tinacms 1.5.23 → 1.5.25

package/dist/index.mjs

@@ -24,11 +24,12 @@ import * as pkg$1 from "react-color";
 import * as pkg from "color-string";
 import * as dropzone from "react-dropzone";
 import { EditContext, useEditState, setEditing } from "@tinacms/sharedctx";
-import { isHotkey } from "is-hotkey";
-import { computePosition, flip, shift } from "@floating-ui/dom";
+import get from "lodash.get";
 import moment from "moment";
 import { formatDistanceToNow } from "date-fns";
 import { useWindowWidth } from "@react-hook/window-size";
+import { isHotkey } from "is-hotkey";
+import { computePosition, flip, shift } from "@floating-ui/dom";
 import { getIntrospectionQuery, buildClientSchema, print, parse as parse$3, buildSchema } from "graphql";
 import gql$1 from "graphql-tag";
 import { TinaSchema, addNamespaceToSchema, parseURL, resolveForm, normalizePath, validateSchema } from "@tinacms/schema-tools";
@@ -37,42 +38,6 @@ import * as yup from "yup";
 import { diff } from "@graphql-inspector/core";
 import { NavLink, useSearchParams, useNavigate, useLocation, useParams, Link, HashRouter, Routes, Route } from "react-router-dom";
 import { stringifyMDX } from "@tinacms/mdx";
-function popupWindow(url, title, window2, w, h) {
-  const y = window2.top.outerHeight / 2 + window2.top.screenY - h / 2;
-  const x = window2.top.outerWidth / 2 + window2.top.screenX - w / 2;
-  return window2.open(
-    url,
-    title,
-    "toolbar=no, location=no, directories=no, status=no, menubar=no, scrollbars=yes, resizable=yes, copyhistory=no, width=" + w + ", height=" + h + ", top=" + y + ", left=" + x
-  );
-}
-const TINA_LOGIN_EVENT = "tinaCloudLogin";
-const AUTH_TOKEN_KEY = "tinacms-auth";
-const authenticate = (clientId, frontendUrl) => {
-  return new Promise((resolve) => {
-    let authTab;
-    window.addEventListener("message", function(e) {
-      if (e.data.source === TINA_LOGIN_EVENT) {
-        if (authTab) {
-          authTab.close();
-        }
-        resolve({
-          id_token: e.data.id_token,
-          access_token: e.data.access_token,
-          refresh_token: e.data.refresh_token
-        });
-      }
-    });
-    const origin = `${window.location.protocol}//${window.location.host}`;
-    authTab = popupWindow(
-      `${frontendUrl}/signin?clientId=${clientId}&origin=${origin}`,
-      "_blank",
-      window,
-      1e3,
-      700
-    );
-  });
-};
 const ModalProvider = ({ children }) => {
   const [modalRootContainerRef, setModalRootContainerRef] = useState(
     null
@@ -3093,6 +3058,9 @@ function IoMdClose(props) {
 function IoMdRefresh(props) {
   return GenIcon({ "tag": "svg", "attr": { "viewBox": "0 0 512 512" }, "child": [{ "tag": "path", "attr": { "d": "M256 388c-72.597 0-132-59.405-132-132 0-72.601 59.403-132 132-132 36.3 0 69.299 15.4 92.406 39.601L278 234h154V80l-51.698 51.702C348.406 99.798 304.406 80 256 80c-96.797 0-176 79.203-176 176s78.094 176 176 176c81.045 0 148.287-54.134 169.401-128H378.85c-18.745 49.561-67.138 84-122.85 84z" } }] })(props);
 }
+function MdVpnKey(props) {
+  return GenIcon({ "tag": "svg", "attr": { "viewBox": "0 0 24 24" }, "child": [{ "tag": "path", "attr": { "fill": "none", "d": "M0 0h24v24H0z" } }, { "tag": "path", "attr": { "d": "M12.65 10A5.99 5.99 0 007 6c-3.31 0-6 2.69-6 6s2.69 6 6 6a5.99 5.99 0 005.65-4H17v4h4v-4h2v-4H12.65zM7 14c-1.1 0-2-.9-2-2s.9-2 2-2 2 .9 2 2-.9 2-2 2z" } }] })(props);
+}
 function MdKeyboardArrowDown(props) {
   return GenIcon({ "tag": "svg", "attr": { "viewBox": "0 0 24 24" }, "child": [{ "tag": "path", "attr": { "fill": "none", "d": "M0 0h24v24H0V0z" } }, { "tag": "path", "attr": { "d": "M7.41 8.59L12 13.17l4.59-4.58L18 10l-6 6-6-6 1.41-1.41z" } }] })(props);
 }
@@ -3154,14 +3122,14 @@ const useBranchData = () => {
   return branchData;
 };
 const textFieldClasses = "shadow-inner focus:shadow-outline focus:border-blue-500 focus:outline-none block text-base placeholder:text-gray-300 px-3 py-2 text-gray-600 w-full bg-white border border-gray-200 transition-all ease-out duration-150 focus:text-gray-900 rounded-md";
-const disabledClasses = "opacity-50 pointer-events-none cursor-not-allowed";
+const disabledClasses$1 = "opacity-50 pointer-events-none cursor-not-allowed";
 const BaseTextField = React.forwardRef(({ className, disabled, ...rest }, ref) => {
   return /* @__PURE__ */ React.createElement(
     "input",
     {
       ref,
       type: "text",
-      className: `${textFieldClasses} ${disabled ? disabledClasses : ""} ${className}`,
+      className: `${textFieldClasses} ${disabled ? disabledClasses$1 : ""} ${className}`,
       ...rest
     }
   );
@@ -3980,6 +3948,20 @@ function toProps(option) {
     return option;
   return { value: option, label: option };
 }
+const passwordFieldClasses = "shadow-inner focus:shadow-outline focus:border-blue-500 focus:outline-none block text-base placeholder:text-gray-300 px-3 py-2 text-gray-600 w-full bg-white border border-gray-200 transition-all ease-out duration-150 focus:text-gray-900 rounded-md";
+const disabledClasses = "opacity-50 pointer-events-none cursor-not-allowed";
+const errorClasses = "border-red-500 focus:border-red-500 focus:shadow-outline-red";
+const BasePasswordField = React.forwardRef(({ className, disabled, error, ...rest }, ref) => {
+  return /* @__PURE__ */ React.createElement(
+    "input",
+    {
+      ref,
+      type: "password",
+      className: `${passwordFieldClasses} ${disabled ? disabledClasses : ""} ${className} ${error ? errorClasses : ""}`,
+      ...rest
+    }
+  );
+});
 const Group$1 = wrapFieldWithError(({ tinaForm, field }) => {
   const cms = useCMS$1();
   React.useState(false);
@@ -5066,9 +5048,19 @@ const TextField = wrapFieldsWithMeta(
 const TextFieldPlugin = {
   name: "text",
   Component: TextField,
-  validate(value, values, meta, field) {
+  validate(value, allValues, meta, field) {
+    var _a;
     if (field.required && !value)
       return "Required";
+    if (field.uid) {
+      const path = field.name.split(".");
+      const fieldName = path[path.length - 1];
+      const parent = path.slice(0, path.length - 2);
+      const items = get(allValues, parent);
+      if (((_a = items == null ? void 0 : items.filter((item) => item[fieldName] === value)) == null ? void 0 : _a.length) > 1) {
+        return `Item with this unique id already exists`;
+      }
+    }
   },
   parse: parse$2
 };
@@ -5731,7 +5723,7 @@ var testPassiveEventSupport = function testPassiveEventSupport2() {
   }
   var passive = false;
   var options = Object.defineProperty({}, "passive", {
-    get: function get() {
+    get: function get2() {
       passive = true;
     }
   });
@@ -6579,6 +6571,111 @@ const HiddenFieldPlugin = {
   Component: HiddenField,
   parse: parse$2
 };
+const PasswordMask = "********";
+const PasswordFieldComponent = wrapFieldsWithMeta(({ field, form, meta, input, children }) => {
+  const ref1 = React.useRef(null);
+  const ref2 = React.useRef(null);
+  const [error, setError] = React.useState(false);
+  const [password, setPassword] = React.useState();
+  const [confirmPassword, setConfirmPassword] = React.useState();
+  const [passwordChangeRequired, setPasswordChangeRequired] = React.useState(input.value.passwordChangeRequired);
+  React.useEffect(() => {
+    if (password) {
+      if (password === confirmPassword) {
+        setError(false);
+        form.change(field.name, { value: password, passwordChangeRequired });
+      } else {
+        setError(true);
+        form.change(field.name, void 0);
+      }
+    } else {
+      setError(false);
+      form.change(field.name, { passwordChangeRequired });
+    }
+  }, [password, confirmPassword, passwordChangeRequired]);
+  return /* @__PURE__ */ React.createElement("div", { className: "flex flex-col" }, /* @__PURE__ */ React.createElement("div", { className: "flex flex-row space-x-4" }, /* @__PURE__ */ React.createElement(
+    BasePasswordField,
+    {
+      autoComplete: "off",
+      value: password ?? PasswordMask,
+      ref: ref1,
+      disabled: (field == null ? void 0 : field.disabled) ?? false,
+      error,
+      placeholder: field.placeholder || "Password",
+      onKeyDown: (_) => {
+        if (password === void 0) {
+          setPassword("");
+        }
+        if (confirmPassword === void 0) {
+          setConfirmPassword("");
+        }
+      },
+      onChange: (event) => {
+        setPassword(event.target.value);
+      }
+    }
+  ), /* @__PURE__ */ React.createElement(
+    BasePasswordField,
+    {
+      autoComplete: "off",
+      ref: ref2,
+      value: confirmPassword ?? PasswordMask,
+      disabled: (field == null ? void 0 : field.disabled) ?? false,
+      error,
+      placeholder: field.confirmPlaceholder || "Confirm Password",
+      onKeyDown: (_) => {
+        setPasswordChangeRequired(true);
+        if (password === void 0) {
+          setPassword("");
+        }
+        if (confirmPassword === void 0) {
+          setConfirmPassword("");
+        }
+      },
+      onChange: (event) => {
+        setConfirmPassword(event.target.value);
+      }
+    }
+  ), /* @__PURE__ */ React.createElement(
+    Button,
+    {
+      variant: "secondary",
+      disabled: password === void 0 && confirmPassword === void 0,
+      onClick: () => {
+        setError(false);
+        setPassword(void 0);
+        setConfirmPassword(void 0);
+        setPasswordChangeRequired(void 0);
+        form.change(field.name, void 0);
+      }
+    },
+    "Reset"
+  )), /* @__PURE__ */ React.createElement("div", { className: "flex w-full items-center pl-1 pt-3" }, /* @__PURE__ */ React.createElement(
+    Toggle,
+    {
+      field: { name: "passwordChangeRequired", component: "toggle" },
+      input: {
+        value: passwordChangeRequired ?? true,
+        onChange: () => setPasswordChangeRequired(!passwordChangeRequired)
+      },
+      name: "passwordChangeRequired"
+    }
+  ), /* @__PURE__ */ React.createElement("div", null, /* @__PURE__ */ React.createElement("label", { className: "block font-sans text-xs font-semibold text-gray-700 whitespace-normal h-full items-center ml-1" }, "Require Password Change on Next Login"))));
+});
+const PasswordFieldPlugin = {
+  name: "password",
+  Component: PasswordFieldComponent,
+  validate(value, values, meta, field) {
+    let password = value;
+    if (Array.isArray(value)) {
+      password = value[0];
+    }
+    if (field.required && (password == null ? void 0 : password.passwordChangeRequired) === void 0) {
+      return "Required";
+    }
+  },
+  parse: parse$2
+};
