@swiss-ai-hub/web 0.319.0 → 0.321.0

package/middleware/auth.global.ts

@@ -6,20 +6,42 @@ let lastSyncedTenant: string | null = null
 
 const REDIRECT_KEY = 'aihub_redirect_after_login'
 
+const normalize = (path: string) => (path.endsWith('/') ? path.slice(0, -1) : path)
+
+const stripLocale = (path: string, localeCodes: string[]): string => {
+  const prefix = localeCodes.find(code => path === `/${code}` || path.startsWith(`/${code}/`))
+  return prefix ? path.slice(prefix.length + 1) : path
+}
+
+/**
+ * The whole login subtree is anonymous, not just the login page itself:
+ * per-tenant login links live at `/auth/login/<idp-alias>`. No
+ * authenticated-only page may ever be nested below that path.
+ *
+ * The locale prefix is optional. This middleware runs before @nuxtjs/i18n's
+ * `locale-changing` middleware (Nuxt orders file-based global middleware ahead
+ * of plugin-registered ones), so bouncing a hand-distributed link that dropped
+ * `/en/` would strip the tenant before i18n ever restores the prefix.
+ */
+const isAnonymousPath = (path: string, localeCodes: string[]): boolean => {
+  const unprefixedPath = stripLocale(normalize(path), localeCodes)
+
+  return ['/auth/login', '/auth/callback', '/auth/renew'].includes(unprefixedPath)
+    || unprefixedPath.startsWith('/auth/login/')
+}
+
+const rememberRedirect = (fullPath: string, isAuthPath: boolean) => {
+  if (import.meta.client && fullPath !== '/' && !isAuthPath) {
+    sessionStorage.setItem(REDIRECT_KEY, fullPath)
+  }
+}
+
 export default defineNuxtRouteMiddleware(async (to) => {
   const { $auth, $i18n } = useNuxtApp()
   const locale = $i18n.locale.value
+  const localeCodes = $i18n.locales.value.map(entry => entry.code)
 
-  const noAuthPaths = [
-    `/${locale}/auth/login`,
-    `/${locale}/auth/callback`,
-    `/${locale}/auth/renew`,
-  ]
-
-  // No auth check for public paths (normalize trailing slashes on both sides)
-  const normalize = (p: string) => (p.endsWith('/') ? p.slice(0, -1) : p)
-  const normalizedPath = normalize(to.path)
-  if (noAuthPaths.some(p => normalize(p) === normalizedPath)) {
+  if (isAnonymousPath(to.path, localeCodes)) {
     return
   }
 
@@ -29,9 +51,7 @@ export default defineNuxtRouteMiddleware(async (to) => {
     const isAuthPath = to.path.includes('/auth/')
 
     if (!user) {
-      if (import.meta.client && to.fullPath !== '/' && !isAuthPath) {
-        sessionStorage.setItem(REDIRECT_KEY, to.fullPath)
-      }
+      rememberRedirect(to.fullPath, isAuthPath)
       return navigateTo(`/${locale}/auth/login`)
     }
 
@@ -41,9 +61,7 @@ export default defineNuxtRouteMiddleware(async (to) => {
       }
       catch {
         await $auth.removeUser()
-        if (import.meta.client && to.fullPath !== '/' && !isAuthPath) {
-          sessionStorage.setItem(REDIRECT_KEY, to.fullPath)
-        }
+        rememberRedirect(to.fullPath, isAuthPath)
         return navigateTo(`/${locale}/auth/login`)
       }
     }

package/package.json

@@ -3,7 +3,7 @@
   "license": "AGPL-3.0-or-later",
   "author": "bbv Software Services AG (https://www.bbv.ch)",
   "type": "module",
-  "version": "0.319.0",
+  "version": "0.321.0",
   "description": "Swiss AI Hub - Admin & Management UI (Nuxt 3 layer)",
   "main": "./nuxt.config.ts",
   "repository": {

package/pages/[tenant]/service/agents.vue

@@ -138,6 +138,9 @@ import { AgentConfigImportError } from '@core/composables/agent/useImportAgentIn
 
 import type { FullAgentInstanceDto, WorkflowGraph } from '@core/sdk/client'
 
