@trackunit/react-core-contexts 2.6.17-alpha-62031fc7c43.0 → 2.7.0

package/index.cjs.js

@@ -40,10 +40,25 @@ const FeatureFlagProviderIrisApp = ({ children }) => {
     return jsxRuntime.jsx(reactCoreContextsApi.FeatureFlagContextProvider, { value: featureFlags, children: children });
 };
 
+/**
+ * Picks out the messages that report a missing authorization scope.
+ *
+ * The server offers no structured signal to key off: `verifyScopes`
+ * (libs/graphql/common/src/schemabuilder/AuthorizationDirective.ts) throws a plain
+ * `ForbiddenError` whose message is assembled as "Missing " + the allowed scopes joined with
+ * " or " + " scope". Matching on that shape is therefore the only option available, and it
+ * lives here so the HTTP and subscription links cannot drift apart on what counts as a
+ * missing scope.
+ *
+ * Filtering rather than inspecting the first error matters in both links: a response can
+ * carry several errors in any order, since the directive throws per resolved field.
+ */
+const getMissingScopeMessages = (errors) => errors.map(error => error.message).filter(message => message.startsWith("Missing ") && message.endsWith(" scope"));
+
 /**
  * This error link is used to capture error information, i. e. traceId, graphQL errors, network errors, etc.
  */
-const createErrorLink = ({ errorHandler, getToken, }) => {
+const createErrorLink = ({ errorHandler, getToken, showErrorToast, }) => {
     return error.onError(({ graphQLErrors, networkError, operation, response, forward }) => {
         if (networkError) {
             // We skip the error logging if the error is an AbortError
@@ -70,6 +85,10 @@ const createErrorLink = ({ errorHandler, getToken, }) => {
             }
             // eslint-disable-next-line no-console
             console.error(`Error calling: '${operation.getContext().clientAwareness.name}' fetching Data for: ${operation.operationName}`, graphQLErrors);
+            const missingScopeMessages = getMissingScopeMessages(graphQLErrors);
+            if (missingScopeMessages.length > 0) {
+                showErrorToast(new Error(missingScopeMessages.join(", ")));
+            }
             /**
              * We want to see the full graphQL error since
              * it contains extra details like the query/mutation
@@ -120,18 +139,20 @@ const DEFAULT_AUTH_GRACE_MS = 30000;
 /**
  * Wraps an SSE subscription link and provides the same error monitoring as the
  * HTTP error link — capturing GraphQL errors, traceIds, FORCE_RELOAD_BROWSER,
- * and UNAUTHENTICATED codes — for long-lived subscription Observables.
+ * and UNAUTHENTICATED codes, and surfacing missing authorization scopes — for
+ * long-lived subscription Observables.
  *
  * UNAUTHENTICATED errors are deferred by a grace period (default 30s) to allow
  * Okta's autoRenew to refresh the token. If a successful response arrives
  * within the window the capture is cancelled; if the timer fires, a single
  * captureException is sent — an actionable signal that token refresh failed.
  */
-const createSubscriptionErrorLink = ({ errorHandler, getToken, graceMs = DEFAULT_AUTH_GRACE_MS, }) => {
+const createSubscriptionErrorLink = ({ errorHandler, getToken, showErrorToast, graceMs = DEFAULT_AUTH_GRACE_MS, }) => {
     return new client.ApolloLink((operation, forward) => {
         return new client.Observable(observer => {
             let authGraceTimer = null;
             let authErrorReported = false;
+            let missingScopeReported = false;
             const clearGraceTimer = () => {
                 if (authGraceTimer !== null) {
                     clearTimeout(authGraceTimer);
@@ -161,6 +182,16 @@ const createSubscriptionErrorLink = ({ errorHandler, getToken, graceMs = DEFAULT
                             level: "error",
                             data: { log: JSON.stringify(errors) },
                         });
+                        // A subscription is long-lived and a scope failure is static for the operation, so
+                        // the same error can arrive on every payload. Report it once per subscription
+                        // rather than re-raising the toast, which the provider's de-dup would otherwise