 function GrCircleQuestion(props) {
   return GenIcon({ "tag": "svg", "attr": { "viewBox": "0 0 24 24" }, "child": [{ "tag": "path", "attr": { "fill": "none", "stroke": "#000", "strokeWidth": "2", "d": "M12,22 C17.5228475,22 22,17.5228475 22,12 C22,6.4771525 17.5228475,2 12,2 C6.4771525,2 2,6.4771525 2,12 C2,17.5228475 6.4771525,22 12,22 Z M12,15 L12,14 C12,13 12,12.5 13,12 C14,11.5 15,11 15,9.5 C15,8.5 14,7 12,7 C10,7 9,8.26413718 9,10 M12,16 L12,18" } }] })(props);
 }
@@ -7533,14 +7630,19 @@ class TinaMediaStore {
     if (!this.api) {
       this.api = (_b = (_a = this.cms) == null ? void 0 : _a.api) == null ? void 0 : _b.tina;
       this.isLocal = !!this.api.isLocalMode;
-      const contentApiUrl = new URL(this.api.contentApiUrl);
-      this.url = `${contentApiUrl.origin}/media`;
-      if (!this.isLocal) {
-        if ((_d = (_c = this.api.options) == null ? void 0 : _c.tinaioConfig) == null ? void 0 : _d.assetsApiUrlOverride) {
-          const url = new URL(this.api.assetsApiUrl);
-          this.url = `${url.origin}/v1/${this.api.clientId}`;
-        } else {
-          this.url = `${contentApiUrl.origin.replace("content", "assets")}/v1/${this.api.clientId}`;
+      if (!this.isStatic) {
+        const contentApiUrl = new URL(this.api.contentApiUrl);
+        this.url = `${contentApiUrl.origin}/media`;
+        if (!this.isLocal) {
+          if ((_d = (_c = this.api.options) == null ? void 0 : _c.tinaioConfig) == null ? void 0 : _d.assetsApiUrlOverride) {
+            const url = new URL(this.api.assetsApiUrl);
+            this.url = `${url.origin}/v1/${this.api.clientId}`;
+          } else {
+            this.url = `${contentApiUrl.origin.replace(
+              "content",
+              "assets"
+            )}/v1/${this.api.clientId}`;
+          }
         }
       }
     }
@@ -7680,6 +7782,38 @@ class TinaMediaStore {
   }
   async list(options) {
     this.setup();
+    if (this.staticMedia) {
+      const offset = options.offset || 0;
+      const media = this.staticMedia[String(offset)];
+      let hasMore = false;
+      if (this.staticMedia[String(Number(offset) + 20)]) {
+        hasMore = true;
+      }
+      if (options.directory) {
+        let depth = 0;
+        const pathToDirectory = options.directory.split("/");
+        let currentFolder = media;
+        let hasMore2 = false;
+        while (depth < pathToDirectory.length) {
+          const nextFolder = currentFolder.find(
+            (item) => item.type === "dir" && item.filename === pathToDirectory[depth]
+          );
+          if (nextFolder) {
+            const offset2 = options.offset || 0;
+            currentFolder = nextFolder.children[String(offset2)];
+            if (nextFolder.children[String(Number(offset2) + 20)]) {
+              hasMore2 = true;
+            }
+          }
+          depth++;
+        }
+        return {
+          items: currentFolder,
+          nextOffset: hasMore2 ? Number(offset) + 20 : null
+        };
+      }
+      return { items: media, nextOffset: hasMore ? Number(offset) + 20 : null };
+    }
     let res;
     if (!this.isLocal) {
       if (await this.isAuthenticated()) {
@@ -7732,38 +7866,6 @@ class TinaMediaStore {
         filename: dir
       });
     }
-    if (this.staticMedia) {
-      const offset = options.offset || 0;
-      const media = this.staticMedia[String(offset)];
-      let hasMore = false;
-      if (this.staticMedia[String(Number(offset) + 20)]) {
-        hasMore = true;
-      }
-      if (options.directory) {
-        let depth = 0;
-        const pathToDirectory = options.directory.split("/");
-        let currentFolder = media;
-        let hasMore2 = false;
-        while (depth < pathToDirectory.length) {
-          const nextFolder = currentFolder.find(
-            (item) => item.type === "dir" && item.filename === pathToDirectory[depth]
-          );
-          if (nextFolder) {
-            const offset2 = options.offset || 0;
-            currentFolder = nextFolder.children[String(offset2)];
-            if (nextFolder.children[String(Number(offset2) + 20)]) {
-              hasMore2 = true;
-            }
-          }
-          depth++;
-        }
-        return {
-          items: currentFolder,
-          nextOffset: hasMore2 ? Number(offset) + 20 : null
-        };
-      }
-      return { items: media, nextOffset: hasMore ? Number(offset) + 20 : null };
-    }
     return {
       items,
       nextOffset: cursor || 0
@@ -8429,6 +8531,9 @@ const FormHeader = ({ activeForm }) => {
 function ImFilesEmpty(props) {
   return GenIcon({ "tag": "svg", "attr": { "version": "1.1", "viewBox": "0 0 16 16" }, "child": [{ "tag": "path", "attr": { "d": "M14.341 5.579c-0.347-0.473-0.831-1.027-1.362-1.558s-1.085-1.015-1.558-1.362c-0.806-0.591-1.197-0.659-1.421-0.659h-5.75c-0.689 0-1.25 0.561-1.25 1.25v11.5c0 0.689 0.561 1.25 1.25 1.25h9.5c0.689 0 1.25-0.561 1.25-1.25v-7.75c0-0.224-0.068-0.615-0.659-1.421zM12.271 4.729c0.48 0.48 0.856 0.912 1.134 1.271h-2.406v-2.405c0.359 0.278 0.792 0.654 1.271 1.134v0zM14 14.75c0 0.136-0.114 0.25-0.25 0.25h-9.5c-0.136 0-0.25-0.114-0.25-0.25v-11.5c0-0.135 0.114-0.25 0.25-0.25 0 0 5.749-0 5.75 0v3.5c0 0.276 0.224 0.5 0.5 0.5h3.5v7.75z" } }, { "tag": "path", "attr": { "d": "M9.421 0.659c-0.806-0.591-1.197-0.659-1.421-0.659h-5.75c-0.689 0-1.25 0.561-1.25 1.25v11.5c0 0.604 0.43 1.109 1 1.225v-12.725c0-0.135 0.115-0.25 0.25-0.25h7.607c-0.151-0.124-0.297-0.238-0.437-0.341z" } }] })(props);
 }
+function ImUsers(props) {
+  return GenIcon({ "tag": "svg", "attr": { "version": "1.1", "viewBox": "0 0 18 16" }, "child": [{ "tag": "path", "attr": { "d": "M12 12.041v-0.825c1.102-0.621 2-2.168 2-3.716 0-2.485 0-4.5-3-4.5s-3 2.015-3 4.5c0 1.548 0.898 3.095 2 3.716v0.825c-3.392 0.277-6 1.944-6 3.959h14c0-2.015-2.608-3.682-6-3.959z" } }, { "tag": "path", "attr": { "d": "M5.112 12.427c0.864-0.565 1.939-0.994 3.122-1.256-0.235-0.278-0.449-0.588-0.633-0.922-0.475-0.863-0.726-1.813-0.726-2.748 0-1.344 0-2.614 0.478-3.653 0.464-1.008 1.299-1.633 2.488-1.867-0.264-1.195-0.968-1.98-2.841-1.98-3 0-3 2.015-3 4.5 0 1.548 0.898 3.095 2 3.716v0.825c-3.392 0.277-6 1.944-6 3.959h4.359c0.227-0.202 0.478-0.393 0.753-0.573z" } }] })(props);
+}
 const LocalWarning = () => {
   return /* @__PURE__ */ React.createElement(
     "a",
@@ -8516,10 +8621,10 @@ const useGetEvents = (cms, cursor, existingEvents) => {
   const [error, setError] = useState(void 0);
   React.useEffect(() => {
     const fetchEvents = async () => {
-      var _a, _b, _c, _d;
+      var _a, _b, _c, _d, _e;
       let doFetchEvents = false;
       if (!((_b = (_a = cms.api) == null ? void 0 : _a.tina) == null ? void 0 : _b.isCustomContentApi)) {
-        doFetchEvents = await ((_d = (_c = cms.api) == null ? void 0 : _c.tina) == null ? void 0 : _d.isAuthenticated());
+        doFetchEvents = await ((_e = (_d = (_c = cms.api) == null ? void 0 : _c.tina) == null ? void 0 : _d.authProvider) == null ? void 0 : _e.isAuthenticated());
       }
       if (doFetchEvents) {
         try {
@@ -8678,17 +8783,40 @@ const Nav = ({
   RenderNavSite,
   RenderNavCloud,
   RenderNavCollection,
+  AuthRenderNavCollection,
   ...props
 }) => {
   const cms = useCMS$1();
   const { setEdit } = useEditState();
   const [eventsOpen, setEventsOpen] = React.useState(false);
+  const { contentCollections, authCollection } = collectionsInfo.collections.reduce(
+    (acc, collection) => {
+      if (collection.isAuthCollection) {
+        acc.authCollection = collection;
+      } else {
+        acc.contentCollections.push(collection);
+      }
+      return acc;
+    },
+    {
+      contentCollections: []
+    }
+  );
   function closeEventsModal() {
     setEventsOpen(false);
   }
   const WrappedSyncStatus = React.forwardRef(
     (props2, ref) => /* @__PURE__ */ React.createElement(SyncStatus, { ...props2 })
   );
+  const screenCategories = screens.reduce(
+    (acc, screen) => {
+      const category = screen.navCategory || "Site";
+      acc[category] = acc[category] || [];
+      acc[category].push(screen);
+      return acc;
+    },
+    { Site: [] }
+  );
   return /* @__PURE__ */ React.createElement(
     "div",
     {
@@ -8734,18 +8862,21 @@ const Nav = ({
         {
           className: `text-lg px-4 py-2 first:pt-3 last:pb-3 tracking-wide whitespace-nowrap flex items-center opacity-80 text-gray-600 hover:text-blue-400 hover:bg-gray-50 hover:opacity-100`,
           onClick: async () => {
-            var _a, _b, _c, _d, _e, _f;
+            var _a, _b, _c, _d, _e, _f, _g, _h;
             updateBodyDisplacement({
               displayState: "closed",
               sidebarWidth: null,
               resizingSidebar: false
             });
             try {
-              if ((_b = (_a = cms == null ? void 0 : cms.api) == null ? void 0 : _a.tina) == null ? void 0 : _b.logout) {
-                await cms.api.tina.logout();
-                if ((_d = (_c = cms == null ? void 0 : cms.api) == null ? void 0 : _c.tina) == null ? void 0 : _d.onLogout) {
-                  await ((_f = (_e = cms == null ? void 0 : cms.api) == null ? void 0 : _e.tina) == null ? void 0 : _f.onLogout());
+              if ((_c = (_b = (_a = cms == null ? void 0 : cms.api) == null ? void 0 : _a.tina) == null ? void 0 : _b.authProvider) == null ? void 0 : _c.logout) {
+                await ((_d = cms.api.tina) == null ? void 0 : _d.authProvider.logout());
+                if ((_f = (_e = cms == null ? void 0 : cms.api) == null ? void 0 : _e.tina) == null ? void 0 : _f.onLogout) {
+                  await ((_h = (_g = cms == null ? void 0 : cms.api) == null ? void 0 : _g.tina) == null ? void 0 : _h.onLogout());
                 }
+                window.location.href = new URL(
+                  window.location.href
+                ).pathname;
               }
               setEdit(false);
             } catch (e) {
@@ -8778,13 +8909,25 @@ const Nav = ({
       CollectionsList,
       {
         RenderNavCollection,
-        ...collectionsInfo
+        collections: contentCollections
       }
-    )), (screens.length > 0 || contentCreators.length) > 0 && /* @__PURE__ */ React.createElement(React.Fragment, null, /* @__PURE__ */ React.createElement("h4", { className: "uppercase font-sans font-bold text-sm mb-3 mt-8 text-gray-700" }, "Site"), /* @__PURE__ */ React.createElement("ul", { className: "flex flex-col gap-4" }, screens.map((view) => {
