@vertesia/ui 1.5.0-dev.20260725.083715Z → 1.5.0-dev.20260806.125520Z

package/src/i18n/locales/zh-TW.json

@@ -160,7 +160,7 @@
   "agent.rewind.jumpToLatest": "跳到最新訊息",
   "agent.rewind.jumpToLive": "跳到即時",
   "agent.rewind.jumpToStart": "跳到第一則訊息",
-  "agent.rewind.label": "重播",
+  "agent.rewind.label": "偵錯",
   "agent.rewind.nextMessage": "下一則訊息",
   "agent.rewind.pause": "暫停",
   "agent.rewind.positionInput": "播放位置",
@@ -192,6 +192,7 @@
   "agent.summary": "摘要",
   "agent.taskProgress": "任務進度",
   "agent.tasksCompleted": "{{completed}}/{{total}} 已完成",
+  "agent.thinking": "思考中...",
   "agent.timeout": "已逾時",
   "agent.toggleRightSidebar": "切換右側邊欄",
   "agent.typeYourMessage": "輸入訊息...",
@@ -243,6 +244,31 @@
   "auth.providers.bodyConsumer": "請從下方提供者中選擇一個繼續。",
   "auth.providers.eyebrow": "選擇登入方式",
   "auth.providers.title": "再一步",
+    "auth.recovery.continue": "繼續前往 Vertesia",
+    "auth.recovery.credential.body": "無法驗證您的登入資訊。請重新登入以繼續。",
+    "auth.recovery.credential.eyebrow": "需要登入",
+    "auth.recovery.credential.title": "無法驗證您的登入資訊",
+    "auth.recovery.errorCode": "錯誤代碼",
+    "auth.recovery.errorMessage": "錯誤訊息",
+    "auth.recovery.httpStatus": "HTTP 狀態",
+    "auth.recovery.noAccessibleAccount.body": "您已登入，但此身分沒有可用的 Vertesia 帳戶。",
+    "auth.recovery.noAccessibleAccount.eyebrow": "需要帳戶",
+    "auth.recovery.noAccessibleAccount.title": "沒有可用帳戶",
+    "auth.recovery.requestedAccount": "要求的帳戶",
+    "auth.recovery.requestedProject": "要求的專案",
+    "auth.recovery.scopeAccount.body": "您已登入，但此連結中的帳戶無法使用。連結可能已過期，或您沒有存取權限。",
+    "auth.recovery.scopeAccount.eyebrow": "連結無法使用",
+    "auth.recovery.scopeAccount.title": "帳戶無法使用",
+    "auth.recovery.scopeProject.body": "您已登入，但此連結中的專案無法使用。連結可能已過期，或您沒有存取權限。",
+    "auth.recovery.scopeProject.eyebrow": "連結無法使用",
+    "auth.recovery.scopeProject.title": "專案無法使用",
+    "auth.recovery.service.body": "驗證服務暫時無法使用。請重試或使用其他帳戶。",
+    "auth.recovery.service.eyebrow": "服務無法使用",
+    "auth.recovery.service.title": "無法完成登入",
+    "auth.recovery.supportPrefix": "如需協助，請聯絡",
+    "auth.recovery.technicalDetails": "技術詳細資料",
+    "auth.recovery.tryAgain": "重試",
+    "auth.recovery.useDifferentAccount": "使用其他帳戶",
   "auth.restricted.autoRedirect": "{{seconds}} 秒後前往主網站…",
   "auth.restricted.body": "本網站僅限擁有新功能和修復搶先體驗權限的使用者使用。請繼續前往主網站，或就此網站的搶先體驗事宜聯絡 Vertesia。",
   "auth.restricted.calloutMeta": "聯絡 Vertesia 取得搶先體驗權限",

