@vertesia/ui 1.5.0-dev.20260713.151751Z → 1.5.0-dev.20260717.131047Z

package/src/router/Router.tsx

@@ -1,7 +1,7 @@
 import { createContext, useContext, useEffect } from 'react';
 import { HistoryNavigator, type LocationChangeEvent, type NavigateOptions } from './HistoryNavigator';
 import { type PathMatch, PathMatcher } from './PathMatcher';
-import { isRootPath, joinPath, type PathMatchParams } from './path';
+import { getMountBasename, isRootPath, joinPath, type PathMatchParams, stripMountBasename } from './path';
 
 export type RouteComponentProps = PathMatchParams;
 export type LazyRouteModule = { default: React.ComponentType<Record<string, never>> };
@@ -61,7 +61,8 @@ export class Router extends BaseRouter {
             }
             // only process afterChange events
             if (event.name === 'afterChange') {
-                const match = this.match(event.location.pathname);
+                // Match app-relative: strip the served `<base href>` mount prefix (no-op when origin-served).
+                const match = this.match(stripMountBasename(event.location.pathname));
                 if (match?.value) {
                     updateState({
                         ...match,
@@ -184,8 +185,21 @@ export function useNavigate() {
 }
 
 export function useRouterBasePath() {
-    const { matchedRoutePath, router } = useRouterContext();
-    return router instanceof NestedRouter ? router.basePath : matchedRoutePath;
+    const { router } = useRouterContext();
+    // The base path apps prepend to build absolute in-app links (e.g. `${base}/items/${id}`). It MUST
+    // include the served `<base href>` mount so links stay on the mount and match the full
+    // `useLocation().pathname` (which carries the mount). `getMountBasename()` is '' for the
+    // origin-served Studio UI and the mount (no trailing slash) for gateway-served apps.
+    const mount = getMountBasename();
+    if (router instanceof NestedRouter) {
+        // NestedRouter.basePath is relative to the parent router, which sits at the mount, so it must
+        // be mount-prefixed too. A bare nested base of '/' (an app whose NestedRouterProvider has no
+        // basePath) would otherwise make `${base}/items` resolve to `//items` — a protocol-relative
+        // URL that escapes the app. Origin-served Studio (mount '') keeps the raw nested basePath.
+        if (!mount) return router.basePath;
+        return router.basePath === '/' ? mount : joinPath(mount, router.basePath);
+    }
+    return mount;
 }
 
 type UseParamsReturn<T> = T extends string ? string : Record<string, string>;

