@cat-factory/app 0.64.0 → 0.65.0

package/app/components/auth/LoginScreen.vue

@@ -32,6 +32,9 @@ const configuredProviders = computed<PatProvider[]>(
 )
 const isLocalMode = computed(() => auth.localMode?.enabled === true)
 const hasConfiguredPat = computed(() => configuredProviders.value.length > 0)
+// Mothership mode: identity + org data live on a hosted mothership, so the primary sign-in is a
+// round-trip to the mothership's OAuth (the node then exchanges the session for a machine token).
+const isMothership = computed(() => auth.localMode?.mothership === true)
 
 const patBusy = ref(false)
 const patError = ref<string | null>(null)
@@ -186,6 +189,29 @@ const noSignInMethod = computed(
         </p>
       </div>
 
+      <!-- Mothership mode: sign in through the hosted mothership (it owns identity + the
+           allowlist). The node exchanges the returned session for a machine token. -->
+      <div v-if="isMothership && mode !== 'forgot'" class="mb-4 space-y-2">
+        <UButton
+          block
+          size="lg"
+          color="primary"
+          icon="i-lucide-cloud"
+          data-testid="mothership-signin"
+          @click="auth.signInViaMothership()"
+        >
+          {{ t('auth.mothership.signIn') }}
+        </UButton>
+        <p class="px-1 text-xs text-slate-400">{{ t('auth.mothership.hint') }}</p>
+        <p
+          v-if="auth.mothershipError"
+          class="px-1 text-xs text-rose-400"
+          data-testid="mothership-error"
+        >
+          {{ t('auth.mothership.error') }}
+        </p>
+      </div>
+
       <!-- Local mode: sign in with the env-configured source-control PAT. The token lives
            server-side (GITHUB_PAT / GITLAB_PAT); we only pick a provider here. -->
       <div v-if="isLocalMode && mode !== 'forgot'" class="space-y-3">

package/app/composables/api/auth.ts

@@ -1,6 +1,7 @@
 import {
   acceptInvitationContract,
   authConfigContract,
+  connectMothershipContract,
   forgotPasswordContract,
   logoutContract,
   meContract,
@@ -51,6 +52,11 @@ export function authApi({ http, send, ws }: ApiContext) {
 
     logout: () => send(logoutContract, { pathPrefix: '/auth' }),
 
+    // Mothership mode (local facade): hand the local node a mothership SESSION token (captured
+    // from the mothership OAuth redirect fragment). The node exchanges it for a cached machine
+    // token and returns a LOCAL session for the same user. Mounted at the app root (no prefix).
+    connectMothership: (session: string) => send(connectMothershipContract, { body: { session } }),
+
     // Mint a short-lived, workspace-scoped ticket for the events WebSocket. A
     // browser can't set Authorization on a WS handshake, so the socket auths from
     // this `?ticket=` instead of the long-lived session token. Empty string when

package/app/stores/auth.ts

@@ -60,6 +60,12 @@ export const useAuthStore = defineStore(
     const autoLoginProvider = ref<'github' | 'gitlab' | null>(null)
     /** True once the initial auth handshake has settled. */
     const ready = ref(false)
+    /**
+     * Mothership mode: the last mothership sign-in failure (node unreachable / rejected session),
+     * or null. Set when the post-OAuth connect exchange fails, so the login screen can tell the
+     * user the click didn't take instead of silently returning them to the sign-in button.
+     */
+    const mothershipError = ref<string | null>(null)
     /**
      * True only once `getAuthConfig()` has resolved successfully. Distinguishes "the backend
      * told us auth is off" from "we never reached the backend" (the bootstrap catch path),
@@ -109,9 +115,59 @@ export const useAuthStore = defineStore(
       history.replaceState(null, '', window.location.pathname + window.location.search)
     }
 