package/src/i18n/locales/zh.json

@@ -160,7 +160,7 @@
   "agent.rewind.jumpToLatest": "跳到最新消息",
   "agent.rewind.jumpToLive": "跳到实时",
   "agent.rewind.jumpToStart": "跳到第一条消息",
-  "agent.rewind.label": "回放",
+  "agent.rewind.label": "调试",
   "agent.rewind.nextMessage": "下一条消息",
   "agent.rewind.pause": "暂停",
   "agent.rewind.positionInput": "播放位置",
@@ -192,6 +192,7 @@
   "agent.summary": "摘要",
   "agent.taskProgress": "任务进度",
   "agent.tasksCompleted": "{{completed}}/{{total}} 已完成",
+  "agent.thinking": "思考中...",
   "agent.timeout": "已超时",
   "agent.toggleRightSidebar": "切换右侧边栏",
   "agent.typeYourMessage": "输入消息...",
@@ -243,6 +244,31 @@
   "auth.providers.bodyConsumer": "请从下方提供商中选择一个继续。",
   "auth.providers.eyebrow": "选择登录方式",
   "auth.providers.title": "再一步",
+    "auth.recovery.continue": "继续前往 Vertesia",
+    "auth.recovery.credential.body": "无法验证您的登录信息。请重新登录以继续。",
+    "auth.recovery.credential.eyebrow": "需要登录",
+    "auth.recovery.credential.title": "无法验证您的登录信息",
+    "auth.recovery.errorCode": "错误代码",
+    "auth.recovery.errorMessage": "错误消息",
+    "auth.recovery.httpStatus": "HTTP 状态",
+    "auth.recovery.noAccessibleAccount.body": "您已登录，但此身份没有可用的 Vertesia 账户。",
+    "auth.recovery.noAccessibleAccount.eyebrow": "需要账户",
+    "auth.recovery.noAccessibleAccount.title": "没有可用账户",
+    "auth.recovery.requestedAccount": "请求的账户",
+    "auth.recovery.requestedProject": "请求的项目",
+    "auth.recovery.scopeAccount.body": "您已登录，但此链接中的账户不可用。链接可能已过期，或者您没有访问权限。",
+    "auth.recovery.scopeAccount.eyebrow": "链接不可用",
+    "auth.recovery.scopeAccount.title": "账户不可用",
+    "auth.recovery.scopeProject.body": "您已登录，但此链接中的项目不可用。链接可能已过期，或者您没有访问权限。",
+    "auth.recovery.scopeProject.eyebrow": "链接不可用",
+    "auth.recovery.scopeProject.title": "项目不可用",
+    "auth.recovery.service.body": "身份验证服务暂时不可用。请重试或使用其他账户。",
+    "auth.recovery.service.eyebrow": "服务不可用",
+    "auth.recovery.service.title": "无法完成登录",
+    "auth.recovery.supportPrefix": "如需帮助，请联系",
+    "auth.recovery.technicalDetails": "技术详情",
+    "auth.recovery.tryAgain": "重试",
+    "auth.recovery.useDifferentAccount": "使用其他账户",
   "auth.restricted.autoRedirect": "{{seconds}} 秒后前往主站点…",
   "auth.restricted.body": "本站点仅限拥有新功能和修复抢先体验权限的用户使用。请继续前往主站点，或就此站点的抢先体验事宜联系 Vertesia。",
   "auth.restricted.calloutMeta": "联系 Vertesia 获取抢先体验权限",

