@cat-factory/app 0.58.5 → 0.59.0

package/app/components/auth/LoginScreen.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { computed, ref } from 'vue'
+import { computed, ref, watch } from 'vue'
 import { apiErrorEnvelope } from '~/composables/api/errors'
 
 const auth = useAuthStore()
@@ -123,6 +123,51 @@ function setMode(next: 'login' | 'signup' | 'forgot') {
 const showOAuthDivider = computed(
   () => auth.providers.password && (auth.providers.github || auth.providers.google),
 )
+
+// Hosted (remote node) PAT login: the user pastes their OWN source-control PAT, which the
+// server resolves to an account and holds to its login/org/domain allowlist. The available
+// providers come from the server (`auth.patProviders`); empty in local mode (which uses the
+// configured-token flow above) and on OAuth-only facades like the Worker.
+const remotePatProviders = computed<PatProvider[]>(() =>
+  isLocalMode.value ? [] : (auth.patProviders as PatProvider[]),
+)
+const remotePatProvider = ref<PatProvider>('github')
+watch(
+  remotePatProviders,
+  (list) => {
+    if (list.length && !list.includes(remotePatProvider.value)) remotePatProvider.value = list[0]!
+  },
+  { immediate: true },
+)
+const remotePatToken = ref('')
+const remotePatBusy = ref(false)
+const remotePatError = ref<string | null>(null)
+
+async function submitRemotePat() {
+  remotePatError.value = null
+  remotePatBusy.value = true
+  try {
+    await auth.patLogin({ provider: remotePatProvider.value, token: remotePatToken.value.trim() })
+    if (typeof window !== 'undefined') window.location.assign(window.location.pathname)
+  } catch (e) {
+    remotePatError.value = apiErrorEnvelope(e)?.message ?? t('auth.login.signInFailed')
+  } finally {
+    remotePatBusy.value = false
+  }
+}
+
+// A remote deployment (node service / Worker) that advertises no sign-in method at all:
+// no OAuth, no password, no PAT, and not local mode. The auth gate still routes here (a
+// remote facade has no anonymous tier), so instead of a blank card we explain that
+// authentication isn't configured and there's nothing to sign in with yet.
+const noSignInMethod = computed(
+  () =>
+    !isLocalMode.value &&
+    !auth.providers.github &&
+    !auth.providers.google &&
+    !auth.providers.password &&
+    remotePatProviders.value.length === 0,
+)
 </script>
 
 <template>
@@ -296,6 +341,76 @@ const showOAuthDivider = computed(
         </p>
       </form>
 
+      <!-- Hosted (remote node) PAT login: paste your own source-control PAT -->
+      <template v-if="remotePatProviders.length > 0 && mode !== 'forgot'">
+        <div
+          v-if="auth.providers.github || auth.providers.google || auth.providers.password"
+          class="my-4 flex items-center gap-3 text-xs text-slate-500"
+        >
+          <span class="h-px flex-1 bg-slate-800" /> {{ t('auth.login.or') }}
+          <span class="h-px flex-1 bg-slate-800" />
+        </div>
+        <form class="space-y-3" @submit.prevent="submitRemotePat">
+          <div v-if="remotePatProviders.length > 1" class="flex gap-2">
+            <UButton
+              v-for="p in remotePatProviders"
+              :key="p"
+              :color="p === remotePatProvider ? 'primary' : 'neutral'"
+              :variant="p === remotePatProvider ? 'solid' : 'subtle'"
+              :icon="PROVIDER_ICONS[p]"
+              size="sm"
+              @click="remotePatProvider = p"
+            >
+              {{ PROVIDER_LABELS[p] }}
+            </UButton>
+          </div>
+          <UInput
+            v-model="remotePatToken"
+            type="password"
+            required
+            :placeholder="
+              t('auth.login.patPlaceholder', { provider: PROVIDER_LABELS[remotePatProvider] })
+            "
+            icon="i-lucide-key-round"
+            size="lg"
+            class="w-full"
+          />
+          <p v-if="remotePatError" class="text-sm text-rose-400">{{ remotePatError }}</p>
+          <UButton
+            block
+            size="lg"
+            color="primary"
+            type="submit"
+            :icon="PROVIDER_ICONS[remotePatProvider]"
+            :loading="remotePatBusy"
+          >
+            {{ t('auth.login.signInWithPat', { provider: PROVIDER_LABELS[remotePatProvider] }) }}
+          </UButton>
+          <p class="px-1 text-center">
+            <a
+              :href="tokenCreateUrl(remotePatProvider)"
+              target="_blank"
+              rel="noopener noreferrer"
+              class="text-xs text-indigo-400 hover:underline"
+            >
+              {{
+                t('auth.localMode.createToken', { provider: PROVIDER_LABELS[remotePatProvider] })
+              }}
+            </a>
+          </p>
+        </form>
+      </template>
+
+      <!-- No sign-in method configured on a remote deployment: explain, don't show a blank card -->
+      <UAlert
+        v-if="noSignInMethod"
+        color="warning"
+        variant="subtle"
+        icon="i-lucide-shield-alert"
+        :title="t('auth.login.notConfiguredTitle')"
+        :description="t('auth.login.notConfiguredBody')"
+      />
+
       <!-- Forgot password: request a reset link by email -->
       <form
         v-if="auth.providers.password && mode === 'forgot'"

