@cat-factory/app 0.47.6 → 0.47.7

package/app/components/auth/LoginScreen.vue

@@ -1,16 +1,18 @@
 <script setup lang="ts">
-import { computed, ref, watch } from 'vue'
+import { computed, ref } from 'vue'
 import { apiErrorEnvelope } from '~/composables/api/errors'
 
 const auth = useAuthStore()
 const { t } = useI18n()
 
-// Local-mode source-control PAT login. GitHub/GitLab are brand names (kept verbatim across
-// locales), as are the token-settings URLs, so they're inline constants rather than catalog
-// keys — same convention as the provider descriptors in ApiKeysSection. The actual link
-// prefers the server's scopes-preselected deep link (`patLogin.setupUrls`); these are the
-// fallback when it's absent.
+// Local-mode source-control PAT login. The PAT lives server-side in env (GITHUB_PAT /
+// GITLAB_PAT); the login screen only SELECTS a configured provider — no token is ever typed
+// into or shown in the browser. GitHub/GitLab are brand names (kept verbatim across locales),
+// as are the token-settings URLs, so they're inline constants rather than catalog keys — same
+// convention as the provider descriptors in ApiKeysSection. The "create a token" link prefers
+// the server's scopes-preselected deep link (`patLogin.setupUrls`); these are the fallback.
 type PatProvider = 'github' | 'gitlab'
+const ALL_PROVIDERS: PatProvider[] = ['github', 'gitlab']
 const PROVIDER_LABELS: Record<PatProvider, string> = { github: 'GitHub', gitlab: 'GitLab' }
 const PROVIDER_ICONS: Record<PatProvider, string> = {
   github: 'i-lucide-github',
@@ -23,44 +25,29 @@ const PROVIDER_TOKEN_URLS: Record<PatProvider, string> = {
 }
 
 const patLoginCfg = computed(() => auth.localMode?.patLogin)
+// Only providers whose PAT is configured in env can sign in (the token is the operational
+// credential too). A provider without one gets no button — see the no-PAT notice instead.
 const configuredProviders = computed<PatProvider[]>(
   () => (patLoginCfg.value?.configured ?? []) as PatProvider[],
 )
-const availableProviders = computed<PatProvider[]>(
-  () => (patLoginCfg.value?.available ?? []) as PatProvider[],
-)
-const showLocalLogin = computed(() => availableProviders.value.length > 0)
+const isLocalMode = computed(() => auth.localMode?.enabled === true)
+const hasConfiguredPat = computed(() => configuredProviders.value.length > 0)
 
-const patProvider = ref<PatProvider>('github')
-const patToken = ref('')
 const patBusy = ref(false)
 const patError = ref<string | null>(null)
 
-// Keep the picker on an actually-available provider.
-watch(
-  availableProviders,
-  (list) => {
-    if (list.length && !list.includes(patProvider.value)) patProvider.value = list[0]!
-  },
-  { immediate: true },
-)
-
-const patProviderItems = computed(() =>
-  availableProviders.value.map((p) => ({ label: PROVIDER_LABELS[p], value: p })),
-)
-
-// Prefer the server's scopes-preselected deep link (it owns the per-provider scopes);
-// fall back to the plain token page if it wasn't advertised.
-const tokenCreateUrl = computed(
-  () => patLoginCfg.value?.setupUrls?.[patProvider.value] ?? PROVIDER_TOKEN_URLS[patProvider.value],
-)
+// Per-provider "create a token" link: prefer the server's scopes-preselected deep link (it
+// owns the per-provider scopes), fall back to the plain token page.
+function tokenCreateUrl(provider: PatProvider): string {
+  return patLoginCfg.value?.setupUrls?.[provider] ?? PROVIDER_TOKEN_URLS[provider]
+}
 
-/** One-click (configured PAT) or pasted-token sign-in; reloads so the app boots signed in. */
-async function submitPat(provider: PatProvider, token?: string) {
+/** Sign in as the account the configured env PAT belongs to; reloads so the app boots in. */
+async function submitPat(provider: PatProvider) {
   patError.value = null
   patBusy.value = true
   try {
-    await auth.patLogin(token ? { provider, token } : { provider })
+    await auth.patLogin({ provider })
     if (typeof window !== 'undefined') window.location.assign(window.location.pathname)
   } catch (e) {
     patError.value = apiErrorEnvelope(e)?.message ?? t('auth.localMode.failed')
@@ -154,9 +141,10 @@ const showOAuthDivider = computed(
         </p>
       </div>
 