+                        // make visibly disappear and re-enter. Reset when a clean payload arrives, as the
+                        // auth grace handling below does.
+                        const missingScopeMessages = getMissingScopeMessages(errors);
+                        if (missingScopeMessages.length > 0 && !missingScopeReported) {
+                            missingScopeReported = true;
+                            showErrorToast(new Error(missingScopeMessages.join(", ")));
+                        }
                         const invalidToken = errors.some(x => x.extensions?.code === "UNAUTHENTICATED" ||
                             x.message.includes("Invalid token specified") ||
                             x.message.includes("Access denied! You need to be authorized to perform this action!"));
@@ -180,6 +211,7 @@ const createSubscriptionErrorLink = ({ errorHandler, getToken, graceMs = DEFAULT
                     else {
                         clearGraceTimer();
                         authErrorReported = false;
+                        missingScopeReported = false;
                     }
                     observer.next(response);
                 },
@@ -281,7 +313,7 @@ const isInternalGqlContext = () => {
 /**
  * @internal
  */
-const createApolloClient = ({ graphqlPublicUrl, graphqlInternalUrl, graphqlReportUrl, isDev, tracingHeaders: initialTracingHeaders, firstToken, errorHandler, }) => {
+const createApolloClient = ({ graphqlPublicUrl, graphqlInternalUrl, graphqlReportUrl, isDev, tracingHeaders: initialTracingHeaders, firstToken, errorHandler, showErrorToast, }) => {
     let token = firstToken;
     let tracingHeaders = initialTracingHeaders;
     const publicGraphQLLink = client.createHttpLink({
@@ -301,7 +333,7 @@ const createApolloClient = ({ graphqlPublicUrl, graphqlInternalUrl, graphqlRepor
             },
         };
     });
-    const errorLink = createErrorLink({ errorHandler, getToken: () => token });
+    const errorLink = createErrorLink({ errorHandler, getToken: () => token, showErrorToast });
     const defaultOptions = {
         watchQuery: {
             fetchPolicy: "no-cache",
@@ -339,7 +371,7 @@ const createApolloClient = ({ graphqlPublicUrl, graphqlInternalUrl, graphqlRepor
         headers: () => generateHeaders(token, tracingHeaders),
     });
     // Split links based on operation type
-    const subscriptionErrorLink = createSubscriptionErrorLink({ errorHandler, getToken: () => token });
+    const subscriptionErrorLink = createSubscriptionErrorLink({ errorHandler, getToken: () => token, showErrorToast });
     const splitLink = client.from([
         authLink,
         client.split(({ query }) => {
@@ -394,6 +426,34 @@ const useApolloClient = () => {
     const { graphqlPublicUrl, graphqlInternalUrl, graphqlReportUrl, environment, tracingHeaders } = reactCoreHooks.useEnvironment();
     const { token: currentToken } = reactCoreHooks.useToken();
     const errorHandler = reactCoreHooks.useErrorHandler();
+    const { addToast } = reactCoreHooks.useToast();
+    const { permissions } = reactCoreHooks.useCurrentUser();
+    const showErrorToast = react.useCallback((error) => {
+        // Only a developer running an Iris App locally can act on a missing scope, since only
+        // they can edit the manifest. The server throws the same message for real customer
+        // sessions and for token clients that have no manifest at all, so surfacing it outside
+        // local mode tells users to fix something they cannot reach.
+        //
+        // Read from storage rather than through useIrisAppsSDK().developerMode: that context is
+        // created below this provider (it queries GraphQL, so it needs this Apollo client) and
+        // lives in a visibility:host library this one cannot import.
+        const isDeveloper = permissions?.some(permission => permission === "account.iris.app.developer");
+        if (!isDeveloper) {
+            return;
+        }
+        void addToast({
+            // ToastProviderHost de-dups on id *or* title, so both must be constant and
+            // specific: a message-derived id churned on every scope combination, and the
