@micha.bigler/ui-core-micha 2.10.0 → 2.10.1

package/WORK_ORDERS.md

@@ -9,6 +9,7 @@ rules are defined centrally in `webapps/AGENTS.md` → "Work-Order Register".
 | Prefix | Workstream |
 |---|---|
 | `ONB-*` | Onboarding wizard (steps, conditions, persistence) |
+| `PERF-*` | Performance improvements |
 
 Introduce a new prefix when none fits and add it here. New WOs always get a
 prefixed ID; never reuse a bare flat number across workstreams.
@@ -18,3 +19,4 @@ prefixed ID; never reuse a bare flat number across workstreams.
 | ID | Titel | Beschreibung | Datum | Status | Commit(s) | Notiz |
 |---|---|---|---|---|---|---|
 | ONB-1 | Per-app configurable notifications onboarding step | New `browserPush` prop `{nagUntil, showOnce}` on `OnboardingProvider`; parameterizes the `browser_push` descriptor's condition (default changes from implicit "all-channels" to "any-channel", stopping the over-nag); `showOnce` via a persisted `onboarding_seen` set (frozen-at-mount ref, no mid-session flicker) | 2026-07-17 | done | 1ae7c20 | Default behavior change affects cockpit and all consumers on their next ucm bump. jg-ferien companion WO pins the new version with `browserPush={{nagUntil: 'any-channel'}}` explicit (matches new default, but pinned explicitly per the WO). |
+| PERF-3B1 | Parallel auth bootstrap after CSRF | Starts auth-methods and current-user concurrently once CSRF is available, while preserving error handling and loading semantics. | 2026-07-19 | done |  | Independent `reviewer` + `sec_reviewer` passes both clean (no findings); one P3 test-coverage gap from the reviewer (missing mirror case: auth-methods rejects, current-user succeeds) closed with an added regression test — 45/45 tests green. Published as 2.10.1 (patch, no interface change) and pinned in jg-ferien alongside its PERF-3A companion WO. |

package/dist/auth/AuthContext.js

@@ -37,18 +37,24 @@ export const AuthProvider = ({ children }) => {
             try {
                 // 1) Ensure CSRF cookie exists using the specific client
                 await ensureCsrfToken();
-                // 2) Load auth methods (public)
-                try {
-                    const methods = await fetchAuthMethods();
+                // 2) Both calls depend on CSRF, but not on each other. Await both settlements
+                // so loading stays true until the complete auth bootstrap has finished.
+                const [methodsResult, userResult] = await Promise.allSettled([
+                    fetchAuthMethods(),
+                    fetchCurrentUser(),
+                ]);
+                // Keep defaults when the public auth-methods request fails.
+                if (methodsResult.status === 'fulfilled') {
+                    const methods = methodsResult.value;
                     if (isMounted && methods && typeof methods === 'object') {
                         setAuthMethods((prev) => (Object.assign(Object.assign({}, prev), methods)));
                     }
                 }
-                catch (_a) {
-                    // Keep defaults; login UI remains usable.
+                // Preserve the previous unauthenticated/error handling for current-user.
+                if (userResult.status === 'rejected') {
+                    throw userResult.reason;
                 }
-                // 3) Load user
-                const data = await fetchCurrentUser();
+                const data = userResult.value;
                 if (isMounted) {
                     setUser(mapUserFromApi(data));
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@micha.bigler/ui-core-micha",
-  "version": "2.10.0",
+  "version": "2.10.1",
   "main": "dist/index.js",
   "module": "dist/index.js",
   "repository": {

package/src/auth/AuthContext.jsx

@@ -79,19 +79,27 @@ export const AuthProvider = ({ children }) => {
         // 1) Ensure CSRF cookie exists using the specific client
         await ensureCsrfToken();
 
-        // 2) Load auth methods (public)
-        try {
-          const methods = await fetchAuthMethods();
+        // 2) Both calls depend on CSRF, but not on each other. Await both settlements
+        // so loading stays true until the complete auth bootstrap has finished.
+        const [methodsResult, userResult] = await Promise.allSettled([
+          fetchAuthMethods(),
+          fetchCurrentUser(),
+        ]);
+
+        // Keep defaults when the public auth-methods request fails.
+        if (methodsResult.status === 'fulfilled') {
+          const methods = methodsResult.value;
           if (isMounted && methods && typeof methods === 'object') {
             setAuthMethods((prev) => ({ ...prev, ...methods }));
           }
-        } catch {
-          // Keep defaults; login UI remains usable.
         }
 
