tenneo-auth-plugin 0.1.7 → 0.1.9

package/dist/index.mjs

@@ -1,4 +1,3 @@
-import { z } from 'zod';
 import axios from 'axios';
 import { createContext, useContext, useMemo, useRef, useLayoutEffect, useEffect, useState, useCallback } from 'react';
 import { jsx, jsxs, Fragment } from 'react/jsx-runtime';
@@ -67,13 +66,11 @@ function extractTenantKeyFromUrl(url, config, getStorage3, getKey) {
     if (keyFromHost) return keyFromHost;
     const clientCode = config.getClientCode();
     if (clientCode?.trim()) return clientCode.trim();
-    const tenantId = config.getTenantId();
-    if (tenantId?.trim()) return tenantId.trim();
     return config.getClientCode();
   } catch {
     const clientCode = config.getClientCode();
     if (clientCode?.trim()) return clientCode.trim();
-    return config.getTenantId() || config.getClientCode();
+    return config.getClientCode();
   }
 }
 function isCallbackUrlFromUrl(url) {
@@ -804,85 +801,6 @@ function generateState() {
   return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
 
-// src/config/env.ts
-var ENV_KEYS = {
-  CLIENT_ID: ["VITE_CLIENT_ID", "CLIENT_ID"],
-  TENANT_ID: ["VITE_TENANT_ID", "TENANT_ID"],
-  CLIENTCODE: ["VITE_CLIENTCODE", "CLIENTCODE"]
-};
-function getEnvValue(keys) {
-  try {
-    const g = typeof globalThis !== "undefined" ? globalThis : null;
-    const env = g?.process && typeof g.process.env === "object" ? g.process.env : null;
-    if (env) {
-      for (const key of keys) {
-        const v = env[key];
-        if (v != null && String(v).trim()) return String(v).trim();
-      }
-    }
-  } catch {
-  }
-  try {
-    const meta = typeof import.meta !== "undefined" ? import.meta.env : void 0;
-    if (meta) {
-      for (const key of keys) {
-        const v = meta[key];
-        if (v != null && String(v).trim()) return String(v).trim();
-      }
-    }
-  } catch {
-  }
-  return "";
-}
-var FORBIDDEN_WINDOW_KEYS = ["apiBaseUrl", "apiTenantResolutionBaseUrl", "apiAuthBaseUrl", "authServerUrl", "defaultDomain", "API_BASE_URL", "AUTH_SERVER_URL", "DEFAULT_DOMAIN"];
-function getWindowConfigRaw() {
-  if (typeof window === "undefined") return null;
-  const w = window;
-  const raw = w.__AUTH_CONFIG__ ?? w.__APP_CONFIG__;
-  if (!raw || typeof raw !== "object") return null;
-  for (const forbidden of FORBIDDEN_WINDOW_KEYS) {
-    if (forbidden in raw) {
-      throw new Error("Attempted to override protected internal configuration");
-    }
-  }
-  const out = {};
-  const map = {
-    clientId: "CLIENT_ID",
-    tenantId: "TENANT_ID",
-    clientcode: "CLIENTCODE"
-  };
-  for (const [winKey, sdkKey] of Object.entries(map)) {
-    const v = raw[winKey];
-    if (v != null && typeof v === "string" && v.trim()) out[sdkKey] = v.trim();
-  }
-  return Object.keys(out).length ? out : null;
-}
-function loadEnvConfig() {
-  const partial = {};
-  for (const [key, envKeys] of Object.entries(ENV_KEYS)) {
-    const v = getEnvValue(envKeys);
-    if (v) partial[key] = v;
-  }
-  return partial;
-}
-function loadWindowConfig() {
-  const raw = getWindowConfigRaw();
-  if (!raw) return null;
-  return raw;
-}
-var schema = z.object({
-  CLIENT_ID: z.string().min(1, "CLIENT_ID is required"),
-  TENANT_ID: z.string().min(1, "TENANT_ID is required"),
-  CLIENTCODE: z.string().min(1, "CLIENTCODE is required")
-});
-function validateConfig(data) {
-  return schema.parse(data);
-}
-
-// src/config/types.ts
-var INTERNAL_CONFIG_KEYS = ["API_TENANT_RESOLUTION_BASE_URL", "API_AUTH_BASE_URL", "AUTH_SERVER_URL", "DEFAULT_DOMAIN"];
-var RUNTIME_CONFIG_KEYS = ["CLIENT_ID", "TENANT_ID", "CLIENTCODE"];
-
 // src/config/constants.ts
 var OAUTH_CONSTANTS = {
   SCOPES: "openid profile email",
@@ -910,232 +828,63 @@ var DEFAULT_TOKEN_GRANT_TYPE = OAUTH_CONSTANTS.TOKEN_GRANT_TYPE;
 var DEFAULT_REFRESH_GRANT_TYPE = OAUTH_CONSTANTS.REFRESH_GRANT_TYPE;
 
 // src/config/index.ts
-var INTERNAL_DEFAULTS = {
-  API_TENANT_RESOLUTION_BASE_URL: "https://localhost:5020/api/v1",
-  API_AUTH_BASE_URL: "https://localhost:5001",
-  AUTH_SERVER_URL: "https://localhost:5001",
-  DEFAULT_DOMAIN: "https://localhost:5001"
-};
-function envOr(key) {
-  const v = getEnvValue([`VITE_${key}`, key]);
-  return v && v.trim() ? v.trim() : INTERNAL_DEFAULTS[key];
-}
-var INTERNAL_CONFIG = Object.freeze({
-  API_TENANT_RESOLUTION_BASE_URL: envOr("API_TENANT_RESOLUTION_BASE_URL"),
-  API_AUTH_BASE_URL: envOr("API_AUTH_BASE_URL"),
-  AUTH_SERVER_URL: envOr("AUTH_SERVER_URL"),
-  DEFAULT_DOMAIN: envOr("DEFAULT_DOMAIN")
-});
-var RUNTIME_CONFIG_DEFAULTS = Object.freeze({
-  CLIENT_ID: "tenneo",
-  TENANT_ID: "00000000-0000-0000-0000-000000000001",
-  CLIENTCODE: "productlms"
-});
-function pickRuntimeConfig(source) {
-  if (!source) return {};
-  const picked = {};
-  for (const key of RUNTIME_CONFIG_KEYS) {
-    const value = source[key];
