForState.ts
-var forceLoginFlow = new ForceLoginFlow();
 var callbackFlow = new CallbackFlow();
 var authenticatedFlow = new AuthenticatedFlow();
 var refreshFlow = new RefreshFlow();
@@ -1926,8 +1807,6 @@ var tenantSwitchFlow = new TenantSwitchFlow();
 var loginFlow = new LoginFlow();
 function getFlowForState(state) {
   switch (state) {
-    case "FORCE_LOGIN" /* FORCE_LOGIN */:
-      return forceLoginFlow;
     case "PROCESSING_CALLBACK" /* PROCESSING_CALLBACK */:
       return callbackFlow;
     case "AUTHENTICATED" /* AUTHENTICATED */:
@@ -2148,34 +2027,8 @@ function checkCookiesDeleted() {
 function handleCookieDeletion() {
   try {
     logger.info("Cookies deleted detected - clearing session and redirecting to login");
-    const forceLoginSet = getStorage(getStorageKey("force_login")) === "true";
-    const logoutInProgress = getStorage(getStorageKey("logout_in_progress")) === "true";
-    if (forceLoginSet || logoutInProgress) {
-      logger.debug(
-        "Force login or logout in progress - skipping bootstrap from cookie watcher (avoids duplicate by-code API call)"
-      );
-      return;
-    }
     clearAuthStorage();
-    try {
-      if (typeof window !== "undefined") {
-        const forceLogin = window.localStorage.getItem(getStorageKey("force_login"));
-        const logoutInProgressPreserve = window.localStorage.getItem(
-          getStorageKey("logout_in_progress")
-        );
-        clearAuthSessionStorage();
-        if (forceLogin === "true")
-          window.localStorage.setItem(getStorageKey("force_login"), "true");
-        if (logoutInProgressPreserve === "true")
-          window.localStorage.setItem(getStorageKey("logout_in_progress"), "true");
-      } else {
-        clearAuthSessionStorage();
-      }
-    } catch (error) {
-      logger.warn("Failed to clear sessionStorage", {
-        error: error instanceof Error ? error.message : String(error)
-      });
-    }
+    clearAuthSessionStorage();
     const cb = getSessionClearedCallback();
     if (cb) {
       Promise.resolve(cb()).catch((error) => {
@@ -2209,13 +2062,6 @@ function startCookieWatcher() {
     allCookies: initialCookies
   });
   watchInterval = setInterval(async () => {
-    const logoutInProgress = typeof window !== "undefined" && window.localStorage.getItem(getStorageKey("logout_in_progress")) === "true";
-    if (logoutInProgress) {
-      logger.debug("Logout detected. Cookie watcher will not trigger bootstrap.");
-      lastCookieSnapshot = getCookieSnapshot();
-      lastCookieMap = getCookieMap();
-      return;
-    }
     const cookiesDeleted = checkCookiesDeleted();
     if (cookiesDeleted) {
       logger.info("Cookies deleted detected by cookie watcher");
@@ -2301,11 +2147,6 @@ function startStorageWatcher() {
   storageEventListener = handleStorageEvent;
   window.addEventListener("storage", storageEventListener);
   const pollInterval = setInterval(() => {
-    const logoutInProgress = typeof window !== "undefined" && window.localStorage.getItem(getStorageKey("logout_in_progress")) === "true";
-    if (logoutInProgress) {
-      logger.debug("Logout detected. Storage watcher will not trigger bootstrap.");
-      return;
-    }
     const wasCleared = checkStorageCleared();
     if (wasCleared) {
       logger.info("Detected manual sessionStorage clear (polling)! Redirecting to login...");
@@ -2378,6 +2219,27 @@ function buildUrl(baseUrl, path) {
   url.pathname = url.pathname.endsWith("/") ? `${url.pathname}${normalizedPath.slice(1)}` : `${url.pathname}${normalizedPath}`;
   return url.toString();
 }
+function snapshotHostConfig() {
+  try {
+    const raw = getStorage(getStorageKey("host_config"));
+    if (!raw) return null;
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function restoreHostConfig(config) {
+  if (!config) return;
+  try {
+    setStorage(getStorageKey("host_config"), JSON.stringify(config));
+    logger.debug("Restored host_config after logout cleanup");
+  } catch (error) {
+    logger.warn("Failed to restore host_config after logout cleanup", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+  }
+}
