tenneo-auth-plugin 0.1.8 → 0.1.10

package/dist/index.mjs

@@ -1,4 +1,3 @@
-import { z } from 'zod';
 import axios from 'axios';
 import { createContext, useContext, useMemo, useRef, useLayoutEffect, useEffect, useState, useCallback } from 'react';
 import { jsx, jsxs, Fragment } from 'react/jsx-runtime';
@@ -67,13 +66,11 @@ function extractTenantKeyFromUrl(url, config, getStorage3, getKey) {
     if (keyFromHost) return keyFromHost;
     const clientCode = config.getClientCode();
     if (clientCode?.trim()) return clientCode.trim();
-    const tenantId = config.getTenantId();
-    if (tenantId?.trim()) return tenantId.trim();
     return config.getClientCode();
   } catch {
     const clientCode = config.getClientCode();
     if (clientCode?.trim()) return clientCode.trim();
-    return config.getTenantId() || config.getClientCode();
+    return config.getClientCode();
   }
 }
 function isCallbackUrlFromUrl(url) {
@@ -804,85 +801,6 @@ function generateState() {
   return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
 
-// src/config/env.ts
-var ENV_KEYS = {
-  CLIENT_ID: ["VITE_CLIENT_ID", "CLIENT_ID"],
-  TENANT_ID: ["VITE_TENANT_ID", "TENANT_ID"],
-  CLIENTCODE: ["VITE_CLIENTCODE", "CLIENTCODE"]
-};
-function getEnvValue(keys) {
-  try {
-    const g = typeof globalThis !== "undefined" ? globalThis : null;
-    const env = g?.process && typeof g.process.env === "object" ? g.process.env : null;
-    if (env) {
-      for (const key of keys) {
-        const v = env[key];
-        if (v != null && String(v).trim()) return String(v).trim();
-      }
-    }
-  } catch {
-  }
-  try {
-    const meta = typeof import.meta !== "undefined" ? import.meta.env : void 0;
-    if (meta) {
-      for (const key of keys) {
-        const v = meta[key];
-        if (v != null && String(v).trim()) return String(v).trim();
-      }
-    }
-  } catch {
-  }
-  return "";
-}
-var FORBIDDEN_WINDOW_KEYS = ["apiBaseUrl", "apiTenantResolutionBaseUrl", "apiAuthBaseUrl", "authServerUrl", "defaultDomain", "API_BASE_URL", "AUTH_SERVER_URL", "DEFAULT_DOMAIN"];
-function getWindowConfigRaw() {
-  if (typeof window === "undefined") return null;
-  const w = window;
-  const raw = w.__AUTH_CONFIG__ ?? w.__APP_CONFIG__;
-  if (!raw || typeof raw !== "object") return null;
-  for (const forbidden of FORBIDDEN_WINDOW_KEYS) {
-    if (forbidden in raw) {
-      throw new Error("Attempted to override protected internal configuration");
-    }
-  }
-  const out = {};
-  const map = {
-    clientId: "CLIENT_ID",
-    tenantId: "TENANT_ID",
-    clientcode: "CLIENTCODE"
-  };
-  for (const [winKey, sdkKey] of Object.entries(map)) {
-    const v = raw[winKey];
-    if (v != null && typeof v === "string" && v.trim()) out[sdkKey] = v.trim();
-  }
-  return Object.keys(out).length ? out : null;
-}
-function loadEnvConfig() {
-  const partial = {};
-  for (const [key, envKeys] of Object.entries(ENV_KEYS)) {
-    const v = getEnvValue(envKeys);
-    if (v) partial[key] = v;
-  }
-  return partial;
-}
-function loadWindowConfig() {
-  const raw = getWindowConfigRaw();
-  if (!raw) return null;
-  return raw;
-}
-var schema = z.object({
-  CLIENT_ID: z.string().min(1, "CLIENT_ID is required"),
-  TENANT_ID: z.string().min(1, "TENANT_ID is required"),
-  CLIENTCODE: z.string().min(1, "CLIENTCODE is required")
-});
-function validateConfig(data) {
-  return schema.parse(data);
-}
-
-// src/config/types.ts
-var INTERNAL_CONFIG_KEYS = ["API_TENANT_RESOLUTION_BASE_URL", "API_AUTH_BASE_URL", "AUTH_SERVER_URL", "DEFAULT_DOMAIN"];
-var RUNTIME_CONFIG_KEYS = ["CLIENT_ID", "TENANT_ID", "CLIENTCODE"];
-