-    if (value != null && typeof value === "string") {
-      const trimmed = value.trim();
-      if (trimmed) picked[key] = trimmed;
-    }
-  }
-  return picked;
-}
-({
-  ...INTERNAL_CONFIG,
-  ...RUNTIME_CONFIG_DEFAULTS
-});
-var runtimeOverrides = {};
-var runtimeConfigOverrides = {};
-function mergeRuntime(base, ...sources) {
-  let out = { ...base };
-  for (const src of sources) {
-    if (!src) continue;
-    for (const key of Object.keys(src)) {
-      const value = src[key];
-      if (value != null && String(value).trim() !== "") out[key] = String(value).trim();
-    }
-  }
-  return out;
-}
-function assertNoInternalOverrides(source) {
-  if (!source) return;
-  for (const key of INTERNAL_CONFIG_KEYS) {
-    if (source[key] !== void 0) throw new Error("Attempted to override protected internal configuration");
-  }
-}
-var INTERNAL_KEY_SET = new Set(INTERNAL_CONFIG_KEYS);
-var HOST_TO_RUNTIME_KEYS = {
-  clientId: "CLIENT_ID",
-  tenantId: "TENANT_ID",
-  clientcode: "CLIENTCODE"
-};
-function sanitizeRuntimeOverrides(source) {
-  if (!source) return void 0;
-  const filtered = {};
-  for (const [key, raw] of Object.entries(source)) {
-    if (raw == null) continue;
-    if (INTERNAL_KEY_SET.has(key)) continue;
-    const trimmed = String(raw).trim();
-    if (!trimmed) continue;
-    const sdkKey = HOST_TO_RUNTIME_KEYS[key] ?? key;
-    filtered[sdkKey] = trimmed;
-  }
-  const picked = pickRuntimeConfig(filtered);
-  return Object.keys(picked).length ? picked : void 0;
+var inMemoryConfig = {};
+function readHostConfigFromStorage() {
+  try {
+    const raw = getStorage(getStorageKey("host_config"));
+    if (!raw) return {};
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function resolveMerged(overrides) {
+  const stored = readHostConfigFromStorage();
+  const cfg = { ...stored, ...inMemoryConfig, ...overrides ?? {} };
+  const trimmed = (v) => v == null ? "" : String(v).trim();
+  return {
+    apiBaseUrl: trimmed(cfg.apiBaseUrl),
+    authServerUrl: trimmed(cfg.authServerUrl),
+    callbackUrl: trimmed(cfg.callbackUrl),
+    clientCode: trimmed(cfg.clientCode)
+  };
 }
 function resolveConfig(overrides) {
-  assertNoInternalOverrides(runtimeOverrides);
-  assertNoInternalOverrides(overrides);
-  const windowCfg = loadWindowConfig();
-  const envCfg = loadEnvConfig();
-  const mergedRuntime = mergeRuntime(
-    RUNTIME_CONFIG_DEFAULTS,
-    envCfg,
-    windowCfg ?? void 0,
-    runtimeOverrides,
-    sanitizeRuntimeOverrides(overrides)
-  );
-  const validatedRuntime = validateConfig(mergedRuntime);
-  return { ...INTERNAL_CONFIG, ...validatedRuntime };
+  return resolveMerged(overrides);
 }
 function getConfig() {
-  return resolveConfig();
+  return resolveMerged();
 }
 function setConfig(overrides) {
-  assertNoInternalOverrides(overrides);
-  const sanitized = sanitizeRuntimeOverrides(overrides);
-  if (sanitized) runtimeOverrides = { ...runtimeOverrides, ...sanitized };
-  const { basePath, redirectUri } = overrides;
-  if (basePath != null && basePath.trim() !== "") runtimeConfigOverrides = { ...runtimeConfigOverrides, basePath: basePath.trim() };
-  if (redirectUri != null && redirectUri.trim() !== "") runtimeConfigOverrides = { ...runtimeConfigOverrides, redirectUri: redirectUri.trim() };
+  inMemoryConfig = { ...inMemoryConfig, ...overrides };
 }
 function clearConfigOverrides() {
-  runtimeOverrides = {};
-  runtimeConfigOverrides = {};
-}
-function getWindowBasePath() {
-  if (typeof window === "undefined") return "";
-  const w = window;
-  const raw = w.__AUTH_CONFIG__ ?? w.__APP_CONFIG__;
-  const bp = raw?.basePath;
-  if (bp != null && typeof bp === "string" && bp.trim()) return bp.trim();
-  const pathname = window.location.pathname;
-  const segments = pathname.split("/").filter(Boolean);
-  const commonRoutes = ["dashboards", "callback", "confirmation", "client-confirmed", "client-provisioned", "approval-completed"];
-  if (segments.length > 0 && !commonRoutes.includes(segments[0])) {
-    let base = "/" + segments[0];
-    if (base.endsWith("/")) base = base.slice(0, -1);
-    return base;
-  }
-  return "";
-}
-function getBasePath() {
-  if (runtimeConfigOverrides.basePath != null && runtimeConfigOverrides.basePath !== "") return runtimeConfigOverrides.basePath;
-  return getWindowBasePath();
+  inMemoryConfig = {};
 }
 function getRedirectUri2() {
-  if (typeof window !== "undefined") {
-    return `${window.location.origin}/callback`;
-  }
-  return getEnvValue(["VITE_REDIRECT_URI", "REDIRECT_URI"]) || "http://localhost:5173/callback";
-}
-function hasRuntimeConfig() {
-  return loadWindowConfig() !== null || Object.keys(runtimeOverrides).length > 0;
+  const cfg = resolveMerged();
+  if (cfg.callbackUrl) return cfg.callbackUrl;
+  if (typeof window !== "undefined") return `${window.location.origin}/callback`;
+  return "";
 }
