@lukoweb/apitogo 0.1.40 → 0.1.41

package/dist/cli/cli.js

@@ -4124,7 +4124,7 @@ import {
 // package.json
 var package_default = {
   name: "@lukoweb/apitogo",
-  version: "0.1.40",
+  version: "0.1.41",
   type: "module",
   sideEffects: [
     "**/*.css",
@@ -6761,7 +6761,7 @@ var viteAuthPlugin = () => {
     async load(id) {
       if (id === resolvedVirtualModuleId4) {
         const config2 = getCurrentConfig();
-        if (!config2.authentication || !config2.__resolvedModules.userPanel.userManagement.enabled || config2.__meta.mode === "standalone") {
+        if (!config2.authentication || config2.__meta.mode === "standalone") {
           return `export const configuredAuthProvider = undefined;`;
         }
         return [

package/dist/declarations/lib/authentication/state.d.ts

@@ -5,6 +5,7 @@ export type AuthMode = "live" | "preview";
 export interface AuthState {
     isAuthenticated: boolean;
     isPending: boolean;
+    sessionChecked: boolean;
     profile: UserProfile | null;
     providerData: ProviderData | null;
     isBackendAvailable: boolean;

package/dist/declarations/lib/components/context/ZudokuProvider.d.ts

@@ -1,4 +1,4 @@
-import { type PropsWithChildren } from "react";
+import type { PropsWithChildren } from "react";
 import type { ZudokuContext } from "../../core/ZudokuContext.js";
 export declare const ZudokuProvider: ({ children, context, }: PropsWithChildren<{
     context: ZudokuContext;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lukoweb/apitogo",
-  "version": "0.1.40",
+  "version": "0.1.41",
   "type": "module",
   "sideEffects": [
     "**/*.css",

package/src/lib/authentication/providers/dev-portal.tsx

@@ -106,6 +106,7 @@ export class DevPortalAuthenticationProvider
     useAuthState.setState({
       isAuthenticated: false,
       isPending: false,
+      sessionChecked: true,
       profile: null,
       providerData: this.apiBaseUrl
         ? {
@@ -181,6 +182,7 @@ export class DevPortalAuthenticationProvider
         useAuthState.setState({
           isAuthenticated: false,
           isPending: false,
+          sessionChecked: true,
           profile: null,
           providerData: {
             type: "dev-portal",
@@ -208,6 +210,7 @@ export class DevPortalAuthenticationProvider
       useAuthState.setState({
         isAuthenticated: true,
         isPending: false,
+        sessionChecked: true,
         profile,
         providerData: {
           type: "dev-portal",

package/src/lib/authentication/state.ts

@@ -26,6 +26,8 @@ export type AuthMode = "live" | "preview";
 export interface AuthState {
   isAuthenticated: boolean;
   isPending: boolean;
+  /** True after the auth provider has finished its first session probe on load. */
+  sessionChecked: boolean;
   profile: UserProfile | null;
   providerData: ProviderData | null;
   /** False when dev-portal backend is unavailable (local preview). Defaults true. */
@@ -57,6 +59,7 @@ function createAuthStateStore(): AuthStateStore {
       (set) => ({
         isAuthenticated: false,
         isPending: true,
+        sessionChecked: false,
         profile: null,
         providerData: null,
         isBackendAvailable: true,
@@ -65,6 +68,7 @@ function createAuthStateStore(): AuthStateStore {
           set(() => ({
             isAuthenticated: false,
             isPending: false,
+            sessionChecked: true,
             profile: null,
             providerData: null,
             isBackendAvailable: true,
@@ -74,6 +78,7 @@ function createAuthStateStore(): AuthStateStore {
           set(() => ({
             isAuthenticated: false,
             isPending: false,
+            sessionChecked: true,
             profile: null,
             providerData: null,
             isBackendAvailable: true,
@@ -83,6 +88,7 @@ function createAuthStateStore(): AuthStateStore {
           set(() => ({
             isAuthenticated: true,
             isPending: false,
+            sessionChecked: true,
             profile,
             providerData,
           })),
@@ -113,9 +119,11 @@ function createAuthStateStore(): AuthStateStore {
 
           // Cookie/session auth is refreshed from the backend on load. Do not
           // restore identity fields from localStorage or OIDC return looks logged out.
+          // Keep isPending true until the auth provider finishes /auth/me (or equivalent).
           return {
             ...currentState,
-            isPending: false,
+            isPending: true,
+            sessionChecked: false,
             isAuthenticated: currentState.isAuthenticated,
             profile: currentState.profile,
             providerData: currentState.providerData,

package/src/lib/components/HeaderNavigation.tsx

@@ -7,7 +7,6 @@ import {
   type HeaderNavLinkItem,
 } from "../../config/validators/HeaderNavigationSchema.js";
 import { useAuth } from "../authentication/hook.js";
-import { shouldShowItem } from "./navigation/utils.js";
 import type { ZudokuContext } from "../core/ZudokuContext.js";
 import {
   NavigationMenu,
@@ -20,6 +19,7 @@ import {
 } from "../ui/NavigationMenu.js";
 import { cn } from "../util/cn.js";
 import { useZudoku } from "./context/ZudokuContext.js";
+import { shouldShowItem } from "./navigation/utils.js";
 
