@luxfi/ui 7.4.3 → 7.4.4

package/dist/iam.cjs

@@ -134,7 +134,7 @@ var IamError = class extends Error {
 };
 var SIGNED_OUT = /please sign in|authentication required|unauthorized/i;
 function isSignedOut(status, msg) {
-  return status === 401 || status === 403 || SIGNED_OUT.test(msg);
+  return status === 401 || SIGNED_OUT.test(msg);
 }
 function iamBase(host) {
   const wl = typeof host === "object" && host !== null ? host : resolveWhiteLabel(host);

package/dist/iam.js

@@ -132,7 +132,7 @@ var IamError = class extends Error {
 };
 var SIGNED_OUT = /please sign in|authentication required|unauthorized/i;
 function isSignedOut(status, msg) {
-  return status === 401 || status === 403 || SIGNED_OUT.test(msg);
+  return status === 401 || SIGNED_OUT.test(msg);
 }
 function iamBase(host) {
   const wl = typeof host === "object" && host !== null ? host : resolveWhiteLabel(host);

package/dist/identity.cjs

@@ -160,7 +160,7 @@ var IamError = class extends Error {
 };
 var SIGNED_OUT = /please sign in|authentication required|unauthorized/i;
 function isSignedOut(status, msg) {
-  return status === 401 || status === 403 || SIGNED_OUT.test(msg);
+  return status === 401 || SIGNED_OUT.test(msg);
 }
 function iamBase(host) {
   const wl = typeof host === "object" && host !== null ? host : resolveWhiteLabel(host);

package/dist/identity.js

@@ -139,7 +139,7 @@ var IamError = class extends Error {
 };
 var SIGNED_OUT = /please sign in|authentication required|unauthorized/i;
 function isSignedOut(status, msg) {
-  return status === 401 || status === 403 || SIGNED_OUT.test(msg);
+  return status === 401 || SIGNED_OUT.test(msg);
 }
 function iamBase(host) {
   const wl = typeof host === "object" && host !== null ? host : resolveWhiteLabel(host);

package/dist/index.cjs

@@ -288,7 +288,7 @@ var IamError = class extends Error {
 };
 var SIGNED_OUT = /please sign in|authentication required|unauthorized/i;
 function isSignedOut(status, msg) {
-  return status === 401 || status === 403 || SIGNED_OUT.test(msg);
+  return status === 401 || SIGNED_OUT.test(msg);
 }
 function iamBase(host) {
   const wl = typeof host === "object" && host !== null ? host : resolveWhiteLabel(host);

package/dist/index.js

@@ -260,7 +260,7 @@ var IamError = class extends Error {
 };
 var SIGNED_OUT = /please sign in|authentication required|unauthorized/i;
 function isSignedOut(status, msg) {
-  return status === 401 || status === 403 || SIGNED_OUT.test(msg);
+  return status === 401 || SIGNED_OUT.test(msg);
 }
 function iamBase(host) {
   const wl = typeof host === "object" && host !== null ? host : resolveWhiteLabel(host);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@luxfi/ui",
-  "version": "7.4.3",
+  "version": "7.4.4",
   "description": "Cross-platform DeFi UI components built on @hanzo/gui (Tamagui). Native mobile + web.",
   "type": "module",
   "license": "MIT",

package/src/iam.ts

@@ -70,11 +70,25 @@ export class IamError extends Error {
   }
 }
 
-/** IAM answers 401, or 200 with a sign-in message. Both mean "no session". */
+/**
+ * "No session" — as opposed to "a session that may not do this".
+ *
+ * IAM says it two ways: 401, and (measured against lux.id) HTTP **200** with
+ * `{"status":"error","msg":"please sign in first"}`, which is what both a
+ * missing and a malformed bearer get. So the message has to be read, not just
+ * the status.
+ *
+ * 403 is deliberately NOT here. `get-organizations` answers 403 to an ordinary
+ * signed-in user — listing the tenant table is a super-admin read — and folding
+ * that into "signed out" logged the user out of the chrome: get-account had
+ * already succeeded, then the org read's 403 wiped the account and every
+ * switcher offered "Sign in" to somebody who was signed in. Forbidden means
+ * signed in and not allowed; the caller falls back to the org it can see.
+ */
 const SIGNED_OUT = /please sign in|authentication required|unauthorized/i;
 
 function isSignedOut(status: number, msg: string): boolean {
-  return status === 401 || status === 403 || SIGNED_OUT.test(msg);
+  return status === 401 || SIGNED_OUT.test(msg);
 }
 
 /** The IAM API root for a host — `lux.cloud` → `https://lux.id/v1/iam`. */

package/src/identity.tsx

@@ -181,8 +181,12 @@ export const IdentityProvider = ({
           return;
         }
         setAccount(me);
-        // A member who cannot list the tenant table still has their OWN org:
-        // fall back to the one the account names rather than showing nothing.
+        // A member who cannot list the tenant table still has their OWN org.
+        // `get-organizations` is a super-admin read and answers 403 to everyone
+        // else (measured on lux.id with a real z@lux.network bearer), so this is
+        // the COMMON path, not an edge case: fall back to the org the account
+        // itself names rather than showing an empty switcher — or, worse,
+        // treating the refusal as "not signed in".
         const rows = await iam.organizations(call).catch((e: unknown) => {
           if (e instanceof IamError && !e.unauthenticated) return [ { owner: 'admin', name: me.owner } ];
           throw e;