@vertesia/ui 1.5.0-dev.20260713.151751Z → 1.5.0-dev.20260717.131047Z

package/src/session/auth/composable.ts

@@ -17,6 +17,44 @@ interface ComposableTokenResponse {
     message?: string;
 }
 
+function normalizeIssuer(value: string | undefined): string | undefined {
+    return value?.replace(/\/+$/, '');
+}
+
+function decodeToken(token: string): AuthTokenPayload {
+    return jwtDecode(token) as AuthTokenPayload;
+}
+
+function isVertesiaIssuedToken(token: string | undefined): token is string {
+    if (!token) return false;
+    try {
+        const decoded = decodeToken(token) as AuthTokenPayload & { iss?: string };
+        return normalizeIssuer(decoded.iss) === normalizeIssuer(Env.endpoints.sts);
+    } catch {
+        return false;
+    }
+}
+
+function canUseVertesiaTokenDirectly(token: string, accountId?: string, projectId?: string): boolean {
+    const decoded = decodeToken(token);
+    const hasAuthorizationClaims = Boolean(
+        decoded.permissions?.length ||
+            decoded.account_roles?.length ||
+            decoded.project_roles?.length ||
+            decoded.apps?.length,
+    );
+    if (!hasAuthorizationClaims) {
+        return false;
+    }
+    if (accountId && decoded.account?.id !== accountId) {
+        return false;
+    }
+    if (projectId && decoded.project?.id !== projectId) {
+        return false;
+    }
+    return true;
+}
+
 export async function fetchComposableToken(
     getIdToken: () => Promise<string | null | undefined>,
     accountId?: string,
@@ -319,23 +357,40 @@ export async function getComposableToken(
     const selectedAccount = accountId ?? localStorage.getItem(LastSelectedAccountId_KEY) ?? undefined;
     const selectedProject =
         projectId ?? localStorage.getItem(`${LastSelectedProjectId_KEY}-${selectedAccount}`) ?? undefined;
+    const devAuthToken = Env.isLocalDev ? Env.devAuthToken : undefined;
+    const suppliedToken = devAuthToken ?? initToken ?? AUTH_TOKEN_RAW;
 
     //token is still valid for more than 5 minutes
     if (!forceRefresh && AUTH_TOKEN_RAW && AUTH_TOKEN && AUTH_TOKEN.exp > Date.now() / 1000 + 300) {
         return { rawToken: AUTH_TOKEN_RAW, token: AUTH_TOKEN, error: false };
     }
 
+    if (
+        !forceRefresh &&
+        isVertesiaIssuedToken(suppliedToken) &&
+        canUseVertesiaTokenDirectly(suppliedToken, selectedAccount, selectedProject)
+    ) {
+        AUTH_TOKEN_RAW = suppliedToken;
+        AUTH_TOKEN = decodeToken(AUTH_TOKEN_RAW);
+        if (!AUTH_TOKEN.exp) {
+            throw new Error('Invalid composable token');
+        }
+        return { rawToken: AUTH_TOKEN_RAW, token: AUTH_TOKEN, error: false };
+    }
+
     //token is close to expire, refresh it
-    if (!useInternalAuth && getFirebaseAuth().currentUser) {
+    if (!devAuthToken && !useInternalAuth && getFirebaseAuth().currentUser) {
         //we have a firebase user, get the token from there
         AUTH_TOKEN_RAW = await fetchComposableTokenFromFirebaseToken(selectedAccount, selectedProject);
-    } else if (initToken || AUTH_TOKEN_RAW) {
+    } else if (!devAuthToken && (initToken || AUTH_TOKEN_RAW)) {
         // we have a token already and no firebase user, refresh it
         AUTH_TOKEN_RAW = await fetchComposableToken(
             () => Promise.resolve(initToken ?? AUTH_TOKEN_RAW),
             selectedAccount,
             selectedProject,
         );
+    } else if (devAuthToken) {
+        AUTH_TOKEN_RAW = devAuthToken;
     }
 
     if (!AUTH_TOKEN_RAW) {
@@ -348,7 +403,7 @@ export async function getComposableToken(
         throw new Error('Cannot acquire a composable token');
     }
 