package/src/session/UserSessionProvider.test.ts

@@ -0,0 +1,69 @@
+import { describe, expect, it } from 'vitest';
+import { RequestedScopeUnavailableError } from './auth/composable';
+import { sanitizeRejectedScopeUrl } from './UserSessionProvider';
+
+describe('sanitizeRejectedScopeUrl', () => {
+    it.each([
+        {
+            name: 'an account/project pair',
+            input: 'https://app.example.test/studio/dashboard?a=apple&p=banana&tab=runs',
+            accountId: 'apple',
+            projectId: 'banana',
+            expected: 'https://app.example.test/studio/dashboard?tab=runs',
+            scope: 'project',
+        },
+        {
+            name: 'a project-only selector',
+            input: 'https://app.example.test/studio/dashboard?p=banana&tab=runs',
+            accountId: undefined,
+            projectId: 'banana',
+            expected: 'https://app.example.test/studio/dashboard?tab=runs',
+            scope: 'project',
+        },
+        {
+            name: 'an account-only selector',
+            input: 'https://app.example.test/studio/dashboard?a=apple&tab=runs',
+            accountId: 'apple',
+            projectId: undefined,
+            expected: 'https://app.example.test/studio/dashboard?tab=runs',
+            scope: 'account',
+        },
+    ])('removes $name while preserving the path and unrelated parameters', (testCase) => {
+        const error = new RequestedScopeUnavailableError(
+            'https://sts.example.test',
+            testCase.accountId,
+            testCase.projectId,
+        );
+
+        const result = sanitizeRejectedScopeUrl(new URL(testCase.input), error);
+
+        expect(result.toString()).toBe(testCase.expected);
+        expect(error.recoveryUrl).toBe(testCase.expected);
+        expect(error.requestedScope).toBe(testCase.scope);
+        expect(error.selectorSource).toBe('url');
+    });
+
+    it('clears central-auth state while preserving unrelated query parameters', () => {
+        const error = new RequestedScopeUnavailableError('https://sts.example.test', 'apple', 'banana');
+
+        const result = sanitizeRejectedScopeUrl(
+            new URL('https://app.example.test/deep/path?a=apple&p=banana&view=grid#token=secret&state=opaque'),
+            error,
+            true,
+        );
+
+        expect(result.toString()).toBe('https://app.example.test/deep/path?view=grid');
+        expect(error.recoveryUrl).not.toContain('secret');
+    });
+
+    it('marks a matching persisted-only selection without removing unrelated URL state', () => {
+        const error = new RequestedScopeUnavailableError('https://sts.example.test', 'stored-a', 'stored-p');
+        const input = new URL('https://app.example.test/deep/path?view=grid');
+
+        const result = sanitizeRejectedScopeUrl(input, error);
+
+        expect(result.toString()).toBe(input.toString());
+        expect(error.selectorSource).toBe('persisted');
+        expect(error.requestedScope).toBe('project');
+    });
+});

package/src/session/UserSessionProvider.tsx

@@ -1,11 +1,21 @@
+import { REQUESTED_SCOPE_UNAVAILABLE_ERROR_CODE } from '@vertesia/common';
 import { Env } from '@vertesia/ui/env';
 import { onAuthStateChanged } from 'firebase/auth';
 import { type ReactNode, useEffect, useRef, useState } from 'react';
-import { getComposableToken, RestrictedEnvironmentError, STSError, UserNotFoundError } from './auth/composable';
+import {
+    AuthenticationServiceError,
+    CredentialError,
+    getComposableToken,
+    NoAccessibleAccountError,
+    RequestedScopeUnavailableError,
+    RestrictedEnvironmentError,
+    resolveAuthSelection,
+    UserNotFoundError,
+} from './auth/composable';
 import { authReturnUrl, shouldRedirectToCentralAuth } from './auth/domainRouting';
 import { getFirebaseAuth } from './auth/firebase';
 import { useAuthState } from './auth/useAuthState';
-import { LastSelectedAccountId_KEY, LastSelectedProjectId_KEY, UserSession, UserSessionContext } from './UserSession';
+import { UserSession, UserSessionContext } from './UserSession';
 
 const CENTRAL_AUTH_REDIRECT = 'https://internal-auth.vertesia.app/';
 
@@ -15,6 +25,38 @@ function clearAuthHash() {
     window.history.replaceState(window.history.state, '', `${url.pathname}${url.search}`);
 }
 
