@almadar/orb 16.9.1 → 17.0.0

package/shells/almadar-shell/packages/client/src/features/auth/authService.ts

@@ -10,15 +10,24 @@ import {
   signInWithEmailLink as firebaseSignInWithEmailLink,
   ActionCodeSettings,
 } from 'firebase/auth';
-import { auth } from '../../config/firebase';
+import { auth, isAuthEnabled, requireAuth } from '../../config/firebase';
+import { mockAuth } from '../../config/mockAuth';
+
+// With no Firebase credentials the real calls throw "not configured", which
+// leaves a generated app impossible to sign into — and therefore impossible to
+// view as anyone, since @user.id/@user.role drive ownership and role gates.
+// Route to the persona-backed mock in exactly that case.
+const useMock = (): boolean => !isAuthEnabled();
 
 const googleProvider = new GoogleAuthProvider();
 
 export const authService = {
   // Google Sign In
   signInWithGoogle: async () => {
+    // No popup to show without Firebase — sign in as the seeded end-user.
+    if (useMock()) return mockAuth.signInAsPersona('member');
     try {
-      const result = await signInWithPopup(auth, googleProvider);
+      const result = await signInWithPopup(requireAuth(), googleProvider);
       return result.user;
     } catch (error) {
       throw error;
@@ -27,8 +36,9 @@ export const authService = {
 
   // Email/Password Sign In
   signInWithEmail: async (email: string, password: string) => {
+    if (useMock()) return mockAuth.signInWithEmail(email, password);
     try {
-      const result = await signInWithEmailAndPassword(auth, email, password);
+      const result = await signInWithEmailAndPassword(requireAuth(), email, password);
       return result.user;
     } catch (error) {
       throw error;
@@ -37,8 +47,9 @@ export const authService = {
 
   // Email/Password Sign Up
   signUpWithEmail: async (email: string, password: string, displayName?: string) => {
+    if (useMock()) return mockAuth.signUpWithEmail(email, password, displayName);
     try {
-      const result = await createUserWithEmailAndPassword(auth, email, password);
+      const result = await createUserWithEmailAndPassword(requireAuth(), email, password);
 
       if (displayName) {
         await updateProfile(result.user, { displayName });
@@ -52,8 +63,9 @@ export const authService = {
 
   // Sign Out
   signOut: async () => {
+    if (useMock()) return mockAuth.signOut();
     try {
-      await firebaseSignOut(auth);
+      await firebaseSignOut(requireAuth());
     } catch (error) {
       throw error;
     }
@@ -62,22 +74,31 @@ export const authService = {
   // Email Link Authentication
   sendSignInLinkToEmail: async (email: string, actionCodeSettings: ActionCodeSettings) => {
     try {
-      await firebaseSendSignInLinkToEmail(auth, email, actionCodeSettings);
+      await firebaseSendSignInLinkToEmail(requireAuth(), email, actionCodeSettings);
     } catch (error) {
       throw error;
     }
   },
 
   isSignInWithEmailLink: (emailLink: string): boolean => {
+    // Predicate evaluated during Login render — degrade, don't throw,
+    // when auth is unconfigured: it simply isn't an email-link sign-in.
+    if (!auth) return false;
     return firebaseIsSignInWithEmailLink(auth, emailLink);
   },
 
   signInWithEmailLink: async (email: string, emailLink: string) => {
     try {
-      const result = await firebaseSignInWithEmailLink(auth, email, emailLink);
+      const result = await firebaseSignInWithEmailLink(requireAuth(), email, emailLink);
       return result.user;
     } catch (error) {
       throw error;
     }
   },
+
+  /** Sign in as a named seeded persona (dev only; no-op with real Firebase). */
+  signInAsPersona: async (idOrRole: string) => {
+    if (useMock()) return mockAuth.signInAsPersona(idOrRole);
+    throw new Error('Persona sign-in is a dev-only affordance; real auth is configured');
+  },
 };

package/shells/almadar-shell/packages/client/src/features/auth/components/PersonaSwitcher.tsx

@@ -0,0 +1,50 @@
+/**
+ * Dev persona switch — view the app as each identity its domain implies.
+ *
+ * Renders only when auth is mocked (no Firebase credentials), so it cannot appear
+ * in a real deployment. Role gates and ownership-scoped lists are the parts of an
+ * app that look identical whether they work or are simply empty; switching viewer
+ * in one click is how you tell the difference.
+ */
+
+import React from 'react';
+import { HStack, Select, Typography } from '@almadar/ui';
+import { isAuthEnabled } from '../../../config/firebase';
+import { listMockAccounts, onMockRosterChanged } from '../../../config/mockAuth';
+import { authService } from '../authService';
+import { useAuthContext } from '../AuthContext';
+
+export function PersonaSwitcher(): React.ReactElement | null {
+  const { user } = useAuthContext();
+  // The roster arrives over HTTP after first paint. Without this the picker
+  // renders its empty pre-fetch state and never updates, because the signed-out
+  // viewer never changes and so the auth listener never fires.
+  const [accounts, setAccounts] = React.useState(() => listMockAccounts());
+
+  React.useEffect(() => onMockRosterChanged(() => setAccounts(listMockAccounts())), []);
+
+  if (isAuthEnabled()) return null;
+
+  const options = accounts.map((p) => ({
+    value: p.id,
+    label: `${String(p.name ?? p.id)} — ${String(p.role ?? 'no role')}`,
+  }));
+
+  return (
+    <HStack gap="sm" align="center">
+      <Typography variant="caption" color="muted">
+        Viewing as
+      </Typography>
+      <Select
+        options={options}
+        value={user?.uid ?? ''}
+        placeholder="Signed out"
+        onChange={(event) => {
+          void authService.signInAsPersona(event.target.value);
+        }}
+      />
+    </HStack>
+  );
+}
+
+export default PersonaSwitcher;