-    AUTH_TOKEN = jwtDecode(AUTH_TOKEN_RAW) as AuthTokenPayload;
+    AUTH_TOKEN = decodeToken(AUTH_TOKEN_RAW);
 
     if (!AUTH_TOKEN?.exp || !AUTH_TOKEN_RAW) {
         console.error('Invalid composable token', AUTH_TOKEN);

package/src/session/auth/domainRouting.test.ts

@@ -1,9 +1,15 @@
 import { afterEach, describe, expect, it } from 'vitest';
-import { shouldRedirectToCentralAuth, shouldUseFirebaseAuth } from './domainRouting';
+import { mountRootUrl, shouldRedirectToCentralAuth, shouldUseFirebaseAuth } from './domainRouting';
+
+// Stub document.baseURI to simulate the served `<base href>` (deep gateway mount) or its absence.
+function setBaseURI(baseURI: string) {
+    (globalThis as { document?: unknown }).document = { baseURI };
+}
 
 describe('domainRouting', () => {
     afterEach(() => {
         delete (globalThis as { window?: unknown }).window;
+        delete (globalThis as { document?: unknown }).document;
     });
 
     it("uses Firebase auth when AUTH_MODE is 'firebase'", () => {
@@ -23,4 +29,25 @@ describe('domainRouting', () => {
         expect(shouldUseFirebaseAuth()).toBe(false);
         expect(shouldRedirectToCentralAuth()).toBe(true);
     });
+
+    describe('mountRootUrl', () => {
+        it('returns the deep gateway mount root (dropping any deep route / query / hash)', () => {
+            const mount = 'https://gw.example.com/tenants/05948c_5ed5f4/apps/furniture-catalog/versions/v1/app/';
+            setBaseURI(mount);
+            expect(mountRootUrl().toString()).toBe(mount);
+        });
+
+        it('strips an existing query and hash so callers control the reload target', () => {
+            setBaseURI('https://gw.example.com/tenants/t/apps/a/versions/v/app/');
+            const url = mountRootUrl();
+            url.searchParams.set('a', 'acct1');
+            url.searchParams.set('p', 'proj1');
+            expect(url.toString()).toBe('https://gw.example.com/tenants/t/apps/a/versions/v/app/?a=acct1&p=proj1');
+        });
+
+        it('is the origin root for the Studio UI (no <base> element)', () => {
+            setBaseURI('https://studio.vertesia.io/');
+            expect(mountRootUrl().toString()).toBe('https://studio.vertesia.io/');
+        });
+    });
 });

package/src/session/auth/domainRouting.ts

@@ -11,3 +11,41 @@ export function shouldUseFirebaseAuth(_hostname?: string) {
 export function shouldRedirectToCentralAuth(_hostname?: string) {
     return !shouldUseFirebaseAuth();
 }
+
+/**
+ * The page URL to return to after a central-auth round-trip (`redirect_uri`).
+ *
+ * Apps served under a deep gateway mount carry a `<base href="/tenants/<t>/apps/<app>/.../app/">`
+ * that the app-gateway injects at serve time. The in-app router rewrites the address bar relative
+ * to the origin rather than that mount, so by the time the auth flow runs `window.location` can
+ * read as the bare origin `/`. Building `redirect_uri` from that drops the app path, and the
+ * post-login token bounces back to a URL that serves no app.
+ *
+ * Prefer the live location when it still sits under the mount (preserves the in-app deep route);
+ * otherwise fall back to `document.baseURI` — the mount, which the router cannot clobber. With no
+ * `<base>` element (the Studio UI), `document.baseURI` is the document URL and its `pathname` is a
+ * prefix of the live location, so the live URL is used unchanged — no behavior change there.
+ */
+export function authReturnUrl(): URL {
+    const base = new URL(document.baseURI);
+    const current = new URL(window.location.href);
+    const target = current.pathname.startsWith(base.pathname) ? current : base;
+    target.hash = '';
+    return target;
+}
+
+/**
+ * The app's mount root URL — the served `<base href>` (or the origin root for the Studio UI).
+ *
+ * Used for full-reload navigations that intentionally reset to the app root (logout, account /
+ * project switch). Building these from a bare `/` drops a gateway-mounted app off its mount and
+ * lands on a URL that serves no app; resolving against `document.baseURI` keeps the reload inside
+ * the mount. For the Studio UI (no `<base>` element) `document.baseURI` is the origin root, so the
+ * behavior is unchanged.
+ */
+export function mountRootUrl(): URL {
+    const url = new URL(document.baseURI);
+    url.hash = '';
+    url.search = '';
+    return url;
+}

package/src/shell/login/SignInRestrictedEnvStep.tsx

@@ -15,7 +15,7 @@ interface SignInRestrictedEnvStepProps {
 const AUTO_REDIRECT_SECONDS = 15;
 