+            // generic "Error" title evicted unrelated toasts (and was evicted by them).
+            id: "apollo-missing-scope",
+            intent: "danger",
+            title: "Missing scope",
+            // A missing scope leaves the view permanently empty, so the only explanation
+            // the user gets must not time out.
+            behavior: "persistent",
+            description: `${error.message} - you must add the scope to your iris app manifest`,
+        });
+    }, [addToast, permissions]);
     const [client] = react.useState(() => {
         return createApolloClient({
             /* DON'T CHANGE THIS ! its there to ensure we don't recreate apollo client just because the token changes,
@@ -406,6 +466,7 @@ const useApolloClient = () => {
             tracingHeaders,
             firstToken: currentToken,
             errorHandler,
+            showErrorToast,
         });
     });
     // Synchronously propagate the token into the Apollo client closure during render
@@ -973,7 +1034,7 @@ const TrackunitProviders = ({ translations, children, errorHandler }) => {
         i18nLibraryTranslation.registerTranslations(translations); // Register the apps translations if passed.
     }
     i18nLibraryTranslation.initializeTranslationsForApp(); // Initialize all registered translations
-    return (jsxRuntime.jsx(EnvironmentProviderIrisApp, { children: jsxRuntime.jsx(ErrorHandlingProviderIrisApp, { errorHandler: errorHandler, children: jsxRuntime.jsx(ThemeCssProviderIrisApp, { children: jsxRuntime.jsx(TokenProviderIrisApp, { children: jsxRuntime.jsx(CurrentUserPreferenceProviderIrisApp, { children: jsxRuntime.jsx(CurrentUserProviderIrisApp, { children: jsxRuntime.jsx(UserSubscriptionProviderIrisApp, { children: jsxRuntime.jsx(AnalyticsProviderIrisApp, { children: jsxRuntime.jsx(OemBrandingProviderIrisApp, { children: jsxRuntime.jsx(AssetSortingProviderIrisApp, { children: jsxRuntime.jsx(ManagerApolloProvider, { children: jsxRuntime.jsx(NavigationProviderIrisApp, { children: jsxRuntime.jsx(ToastProviderIrisApp, { children: jsxRuntime.jsx(ModalDialogContextProviderIrisApp, { children: jsxRuntime.jsx(ConfirmationDialogProviderIrisApp, { children: jsxRuntime.jsx(FilterBarProviderIrisApp, { children: jsxRuntime.jsx(ExportDataProviderIrisApp, { children: jsxRuntime.jsx(TimeRangeProviderIrisApp, { children: jsxRuntime.jsx(WidgetConfigProviderIrisApp, { children: jsxRuntime.jsx(GeolocationProviderIrisApp, { children: jsxRuntime.jsx(react.Suspense, { fallback: jsxRuntime.jsx(reactComponents.Spinner, { centering: "centered", "data-testid": "trackunit-providers" }), children: jsxRuntime.jsx(FeatureFlagProviderIrisApp, { children: children }) }) }) }) }) }) }) }) }) }) }) }) }) }) }) }) }) }) }) }) }) }));
+    return (jsxRuntime.jsx(EnvironmentProviderIrisApp, { children: jsxRuntime.jsx(ErrorHandlingProviderIrisApp, { errorHandler: errorHandler, children: jsxRuntime.jsx(ThemeCssProviderIrisApp, { children: jsxRuntime.jsx(TokenProviderIrisApp, { children: jsxRuntime.jsx(CurrentUserPreferenceProviderIrisApp, { children: jsxRuntime.jsx(CurrentUserProviderIrisApp, { children: jsxRuntime.jsx(UserSubscriptionProviderIrisApp, { children: jsxRuntime.jsx(AnalyticsProviderIrisApp, { children: jsxRuntime.jsx(OemBrandingProviderIrisApp, { children: jsxRuntime.jsx(AssetSortingProviderIrisApp, { children: jsxRuntime.jsx(ToastProviderIrisApp, { children: jsxRuntime.jsx(ManagerApolloProvider, { children: jsxRuntime.jsx(NavigationProviderIrisApp, { children: jsxRuntime.jsx(ModalDialogContextProviderIrisApp, { children: jsxRuntime.jsx(ConfirmationDialogProviderIrisApp, { children: jsxRuntime.jsx(FilterBarProviderIrisApp, { children: jsxRuntime.jsx(ExportDataProviderIrisApp, { children: jsxRuntime.jsx(TimeRangeProviderIrisApp, { children: jsxRuntime.jsx(WidgetConfigProviderIrisApp, { children: jsxRuntime.jsx(GeolocationProviderIrisApp, { children: jsxRuntime.jsx(react.Suspense, { fallback: jsxRuntime.jsx(reactComponents.Spinner, { centering: "centered", "data-testid": "trackunit-providers" }), children: jsxRuntime.jsx(FeatureFlagProviderIrisApp, { children: children }) }) }) }) }) }) }) }) }) }) }) }) }) }) }) }) }) }) }) }) }) }));
 };
 