package/app/stores/auth.ts

@@ -25,6 +25,18 @@ export const useAuthStore = defineStore(
     const required = ref(false)
     /** Which login providers the backend offers (drives the login UI). */
     const providers = ref({ github: false, password: false, google: false })
+    /**
+     * Source-control providers a HOSTED facade (remote node) accepts a user-supplied PAT for.
+     * Drives the login screen's "sign in with a PAT" option on non-local deployments. Empty on
+     * the Worker (OAuth-only) and in local mode (which uses `localMode.patLogin` instead).
+     */
+    const patProviders = ref<('github' | 'gitlab')[]>([])
+    /**
+     * Test-only: the backend advertised that it runs with NO authentication (its
+     * `TESTING_NO_AUTH` opt-in). When set, the SPA renders the board anonymously instead of
+     * gating to the login screen — even on a remote facade. Only ever true under the e2e suite.
+     */
+    const testingNoAuth = ref(false)
     /**
      * Local-mode signals from the backend. Present only when running the local facade;
      * `githubPatSetupUrl` is set when local mode has no GitHub PAT configured (drives the
@@ -48,18 +60,44 @@ export const useAuthStore = defineStore(
     const autoLoginProvider = ref<'github' | 'gitlab' | null>(null)
     /** True once the initial auth handshake has settled. */
     const ready = ref(false)
+    /**
+     * True only once `getAuthConfig()` has resolved successfully. Distinguishes "the backend
+     * told us auth is off" from "we never reached the backend" (the bootstrap catch path),
+     * so an unreachable backend falls through to the board's own error UI instead of being
+     * mistaken for an unauthenticated session and gated to the login screen.
+     */
+    const configLoaded = ref(false)
+    /**
+     * Whether this is the local-mode facade. Only the local facade reports `localMode`; the
+     * remote node service and the Cloudflare Worker never do. Used to tell "a developer's
+     * own machine (anonymous-but-dev-open is its own thing)" apart from "a remote deployment
+     * that has no anonymous tier".
+     */
+    const isLocalFacade = computed(() => localMode.value !== null)
 
     /** May the app render? True when auth is off, or on with a known user. */
     const isAuthenticated = computed(() => !required.value || user.value !== null)
 
     /**
-     * Whether the SPA must show the login screen before the board. Auth-enabled deployments
-     * gate on a user as before; local mode ALSO gates (even though its API stays dev-open),
-     * because anonymous local use can't store per-user credentials — see the login flow.
+     * Whether the SPA must show the login screen before the board.
+     *
+     * - Auth-enabled deployments gate on a user as before.
+     * - Local mode ALSO gates (even though its API stays dev-open), because anonymous local
+     *   use can't store per-user credentials — see the login flow.
+     * - A REMOTE facade (node service / Worker) has NO anonymous tier: once the auth handshake
+     *   has resolved and there's no user, gate — even when the backend reports auth "disabled"
+     *   (a misconfigured/dev-open remote running without a provider). Previously this slipped
+     *   through and dropped the user onto a board where every per-user action silently failed
+     *   with no sign-in affordance; the login screen now surfaces that state (offering a
+     *   provider, or explaining that none is configured).
      */
-    const needsLogin = computed(
-      () => (required.value || localMode.value?.enabled === true) && user.value === null,
-    )
+    const needsLogin = computed(() => {
+      if (!configLoaded.value || user.value !== null) return false
+      // A deployment that explicitly runs with no auth (the test opt-in) renders anonymously.
+      if (testingNoAuth.value) return false
+      if (isLocalFacade.value) return required.value || localMode.value?.enabled === true
+      return true
+    })
 