 /**
- * Shown when the STS rejects sign-in because the current environment (preview/preprod) is
+ * Shown when the STS rejects sign-in because the current environment (any non-production tier) is
  * restricted to early-access users. Offers a redirect to the production web application — in the
  * user's own region — and a way to sign in with a different account. If the user takes no action, it
  * redirects automatically after {@link AUTO_REDIRECT_SECONDS}. See

package/src/shell/login/SigninScreen.tsx

@@ -89,7 +89,15 @@ function SigninScreenImpl({
 
     useEffect(() => {
         if (!preservePath) {
-            history.replaceState({}, '', '/');
+            // Reset to the app's mount root, not the bare origin. A gateway-mounted app carries a
+            // served `<base href>` deep mount; collapsing to '/' drops the app off that mount (the
+            // bare origin serves no app) and the address bar can no longer be reloaded. This effect
+            // also flashes briefly for already-authenticated users during the loading transition, so
+            // a bare '/' here loses the URL even on a normal login. Deriving the root from
+            // `document.baseURI` keeps it inside the mount; for the origin-served Studio UI the
+            // pathname is '/', so the behavior is unchanged.
+            const mountRoot = new URL(document.baseURI).pathname || '/';
+            history.replaceState({}, '', mountRoot);
         }
     }, [preservePath]);
 

package/src/shell/login/productionUrl.test.ts

@@ -2,17 +2,20 @@ import { describe, expect, it } from 'vitest';
 import { getProductionAppUrl } from './productionUrl.js';
 
 describe('getProductionAppUrl', () => {
-    it('sends a non-US region to its own regional production site', () => {
+    it('sends every production region to its regional site (one cloud.{region} pattern)', () => {
+        // us1 is not special-cased — it uses the same regional pattern as every other region.
+        expect(getProductionAppUrl('us1')).toBe('https://cloud.us1.vertesia.io/');
+        expect(getProductionAppUrl('us2')).toBe('https://cloud.us2.vertesia.io/');
         expect(getProductionAppUrl('eu1')).toBe('https://cloud.eu1.vertesia.io/');
         expect(getProductionAppUrl('jp1')).toBe('https://cloud.jp1.vertesia.io/');
     });
 
-    it('sends US regions to the canonical non-regional production site', () => {
-        expect(getProductionAppUrl('us1')).toBe('https://cloud.vertesia.io/');
-        expect(getProductionAppUrl('us')).toBe('https://cloud.vertesia.io/');
+    it('sends a dev region to the production region it mirrors, not the dev host', () => {
+        // dev1 mirrors us1: a rejected user must land on production, never back on cloud.dev1.
+        expect(getProductionAppUrl('dev1')).toBe('https://cloud.us1.vertesia.io/');
     });
 
-    it('falls back to the canonical production site when the region is unknown', () => {
+    it('falls back to the canonical non-regional site when the region is unknown', () => {
         expect(getProductionAppUrl(undefined)).toBe('https://cloud.vertesia.io/');
         expect(getProductionAppUrl('')).toBe('https://cloud.vertesia.io/');
     });

package/src/shell/login/productionUrl.ts

@@ -4,15 +4,25 @@
  * they do have access — in their own region, never another one (an EU user must not land on the US
  * site, and vice versa).
  *
- * The mapping mirrors the server's `detectUiUrl` production branch (packages/server-common):
- *   - US (`us` / `us1`) or unknown region → `https://cloud.vertesia.io/` (canonical, non-regional)
- *   - any other region (e.g. `eu1`, `jp1`)  → `https://cloud.{region}.vertesia.io/`
+ * Every production region follows one URL pattern — `https://cloud.{region}.vertesia.io/` (e.g.
+ * `us1`, `us2`, `eu1`, `jp1`) — with no region special-cased. Only the legacy non-regional
+ * deployment has no region and falls back to the apex `https://cloud.vertesia.io/`.
+ *
+ * Dev/ephemeral regions have no production site of their own — they mirror a production region — so
+ * they are mapped to it first. Sending a rejected user to the dev host (e.g. `cloud.dev1.vertesia.io`)
+ * would just bounce them back to the same restricted environment. `dev1` (us-central1) mirrors the
+ * `us1` production region.
  *
  * Region is preferred over parsing the current hostname because it is well-defined for every serving
  * pattern (including the direct-routing `*.ui.{region}.vertesia.io` hosts, which carry no
  * `preview.`/`preprod.` prefix to strip). Callers pass `Env.region` from `@vertesia/ui/env`.
  */
+const DEV_REGION_TO_PRODUCTION_REGION: Record<string, string> = {
+    // dev1 (us-central1) is a dev mirror of the us1 production region.
+    dev1: 'us1',
+};
+
 export function getProductionAppUrl(region?: string): string {
-    const isNonUsRegion = region && region !== 'us' && region !== 'us1';
-    return isNonUsRegion ? `https://cloud.${region}.vertesia.io/` : 'https://cloud.vertesia.io/';
+    const prodRegion = (region && DEV_REGION_TO_PRODUCTION_REGION[region]) || region;
+    return prodRegion ? `https://cloud.${prodRegion}.vertesia.io/` : 'https://cloud.vertesia.io/';
 }