 // src/config/constants.ts
 var OAUTH_CONSTANTS = {
   SCOPES: "openid profile email",
@@ -910,232 +828,63 @@ var DEFAULT_TOKEN_GRANT_TYPE = OAUTH_CONSTANTS.TOKEN_GRANT_TYPE;
 var DEFAULT_REFRESH_GRANT_TYPE = OAUTH_CONSTANTS.REFRESH_GRANT_TYPE;
 
 // src/config/index.ts
-var INTERNAL_DEFAULTS = {
-  API_TENANT_RESOLUTION_BASE_URL: "http://localhost:5021/api/v1",
-  API_AUTH_BASE_URL: "http://localhost:5000",
-  AUTH_SERVER_URL: "http://localhost:5000",
-  DEFAULT_DOMAIN: "http://localhost:5000"
-};
-function envOr(key) {
-  const v = getEnvValue([`VITE_${key}`, key]);
-  return v && v.trim() ? v.trim() : INTERNAL_DEFAULTS[key];
-}
-var INTERNAL_CONFIG = Object.freeze({
-  API_TENANT_RESOLUTION_BASE_URL: envOr("API_TENANT_RESOLUTION_BASE_URL"),
-  API_AUTH_BASE_URL: envOr("API_AUTH_BASE_URL"),
-  AUTH_SERVER_URL: envOr("AUTH_SERVER_URL"),
-  DEFAULT_DOMAIN: envOr("DEFAULT_DOMAIN")
-});
-var RUNTIME_CONFIG_DEFAULTS = Object.freeze({
-  CLIENT_ID: "tenneo",
-  TENANT_ID: "00000000-0000-0000-0000-000000000001",
-  CLIENTCODE: "productlms"
-});
-function pickRuntimeConfig(source) {
-  if (!source) return {};
-  const picked = {};
-  for (const key of RUNTIME_CONFIG_KEYS) {
-    const value = source[key];
-    if (value != null && typeof value === "string") {
-      const trimmed = value.trim();
-      if (trimmed) picked[key] = trimmed;
-    }
-  }
-  return picked;
-}
-({
-  ...INTERNAL_CONFIG,
-  ...RUNTIME_CONFIG_DEFAULTS
-});
-var runtimeOverrides = {};
-var runtimeConfigOverrides = {};
-function mergeRuntime(base, ...sources) {
-  let out = { ...base };
-  for (const src of sources) {
-    if (!src) continue;
-    for (const key of Object.keys(src)) {
-      const value = src[key];
-      if (value != null && String(value).trim() !== "") out[key] = String(value).trim();
-    }
-  }
-  return out;
-}
-function assertNoInternalOverrides(source) {
-  if (!source) return;
-  for (const key of INTERNAL_CONFIG_KEYS) {
-    if (source[key] !== void 0) throw new Error("Attempted to override protected internal configuration");
-  }
-}
-var INTERNAL_KEY_SET = new Set(INTERNAL_CONFIG_KEYS);
-var HOST_TO_RUNTIME_KEYS = {
-  clientId: "CLIENT_ID",
-  tenantId: "TENANT_ID",
-  clientcode: "CLIENTCODE"
-};
-function sanitizeRuntimeOverrides(source) {
-  if (!source) return void 0;
-  const filtered = {};
-  for (const [key, raw] of Object.entries(source)) {
-    if (raw == null) continue;
-    if (INTERNAL_KEY_SET.has(key)) continue;
-    const trimmed = String(raw).trim();
-    if (!trimmed) continue;
-    const sdkKey = HOST_TO_RUNTIME_KEYS[key] ?? key;
-    filtered[sdkKey] = trimmed;
-  }
-  const picked = pickRuntimeConfig(filtered);
-  return Object.keys(picked).length ? picked : void 0;
+var inMemoryConfig = {};
+function readHostConfigFromStorage() {
+  try {
+    const raw = getStorage(getStorageKey("host_config"));
+    if (!raw) return {};
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function resolveMerged(overrides) {
+  const stored = readHostConfigFromStorage();
+  const cfg = { ...stored, ...inMemoryConfig, ...overrides ?? {} };
+  const trimmed = (v) => v == null ? "" : String(v).trim();
+  return {
+    apiBaseUrl: trimmed(cfg.apiBaseUrl),
+    authServerUrl: trimmed(cfg.authServerUrl),
+    callbackUrl: trimmed(cfg.callbackUrl),
+    clientCode: trimmed(cfg.clientCode)
+  };
 }
 function resolveConfig(overrides) {
-  assertNoInternalOverrides(runtimeOverrides);
-  assertNoInternalOverrides(overrides);
-  const windowCfg = loadWindowConfig();
-  const envCfg = loadEnvConfig();
-  const mergedRuntime = mergeRuntime(
-    RUNTIME_CONFIG_DEFAULTS,
-    envCfg,