     /** Pull a token handed back in the post-login URL fragment (#token=…). */
     function consumeRedirectToken() {
@@ -78,10 +116,14 @@ export const useAuthStore = defineStore(
         const config = await api.getAuthConfig()
         required.value = config.enabled
         if (config.providers) providers.value = config.providers
+        patProviders.value = config.patLogin?.providers ?? []
+        testingNoAuth.value = config.testingNoAuth ?? false
         localMode.value = config.localMode ?? null
         infrastructure.value = config.infrastructure ?? null
+        configLoaded.value = true
       } catch {
-        // Backend unreachable — let the board's own error UI handle it.
+        // Backend unreachable — let the board's own error UI handle it (configLoaded stays
+        // false, so we never mistake this for an unauthenticated session and gate it).
         required.value = false
         ready.value = true
         return
@@ -229,10 +271,14 @@ export const useAuthStore = defineStore(
       user,
       required,
       providers,
+      patProviders,
+      testingNoAuth,
       localMode,
       infrastructure,
       autoLoginProvider,
       ready,
+      configLoaded,
+      isLocalFacade,
       isAuthenticated,
       needsLogin,
       bootstrap,

package/i18n/locales/en.json

@@ -812,7 +812,11 @@
       "sendResetLink": "Send reset link",
       "backToSignIn": "Back to sign in",
       "signInFailed": "Sign-in failed. Check your details and try again.",
-      "genericError": "Something went wrong. Please try again."
+      "genericError": "Something went wrong. Please try again.",
+      "notConfiguredTitle": "Authentication isn't configured",
+      "notConfiguredBody": "This deployment has no sign-in method enabled, so you can't sign in or access your workspaces. An administrator needs to configure an authentication provider (GitHub or Google OAuth, or email and password login).",
+      "patPlaceholder": "{provider} personal access token",
+      "signInWithPat": "Sign in with {provider} PAT"
     },
     "resetPassword": {
       "title": "Reset password",

package/i18n/locales/es.json

@@ -772,7 +772,11 @@
       "sendResetLink": "Enviar enlace de restablecimiento",
       "backToSignIn": "Volver al inicio de sesión",
       "signInFailed": "Error al iniciar sesión. Revisa tus datos e inténtalo de nuevo.",
-      "genericError": "Algo salió mal. Inténtalo de nuevo."
+      "genericError": "Algo salió mal. Inténtalo de nuevo.",
+      "notConfiguredTitle": "La autenticación no está configurada",
+      "notConfiguredBody": "Este despliegue no tiene ningún método de inicio de sesión habilitado, por lo que no puedes iniciar sesión ni acceder a tus espacios de trabajo. Un administrador debe configurar un proveedor de autenticación (OAuth de GitHub o Google, o inicio de sesión con correo y contraseña).",
+      "patPlaceholder": "Token de acceso personal de {provider}",
+      "signInWithPat": "Iniciar sesión con un PAT de {provider}"
     },
     "resetPassword": {
       "title": "Restablecer contraseña",

package/i18n/locales/fr.json

@@ -772,7 +772,11 @@
       "sendResetLink": "Envoyer le lien de réinitialisation",
       "backToSignIn": "Retour à la connexion",
       "signInFailed": "Échec de la connexion. Vérifiez vos informations et réessayez.",
-      "genericError": "Une erreur s'est produite. Veuillez réessayer."
+      "genericError": "Une erreur s'est produite. Veuillez réessayer.",
+      "notConfiguredTitle": "L'authentification n'est pas configurée",
+      "notConfiguredBody": "Ce déploiement n'a aucune méthode de connexion activée, vous ne pouvez donc pas vous connecter ni accéder à vos espaces de travail. Un administrateur doit configurer un fournisseur d'authentification (OAuth GitHub ou Google, ou connexion par e-mail et mot de passe).",
+      "patPlaceholder": "Jeton d'accès personnel {provider}",
+      "signInWithPat": "Se connecter avec un PAT {provider}"
     },
     "resetPassword": {
       "title": "Réinitialiser le mot de passe",

package/i18n/locales/he.json

@@ -772,7 +772,11 @@
       "sendResetLink": "שלח קישור איפוס",
       "backToSignIn": "חזרה להתחברות",
       "signInFailed": "ההתחברות נכשלה. בדוק את הפרטים שלך ונסה שוב.",
-      "genericError": "משהו השתבש. אנא נסה שוב."
+      "genericError": "משהו השתבש. אנא נסה שוב.",
+      "notConfiguredTitle": "האימות אינו מוגדר",
+      "notConfiguredBody": "בפריסה זו לא מופעלת אף שיטת התחברות, ולכן לא ניתן להתחבר או לגשת למרחבי העבודה שלך. מנהל המערכת צריך להגדיר ספק אימות (GitHub או Google OAuth, או התחברות עם אימייל וסיסמה).",
+      "patPlaceholder": "אסימון גישה אישי של {provider}",
+      "signInWithPat": "התחברות עם PAT של {provider}"
     },
     "resetPassword": {
       "title": "אפס סיסמה",