-      <!-- Local mode: sign in with a source-control PAT (no OAuth round-trip needed) -->
-      <div v-if="showLocalLogin && mode !== 'forgot'" class="space-y-3">
-        <!-- One-click: a PAT is already configured server-side -->
+      <!-- Local mode: sign in with the env-configured source-control PAT. The token lives
+           server-side (GITHUB_PAT / GITLAB_PAT); we only pick a provider here. -->
+      <div v-if="isLocalMode && mode !== 'forgot'" class="space-y-3">
+        <!-- One button per provider whose PAT is configured in env -->
         <UButton
           v-for="p in configuredProviders"
           :key="p"
@@ -167,53 +155,37 @@ const showOAuthDivider = computed(
           :loading="patBusy"
           @click="submitPat(p)"
         >
-          {{ t('auth.localMode.continueWith', { provider: PROVIDER_LABELS[p] }) }}
+          {{ t('auth.localMode.continueWithConfigured', { provider: PROVIDER_LABELS[p] }) }}
         </UButton>
 
-        <!-- Enter a PAT inline -->
-        <form class="space-y-2" @submit.prevent="submitPat(patProvider, patToken.trim())">
-          <p class="text-xs font-medium text-slate-400">{{ t('auth.localMode.enterPatTitle') }}</p>
-          <USelect
-            v-if="patProviderItems.length > 1"
-            v-model="patProvider"
-            :items="patProviderItems"
-            size="lg"
-            class="w-full"
-          />
-          <UTextarea
-            v-model="patToken"
-            :rows="2"
-            :placeholder="
-              t('auth.localMode.tokenPlaceholder', { provider: PROVIDER_LABELS[patProvider] })
-            "
-            class="w-full font-mono"
+        <!-- Neither GITHUB_PAT nor GITLAB_PAT is set: tell the developer how to configure one -->
+        <template v-if="!hasConfiguredPat">
+          <UAlert
+            color="warning"
+            variant="subtle"
+            icon="i-lucide-key-round"
+            :title="t('auth.localMode.noPatTitle')"
+            :description="t('auth.localMode.noPatBody')"
           />
-          <div class="flex items-center justify-between gap-2">
+          <div class="flex flex-wrap gap-3 px-1">
             <a
-              :href="tokenCreateUrl"
+              v-for="p in ALL_PROVIDERS"
+              :key="p"
+              :href="tokenCreateUrl(p)"
               target="_blank"
               rel="noopener noreferrer"
               class="text-xs text-indigo-400 hover:underline"
             >
-              {{ t('auth.localMode.createToken', { provider: PROVIDER_LABELS[patProvider] }) }}
+              {{ t('auth.localMode.createToken', { provider: PROVIDER_LABELS[p] }) }}
             </a>
-            <UButton
-              size="lg"
-              color="neutral"
-              variant="subtle"
-              type="submit"
-              :loading="patBusy"
-              :disabled="!patToken.trim()"
-            >
-              {{ t('auth.localMode.submit') }}
-            </UButton>
           </div>
-        </form>
+        </template>
+
         <p v-if="patError" class="text-sm text-rose-400">{{ patError }}</p>
       </div>
 
       <div
-        v-if="showLocalLogin && auth.providers.password && mode !== 'forgot'"
+        v-if="isLocalMode && auth.providers.password && mode !== 'forgot'"
         class="my-4 flex items-center gap-3 text-xs text-slate-500"
       >
         <span class="h-px flex-1 bg-slate-800" /> {{ t('auth.localMode.orDivider') }}

package/app/stores/auth.ts

@@ -31,6 +31,14 @@ export const useAuthStore = defineStore(
      * setup banner). Null on every other facade.
      */
     const localMode = ref<LocalModeConfig | null>(null)
+    /**
+     * Local mode only: the source-control provider the user last chose to sign in with
+     * (its PAT lives server-side in env — this is just the non-secret choice). Persisted, so
+     * on a later load we silently re-mint a session from that env PAT without showing the
+     * login screen. Set on an explicit sign-in, cleared on logout / 401 (so logout actually
+     * signs out — no auto re-login loop).
+     */
+    const autoLoginProvider = ref<'github' | 'gitlab' | null>(null)
     /** True once the initial auth handshake has settled. */
     const ready = ref(false)
 