-    windowCfg ?? void 0,
-    runtimeOverrides,
-    sanitizeRuntimeOverrides(overrides)
-  );
-  const validatedRuntime = validateConfig(mergedRuntime);
-  return { ...INTERNAL_CONFIG, ...validatedRuntime };
+  return resolveMerged(overrides);
 }
 function getConfig() {
-  return resolveConfig();
+  return resolveMerged();
 }
 function setConfig(overrides) {
-  assertNoInternalOverrides(overrides);
-  const sanitized = sanitizeRuntimeOverrides(overrides);
-  if (sanitized) runtimeOverrides = { ...runtimeOverrides, ...sanitized };
-  const { basePath, redirectUri } = overrides;
-  if (basePath != null && basePath.trim() !== "") runtimeConfigOverrides = { ...runtimeConfigOverrides, basePath: basePath.trim() };
-  if (redirectUri != null && redirectUri.trim() !== "") runtimeConfigOverrides = { ...runtimeConfigOverrides, redirectUri: redirectUri.trim() };
+  inMemoryConfig = { ...inMemoryConfig, ...overrides };
 }
 function clearConfigOverrides() {
-  runtimeOverrides = {};
-  runtimeConfigOverrides = {};
-}
-function getWindowBasePath() {
-  if (typeof window === "undefined") return "";
-  const w = window;
-  const raw = w.__AUTH_CONFIG__ ?? w.__APP_CONFIG__;
-  const bp = raw?.basePath;
-  if (bp != null && typeof bp === "string" && bp.trim()) return bp.trim();
-  const pathname = window.location.pathname;
-  const segments = pathname.split("/").filter(Boolean);
-  const commonRoutes = ["dashboards", "callback", "confirmation", "client-confirmed", "client-provisioned", "approval-completed"];
-  if (segments.length > 0 && !commonRoutes.includes(segments[0])) {
-    let base = "/" + segments[0];
-    if (base.endsWith("/")) base = base.slice(0, -1);
-    return base;
-  }
-  return "";
-}
-function getBasePath() {
-  if (runtimeConfigOverrides.basePath != null && runtimeConfigOverrides.basePath !== "") return runtimeConfigOverrides.basePath;
-  return getWindowBasePath();
+  inMemoryConfig = {};
 }
 function getRedirectUri2() {
-  if (typeof window !== "undefined") {
-    return `${window.location.origin}/callback`;
-  }
-  return getEnvValue(["VITE_REDIRECT_URI", "REDIRECT_URI"]) || "http://localhost:5173/callback";
-}
-function hasRuntimeConfig() {
-  return loadWindowConfig() !== null || Object.keys(runtimeOverrides).length > 0;
+  const cfg = resolveMerged();
+  if (cfg.callbackUrl) return cfg.callbackUrl;
+  if (typeof window !== "undefined") return `${window.location.origin}/callback`;
+  return "";
 }
 var Config = {
-  getApiTenantResolutionBaseUrl() {
-    return getConfig().API_TENANT_RESOLUTION_BASE_URL;
-  },
-  getApiAuthBaseUrl() {
-    return getConfig().API_AUTH_BASE_URL;
+  getApiBaseUrl() {
+    return resolveMerged().apiBaseUrl;
   },
   getAuthServerUrl() {
-    return getConfig().AUTH_SERVER_URL;
-  },
-  getDefaultDomain() {
-    return getConfig().DEFAULT_DOMAIN;
-  },
-  getClientId() {
-    return getConfig().CLIENT_ID;
-  },
-  getTenantId() {
-    return getConfig().TENANT_ID;
+    return resolveMerged().authServerUrl;
   },
   getClientCode() {
-    return getConfig().CLIENTCODE;
+    return resolveMerged().clientCode;
   },
   getRedirectUri() {
     return getRedirectUri2();
   },
-  getBasePath() {
-    return getBasePath();
-  },
-  hasRuntimeConfig() {
-    return hasRuntimeConfig();
-  },
   getAll() {
-    const c = getConfig();
-    return {
-      apiTenantResolutionBaseUrl: c.API_TENANT_RESOLUTION_BASE_URL,
-      apiAuthBaseUrl: c.API_AUTH_BASE_URL,
-      authServerUrl: c.AUTH_SERVER_URL,
-      defaultDomain: c.DEFAULT_DOMAIN,
-      clientId: c.CLIENT_ID,
-      tenantId: c.TENANT_ID,
-      clientCode: c.CLIENTCODE,
