@swiss-ai-hub/web 0.319.0 → 0.320.0

package/middleware/auth.global.ts

@@ -6,20 +6,42 @@ let lastSyncedTenant: string | null = null
 
 const REDIRECT_KEY = 'aihub_redirect_after_login'
 
+const normalize = (path: string) => (path.endsWith('/') ? path.slice(0, -1) : path)
+
+const stripLocale = (path: string, localeCodes: string[]): string => {
+  const prefix = localeCodes.find(code => path === `/${code}` || path.startsWith(`/${code}/`))
+  return prefix ? path.slice(prefix.length + 1) : path
+}
+
+/**
+ * The whole login subtree is anonymous, not just the login page itself:
+ * per-tenant login links live at `/auth/login/<idp-alias>`. No
+ * authenticated-only page may ever be nested below that path.
+ *
+ * The locale prefix is optional. This middleware runs before @nuxtjs/i18n's
+ * `locale-changing` middleware (Nuxt orders file-based global middleware ahead
+ * of plugin-registered ones), so bouncing a hand-distributed link that dropped
+ * `/en/` would strip the tenant before i18n ever restores the prefix.
+ */
+const isAnonymousPath = (path: string, localeCodes: string[]): boolean => {
+  const unprefixedPath = stripLocale(normalize(path), localeCodes)
+
+  return ['/auth/login', '/auth/callback', '/auth/renew'].includes(unprefixedPath)
+    || unprefixedPath.startsWith('/auth/login/')
+}
+
+const rememberRedirect = (fullPath: string, isAuthPath: boolean) => {
+  if (import.meta.client && fullPath !== '/' && !isAuthPath) {
+    sessionStorage.setItem(REDIRECT_KEY, fullPath)
+  }
+}
+
 export default defineNuxtRouteMiddleware(async (to) => {
   const { $auth, $i18n } = useNuxtApp()
   const locale = $i18n.locale.value
+  const localeCodes = $i18n.locales.value.map(entry => entry.code)
 
-  const noAuthPaths = [
-    `/${locale}/auth/login`,
-    `/${locale}/auth/callback`,
-    `/${locale}/auth/renew`,
-  ]
-
-  // No auth check for public paths (normalize trailing slashes on both sides)
-  const normalize = (p: string) => (p.endsWith('/') ? p.slice(0, -1) : p)
-  const normalizedPath = normalize(to.path)
-  if (noAuthPaths.some(p => normalize(p) === normalizedPath)) {
+  if (isAnonymousPath(to.path, localeCodes)) {
     return
   }
 
@@ -29,9 +51,7 @@ export default defineNuxtRouteMiddleware(async (to) => {
     const isAuthPath = to.path.includes('/auth/')
 
     if (!user) {
-      if (import.meta.client && to.fullPath !== '/' && !isAuthPath) {
-        sessionStorage.setItem(REDIRECT_KEY, to.fullPath)
-      }
+      rememberRedirect(to.fullPath, isAuthPath)
       return navigateTo(`/${locale}/auth/login`)
     }
 
@@ -41,9 +61,7 @@ export default defineNuxtRouteMiddleware(async (to) => {
       }
       catch {
         await $auth.removeUser()
-        if (import.meta.client && to.fullPath !== '/' && !isAuthPath) {
-          sessionStorage.setItem(REDIRECT_KEY, to.fullPath)
-        }
+        rememberRedirect(to.fullPath, isAuthPath)
         return navigateTo(`/${locale}/auth/login`)
       }
     }

package/package.json

@@ -3,7 +3,7 @@
   "license": "AGPL-3.0-or-later",
   "author": "bbv Software Services AG (https://www.bbv.ch)",
   "type": "module",
-  "version": "0.319.0",
+  "version": "0.320.0",
   "description": "Swiss AI Hub - Admin & Management UI (Nuxt 3 layer)",
   "main": "./nuxt.config.ts",
   "repository": {