 var Config = {
-  getApiTenantResolutionBaseUrl() {
-    return getConfig().API_TENANT_RESOLUTION_BASE_URL;
-  },
-  getApiAuthBaseUrl() {
-    return getConfig().API_AUTH_BASE_URL;
+  getApiBaseUrl() {
+    return resolveMerged().apiBaseUrl;
   },
   getAuthServerUrl() {
-    return getConfig().AUTH_SERVER_URL;
-  },
-  getDefaultDomain() {
-    return getConfig().DEFAULT_DOMAIN;
-  },
-  getClientId() {
-    return getConfig().CLIENT_ID;
-  },
-  getTenantId() {
-    return getConfig().TENANT_ID;
+    return resolveMerged().authServerUrl;
   },
   getClientCode() {
-    return getConfig().CLIENTCODE;
+    return resolveMerged().clientCode;
   },
   getRedirectUri() {
     return getRedirectUri2();
   },
-  getBasePath() {
-    return getBasePath();
-  },
-  hasRuntimeConfig() {
-    return hasRuntimeConfig();
-  },
   getAll() {
-    const c = getConfig();
-    return {
-      apiTenantResolutionBaseUrl: c.API_TENANT_RESOLUTION_BASE_URL,
-      apiAuthBaseUrl: c.API_AUTH_BASE_URL,
-      authServerUrl: c.AUTH_SERVER_URL,
-      defaultDomain: c.DEFAULT_DOMAIN,
-      clientId: c.CLIENT_ID,
-      tenantId: c.TENANT_ID,
-      clientCode: c.CLIENTCODE,
-      redirectUri: getRedirectUri2(),
-      basePath: getBasePath()
-    };
+    return resolveMerged();
   }
 };
-({
-  AUTH_SERVER_URL: Config.getAuthServerUrl(),
-  CLIENT_ID: Config.getClientId(),
-  TENANT_ID: Config.getTenantId(),
-  CLIENTCODE: Config.getClientCode()
-});
-function getEnvConfig() {
-  const authServerUrl = Config.getAuthServerUrl();
-  const clientId = Config.getClientId();
-  const tenantId = Config.getTenantId();
-  const redirectUri = Config.getRedirectUri();
-  try {
-    new URL(authServerUrl);
-    new URL(redirectUri);
-  } catch {
-    return Promise.resolve(null);
-  }
-  return Promise.resolve({
-    authServerUrl: authServerUrl.trim(),
-    clientId: clientId.trim(),
-    redirectUri: redirectUri.trim(),
-    tenantId: tenantId.trim()
-  });
-}
-function getEnvConfigSync() {
-  const authServerUrl = Config.getAuthServerUrl();
-  const clientId = Config.getClientId();
-  const tenantId = Config.getTenantId();
-  const redirectUri = Config.getRedirectUri();
-  try {
-    new URL(authServerUrl);
-    new URL(redirectUri);
-  } catch {
-    return null;
-  }
-  return {
-    authServerUrl: authServerUrl.trim(),
-    clientId: clientId.trim(),
-    redirectUri: redirectUri.trim(),
-    tenantId: tenantId.trim()
-  };
-}
-function hasEnvFallback() {
-  return getEnvConfigSync() !== null;
-}
 
 // src/utils/validation.ts
 function isValidGuid(guid) {
@@ -1289,7 +1038,8 @@ function storeTenantConfig(config) {
   if (!validation.isValid) {
     logger.warn("Tenant ID validation failed", { tenantId: config.tenantId });
   }
-  setStorage(STORAGE_KEYS.authServerUrl, config.authServer);
+  const authServerToStore = Config.getAuthServerUrl() || config.authServer;
+  setStorage(STORAGE_KEYS.authServerUrl, authServerToStore);
   setStorage(STORAGE_KEYS.clientId, config.client.clientId);
   setStorage(STORAGE_KEYS.redirectUri, Config.getRedirectUri());
   setStorage(STORAGE_KEYS.tenantId, config.tenantId);
@@ -1300,6 +1050,22 @@ function storeTenantConfig(config) {
 async function initiateAuthFlow(config) {
   try {
     logger.info("Initiating OAuth authorization flow");
+    const authServerFromProps = Config.getAuthServerUrl();
+    const authServerEffective = (authServerFromProps || config?.authServer || "").replace(/\/+$/, "");
+    const redirectUriEffective = Config.getRedirectUri();
+    const storedTenantId = getStorage(STORAGE_KEYS.tenantId);
+    const storedClientId = getStorage(STORAGE_KEYS.clientId);
+    const tenantIdEffective = storedTenantId || config?.tenantId || "";
+    const clientIdEffective = storedClientId || config?.client?.clientId || "";
+    logger.debug("[initiateAuthFlow] Resolved inputs", {
+      authServerFromProps: authServerFromProps ? "(provided)" : "(empty)",
+      authServerEffective,
+      redirectUriEffective,
+      tenantIdEffective,
+      clientIdEffective,
+      scopes: config?.client?.scopes,
+      hasRuntime: !!getAuthRuntime()
+    });
     const token = getAccessToken();
     if (token && !isAccessTokenExpired()) {
       logger.debug("Valid token already exists, skipping auth flow");
@@ -1321,10 +1087,17 @@ async function initiateAuthFlow(config) {
       }
     }
     setFlowFlags();
-    if (!config?.authServer || !config.client?.clientId || !config.client?.redirectUri) {
+    if (!(Config.getAuthServerUrl() || config?.authServer) || !config.client?.clientId || !config.client?.redirectUri) {
+      logger.error("[initiateAuthFlow] Missing required tenant config", {
+        authServerEffective,
+        clientId: config?.client?.clientId,
+        redirectUriFromTenantApi: config?.client?.redirectUri,
+        redirectUriEffective
+      });