 function getCsrfToken() {
   try {
     if (typeof document === "undefined") return null;
@@ -2485,9 +2347,14 @@ function releaseLogoutLock() {
   }
 }
 async function logout(tenantKey) {
-  setStorage(getStorageKey("force_login"), "true");
+  const preservedHostConfig = snapshotHostConfig();
   if (tenantKey?.trim()) {
-    setStorage(getStorageKey("preserved_tenant_key"), tenantKey.trim());
+    const updated = {
+      ...preservedHostConfig ?? {},
+      tenantKey: tenantKey.trim(),
+      tenantCode: tenantKey.trim()
+    };
+    setStorage(getStorageKey("host_config"), JSON.stringify(updated));
   }
   if (!acquireLogoutLock()) {
     return { success: true, message: "Logout already in progress." };
@@ -2495,7 +2362,8 @@ async function logout(tenantKey) {
   try {
     stopStorageWatcher();
     stopCookieWatcher();
-    const apiAuthBaseUrl = Config.getAuthServerUrl();
+    const authConfig = getAuthConfig();
+    const apiAuthBaseUrl = authConfig.authServerUrl || Config.getAuthServerUrl();
     let serverLogoutSuccess = false;
     let serverResponse;
     if (apiAuthBaseUrl) {
@@ -2514,25 +2382,7 @@ async function logout(tenantKey) {
       logger.warn("API auth base URL not configured, performing local logout only");
     }
     performLocalLogoutCleanup();
-    const preservedTenantKey = getStorage(getStorageKey("preserved_tenant_key"));
-    if (preservedTenantKey) {
-      const propsKey = getStorageKey("props_config");
-      let existing = {};
-      try {
-        const raw = getStorage(propsKey);
-        if (raw) {
-          existing = JSON.parse(raw);
-        }
-      } catch {
-        existing = {};
-      }
-      const merged = {
-        ...existing,
-        tenantKey: preservedTenantKey
-      };
-      setStorage(propsKey, JSON.stringify(merged));
-      removeStorage(getStorageKey("preserved_tenant_key"));
-    }
+    restoreHostConfig(preservedHostConfig);
     resetCookieWatcher();
     startStorageWatcher();
     releaseLogoutLock();
@@ -2542,7 +2392,7 @@ async function logout(tenantKey) {
     });
     emitAuthEvent(AuthEventNames.LOGOUT_COMPLETED, {
       serverLogoutSuccess,
-      tenantKey: getStorage(getStorageKey("preserved_tenant_key")) || void 0,
+      tenantKey: tenantKey?.trim() || preservedHostConfig?.tenantKey || void 0,
       message: serverLogoutSuccess ? "Server logout success" : "Local logout only"
     });
     return {
@@ -2555,25 +2405,7 @@ async function logout(tenantKey) {
       error: error instanceof Error ? error.message : String(error)
     });
     performLocalLogoutCleanup();
-    const preservedTenantKey = getStorage(getStorageKey("preserved_tenant_key"));
-    if (preservedTenantKey) {
-      const propsKey = getStorageKey("props_config");
-      let existing = {};
-      try {
-        const raw = getStorage(propsKey);
-        if (raw) {
-          existing = JSON.parse(raw);
-        }
-      } catch {
-        existing = {};
-      }
-      const merged = {
-        ...existing,
-        tenantKey: preservedTenantKey
-      };
-      setStorage(propsKey, JSON.stringify(merged));
-      removeStorage(getStorageKey("preserved_tenant_key"));
-    }
+    restoreHostConfig(preservedHostConfig);
     releaseLogoutLock();
     return {
       success: true,
@@ -2926,13 +2758,19 @@ function AuthProvider({
   }, [mergedTenantCode, mergedApiBaseUrl, mergedAuthServerUrl, mergedCallbackUrl]);
   react.useEffect(() => {
     try {
+      const hostConfigKey = getStorageKey("host_config");
+      const raw = getStorage(hostConfigKey);
+      const existing = raw ? JSON.parse(raw) : {};
       const payload = {
+        ...existing,
         tenantCode: mergedTenantCode ?? "",
+        tenantKey: mergedTenantCode ?? "",
+        appId: appId ?? "",
         apiBaseUrl: mergedApiBaseUrl ?? "",
         authServerUrl: mergedAuthServerUrl ?? "",
         callbackUrl: mergedCallbackUrl ?? ""
       };
-      setStorage(getStorageKey("host_config"), JSON.stringify(payload));
+      setStorage(hostConfigKey, JSON.stringify(payload));
     } catch {
     }
   }, [mergedTenantCode, mergedApiBaseUrl, mergedAuthServerUrl, mergedCallbackUrl]);