-      redirectUri: getRedirectUri2(),
-      basePath: getBasePath()
-    };
+    return resolveMerged();
   }
 };
-({
-  AUTH_SERVER_URL: Config.getAuthServerUrl(),
-  CLIENT_ID: Config.getClientId(),
-  TENANT_ID: Config.getTenantId(),
-  CLIENTCODE: Config.getClientCode()
-});
-function getEnvConfig() {
-  const authServerUrl = Config.getAuthServerUrl();
-  const clientId = Config.getClientId();
-  const tenantId = Config.getTenantId();
-  const redirectUri = Config.getRedirectUri();
-  try {
-    new URL(authServerUrl);
-    new URL(redirectUri);
-  } catch {
-    return Promise.resolve(null);
-  }
-  return Promise.resolve({
-    authServerUrl: authServerUrl.trim(),
-    clientId: clientId.trim(),
-    redirectUri: redirectUri.trim(),
-    tenantId: tenantId.trim()
-  });
-}
-function getEnvConfigSync() {
-  const authServerUrl = Config.getAuthServerUrl();
-  const clientId = Config.getClientId();
-  const tenantId = Config.getTenantId();
-  const redirectUri = Config.getRedirectUri();
-  try {
-    new URL(authServerUrl);
-    new URL(redirectUri);
-  } catch {
-    return null;
-  }
-  return {
-    authServerUrl: authServerUrl.trim(),
-    clientId: clientId.trim(),
-    redirectUri: redirectUri.trim(),
-    tenantId: tenantId.trim()
-  };
-}
-function hasEnvFallback() {
-  return getEnvConfigSync() !== null;
-}
 
 // src/utils/validation.ts
 function isValidGuid(guid) {
@@ -1289,7 +1038,8 @@ function storeTenantConfig(config) {
   if (!validation.isValid) {
     logger.warn("Tenant ID validation failed", { tenantId: config.tenantId });
   }
-  setStorage(STORAGE_KEYS.authServerUrl, config.authServer);
+  const authServerToStore = Config.getAuthServerUrl() || config.authServer;
+  setStorage(STORAGE_KEYS.authServerUrl, authServerToStore);
   setStorage(STORAGE_KEYS.clientId, config.client.clientId);
   setStorage(STORAGE_KEYS.redirectUri, Config.getRedirectUri());
   setStorage(STORAGE_KEYS.tenantId, config.tenantId);
@@ -1300,6 +1050,22 @@ function storeTenantConfig(config) {
 async function initiateAuthFlow(config) {
   try {
     logger.info("Initiating OAuth authorization flow");
+    const authServerFromProps = Config.getAuthServerUrl();
+    const authServerEffective = (authServerFromProps || config?.authServer || "").replace(/\/+$/, "");
+    const redirectUriEffective = Config.getRedirectUri();
+    const storedTenantId = getStorage(STORAGE_KEYS.tenantId);
+    const storedClientId = getStorage(STORAGE_KEYS.clientId);
+    const tenantIdEffective = storedTenantId || config?.tenantId || "";
+    const clientIdEffective = storedClientId || config?.client?.clientId || "";
+    logger.debug("[initiateAuthFlow] Resolved inputs", {
+      authServerFromProps: authServerFromProps ? "(provided)" : "(empty)",
+      authServerEffective,
+      redirectUriEffective,
+      tenantIdEffective,
+      clientIdEffective,
+      scopes: config?.client?.scopes,
+      hasRuntime: !!getAuthRuntime()
+    });
     const token = getAccessToken();
     if (token && !isAccessTokenExpired()) {
       logger.debug("Valid token already exists, skipping auth flow");
@@ -1321,10 +1087,17 @@ async function initiateAuthFlow(config) {
       }
     }
     setFlowFlags();
-    if (!config?.authServer || !config.client?.clientId || !config.client?.redirectUri) {
+    if (!(Config.getAuthServerUrl() || config?.authServer) || !config.client?.clientId || !config.client?.redirectUri) {
+      logger.error("[initiateAuthFlow] Missing required tenant config", {
+        authServerEffective,
+        clientId: config?.client?.clientId,
+        redirectUriFromTenantApi: config?.client?.redirectUri,