       throw new Error("Invalid tenant configuration for auth flow");
     }
     storeTenantConfig(config);
+    logger.debug("[initiateAuthFlow] Stored tenant config, generating PKCE");
     const codeVerifier = generateCodeVerifier();
     const codeChallenge = await generateCodeChallenge(codeVerifier);
     const state = generateState();
@@ -1333,6 +1106,10 @@ async function initiateAuthFlow(config) {
     setStorage(STORAGE_KEYS.codeVerifier, codeVerifier);
     setStorage(STORAGE_KEYS.state, state);
     const authUrl = buildAuthorizationUrl(config, codeChallenge, state);
+    logger.debug("[initiateAuthFlow] Built authorization URL", {
+      authServerEffective,
+      urlPrefix: authUrl?.slice(0, 80)
+    });
     if (!authUrl || !(authUrl.startsWith("http://") || authUrl.startsWith("https://"))) {
       throw new Error("Invalid authorization URL generated");
     }
@@ -1344,8 +1121,15 @@ async function initiateAuthFlow(config) {
     logger.info("Redirecting to authorization server");
     emitAuthEvent(AuthEventNames.LOGIN_STARTED, { tenantKey: config.tenantKey });
     const runtime = getAuthRuntime();
-    if (runtime) runtime.urlProvider.redirect(authUrl);
-    else if (typeof window !== "undefined") window.location.replace(authUrl);
+    if (runtime) {
+      logger.debug("[initiateAuthFlow] Redirect via runtime.urlProvider.redirect");
+      runtime.urlProvider.redirect(authUrl);
+    } else if (typeof window !== "undefined") {
+      logger.debug("[initiateAuthFlow] Redirect via window.location.replace");
+      window.location.replace(authUrl);
+    } else {
+      logger.error("[initiateAuthFlow] No runtime and no window; cannot redirect", { authUrl });
+    }
   } catch (error) {
     clearFlowFlags();
     logger.error("Failed to initiate auth flow", {
@@ -1355,9 +1139,10 @@ async function initiateAuthFlow(config) {
   }
 }
 function buildAuthorizationUrl(config, codeChallenge, state) {
+  const authServerBase = (Config.getAuthServerUrl() || config.authServer || "").replace(/\/+$/, "");
   if (isLocalhost2()) {
     logger.debug("Building authorization URL", {
-      authServer: config.authServer,
+      authServer: authServerBase,
       clientId: config.client.clientId,
       redirectUri: config.client.redirectUri,
       scopes: config.client.scopes
@@ -1378,7 +1163,7 @@ function buildAuthorizationUrl(config, codeChallenge, state) {
     code_challenge: codeChallenge,
     code_challenge_method: DEFAULT_CODE_CHALLENGE_METHOD
   });
-  return `${config.authServer}/connect/authorize?${params.toString()}`;
+  return `${authServerBase}/connect/authorize?${params.toString()}`;
 }
 
 // src/strategies/oauth2-pkce/token-exchange.ts
@@ -1408,7 +1193,7 @@ function storeTokens(tokenData) {
 async function exchangeCodeForTokens(params) {
   try {
     const { code, codeVerifier, clientId, redirectUri } = params;
-    const apiAuthBaseUrl = Config.getApiAuthBaseUrl();
+    const apiAuthBaseUrl = Config.getAuthServerUrl();
     const tokenUrl = `${apiAuthBaseUrl}/oauth/token`;
     const body = new URLSearchParams({
       grant_type: DEFAULT_TOKEN_GRANT_TYPE,
@@ -1482,7 +1267,7 @@ async function refreshAccessToken() {
         });
         throw new Error("Cannot refresh token: missing required data");
       }
-      const apiAuthBaseUrl = Config.getApiAuthBaseUrl();
+      const apiAuthBaseUrl = Config.getApiBaseUrl();
       const tokenUrl = `${apiAuthBaseUrl}/oauth/refresh`;
       const body = new URLSearchParams({
         grant_type: DEFAULT_REFRESH_GRANT_TYPE,
@@ -1879,40 +1664,15 @@ function mergeConfigWithProps(apiEnvConfig, propsConfig, tenantKey) {
     }
   };
 }
-async function buildTenantConfigFromEnv() {
-  const envConfig = await getEnvConfig();
-  if (!envConfig) return null;
-  return {
-    tenantId: envConfig.tenantId,
-    authServer: envConfig.authServerUrl,
-    client: {
-      clientId: envConfig.clientId,
-      redirectUri: envConfig.redirectUri,
-      scopes: "openid profile email"
-    }
-  };
-}
 async function resolveTenantConfig(tenantKey, tenantResolver) {
   if (!tenantKey) return null;
   const propsConfig = getPropsConfig();
-  let apiEnvConfig = null;
-  let apiResolved = false;
-  apiEnvConfig = await tenantResolver.resolve(tenantKey);
-  apiResolved = !!apiEnvConfig;
-  if (!apiEnvConfig) {
-    apiEnvConfig = await buildTenantConfigFromEnv();
-  }
-  if (!apiEnvConfig) return null;
-  if (!apiResolved && propsConfig) {
-    const mergedConfig = mergeConfigWithProps(apiEnvConfig, propsConfig, tenantKey);
-    removeStorage(getStorageKey("props_config"));
-    logger.info("Merged props config with ENV fallback config");
-    return mergedConfig;
-  }
+  const resolved = await tenantResolver.resolve(tenantKey);
+  if (!resolved) return null;
   removeStorage(getStorageKey("props_config"));
   return {