 exports.FeatureFlagProviderIrisApp = FeatureFlagProviderIrisApp;

package/index.esm.js

@@ -1,9 +1,9 @@
 import { jsx, Fragment } from 'react/jsx-runtime';
 import { FeatureFlagRuntime, ToastRuntime, AnalyticsRuntime, registerHostChangeHandler, AssetSortingRuntime, ConfirmationDialogRuntime, EnvironmentRuntime, ExportDataRuntime, AssetsFilterBarRuntime, CustomersFilterBarRuntime, SitesFilterBarRuntime, GeolocationRuntime, ModalDialogRuntime, NavigationRuntime, OemBrandingRuntime, ThemeCssRuntime, TimeRangeRuntime, TokenRuntime, CurrentUserRuntime, CurrentUserPreferenceRuntime, UserSubscriptionRuntime, WidgetConfigRuntime } from '@trackunit/iris-app-runtime-core';
 import { FeatureFlagContextProvider, ToastProvider, AnalyticsContextProvider, AssetSortingProvider, ConfirmationDialogProvider, EnvironmentContextProvider, ErrorHandlingContextProvider, ExportDataContext, FilterBarProvider, GeolocationProvider, ModalDialogContextProvider, NavigationContextProvider, OemBrandingContextProvider, TimeRangeProvider, TokenProvider, CurrentUserProvider, CurrentUserPreferenceProvider, UserSubscriptionProvider, WidgetConfigProvider } from '@trackunit/react-core-contexts-api';
-import { useState, useEffect, useMemo, useCallback, useReducer, Suspense } from 'react';
+import { useState, useEffect, useCallback, useMemo, useReducer, Suspense } from 'react';
 import { ApolloLink, Observable, createHttpLink, from, split, ApolloClient, InMemoryCache, ApolloProvider } from '@apollo/client';
-import { useEnvironment, useToken, useErrorHandler } from '@trackunit/react-core-hooks';
+import { useEnvironment, useToken, useErrorHandler, useToast, useCurrentUser } from '@trackunit/react-core-hooks';
 import { setContext } from '@apollo/client/link/context';
 import { removeTypenameFromVariables } from '@apollo/client/link/remove-typename';
 import { getMainDefinition, Observable as Observable$1 } from '@apollo/client/utilities';
@@ -38,10 +38,25 @@ const FeatureFlagProviderIrisApp = ({ children }) => {
     return jsx(FeatureFlagContextProvider, { value: featureFlags, children: children });
 };
 