package/src/router/path.test.ts

@@ -0,0 +1,87 @@
+import { afterEach, describe, expect, it } from 'vitest';
+import { getMountBasename, joinPath, stripMountBasename, withMountBasename } from './path';
+
+// Simulate a served `<base href>` (or its absence) by stubbing document.querySelector + document.URL.
+function setBaseHref(href: string | null, docUrl = 'https://gw.example.com/x') {
+    (globalThis as { document?: unknown }).document = {
+        URL: docUrl,
+        querySelector: (sel: string) =>
+            sel === 'base[href]' && href ? ({ href: new URL(href, docUrl).href } as unknown) : null,
+    };
+}
+
+const MOUNT = '/tenants/05948c_5ed5f4/apps/furniture-catalog/versions/20260620T064257113Z/app';
+
+describe('mount basename helpers', () => {
+    afterEach(() => {
+        delete (globalThis as { document?: unknown }).document;
+    });
+
+    describe('getMountBasename', () => {
+        it('returns the base path (no trailing slash) when a deep <base href> is present', () => {
+            setBaseHref(`${MOUNT}/`);
+            expect(getMountBasename()).toBe(MOUNT);
+        });
+        it('returns "" for the Studio UI (no <base> element)', () => {
+            setBaseHref(null);
+            expect(getMountBasename()).toBe('');
+        });
+        it('returns "" for a root <base href="/">', () => {
+            setBaseHref('/');
+            expect(getMountBasename()).toBe('');
+        });
+        it('returns "" when there is no document (SSR)', () => {
+            delete (globalThis as { document?: unknown }).document;
+            expect(getMountBasename()).toBe('');
+        });
+    });
+
+    describe('withMountBasename (navigate side)', () => {
+        it('prepends the mount to an absolute app route', () => {
+            setBaseHref(`${MOUNT}/`);
+            expect(withMountBasename('/assistant')).toBe(`${MOUNT}/assistant`);
+            expect(withMountBasename('/')).toBe(`${MOUNT}/`);
+        });
+        it('does not double-prepend a path already under the mount', () => {
+            setBaseHref(`${MOUNT}/`);
+            expect(withMountBasename(`${MOUNT}/items/5`)).toBe(`${MOUNT}/items/5`);
+            expect(withMountBasename(MOUNT)).toBe(MOUNT);
+        });
+        it('leaves relative paths untouched', () => {
+            setBaseHref(`${MOUNT}/`);
+            expect(withMountBasename('assistant')).toBe('assistant');
+        });
+        it('is a no-op for the Studio UI (no mount)', () => {
+            setBaseHref(null);
+            expect(withMountBasename('/assistant')).toBe('/assistant');
+            expect(withMountBasename('/')).toBe('/');
+        });
+    });
+
+    describe('stripMountBasename (match side)', () => {
+        it('strips the mount so route patterns match app-relative', () => {
+            setBaseHref(`${MOUNT}/`);
+            expect(stripMountBasename(`${MOUNT}/assistant`)).toBe('/assistant');
+            expect(stripMountBasename(MOUNT)).toBe('/');
+            expect(stripMountBasename(`${MOUNT}/`)).toBe('/');
+        });
+        it('leaves a path not under the mount untouched', () => {
+            setBaseHref(`${MOUNT}/`);
+            expect(stripMountBasename('/somewhere-else')).toBe('/somewhere-else');
+        });
+        it('is a no-op for the Studio UI (no mount)', () => {
+            setBaseHref(null);
+            expect(stripMountBasename('/agents/123')).toBe('/agents/123');
+            expect(stripMountBasename('/')).toBe('/');
+        });
+    });
+
+    it('round-trips: strip(with(route)) === route under a mount', () => {
+        setBaseHref(`${MOUNT}/`);
+        for (const route of ['/', '/assistant', '/items/5']) {
+            expect(stripMountBasename(withMountBasename(route))).toBe(route === '/' ? '/' : route);
+        }
+        // sanity: joinPath stays available/correct
+        expect(joinPath(MOUNT, '/assistant')).toBe(`${MOUNT}/assistant`);
+    });
+});

package/src/router/path.ts

@@ -19,6 +19,44 @@ export function joinPath(path1: string, path2: string) {
     return path2;
 }
 
+/**
+ * The mount base path from an explicit `<base href>` element, or `''` when there is none.
+ *
+ * Apps served under a deep gateway mount carry `<base href="/tenants/.../app/">`, injected at serve
+ * time. The router otherwise resolves absolute routes against the origin, which collapses the URL
+ * off the mount (and breaks in-app links). This returns the base pathname without a trailing slash
+ * so {@link withMountBasename} can keep navigation under the mount and {@link stripMountBasename}
+ * can match routes app-relative. The Studio UI has no `<base>` element, so this returns `''` and
+ * every caller becomes a no-op there.
+ */
+export function getMountBasename(): string {
+    if (typeof document === 'undefined') return '';
+    const base = document.querySelector('base[href]') as HTMLBaseElement | null;
+    if (!base) return '';
+    try {
+        return new URL(base.href, document.URL).pathname.replace(/\/+$/, '');
+    } catch {
+        return '';
+    }
+}
+
+/** Prepend the mount basename to an absolute app path (no-op when no mount, path is relative, or already prefixed). */
+export function withMountBasename(path: string): string {
+    const base = getMountBasename();
+    if (!base || !path.startsWith('/')) return path;
+    if (path === base || path.startsWith(`${base}/`)) return path;
+    return joinPath(base, path);
+}
+
+/** Strip the mount basename from a browser path so route patterns match app-relative (no-op when no mount). */
+export function stripMountBasename(path: string): string {
+    const base = getMountBasename();
+    if (!base) return path;
+    if (path === base) return '/';
+    if (path.startsWith(`${base}/`)) return path.slice(base.length) || '/';
+    return path;
+}
+
 export function getPathSegments(path: string) {
     if (path === '') {
         return [];

package/src/session/UserSession.ts

@@ -5,7 +5,7 @@ import { jwtDecode } from 'jwt-decode';
 import { createContext, useContext } from 'react';
 
 import { getComposableToken } from './auth/composable';
-import { shouldRedirectToCentralAuth } from './auth/domainRouting';
+import { authReturnUrl, mountRootUrl, shouldRedirectToCentralAuth } from './auth/domainRouting';
 import { getFirebaseAuth } from './auth/firebase';
 
 import { LastSelectedAccountId_KEY, LastSelectedProjectId_KEY } from './constants';
@@ -84,6 +84,22 @@ class UserSession {
         });
     }
 