package/i18n/locales/ja.json

@@ -772,7 +772,11 @@
       "sendResetLink": "リセットリンクを送信",
       "backToSignIn": "サインインに戻る",
       "signInFailed": "サインインに失敗しました。入力内容を確認して、もう一度お試しください。",
-      "genericError": "問題が発生しました。もう一度お試しください。"
+      "genericError": "問題が発生しました。もう一度お試しください。",
+      "notConfiguredTitle": "認証が設定されていません",
+      "notConfiguredBody": "このデプロイにはサインイン方法が有効になっていないため、サインインやワークスペースへのアクセスができません。管理者が認証プロバイダー（GitHub または Google の OAuth、あるいはメールアドレスとパスワードによるログイン）を設定する必要があります。",
+      "patPlaceholder": "{provider} のパーソナルアクセストークン",
+      "signInWithPat": "{provider} の PAT でサインイン"
     },
     "resetPassword": {
       "title": "パスワードをリセット",

package/i18n/locales/pl.json

@@ -772,7 +772,11 @@
       "sendResetLink": "Wyślij link resetujący",
       "backToSignIn": "Powrót do logowania",
       "signInFailed": "Logowanie nie powiodło się. Sprawdź swoje dane i spróbuj ponownie.",
-      "genericError": "Coś poszło nie tak. Spróbuj ponownie."
+      "genericError": "Coś poszło nie tak. Spróbuj ponownie.",
+      "notConfiguredTitle": "Uwierzytelnianie nie jest skonfigurowane",
+      "notConfiguredBody": "To wdrożenie nie ma włączonej żadnej metody logowania, więc nie możesz się zalogować ani uzyskać dostępu do swoich przestrzeni roboczych. Administrator musi skonfigurować dostawcę uwierzytelniania (OAuth GitHub lub Google albo logowanie e-mailem i hasłem).",
+      "patPlaceholder": "Osobisty token dostępu {provider}",
+      "signInWithPat": "Zaloguj się tokenem PAT {provider}"
     },
     "resetPassword": {
       "title": "Zresetuj hasło",

package/i18n/locales/tr.json

@@ -772,7 +772,11 @@
       "sendResetLink": "Sıfırlama bağlantısı gönder",
       "backToSignIn": "Oturum açmaya dön",
       "signInFailed": "Oturum açma başarısız. Bilgilerinizi kontrol edip tekrar deneyin.",
-      "genericError": "Bir şeyler ters gitti. Lütfen tekrar deneyin."
+      "genericError": "Bir şeyler ters gitti. Lütfen tekrar deneyin.",
+      "notConfiguredTitle": "Kimlik doğrulama yapılandırılmamış",
+      "notConfiguredBody": "Bu dağıtımda etkin bir oturum açma yöntemi yok, bu nedenle oturum açamaz veya çalışma alanlarınıza erişemezsiniz. Bir yönetici, bir kimlik doğrulama sağlayıcısı (GitHub veya Google OAuth ya da e-posta ve parola ile oturum açma) yapılandırmalıdır.",
+      "patPlaceholder": "{provider} kişisel erişim belirteci",
+      "signInWithPat": "{provider} PAT ile oturum aç"
     },
     "resetPassword": {
       "title": "Parolayı sıfırla",

package/i18n/locales/uk.json

@@ -772,7 +772,11 @@
       "sendResetLink": "Надіслати посилання для скидання",
       "backToSignIn": "Повернутися до входу",
       "signInFailed": "Не вдалося увійти. Перевірте свої дані та спробуйте ще раз.",
-      "genericError": "Щось пішло не так. Спробуйте ще раз."
+      "genericError": "Щось пішло не так. Спробуйте ще раз.",
+      "notConfiguredTitle": "Автентифікацію не налаштовано",
+      "notConfiguredBody": "У цьому розгортанні не ввімкнено жодного способу входу, тому ви не можете увійти чи отримати доступ до своїх робочих просторів. Адміністратор має налаштувати постачальника автентифікації (OAuth GitHub або Google чи вхід за електронною поштою та паролем).",
+      "patPlaceholder": "Особистий токен доступу {provider}",
+      "signInWithPat": "Увійти за допомогою PAT {provider}"
     },
     "resetPassword": {
       "title": "Скинути пароль",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/app",
-  "version": "0.58.5",
+  "version": "0.59.0",
   "description": "Reusable Nuxt layer for the Agent Architecture Board SPA (components, stores, composables, pages). Consume it from a thin deployment app via `extends: ['@cat-factory/app']` and point it at your backend with NUXT_PUBLIC_API_BASE. See deploy/frontend for an example.",
   "repository": {
     "type": "git",
@@ -34,7 +34,7 @@
     "valibot": "^1.4.2",
     "vue": "^3.5.39",
     "wretch": "^3.0.9",
-    "@cat-factory/contracts": "0.62.0"
+    "@cat-factory/contracts": "0.63.0"
   },
   "devDependencies": {
     "@toad-contracts/testing": "0.3.2",