-    ...apiEnvConfig,
-    tenantKey: tenantKey || apiEnvConfig.tenantKey
+    ...propsConfig ? mergeConfigWithProps(resolved, propsConfig, tenantKey) : resolved,
+    tenantKey: tenantKey || resolved.tenantKey
   };
 }
 async function resolveTenantConfigCached(tenantKey, tenantResolver) {
@@ -2106,6 +1866,8 @@ var LoginFlow = class {
     const { runtime } = context;
     const { logger: log } = runtime;
     const getUrl = () => runtime.urlProvider.getCurrentUrl();
+    const url = getUrl();
+    log.debug("[LoginFlow] Start", { url: url.href, pathname: url.pathname, search: url.search });
     const callbackProcessed = getStorage(getStorageKey("callback_processed")) === "true";
     const token = getAccessToken();
     if (callbackProcessed && !token) {
@@ -2115,7 +1877,8 @@ var LoginFlow = class {
     }
     const wasStateMismatch = getStorage(getStorageKey("state_mismatch")) === "true";
     if (wasStateMismatch) removeStorage(getStorageKey("state_mismatch"));
-    const tenantKey = getTenantKeyFromRuntime(getUrl(), runtime.configProvider);
+    const tenantKey = getTenantKeyFromRuntime(url, runtime.configProvider);
+    log.debug("[LoginFlow] Tenant key resolved", { tenantKey: tenantKey ?? "(null)" });
     if (!tenantKey) {
       throw new SanitizedError(
         "TENANT_KEY_RESOLUTION_FAILED",
@@ -2123,7 +1886,15 @@ var LoginFlow = class {
         new Error("Tenant key missing")
       );
     }
+    log.debug("[LoginFlow] Resolving tenant config", { tenantKey });
     const tenantConfig = await resolveTenantConfigCached(tenantKey, runtime.tenantResolver);
+    log.debug("[LoginFlow] Tenant config resolved", {
+      ok: !!tenantConfig,
+      tenantId: tenantConfig?.tenantId,
+      authServer: tenantConfig?.authServer ? "(set)" : "(empty)",
+      clientId: tenantConfig?.client?.clientId,
+      redirectUri: tenantConfig?.client?.redirectUri
+    });
     if (!tenantConfig) {
       throw new SanitizedError(
         "TENANT_CONFIG_RESOLUTION_FAILED",
@@ -2133,7 +1904,9 @@ var LoginFlow = class {
     }
     setTenantKey(tenantKey);
     storeTenantConfig(tenantConfig);
+    log.debug("[LoginFlow] Stored tenant config, initiating auth flow");
     await initiateAuthFlow(tenantConfig);
+    log.debug("[LoginFlow] Auth flow initiated (redirect should happen)");
     return { completed: true };
   }
 };
@@ -2482,7 +2255,74 @@ function resetCookieWatcher() {
     authCookies
   });
 }
+
+// src/infrastructure/watchers/storage-watcher.ts
+var isWatching2 = false;
+var lastStorageCheck = null;
+var storageEventListener = null;
+function checkStorageCleared() {
+  try {
+    const hasAnyAuthData = Object.values(STORAGE_KEYS).some(
+      (key) => getStorage(key) !== null
+    );
+    if (lastStorageCheck === "had_data" && !hasAnyAuthData) return true;
+    lastStorageCheck = hasAnyAuthData ? "had_data" : "no_data";
+    return false;
+  } catch {
+    return false;
+  }
+}
+function handleStorageEvent(event) {
+  if (typeof window !== "undefined" && event.storageArea === window.sessionStorage) {
+    const wasCleared = checkStorageCleared();
+    if (wasCleared) {
+      logger.info("Detected manual sessionStorage clear! Redirecting to login...");
+      const cb = getSessionClearedCallback();
+      if (cb) {
+        Promise.resolve(cb()).catch((error) => {
+          logger.error("Failed to redirect to login after manual clear", {
+            error: error instanceof Error ? error.message : String(error)
+          });
+        });
+      }
+    }
+  }
+}
+function startStorageWatcher() {
+  if (isWatching2) return;
+  isWatching2 = true;
+  checkStorageCleared();
+  storageEventListener = handleStorageEvent;
+  window.addEventListener("storage", storageEventListener);
+  const pollInterval = setInterval(() => {
+    const logoutInProgress = typeof window !== "undefined" && window.localStorage.getItem(getStorageKey("logout_in_progress")) === "true";
+    if (logoutInProgress) {
+      logger.debug("Logout detected. Storage watcher will not trigger bootstrap.");
+      return;
+    }
+    const wasCleared = checkStorageCleared();
+    if (wasCleared) {
+      logger.info("Detected manual sessionStorage clear (polling)! Redirecting to login...");
+      clearInterval(pollInterval);
+      const cb = getSessionClearedCallback();
+      if (cb) {
+        Promise.resolve(cb()).catch((error) => {
+          logger.error("Failed to redirect to login after manual clear", {
+            error: error instanceof Error ? error.message : String(error)
+          });
+          if (!isWatching2) startStorageWatcher();
+        });
+      }
+    }
+  }, 1e3);
+  window.__tenneo_auth_storage_watcher_interval = pollInterval;
+}
 function stopStorageWatcher() {
+  isWatching2 = false;
+  if (storageEventListener) {
+    window.removeEventListener("storage", storageEventListener);