+    /**
+     * Force a fresh Vertesia JWT from STS, bypassing the in-memory cache.
+     * Use this when the current token's claims (e.g. `apps`) are suspected
+     * stale — STS recomputes the `apps` claim from ACEs on every issuance.
+     */
+    async refreshAuthToken(): Promise<AuthTokenPayload> {
+        const res = await getComposableToken(undefined, undefined, undefined, true);
+        const token = res?.rawToken;
+        if (!token) {
+            throw new Error('No token available');
+        }
+        this.authToken = jwtDecode(token) as unknown as AuthTokenPayload;
+        this.setSession?.(this.clone());
+        return this.authToken;
+    }
+
     signOut() {
         //compatibility
         this.logout();
@@ -136,8 +152,7 @@ class UserSession {
             this.client.withAuthCallback(undefined);
 
             const logoutUrl = new URL(CENTRAL_AUTH_REDIRECT);
-            const currentUrl = new URL(window.location.href);
-            currentUrl.hash = '';
+            const currentUrl = authReturnUrl();
             logoutUrl.pathname = '/logout';
             logoutUrl.searchParams.set('redirect_uri', currentUrl.toString());
             location.replace(logoutUrl.toString());
@@ -153,12 +168,13 @@ class UserSession {
             this.authToken = undefined;
             this.setSession = undefined;
             this.client.withAuthCallback(undefined);
-            // Navigate to root to avoid React rendering errors when
+            // Navigate to the app root to avoid React rendering errors when
             // unmounting deeply nested route components during logout.
-            // Only navigate if user was actually logged in to avoid
-            // infinite reload loop on fresh/incognito sessions.
+            // Use the mount root (not bare '/') so a gateway-mounted app stays
+            // on its mount. Only navigate if user was actually logged in to
+            // avoid an infinite reload loop on fresh/incognito sessions.
             if (wasLoggedIn) {
-                location.replace('/');
+                location.replace(mountRootUrl().toString());
             }
         }
     }
@@ -173,7 +189,9 @@ class UserSession {
             }
         }
 
-        window.location.replace(`/?a=${targetAccountId}`);
+        const url = mountRootUrl();
+        url.searchParams.set('a', targetAccountId);
+        window.location.replace(url.toString());
     }
 
     async switchProject(targetProjectId: string) {
@@ -181,7 +199,12 @@ class UserSession {
             localStorage.setItem(`${LastSelectedProjectId_KEY}-${this.account.id}`, targetProjectId);
         }
 
-        window.location.replace(`/?a=${this.account?.id}&p=${targetProjectId}`);
+        const url = mountRootUrl();
+        if (this.account?.id) {
+            url.searchParams.set('a', this.account.id);
+        }
+        url.searchParams.set('p', targetProjectId);
+        window.location.replace(url.toString());
     }
 
     async fetchAccounts() {

package/src/session/UserSessionProvider.tsx

@@ -2,13 +2,19 @@ import { Env } from '@vertesia/ui/env';
 import { onAuthStateChanged } from 'firebase/auth';
 import { type ReactNode, useEffect, useRef, useState } from 'react';
 import { getComposableToken, RestrictedEnvironmentError, STSError, UserNotFoundError } from './auth/composable';
-import { shouldRedirectToCentralAuth } from './auth/domainRouting';
+import { authReturnUrl, shouldRedirectToCentralAuth } from './auth/domainRouting';
 import { getFirebaseAuth } from './auth/firebase';
 import { useAuthState } from './auth/useAuthState';
 import { LastSelectedAccountId_KEY, LastSelectedProjectId_KEY, UserSession, UserSessionContext } from './UserSession';
 
 const CENTRAL_AUTH_REDIRECT = 'https://internal-auth.vertesia.app/';
 