@@ -2976,24 +2814,18 @@ function AuthProvider({
           const currentUrl = window.location.href;
           const isCallback = currentUrl.includes("code=") || currentUrl.includes("state=");
           if (isCallback) {
-            const cleanUrl2 = window.location.origin + window.location.pathname;
-            window.history.replaceState({}, document.title, cleanUrl2);
+            const cleanUrl = window.location.origin + window.location.pathname;
+            window.history.replaceState({}, document.title, cleanUrl);
           }
         }
         removeStorage(getStorageKey("access_token"));
         removeStorage(getStorageKey("refresh_token"));
         removeStorage(getStorageKey("expires_at"));
-        removeStorage(getStorageKey("id_token"));
         removeStorage(getStorageKey("state"));
         removeStorage(getStorageKey("code_verifier"));
         removeStorage(getStorageKey("callback_processed"));
         clearCallbackProcessing();
         clearFlowFlags();
-        removeStorage(getStorageKey("tenant_id"));
-        if (typeof window !== "undefined") {
-          window.localStorage.removeItem(getStorageKey("force_login"));
-          window.localStorage.removeItem(getStorageKey("logout_in_progress"));
-        }
         setStorage(getStorageKey("props_changed"), "true");
         setStorage(getStorageKey("tenant_switched"), "true");
         setStorage(getStorageKey("new_tenant_key"), resolvedTenantKey2);
@@ -3006,7 +2838,17 @@ function AuthProvider({
       } else if (previousTenantKey) {
         logger.debug("[AuthProvider] TenantKey unchanged", { tenantKey: resolvedTenantKey2 });
       }
-      setStorage(getStorageKey("props_config"), JSON.stringify({ tenantKey: resolvedTenantKey2 }));
+      try {
+        const hostConfigKey = getStorageKey("host_config");
+        const raw = getStorage(hostConfigKey);
+        const existing = raw ? JSON.parse(raw) : {};
+        setStorage(hostConfigKey, JSON.stringify({
+          ...existing,
+          tenantKey: resolvedTenantKey2,
+          tenantCode: resolvedTenantKey2
+        }));
+      } catch {
+      }
       setStorage(getStorageKey("tenant_key"), resolvedTenantKey2);
     } else {
       logger.debug("[AuthProvider] No tenant code determined");
@@ -3205,17 +3047,29 @@ function AuthCallback({
       setStatus("loading");
       setMessage("Completing sign-in...");
       const handled = await handleCallback();
-      if (handled) {
-        const token = getAccessToken();
-        if (token) setTokens(token);
-        setStatus("success");
-        setMessage("Authentication successful. Redirecting...");
-        window.location.replace(successPath);
-      } else {
+      if (!handled) {
         setStatus("error");
         setMessage("Authentication failed. Please try again.");
         window.history.replaceState({}, document.title, window.location.origin + window.location.pathname);
+        return;
+      }
+      const startedAt = Date.now();
+      const MAX_WAIT_MS = 5e3;
+      while (true) {
+        const token = getAccessToken();
+        if (token) {
+          setTokens(token);
+          setStatus("success");
+          setMessage("Authentication successful. Redirecting...");
+          window.location.replace(successPath);
+          return;
+        }
+        if (Date.now() - startedAt > MAX_WAIT_MS) break;
+        await new Promise((r) => setTimeout(r, 200));
       }
+      setStatus("error");
+      setMessage("Authentication did not complete. Please try again.");
+      window.history.replaceState({}, document.title, window.location.origin + window.location.pathname);
     };
     runCallback();
   }, [homePath, loginPath, successPath, setTokens]);
@@ -3417,6 +3271,7 @@ exports.enforceHttps = enforceHttps;
 exports.ensureValidAccessToken = ensureValidAccessToken;
 exports.extractTenantKey = extractTenantKey;
 exports.getAccessToken = getAccessToken2;
+exports.getAuthConfig = getAuthConfig;
 exports.getAuthRuntime = getAuthRuntime;
 exports.getConfig = getConfig;
 exports.getStorageAdapter = getStorageAdapter;