+/**
+ * Picks out the messages that report a missing authorization scope.
+ *
+ * The server offers no structured signal to key off: `verifyScopes`
+ * (libs/graphql/common/src/schemabuilder/AuthorizationDirective.ts) throws a plain
+ * `ForbiddenError` whose message is assembled as "Missing " + the allowed scopes joined with
+ * " or " + " scope". Matching on that shape is therefore the only option available, and it
+ * lives here so the HTTP and subscription links cannot drift apart on what counts as a
+ * missing scope.
+ *
+ * Filtering rather than inspecting the first error matters in both links: a response can
+ * carry several errors in any order, since the directive throws per resolved field.
+ */
+const getMissingScopeMessages = (errors) => errors.map(error => error.message).filter(message => message.startsWith("Missing ") && message.endsWith(" scope"));
+
 /**
  * This error link is used to capture error information, i. e. traceId, graphQL errors, network errors, etc.
  */
-const createErrorLink = ({ errorHandler, getToken, }) => {
+const createErrorLink = ({ errorHandler, getToken, showErrorToast, }) => {
     return onError(({ graphQLErrors, networkError, operation, response, forward }) => {
         if (networkError) {
             // We skip the error logging if the error is an AbortError
@@ -68,6 +83,10 @@ const createErrorLink = ({ errorHandler, getToken, }) => {
             }
             // eslint-disable-next-line no-console
             console.error(`Error calling: '${operation.getContext().clientAwareness.name}' fetching Data for: ${operation.operationName}`, graphQLErrors);
+            const missingScopeMessages = getMissingScopeMessages(graphQLErrors);
+            if (missingScopeMessages.length > 0) {
+                showErrorToast(new Error(missingScopeMessages.join(", ")));
+            }
             /**
              * We want to see the full graphQL error since
              * it contains extra details like the query/mutation
@@ -118,18 +137,20 @@ const DEFAULT_AUTH_GRACE_MS = 30000;
 /**
  * Wraps an SSE subscription link and provides the same error monitoring as the
  * HTTP error link — capturing GraphQL errors, traceIds, FORCE_RELOAD_BROWSER,
- * and UNAUTHENTICATED codes — for long-lived subscription Observables.
+ * and UNAUTHENTICATED codes, and surfacing missing authorization scopes — for
+ * long-lived subscription Observables.
  *
  * UNAUTHENTICATED errors are deferred by a grace period (default 30s) to allow
  * Okta's autoRenew to refresh the token. If a successful response arrives
  * within the window the capture is cancelled; if the timer fires, a single
  * captureException is sent — an actionable signal that token refresh failed.
  */
-const createSubscriptionErrorLink = ({ errorHandler, getToken, graceMs = DEFAULT_AUTH_GRACE_MS, }) => {
+const createSubscriptionErrorLink = ({ errorHandler, getToken, showErrorToast, graceMs = DEFAULT_AUTH_GRACE_MS, }) => {
     return new ApolloLink((operation, forward) => {
         return new Observable(observer => {
             let authGraceTimer = null;
             let authErrorReported = false;
+            let missingScopeReported = false;
             const clearGraceTimer = () => {
                 if (authGraceTimer !== null) {
                     clearTimeout(authGraceTimer);
@@ -159,6 +180,16 @@ const createSubscriptionErrorLink = ({ errorHandler, getToken, graceMs = DEFAULT
                             level: "error",
                             data: { log: JSON.stringify(errors) },
                         });
+                        // A subscription is long-lived and a scope failure is static for the operation, so
+                        // the same error can arrive on every payload. Report it once per subscription
+                        // rather than re-raising the toast, which the provider's de-dup would otherwise
+                        // make visibly disappear and re-enter. Reset when a clean payload arrives, as the
+                        // auth grace handling below does.
+                        const missingScopeMessages = getMissingScopeMessages(errors);
+                        if (missingScopeMessages.length > 0 && !missingScopeReported) {
+                            missingScopeReported = true;
+                            showErrorToast(new Error(missingScopeMessages.join(", ")));
+                        }
                         const invalidToken = errors.some(x => x.extensions?.code === "UNAUTHENTICATED" ||
                             x.message.includes("Invalid token specified") ||
                             x.message.includes("Access denied! You need to be authorized to perform this action!"));
@@ -178,6 +209,7 @@ const createSubscriptionErrorLink = ({ errorHandler, getToken, graceMs = DEFAULT
                     else {
                         clearGraceTimer();
                         authErrorReported = false;
+                        missingScopeReported = false;
                     }
                     observer.next(response);
                 },
@@ -279,7 +311,7 @@ const isInternalGqlContext = () => {
 /**
  * @internal
  */
-const createApolloClient = ({ graphqlPublicUrl, graphqlInternalUrl, graphqlReportUrl, isDev, tracingHeaders: initialTracingHeaders, firstToken, errorHandler, }) => {
+const createApolloClient = ({ graphqlPublicUrl, graphqlInternalUrl, graphqlReportUrl, isDev, tracingHeaders: initialTracingHeaders, firstToken, errorHandler, showErrorToast, }) => {
     let token = firstToken;
     let tracingHeaders = initialTracingHeaders;
     const publicGraphQLLink = createHttpLink({
@@ -299,7 +331,7 @@ const createApolloClient = ({ graphqlPublicUrl, graphqlInternalUrl, graphqlRepor
             },
         };
     });
