@lumerahq/cli 0.30.13 → 0.30.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumerahq/cli",
-  "version": "0.30.13",
+  "version": "0.30.14",
   "description": "CLI for building and deploying Lumera apps",
   "type": "module",
   "engines": {

package/templates/default/src/lib/auth.ts

@@ -1,9 +1,47 @@
-import { createContext } from 'react';
+import { createContext, useContext } from 'react';
+
+export type ViewerMemberTag = {
+  id: string;
+  key: string;
+  label: string;
+  color: string;
+};
+
+export type ViewerContext = {
+  version: 1;
+  isSignedIn: boolean;
+  subjectType: 'anonymous' | 'org_member' | 'public_app_user';
+  belongsToOrganization: boolean;
+  identity: { id: string; name: string; email: string } | null;
+  organizationMembership: {
+    id: string;
+    role: string;
+    isCompanyAdmin: boolean;
+    department: ViewerMemberTag | null;
+    tags: ViewerMemberTag[];
+  } | null;
+  appUser: { id: string; role: string } | null;
+};
 
 export type AuthContextValue = {
   company?: { id: string; name?: string; apiName?: string };
   user?: { id: string; name: string; email: string; role?: string };
+  viewer: ViewerContext;
   sessionToken?: string;
 };
 
 export const AuthContext = createContext<AuthContextValue | null>(null);
+
+export const useAuth = (): AuthContextValue => {
+  const value = useContext(AuthContext);
+  if (!value) throw new Error('useAuth must be used inside AuthContext.Provider');
+  return value;
+};
+
+export const hasMemberTag = (viewer: ViewerContext, key: string): boolean =>
+  viewer.organizationMembership?.tags.some(
+    (tag) => tag.key.trim().toLowerCase() === key.trim().toLowerCase()
+  ) === true;
+
+export const isDepartment = (viewer: ViewerContext, key: string): boolean =>
+  viewer.organizationMembership?.department?.key.trim().toLowerCase() === key.trim().toLowerCase();

package/templates/default/src/main.tsx

@@ -11,7 +11,12 @@ import { StrictMode, useEffect, useRef, useState } from 'react';
 import ReactDOM from 'react-dom/client';
 import { Toaster } from 'sonner';
 
-import { AuthContext, type AuthContextValue } from './lib/auth';
+import {
+  AuthContext,
+  type AuthContextValue,
+  type ViewerContext,
+  type ViewerMemberTag,
+} from './lib/auth';
 import { routeTree } from './routeTree.gen';
 import './styles.css';
 
@@ -39,6 +44,117 @@ declare module '@tanstack/react-router' {
 
 const ROUTE_STORAGE_KEY = '{{projectName}}-route';
 
+type ViewerHostPayload = HostPayload & { viewer?: ViewerContext };
+
+type ViewerResponse = {
+  version?: number;
+  is_signed_in?: boolean;
+  subject_type?: 'anonymous' | 'org_member' | 'public_app_user';
+  belongs_to_organization?: boolean;
+  identity?: { id?: string; name?: string; email?: string } | null;
+  organization_membership?: {
+    id?: string;
+    role?: string;
+    is_company_admin?: boolean;
+    department?: ViewerMemberTag | null;
+    tags?: ViewerMemberTag[];
+  } | null;
+  app_user?: { id?: string; role?: string } | null;
+};
+
+const viewerFromPayload = (payload: ViewerHostPayload): ViewerContext => {
+  if (payload.viewer) return payload.viewer;
+  const user = payload.user;
+  if (user && (payload.subjectType === 'app_user' || payload.subjectType === 'public_app_user')) {
+    return {
+      version: 1,
+      isSignedIn: true,
+      subjectType: 'public_app_user',
+      belongsToOrganization: false,
+      identity: { id: user.id, name: user.name, email: user.email },
+      organizationMembership: null,
+      appUser: { id: user.id, role: user.role ?? '' },
+    };
+  }
+  if (user) {
+    return {
+      version: 1,
+      isSignedIn: true,
+      subjectType: 'org_member',
+      belongsToOrganization: true,
+      identity: { id: user.id, name: user.name, email: user.email },
+      organizationMembership: {
+        id: user.id,
+        role: user.role ?? '',
+        isCompanyAdmin: user.role?.toLowerCase() === 'admin',
+        department: null,
+        tags: [],
+      },
+      appUser: null,
+    };
+  }
+  return {
+    version: 1,
+    isSignedIn: false,
+    subjectType: 'anonymous',
+    belongsToOrganization: false,
+    identity: null,
+    organizationMembership: null,
+    appUser: null,
+  };
+};
+
+const viewerFromResponse = (response: ViewerResponse): ViewerContext => ({
+  version: 1,
+  isSignedIn: response.is_signed_in === true,
+  subjectType: response.subject_type ?? 'anonymous',
+  belongsToOrganization: response.belongs_to_organization === true,
+  identity: response.identity
+    ? {
+        id: response.identity.id ?? '',
+        name: response.identity.name ?? '',
+        email: response.identity.email ?? '',
+      }
+    : null,
+  organizationMembership: response.organization_membership
+    ? {
+        id: response.organization_membership.id ?? '',
+        role: response.organization_membership.role ?? '',
+        isCompanyAdmin: response.organization_membership.is_company_admin === true,
+        department: response.organization_membership.department ?? null,
+        tags: response.organization_membership.tags ?? [],
+      }
+    : null,
+  appUser: response.app_user
+    ? {
+        id: response.app_user.id ?? '',
+        role: response.app_user.role ?? '',
+      }
+    : null,
+});
+
+const resolveViewer = async (payload: ViewerHostPayload): Promise<ViewerContext> => {
+  if (payload.viewer) return payload.viewer;
+
+  // The checked-in lockfile can briefly trail a newly published UI bridge.
+  // Keep standalone apps complete during that release window by reading the
+  // canonical block from the same authenticated /api/me endpoint.
+  if (!isEmbedded()) {
+    try {
+      const response = await fetch('/api/me', { credentials: 'same-origin' });
+      if (response.ok) {
+        const body = (await response.json()) as { viewer?: ViewerResponse };
+        if (body.viewer) return viewerFromResponse(body.viewer);
+      }
+    } catch {
+      // Compatibility fallback below preserves the pre-viewer behavior when
+      // an older app host does not yet expose the canonical response.
+    }
+  }
+
+  return viewerFromPayload(payload);
+};
+
 function RouteRestorer() {
   const isFirstLoad = useRef(true);
 
@@ -75,7 +191,8 @@ const App = () => {
     // in the Lumera shell, same-origin /api with the app-session cookie when
     // served standalone on the app's own hostname, and direct dev fetch when
     // VITE_DEV_API_BASE_URL is set.
-    const cleanup = onInitMessage((payload?: HostPayload) => {
+    const cleanup = onInitMessage((rawPayload?: HostPayload) => {
+      const payload = rawPayload as ViewerHostPayload | undefined;
       if (!payload) {
         // No identity and no app context: authentication is required
         // (payload.user alone being undefined means an anonymous visitor on
@@ -83,12 +200,15 @@ const App = () => {
         setStatus('unauthenticated');
         return;
       }
-      setHostContext({
-        company: payload.company,
-        user: payload.user,
-        sessionToken: payload.session?.token,
+      void resolveViewer(payload).then((viewer) => {
+        setHostContext({
+          company: payload.company,
+          user: payload.user,
+          viewer,
+          sessionToken: payload.session?.token,
+        });
+        setStatus('ready');
       });
-      setStatus('ready');
     });
 
     postReadyMessage();