package/shells/almadar-shell/packages/client/src/features/auth/components/ProtectedRoute.tsx

@@ -1,6 +1,7 @@
 import React from 'react';
 import { Navigate } from 'react-router-dom';
 import { useAuthContext } from '../AuthContext';
+import { isAuthEnabled } from '../../../config/firebase';
 
 interface ProtectedRouteProps {
   children: React.ReactNode;
@@ -17,6 +18,14 @@ const ProtectedRoute: React.FC<ProtectedRouteProps> = ({ children }) => {
     );
   }
 
+  // Auth-disabled mode (no Firebase config): nothing can sign in, so
+  // gating would strand every route on /login — pass straight through.
+  // Checked after `loading` so a configured-but-initializing Firebase
+  // still shows the spinner instead of flashing protected content.
+  if (!isAuthEnabled()) {
+    return <>{children}</>;
+  }
+
   if (!user) {
     return <Navigate to="/login" replace />;
   }

package/shells/almadar-shell/packages/client/src/features/auth/index.ts

@@ -5,9 +5,10 @@ export { AuthProvider, useAuthContext } from './AuthContext';
 export { default as Login } from './components/Login';
 export { default as UserProfile } from './components/UserProfile';
 export { default as ProtectedRoute } from './components/ProtectedRoute';
+export { PersonaSwitcher } from './components/PersonaSwitcher';
 
 // Service
 export { authService } from './authService';
 
 // Types
-export type { AuthContextType, LoginCredentials, SignUpCredentials } from './types';
+export type { AuthContextType, AuthViewer, LoginCredentials, SignUpCredentials } from './types';

package/shells/almadar-shell/packages/client/src/features/auth/types.ts

@@ -1,4 +1,20 @@
-import { User } from 'firebase/auth';
+/**
+ * The signed-in viewer, as the auth UI reads it. Firebase's `User` and the mocked
+ * `MockUser` are both structurally assignable to this, so the provider carries
+ * either without a cast and without the UI knowing which one is live.
+ *
+ * A type alias, not an interface: only aliases get TS's implicit index signature,
+ * which is what lets this be passed to `normalizeUserContext(claims: RawUserClaims)`
+ * without a cast.
+ */
+export type AuthViewer = {
+  uid: string;
+  email: string | null;
+  displayName: string | null;
+  photoURL: string | null;
+  /** Present only for mocked personas; real Firebase claims carry no role. */
+  role?: string;
+};
 
 export interface LoginCredentials {
   email: string;
@@ -10,7 +26,7 @@ export interface SignUpCredentials extends LoginCredentials {
 }
 
 export interface AuthContextType {
-  user: User | null;
+  user: AuthViewer | null;
   loading: boolean;
   error: string | null;
   signInWithGoogle: () => Promise<void>;

package/shells/almadar-shell/packages/server/package.json

@@ -13,20 +13,22 @@
     "test:watch": "vitest"
   },
   "dependencies": {
-    "@almadar/core": "^7.14.3",
-    "@almadar/evaluator": "^2.11.2",
-    "@almadar/integrations": "^2.7.0",
-    "@almadar/logger": "^1.3.0",
-    "@almadar/runtime": "^6.5.1",
-    "@almadar/server": "^2.11.0",
+    "@almadar/core": "^10.99.0",
+    "@almadar/evaluator": "^2.47.0",
+    "@almadar/integrations": "^2.36.0",
+    "@almadar/logger": "^1.12.0",
+    "@almadar/runtime": "^6.84.0",
+    "@almadar/server": "^2.43.0",
     "cors": "^2.8.5",
     "dotenv": "^16.4.7",
     "express": "^4.21.2",
+    "express-rate-limit": "^7.4.0",
     "firebase-admin": "^12.7.0",
+    "helmet": "^8.0.0",
     "zod": "^3.22.0"
   },
   "devDependencies": {
-    "@almadar/eslint-plugin": "^2.8.1",
+    "@almadar/eslint-plugin": "^2.18.0",
     "@types/cors": "^2.8.17",
     "@types/express": "^5.0.0",
     "@types/node": "^20.17.19",