-    const errorLink = createErrorLink({ errorHandler, getToken: () => token });
+    const errorLink = createErrorLink({ errorHandler, getToken: () => token, showErrorToast });
     const defaultOptions = {
         watchQuery: {
             fetchPolicy: "no-cache",
@@ -337,7 +369,7 @@ const createApolloClient = ({ graphqlPublicUrl, graphqlInternalUrl, graphqlRepor
         headers: () => generateHeaders(token, tracingHeaders),
     });
     // Split links based on operation type
-    const subscriptionErrorLink = createSubscriptionErrorLink({ errorHandler, getToken: () => token });
+    const subscriptionErrorLink = createSubscriptionErrorLink({ errorHandler, getToken: () => token, showErrorToast });
     const splitLink = from([
         authLink,
         split(({ query }) => {
@@ -392,6 +424,34 @@ const useApolloClient = () => {
     const { graphqlPublicUrl, graphqlInternalUrl, graphqlReportUrl, environment, tracingHeaders } = useEnvironment();
     const { token: currentToken } = useToken();
     const errorHandler = useErrorHandler();
+    const { addToast } = useToast();
+    const { permissions } = useCurrentUser();
+    const showErrorToast = useCallback((error) => {
+        // Only a developer running an Iris App locally can act on a missing scope, since only
+        // they can edit the manifest. The server throws the same message for real customer
+        // sessions and for token clients that have no manifest at all, so surfacing it outside
+        // local mode tells users to fix something they cannot reach.
+        //
+        // Read from storage rather than through useIrisAppsSDK().developerMode: that context is
+        // created below this provider (it queries GraphQL, so it needs this Apollo client) and
+        // lives in a visibility:host library this one cannot import.
+        const isDeveloper = permissions?.some(permission => permission === "account.iris.app.developer");
+        if (!isDeveloper) {
+            return;
+        }
+        void addToast({
+            // ToastProviderHost de-dups on id *or* title, so both must be constant and
+            // specific: a message-derived id churned on every scope combination, and the
+            // generic "Error" title evicted unrelated toasts (and was evicted by them).
+            id: "apollo-missing-scope",
+            intent: "danger",
+            title: "Missing scope",
+            // A missing scope leaves the view permanently empty, so the only explanation
+            // the user gets must not time out.
+            behavior: "persistent",
+            description: `${error.message} - you must add the scope to your iris app manifest`,
+        });
+    }, [addToast, permissions]);
     const [client] = useState(() => {
         return createApolloClient({
             /* DON'T CHANGE THIS ! its there to ensure we don't recreate apollo client just because the token changes,
@@ -404,6 +464,7 @@ const useApolloClient = () => {
             tracingHeaders,
             firstToken: currentToken,
             errorHandler,
+            showErrorToast,
         });
     });
     // Synchronously propagate the token into the Apollo client closure during render
@@ -971,7 +1032,7 @@ const TrackunitProviders = ({ translations, children, errorHandler }) => {
         registerTranslations(translations); // Register the apps translations if passed.
     }
     initializeTranslationsForApp(); // Initialize all registered translations
-    return (jsx(EnvironmentProviderIrisApp, { children: jsx(ErrorHandlingProviderIrisApp, { errorHandler: errorHandler, children: jsx(ThemeCssProviderIrisApp, { children: jsx(TokenProviderIrisApp, { children: jsx(CurrentUserPreferenceProviderIrisApp, { children: jsx(CurrentUserProviderIrisApp, { children: jsx(UserSubscriptionProviderIrisApp, { children: jsx(AnalyticsProviderIrisApp, { children: jsx(OemBrandingProviderIrisApp, { children: jsx(AssetSortingProviderIrisApp, { children: jsx(ManagerApolloProvider, { children: jsx(NavigationProviderIrisApp, { children: jsx(ToastProviderIrisApp, { children: jsx(ModalDialogContextProviderIrisApp, { children: jsx(ConfirmationDialogProviderIrisApp, { children: jsx(FilterBarProviderIrisApp, { children: jsx(ExportDataProviderIrisApp, { children: jsx(TimeRangeProviderIrisApp, { children: jsx(WidgetConfigProviderIrisApp, { children: jsx(GeolocationProviderIrisApp, { children: jsx(Suspense, { fallback: jsx(Spinner, { centering: "centered", "data-testid": "trackunit-providers" }), children: jsx(FeatureFlagProviderIrisApp, { children: children }) }) }) }) }) }) }) }) }) }) }) }) }) }) }) }) }) }) }) }) }) }));
+    return (jsx(EnvironmentProviderIrisApp, { children: jsx(ErrorHandlingProviderIrisApp, { errorHandler: errorHandler, children: jsx(ThemeCssProviderIrisApp, { children: jsx(TokenProviderIrisApp, { children: jsx(CurrentUserPreferenceProviderIrisApp, { children: jsx(CurrentUserProviderIrisApp, { children: jsx(UserSubscriptionProviderIrisApp, { children: jsx(AnalyticsProviderIrisApp, { children: jsx(OemBrandingProviderIrisApp, { children: jsx(AssetSortingProviderIrisApp, { children: jsx(ToastProviderIrisApp, { children: jsx(ManagerApolloProvider, { children: jsx(NavigationProviderIrisApp, { children: jsx(ModalDialogContextProviderIrisApp, { children: jsx(ConfirmationDialogProviderIrisApp, { children: jsx(FilterBarProviderIrisApp, { children: jsx(ExportDataProviderIrisApp, { children: jsx(TimeRangeProviderIrisApp, { children: jsx(WidgetConfigProviderIrisApp, { children: jsx(GeolocationProviderIrisApp, { children: jsx(Suspense, { fallback: jsx(Spinner, { centering: "centered", "data-testid": "trackunit-providers" }), children: jsx(FeatureFlagProviderIrisApp, { children: children }) }) }) }) }) }) }) }) }) }) }) }) }) }) }) }) }) }) }) }) }) }));
 };
 