+// Nuxt collects middleware from every matched record, so this guards the whole /service/agents subtree.
+definePageMeta({ middleware: 'agent-admin' })
+
 type AgentGroup = {
   agentClass: string
   name: string

package/pages/[tenant]/service/knowledge/[db]/[namespace]/[document_id].vue

@@ -82,20 +82,27 @@ const confirmDelete = () => {
 }
 
 const handleDelete = async () => {
+  const database = route.params.db as string
+  const namespace = route.params.namespace as string
+  const documentId = route.params.document_id as string
+
   try {
+    // Leave before deleting: the delete invalidates a key that is a prefix of this document's own query, so a
+    // still-mounted page refetches the document it just removed.
+    await router.push(tenantPath(`/service/knowledge/${database}/${namespace}`))
+
     await deleteDocument({
       tenantId: tenantId.value!,
-      database: route.params.db as string,
-      namespace: route.params.namespace as string,
-      documentId: route.params.document_id as string,
+      database,
+      namespace,
+      documentId,
     })
-    schedule([route.params.document_id as string])
+    schedule([documentId])
     toast.add({
       severity: 'success',
       summary: t('document.delete.success'),
       life: 3000,
     })
-    router.push(tenantPath(`/service/knowledge/${route.params.db}/${route.params.namespace}`))
   }
   catch (error) {
     toast.add({

package/pages/[tenant]/service/knowledge.vue

@@ -5,6 +5,7 @@
       :loading="databasesAreLoading"
     >
       <div class="flex flex-col gap-12">
+        <KnowledgeDatabaseEmptyCard @add="openNewDatabaseModal" />
         <div
           v-for="database in databases"
           :key="database.name"
@@ -21,6 +22,19 @@
               class="pi pi-lock-open text-surface-400 dark:text-surface-500"
               :title="t('knowledge.manual_management.description')"
             />
+            <span class="text-xs text-surface-500 dark:text-surface-400">
+              {{ t('knowledge.pipeline', { name: capitalCase(database.ingestor) }) }}
+            </span>
+            <Button
+              v-if="database.deletable"
+              v-tooltip.top="t('knowledge.delete_database')"
+              icon="pi pi-trash"
+              rounded
+              text
+              size="small"
+              severity="danger"
+              @click="openDeleteDatabaseModal(database)"
+            />
           </div>
           <div class="grid grid-cols-2 gap-4 2xl:grid-cols-2">
             <KnowledgeNamespaceCard
@@ -31,6 +45,7 @@
               @click="toNamespace(database.name, namespace)"
               @upload="openUploadModal(database, namespace)"
               @edit="openEditNamespaceModal(namespace)"
+              @delete="openDeleteNamespaceModal(database, namespace)"
             />
             <KnowledgeNamespaceEmptyCard
               v-if="!database.auto_sync"
@@ -63,6 +78,20 @@
       :namespace="editingNamespace"
       @success="handleUpdateSuccess"
     />
+
+    <KnowledgeDatabaseCreateModal
+      v-model="newDatabaseModalVisible"
+      @success="handleDatabaseCreationSuccess"
+    />
+
+    <KnowledgeDeleteConfirmModal
+      v-model:visible="deleteModalVisible"
+      :title="deleteTitle"
+      :warning="deleteWarning"
+      :expected-name="deleteExpectedName"
+      :is-deleting="isDeleting"
+      @confirm="handleConfirmDelete"
+    />
   </StructuralScreen>
 </template>
 
@@ -71,12 +100,18 @@ import { capitalCase } from 'change-case'
 
 import type { DatabaseDto, NamespaceDto } from '@core/sdk/client'
 
+const route = useRoute()
 const router = useRouter()
 const tenantPath = useTenantPath()
 const { t } = useI18n()
+const toast = useToast()
+const { tenantId } = useTenant()
 
 const { databases, databasesAreLoading } = useDatabases()
 