+    storageEventListener = null;
+  }
   const win = window;
   const intervalId = win.__tenneo_auth_storage_watcher_interval;
   if (intervalId) {
@@ -2532,51 +2372,68 @@ function buildUrl(baseUrl, path) {
   url.pathname = url.pathname.endsWith("/") ? `${url.pathname}${normalizedPath.slice(1)}` : `${url.pathname}${normalizedPath}`;
   return url.toString();
 }
-async function callServerLogout(logoutUrl) {
+function getCsrfToken() {
   try {
+    if (typeof document === "undefined") return null;
+    const meta = document.querySelector('meta[name="csrf-token"]');
+    if (meta?.content) return meta.content;
+    const match = document.cookie.match(/(?:^|;\s*)XSRF-TOKEN=([^;]+)/i);
+    if (match) return decodeURIComponent(match[1]);
+    return null;
+  } catch {
+    return null;
+  }
+}
+async function callServerLogout(logoutUrl) {
+  const csrfToken = getCsrfToken();
+  async function doRequest(method) {
+    const isPost = method === "POST";
+    const headers = {
+      "X-Requested-With": "XMLHttpRequest",
+      Accept: "application/json, */*"
+    };
+    if (isPost) {
+      headers["Content-Type"] = "application/x-www-form-urlencoded";
+    }
+    if (csrfToken) {
+      headers["X-CSRF-Token"] = csrfToken;
+    }
     const response = await fetch(logoutUrl, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/x-www-form-urlencoded",
-        "X-Requested-With": "XMLHttpRequest",
-        Accept: "application/json"
-      },
+      method,
+      mode: "cors",
+      headers,
       credentials: "include"
     });
+    if (!response.ok) {
+      logger.warn("Server logout HTTP error", {
+        method,
+        status: response.status,
+        statusText: response.statusText
+      });
+      return { success: false };
+    }
     const data = await response.json().catch(() => ({}));
-    logger.info("Server logout response (POST)", { response: data });
+    logger.info(`Server logout response (${method})`, { response: data });
     if (data && (data.success === true || data.logout === true)) {
       return { success: true, response: data };
     }
-    logger.warn("Server logout response invalid (POST)", { response: data });
+    logger.warn("Server logout response invalid payload", {
+      method,
+      response: data
+    });
     return { success: false, response: data };
+  }
+  try {
+    const postResult = await doRequest("POST");
+    if (postResult.success) return postResult;
+    logger.debug("POST logout did not succeed, trying GET");
+    const getResult = await doRequest("GET");
+    return getResult;
   } catch (error) {
-    logger.debug("POST logout failed, trying GET", {
+    logger.warn("Server logout failed (both POST and GET)", {
       error: error instanceof Error ? error.message : String(error)
     });
-    try {
-      const response = await fetch(logoutUrl, {
-        method: "GET",
-        headers: {
-          "X-Requested-With": "XMLHttpRequest",
-          Accept: "application/json"
-        },
-        credentials: "include"
-      });
-      const data = await response.json().catch(() => ({}));
-      logger.info("Server logout response (GET)", { response: data });
-      if (data && (data.success === true || data.logout === true)) {
-        return { success: true, response: data };
-      }
-      logger.warn("Server logout response invalid (GET)", { response: data });
-      return { success: false, response: data };
-    } catch (getError) {
-      logger.warn("Server logout failed (both POST and GET)", {
-        postError: error instanceof Error ? error.message : String(error),
-        getError: getError instanceof Error ? getError.message : String(getError)
-      });
-      return { success: false };
-    }
+    return { success: false };
   }
 }
 function performLocalLogoutCleanup() {
@@ -2589,22 +2446,50 @@ function performLocalLogoutCleanup() {
     });
   }
   clearClientCookies();
-  clearAllStorage();
+  try {
+    clearAuthStorage();
+  } catch (error) {
+    logger.warn("clearAuthStorage failed (ignored)", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+  }
   logger.info("Local logout cleanup completed");
 }
+function acquireLogoutLock() {
+  const LOCK_KEY = getStorageKey("logout_lock");
+  const now = Date.now();
+  const existingLock = getStorage(LOCK_KEY);
+  if (existingLock) {
+    const lockTime = Number(existingLock);
+    if (!Number.isNaN(lockTime) && now - lockTime < 5e3) {
+      logger.debug("Logout lock active \u2013 skipping duplicate logout", {
+        now,
+        lockTime
+      });
+      return false;
+    }
+  }
+  setStorage(LOCK_KEY, String(now));
+  return true;
+}
+function releaseLogoutLock() {
+  try {
+    removeStorage(getStorageKey("logout_lock"));
+  } catch {
+  }
+}
 async function logout(tenantKey) {
-  setStorage(getStorageKey("logout_in_progress"), "true");