+export function sanitizeRejectedScopeUrl(
+    currentUrl: URL,
+    error: RequestedScopeUnavailableError,
+    clearHash = false,
+): URL {
+    const sanitizedUrl = new URL(currentUrl);
+    const urlAccountId = sanitizedUrl.searchParams.get('a') ?? undefined;
+    const urlProjectId = sanitizedUrl.searchParams.get('p') ?? undefined;
+
+    if (urlAccountId && urlProjectId && urlAccountId === error.accountId && urlProjectId === error.projectId) {
+        sanitizedUrl.searchParams.delete('a');
+        sanitizedUrl.searchParams.delete('p');
+        error.requestedScope = 'project';
+        error.selectorSource = 'url';
+    } else if (urlProjectId && urlProjectId === error.projectId) {
+        sanitizedUrl.searchParams.delete('p');
+        error.requestedScope = 'project';
+        error.selectorSource = 'url';
+    } else if (urlAccountId && urlAccountId === error.accountId) {
+        sanitizedUrl.searchParams.delete('a');
+        error.requestedScope = 'account';
+        error.selectorSource = 'url';
+    } else {
+        error.requestedScope = error.projectId ? 'project' : 'account';
+        error.selectorSource = 'persisted';
+    }
+
+    if (clearHash) sanitizedUrl.hash = '';
+    error.recoveryUrl = sanitizedUrl.toString();
+    return sanitizedUrl;
+}
+
 interface UserSessionProviderProps {
     children: ReactNode | ReactNode[];
     loadOnboardingStatus?: boolean;
@@ -28,6 +70,46 @@ export function UserSessionProvider({ children, loadOnboardingStatus = true }: U
     const hasInitiatedAuthRef = useRef(false);
     const authFlowRef = useRef<(() => undefined | (() => void)) | undefined>(undefined);
 
+    const clearRejectedUrlScope = (error: RequestedScopeUnavailableError, clearHash = false) => {
+        const sanitizedUrl = sanitizeRejectedScopeUrl(new URL(window.location.href), error, clearHash);
+        window.history.replaceState(window.history.state, '', sanitizedUrl);
+        Env.logger.warn('Sanitized an unavailable authentication scope', {
+            vertesia: {
+                account_id: error.accountId,
+                project_id: error.projectId,
+                error_code: REQUESTED_SCOPE_UNAVAILABLE_ERROR_CODE,
+                selector_source: error.selectorSource,
+                requested_scope: error.requestedScope,
+                recovery_action: 'url_sanitized',
+            },
+        });
+    };
+
+    const surfaceAuthError = (error: unknown, clearHash = false): boolean => {
+        if (
+            !(
+                error instanceof RequestedScopeUnavailableError ||
+                error instanceof NoAccessibleAccountError ||
+                error instanceof CredentialError ||
+                error instanceof AuthenticationServiceError ||
+                error instanceof UserNotFoundError ||
+                error instanceof RestrictedEnvironmentError
+            )
+        ) {
+            return false;
+        }
+
+        if (error instanceof RequestedScopeUnavailableError) {
+            clearRejectedUrlScope(error, clearHash);
+        } else if (clearHash) {
+            clearAuthHash();
+        }
+        session.isLoading = false;
+        session.authError = error;
+        setSession(session.clone());
+        return true;
+    };
+
     const redirectToCentralAuth = (projectId?: string, accountId?: string) => {
         const url = new URL(`${CENTRAL_AUTH_REDIRECT}?sts=${Env.endpoints.sts ?? 'https://sts.vertesia.io'}`);
         const currentUrl = authReturnUrl();
@@ -49,12 +131,7 @@ export function UserSessionProvider({ children, loadOnboardingStatus = true }: U
         console.log('Auth: starting auth flow');
         Env.logger.info('Starting auth flow');
         const currentUrl = new URL(window.location.href);
-        const selectedAccount =
-            currentUrl.searchParams.get('a') ?? localStorage.getItem(LastSelectedAccountId_KEY) ?? undefined;
-        const selectedProject =
-            currentUrl.searchParams.get('p') ??
-            localStorage.getItem(`${LastSelectedProjectId_KEY}-${selectedAccount}`) ??
-            undefined;
+        const { accountId: selectedAccount, projectId: selectedProject } = resolveAuthSelection(currentUrl);
         console.log('Auth: selected account', selectedAccount);
         console.log('Auth: selected project', selectedProject);
         Env.logger.info('Selected account and project', {
@@ -71,6 +148,7 @@ export function UserSessionProvider({ children, loadOnboardingStatus = true }: U
                     session.login(res.rawToken).then(() => setSession(session.clone()));
                 })
                 .catch((err) => {
+                    if (surfaceAuthError(err)) return;
                     console.error('Failed to initialize dev auth token', err);
                     Env.logger.error('Failed to initialize dev auth token', {
                         vertesia: {
@@ -108,44 +186,7 @@ export function UserSessionProvider({ children, loadOnboardingStatus = true }: U
                     });
                 })
                 .catch((err) => {
-                    // Don't redirect to central auth for UserNotFoundError - let signup flow handle it
-                    if (err instanceof UserNotFoundError) {
-                        console.log('User not found - will trigger signup flow', err);
-                        session.isLoading = false;
-                        session.authError = err;
-                        setSession(session.clone());
-                        return;
-                    }
-
-                    // Restricted environment (preview/preprod without early-access): surface the
-                    // error so the sign-in screen shows the dedicated step. Redirecting to central
-                    // auth here would loop, since the identity is valid but the environment is gated.
-                    if (err instanceof RestrictedEnvironmentError) {
-                        console.warn('Restricted environment - user lacks early-access', err);
-                        session.isLoading = false;
-                        session.authError = err;
-                        setSession(session.clone());
-                        return;
-                    }
-
-                    if (err instanceof STSError) {
-                        console.error('STS error during token exchange', err);
-                        Env.logger.error('STS error during token exchange', {
-                            vertesia: {
-                                account_id: selectedAccount,
-                                project_id: selectedProject,
-                                sts_url: err.stsURL,
-                                error: err,
-                            },
-                        });
-                        window.alert(
-                            'Authentication failed due to an issue with the authentication service. Please try again later.',
-                        );
-                        session.logout();
-                        setSession(session.clone());
-                        clearAuthHash();
-                        return;
-                    }
+                    if (surfaceAuthError(err, true)) return;
 