+function clearAuthHash() {
+    const url = new URL(window.location.href);
+    url.hash = '';
+    window.history.replaceState(window.history.state, '', `${url.pathname}${url.search}`);
+}
+
 interface UserSessionProviderProps {
     children: ReactNode | ReactNode[];
     loadOnboardingStatus?: boolean;
@@ -24,8 +30,7 @@ export function UserSessionProvider({ children, loadOnboardingStatus = true }: U
 
     const redirectToCentralAuth = (projectId?: string, accountId?: string) => {
         const url = new URL(`${CENTRAL_AUTH_REDIRECT}?sts=${Env.endpoints.sts ?? 'https://sts.vertesia.io'}`);
-        const currentUrl = new URL(window.location.href);
-        currentUrl.hash = '';
+        const currentUrl = authReturnUrl();
         if (projectId) currentUrl.searchParams.set('p', projectId);
         if (accountId) currentUrl.searchParams.set('a', accountId);
         url.searchParams.set('redirect_uri', currentUrl.toString());
@@ -59,6 +64,28 @@ export function UserSessionProvider({ children, loadOnboardingStatus = true }: U
             },
         });
 
+        if (Env.isLocalDev && Env.devAuthToken) {
+            session.setSession = setSession;
+            getComposableToken(selectedAccount, selectedProject, Env.devAuthToken)
+                .then((res) => {
+                    session.login(res.rawToken).then(() => setSession(session.clone()));
+                })
+                .catch((err) => {
+                    console.error('Failed to initialize dev auth token', err);
+                    Env.logger.error('Failed to initialize dev auth token', {
+                        vertesia: {
+                            account_id: selectedAccount,
+                            project_id: selectedProject,
+                            error: err,
+                        },
+                    });
+                    session.isLoading = false;
+                    session.authError = err instanceof Error ? err : new Error(String(err));
+                    setSession(session.clone());
+                });
+            return;
+        }
+
         if (token && state) {
             session.setSession = setSession;
             const validationError = verifyState(state);
@@ -77,8 +104,7 @@ export function UserSessionProvider({ children, loadOnboardingStatus = true }: U
                 .then((res) => {
                     session.login(res.rawToken, { loadOnboardingStatus }).then(() => {
                         setSession(session.clone());
-                        //cleanup the hash
-                        window.location.hash = '';
+                        clearAuthHash();
                     });
                 })
                 .catch((err) => {
@@ -117,7 +143,7 @@ export function UserSessionProvider({ children, loadOnboardingStatus = true }: U
                         );
                         session.logout();
                         setSession(session.clone());
-                        window.location.hash = '';
+                        clearAuthHash();
                         return;
                     }
 
@@ -130,7 +156,14 @@ export function UserSessionProvider({ children, loadOnboardingStatus = true }: U
                     redirectToCentralAuth();
                 });
             return;
-        } else {
+        }
+
+        let cancelled = false;
+        let unsubscribe: (() => void) | undefined;
+
+        const startFirebaseOrCentralAuth = () => {
+            if (cancelled) return;
+
             // If the current host is not in the Firebase allowlist, central auth owns sign-in.
             if (!session.isLoggedIn()) {
                 console.log('Auth: not logged in & no token/state');
@@ -154,71 +187,114 @@ export function UserSessionProvider({ children, loadOnboardingStatus = true }: U
                     });
                     redirectToCentralAuth();
                     return; // Don't register onAuthStateChanged listener when redirecting
-                } else {
-                    console.log('Auth: host is in Firebase auth allowlist');
-                    Env.logger.info('Host is in Firebase auth allowlist', {
-                        vertesia: {
-                            account_id: selectedAccount,
-                            project_id: selectedProject,
-                        },
-                    });
                 }
-            }
-        }
 