   setStorage(getStorageKey("force_login"), "true");
-  if (tenantKey?.trim()) setStorage(getStorageKey("preserved_tenant_key"), tenantKey.trim());
-  if (getStorage(getStorageKey("logout_processing")) === "true") {
-    logger.debug("Logout already in progress \u2013 skipping duplicate call");
+  if (tenantKey?.trim()) {
+    setStorage(getStorageKey("preserved_tenant_key"), tenantKey.trim());
+  }
+  if (!acquireLogoutLock()) {
     return { success: true, message: "Logout already in progress." };
   }
-  setStorage(getStorageKey("logout_processing"), "true");
   try {
     stopStorageWatcher();
     stopCookieWatcher();
-    const apiAuthBaseUrl = Config.getApiAuthBaseUrl();
+    const apiAuthBaseUrl = Config.getAuthServerUrl();
     let serverLogoutSuccess = false;
     let serverResponse;
     if (apiAuthBaseUrl) {
@@ -2613,20 +2498,45 @@ async function logout(tenantKey) {
       const logoutResult = await callServerLogout(logoutUrl);
       serverLogoutSuccess = logoutResult.success;
       serverResponse = logoutResult.response;
+      if (!serverLogoutSuccess) {
+        logger.warn("Server logout failed \u2013 session may still exist", {
+          logoutUrl,
+          serverResponse
+        });
+      }
+    } else {
+      logger.warn("API auth base URL not configured, performing local logout only");
     }
     performLocalLogoutCleanup();
     const preservedTenantKey = getStorage(getStorageKey("preserved_tenant_key"));
     if (preservedTenantKey) {
-      setStorage(getStorageKey("props_config"), JSON.stringify({ tenantKey: preservedTenantKey }));
+      const propsKey = getStorageKey("props_config");
+      let existing = {};
+      try {
+        const raw = getStorage(propsKey);
+        if (raw) {
+          existing = JSON.parse(raw);
+        }
+      } catch {
+        existing = {};
+      }
+      const merged = {
+        ...existing,
+        tenantKey: preservedTenantKey
+      };
+      setStorage(propsKey, JSON.stringify(merged));
       removeStorage(getStorageKey("preserved_tenant_key"));
     }
     resetCookieWatcher();
-    removeStorage(getStorageKey("logout_processing"));
+    startStorageWatcher();
+    releaseLogoutLock();
     logger.info("Logout completed \u2013 flags set, storage cleared, fresh login required", {
       serverLogoutSuccess,
       serverResponse
     });
     emitAuthEvent(AuthEventNames.LOGOUT_COMPLETED, {
+      serverLogoutSuccess,
+      tenantKey: getStorage(getStorageKey("preserved_tenant_key")) || void 0,
       message: serverLogoutSuccess ? "Server logout success" : "Local logout only"
     });
     return {
@@ -2641,10 +2551,24 @@ async function logout(tenantKey) {
     performLocalLogoutCleanup();
     const preservedTenantKey = getStorage(getStorageKey("preserved_tenant_key"));
     if (preservedTenantKey) {
-      setStorage(getStorageKey("props_config"), JSON.stringify({ tenantKey: preservedTenantKey }));
+      const propsKey = getStorageKey("props_config");
+      let existing = {};
+      try {
+        const raw = getStorage(propsKey);
+        if (raw) {
+          existing = JSON.parse(raw);
+        }
+      } catch {
+        existing = {};
+      }
+      const merged = {
+        ...existing,
+        tenantKey: preservedTenantKey
+      };
+      setStorage(propsKey, JSON.stringify(merged));
       removeStorage(getStorageKey("preserved_tenant_key"));
     }
-    removeStorage(getStorageKey("logout_processing"));
+    releaseLogoutLock();
     return {
       success: true,
       message: "Logged out locally due to an error. Fresh login required."
@@ -2664,16 +2588,16 @@ function useAuthContext() {
 var ongoingRequests = /* @__PURE__ */ new Map();
 var DEFAULT_SCOPES2 = OAUTH_CONSTANTS.SCOPES;
 function getResolvedTenantBaseUrl() {
-  let base = Config.getApiTenantResolutionBaseUrl();
+  let base = Config.getApiBaseUrl();
   if (typeof window !== "undefined" && (!base || base.startsWith("/"))) {
-    base = window.location.origin + (base || "/api");
+    base = window.location.origin + (base || "");
   }
   return base;
 }
 var PUBLIC_CODE_PREFIX = "public-";
 function getTenantByCodeUrl(tenantCode) {
   const apiTenantResolutionBaseUrl = getResolvedTenantBaseUrl();
-  const base = apiTenantResolutionBaseUrl.replace(/\/api\/v1\/?$/, "") || apiTenantResolutionBaseUrl;
+  const base = (apiTenantResolutionBaseUrl || "").replace(/\/api(?:\/v1)?\/?$/, "") || apiTenantResolutionBaseUrl;
   return `${base}/api/v1/tenant/public/tenants/by-code/${encodeURIComponent(tenantCode)}`;
 }
 async function resolveTenant(tenantKey) {
@@ -2709,7 +2633,9 @@ async function resolveTenant(tenantKey) {
       if (!tenant.id || !tenant.clientCode) return null;
       const authServer = Config.getAuthServerUrl();
       const redirectUri = Config.getRedirectUri();
-      if (!authServer || !redirectUri) return null;