+const { deleteDatabase, isDeleting: isDeletingDatabase } = useDeleteDatabase()
+const { deleteNamespace, isDeleting: isDeletingNamespace } = useDeleteNamespace()
+
 const uploadModalVisible = ref(false)
 const selectedDatabaseForUpload = ref('')
 const selectedNamespaceForUpload = ref('')
@@ -89,6 +124,8 @@ const selectedDatabaseForNewNamespace = ref('')
 const editNamespaceModalVisible = ref(false)
 const editingNamespace = ref<NamespaceDto | null>(null)
 
+const newDatabaseModalVisible = ref(false)
+
 const toNamespace = (database_name: string, namespace: NamespaceDto) => {
   router.push(tenantPath(`/service/knowledge/${database_name}/${namespace.name}`))
 }
@@ -123,4 +160,105 @@ const openEditNamespaceModal = (namespace: NamespaceDto) => {
 const handleUpdateSuccess = () => {
   editingNamespace.value = null
 }
+
+const openNewDatabaseModal = () => {
+  newDatabaseModalVisible.value = true
+}
+
+const handleDatabaseCreationSuccess = () => {
+  newDatabaseModalVisible.value = false
+}
+
+type PendingDeletion
+  = | { type: 'database', database: string, name: string, count: number }
+    | { type: 'namespace', database: string, namespace: string, name: string, count: number }
+
+const deleteModalVisible = ref(false)
+const pendingDeletion = ref<PendingDeletion | null>(null)
+
+const isDeleting = computed(() => isDeletingDatabase.value || isDeletingNamespace.value)
+
+const deleteExpectedName = computed(() => pendingDeletion.value?.name ?? '')
+
+const deleteTitle = computed(() =>
+  pendingDeletion.value?.type === 'database'
+    ? t('knowledge.delete.database.title')
+    : t('knowledge.delete.namespace.title'),
+)
+
+const deleteWarning = computed(() => {
+  const pending = pendingDeletion.value
+  if (!pending) return ''
+  const params = { name: pending.name, count: pending.count }
+  return pending.type === 'database'
+    ? t('knowledge.delete.database.warning', params)
+    : t('knowledge.delete.namespace.warning', params)
+})
+
+const documentCountFor = (database: DatabaseDto) =>
+  (database.namespaces ?? []).reduce((sum, namespace) => sum + (namespace.number_of_documents ?? 0), 0)
+
+const openDeleteDatabaseModal = (database: DatabaseDto) => {
+  pendingDeletion.value = {
+    type: 'database',
+    database: database.name,
+    name: database.name,
+    count: documentCountFor(database),
+  }
+  deleteModalVisible.value = true
+}
+
+const openDeleteNamespaceModal = (database: DatabaseDto, namespace: NamespaceDto) => {
+  pendingDeletion.value = {
+    type: 'namespace',
+    database: database.name,
+    namespace: namespace.name,
+    name: namespace.name,
+    count: namespace.number_of_documents ?? 0,
+  }
+  deleteModalVisible.value = true
+}
+
+// The nested document route renders inside this page, so deleting what it points at leaves it mounted on a
+// dead URL. Leave for the nearest surviving ancestor first: navigating deactivates the child's queries, so the
+// delete's invalidation only marks them stale instead of refetching a resource the teardown job is purging.
+// Both cases land on the database list — there is no /service/knowledge/[db] route.
+const isViewingPendingDeletion = (pending: PendingDeletion) => {
+  if (route.params.db !== pending.database) return false
+  return pending.type === 'database' || route.params.namespace === pending.namespace
+}
+
+const handleConfirmDelete = async () => {
+  const pending = pendingDeletion.value
+  if (!pending) return
+
+  try {
+    if (isViewingPendingDeletion(pending)) {
+      await router.push(tenantPath('/service/knowledge'))
+    }
+
+    if (pending.type === 'database') {
+      await deleteDatabase({ tenantId: tenantId.value!, database: pending.database })
+    }
+    else {
+      await deleteNamespace({ tenantId: tenantId.value!, database: pending.database, namespace: pending.namespace })
+    }
+    toast.add({
+      severity: 'success',
+      summary: t('knowledge.delete.scheduled.summary'),
+      detail: t('knowledge.delete.scheduled.detail'),
+      life: 4000,
+    })
+    deleteModalVisible.value = false
+    pendingDeletion.value = null
+  }
+  catch {
+    toast.add({
+      severity: 'error',
+      summary: t('knowledge.delete.error.summary'),
+      detail: t('knowledge.delete.error.detail'),
+      life: 4000,
+    })
+  }
+}
 </script>

