@stacksjs/defaults 0.70.355 → 0.70.357

package/views/dashboard/stores/auth.ts

@@ -21,32 +21,31 @@ import { dashboardApi } from '../../../functions/dashboard-api'
  *      RBAC role names from the `user_roles` pivot. The role-derived
  *      flags (`isAdmin`, `isDev`, `isClient`) reflect that membership.
  *   3. **Fetch failed** — network down, route 404, server error.
- *      `error` is set, but the role flags still default to "permissive
- *      dev" so a broken endpoint doesn't lock the dashboard.
+ *      `error` is set and role flags fail closed until a later successful
+ *      refresh resolves the viewer's identity.
  */
 export const authStore = defineStore('auth', () => {
   const userId = state<number | null>(null)
   const userName = state<string | null>(null)
   const userEmail = state<string | null>(null)
   const roles = state<string[]>([])
-  const unauthenticated = state(true)
+  const unauthenticated = state(false)
   const loading = state(false)
   const error = state<string | null>(null)
   const loaded = state(false)
 
-  // Permissive-dev defaults: when nobody is signed in (or the endpoint
-  // failed), assume the viewer is a dev. The alternative — hiding every
-  // gated surface until auth is wired — would make the dashboard look
-  // broken on a fresh project.
   const isAdmin = derived(() => {
+    if (!loaded()) return false
     if (unauthenticated()) return true
     return roles().includes('admin')
   })
   const isDev = derived(() => {
+    if (!loaded()) return false
     if (unauthenticated()) return true
     return roles().includes('admin') || roles().includes('dev')
   })
   const isClient = derived(() => {
+    if (!loaded()) return false
     if (unauthenticated()) return false
     return roles().includes('client')
   })
@@ -77,8 +76,12 @@ export const authStore = defineStore('auth', () => {
     }
     catch (e) {
       error.set(e instanceof Error ? e.message : String(e))
-      // Keep the permissive defaults: don't mark `loaded` so a later
-      // explicit `refresh()` can retry.
+      userId.set(null)
+      userName.set(null)
+      userEmail.set(null)
+      roles.set([])
+      unauthenticated.set(false)
+      // Do not mark `loaded`, so a later explicit `refresh()` can retry.
     }
     finally {
       loading.set(false)
@@ -109,12 +112,10 @@ export const authStore = defineStore('auth', () => {
   persist: {
     storage: 'sessionStorage',
     key: 'stacks-dashboard-auth',
-    // Don't persist `loaded` — every fresh tab should re-fetch identity
+    // Don't persist authorization state. Every fresh tab re-fetches identity
     // (the user may have been assigned a new role, or signed out, since
-    // the last visit). Roles + user info ride along as a soft cache so
-    // the dashboard renders against last-known state before the
-    // round-trip resolves.
-    pick: ['userId', 'userName', 'userEmail', 'roles', 'unauthenticated'],
+    // the last visit). User info remains a display-only soft cache.
+    pick: ['userId', 'userName', 'userEmail'],
   },
 })