+    /**
+     * Mothership mode: when the mothership OAuth redirect returns here (flagged
+     * `?mothership_connect=1`), the URL fragment carries a MOTHERSHIP session — not a local one.
+     * Hand it to our OWN node, which exchanges it for a cached machine token and returns a LOCAL
+     * session for the same user. Returns true when it handled the redirect (so the caller skips
+     * the normal `consumeRedirectToken`, which would wrongly store the mothership session locally).
+     */
+    async function maybeConnectMothership(): Promise<boolean> {
+      if (typeof window === 'undefined') return false
+      const params = new URLSearchParams(window.location.search)
+      if (params.get('mothership_connect') !== '1') return false
+      const match = /(?:^#|[#&])token=([^&]+)/.exec(window.location.hash)
+      const session = match ? decodeURIComponent(match[1]!) : null
+      // Clean the flag + fragment from the URL regardless of outcome, so it isn't left in history.
+      params.delete('mothership_connect')
+      const qs = params.toString()
+      history.replaceState(null, '', window.location.pathname + (qs ? `?${qs}` : ''))
+      if (!session) return true
+      try {
+        const result = await api.connectMothership(session)
+        applySession({ token: result.session, user: result.user })
+        mothershipError.value = null
+      } catch (err) {
+        // Surface the failure so the login screen shows it, rather than silently dropping the
+        // user back on the sign-in button as if the click did nothing. The captured session is
+        // already stripped from the URL, so recovery is a fresh "Sign in via mothership".
+        mothershipError.value =
+          err instanceof Error ? err.message : 'Could not connect to the mothership'
+      }
+      return true
+    }
+
+    /**
+     * Mothership mode: sign in through the hosted mothership. The mothership owns identity + the
+     * allowlist, so we send the browser to ITS OAuth and return here flagged for the connect
+     * exchange (`maybeConnectMothership`). No-op if the mothership URL isn't known.
+     */
+    function signInViaMothership() {
+      if (typeof window === 'undefined') return
+      const base = localMode.value?.mothershipUrl
+      if (!base) return
+      mothershipError.value = null
+      const here = new URL(window.location.origin + window.location.pathname)
+      here.searchParams.set('mothership_connect', '1')
+      const redirect = new URLSearchParams({ redirect: here.toString() })
+      window.location.href = `${base.replace(/\/$/, '')}/auth/login?${redirect}`
+    }
+
     /** Resolve auth state: capture any redirect token, then check the backend. */
     async function bootstrap() {
-      consumeRedirectToken()
+      // A returning mothership-connect redirect is handled first (it carries a mothership session,
+      // which must be exchanged — not stored as a local token by `consumeRedirectToken`).
+      if (!(await maybeConnectMothership())) consumeRedirectToken()
       try {
         const config = await api.getAuthConfig()
         required.value = config.enabled
@@ -277,6 +333,7 @@ export const useAuthStore = defineStore(
       infrastructure,
       autoLoginProvider,
       ready,
+      mothershipError,
       configLoaded,
       isLocalFacade,
       isAuthenticated,
@@ -284,6 +341,7 @@ export const useAuthStore = defineStore(
       bootstrap,
       login,
       loginWithGoogle,
+      signInViaMothership,
       signup,
       passwordLogin,
       patLogin,

package/i18n/locales/en.json

@@ -872,6 +872,11 @@
     "userMenu": {
       "mySetup": "My setup",
       "signOut": "Sign out"
+    },
+    "mothership": {
+      "signIn": "Sign in via mothership",
+      "hint": "Your projects and identity live on the hosted mothership. Sign in there to connect this node.",
+      "error": "Could not sign in via the mothership. Try again."
     }
   },
   "layout": {

package/i18n/locales/es.json

@@ -832,6 +832,11 @@
     "userMenu": {
       "mySetup": "Mi configuración",
       "signOut": "Cerrar sesión"
+    },
+    "mothership": {
+      "signIn": "Iniciar sesión con la central",
+      "hint": "Tus proyectos e identidad están en la central alojada: inicia sesión allí para conectar este nodo.",
+      "error": "No se pudo iniciar sesión con la central. Inténtalo de nuevo."
     }
   },
   "layout": {