@@ -83,6 +91,25 @@ export const useAuthStore = defineStore(
         }
         if (!user.value) token.value = null
       }
+
+      // Local mode: if no live session resolved but the user previously signed in with a
+      // configured env PAT, silently re-mint a session from it — so an expired/rotated token
+      // never forces the login screen again. The token itself stays server-side; we only
+      // remembered the provider choice. Guard on the provider STILL being configured (PAT could
+      // have been removed) and clear the choice on failure so we fall back to the login screen
+      // instead of looping.
+      if (
+        localMode.value?.enabled === true &&
+        user.value === null &&
+        autoLoginProvider.value &&
+        localMode.value.patLogin?.configured.includes(autoLoginProvider.value)
+      ) {
+        try {
+          await patLogin({ provider: autoLoginProvider.value })
+        } catch {
+          autoLoginProvider.value = null
+        }
+      }
       // An already-signed-in user who followed an invite link redeems it here (a
       // brand-new user redeems it server-side during signup/OAuth instead).
       if (user.value) await maybeAcceptInvite()
@@ -153,6 +180,8 @@ export const useAuthStore = defineStore(
      */
     async function patLogin(body: { provider: 'github' | 'gitlab'; token?: string }) {
       applySession(await api.patLogin(body))
+      // Remember the choice so a later load re-mints the session from the env PAT silently.
+      autoLoginProvider.value = body.provider
     }
 
     /** Request a password-reset link by email (always resolves; never reveals existence). */
@@ -170,9 +199,18 @@ export const useAuthStore = defineStore(
       api.logout().catch(() => {})
       token.value = null
       user.value = null
+      // Forget the remembered provider so logout sticks (otherwise bootstrap would
+      // immediately re-mint a session from the env PAT).
+      autoLoginProvider.value = null
     }
 
-    /** Called by the API client when a request comes back 401. */
+    /**
+     * Called by the API client when a request comes back 401. Drops the dead session but KEEPS
+     * the remembered provider (unlike logout): a 401 from an expired/rotated token or a
+     * transient blip should let the next load silently re-mint from the env PAT, not force the
+     * login screen. The guarded re-mint in `bootstrap` clears the choice itself if it genuinely
+     * fails (PAT removed/revoked), so there's no re-login loop.
+     */
     function handleUnauthorized() {
       token.value = null
       user.value = null
@@ -184,6 +222,7 @@ export const useAuthStore = defineStore(
       required,
       providers,
       localMode,
+      autoLoginProvider,
       ready,
       isAuthenticated,
       needsLogin,
@@ -199,5 +238,5 @@ export const useAuthStore = defineStore(
       handleUnauthorized,
     }
   },
-  { persist: { pick: ['token'] } },
+  { persist: { pick: ['token', 'autoLoginProvider'] } },
 )

package/i18n/locales/en.json

@@ -752,13 +752,12 @@
       "loading": "Loading…"
     },
     "localMode": {
-      "continueWith": "Continue with {provider}",
-      "enterPatTitle": "Or sign in with a personal access token",
-      "tokenPlaceholder": "paste a {provider} token",
+      "continueWithConfigured": "Sign in with configured {provider} PAT",
+      "noPatTitle": "No source-control token configured",
+      "noPatBody": "Set GITHUB_PAT or GITLAB_PAT in your .env to sign in with a personal access token, then restart the server.",
       "createToken": "Create a {provider} token ↗",
-      "submit": "Sign in",
       "orDivider": "or",
-      "failed": "Sign-in failed. Check the token and try again."
+      "failed": "Sign-in failed. Check that the configured token is valid and try again."
     },
     "signInRequired": {
       "personalSubscriptions": "Personal subscriptions are saved to your account, but this deployment runs without sign-in, so they can't be stored here. Use the workspace pool or a provider API key instead.",

package/i18n/locales/es.json

@@ -716,13 +716,12 @@
       "loading": "Cargando…"
     },
     "localMode": {
-      "continueWith": "Continuar con {provider}",
-      "enterPatTitle": "O inicia sesión con un token de acceso personal",
-      "tokenPlaceholder": "pega un token de {provider}",
+      "continueWithConfigured": "Inicia sesión con el PAT de {provider} configurado",
+      "noPatTitle": "No hay ningún token de control de versiones configurado",
+      "noPatBody": "Define GITHUB_PAT o GITLAB_PAT en tu .env para iniciar sesión con un token de acceso personal y reinicia el servidor.",
       "createToken": "Crear un token de {provider} ↗",
-      "submit": "Iniciar sesión",
       "orDivider": "o",
-      "failed": "Error al iniciar sesión. Comprueba el token e inténtalo de nuevo."
+      "failed": "Error al iniciar sesión. Comprueba que el token configurado sea válido e inténtalo de nuevo."
     },
     "signInRequired": {
       "personalSubscriptions": "Las suscripciones personales se guardan en tu cuenta, pero este despliegue se ejecuta sin inicio de sesión, así que no se pueden almacenar aquí. Usa el grupo del espacio de trabajo o una clave de API de proveedor.",