+    )), (screenCategories.Site.length > 0 || contentCreators.length) > 0 && /* @__PURE__ */ React.createElement(React.Fragment, null, /* @__PURE__ */ React.createElement("h4", { className: "uppercase font-sans font-bold text-sm mb-3 mt-8 text-gray-700" }, "Site"), /* @__PURE__ */ React.createElement("ul", { className: "flex flex-col gap-4" }, screenCategories.Site.map((view) => {
       return /* @__PURE__ */ React.createElement("li", { key: `nav-site-${view.name}` }, /* @__PURE__ */ React.createElement(RenderNavSite, { view }));
     }), contentCreators.map((plugin, idx) => {
       return /* @__PURE__ */ React.createElement(CreateContentNavItem, { key: `plugin-${idx}`, plugin });
-    }))), !!(cloudConfigs == null ? void 0 : cloudConfigs.length) && /* @__PURE__ */ React.createElement(React.Fragment, null, /* @__PURE__ */ React.createElement("h4", { className: "uppercase font-sans font-bold text-sm mb-3 mt-8 text-gray-700" }, "Cloud"), /* @__PURE__ */ React.createElement("ul", { className: "flex flex-col gap-4" }, cloudConfigs.map((config) => {
+    }), authCollection && /* @__PURE__ */ React.createElement(
+      CollectionsList,
+      {
+        RenderNavCollection: AuthRenderNavCollection,
+        collections: [authCollection]
+      }
+    ))), Object.entries(screenCategories).map(([category, screens2]) => {
+      if (category !== "Site") {
+        return /* @__PURE__ */ React.createElement("div", { key: category }, /* @__PURE__ */ React.createElement("h4", { className: "uppercase font-sans font-bold text-sm mb-3 mt-8 text-gray-700" }, category), /* @__PURE__ */ React.createElement("ul", { className: "flex flex-col gap-4" }, screens2.map((view) => {
+          return /* @__PURE__ */ React.createElement("li", { key: `nav-site-${view.name}` }, /* @__PURE__ */ React.createElement(RenderNavSite, { view }));
+        })));
+      }
+    }), !!(cloudConfigs == null ? void 0 : cloudConfigs.length) && /* @__PURE__ */ React.createElement(React.Fragment, null, /* @__PURE__ */ React.createElement("h4", { className: "uppercase font-sans font-bold text-sm mb-3 mt-8 text-gray-700" }, "Cloud"), /* @__PURE__ */ React.createElement("ul", { className: "flex flex-col gap-4" }, cloudConfigs.map((config) => {
       return /* @__PURE__ */ React.createElement("li", { key: `nav-site-${config.name}` }, /* @__PURE__ */ React.createElement(RenderNavCloud, { config }));
     }))))
   );
@@ -8941,6 +9084,12 @@ const Sidebar$1 = ({
   const [activeScreen, setActiveView] = useState(null);
   const [sidebarWidth, setSidebarWidth] = React.useState(defaultWidth);
   const [formIsPristine, setFormIsPristine] = React.useState(true);
+  const activeScreens = allScreens.filter(
+    (screen) => {
+      var _a2, _b2;
+      return screen.navCategory !== "Account" || ((_b2 = (_a2 = cms.api.tina) == null ? void 0 : _a2.authProvider) == null ? void 0 : _b2.getLoginStrategy()) === "UsernamePassword";
+    }
+  );
   const setDisplayState = (value) => cms.dispatch({ type: "sidebar:set-display-state", value });
   const displayState = cms.state.sidebarDisplayState;
   React.useEffect(() => {
@@ -9036,7 +9185,7 @@ const Sidebar$1 = ({
         isLocalMode: (_b = (_a = cms.api) == null ? void 0 : _a.tina) == null ? void 0 : _b.isLocalMode,
         showCollections: isTinaAdminEnabled,
         collectionsInfo,
-        screens: allScreens,
+        screens: activeScreens,
         cloudConfigs: allConfigs,
         contentCreators,
         sidebarWidth,
@@ -9059,6 +9208,16 @@ const Sidebar$1 = ({
             },
             collection
           }
+        ),
+        AuthRenderNavCollection: ({ collection }) => /* @__PURE__ */ React.createElement(
+          SidebarCollectionLink,
+          {
+            onClick: () => {
+              setMenuIsOpen(false);
+            },
+            collection,
+            Icon: ImUsers
+          }
         )
       }
     ), /* @__PURE__ */ React.createElement(SidebarBody, null, /* @__PURE__ */ React.createElement(
@@ -9093,7 +9252,7 @@ const Sidebar$1 = ({
           className: "rounded-r-md",
           showCollections: isTinaAdminEnabled,
           collectionsInfo,
-          screens: allScreens,
+          screens: activeScreens,
           cloudConfigs: allConfigs,
           contentCreators,
           sidebarWidth,
@@ -9116,6 +9275,16 @@ const Sidebar$1 = ({
               },
               collection
             }
+          ),
+          AuthRenderNavCollection: ({ collection }) => /* @__PURE__ */ React.createElement(
+            SidebarCollectionLink,
+            {
+              onClick: () => {
+                setMenuIsOpen(false);
+              },
+              collection,
+              Icon: ImUsers
+            }
           )
         },
         /* @__PURE__ */ React.createElement("div", { className: "absolute top-8 right-0 transform translate-x-full overflow-hidden" }, /* @__PURE__ */ React.createElement(
@@ -9277,6 +9446,7 @@ const SidebarCloudLink$1 = ({ config }) => {
   return /* @__PURE__ */ React.createElement("span", { className: "text-base tracking-wide text-gray-500 hover:text-blue-600 flex items-center opacity-90 hover:opacity-100" }, /* @__PURE__ */ React.createElement(config.Icon, { className: "mr-2 h-6 opacity-80 w-auto" }), /* @__PURE__ */ React.createElement("a", { target: "_blank", href: config.link.href }, config.link.text));
 };
 const SidebarCollectionLink = ({
+  Icon = ImFilesEmpty,
   collection,
   onClick
 }) => {
@@ -9289,7 +9459,7 @@ const SidebarCollectionLink = ({
       href: `${tinaPreview ? `/${tinaPreview}/index.html#` : "/admin#"}/collections/${collection.name}/~`,
       className: "text-base tracking-wide text-gray-500 hover:text-blue-600 flex items-center opacity-90 hover:opacity-100"
     },
-    /* @__PURE__ */ React.createElement(ImFilesEmpty, { className: "mr-2 h-6 opacity-80 w-auto" }),
+    /* @__PURE__ */ React.createElement(Icon, { className: "mr-2 h-6 opacity-80 w-auto" }),
     " ",
     collection.label ? collection.label : collection.name
   );
@@ -10005,7 +10175,9 @@ const SyncStatusContainer = ({ children }) => {
         setSyncStatus(project.mediaBranch ? "synced" : "needs-sync");
       }
     };
-    checkSyncStatus();
+    if (!cms.media.store.isStatic) {
+      checkSyncStatus();
+    }
   }, []);
   return syncStatus == "needs-sync" ? /* @__PURE__ */ React__default.createElement("div", { className: "h-full flex items-center justify-center p-6 bg-gradient-to-t from-gray-200 to-transparent" }, /* @__PURE__ */ React__default.createElement("div", { className: "rounded-lg border shadow-sm px-4 lg:px-6 py-3 lg:py-4 bg-gradient-to-r from-yellow-50 to-yellow-100 border-yellow-200 mx-auto mb-12" }, /* @__PURE__ */ React__default.createElement("div", { className: "flex items-start sm:items-center gap-2" }, /* @__PURE__ */ React__default.createElement(
     BiError,
@@ -10095,6 +10267,108 @@ const MediaManagerScreenPlugin = createScreen({
     allowDelete: true
   }
 });
+function UpdatePassword(props) {
+  const cms = useCMS$1();
+  const client = cms.api.tina;
+  const [password, setPassword] = useState("");
+  const [confirmPassword, setConfirmPassword] = useState("");
+  const [dirty, setDirty] = useState(false);
+  const [result, setResult] = useState(null);
+  const [formState, setFormState] = useState("idle");
+  const [passwordChangeRequired, setPasswordChangeRequired] = useState(false);
+  useEffect(() => {
+    var _a;
+    (_a = client == null ? void 0 : client.authProvider) == null ? void 0 : _a.getUser().then(
+      (user) => setPasswordChangeRequired((user == null ? void 0 : user.passwordChangeRequired) ?? false)
+    );
+  }, []);
+  let err = null;
+  if (dirty && password !== confirmPassword) {
+    err = "Passwords do not match";
+  }
+  if (dirty && !password) {
+    err = "Please enter a password";
+  }
+  const updatePassword = async () => {
+    var _a;
+    setResult(null);
+    setFormState("busy");
+    const res = await cms.api.tina.request(
+      `mutation($password: String!) { updatePassword(password: $password) }`,
+      {
+        variables: {
+          password
+        }
+      }
+    );
+    if (!(res == null ? void 0 : res.updatePassword)) {
+      setResult("Error updating password");
+    } else {
+      setDirty(false);
+      setPassword("");
+      setConfirmPassword("");
+      setResult("Password updated");
+      setPasswordChangeRequired(false);
+      await new Promise((resolve) => setTimeout(resolve, 1e3));
+      (_a = client == null ? void 0 : client.authProvider) == null ? void 0 : _a.logout().then(async () => {
+        if (typeof (client == null ? void 0 : client.onLogout) === "function") {
+          await client.onLogout();
+        }
+        window.location.href = new URL(window.location.href).pathname;
+      }).catch((e) => console.error(e));
+    }
+    setFormState("idle");
+  };
+  return /* @__PURE__ */ React__default.createElement(React__default.Fragment, null, /* @__PURE__ */ React__default.createElement("div", { className: "flex justify-center items-center h-full" }, /* @__PURE__ */ React__default.createElement("div", { className: "flex flex-col space-y-8 p-6" }, passwordChangeRequired && /* @__PURE__ */ React__default.createElement("div", { className: "text-center text-red-500" }, "Your password has expired. Please update your password."), /* @__PURE__ */ React__default.createElement("label", { className: "block" }, /* @__PURE__ */ React__default.createElement("span", { className: "text-gray-700" }, "New Password"), /* @__PURE__ */ React__default.createElement(
+    BaseTextField,
+    {
+      type: "password",
+      name: "password",
+      id: "password",
+      placeholder: "Enter password",
+      className: err ? "border-red-500" : "border-gray-300 focus:ring-indigo-500 focus:border-indigo-500",
+      value: password,
+      onKeyDown: () => {
+        setDirty(true);
+        setResult(null);
+      },
+      onChange: (e) => setPassword(e.target.value),
+      required: true
+    }
+  )), /* @__PURE__ */ React__default.createElement("label", { className: "block" }, /* @__PURE__ */ React__default.createElement("span", { className: "text-gray-700" }, "Confirm New Password"), /* @__PURE__ */ React__default.createElement(
+    BaseTextField,
+    {
+      type: "password",
+      name: "confirmPassword",
+      id: "confirmPassword",
+      placeholder: "Confirm password",
+      className: err ? "border-red-500" : "border-gray-300 focus:ring-indigo-500 focus:border-indigo-500",
+      value: confirmPassword,
+      onKeyDown: () => {
+        setDirty(true);
+        setResult(null);
+      },
+      onChange: (e) => setConfirmPassword(e.target.value),
+      required: true
+    }