package/pages/auth/login/[idp].vue

@@ -0,0 +1,57 @@
+<template>
+  <AuthLoginPanel>
+    <template #heading>
+      <template v-if="provider">
+        {{ t('auth.login.welcomeProvider', { provider: provider.display_name }) }}
+      </template>
+    </template>
+    <template #message>
+      <template v-if="provider">
+        {{ t('auth.login.pleaseLoginWith', { provider: provider.display_name }) }}
+      </template>
+    </template>
+
+    <Button
+      v-if="provider"
+      :label="t('auth.login.loginWith', { provider: provider.display_name })"
+      :icon="`pi ${provider.icon}`"
+      icon-pos="right"
+      class="!bg-white !text-black"
+      @click="login(provider.alias)"
+    />
+    <ProgressSpinner
+      v-else
+      class="!h-8 !w-8"
+    />
+  </AuthLoginPanel>
+</template>
+
+<script setup lang="ts">
+definePageMeta({
+  layout: 'anonymous',
+})
+
+const { t, locale } = useI18n()
+const route = useRoute()
+const { login } = useAuth()
+const { authProviders, isLoading } = useAuthProviders()
+
+/**
+ * The empty alias belongs to the synthetic "Keycloak" entry, which has no
+ * kc_idp_hint and must therefore not be addressable through a tenant link.
+ */
+const requestedAlias = computed(() => String(route.params.idp ?? ''))
+const provider = computed(() =>
+  requestedAlias.value
+    ? authProviders.value?.find(candidate => candidate.alias === requestedAlias.value)
+    : undefined,
+)
+
+// Only decide once the query settled — an unknown, disabled or hidden alias
+// (and a failed provider request) falls back to the all-providers page.
+watch([isLoading, provider], ([providersLoading, matchedProvider]) => {
+  if (!providersLoading && !matchedProvider) {
+    navigateTo(`/${locale.value}/auth/login`, { replace: true })
+  }
+}, { immediate: true })
+</script>

package/pages/auth/login/index.vue

@@ -0,0 +1,46 @@
+<template>
+  <AuthLoginPanel>
+    <template #heading>
+      {{ t('auth.login.welcome', { companyName }) }}
+    </template>
+    <template #message>
+      {{ t('auth.login.pleaseLogin') }}
+    </template>
+
+    <ProgressSpinner
+      v-if="isLoading"
+      class="!h-8 !w-8"
+    />
+    <template v-else>
+      <Button
+        v-for="idp in authProviders ?? []"
+        :key="idp.alias"
+        :label="t('auth.login.loginWith', { provider: idp.display_name })"
+        :icon="`pi ${idp.icon}`"
+        icon-pos="right"
+        class="!bg-white !text-black"
+        @click="login(idp.alias || undefined)"
+      />
+      <Button
+        v-if="(authProviders?.length ?? 0) === 0"
+        :label="t('auth.login.title')"
+        icon="pi pi-sign-in"
+        icon-pos="right"
+        class="!bg-white !text-black"
+        @click="login()"
+      />
+    </template>
+  </AuthLoginPanel>
+</template>
+
+<script setup lang="ts">
+definePageMeta({
+  layout: 'anonymous',
+})
+
+const { t } = useI18n()
+const { login } = useAuth()
+const { authProviders, isLoading } = useAuthProviders()
+
+const companyName = 'bbv Software Services AG'
+</script>

package/sdk/client/client/client.gen.ts

@@ -197,9 +197,7 @@ export const createClient = (config: Config = {}): Client => {
         method,
         onRequest: undefined,
         serializedBody: getValidRequestBody(opts) as
-          | BodyInit
-          | null
-          | undefined,
+          BodyInit | null | undefined,
         signal: unwrapRefs(opts.signal) as AbortSignal,
         url,
       });

package/sdk/client/client/types.gen.ts

@@ -33,14 +33,12 @@ export type QuerySerializer = (
 
 type WithRefs<TData> = {
   [K in keyof TData]: NonNullable<TData[K]> extends object
-    ?
-        | WithRefs<NonNullable<TData[K]>>
-        | Ref<NonNullable<TData[K]>>
-        | Extract<TData[K], null>
-    :
-        | NonNullable<TData[K]>
-        | Ref<NonNullable<TData[K]>>
-        | Extract<TData[K], null>;
+    ? | WithRefs<NonNullable<TData[K]>>
+      | Ref<NonNullable<TData[K]>>
+      | Extract<TData[K], null>
+    : | NonNullable<TData[K]>
+      | Ref<NonNullable<TData[K]>>
+      | Extract<TData[K], null>;
 };
 