 export { FeatureFlagProviderIrisApp, ManagerApolloProvider, ToastProviderIrisApp, TrackunitProviders };

package/migrations/entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry.js","sourceRoot":"","sources":["../../../../../libs/react/core-contexts/migrations/entry.ts"],"names":[],"mappings":"","sourcesContent":["export {};\n"]}

package/package.json

@@ -1,20 +1,20 @@
 {
   "name": "@trackunit/react-core-contexts",
-  "version": "2.6.17-alpha-62031fc7c43.0",
+  "version": "2.7.0",
   "repository": "https://github.com/Trackunit/manager",
   "license": "SEE LICENSE IN LICENSE.txt",
   "engines": {
     "node": ">=24.x"
   },
   "dependencies": {
-    "@trackunit/iris-app-api": "2.4.12-alpha-62031fc7c43.0",
-    "@trackunit/iris-app-runtime-core-api": "1.17.24-alpha-62031fc7c43.0",
-    "@trackunit/react-core-hooks": "1.21.18-alpha-62031fc7c43.0",
-    "@trackunit/i18n-library-translation": "2.4.18-alpha-62031fc7c43.0",
-    "@trackunit/react-components": "2.10.12-alpha-62031fc7c43.0",
-    "@trackunit/iris-app-runtime-core": "1.18.24-alpha-62031fc7c43.0",
+    "@trackunit/iris-app-api": "2.4.12",
+    "@trackunit/iris-app-runtime-core-api": "1.17.24",
+    "@trackunit/react-core-hooks": "1.21.18",
+    "@trackunit/i18n-library-translation": "2.4.18",
+    "@trackunit/react-components": "2.10.12",
+    "@trackunit/iris-app-runtime-core": "1.18.24",
     "graphql-sse": "^2.5.4",
-    "@trackunit/react-core-contexts-api": "1.18.24-alpha-62031fc7c43.0"
+    "@trackunit/react-core-contexts-api": "1.18.24"
   },
   "peerDependencies": {
     "@apollo/client": "^3.13.8",