+  )), result && /* @__PURE__ */ React__default.createElement("div", { className: "text-center text-sm text-gray-500" }, result), err && /* @__PURE__ */ React__default.createElement("div", { className: "text-center text-sm text-red-500" }, err), /* @__PURE__ */ React__default.createElement(
+    Button,
+    {
+      onClick: updatePassword,
+      disabled: err,
+      variant: "primary",
+      busy: formState === "busy"
+    },
+    "Update"
+  ))));
+}
+const PasswordScreenPlugin = createScreen({
+  name: "Change Password",
+  Component: UpdatePassword,
+  Icon: MdVpnKey,
+  layout: "fullscreen",
+  navCategory: "Account"
+});
 function createCloudConfig({
   ...options
 }) {
@@ -10124,7 +10398,8 @@ const DEFAULT_FIELDS = [
   CheckboxGroupFieldPlugin,
   ReferenceFieldPlugin,
   ButtonToggleFieldPlugin,
-  HiddenFieldPlugin
+  HiddenFieldPlugin,
+  PasswordFieldPlugin
 ];
 class TinaCMS extends CMS {
   constructor({
@@ -10163,6 +10438,7 @@ class TinaCMS extends CMS {
       }
     });
     this.plugins.add(MediaManagerScreenPlugin);
+    this.plugins.add(PasswordScreenPlugin);
     if (isLocalClient !== true) {
       if (clientId) {
         this.plugins.add(
@@ -26392,25 +26668,6 @@ const parseSearchIndexResponse = (data, options) => {
     };
   }
 };
-const captureBranchName = /^refs\/heads\/(.*)/;
-const parseRefForBranchName = (ref) => {
-  const matches = ref.match(captureBranchName);
-  return matches[1];
-};
-const ListBranchResponse = z.object({
-  name: z.string(),
-  protected: z.boolean().optional().default(false),
-  githubPullRequestUrl: z.string().optional()
-}).array().nonempty();
-const IndexStatusResponse = z.object({
-  status: z.union([
-    z.literal("complete"),
-    z.literal("unknown"),
-    z.literal("failed"),
-    z.literal("inprogress")
-  ]).optional(),
-  timestamp: z.number().optional()
-});
 function asyncPoll(fn, pollInterval = 5 * 1e3, pollTimeout = 30 * 1e3) {
   const endTime = (/* @__PURE__ */ new Date()).getTime() + pollTimeout;
   let stop = false;
@@ -26435,19 +26692,261 @@ function asyncPoll(fn, pollInterval = 5 * 1e3, pollTimeout = 30 * 1e3) {
   };
   return [new Promise(checkCondition), cancel];
 }
-class Client {
-  constructor({ tokenStorage = "MEMORY", ...options }) {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _A, _B, _C, _D, _E, _F, _G, _H, _I, _J, _K, _L, _M, _N, _O, _P, _Q, _R, _S, _T, _U, _V, _W, _X;
-    this.events = new EventBus();
-    this.protectedBranches = [];
-    this.usingEditorialWorkflow = false;
-    this.addPendingContent = async (props) => {
-      const mutation = `#graphql
-mutation addPendingDocumentMutation(
-  $relativePath: String!
-  $collection: String!
-  $template: String
-) {
+function popupWindow(url, title, window2, w, h) {
+  const y = window2.top.outerHeight / 2 + window2.top.screenY - h / 2;
+  const x = window2.top.outerWidth / 2 + window2.top.screenX - w / 2;
+  return window2.open(
+    url,
+    title,
+    "toolbar=no, location=no, directories=no, status=no, menubar=no, scrollbars=yes, resizable=yes, copyhistory=no, width=" + w + ", height=" + h + ", top=" + y + ", left=" + x
+  );
+}
+const TINA_LOGIN_EVENT = "tinaCloudLogin";
+const AUTH_TOKEN_KEY = "tinacms-auth";
+const authenticate = (clientId, frontendUrl) => {
+  return new Promise((resolve) => {
+    let authTab;
+    window.addEventListener("message", function(e) {
+      if (e.data.source === TINA_LOGIN_EVENT) {
+        if (authTab) {
+          authTab.close();
+        }
+        resolve({
+          id_token: e.data.id_token,
+          access_token: e.data.access_token,
+          refresh_token: e.data.refresh_token
+        });
+      }
+    });
+    const origin = `${window.location.protocol}//${window.location.host}`;
+    authTab = popupWindow(
+      `${frontendUrl}/signin?clientId=${clientId}&origin=${origin}`,
+      "_blank",
+      window,
+      1e3,
+      700
+    );
+  });
+};
+const DefaultSessionProvider = ({
+  children
+}) => /* @__PURE__ */ React__default.createElement(React__default.Fragment, null, children);
+class AbstractAuthProvider {
+  /**
+   * Wraps the normal fetch function with same API but adds the authorization header token.
+   *
+   * @example
+   * const test = await tinaCloudClient.fetchWithToken(`/mycustomAPI/thing/one`) // the token will be passed in the authorization header
+   *
+   * @param input fetch function input
+   * @param init fetch function init
+   */
+  async fetchWithToken(input, init) {
+    const headers2 = (init == null ? void 0 : init.headers) || {};
+    const token = await this.getToken();
+    if (token == null ? void 0 : token.id_token) {
+      headers2["Authorization"] = "Bearer " + (token == null ? void 0 : token.id_token);
+    }
+    return await fetch(input, {
+      ...init || {},
+      headers: new Headers(headers2)
+    });
+  }
+  async authorize(context) {
+    return this.getToken();
+  }
+  async isAuthorized(context) {
+    return !!await this.authorize(context);
+  }
+  async isAuthenticated() {
+    return !!await this.getUser();
+  }
+  getLoginStrategy() {
+    return "Redirect";
+  }
+  getSessionProvider() {
+    return DefaultSessionProvider;
+  }
+}
+class TinaCloudAuthProvider extends AbstractAuthProvider {
+  constructor({
+    clientId,
+    identityApiUrl,
+    tokenStorage = "MEMORY",
+    frontendUrl,
+    ...options
+  }) {
+    super();
+    this.frontendUrl = frontendUrl;
+    this.clientId = clientId;
+    this.identityApiUrl = identityApiUrl;
+    switch (tokenStorage) {
+      case "LOCAL_STORAGE":
+        this.getToken = async function() {
+          const tokens = localStorage.getItem(AUTH_TOKEN_KEY) || null;
+          if (tokens) {
+            return await this.getRefreshedToken(tokens);
+          } else {
+            return {
+              access_token: null,
+              id_token: null,
+              refresh_token: null
+            };
+          }
+        };
+        this.setToken = function(token) {
+          localStorage.setItem(AUTH_TOKEN_KEY, JSON.stringify(token, null, 2));
+        };
+        break;
+      case "MEMORY":
+        this.getToken = async () => {
+          if (this.token) {
+            return await this.getRefreshedToken(this.token);
+          } else {
+            return {
+              access_token: null,
+              id_token: null,
+              refresh_token: null
+            };
+          }
+        };
+        this.setToken = (token) => {
+          this.token = JSON.stringify(token, null, 2);
+        };
+        break;
+      case "CUSTOM":
+        if (!options.getTokenFn) {
+          throw new Error(
+            "When CUSTOM token storage is selected, a getTokenFn must be provided"
+          );
+        }
+        this.getToken = options.getTokenFn;
+        break;
+    }
+  }
+  async authenticate() {
+    const token = await authenticate(this.clientId, this.frontendUrl);
+    this.setToken(token);
+    return token;
+  }
+  async getUser() {
+    if (!this.clientId) {
+      return null;
+    }
+    const url = `${this.identityApiUrl}/v2/apps/${this.clientId}/currentUser`;
+    try {
+      const res = await this.fetchWithToken(url, {
+        method: "GET"
+      });
+      const val = await res.json();
+      if (!res.status.toString().startsWith("2")) {
+        console.error(val.error);
+        return null;
+      }
+      return val;
+    } catch (e) {
+      console.error(e);
+      return null;
+    }
+  }
+  async logout() {
+    this.setToken(null);
+  }
+  async getRefreshedToken(tokens) {
+    const { access_token, id_token, refresh_token } = JSON.parse(tokens);
+    const { exp, iss, client_id } = this.parseJwt(access_token);
+    if (Date.now() / 1e3 >= exp - 120) {
+      const refreshResponse = await fetch(iss, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-amz-json-1.1",
+          "x-amz-target": "AWSCognitoIdentityProviderService.InitiateAuth"
+        },
+        body: JSON.stringify({
+          ClientId: client_id,
+          AuthFlow: "REFRESH_TOKEN_AUTH",
+          AuthParameters: {
+            REFRESH_TOKEN: refresh_token,
+            DEVICE_KEY: null
+          }
+        })
+      });
+      if (refreshResponse.status !== 200) {
+        throw new Error("Unable to refresh auth tokens");
+      }
+      const responseJson = await refreshResponse.json();
+      const newToken = {
+        access_token: responseJson.AuthenticationResult.AccessToken,
+        id_token: responseJson.AuthenticationResult.IdToken,
+        refresh_token
+      };
+      this.setToken(newToken);
+      return Promise.resolve(newToken);
+    }
+    return Promise.resolve({ access_token, id_token, refresh_token });
+  }
+  parseJwt(token) {
+    const base64Url = token.split(".")[1];
+    const base64 = base64Url.replace(/-/g, "+").replace(/_/g, "/");
+    const jsonPayload = decodeURIComponent(
+      atob(base64).split("").map(function(c) {
+        return "%" + ("00" + c.charCodeAt(0).toString(16)).slice(-2);
+      }).join("")
+    );
+    return JSON.parse(jsonPayload);
+  }
+}
+const LOCAL_CLIENT_KEY = "tina.local.isLogedIn";
+class LocalAuthProvider extends AbstractAuthProvider {
+  constructor() {
+    super();
+  }
+  async authenticate() {
+    localStorage.setItem(LOCAL_CLIENT_KEY, "true");
+    return { access_token: "LOCAL", id_token: "LOCAL", refresh_token: "LOCAL" };
+  }
+  async getUser() {
+    return localStorage.getItem(LOCAL_CLIENT_KEY) === "true";
+  }
+  async getToken() {
+    return Promise.resolve({ id_token: "" });
+  }
+  async logout() {
+    localStorage.removeItem(LOCAL_CLIENT_KEY);
+  }
+}
+const captureBranchName = /^refs\/heads\/(.*)/;
+const parseRefForBranchName = (ref) => {
+  const matches = ref.match(captureBranchName);
+  return matches[1];
+};
+const ListBranchResponse = z.object({
+  name: z.string(),
+  protected: z.boolean().optional().default(false),
+  githubPullRequestUrl: z.string().optional()
+}).array().nonempty();
+const IndexStatusResponse = z.object({
+  status: z.union([
+    z.literal("complete"),
+    z.literal("unknown"),
+    z.literal("failed"),
+    z.literal("inprogress")
+  ]).optional(),
+  timestamp: z.number().optional()
+});
+class Client {
+  constructor({ tokenStorage = "MEMORY", ...options }) {
+    var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q, _r, _s, _t, _u;
+    this.events = new EventBus();
+    this.protectedBranches = [];
+    this.usingEditorialWorkflow = false;
+    this.addPendingContent = async (props) => {
+      const mutation = `#graphql
+mutation addPendingDocumentMutation(
+  $relativePath: String!
