@reflagged/shell 1.1.0 → 1.3.0

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "@reflagged/shell",
-  "version": "1.1.0",
+  "version": "1.3.0",
   "description": "Shared app shell for Reflagged services — OIDC auth, SSO, app switcher",
   "type": "module",
   "sideEffects": false,
   "files": [
     "src",
+    "!src/**/*.test.ts",
     "tsconfig.json",
     "README.md"
   ],
@@ -25,16 +26,19 @@
     "./api/oidc-callback": "./src/lib/api/oidc-callback.ts",
     "./api/oidc-signout": "./src/lib/api/oidc-signout.ts",
     "./api/shell-info": "./src/lib/api/shell-info.ts",
-    "./package.json": "./package.json"
+    "./package.json": "./package.json",
+    "./components/ServiceIcon": "./src/components/ServiceIcon.tsx"
   },
   "scripts": {
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
   },
   "dependencies": {
     "jose": "^5.10.0",
     "oauth4webapi": "^3.6.0"
   },
   "peerDependencies": {
+    "lucide-react": ">=0.400.0",
     "next": "^15.4.0",
     "payload": "^3.79.0",
     "react": "^19.2.0",
@@ -43,10 +47,17 @@
   "devDependencies": {
     "@types/react": "^19.2.0",
     "@types/react-dom": "^19.2.0",
+    "lucide-react": "^0.500.0",
     "next": "^15.4.0",
     "payload": "^3.79.0",
     "react": "^19.2.0",
     "react-dom": "^19.2.0",
-    "typescript": "^5.7.0"
+    "typescript": "^5.7.0",
+    "vitest": "^3.2.0"
+  },
+  "peerDependenciesMeta": {
+    "lucide-react": {
+      "optional": false
+    }
   }
 }

package/src/components/BrandSwitcher.tsx

@@ -3,6 +3,7 @@
 import { useEffect, useRef, useState } from 'react'
 import { createPortal } from 'react-dom'
 import { loadAppConfig } from '../config'
+import { ServiceIcon } from './ServiceIcon'
 
 type Booking = {
   id: string
@@ -11,6 +12,12 @@ type Booking = {
   status: string
   url: string | null
   iconUrl: string | null
+  /**
+   * Lucide name of the service icon, from rflgd-base. Optional: an older
+   * platform does not send it, and then the initial stands in — the way it
+   * always did.
+   */
+  icon?: string | null
 }
 
 type Org = {
@@ -391,7 +398,7 @@ export function BrandSwitcher() {
                       fontWeight: 600,
                     }}
                   >
-                    {b.label.slice(0, 1).toUpperCase()}
+                    <ServiceIcon name={b.icon} label={b.label} />
                   </div>
                   <div style={{ flex: 1, minWidth: 0 }}>
                     <div style={{ fontWeight: 500, fontSize: 13.5 }}>{b.label}</div>

package/src/components/ServiceIcon.tsx

@@ -0,0 +1,66 @@
+'use client'
+
+import {
+  AudioLines,
+  Bot,
+  Box,
+  Brain,
+  Contact,
+  Factory,
+  ListMusic,
+  MailPlus,
+  MessageSquareText,
+  PenTool,
+  ShieldCheck,
+  Users,
+  type LucideIcon,
+} from 'lucide-react'
+
+/**
+ * The icon a service shows in the app switcher.
+ *
+ * Which icon a service gets is rflgd-base's decision — it sends the lucide
+ * name in `/api/shell/me` (`serviceIconName()`), so switcher, launchpad and
+ * catalog show the same mark. This file only holds the components to render
+ * those names with.
+ *
+ * Listed one by one rather than looked up in lucide's `icons` object, and that
+ * is the whole reason this file exists: an index lookup defeats tree shaking,
+ * and all ~1500 icons would land in the bundle of every app using this
+ * package. Ten repositories depend on it.
+ *
+ * The cost is a list that can fall behind the platform's. It degrades to
+ * exactly today's behaviour — a service whose name is not here shows its
+ * initial, as every service did before. Nothing breaks, it just looks
+ * unfinished, and adding the icon here is a one-line fix.
+ */
+const ICONS: Record<string, LucideIcon> = {
+  AudioLines,
+  Bot,
+  Box,
+  Brain,
+  Contact,
+  Factory,
+  ListMusic,
+  MailPlus,
+  MessageSquareText,
+  PenTool,
+  ShieldCheck,
+  Users,
+}
+
+export function ServiceIcon({
+  name,
+  label,
+  size = 18,
+}: {
+  /** Lucide name from the platform, e.g. 'Brain'. */
+  name?: string | null
+  /** Fallback when the name is missing or not bundled here. */
+  label: string
+  size?: number
+}) {
+  const Icon = name ? ICONS[name] : undefined
+  if (!Icon) return <>{label.slice(0, 1).toUpperCase()}</>
+  return <Icon size={size} strokeWidth={1.75} aria-hidden />
+}

package/src/lib/auth/nextauth-strategy.ts

@@ -5,46 +5,112 @@ import { loadAppConfig } from '../../config'
 import { OIDC_COOKIE } from './oidc-config'
 import { verifySessionCookie } from './oidc-cookie'
 