package/pages/auth/login/[idp].vue

@@ -0,0 +1,57 @@
+<template>
+  <AuthLoginPanel>
+    <template #heading>
+      <template v-if="provider">
+        {{ t('auth.login.welcomeProvider', { provider: provider.display_name }) }}
+      </template>
+    </template>
+    <template #message>
+      <template v-if="provider">
+        {{ t('auth.login.pleaseLoginWith', { provider: provider.display_name }) }}
+      </template>
+    </template>
+
+    <Button
+      v-if="provider"
+      :label="t('auth.login.loginWith', { provider: provider.display_name })"
+      :icon="`pi ${provider.icon}`"
+      icon-pos="right"
+      class="!bg-white !text-black"
+      @click="login(provider.alias)"
+    />
+    <ProgressSpinner
+      v-else
+      class="!h-8 !w-8"
+    />
+  </AuthLoginPanel>
+</template>
+
+<script setup lang="ts">
+definePageMeta({
+  layout: 'anonymous',
+})
+
+const { t, locale } = useI18n()
+const route = useRoute()
+const { login } = useAuth()
+const { authProviders, isLoading } = useAuthProviders()
+
+/**
+ * The empty alias belongs to the synthetic "Keycloak" entry, which has no
+ * kc_idp_hint and must therefore not be addressable through a tenant link.
+ */
+const requestedAlias = computed(() => String(route.params.idp ?? ''))
+const provider = computed(() =>
+  requestedAlias.value
+    ? authProviders.value?.find(candidate => candidate.alias === requestedAlias.value)
+    : undefined,
+)
+
+// Only decide once the query settled — an unknown, disabled or hidden alias
+// (and a failed provider request) falls back to the all-providers page.
+watch([isLoading, provider], ([providersLoading, matchedProvider]) => {
+  if (!providersLoading && !matchedProvider) {
+    navigateTo(`/${locale.value}/auth/login`, { replace: true })
+  }
+}, { immediate: true })
+</script>

package/pages/auth/login/index.vue

@@ -0,0 +1,46 @@
+<template>
+  <AuthLoginPanel>
+    <template #heading>
+      {{ t('auth.login.welcome', { companyName }) }}
+    </template>
+    <template #message>
+      {{ t('auth.login.pleaseLogin') }}
+    </template>
+
+    <ProgressSpinner
+      v-if="isLoading"
+      class="!h-8 !w-8"
+    />
+    <template v-else>
+      <Button
+        v-for="idp in authProviders ?? []"
+        :key="idp.alias"
+        :label="t('auth.login.loginWith', { provider: idp.display_name })"
+        :icon="`pi ${idp.icon}`"
+        icon-pos="right"
+        class="!bg-white !text-black"
+        @click="login(idp.alias || undefined)"
+      />
+      <Button
+        v-if="(authProviders?.length ?? 0) === 0"
+        :label="t('auth.login.title')"
+        icon="pi pi-sign-in"
+        icon-pos="right"
+        class="!bg-white !text-black"
+        @click="login()"
+      />
+    </template>
+  </AuthLoginPanel>
+</template>
+
+<script setup lang="ts">
+definePageMeta({
+  layout: 'anonymous',
+})
+
+const { t } = useI18n()
+const { login } = useAuth()
+const { authProviders, isLoading } = useAuthProviders()
+
+const companyName = 'bbv Software Services AG'
+</script>

package/plugins/0.runtime-config.client.ts

@@ -50,6 +50,11 @@ export default defineNuxtPlugin(() => {
   assign(group('sysadmin'), 'url', injected.SYSADMIN_URL)
   assign(group('mainApp'), 'url', injected.MAIN_APP_URL)
   if (injected.API_BASE_URL) publicConfig.apiBaseUrl = injected.API_BASE_URL
+  // The version actually deployed. A release is promoted by retagging the exact
+  // `-rc.N` build that was tested, so whatever was baked into the bundle at build
+  // time keeps the candidate's name — the deployment is the only party that knows
+  // the tag it pulled. Falls back to the baked value when nothing is injected.
+  if (injected.APP_VERSION) publicConfig.appVersion = injected.APP_VERSION
 