+  $collection: String!
+  $template: String
+) {
   addPendingDocument(
     relativePath: $relativePath
     template: $template
@@ -26491,20 +26990,8 @@ mutation addPendingDocumentMutation(
       return parse$3(data.getOptimizedQuery);
     };
     this.tinaGraphQLVersion = options.tinaGraphQLVersion;
-    this.onLogin = (_d = (_c = (_b = (_a = options.schema) == null ? void 0 : _a.config) == null ? void 0 : _b.admin) == null ? void 0 : _c.auth) == null ? void 0 : _d.onLogin;
-    this.onLogout = (_h = (_g = (_f = (_e = options.schema) == null ? void 0 : _e.config) == null ? void 0 : _f.admin) == null ? void 0 : _g.auth) == null ? void 0 : _h.onLogout;
-    if ((_l = (_k = (_j = (_i = options.schema) == null ? void 0 : _i.config) == null ? void 0 : _j.admin) == null ? void 0 : _k.auth) == null ? void 0 : _l.logout) {
-      this.onLogout = (_p = (_o = (_n = (_m = options.schema) == null ? void 0 : _m.config) == null ? void 0 : _n.admin) == null ? void 0 : _o.auth) == null ? void 0 : _p.logout;
-    }
-    if ((_t = (_s = (_r = (_q = options.schema) == null ? void 0 : _q.config) == null ? void 0 : _r.admin) == null ? void 0 : _s.auth) == null ? void 0 : _t.getUser) {
-      this.getUser = (_x = (_w = (_v = (_u = options.schema) == null ? void 0 : _u.config) == null ? void 0 : _v.admin) == null ? void 0 : _w.auth) == null ? void 0 : _x.getUser;
-    }
-    if ((_B = (_A = (_z = (_y = options.schema) == null ? void 0 : _y.config) == null ? void 0 : _z.admin) == null ? void 0 : _A.auth) == null ? void 0 : _B.authenticate) {
-      this.authenticate = (_F = (_E = (_D = (_C = options.schema) == null ? void 0 : _C.config) == null ? void 0 : _D.admin) == null ? void 0 : _E.auth) == null ? void 0 : _F.authenticate;
-    }
-    if ((_J = (_I = (_H = (_G = options.schema) == null ? void 0 : _G.config) == null ? void 0 : _H.admin) == null ? void 0 : _I.auth) == null ? void 0 : _J.authorize) {
-      this.authorize = (_N = (_M = (_L = (_K = options.schema) == null ? void 0 : _K.config) == null ? void 0 : _L.admin) == null ? void 0 : _M.auth) == null ? void 0 : _N.authorize;
-    }
+    this.onLogin = ((_d = (_c = (_b = (_a = options.schema) == null ? void 0 : _a.config) == null ? void 0 : _b.admin) == null ? void 0 : _c.authHooks) == null ? void 0 : _d.onLogin) || ((_h = (_g = (_f = (_e = options.schema) == null ? void 0 : _e.config) == null ? void 0 : _f.admin) == null ? void 0 : _g.auth) == null ? void 0 : _h.onLogin);
+    this.onLogout = ((_l = (_k = (_j = (_i = options.schema) == null ? void 0 : _i.config) == null ? void 0 : _j.admin) == null ? void 0 : _k.authHooks) == null ? void 0 : _l.onLogout) || ((_p = (_o = (_n = (_m = options.schema) == null ? void 0 : _m.config) == null ? void 0 : _n.admin) == null ? void 0 : _o.auth) == null ? void 0 : _p.onLogout);
     if (options.schema) {
       const enrichedSchema = new TinaSchema({
         version: { fullVersion: "", major: "", minor: "", patch: "" },
@@ -26514,7 +27001,7 @@ mutation addPendingDocumentMutation(
       this.schema = enrichedSchema;
     }
     this.options = options;
-    if ((_P = (_O = options.schema) == null ? void 0 : _O.config) == null ? void 0 : _P.contentApiUrlOverride) {
+    if ((_r = (_q = options.schema) == null ? void 0 : _q.config) == null ? void 0 : _r.contentApiUrlOverride) {
       this.options.customContentApiUrl = options.schema.config.contentApiUrlOverride;
     }
     this.setBranch(options.branch);
@@ -26525,52 +27012,13 @@ mutation addPendingDocumentMutation(
       }
     );
     this.clientId = options.clientId;
-    switch (tokenStorage) {
-      case "LOCAL_STORAGE":
-        this.getToken = async function() {
-          const tokens = localStorage.getItem(AUTH_TOKEN_KEY) || null;
-          if (tokens) {
-            return await this.getRefreshedToken(tokens);
-          } else {
-            return {
-              access_token: null,
-              id_token: null,
-              refresh_token: null
-            };
-          }
-        };
-        this.setToken = function(token) {
-          localStorage.setItem(AUTH_TOKEN_KEY, JSON.stringify(token, null, 2));
-        };
-        break;
-      case "MEMORY":
-        this.getToken = async () => {
-          if (this.token) {
-            return await this.getRefreshedToken(this.token);
-          } else {
-            return {
-              access_token: null,
-              id_token: null,
-              refresh_token: null
-            };
-          }
-        };
-        this.setToken = (token) => {
-          this.token = JSON.stringify(token, null, 2);
-        };
-        break;
-      case "CUSTOM":
-        if (!options.getTokenFn) {
-          throw new Error(
-            "When CUSTOM token storage is selected, a getTokenFn must be provided"
-          );
-        }
-        this.getToken = options.getTokenFn;
-        break;
-    }
-    if ((_T = (_S = (_R = (_Q = options.schema) == null ? void 0 : _Q.config) == null ? void 0 : _R.admin) == null ? void 0 : _S.auth) == null ? void 0 : _T.getToken) {
-      this.getToken = (_X = (_W = (_V = (_U = options.schema) == null ? void 0 : _U.config) == null ? void 0 : _V.admin) == null ? void 0 : _W.auth) == null ? void 0 : _X.getToken;
-    }
+    this.authProvider = ((_u = (_t = (_s = this.schema) == null ? void 0 : _s.config) == null ? void 0 : _t.config) == null ? void 0 : _u.authProvider) || new TinaCloudAuthProvider({
+      clientId: options.clientId,
+      identityApiUrl: this.identityApiUrl,
+      getTokenFn: options.getTokenFn,
+      tokenStorage,
+      frontendUrl: this.frontendUrl
+    });
   }
   get isLocalMode() {
     return false;
@@ -26587,12 +27035,16 @@ mutation addPendingDocumentMutation(
     this.identityApiUrl = ((_c = this.options.tinaioConfig) == null ? void 0 : _c.identityApiUrlOverride) || "https://identity.tinajs.io";
     this.contentApiBase = ((_d = this.options.tinaioConfig) == null ? void 0 : _d.contentApiUrlOverride) || `https://content.tinajs.io`;
     this.contentApiUrl = this.options.customContentApiUrl || `${this.contentApiBase}/${this.tinaGraphQLVersion}/content/${this.options.clientId}/github/${encodedBranch}`;
+    if (this.authProvider instanceof TinaCloudAuthProvider) {
+      this.authProvider.identityApiUrl = this.identityApiUrl;
+      this.authProvider.frontendUrl = this.frontendUrl;
+    }
   }
   getBranch() {
     return this.branch;
   }
   async request(query, { variables }) {
-    const token = await this.getToken();
+    const token = await this.authProvider.getToken();
     const headers2 = {
       "Content-Type": "application/json"
     };
@@ -26639,7 +27091,7 @@ mutation addPendingDocumentMutation(
   async checkSyncStatus({
     assetsSyncing
   }) {
-    const res = await this.fetchWithToken(
+    const res = await this.authProvider.fetchWithToken(
       `${this.assetsApiUrl}/v1/${this.clientId}/syncStatus`,
       {
         method: "POST",
@@ -26653,7 +27105,7 @@ mutation addPendingDocumentMutation(
     return jsonRes;
   }
   async getProject() {
-    const res = await this.fetchWithToken(
+    const res = await this.authProvider.fetchWithToken(
       `${this.identityApiUrl}/v2/apps/${this.clientId}`,
       {
         method: "GET"
@@ -26669,7 +27121,7 @@ mutation addPendingDocumentMutation(
   }) {
     const url = `${this.contentApiBase}/github/${this.clientId}/create_pull_request`;
     try {
-      const res = await this.fetchWithToken(url, {
+      const res = await this.authProvider.fetchWithToken(url, {
         method: "POST",
         body: JSON.stringify({
           baseBranch,
@@ -26698,119 +27150,19 @@ mutation addPendingDocumentMutation(
         events: []
       };
     } else {
-      return (await this.fetchWithToken(
+      return (await this.authProvider.fetchWithToken(
         `${this.contentApiBase}/events/${this.clientId}/${this.branch}?limit=${limit || 1}${cursor ? `&cursor=${cursor}` : ""}`,
         { method: "GET" }
       )).json();
     }
   }
-  parseJwt(token) {
-    const base64Url = token.split(".")[1];
-    const base64 = base64Url.replace(/-/g, "+").replace(/_/g, "/");
-    const jsonPayload = decodeURIComponent(
-      atob(base64).split("").map(function(c) {
-        return "%" + ("00" + c.charCodeAt(0).toString(16)).slice(-2);
-      }).join("")
-    );
-    return JSON.parse(jsonPayload);
-  }
-  async getRefreshedToken(tokens) {
-    const { access_token, id_token, refresh_token } = JSON.parse(tokens);
-    const { exp, iss, client_id } = this.parseJwt(access_token);
-    if (Date.now() / 1e3 >= exp - 120) {
-      const refreshResponse = await fetch(iss, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/x-amz-json-1.1",
-          "x-amz-target": "AWSCognitoIdentityProviderService.InitiateAuth"
-        },
-        body: JSON.stringify({
-          ClientId: client_id,
-          AuthFlow: "REFRESH_TOKEN_AUTH",
-          AuthParameters: {
-            REFRESH_TOKEN: refresh_token,
-            DEVICE_KEY: null
-          }
-        })
-      });
-      if (refreshResponse.status !== 200) {
-        throw new Error("Unable to refresh auth tokens");
-      }
-      const responseJson = await refreshResponse.json();
-      const newToken = {
-        access_token: responseJson.AuthenticationResult.AccessToken,
-        id_token: responseJson.AuthenticationResult.IdToken,
-        refresh_token
-      };
-      this.setToken(newToken);
-      return Promise.resolve(newToken);
-    }
-    return Promise.resolve({ access_token, id_token, refresh_token });
-  }
-  async isAuthorized(context) {
-    return !!await this.authorize(context);
-  }
-  async isAuthenticated() {
-    return !!await this.getUser();
-  }
-  async logout() {
-    this.setToken(null);
-  }
-  async authenticate() {
-    const token = await authenticate(this.clientId, this.frontendUrl);
-    this.setToken(token);
-    return token;
-  }
-  async authorize(context) {
-    return this.getToken();
-  }
-  /**
-   * Wraps the normal fetch function with same API but adds the authorization header token.