-export const nextauthStrategy: AuthStrategy = {
-  name: 'rflgd-oidc',
-  authenticate: async ({ payload, headers }) => {
-    const secret = process.env.AUTH_SECRET
-    if (!secret) return { user: null }
-
-    const cookieHeader = headers.get('cookie') ?? ''
-    const cookieStart = `${OIDC_COOKIE}=`
-    const segment = cookieHeader
-      .split(';')
-      .map((c) => c.trim())
-      .find((c) => c.startsWith(cookieStart))
-    if (!segment) return { user: null }
-
-    const token = segment.slice(cookieStart.length)
-    const session = await verifySessionCookie(secret, token)
-    if (!session?.email) return { user: null }
-
-    const existing = await payload.find({
-      collection: 'users',
-      where: { email: { equals: session.email } },
-      limit: 1,
-      overrideAccess: true,
-    })
-
-    let user = existing.docs[0]
-    if (!user) {
-      const config = loadAppConfig()
-      const isFirst = (await payload.count({ collection: 'users', overrideAccess: true })).totalDocs === 0
-      user = await payload.create({
+/** What the platform knows about a person signing in for the first time. */
+export type NewUserContext = {
+  /** Role in the current workspace ('admin' | 'member'), null without claims. */
+  orgRole: string | null
+  /** Role on the platform itself, null without claims. */
+  platformRole: string | null
+  email: string
+  /** True when this account is the first in the instance. */
+  isFirstUser: boolean
+}
+
+/** Maps the platform's view of a person onto one of this app's own roles. */
+export type RoleForNewUser = (ctx: NewUserContext) => string
+
+/**
+ * The role a newly created account receives.
+ *
+ * Without a callback this is exactly what it always was: the first account
+ * administers, everyone after it gets RFLGD_DEFAULT_USER_ROLE. With a
+ * callback the decision belongs entirely to the app, `isFirstUser` included —
+ * which is why it is in the context. An app that forgets that branch can end
+ * up with an instance that has no administrator.
+ *
+ * The return value is not checked. Which roles exist is the app's knowledge;
+ * an unknown value is rejected by Payload against the field configuration and
+ * the account is not created. That is the same path on which this package's
+ * own default 'user' once locked instances out.
+ */
+export function resolveNewUserRole(
+  ctx: NewUserContext,
+  roleForNewUser?: RoleForNewUser,
+): string {
+  if (roleForNewUser) return roleForNewUser(ctx)
+  return ctx.isFirstUser ? 'admin' : loadAppConfig().defaultRole
+}
+
+/**
+ * Payload auth strategy for the platform's single sign-on.
+ *
+ * Creates an account on first sign-in when none exists for the address. The
+ * role it gets is `resolveNewUserRole`'s decision — see there.
+ */
+export function createOidcStrategy(options?: {
+  roleForNewUser?: RoleForNewUser
+}): AuthStrategy {
+  return {
+    name: 'rflgd-oidc',
+    authenticate: async ({ payload, headers }) => {
+      const secret = process.env.AUTH_SECRET
+      if (!secret) return { user: null }
+
+      const cookieHeader = headers.get('cookie') ?? ''
+      const cookieStart = `${OIDC_COOKIE}=`
+      const segment = cookieHeader
+        .split(';')
+        .map((c) => c.trim())
+        .find((c) => c.startsWith(cookieStart))
+      if (!segment) return { user: null }
+
+      const token = segment.slice(cookieStart.length)
+      const session = await verifySessionCookie(secret, token)
+      if (!session?.email) return { user: null }
+
+      const existing = await payload.find({
         collection: 'users',
-        data: {
-          email: session.email,
-          password: randomBytes(32).toString('hex'),
-          role: isFirst ? 'admin' : config.defaultRole,
-        },
+        where: { email: { equals: session.email } },
+        limit: 1,
         overrideAccess: true,
       })
-    }
 
-    return { user: { ...user, collection: 'users' } }
-  },
+      let user = existing.docs[0]
+      if (!user) {
+        const isFirstUser =
+          (await payload.count({ collection: 'users', overrideAccess: true })).totalDocs === 0
+        const role = resolveNewUserRole(
+          {
+            orgRole: session.orgRole ?? null,
+            platformRole: session.platformRole ?? null,
+            email: session.email,
+            isFirstUser,
+          },
+          options?.roleForNewUser,
+        )
+        user = await payload.create({
+          collection: 'users',
+          data: {
+            email: session.email,
+            password: randomBytes(32).toString('hex'),
+            // `role` comes from the environment or the app and is therefore a
+            // `string`. The host application narrows `users.role` to the
+            // options of its own collection — this package cannot know that
+            // type. The value is checked by Payload against the field
+            // configuration on write; an unknown one is rejected there.
+            role: role as never,
+          },
+          overrideAccess: true,
+        })
+      }
+
+      return { user: { ...user, collection: 'users' } }
+    },
+  }
 }
+
+/**
+ * The strategy without options — the export every consumer used before this
+ * package learned about role translation. Kept so nothing has to change.
+ */
+export const nextauthStrategy: AuthStrategy = createOidcStrategy()