package/i18n/locales/fr.json

@@ -832,6 +832,11 @@
     "userMenu": {
       "mySetup": "Ma configuration",
       "signOut": "Se déconnecter"
+    },
+    "mothership": {
+      "signIn": "Se connecter via le serveur central",
+      "hint": "Vos projets et votre identité sont sur le serveur central hébergé. Connectez-vous là-bas pour relier ce nœud.",
+      "error": "Impossible de se connecter via le serveur central. Réessayez."
     }
   },
   "layout": {

package/i18n/locales/he.json

@@ -832,6 +832,11 @@
     "userMenu": {
       "mySetup": "ההגדרות שלי",
       "signOut": "התנתק"
+    },
+    "mothership": {
+      "signIn": "התחברות דרך שרת המרכז",
+      "hint": "הפרויקטים והזהות שלך נמצאים בשרת המרכז המתארח. התחבר שם כדי לחבר את הצומת הזה.",
+      "error": "לא ניתן להתחבר דרך שרת המרכז. נסה שוב."
     }
   },
   "layout": {

package/i18n/locales/ja.json

@@ -832,6 +832,11 @@
     "userMenu": {
       "mySetup": "マイセットアップ",
       "signOut": "サインアウト"
+    },
+    "mothership": {
+      "signIn": "マザーシップ経由でサインイン",
+      "hint": "プロジェクトと認証情報はホスト型のマザーシップにあります。そこでサインインしてこのノードを接続してください。",
+      "error": "マザーシップ経由でサインインできませんでした。もう一度お試しください。"
     }
   },
   "layout": {

package/i18n/locales/pl.json

@@ -832,6 +832,11 @@
     "userMenu": {
       "mySetup": "Moja konfiguracja",
       "signOut": "Wyloguj się"
+    },
+    "mothership": {
+      "signIn": "Zaloguj się przez serwer centralny",
+      "hint": "Twoje projekty i tożsamość znajdują się na hostowanym serwerze centralnym. Zaloguj się tam, aby połączyć ten węzeł.",
+      "error": "Nie udało się zalogować przez serwer centralny. Spróbuj ponownie."
     }
   },
   "layout": {

package/i18n/locales/tr.json

@@ -832,6 +832,11 @@
     "userMenu": {
       "mySetup": "Kurulumum",
       "signOut": "Oturumu kapat"
+    },
+    "mothership": {
+      "signIn": "Ana sunucu üzerinden oturum aç",
+      "hint": "Projeleriniz ve kimliğiniz barındırılan ana sunucuda tutulur. Bu düğümü bağlamak için orada oturum açın.",
+      "error": "Ana sunucu üzerinden oturum açılamadı. Tekrar deneyin."
     }
   },
   "layout": {

package/i18n/locales/uk.json

@@ -832,6 +832,11 @@
     "userMenu": {
       "mySetup": "Моє налаштування",
       "signOut": "Вийти"
+    },
+    "mothership": {
+      "signIn": "Увійти через центральний сервер",
+      "hint": "Ваші проєкти та обліковий запис зберігаються на центральному сервері. Увійдіть там, щоб приєднати цей вузол.",
+      "error": "Не вдалося увійти через центральний сервер. Спробуйте ще раз."
     }
   },
   "layout": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/app",
-  "version": "0.64.0",
+  "version": "0.65.0",
   "description": "Reusable Nuxt layer for the Agent Architecture Board SPA (components, stores, composables, pages). Consume it from a thin deployment app via `extends: ['@cat-factory/app']` and point it at your backend with NUXT_PUBLIC_API_BASE. See deploy/frontend for an example.",
   "repository": {
     "type": "git",
@@ -34,7 +34,7 @@
     "valibot": "^1.4.2",
     "vue": "^3.5.39",
     "wretch": "^3.0.9",
-    "@cat-factory/contracts": "0.71.0"
+    "@cat-factory/contracts": "0.72.0"
   },
   "devDependencies": {
     "@toad-contracts/testing": "0.3.2",