   isConfigLoaded.value = true
 })

package/plugins/oidc-client.ts

@@ -12,7 +12,7 @@ export default defineNuxtPlugin(async ({ $i18n, $router }) => {
     client_id: config.public.oidc.clientId,
     redirect_uri: `${globalThis.location.origin}/${$i18n.locale.value}/auth/callback`,
     silent_redirect_uri: `${globalThis.location.origin}/${$i18n.locale.value}/auth/renew`,
-    post_logout_redirect_uri: globalThis.location.origin,
+    post_logout_redirect_uri: `${globalThis.location.origin}/${$i18n.locale.value}/auth/login`,
     response_type: 'code',
     scope: 'openid profile email',
     filterProtocolClaims: true,

package/sdk/client/client/client.gen.ts

@@ -197,9 +197,7 @@ export const createClient = (config: Config = {}): Client => {
         method,
         onRequest: undefined,
         serializedBody: getValidRequestBody(opts) as
-          | BodyInit
-          | null
-          | undefined,
+          BodyInit | null | undefined,
         signal: unwrapRefs(opts.signal) as AbortSignal,
         url,
       });

package/sdk/client/client/types.gen.ts

@@ -33,14 +33,12 @@ export type QuerySerializer = (
 
 type WithRefs<TData> = {
   [K in keyof TData]: NonNullable<TData[K]> extends object
-    ?
-        | WithRefs<NonNullable<TData[K]>>
-        | Ref<NonNullable<TData[K]>>
-        | Extract<TData[K], null>
-    :
-        | NonNullable<TData[K]>
-        | Ref<NonNullable<TData[K]>>
-        | Extract<TData[K], null>;
+    ? | WithRefs<NonNullable<TData[K]>>
+      | Ref<NonNullable<TData[K]>>
+      | Extract<TData[K], null>
+    : | NonNullable<TData[K]>
+      | Ref<NonNullable<TData[K]>>
+      | Extract<TData[K], null>;
 };
 
 // copied from Nuxt
@@ -206,8 +204,4 @@ type FetchOptions<TData> = Omit<
 >;
 
 export type Composable =
-  | "$fetch"
-  | "useAsyncData"
-  | "useFetch"
-  | "useLazyAsyncData"
-  | "useLazyFetch";
+  "$fetch" | "useAsyncData" | "useFetch" | "useLazyAsyncData" | "useLazyFetch";

package/sdk/client/client/utils.gen.ts

@@ -195,8 +195,7 @@ export const setAuthParams = async ({
           options.query = {};
         }
         const queryValue = toValue(options.query) as
-          | Record<string, unknown>
-          | undefined;
+          Record<string, unknown> | undefined;
         if (queryValue) {
           queryValue[name] = token;
         }

package/sdk/client/core/queryKeySerializer.gen.ts

@@ -4,12 +4,7 @@
  * JSON-friendly union that mirrors what Pinia Colada can hash.
  */
 export type JsonValue =
-  | null
-  | string
-  | number
-  | boolean
-  | JsonValue[]
-  | { [key: string]: JsonValue };
+  null | string | number | boolean | JsonValue[] | { [key: string]: JsonValue };
 
 /**
  * Replacer that converts non-JSON values (bigint, Date, etc.) to safe substitutes.

package/sdk/client/core/types.gen.ts

@@ -112,7 +112,9 @@ type IsExactlyNeverOrNeverUndefined<T> = [T] extends [never]
     : false;
 
 export type OmitNever<T extends Record<string, unknown>> = {
-  [K in keyof T as IsExactlyNeverOrNeverUndefined<T[K]> extends true
-    ? never
-    : K]: T[K];
+  [
+    K in keyof T as IsExactlyNeverOrNeverUndefined<T[K]> extends true
+      ? never
+      : K
+  ]: T[K];
 };