package/i18n/locales/fr.json

@@ -716,13 +716,12 @@
       "loading": "Chargement…"
     },
     "localMode": {
-      "continueWith": "Continuer avec {provider}",
-      "enterPatTitle": "Ou connectez-vous avec un jeton d'accès personnel",
-      "tokenPlaceholder": "collez un jeton {provider}",
+      "continueWithConfigured": "Se connecter avec le PAT {provider} configuré",
+      "noPatTitle": "Aucun jeton de gestion de versions configuré",
+      "noPatBody": "Définissez GITHUB_PAT ou GITLAB_PAT dans votre .env pour vous connecter avec un jeton d'accès personnel, puis redémarrez le serveur.",
       "createToken": "Créer un jeton {provider} ↗",
-      "submit": "Se connecter",
       "orDivider": "ou",
-      "failed": "Échec de la connexion. Vérifiez le jeton et réessayez."
+      "failed": "Échec de la connexion. Vérifiez que le jeton configuré est valide et réessayez."
     },
     "signInRequired": {
       "personalSubscriptions": "Les abonnements personnels sont enregistrés sur votre compte, mais ce déploiement fonctionne sans connexion, ils ne peuvent donc pas être stockés ici. Utilisez le pool de l'espace de travail ou une clé d'API de fournisseur.",

package/i18n/locales/pl.json

@@ -716,13 +716,12 @@
       "loading": "Ładowanie…"
     },
     "localMode": {
-      "continueWith": "Kontynuuj z {provider}",
-      "enterPatTitle": "Lub zaloguj się za pomocą osobistego tokenu dostępu",
-      "tokenPlaceholder": "wklej token {provider}",
+      "continueWithConfigured": "Zaloguj się skonfigurowanym tokenem PAT {provider}",
+      "noPatTitle": "Nie skonfigurowano tokenu systemu kontroli wersji",
+      "noPatBody": "Ustaw GITHUB_PAT lub GITLAB_PAT w pliku .env, aby zalogować się za pomocą osobistego tokenu dostępu, a następnie zrestartuj serwer.",
       "createToken": "Utwórz token {provider} ↗",
-      "submit": "Zaloguj się",
       "orDivider": "lub",
-      "failed": "Logowanie nie powiodło się. Sprawdź token i spróbuj ponownie."
+      "failed": "Logowanie nie powiodło się. Sprawdź, czy skonfigurowany token jest prawidłowy, i spróbuj ponownie."
     },
     "signInRequired": {
       "personalSubscriptions": "Subskrypcje osobiste są zapisywane na Twoim koncie, ale to wdrożenie działa bez logowania, więc nie można ich tutaj przechowywać. Użyj puli obszaru roboczego lub klucza API dostawcy.",

package/i18n/locales/uk.json

@@ -716,13 +716,12 @@
       "loading": "Завантаження…"
     },
     "localMode": {
-      "continueWith": "Продовжити з {provider}",
-      "enterPatTitle": "Або увійдіть за допомогою особистого токена доступу",
-      "tokenPlaceholder": "вставте токен {provider}",
+      "continueWithConfigured": "Увійти за допомогою налаштованого PAT {provider}",
+      "noPatTitle": "Токен системи контролю версій не налаштовано",
+      "noPatBody": "Установіть GITHUB_PAT або GITLAB_PAT у файлі .env, щоб увійти за допомогою особистого токена доступу, потім перезапустіть сервер.",
       "createToken": "Створити токен {provider} ↗",
-      "submit": "Увійти",
       "orDivider": "або",
-      "failed": "Не вдалося увійти. Перевірте токен і спробуйте ще раз."
+      "failed": "Не вдалося увійти. Перевірте, що налаштований токен дійсний, і спробуйте ще раз."
     },
     "signInRequired": {
       "personalSubscriptions": "Особисті підписки зберігаються у вашому обліковому записі, але це розгортання працює без входу, тому їх не можна зберегти тут. Скористайтеся пулом робочого простору або ключем API постачальника.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/app",
-  "version": "0.47.6",
+  "version": "0.47.7",
   "description": "Reusable Nuxt layer for the Agent Architecture Board SPA (components, stores, composables, pages). Consume it from a thin deployment app via `extends: ['@cat-factory/app']` and point it at your backend with NUXT_PUBLIC_API_BASE. See deploy/frontend for an example.",
   "repository": {
     "type": "git",
@@ -34,7 +34,7 @@
     "valibot": "^1.4.2",
     "vue": "^3.5.39",
     "wretch": "^3.0.9",
-    "@cat-factory/contracts": "0.45.0"
+    "@cat-factory/contracts": "0.45.1"
   },
   "devDependencies": {
     "@toad-contracts/testing": "0.3.2",