 const NavLinkItem = ({ item }: { item: HeaderNavLinkItem }) => {
   const Icon = item.icon as LucideIcon | undefined;
@@ -160,10 +160,9 @@ export const HeaderNavigation = () => {
   return (
     <NavigationMenu className={viewportAlign}>
       <NavigationMenuList>
-        {items.map((item, index) => (
-          // biome-ignore lint/suspicious/noArrayIndexKey: Stable because it's statically defined in the config
+        {items.map((item) => (
           <HeaderNavItemComponent
-            key={`${item.label}-${index}`}
+            key={"to" in item ? item.to : item.label}
             item={item}
             auth={auth}
             context={context}

package/src/lib/components/Zudoku.tsx

@@ -6,6 +6,7 @@ import {
   type PropsWithChildren,
   useEffect,
   useMemo,
+  useRef,
   useState,
 } from "react";
 import { ErrorBoundary } from "react-error-boundary";
@@ -23,8 +24,6 @@ import { ViewportAnchorProvider } from "./context/ViewportAnchorContext.js";
 import { ApitogoProvider } from "./context/ZudokuProvider.js";
 import { PluginHeads } from "./PluginHeads.js";
 
-let apitogoContext: ZudokuContext | undefined;
-
 const ZudokuInner = memo(
   ({
     children,
@@ -53,6 +52,8 @@ const ZudokuInner = memo(
     const [didNavigate, setDidNavigate] = useState(false);
     const navigation = useNavigation();
     const queryClient = useQueryClient();
+    const apitogoContextRef = useRef<ZudokuContext | undefined>(undefined);
+    apitogoContextRef.current ??= new ZudokuContext(props, queryClient, env);
 
     useEffect(() => {
       if (didNavigate || !navigation.location) {
@@ -61,12 +62,10 @@ const ZudokuInner = memo(
       setDidNavigate(true);
     }, [didNavigate, navigation.location]);
 
-    apitogoContext ??= new ZudokuContext(props, queryClient, env);
-
     return (
       <>
         <PluginHeads plugins={props.plugins ?? []} location={location} />
-        <ApitogoProvider context={apitogoContext}>
+        <ApitogoProvider context={apitogoContextRef.current}>
           <RouterEventsEmitter />
           <SlotProvider slots={props.slots ?? props.UNSAFE_slotlets}>
             <MDXProvider components={mdxComponents}>

package/src/lib/components/context/ZudokuProvider.tsx

@@ -1,4 +1,4 @@
-import { use, type PropsWithChildren } from "react";
+import type { PropsWithChildren } from "react";
 import type { ZudokuContext } from "../../core/ZudokuContext.js";
 import { ZudokuReactContext } from "./ZudokuReactContext.js";
 
@@ -6,8 +6,6 @@ const ZudokuProviderImpl = ({
   children,
   context,
 }: PropsWithChildren<{ context: ZudokuContext }>) => {
-  if (context.initialize) use(context.initialize);
-
   return (
     <ZudokuReactContext.Provider value={context}>
       {children}

package/src/lib/core/RouteGuard.tsx

@@ -179,8 +179,10 @@ export const RouteGuard = () => {
     if (
       !auth.isBackendAvailable ||
       auth.isPending ||
+      !auth.sessionChecked ||
       !needsAuth ||
-      auth.hasDistinctSignUpFlow
+      auth.hasDistinctSignUpFlow ||
+      !auth.isAuthEnabled
     ) {
       unifiedRedirectKeyRef.current = null;
       return;
@@ -195,7 +197,9 @@ export const RouteGuard = () => {
   }, [
     auth.isBackendAvailable,
     auth.isPending,
+    auth.sessionChecked,
     auth.hasDistinctSignUpFlow,
+    auth.isAuthEnabled,
     auth.login,
     needsAuth,
     redirectTo,
@@ -210,6 +214,11 @@ export const RouteGuard = () => {
   }
 
   if (isProtectedRoute && !auth.isAuthEnabled) {
+    // Dev SSR can reuse a stale context before auth plugins hydrate; client decides.
+    if (typeof window === "undefined") {
+      return <BypassRoute isProtectedRoute={isProtectedRoute} />;
+    }
+
     throw new ZudokuError("Authentication is not enabled", {
       title: "Authentication is not enabled",
       developerHint:
@@ -217,6 +226,10 @@ export const RouteGuard = () => {
     });
   }
 
+  if (needsToSignIn && !auth.sessionChecked && typeof window !== "undefined") {
+    return null;
+  }
+
   if (needsToSignIn && auth.isPending && typeof window !== "undefined") {
     return null;
   }

package/src/lib/testing/index.tsx

@@ -68,6 +68,7 @@ const StaticZudoku = ({
     useAuthState.setState({
       isAuthenticated: true,
       isPending: false,
+      sessionChecked: true,
       profile: {
         sub: "test-user",
         email: "test@example.com",

package/src/vite/plugin-auth.ts

@@ -16,11 +16,7 @@ const viteAuthPlugin = (): Plugin => {
       if (id === resolvedVirtualModuleId) {
         const config = getCurrentConfig();
 
-        if (
-          !config.authentication ||
-          !config.__resolvedModules.userPanel.userManagement.enabled ||
-          config.__meta.mode === "standalone"
-        ) {
+        if (!config.authentication || config.__meta.mode === "standalone") {
           return `export const configuredAuthProvider = undefined;`;
         }
         // TODO: Validate that the authConfig.type is a valid authentication provider