+        redirectUriEffective
+      });
       throw new Error("Invalid tenant configuration for auth flow");
     }
     storeTenantConfig(config);
+    logger.debug("[initiateAuthFlow] Stored tenant config, generating PKCE");
     const codeVerifier = generateCodeVerifier();
     const codeChallenge = await generateCodeChallenge(codeVerifier);
     const state = generateState();
@@ -1333,6 +1106,10 @@ async function initiateAuthFlow(config) {
     setStorage(STORAGE_KEYS.codeVerifier, codeVerifier);
     setStorage(STORAGE_KEYS.state, state);
     const authUrl = buildAuthorizationUrl(config, codeChallenge, state);
+    logger.debug("[initiateAuthFlow] Built authorization URL", {
+      authServerEffective,
+      urlPrefix: authUrl?.slice(0, 80)
+    });
     if (!authUrl || !(authUrl.startsWith("http://") || authUrl.startsWith("https://"))) {
       throw new Error("Invalid authorization URL generated");
     }
@@ -1344,8 +1121,15 @@ async function initiateAuthFlow(config) {
     logger.info("Redirecting to authorization server");
     emitAuthEvent(AuthEventNames.LOGIN_STARTED, { tenantKey: config.tenantKey });
     const runtime = getAuthRuntime();
-    if (runtime) runtime.urlProvider.redirect(authUrl);
-    else if (typeof window !== "undefined") window.location.replace(authUrl);
+    if (runtime) {
+      logger.debug("[initiateAuthFlow] Redirect via runtime.urlProvider.redirect");
+      runtime.urlProvider.redirect(authUrl);
+    } else if (typeof window !== "undefined") {
+      logger.debug("[initiateAuthFlow] Redirect via window.location.replace");
+      window.location.replace(authUrl);
+    } else {
+      logger.error("[initiateAuthFlow] No runtime and no window; cannot redirect", { authUrl });
+    }
   } catch (error) {
     clearFlowFlags();
     logger.error("Failed to initiate auth flow", {
@@ -1355,9 +1139,10 @@ async function initiateAuthFlow(config) {
   }
 }
 function buildAuthorizationUrl(config, codeChallenge, state) {
+  const authServerBase = (Config.getAuthServerUrl() || config.authServer || "").replace(/\/+$/, "");
   if (isLocalhost2()) {
     logger.debug("Building authorization URL", {
-      authServer: config.authServer,
+      authServer: authServerBase,
       clientId: config.client.clientId,
       redirectUri: config.client.redirectUri,
       scopes: config.client.scopes
@@ -1378,7 +1163,7 @@ function buildAuthorizationUrl(config, codeChallenge, state) {
     code_challenge: codeChallenge,
     code_challenge_method: DEFAULT_CODE_CHALLENGE_METHOD
   });
-  return `${config.authServer}/connect/authorize?${params.toString()}`;
+  return `${authServerBase}/connect/authorize?${params.toString()}`;
 }
 
 // src/strategies/oauth2-pkce/token-exchange.ts
@@ -1408,7 +1193,7 @@ function storeTokens(tokenData) {
 async function exchangeCodeForTokens(params) {
   try {
     const { code, codeVerifier, clientId, redirectUri } = params;
-    const apiAuthBaseUrl = Config.getApiAuthBaseUrl();
+    const apiAuthBaseUrl = Config.getAuthServerUrl();
     const tokenUrl = `${apiAuthBaseUrl}/oauth/token`;
     const body = new URLSearchParams({
       grant_type: DEFAULT_TOKEN_GRANT_TYPE,
@@ -1482,7 +1267,7 @@ async function refreshAccessToken() {
         });
         throw new Error("Cannot refresh token: missing required data");
       }
-      const apiAuthBaseUrl = Config.getApiAuthBaseUrl();
+      const apiAuthBaseUrl = Config.getApiBaseUrl();
       const tokenUrl = `${apiAuthBaseUrl}/oauth/refresh`;
       const body = new URLSearchParams({
         grant_type: DEFAULT_REFRESH_GRANT_TYPE,