                     console.error('Failed to fetch user token from studio, redirecting to central auth', err);
                     Env.logger.error('Failed to fetch user token from studio, redirecting to central auth', {
@@ -221,20 +262,12 @@ export function UserSessionProvider({ children, loadOnboardingStatus = true }: U
                                 .then(() => setSession(session.clone()));
                         })
                         .catch((err) => {
-                            console.error('Failed to fetch user token from studio', err);
-                            Env.logger.error('Failed to fetch user token from studio', {
-                                vertesia: {
-                                    account_id: selectedAccount,
-                                    project_id: selectedProject,
-                                    error: err,
-                                },
+                            if (surfaceAuthError(err)) return;
+                            console.error('Unexpected failure while fetching a user token', err);
+                            Env.logger.error('Unexpected failure while fetching a user token', {
+                                vertesia: { account_id: selectedAccount, project_id: selectedProject, error: err },
                             });
-                            // Keep the Firebase session for UserNotFoundError (signup flow) and
-                            // RestrictedEnvironmentError (identity is valid; the environment is gated).
-                            // Logging out would retrigger onAuthStateChanged and clear the authError.
-                            if (!(err instanceof UserNotFoundError) && !(err instanceof RestrictedEnvironmentError)) {
-                                session.logout();
-                            }
+                            session.logout();
                             session.isLoading = false;
                             session.authError = err;
                             setSession(session.clone());
@@ -274,6 +307,7 @@ export function UserSessionProvider({ children, loadOnboardingStatus = true }: U
                     if (!cancelled) setSession(session.clone());
                 })
                 .catch((err: unknown) => {
+                    if (surfaceAuthError(err)) return;
                     console.warn('Auth: failed to initialize injected auth token', err);
                     Env.logger.warn('Failed to initialize injected auth token', {
                         vertesia: {
@@ -282,7 +316,9 @@ export function UserSessionProvider({ children, loadOnboardingStatus = true }: U
                             error: err,
                         },
                     });
-                    startFirebaseOrCentralAuth();
+                    session.isLoading = false;
+                    session.authError = err instanceof Error ? err : new Error(String(err));
+                    setSession(session.clone());
                 });
             return () => {
                 cancelled = true;