package/src/createApolloClient.d.ts

@@ -3,7 +3,7 @@ import { ErrorHandlingContextValue, TracingHeaders } from "@trackunit/iris-app-r
 /**
  * @internal
  */
-export declare const createApolloClient: ({ graphqlPublicUrl, graphqlInternalUrl, graphqlReportUrl, isDev, tracingHeaders: initialTracingHeaders, firstToken, errorHandler, }: {
+export declare const createApolloClient: ({ graphqlPublicUrl, graphqlInternalUrl, graphqlReportUrl, isDev, tracingHeaders: initialTracingHeaders, firstToken, errorHandler, showErrorToast, }: {
     graphqlPublicUrl: string;
     graphqlInternalUrl: string;
     graphqlReportUrl: string;
@@ -11,6 +11,7 @@ export declare const createApolloClient: ({ graphqlPublicUrl, graphqlInternalUrl
     isDev: boolean;
     firstToken?: string;
     errorHandler: ErrorHandlingContextValue;
+    showErrorToast: (error: Error) => void;
 }) => {
     client: ApolloClient<import("@apollo/client").NormalizedCacheObject>;
     setToken: (newToken: string | undefined) => void;

package/src/errorLink/errorLink.d.ts

@@ -3,7 +3,8 @@ import { ErrorHandlingContextValue } from "@trackunit/iris-app-runtime-core-api"
 /**
  * This error link is used to capture error information, i. e. traceId, graphQL errors, network errors, etc.
  */
-export declare const createErrorLink: ({ errorHandler, getToken, }: {
+export declare const createErrorLink: ({ errorHandler, getToken, showErrorToast, }: {
     errorHandler: ErrorHandlingContextValue;
     getToken: () => string | undefined;
+    showErrorToast: (error: Error) => void;
 }) => ApolloLink;

package/src/errorLink/missingScopeErrors.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Picks out the messages that report a missing authorization scope.
+ *
+ * The server offers no structured signal to key off: `verifyScopes`
+ * (libs/graphql/common/src/schemabuilder/AuthorizationDirective.ts) throws a plain
+ * `ForbiddenError` whose message is assembled as "Missing " + the allowed scopes joined with
+ * " or " + " scope". Matching on that shape is therefore the only option available, and it
+ * lives here so the HTTP and subscription links cannot drift apart on what counts as a
+ * missing scope.
+ *
+ * Filtering rather than inspecting the first error matters in both links: a response can
+ * carry several errors in any order, since the directive throws per resolved field.
+ */
+export declare const getMissingScopeMessages: (errors: ReadonlyArray<{
+    message: string;
+}>) => Array<string>;

package/src/errorLink/subscriptionErrorLink.d.ts

@@ -3,15 +3,17 @@ import { ErrorHandlingContextValue } from "@trackunit/iris-app-runtime-core-api"
 /**
  * Wraps an SSE subscription link and provides the same error monitoring as the
  * HTTP error link — capturing GraphQL errors, traceIds, FORCE_RELOAD_BROWSER,
- * and UNAUTHENTICATED codes — for long-lived subscription Observables.
+ * and UNAUTHENTICATED codes, and surfacing missing authorization scopes — for
+ * long-lived subscription Observables.
  *
  * UNAUTHENTICATED errors are deferred by a grace period (default 30s) to allow
  * Okta's autoRenew to refresh the token. If a successful response arrives
  * within the window the capture is cancelled; if the timer fires, a single
  * captureException is sent — an actionable signal that token refresh failed.
  */
-export declare const createSubscriptionErrorLink: ({ errorHandler, getToken, graceMs, }: {
+export declare const createSubscriptionErrorLink: ({ errorHandler, getToken, showErrorToast, graceMs, }: {
     errorHandler: ErrorHandlingContextValue;
     getToken: () => string | undefined;
+    showErrorToast: (error: Error) => void;
     graceMs?: number;
 }) => ApolloLink;