@@ -1879,40 +1664,15 @@ function mergeConfigWithProps(apiEnvConfig, propsConfig, tenantKey) {
     }
   };
 }
-async function buildTenantConfigFromEnv() {
-  const envConfig = await getEnvConfig();
-  if (!envConfig) return null;
-  return {
-    tenantId: envConfig.tenantId,
-    authServer: envConfig.authServerUrl,
-    client: {
-      clientId: envConfig.clientId,
-      redirectUri: envConfig.redirectUri,
-      scopes: "openid profile email"
-    }
-  };
-}
 async function resolveTenantConfig(tenantKey, tenantResolver) {
   if (!tenantKey) return null;
   const propsConfig = getPropsConfig();
-  let apiEnvConfig = null;
-  let apiResolved = false;
-  apiEnvConfig = await tenantResolver.resolve(tenantKey);
-  apiResolved = !!apiEnvConfig;
-  if (!apiEnvConfig) {
-    apiEnvConfig = await buildTenantConfigFromEnv();
-  }
-  if (!apiEnvConfig) return null;
-  if (!apiResolved && propsConfig) {
-    const mergedConfig = mergeConfigWithProps(apiEnvConfig, propsConfig, tenantKey);
-    removeStorage(getStorageKey("props_config"));
-    logger.info("Merged props config with ENV fallback config");
-    return mergedConfig;
-  }
+  const resolved = await tenantResolver.resolve(tenantKey);
+  if (!resolved) return null;
   removeStorage(getStorageKey("props_config"));
   return {
-    ...apiEnvConfig,
-    tenantKey: tenantKey || apiEnvConfig.tenantKey
+    ...propsConfig ? mergeConfigWithProps(resolved, propsConfig, tenantKey) : resolved,
+    tenantKey: tenantKey || resolved.tenantKey
   };
 }
 async function resolveTenantConfigCached(tenantKey, tenantResolver) {
@@ -2106,6 +1866,8 @@ var LoginFlow = class {
     const { runtime } = context;
     const { logger: log } = runtime;
     const getUrl = () => runtime.urlProvider.getCurrentUrl();
+    const url = getUrl();
+    log.debug("[LoginFlow] Start", { url: url.href, pathname: url.pathname, search: url.search });
     const callbackProcessed = getStorage(getStorageKey("callback_processed")) === "true";
     const token = getAccessToken();
     if (callbackProcessed && !token) {
@@ -2115,7 +1877,8 @@ var LoginFlow = class {
     }
     const wasStateMismatch = getStorage(getStorageKey("state_mismatch")) === "true";
     if (wasStateMismatch) removeStorage(getStorageKey("state_mismatch"));
-    const tenantKey = getTenantKeyFromRuntime(getUrl(), runtime.configProvider);
+    const tenantKey = getTenantKeyFromRuntime(url, runtime.configProvider);
+    log.debug("[LoginFlow] Tenant key resolved", { tenantKey: tenantKey ?? "(null)" });
     if (!tenantKey) {
       throw new SanitizedError(
         "TENANT_KEY_RESOLUTION_FAILED",
@@ -2123,7 +1886,15 @@ var LoginFlow = class {
         new Error("Tenant key missing")
       );
     }
+    log.debug("[LoginFlow] Resolving tenant config", { tenantKey });
     const tenantConfig = await resolveTenantConfigCached(tenantKey, runtime.tenantResolver);
+    log.debug("[LoginFlow] Tenant config resolved", {
+      ok: !!tenantConfig,
+      tenantId: tenantConfig?.tenantId,
+      authServer: tenantConfig?.authServer ? "(set)" : "(empty)",
+      clientId: tenantConfig?.client?.clientId,
+      redirectUri: tenantConfig?.client?.redirectUri
+    });
     if (!tenantConfig) {
       throw new SanitizedError(
         "TENANT_CONFIG_RESOLUTION_FAILED",
@@ -2133,7 +1904,9 @@ var LoginFlow = class {
     }
     setTenantKey(tenantKey);
     storeTenantConfig(tenantConfig);
+    log.debug("[LoginFlow] Stored tenant config, initiating auth flow");
     await initiateAuthFlow(tenantConfig);
+    log.debug("[LoginFlow] Auth flow initiated (redirect should happen)");
     return { completed: true };
   }
 };