-        return onAuthStateChanged(getFirebaseAuth(), async (firebaseUser) => {
-            if (firebaseUser) {
-                console.log('Auth: successful login with firebase');
-                Env.logger.info('Successful login with firebase', {
+                console.log('Auth: host is in Firebase auth allowlist');
+                Env.logger.info('Host is in Firebase auth allowlist', {
                     vertesia: {
                         account_id: selectedAccount,
                         project_id: selectedProject,
                     },
                 });
-                session.setSession = setSession;
-                await getComposableToken(
-                    selectedAccount,
-                    selectedProject,
-                    undefined,
-                    false,
-                    shouldRedirectToCentralAuth(),
-                )
-                    .then((res) => {
-                        session.login(res.rawToken, { loadOnboardingStatus }).then(() => setSession(session.clone()));
-                    })
-                    .catch((err) => {
-                        console.error('Failed to fetch user token from studio', err);
-                        Env.logger.error('Failed to fetch user token from studio', {
-                            vertesia: {
-                                account_id: selectedAccount,
-                                project_id: selectedProject,
-                                error: err,
-                            },
+            }
+
+            unsubscribe = onAuthStateChanged(getFirebaseAuth(), async (firebaseUser) => {
+                if (firebaseUser) {
+                    console.log('Auth: successful login with firebase');
+                    Env.logger.info('Successful login with firebase', {
+                        vertesia: {
+                            account_id: selectedAccount,
+                            project_id: selectedProject,
+                        },
+                    });
+                    session.setSession = setSession;
+                    await getComposableToken(
+                        selectedAccount,
+                        selectedProject,
+                        undefined,
+                        false,
+                        shouldRedirectToCentralAuth(),
+                    )
+                        .then((res) => {
+                            session
+                                .login(res.rawToken, { loadOnboardingStatus })
+                                .then(() => setSession(session.clone()));
+                        })
+                        .catch((err) => {
+                            console.error('Failed to fetch user token from studio', err);
+                            Env.logger.error('Failed to fetch user token from studio', {
+                                vertesia: {
+                                    account_id: selectedAccount,
+                                    project_id: selectedProject,
+                                    error: err,
+                                },
+                            });
+                            // Keep the Firebase session for UserNotFoundError (signup flow) and
+                            // RestrictedEnvironmentError (identity is valid; the environment is gated).
+                            // Logging out would retrigger onAuthStateChanged and clear the authError.
+                            if (!(err instanceof UserNotFoundError) && !(err instanceof RestrictedEnvironmentError)) {
+                                session.logout();
+                            }
+                            session.isLoading = false;
+                            session.authError = err;
+                            setSession(session.clone());
                         });
-                        // Keep the Firebase session for UserNotFoundError (signup flow) and
-                        // RestrictedEnvironmentError (identity is valid; the environment is gated).
-                        // Logging out would retrigger onAuthStateChanged and clear the authError.
-                        if (!(err instanceof UserNotFoundError) && !(err instanceof RestrictedEnvironmentError)) {
-                            session.logout();
-                        }
-                        session.isLoading = false;
-                        session.authError = err;
-                        setSession(session.clone());
+                } else {
+                    // anonymous user
+                    console.log('Auth: using anonymous user');
+                    Env.logger.info('Using anonymous user', {
+                        vertesia: {
+                            account_id: selectedAccount,
+                            project_id: selectedProject,
+                        },
                     });
-            } else {
-                // anonymous user
-                console.log('Auth: using anonymous user');
-                Env.logger.info('Using anonymous user', {
-                    vertesia: {
-                        account_id: selectedAccount,
-                        project_id: selectedProject,
-                    },
+                    session.client.withAuthCallback(undefined);
+                    session.logout();
+                    setSession(session.clone());
+                }
+            });
+        };
+
+        if (Env.authTokenProvider) {
+            session.setSession = setSession;
+            void Env.authTokenProvider()
+                .then(async (injectedToken) => {
+                    if (!injectedToken) {
+                        startFirebaseOrCentralAuth();
+                        return;
+                    }
+                    const res = await getComposableToken(
+                        selectedAccount,
+                        selectedProject,
+                        injectedToken,
+                        false,
+                        shouldRedirectToCentralAuth(),
+                    );
+                    await session.login(res.rawToken, { loadOnboardingStatus });
+                    if (!cancelled) setSession(session.clone());
+                })
+                .catch((err: unknown) => {
+                    console.warn('Auth: failed to initialize injected auth token', err);
+                    Env.logger.warn('Failed to initialize injected auth token', {
+                        vertesia: {
+                            account_id: selectedAccount,
+                            project_id: selectedProject,
+                            error: err,
+                        },
+                    });
+                    startFirebaseOrCentralAuth();
                 });
-                session.client.withAuthCallback(undefined);
-                session.logout();
-                setSession(session.clone());
-            }
-        });
+            return () => {
+                cancelled = true;
+                unsubscribe?.();
+            };
+        }
+
+        startFirebaseOrCentralAuth();
+        return () => {
+            cancelled = true;
+            unsubscribe?.();
+        };
     };
 