+      if (!authServer || !redirectUri) {
+        return null;
+      }
       const clientCodeWithPrefix = tenant.clientCode.startsWith(PUBLIC_CODE_PREFIX) ? tenant.clientCode : `${PUBLIC_CODE_PREFIX}${tenant.clientCode}`;
       const config = {
         tenantId: tenant.id,
@@ -2722,6 +2648,7 @@ async function resolveTenant(tenantKey) {
           scopes: DEFAULT_SCOPES2
         }
       };
+      console.log("config====", config);
       logger.debug("Resolved tenant config", { tenantCode });
       return config;
     } catch (error) {
@@ -2783,13 +2710,10 @@ function createBrowserUrlProvider() {
 }
 function createConfigProvider() {
   return {
-    getApiBaseUrl: () => Config.getApiAuthBaseUrl(),
+    getApiBaseUrl: () => Config.getApiBaseUrl(),
     getAuthServerUrl: () => Config.getAuthServerUrl(),
     getRedirectUri: () => Config.getRedirectUri(),
-    getClientId: () => Config.getClientId(),
-    getTenantId: () => Config.getTenantId(),
-    getClientCode: () => Config.getClientCode(),
-    getBasePath: () => Config.getBasePath()
+    getClientCode: () => Config.getClientCode()
   };
 }
 function createTenantResolver() {
@@ -2953,6 +2877,9 @@ function AuthProvider({
   children,
   autoInit = true,
   tenantCode,
+  apiBaseUrl,
+  authServerUrl,
+  callbackUrl,
   appId = "",
   storageAdapter
 }) {
@@ -2964,13 +2891,40 @@ function AuthProvider({
   const initRanRef = useRef(false);
   const engineRef = useRef(null);
   useLayoutEffect(() => {
-    if (tenantCode) {
-      setConfig({ CLIENTCODE: tenantCode });
+    logger.debug("[AuthProvider] Host config props", {
+      tenantCode: tenantCode ?? "(not provided)",
+      apiBaseUrl: apiBaseUrl ? apiBaseUrl : "(empty)",
+      authServerUrl: authServerUrl ? authServerUrl : "(empty)",
+      callbackUrl: callbackUrl ? callbackUrl : "(empty)"
+    });
+    if (!authServerUrl || !authServerUrl.trim()) {
+      logger.warn("[AuthProvider] authServerUrl missing from host props");
+    }
+    if (!callbackUrl || !callbackUrl.trim()) {
+      logger.warn("[AuthProvider] callbackUrl missing from host props");
     }
+    setConfig({
+      ...tenantCode ? { tenantCode } : {},
+      ...apiBaseUrl ? { apiBaseUrl } : {},
+      ...authServerUrl ? { authServerUrl } : {},
+      ...callbackUrl ? { callbackUrl } : {}
+    });
     return () => {
       clearConfigOverrides();
     };
-  }, [tenantCode]);
+  }, [tenantCode, apiBaseUrl, authServerUrl, callbackUrl]);
+  useEffect(() => {
+    try {
+      const payload = {
+        tenantCode: tenantCode ?? "",
+        apiBaseUrl: apiBaseUrl ?? "",
+        authServerUrl: authServerUrl ?? "",
+        callbackUrl: callbackUrl ?? ""
+      };
+      setStorage(getStorageKey("host_config"), JSON.stringify(payload));
+    } catch {
+    }
+  }, [tenantCode, apiBaseUrl, authServerUrl, callbackUrl]);
   useLayoutEffect(() => {
     setStorageKeyPrefix(resolvedTenantKey ?? "");
     const adapter = storageAdapter !== void 0 && storageAdapter !== null ? storageAdapter : createSecureSessionStorageAdapter(namespace);
@@ -3431,6 +3385,6 @@ function useAuthInit() {
   );
 }
 
-export { AuthCallback, AuthEventNames, AuthProvider, Config, OAUTH_CONSTANTS, ProtectedRoute, STORAGE_KEYS2 as STORAGE_KEYS, STORAGE_KEY_PREFIX, SanitizedError, bootstrap, buildStorageKey, createAuthEngine, createCookieStorageAdapter, createMemoryStorageAdapter, createOAuth2PkceStrategy, createSecureSessionStorageAdapter, emitAuthEvent, enforceHttps, ensureValidAccessToken, extractTenantKey, getAccessToken2 as getAccessToken, getAuthRuntime, getConfig, getEnvConfig, getStorageAdapter, getStorageNamespace, getAccessToken as getStoredAccessToken, hasEnvFallback, isAccessTokenExpired, isCallbackUrl, logout, refreshAccessToken, resetCookieWatcher, resolveConfig, resolveTenant, sanitizeErrorMessage, setAuthRuntime, setConfig, setStorageContext, startCookieWatcher, stopCookieWatcher, subscribeAuthEvent, useAuth, useAuthContext, useAuthInit };
+export { AuthCallback, AuthEventNames, AuthProvider, Config, OAUTH_CONSTANTS, ProtectedRoute, STORAGE_KEYS2 as STORAGE_KEYS, STORAGE_KEY_PREFIX, SanitizedError, bootstrap, buildStorageKey, createAuthEngine, createCookieStorageAdapter, createMemoryStorageAdapter, createOAuth2PkceStrategy, createSecureSessionStorageAdapter, emitAuthEvent, enforceHttps, ensureValidAccessToken, extractTenantKey, getAccessToken2 as getAccessToken, getAuthRuntime, getConfig, getStorageAdapter, getStorageNamespace, getAccessToken as getStoredAccessToken, isAccessTokenExpired, isCallbackUrl, logout, refreshAccessToken, resetCookieWatcher, resolveConfig, resolveTenant, sanitizeErrorMessage, setAuthRuntime, setConfig, setStorageContext, startCookieWatcher, stopCookieWatcher, subscribeAuthEvent, useAuth, useAuthContext, useAuthInit };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map