@@ -2716,7 +2489,7 @@ async function logout(tenantKey) {
   try {
     stopStorageWatcher();
     stopCookieWatcher();
-    const apiAuthBaseUrl = Config.getApiAuthBaseUrl();
+    const apiAuthBaseUrl = Config.getAuthServerUrl();
     let serverLogoutSuccess = false;
     let serverResponse;
     if (apiAuthBaseUrl) {
@@ -2815,16 +2588,16 @@ function useAuthContext() {
 var ongoingRequests = /* @__PURE__ */ new Map();
 var DEFAULT_SCOPES2 = OAUTH_CONSTANTS.SCOPES;
 function getResolvedTenantBaseUrl() {
-  let base = Config.getApiTenantResolutionBaseUrl();
+  let base = Config.getApiBaseUrl();
   if (typeof window !== "undefined" && (!base || base.startsWith("/"))) {
-    base = window.location.origin + (base || "/api");
+    base = window.location.origin + (base || "");
   }
   return base;
 }
 var PUBLIC_CODE_PREFIX = "public-";
 function getTenantByCodeUrl(tenantCode) {
   const apiTenantResolutionBaseUrl = getResolvedTenantBaseUrl();
-  const base = apiTenantResolutionBaseUrl.replace(/\/api\/v1\/?$/, "") || apiTenantResolutionBaseUrl;
+  const base = (apiTenantResolutionBaseUrl || "").replace(/\/api(?:\/v1)?\/?$/, "") || apiTenantResolutionBaseUrl;
   return `${base}/api/v1/tenant/public/tenants/by-code/${encodeURIComponent(tenantCode)}`;
 }
 async function resolveTenant(tenantKey) {
@@ -2860,7 +2633,9 @@ async function resolveTenant(tenantKey) {
       if (!tenant.id || !tenant.clientCode) return null;
       const authServer = Config.getAuthServerUrl();
       const redirectUri = Config.getRedirectUri();
-      if (!authServer || !redirectUri) return null;
+      if (!authServer || !redirectUri) {
+        return null;
+      }
       const clientCodeWithPrefix = tenant.clientCode.startsWith(PUBLIC_CODE_PREFIX) ? tenant.clientCode : `${PUBLIC_CODE_PREFIX}${tenant.clientCode}`;
       const config = {
         tenantId: tenant.id,
@@ -2873,6 +2648,7 @@ async function resolveTenant(tenantKey) {
           scopes: DEFAULT_SCOPES2
         }
       };
+      console.log("config====", config);
       logger.debug("Resolved tenant config", { tenantCode });
       return config;
     } catch (error) {
@@ -2934,13 +2710,10 @@ function createBrowserUrlProvider() {
 }
 function createConfigProvider() {
   return {
-    getApiBaseUrl: () => Config.getApiAuthBaseUrl(),
+    getApiBaseUrl: () => Config.getApiBaseUrl(),
     getAuthServerUrl: () => Config.getAuthServerUrl(),
     getRedirectUri: () => Config.getRedirectUri(),
-    getClientId: () => Config.getClientId(),
-    getTenantId: () => Config.getTenantId(),
-    getClientCode: () => Config.getClientCode(),
-    getBasePath: () => Config.getBasePath()
+    getClientCode: () => Config.getClientCode()
   };
 }
 function createTenantResolver() {
@@ -3103,11 +2876,19 @@ function createAuthEngine(config) {
 function AuthProvider({
   children,
   autoInit = true,
+  config,
   tenantCode,
+  apiBaseUrl,
+  authServerUrl,
+  callbackUrl,
   appId = "",
   storageAdapter
 }) {
-  const resolvedTenantKey = tenantCode ?? Config.getClientCode();
+  const mergedTenantCode = tenantCode ?? config?.tenantCode;
+  const mergedApiBaseUrl = apiBaseUrl ?? config?.apiBaseUrl;
+  const mergedAuthServerUrl = authServerUrl ?? config?.authServerUrl;
+  const mergedCallbackUrl = callbackUrl ?? config?.callbackUrl;
+  const resolvedTenantKey = mergedTenantCode ?? Config.getClientCode();
   const namespace = useMemo(
     () => ({ tenantId: resolvedTenantKey ?? "", appId: appId ?? "" }),
     [resolvedTenantKey, appId]
@@ -3115,13 +2896,40 @@ function AuthProvider({
   const initRanRef = useRef(false);
   const engineRef = useRef(null);