package/src/session/auth/composable.scope.test.ts

@@ -0,0 +1,88 @@
+// @vitest-environment jsdom
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const logger = { info: vi.fn(), warn: vi.fn(), error: vi.fn() };
+
+vi.mock('@vertesia/ui/env', () => ({
+    Env: {
+        endpoints: { sts: 'https://sts.test', studio: 'https://studio.test' },
+        logger,
+    },
+}));
+
+vi.mock('./firebase', () => ({
+    getFirebaseAuth: () => ({ currentUser: null }),
+    getFirebaseAuthToken: vi.fn(),
+}));
+
+function unsignedJwt(payload: Record<string, unknown>): string {
+    const encode = (value: string) => btoa(value).replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
+    return `${encode(JSON.stringify({ alg: 'none', typ: 'JWT' }))}.${encode(JSON.stringify(payload))}.signature`;
+}
+
+describe('getComposableToken scope cache', () => {
+    beforeEach(() => {
+        vi.restoreAllMocks();
+        vi.resetModules();
+        localStorage.clear();
+    });
+
+    it('does not reuse a valid token from another project', async () => {
+        const accountId = 'account-1';
+        const projectA = 'project-a';
+        const projectB = 'project-b';
+        const expiry = Math.floor(Date.now() / 1000) + 3600;
+        const token = (project: string) =>
+            unsignedJwt({ exp: expiry, account: { id: accountId }, project: { id: project } });
+        const response = (project: string) => new Response(JSON.stringify({ token: token(project) }), { status: 200 });
+        const fetchMock = vi
+            .spyOn(globalThis, 'fetch')
+            .mockResolvedValueOnce(response(projectA))
+            .mockResolvedValueOnce(response(projectB));
+
+        const { getComposableToken } = await import('./composable');
+        const first = await getComposableToken(accountId, projectA, 'central-auth-credential', true);
+        const second = await getComposableToken(accountId, projectB, 'central-auth-credential');
+
+        expect(first.token.project?.id).toBe(projectA);
+        expect(second.token.project?.id).toBe(projectB);
+        expect(fetchMock).toHaveBeenCalledTimes(2);
+    });
+
+    it('reuses a valid project token for an account-scoped request in the same account', async () => {
+        const accountId = 'account-1';
+        const projectId = 'project-a';
+        const expiry = Math.floor(Date.now() / 1000) + 3600;
+        const token = unsignedJwt({ exp: expiry, account: { id: accountId }, project: { id: projectId } });
+        const fetchMock = vi
+            .spyOn(globalThis, 'fetch')
+            .mockResolvedValueOnce(new Response(JSON.stringify({ token }), { status: 200 }));
+
+        const { getComposableToken } = await import('./composable');
+        await getComposableToken(accountId, projectId, 'central-auth-credential', true);
+        const accountScoped = await getComposableToken(accountId);
+
+        expect(accountScoped.token.project?.id).toBe(projectId);
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+    });
+
+    it('reuses a valid token for a global request', async () => {
+        const expiry = Math.floor(Date.now() / 1000) + 3600;
+        const token = unsignedJwt({
+            exp: expiry,
+            account: { id: 'account-1' },
+            project: { id: 'project-a' },
+        });
+        const fetchMock = vi
+            .spyOn(globalThis, 'fetch')
+            .mockResolvedValueOnce(new Response(JSON.stringify({ token }), { status: 200 }));
+
+        const { getComposableToken } = await import('./composable');
+        await getComposableToken('account-1', 'project-a', 'central-auth-credential', true);
+        const global = await getComposableToken();
+
+        expect(global.token.account.id).toBe('account-1');
+        expect(global.token.project?.id).toBe('project-a');
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+    });
+});