-   *
-   * @example
-   * const test = await tinaCloudClient.fetchWithToken(`/mycustomAPI/thing/one`) // the token will be passed in the authorization header
-   *
-   * @param input fetch function input
-   * @param init fetch function init
-   */
-  async fetchWithToken(input, init) {
-    const headers2 = (init == null ? void 0 : init.headers) || {};
-    const token = await this.getToken();
-    if (token == null ? void 0 : token.id_token) {
-      headers2["Authorization"] = "Bearer " + (token == null ? void 0 : token.id_token);
-    }
-    return await fetch(input, {
-      ...init,
-      headers: new Headers(headers2)
-    });
-  }
-  async getUser() {
-    if (!this.clientId) {
-      return null;
-    }
-    const url = `${this.identityApiUrl}/v2/apps/${this.clientId}/currentUser`;
-    try {
-      const res = await this.fetchWithToken(url, {
-        method: "GET"
-      });
-      const val = await res.json();
-      if (!res.status.toString().startsWith("2")) {
-        console.error(val.error);
-        return null;
-      }
-      return val;
-    } catch (e) {
-      console.error(e);
-      return null;
-    }
-  }
   async getBillingState() {
     if (!this.clientId) {
       return null;
     }
     const url = `${this.identityApiUrl}/v2/apps/${this.clientId}/billing/state`;
     try {
-      const res = await this.fetchWithToken(url, {
+      const res = await this.authProvider.fetchWithToken(url, {
         method: "GET"
       });
       const val = await res.json();
@@ -26876,7 +27228,7 @@ mutation addPendingDocumentMutation(
   }
   async getIndexStatus({ ref }) {
     const url = `${this.contentApiBase}/db/${this.clientId}/status/${ref}`;
-    const res = await this.fetchWithToken(url);
+    const res = await this.authProvider.fetchWithToken(url);
     const result = await res.json();
     const parsedResult = IndexStatusResponse.parse(result);
     return parsedResult;
@@ -26884,7 +27236,7 @@ mutation addPendingDocumentMutation(
   async listBranches(args) {
     try {
       const url = `${this.contentApiBase}/github/${this.clientId}/list_branches`;
-      const res = await this.fetchWithToken(url, {
+      const res = await this.authProvider.fetchWithToken(url, {
         method: "GET"
       });
       const branches = await res.json();
@@ -26914,7 +27266,7 @@ mutation addPendingDocumentMutation(
   async createBranch({ baseBranch, branchName }) {
     const url = `${this.contentApiBase}/github/${this.clientId}/create_branch`;
     try {
-      const res = await this.fetchWithToken(url, {
+      const res = await this.authProvider.fetchWithToken(url, {
         method: "POST",
         body: JSON.stringify({
           baseBranch,
@@ -26938,9 +27290,9 @@ mutation addPendingDocumentMutation(
   }
 }
 const DEFAULT_LOCAL_TINA_GQL_SERVER_URL = "http://localhost:4001/graphql";
-const LOCAL_CLIENT_KEY = "tina.local.isLogedIn";
 class LocalClient extends Client {
   constructor(props) {
+    var _a, _b, _c;
     const clientProps = {
       ...props,
       clientId: "",
@@ -26949,21 +27301,11 @@ class LocalClient extends Client {
       customContentApiUrl: props && props.customContentApiUrl ? props.customContentApiUrl : DEFAULT_LOCAL_TINA_GQL_SERVER_URL
     };
     super(clientProps);
+    this.authProvider = ((_c = (_b = (_a = this.schema) == null ? void 0 : _a.config) == null ? void 0 : _b.config) == null ? void 0 : _c.authProvider) || new LocalAuthProvider();
   }
   get isLocalMode() {
     return true;
   }
-  // These functions allow the local client to have a login state so that we can correctly call the "OnLogin" callback. This is important for things like preview mode
-  async logout() {
-    localStorage.removeItem(LOCAL_CLIENT_KEY);
-  }
-  async authenticate() {
-    localStorage.setItem(LOCAL_CLIENT_KEY, "true");
-    return { access_token: "LOCAL", id_token: "LOCAL", refresh_token: "LOCAL" };
-  }
-  async getUser() {
-    return localStorage.getItem(LOCAL_CLIENT_KEY) === "true";
-  }
 }
 class TinaCMSSearchClient {
   constructor(client, tinaSearchConfig) {
@@ -26978,13 +27320,13 @@ class TinaCMSSearchClient {
     );
     const opt = optionsToSearchIndexOptions(options);
     const optionsParam = opt["PAGE"] ? `&options=${JSON.stringify(opt)}` : "";
-    const res = await this.client.fetchWithToken(
+    const res = await this.client.authProvider.fetchWithToken(
       `${this.client.contentApiBase}/searchIndex/${this.client.clientId}/${this.client.getBranch()}?q=${JSON.stringify(q)}${optionsParam}`
     );
     return parseSearchIndexResponse(await res.json(), options);
   }
   async del(ids) {
-    const res = await this.client.fetchWithToken(
+    const res = await this.client.authProvider.fetchWithToken(
       `${this.client.contentApiBase}/searchIndex/${this.client.clientId}/${this.client.getBranch()}?ids=${ids.join(",")}`,
       {
         method: "DELETE"
@@ -26995,7 +27337,7 @@ class TinaCMSSearchClient {
     }
   }
   async put(docs) {
-    const res = await this.client.fetchWithToken(
+    const res = await this.client.authProvider.fetchWithToken(
       `${this.client.contentApiBase}/searchIndex/${this.client.clientId}/${this.client.getBranch()}`,
       {
         method: "POST",
@@ -27021,7 +27363,7 @@ class LocalSearchClient {
     const q = queryToSearchIndexQuery(query);
     const opt = optionsToSearchIndexOptions(options);
     const optionsParam = opt["PAGE"] ? `&options=${JSON.stringify(opt)}` : "";
-    const res = await this.client.fetchWithToken(
+    const res = await this.client.authProvider.fetchWithToken(
       `http://localhost:4001/searchIndex?q=${JSON.stringify(q)}${optionsParam}`
     );
     return parseSearchIndexResponse(await res.json(), options);
@@ -27037,12 +27379,19 @@ class LocalSearchClient {
   }
 }
 function ModalBuilder(modalProps) {
-  return /* @__PURE__ */ React__default.createElement(Modal, null, /* @__PURE__ */ React__default.createElement(ModalPopup, null, /* @__PURE__ */ React__default.createElement(ModalHeader, null, modalProps.title), /* @__PURE__ */ React__default.createElement(ModalBody, { padded: true }, /* @__PURE__ */ React__default.createElement("p", null, modalProps.message), modalProps.error && /* @__PURE__ */ React__default.createElement(ErrorLabel, null, modalProps.error)), /* @__PURE__ */ React__default.createElement(ModalActions, null, modalProps.actions.map((action) => /* @__PURE__ */ React__default.createElement(AsyncButton, { key: action.name, ...action })))));
+  return /* @__PURE__ */ React__default.createElement(Modal, null, /* @__PURE__ */ React__default.createElement(ModalPopup, null, /* @__PURE__ */ React__default.createElement(ModalHeader, null, modalProps.title), /* @__PURE__ */ React__default.createElement(ModalBody, { padded: true }, modalProps.message && /* @__PURE__ */ React__default.createElement("p", null, modalProps.message), modalProps.error && /* @__PURE__ */ React__default.createElement(ErrorLabel, null, modalProps.error), modalProps.children), /* @__PURE__ */ React__default.createElement(ModalActions, null, modalProps.actions.map((action) => /* @__PURE__ */ React__default.createElement(AsyncButton, { key: action.name, ...action })))));
 }
 const ErrorLabel = ({ style = {}, ...props }) => /* @__PURE__ */ React__default.createElement("p", { style: { ...style, color: "var(--tina-color-error)" }, ...props });
 const AsyncButton = ({ name, primary, action }) => {
   const [submitting, setSubmitting] = useState(false);
+  const [mounted, setMounted] = useState(false);
+  useEffect(() => {
+    setMounted(true);
+    return () => setMounted(false);
+  }, []);
   const onClick = useCallback(async () => {
+    if (!mounted)
+      return;
     setSubmitting(true);
     try {
       await action();
@@ -27051,7 +27400,7 @@ const AsyncButton = ({ name, primary, action }) => {
       setSubmitting(false);
       throw e;
     }
-  }, [action, setSubmitting]);
+  }, [action, setSubmitting, mounted]);
   return /* @__PURE__ */ React__default.createElement(
     Button,
     {
@@ -27127,7 +27476,7 @@ class TinaAdminApi {
     }
   }
   async isAuthenticated() {
-    return await this.api.isAuthenticated();
+    return await this.api.authProvider.isAuthenticated();
   }
   async checkGraphqlSchema({ localSchema }) {
     const schemaFromCloud = await this.api.getSchema();
@@ -27449,17 +27798,29 @@ const AuthWallInner = ({
   loginScreen,
   getModalActions
 }) => {
-  var _a, _b, _c, _d, _e;
+  var _a, _b, _c;
   const client = cms.api.tina;
-  const isTinaCloud = !client.isLocalMode && !((_e = (_d = (_c = (_b = (_a = client.schema) == null ? void 0 : _a.config) == null ? void 0 : _b.config) == null ? void 0 : _c.admin) == null ? void 0 : _d.auth) == null ? void 0 : _e.customAuth);
+  const isTinaCloud = !client.isLocalMode && !((_c = (_b = (_a = client.schema) == null ? void 0 : _a.config) == null ? void 0 : _b.config) == null ? void 0 : _c.contentApiUrlOverride);
+  const loginStrategy = client.authProvider.getLoginStrategy();
   const [activeModal, setActiveModal] = useState(null);
   const [errorMessage, setErrorMessage] = useState();
   const [showChildren, setShowChildren] = useState(false);
+  const [authProps, setAuthProps] = useState({ username: "", password: "" });
+  const [authenticated, setAuthenticated] = useState(false);
   React__default.useEffect(() => {
-    client.isAuthenticated().then((isAuthenticated) => {
+    let mounted = true;
