@anchrd/intel-ui 0.8.0 → 0.8.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anchrd/intel-ui",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "type": "module",
   "license": "UNLICENSED",
   "repository": {

package/src/i18n/en.json

@@ -147,6 +147,8 @@
   "tools.emptyHelp": "The portal answered, and it offers your account no tools. An administrator decides in the portal which servers exist and who may reach them.",
   "tools.unreachable": "Portal not reachable",
   "tools.unreachableHelp": "The company MCP portal did not answer, so Intel cannot tell which tools you have. Nothing is stored here; try again once the portal responds.",
+  "tools.connectFailed": "Portal sign-in failed",
+  "tools.connectFailedHelp": "The sign-in to the company MCP portal broke before it could be answered. This is a technical fault, not a decision about your access — reload to try again, and tell an administrator if it stays.",
   "tools.origin": "Origin",
   "tools.originPortal": "Company portal",
   "tools.inputSchema": "Input schema",

package/src/tools/tools.tsx

@@ -44,11 +44,17 @@ export function Tools() {
   // A hit from the header search arrives as `?select=<tool name>`, and the row it names opens with
   // the list. Nothing else about the row changes: it is still only a disclosure.
   const requested = useRouterState({ select: (state) => selectedFrom(state.location.search) });
-  // The silent sign-in returns here with a marker when the portal refused. Only its presence is
-  // used: the value comes from outside and could carry provider detail, so it is never rendered.
-  const refused =
-    typeof window !== "undefined" &&
-    new URLSearchParams(window.location.search).has("connectError");
+  // The silent sign-in returns here with a marker when it failed. The value comes from outside
+  // and could carry provider detail, so it is never rendered — it is only compared against the
+  // codes Intel itself writes, to tell "you may not" from "the sign-in broke" (#93): the first is
+  // a sentence about access, the second must not masquerade as one.
+  const connectError =
+    typeof window === "undefined"
+      ? null
+      : new URLSearchParams(window.location.search).get("connectError");
+  const refused = connectError !== null;
+  const accessDenied =
+    connectError === "portal_sign_in_refused" || connectError === "permission_required";
   const [signingIn, setSigningIn] = React.useState(false);
 
   // ⚠️ Nobody is asked to start this. The portal sign-in is a browser redirect, so the screen
@@ -90,7 +96,7 @@ export function Tools() {
         ) : !catalog.data.portalConnected ? (
           signingIn ? (
             <p className="text-sm text-muted-foreground">{i18n.t("tools.signingIn")}</p>
-          ) : (
+          ) : accessDenied || !refused ? (
             // The end of the silent walk for somebody no Access policy carries. It is a sentence
             // about access, not an invitation to connect: there is nothing they could click that
             // would change the answer, and what the portal replied is not repeated here.
@@ -102,6 +108,16 @@ export function Tools() {
               title={i18n.t("tools.noAccess")}
               help={i18n.t("tools.noAccessHelp")}
             />
+          ) : (
+            // Every other marker is machinery, not policy: the sign-in broke before anyone could
+            // be allowed or refused. Saying "no access" here sent the last reader hunting through
+            // Access policies while the real fault sat in a failed client registration (#93).
+            <Notice
+              alert
+              icon={<PlugZap aria-hidden="true" className="mx-auto size-8 text-destructive" />}
+              title={i18n.t("tools.connectFailed")}
+              help={i18n.t("tools.connectFailedHelp")}
+            />
           )
         ) : catalog.data.items.length === 0 ? (
           <Notice