 // copied from Nuxt
@@ -206,8 +204,4 @@ type FetchOptions<TData> = Omit<
 >;
 
 export type Composable =
-  | "$fetch"
-  | "useAsyncData"
-  | "useFetch"
-  | "useLazyAsyncData"
-  | "useLazyFetch";
+  "$fetch" | "useAsyncData" | "useFetch" | "useLazyAsyncData" | "useLazyFetch";

package/sdk/client/client/utils.gen.ts

@@ -195,8 +195,7 @@ export const setAuthParams = async ({
           options.query = {};
         }
         const queryValue = toValue(options.query) as
-          | Record<string, unknown>
-          | undefined;
+          Record<string, unknown> | undefined;
         if (queryValue) {
           queryValue[name] = token;
         }

package/sdk/client/core/queryKeySerializer.gen.ts

@@ -4,12 +4,7 @@
  * JSON-friendly union that mirrors what Pinia Colada can hash.
  */
 export type JsonValue =
-  | null
-  | string
-  | number
-  | boolean
-  | JsonValue[]
-  | { [key: string]: JsonValue };
+  null | string | number | boolean | JsonValue[] | { [key: string]: JsonValue };
 
 /**
  * Replacer that converts non-JSON values (bigint, Date, etc.) to safe substitutes.

package/sdk/client/core/types.gen.ts

@@ -112,7 +112,9 @@ type IsExactlyNeverOrNeverUndefined<T> = [T] extends [never]
     : false;
 
 export type OmitNever<T extends Record<string, unknown>> = {
-  [K in keyof T as IsExactlyNeverOrNeverUndefined<T[K]> extends true
-    ? never
-    : K]: T[K];
+  [
+    K in keyof T as IsExactlyNeverOrNeverUndefined<T[K]> extends true
+      ? never
+      : K
+  ]: T[K];
 };

package/sdk/client/index.ts

@@ -50,6 +50,8 @@ export {
   getLitellmModel,
   getLitellmModels,
   getLitellmModelsByMode,
+  getLlmSpendByTenant,
+  getLlmSpendByUser,
   getLocale,
   getModels,
   getModelWithAssistants,
@@ -315,6 +317,8 @@ export {
   type CreateTranscriptionResponses,
   type CronInput,
   type CronInputWritable,
+  type CronStartEvent,
+  type CronStartEventWritable,
   type CustomOutput,
   type DashboardDto,
   type DashboardItemDto,
@@ -526,6 +530,16 @@ export {
   type GetLitellmModelsData,
   type GetLitellmModelsResponse,
   type GetLitellmModelsResponses,
+  type GetLlmSpendByTenantData,
+  type GetLlmSpendByTenantError,
+  type GetLlmSpendByTenantErrors,
+  type GetLlmSpendByTenantResponse,
+  type GetLlmSpendByTenantResponses,
+  type GetLlmSpendByUserData,
+  type GetLlmSpendByUserError,
+  type GetLlmSpendByUserErrors,
+  type GetLlmSpendByUserResponse,
+  type GetLlmSpendByUserResponses,
   type GetLocaleData,
   type GetLocaleResponse,
   type GetLocaleResponses,
@@ -733,6 +747,7 @@ export {
   type LlmCostEventWritable,
   type LlmEvent,
   type LlmEventWritable,
+  type LlmSpend,
   type LlmStopEvent,
   type LlmStopEventWritable,
   type LocaleInput,
@@ -741,8 +756,11 @@ export {
   type LocaleString,
   type Logprob,
   type MailAttachmentRef,
+  type MailBatchClassifiedEvent,
+  type MailBatchClassifiedEventWritable,
   type MailBatchDraftedEvent,
   type MailBatchDraftedEventWritable,
+  type MailClassificationRef,
   type MailFetchedEvent,
   type MailFetchedEventWritable,
   type MailMessageRef,
@@ -886,8 +904,6 @@ export {
   type RouterEventWritable,
   type RunStatistics,
   type RunStatisticsWritable,
-  type ScheduledStartEvent,
-  type ScheduledStartEventWritable,
   type SearchContextCostPerQueryDto,
   type SearchOrganizationMemoriesData,
   type SearchOrganizationMemoriesError,