+    client.authProvider.isAuthenticated().then((isAuthenticated) => {
+      if (!mounted)
+        return;
       if (isAuthenticated) {
-        client.isAuthorized().then((isAuthorized) => {
+        client.authProvider.isAuthorized().then(async (isAuthorized) => {
+          if (!mounted)
+            return;
           if (isAuthorized) {
+            const user = await client.authProvider.getUser();
+            if (user.passwordChangeRequired) {
+              window.location.hash = "#/screens/change_password";
+            }
             setShowChildren(true);
             cms.enable();
           } else {
@@ -27470,6 +27831,8 @@ const AuthWallInner = ({
             setActiveModal("error");
           }
         }).catch((e) => {
+          if (!mounted)
+            return;
           console.error(e);
           setErrorMessage({ title: "Unexpected Error:", message: `${e}` });
           setActiveModal("error");
@@ -27480,33 +27843,59 @@ const AuthWallInner = ({
         });
       }
     }).catch((e) => {
+      if (!mounted)
+        return;
       console.error(e);
       setErrorMessage({ title: "Unexpected Error:", message: `${e}` });
       setActiveModal("error");
     });
-  }, []);
+    return () => {
+      mounted = false;
+    };
+  }, [authenticated]);
   const onAuthenticated = async () => {
-    if (await client.isAuthorized()) {
-      setShowChildren(true);
-      setActiveModal(null);
-      cms.events.dispatch({ type: "cms:login" });
-    } else {
-      setErrorMessage({
-        title: "Access Denied:",
-        message: "Not Authorized To Edit"
-      });
-      setActiveModal("error");
-    }
+    setAuthenticated(true);
+    setActiveModal(null);
+    cms.events.dispatch({ type: "cms:login" });
   };
   const otherModalActions = getModalActions ? getModalActions({
     closeModal: () => {
       setActiveModal(null);
     }
   }) : [];
-  return /* @__PURE__ */ React__default.createElement(React__default.Fragment, null, activeModal === "authenticate" && /* @__PURE__ */ React__default.createElement(
+  const handleAuthenticate = async () => {
+    try {
+      setAuthenticated(false);
+      const token = await client.authProvider.authenticate(authProps);
+      if (typeof (client == null ? void 0 : client.onLogin) === "function") {
+        await (client == null ? void 0 : client.onLogin({ token }));
+      }
+      return onAuthenticated();
+    } catch (e) {
+      console.error(e);
+      setActiveModal("error");
+      setErrorMessage({
+        title: "Authentication Error",
+        message: `${e}`
+      });
+    }
+  };
+  let modalTitle = "Tina Cloud Authorization";
+  if (activeModal === "authenticate" && loginStrategy === "Redirect" && !isTinaCloud) {
+    modalTitle = "Enter into edit mode";
+  } else if (activeModal === "authenticate" && loginStrategy === "UsernamePassword") {
+    modalTitle = "Sign in to Tina";
+  } else if (activeModal === "error") {
+    if (loginStrategy === "Redirect" && !isTinaCloud) {
+      modalTitle = "Enter into edit mode";
+    } else if (loginStrategy === "UsernamePassword") {
+      modalTitle = "Sign in to Tina";
+    }
+  }
+  return /* @__PURE__ */ React__default.createElement(React__default.Fragment, null, activeModal === "authenticate" && loginStrategy === "Redirect" && /* @__PURE__ */ React__default.createElement(
     ModalBuilder,
     {
-      title: isTinaCloud ? "Tina Cloud Authorization" : "Enter into edit mode",
+      title: modalTitle,
       message: isTinaCloud ? "To save edits, Tina Cloud authorization is required. On save, changes will get committed using your account." : "To save edits, enter into edit mode. On save, changes will saved to the local filesystem.",
       close,
       actions: [
@@ -27521,30 +27910,61 @@ const AuthWallInner = ({
         },
         {
           name: isTinaCloud ? "Continue to Tina Cloud" : "Enter Edit Mode",
-          action: async () => {
-            try {
-              const token = await client.authenticate();
-              if (typeof (client == null ? void 0 : client.onLogin) === "function") {
-                await (client == null ? void 0 : client.onLogin({ token }));
-              }
-              return onAuthenticated();
-            } catch (e) {
-              console.error(e);
-              setActiveModal("error");
-              setErrorMessage({
-                title: "Unexpected Error:",
-                message: `${e}`
-              });
-            }
-          },
+          action: handleAuthenticate,
           primary: true
         }
       ]
     }
+  ), activeModal === "authenticate" && loginStrategy === "UsernamePassword" && /* @__PURE__ */ React__default.createElement(
+    ModalBuilder,
+    {
+      title: modalTitle,
+      message: "",
+      close,
+      actions: [
+        ...otherModalActions,
+        {
+          name: "Login",
+          action: handleAuthenticate,
+          primary: true
+        }
+      ]
+    },
+    /* @__PURE__ */ React__default.createElement("div", { className: "flex items-center justify-center bg-gray-50 px-4 sm:px-6 lg:px-8" }, /* @__PURE__ */ React__default.createElement("div", { className: "max-w-md w-full space-y-6" }, /* @__PURE__ */ React__default.createElement("label", { className: "block" }, /* @__PURE__ */ React__default.createElement("span", { className: "text-gray-700" }, "Username"), /* @__PURE__ */ React__default.createElement(
+      BaseTextField,
+      {
+        id: "username",
+        name: "username",
+        type: "text",
+        autoComplete: "username",
+        required: true,
+        placeholder: "Username",
+        value: authProps.username,
+        onChange: (e) => setAuthProps((prevState) => ({
+          ...prevState,
+          username: e.target.value
+        }))
+      }
+    )), /* @__PURE__ */ React__default.createElement("label", { className: "block" }, /* @__PURE__ */ React__default.createElement("span", { className: "text-gray-700" }, "Password"), /* @__PURE__ */ React__default.createElement(
+      BaseTextField,
+      {
+        id: "password",
+        name: "password",
+        type: "password",
+        autoComplete: "current-password",
+        required: true,
+        placeholder: "Password",
+        value: authProps.password,
+        onChange: (e) => setAuthProps((prevState) => ({
+          ...prevState,
+          password: e.target.value
+        }))
+      }
+    ))))
   ), activeModal === "error" && errorMessage && /* @__PURE__ */ React__default.createElement(
     ModalBuilder,
     {
-      title: isTinaCloud ? "Tina Cloud Authorization" : "Enter into edit mode",
+      title: modalTitle,
       message: errorMessage.title,
       error: errorMessage.message,
       close,
@@ -27556,13 +27976,12 @@ const AuthWallInner = ({
             try {
               setActiveModal(null);
               setErrorMessage(void 0);
-              await client.logout();
-              await client.onLogout();
-              const token = await client.authenticate();
-              if (typeof (client == null ? void 0 : client.onLogin) === "function") {
-                await (client == null ? void 0 : client.onLogin({ token }));
+              const { authProvider } = client;
+              await authProvider.logout();
+              if (typeof (client == null ? void 0 : client.onLogout) === "function") {
+                await client.onLogout();
               }
-              return onAuthenticated();
+              window.location.href = new URL(window.location.href).pathname;
             } catch (e) {
               console.error(e);
               setActiveModal("error");
@@ -27579,7 +27998,7 @@ const AuthWallInner = ({
   ), showChildren ? children : loginScreen ? loginScreen : null);
 };
 const TinaCloudProvider = (props) => {
-  var _a, _b, _c, _d, _e;
+  var _a, _b, _c;
   const baseBranch = props.branch || "main";
   const [currentBranch, setCurrentBranch] = useLocalStorage(
     "tinacms-current-branch",
@@ -27602,7 +28021,7 @@ const TinaCloudProvider = (props) => {
     cms.api.tina.setBranch(currentBranch);
   }
   useEffect(() => {
-    var _a2, _b2, _c2, _d2, _e2, _f;
+    var _a2, _b2, _c2, _d, _e, _f;
     let searchClient;
     if (props.isLocalClient) {
       searchClient = new LocalSearchClient(cms.api.tina);
@@ -27611,10 +28030,10 @@ const TinaCloudProvider = (props) => {
       if (hasTinaSearch) {
         searchClient = new TinaCMSSearchClient(
           cms.api.tina,
-          (_d2 = (_c2 = props.schema.config) == null ? void 0 : _c2.search) == null ? void 0 : _d2.tina
+          (_d = (_c2 = props.schema.config) == null ? void 0 : _c2.search) == null ? void 0 : _d.tina
         );
       } else {
-        searchClient = (_f = (_e2 = props.schema.config) == null ? void 0 : _e2.search) == null ? void 0 : _f.searchClient;
+        searchClient = (_f = (_e = props.schema.config) == null ? void 0 : _e.search) == null ? void 0 : _f.searchClient;
       }
     }
     if (searchClient) {
@@ -27625,7 +28044,7 @@ const TinaCloudProvider = (props) => {
     cms.registerApi("admin", new TinaAdminApi(cms));
   }
   const setupMedia = async (staticMedia) => {
-    var _a2, _b2, _c2, _d2, _e2, _f, _g;
+    var _a2, _b2, _c2, _d, _e, _f, _g;
     const hasTinaMedia = Boolean((_b2 = (_a2 = props.schema.config) == null ? void 0 : _a2.media) == null ? void 0 : _b2.tina);
     if (hasTinaMedia) {