     useEffect(() => {

package/src/session/auth/composable.test.ts

@@ -0,0 +1,111 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+function makeJwt(payload: Record<string, unknown>) {
+    const encode = (value: unknown) => Buffer.from(JSON.stringify(value)).toString('base64url');
+    return `${encode({ alg: 'ES256', typ: 'JWT' })}.${encode(payload)}.signature`;
+}
+
+async function importComposableAuth() {
+    vi.resetModules();
+    const [{ Env }, composableAuth] = await Promise.all([import('@vertesia/ui/env'), import('./composable')]);
+    Env.init({
+        name: 'test',
+        version: '0.0.0',
+        isLocalDev: false,
+        isDocker: false,
+        type: 'test',
+        endpoints: {
+            studio: 'https://studio-server-dev-feat-appgen.api.dev1.vertesia.io',
+            zeno: 'https://zeno-server-dev-feat-appgen.api.dev1.vertesia.io',
+            sts: 'https://sts.dev1.vertesia.io',
+        },
+    });
+    return composableAuth;
+}
+
+describe('getComposableToken', () => {
+    beforeEach(() => {
+        localStorage.clear();
+    });
+
+    afterEach(() => {
+        vi.unstubAllGlobals();
+    });
+
+    it('uses an authorization-bearing STS-issued Vertesia token directly instead of exchanging it', async () => {
+        const token = makeJwt({
+            iss: 'https://sts.dev1.vertesia.io',
+            exp: Math.floor(Date.now() / 1000) + 3600,
+            account: { id: 'account-id', name: 'Account' },
+            account_roles: [],
+            project: { id: 'project-id', name: 'Project', account: 'account-id' },
+            project_roles: ['developer'],
+        });
+        const fetchMock = vi.fn();
+        vi.stubGlobal('fetch', fetchMock);
+
+        const { getComposableToken } = await importComposableAuth();
+        const result = await getComposableToken('account-id', 'project-id', token, false, true);
+
+        expect(result.rawToken).toBe(token);
+        expect(result.token.iss).toBe('https://sts.dev1.vertesia.io');
+        expect(fetchMock).not.toHaveBeenCalled();
+    });
+
+    it('exchanges a bare STS-issued Vertesia token so roles can be hydrated', async () => {
+        const sourceToken = makeJwt({
+            iss: 'https://sts.dev1.vertesia.io',
+            exp: Math.floor(Date.now() / 1000) + 3600,
+            account: { id: 'account-id', name: 'Account' },
+            project: { id: 'project-id', name: 'Project', account: 'account-id' },
+        });
+        const exchangedToken = makeJwt({
+            iss: 'https://sts.dev1.vertesia.io',
+            exp: Math.floor(Date.now() / 1000) + 3600,
+            account: { id: 'account-id', name: 'Account' },
+            account_roles: [],
+            project: { id: 'project-id', name: 'Project', account: 'account-id' },
+            project_roles: ['admin'],
+        });
+        const fetchMock = vi.fn().mockResolvedValue({
+            ok: true,
+            status: 200,
+            json: () => Promise.resolve({ token: exchangedToken }),
+        });
+        vi.stubGlobal('fetch', fetchMock);
+
+        const { getComposableToken } = await importComposableAuth();
+        const result = await getComposableToken('account-id', 'project-id', sourceToken, false, true);
+
+        expect(result.rawToken).toBe(exchangedToken);
+        expect(fetchMock).toHaveBeenCalledOnce();
+        expect(fetchMock.mock.calls[0]?.[0]?.toString()).toBe('https://sts.dev1.vertesia.io/token/issue');
+    });
+
+    it('still exchanges a non-STS source token', async () => {
+        const sourceToken = makeJwt({
+            iss: 'https://securetoken.google.com/example',
+            exp: Math.floor(Date.now() / 1000) + 3600,
+            email: 'user@example.com',
+        });
+        const exchangedToken = makeJwt({
+            iss: 'https://sts.dev1.vertesia.io',
+            exp: Math.floor(Date.now() / 1000) + 3600,
+            account: { id: 'account-id', name: 'Account' },
+            project: { id: 'project-id', name: 'Project', account: 'account-id' },
+        });
+        const fetchMock = vi.fn().mockResolvedValue({
+            ok: true,
+            status: 200,
+            json: () => Promise.resolve({ token: exchangedToken }),
+        });
+        vi.stubGlobal('fetch', fetchMock);
+
+        const { getComposableToken } = await importComposableAuth();
+        const result = await getComposableToken('account-id', 'project-id', sourceToken, false, true);
+
+        expect(result.rawToken).toBe(exchangedToken);
+        expect(fetchMock).toHaveBeenCalledOnce();
+        expect(fetchMock.mock.calls[0]?.[0]?.toString()).toBe('https://sts.dev1.vertesia.io/token/issue');
+    });
+});