   useLayoutEffect(() => {
-    if (tenantCode) {
-      setConfig({ CLIENTCODE: tenantCode });
+    logger.debug("[AuthProvider] Host config props", {
+      tenantCode: mergedTenantCode ?? "(not provided)",
+      apiBaseUrl: mergedApiBaseUrl ? mergedApiBaseUrl : "(empty)",
+      authServerUrl: mergedAuthServerUrl ? mergedAuthServerUrl : "(empty)",
+      callbackUrl: mergedCallbackUrl ? mergedCallbackUrl : "(empty)"
+    });
+    if (!mergedAuthServerUrl || !mergedAuthServerUrl.trim()) {
+      logger.warn("[AuthProvider] authServerUrl missing from host props");
+    }
+    if (!mergedCallbackUrl || !mergedCallbackUrl.trim()) {
+      logger.warn("[AuthProvider] callbackUrl missing from host props");
     }
+    setConfig({
+      ...mergedTenantCode ? { tenantCode: mergedTenantCode } : {},
+      ...mergedApiBaseUrl ? { apiBaseUrl: mergedApiBaseUrl } : {},
+      ...mergedAuthServerUrl ? { authServerUrl: mergedAuthServerUrl } : {},
+      ...mergedCallbackUrl ? { callbackUrl: mergedCallbackUrl } : {}
+    });
     return () => {
       clearConfigOverrides();
     };
-  }, [tenantCode]);
+  }, [mergedTenantCode, mergedApiBaseUrl, mergedAuthServerUrl, mergedCallbackUrl]);
+  useEffect(() => {
+    try {
+      const payload = {
+        tenantCode: mergedTenantCode ?? "",
+        apiBaseUrl: mergedApiBaseUrl ?? "",
+        authServerUrl: mergedAuthServerUrl ?? "",
+        callbackUrl: mergedCallbackUrl ?? ""
+      };
+      setStorage(getStorageKey("host_config"), JSON.stringify(payload));
+    } catch {
+    }
+  }, [mergedTenantCode, mergedApiBaseUrl, mergedAuthServerUrl, mergedCallbackUrl]);
   useLayoutEffect(() => {
     setStorageKeyPrefix(resolvedTenantKey ?? "");
     const adapter = storageAdapter !== void 0 && storageAdapter !== null ? storageAdapter : createSecureSessionStorageAdapter(namespace);
@@ -3582,6 +3390,6 @@ function useAuthInit() {
   );
 }
 
-export { AuthCallback, AuthEventNames, AuthProvider, Config, OAUTH_CONSTANTS, ProtectedRoute, STORAGE_KEYS2 as STORAGE_KEYS, STORAGE_KEY_PREFIX, SanitizedError, bootstrap, buildStorageKey, createAuthEngine, createCookieStorageAdapter, createMemoryStorageAdapter, createOAuth2PkceStrategy, createSecureSessionStorageAdapter, emitAuthEvent, enforceHttps, ensureValidAccessToken, extractTenantKey, getAccessToken2 as getAccessToken, getAuthRuntime, getConfig, getEnvConfig, getStorageAdapter, getStorageNamespace, getAccessToken as getStoredAccessToken, hasEnvFallback, isAccessTokenExpired, isCallbackUrl, logout, refreshAccessToken, resetCookieWatcher, resolveConfig, resolveTenant, sanitizeErrorMessage, setAuthRuntime, setConfig, setStorageContext, startCookieWatcher, stopCookieWatcher, subscribeAuthEvent, useAuth, useAuthContext, useAuthInit };
+export { AuthCallback, AuthEventNames, AuthProvider, Config, OAUTH_CONSTANTS, ProtectedRoute, STORAGE_KEYS2 as STORAGE_KEYS, STORAGE_KEY_PREFIX, SanitizedError, bootstrap, buildStorageKey, createAuthEngine, createCookieStorageAdapter, createMemoryStorageAdapter, createOAuth2PkceStrategy, createSecureSessionStorageAdapter, emitAuthEvent, enforceHttps, ensureValidAccessToken, extractTenantKey, getAccessToken2 as getAccessToken, getAuthRuntime, getConfig, getStorageAdapter, getStorageNamespace, getAccessToken as getStoredAccessToken, isAccessTokenExpired, isCallbackUrl, logout, refreshAccessToken, resetCookieWatcher, resolveConfig, resolveTenant, sanitizeErrorMessage, setAuthRuntime, setConfig, setStorageContext, startCookieWatcher, stopCookieWatcher, subscribeAuthEvent, useAuth, useAuthContext, useAuthInit };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map