       cms.media.store = new TinaMediaStore(cms, staticMedia);
@@ -27633,9 +28052,9 @@ const TinaCloudProvider = (props) => {
       /*
       Has tina custom media (set up in the schema or define schema)
        */
-      ((_d2 = (_c2 = props.schema.config) == null ? void 0 : _c2.media) == null ? void 0 : _d2.loadCustomStore) || props.mediaStore
+      ((_d = (_c2 = props.schema.config) == null ? void 0 : _c2.media) == null ? void 0 : _d.loadCustomStore) || props.mediaStore
     ) {
-      const mediaStoreFromProps = ((_f = (_e2 = props.schema.config) == null ? void 0 : _e2.media) == null ? void 0 : _f.loadCustomStore) || props.mediaStore;
+      const mediaStoreFromProps = ((_f = (_e = props.schema.config) == null ? void 0 : _e.media) == null ? void 0 : _f.loadCustomStore) || props.mediaStore;
       if ((_g = mediaStoreFromProps.prototype) == null ? void 0 : _g.persist) {
         cms.media.store = new mediaStoreFromProps(cms.api.tina);
       } else {
@@ -27647,7 +28066,8 @@ const TinaCloudProvider = (props) => {
     }
   };
   const client = cms.api.tina;
-  const isTinaCloud = !client.isLocalMode && !((_e = (_d = (_c = (_b = (_a = client.schema) == null ? void 0 : _a.config) == null ? void 0 : _b.config) == null ? void 0 : _c.admin) == null ? void 0 : _d.auth) == null ? void 0 : _e.customAuth);
+  const isTinaCloud = !client.isLocalMode && !((_c = (_b = (_a = client.schema) == null ? void 0 : _a.config) == null ? void 0 : _b.config) == null ? void 0 : _c.contentApiUrlOverride);
+  const SessionProvider = client.authProvider.getSessionProvider();
   const handleListBranches = async () => {
     const branches = await cms.api.tina.listBranches({
       includeIndexStatus: true
@@ -27661,7 +28081,9 @@ const TinaCloudProvider = (props) => {
     const newBranch = await cms.api.tina.createBranch(data);
     return newBranch;
   };
-  setupMedia(props.staticMedia);
+  setupMedia(props.staticMedia).catch((e) => {
+    console.error(e);
+  });
   const [branchingEnabled, setBranchingEnabled] = React__default.useState(
     () => cms.flags.get("branch-switcher")
   );
@@ -27714,7 +28136,7 @@ const TinaCloudProvider = (props) => {
     });
     return unsubscribe;
   }, [isTinaCloud, cms]);
-  return /* @__PURE__ */ React__default.createElement(
+  return /* @__PURE__ */ React__default.createElement(SessionProvider, { basePath: "/api/tina/auth" }, /* @__PURE__ */ React__default.createElement(
     BranchDataProvider,
     {
       currentBranch,
@@ -27723,7 +28145,7 @@ const TinaCloudProvider = (props) => {
       }
     },
     /* @__PURE__ */ React__default.createElement(TinaProvider, { cms }, /* @__PURE__ */ React__default.createElement(AuthWallInner, { ...props, cms }))
-  );
+  ));
 };
 const TinaCloudAuthWall = TinaCloudProvider;
 class ContentCreatorPlugin {
@@ -28002,14 +28424,13 @@ const TinaCMSProvider2 = ({
   schema,
   ...props
 }) => {
-  var _a, _b, _c, _d, _e, _f;
+  var _a, _b, _c;
   if (props == null ? void 0 : props.apiURL) {
     console.warn(
       "The apiURL prop is deprecated. Please see https://tina.io/blog/tina-v-0.68.14 for information on how to upgrade to the new API"
     );
   }
   const apiURL = ((_a = props == null ? void 0 : props.client) == null ? void 0 : _a.apiUrl) || (props == null ? void 0 : props.apiURL);
-  const isLocalOverride = (_d = (_c = (_b = schema == null ? void 0 : schema.config) == null ? void 0 : _b.admin) == null ? void 0 : _c.auth) == null ? void 0 : _d.useLocalAuth;
   const { branch, clientId, isLocalClient } = apiURL ? parseURL(apiURL) : {
     branch: props.branch,
     clientId: props.clientId,
@@ -28035,10 +28456,10 @@ const TinaCMSProvider2 = ({
     TinaCloudProvider,
     {
       branch,
-      clientId: clientId || ((_e = schema == null ? void 0 : schema.config) == null ? void 0 : _e.clientId),
+      clientId: clientId || ((_b = schema == null ? void 0 : schema.config) == null ? void 0 : _b.clientId),
       tinaioConfig: props.tinaioConfig,
-      isLocalClient: isLocalOverride || isLocalClient,
-      isSelfHosted: !!((_f = schema == null ? void 0 : schema.config) == null ? void 0 : _f.contentApiUrlOverride),
+      isLocalClient,
+      isSelfHosted: !!((_c = schema == null ? void 0 : schema.config) == null ? void 0 : _c.contentApiUrlOverride),
       cmsCallback: props.cmsCallback,
       mediaStore: props.mediaStore,
       apiUrl: apiURL,
@@ -28242,6 +28663,12 @@ const Sidebar = ({ cms }) => {
   const navBreakpoint2 = 1e3;
   const windowWidth = useWindowWidth();
   const renderDesktopNav = windowWidth > navBreakpoint2;
+  const activeScreens = screens.filter(
+    (screen) => {
+      var _a2;
+      return screen.navCategory !== "Account" || ((_a2 = cms.api.tina.authProvider) == null ? void 0 : _a2.getLoginStrategy()) === "UsernamePassword";
+    }
+  );
   return /* @__PURE__ */ React__default.createElement(React__default.Fragment, null, renderDesktopNav && /* @__PURE__ */ React__default.createElement(
     Nav,
     {
@@ -28249,7 +28676,7 @@ const Sidebar = ({ cms }) => {
       sidebarWidth: 360,
       showCollections: true,
       collectionsInfo,
-      screens,
+      screens: activeScreens,
       cloudConfigs,
       contentCreators: [],
       RenderNavSite: ({ view }) => /* @__PURE__ */ React__default.createElement(
@@ -28268,6 +28695,14 @@ const Sidebar = ({ cms }) => {
           to: `/collections/${collection.name}/~`,
           Icon: ImFilesEmpty
         }
+      ),
+      AuthRenderNavCollection: ({ collection }) => /* @__PURE__ */ React__default.createElement(
+        SidebarLink,
+        {
+          label: collection.label ? collection.label : collection.name,
+          to: `/collections/${collection.name}/~`,
+          Icon: ImUsers
+        }
       )
     }
   ), !renderDesktopNav && /* @__PURE__ */ React__default.createElement(Transition, { show: menuIsOpen }, /* @__PURE__ */ React__default.createElement(
@@ -28289,7 +28724,7 @@ const Sidebar = ({ cms }) => {
         sidebarWidth: 360,
         showCollections: true,
         collectionsInfo,
-        screens,
+        screens: activeScreens,
         cloudConfigs,
         contentCreators: [],
         RenderNavSite: ({ view }) => /* @__PURE__ */ React__default.createElement(
@@ -28314,6 +28749,17 @@ const Sidebar = ({ cms }) => {
               setMenuIsOpen(false);
             }
           }
+        ),
+        AuthRenderNavCollection: ({ collection }) => /* @__PURE__ */ React__default.createElement(
+          SidebarLink,
+          {
+            label: collection.label ? collection.label : collection.name,
+            to: `/collections/${collection.name}/~`,
+            Icon: ImUsers,
+            onClick: () => {
+              setMenuIsOpen(false);
+            }
+          }
         )
       },
       /* @__PURE__ */ React__default.createElement("div", { className: "absolute top-8 right-0 transform translate-x-full overflow-hidden" }, /* @__PURE__ */ React__default.createElement(
@@ -28452,11 +28898,11 @@ const LogoutRedirect = () => {
   const [searchParams] = useSearchParams();
   const slug = searchParams.get("slug") || "/";
   const logout2 = async () => {
-    var _a, _b, _c, _d, _e, _f;
-    if ((_b = (_a = cms == null ? void 0 : cms.api) == null ? void 0 : _a.tina) == null ? void 0 : _b.logout) {
-      await cms.api.tina.logout();
-      if ((_d = (_c = cms == null ? void 0 : cms.api) == null ? void 0 : _c.tina) == null ? void 0 : _d.onLogout) {
-        await ((_f = (_e = cms == null ? void 0 : cms.api) == null ? void 0 : _e.tina) == null ? void 0 : _f.onLogout());
+    var _a, _b, _c, _d, _e, _f, _g, _h, _i, _j;
+    if ((_c = (_b = (_a = cms == null ? void 0 : cms.api) == null ? void 0 : _a.tina) == null ? void 0 : _b.authProvider) == null ? void 0 : _c.logout) {
+      await ((_f = (_e = (_d = cms == null ? void 0 : cms.api) == null ? void 0 : _d.tina) == null ? void 0 : _e.authProvider) == null ? void 0 : _f.logout());
+      if ((_h = (_g = cms == null ? void 0 : cms.api) == null ? void 0 : _g.tina) == null ? void 0 : _h.onLogout) {
+        await ((_j = (_i = cms == null ? void 0 : cms.api) == null ? void 0 : _i.tina) == null ? void 0 : _j.onLogout());
       }
     }
     setEdit(false);
@@ -30660,6 +31106,7 @@ const defineStaticConfig = (config) => {
 };
 const defineConfig = defineStaticConfig;
 export {
+  AbstractAuthProvider,
   ActionButton,
   AddIcon,
   AlertIcon,
@@ -30668,6 +31115,7 @@ export {
   AlignLeft,
   AlignRight,
   AuthWallInner,
+  BasePasswordField,
   BaseTextField,
   BillingWarning,
   BlocksField,
@@ -30762,6 +31210,7 @@ export {
   ListField,
   ListFieldPlugin,
   LoadingDots,
+  LocalAuthProvider,
   LocalClient,
   LocalSearchClient,
   LocalWarning,
@@ -30790,6 +31239,8 @@ export {
   OverflowMenu$1 as OverflowMenu,
   PanelBody,
   PanelHeader$1 as PanelHeader,
+  PasswordFieldComponent,
+  PasswordFieldPlugin,
   PopupModal,
   PrefixedTextField,
   PullRequestIcon,
@@ -30831,6 +31282,7 @@ export {
   TinaCMSProvider,
   TinaCMSProvider2,
   TinaCMSSearchClient,
+  TinaCloudAuthProvider,
   TinaCloudAuthWall,
   TinaCloudProvider,
   TinaField,
@@ -30849,7 +31301,6 @@ export {
   UploadIcon,
   WarningIcon,
   assertShape,
-  asyncPoll,
   classNames,
   createClient,
   TinaCMSProvider2 as default,
@@ -30861,6 +31312,7 @@ export {
   getFilteredBranchList,
   getStaticPropsForTina,
   gql,
+  passwordFieldClasses,
   resolveField,
   safeAssertShape,
   selectFieldClasses,