-        // 3) Load user
-        const data = await fetchCurrentUser();
-        
+        // Preserve the previous unauthenticated/error handling for current-user.
+        if (userResult.status === 'rejected') {
+          throw userResult.reason;
+        }
+
+        const data = userResult.value;
         if (isMounted) {
           setUser(mapUserFromApi(data));
         }

package/tests/AuthContext.test.jsx

@@ -1,7 +1,7 @@
 // @vitest-environment jsdom
 import React, { useContext } from 'react';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
-import { render, screen, waitFor } from '@testing-library/react';
+import { cleanup, render, screen, waitFor } from '@testing-library/react';
 
 const apiClient = vi.hoisted(() => ({
   ensureCsrfToken: vi.fn().mockResolvedValue(undefined),
@@ -19,17 +19,19 @@ vi.mock('../src/auth/ReauthModal', () => ({ ReauthModal: () => null }));
 import { AuthContext, AuthProvider } from '../src/auth/AuthContext';
 
 function Probe() {
-  const { user, refreshUser } = useContext(AuthContext);
+  const { user, loading, refreshUser } = useContext(AuthContext);
   return (
     <div>
       <span data-testid="first-name">{user?.first_name || ''}</span>
+      <span data-testid="loading">{String(loading)}</span>
       <button type="button" onClick={() => refreshUser()}>refresh</button>
     </div>
   );
 }
 
-describe('AuthContext refreshUser', () => {
+describe('AuthContext', () => {
   beforeEach(() => {
+    cleanup();
     vi.clearAllMocks();
   });
 
@@ -47,4 +49,81 @@ describe('AuthContext refreshUser', () => {
     await waitFor(() => expect(screen.getByTestId('first-name').textContent).toBe('Grace'));
     expect(authApi.fetchCurrentUser).toHaveBeenCalledTimes(2);
   });
+
+  it('starts auth methods and current user together after CSRF, then waits for both', async () => {
+    let resolveCsrf;
+    let resolveMethods;
+    let resolveUser;
+    const callOrder = [];
+
+    apiClient.ensureCsrfToken.mockImplementation(() => new Promise((resolve) => {
+      resolveCsrf = resolve;
+    }));
+    authApi.fetchAuthMethods.mockImplementation(() => {
+      callOrder.push('auth-methods');
+      return new Promise((resolve) => {
+        resolveMethods = resolve;
+      });
+    });
+    authApi.fetchCurrentUser.mockImplementation(() => {
+      callOrder.push('current-user');
+      return new Promise((resolve) => {
+        resolveUser = resolve;
+      });
+    });
+
+    render(<AuthProvider><Probe /></AuthProvider>);
+
+    expect(callOrder).toEqual([]);
+    resolveCsrf();
+
+    await waitFor(() => expect(callOrder).toEqual(['auth-methods', 'current-user']));
+    expect(screen.getByTestId('loading').textContent).toBe('true');
+
+    resolveUser({ id: 1, first_name: 'Ada' });
+    await Promise.resolve();
+    expect(screen.getByTestId('loading').textContent).toBe('true');
+
+    resolveMethods({ password_login: false });
+    await waitFor(() => expect(screen.getByTestId('loading').textContent).toBe('false'));
+    expect(screen.getByTestId('first-name').textContent).toBe('Ada');
+  });
+
+  it('still sets the user when auth-methods fails but current-user succeeds', async () => {
+    let resolveUser;
+
+    apiClient.ensureCsrfToken.mockResolvedValue(undefined);
+    authApi.fetchAuthMethods.mockRejectedValue(new Error('auth-methods unavailable'));
+    authApi.fetchCurrentUser.mockImplementation(() => new Promise((resolve) => {
+      resolveUser = resolve;
+    }));
+
+    render(<AuthProvider><Probe /></AuthProvider>);
+
+    await waitFor(() => expect(authApi.fetchAuthMethods).toHaveBeenCalledTimes(1));
+    expect(screen.getByTestId('loading').textContent).toBe('true');
+
+    resolveUser({ id: 1, first_name: 'Ada' });
+    await waitFor(() => expect(screen.getByTestId('loading').textContent).toBe('false'));
+    expect(screen.getByTestId('first-name').textContent).toBe('Ada');
+  });
+
+  it('preserves the unauthenticated state after a current-user failure', async () => {
+    let resolveMethods;
+
+    apiClient.ensureCsrfToken.mockResolvedValue(undefined);
+    authApi.fetchAuthMethods.mockImplementation(() => new Promise((resolve) => {
+      resolveMethods = resolve;
+    }));
+    authApi.fetchCurrentUser.mockRejectedValue(new Error('Unauthenticated'));
+
+    render(<AuthProvider><Probe /></AuthProvider>);
+
+    await waitFor(() => expect(authApi.fetchCurrentUser).toHaveBeenCalledTimes(1));
+    expect(screen.getByTestId('loading').textContent).toBe('true');
+
+    resolveMethods({ password_login: false });
+    await waitFor(() => expect(screen.getByTestId('loading').textContent).toBe('false'));
+    expect(screen.getByTestId('first-name').textContent).toBe('');
+  });
 });