@vertesia/ui 1.5.0-dev.20260910.052912Z → 1.6.0-dev.20260912.110338Z

package/src/router/RouteComponent.test.tsx

@@ -1,5 +1,6 @@
 import { act, cleanup, render, screen, waitFor } from '@testing-library/react';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { ErrorBoundary } from 'react-error-boundary';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { prefetchLazyRoutes, RouteComponent } from './RouteComponent';
 import { type LazyRouteModule, useNavigate } from './Router';
 import { RouterProvider } from './RouterProvider';
@@ -38,6 +39,44 @@ describe('RouteComponent lazy routes', () => {
         window.history.pushState({}, '', '/');
     });
 
+    it.each(['missing module', 'rejected import', 'synchronous failure'] as const)(
+        'reports a %s through the error boundary instead of remaining on the spinner',
+        async (failure) => {
+            const error = new Error('Module could not be loaded');
+            const onError = vi.fn();
+            const consoleError = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+            const routes = [
+                {
+                    path: '/a',
+                    LazyComponent: () => {
+                        if (failure === 'synchronous failure') throw error;
+                        return failure === 'missing module'
+                            ? Promise.resolve(undefined as unknown as LazyRouteModule)
+                            : Promise.reject(error);
+                    },
+                },
+            ];
+            try {
+                render(
+                    <ErrorBoundary fallback={<div>Route unavailable</div>} onError={onError}>
+                        <RouterProvider routes={routes}>
+                            <RouteComponent spinner={<div>loading</div>} />
+                        </RouterProvider>
+                    </ErrorBoundary>,
+                );
+                await screen.findByText('Route unavailable');
+                expect(screen.queryByText('loading')).toBeNull();
+                expect(onError.mock.calls[0][0]).toEqual(
+                    failure === 'missing module'
+                        ? new Error('Lazy module for /a does not have a default export')
+                        : error,
+                );
+            } finally {
+                consoleError.mockRestore();
+            }
+        },
+    );
+
     it('stops showing the previous lazy route while the next one loads', async () => {
         const pageA = deferredModule('Page A');
         const pageB = deferredModule('Page B');
@@ -87,6 +126,31 @@ describe('RouteComponent lazy routes', () => {
         expect(screen.getByText('Page B')).toBeDefined();
     });
 
+    it('ignores a rejected import after navigating away', async () => {
+        let reject!: (error: Error) => void;
+        const promise = new Promise<LazyRouteModule>((_resolve, rejectPromise) => {
+            reject = rejectPromise;
+        });
+        const onError = vi.fn();
+        render(
+            <ErrorBoundary fallback={<div>Route unavailable</div>} onError={onError}>
+                <RouterProvider
+                    routes={[
+                        { path: '/a', LazyComponent: () => promise },
+                        { path: '/b', Component: () => <div>Page B</div> },
+                    ]}
+                >
+                    <CaptureNavigate />
+                    <RouteComponent />
+                </RouterProvider>
+            </ErrorBoundary>,
+        );
+        await act(async () => navigateFn('/b'));
+        await act(async () => reject(new Error('Previous route failed')));
+        expect(screen.getByText('Page B')).toBeDefined();
+        expect(onError).not.toHaveBeenCalled();
+    });
+
     it('renders a previously resolved lazy route synchronously on revisit', async () => {
         const pageA = deferredModule('Page A');
         const pageB = deferredModule('Page B');

package/src/router/RouteComponent.tsx

@@ -13,14 +13,13 @@ import {
 // between two lazy routes blanks the page for at least a frame, even when the module is loaded.
 const resolvedComponents = new Map<LazyComponentRoute['LazyComponent'], LazyRouteModule['default']>();
 
-function resolveLazyRoute(route: LazyComponentRoute): Promise<LazyRouteModule['default']> {
-    return route.LazyComponent().then((module) => {
-        if (!module.default) {
-            throw new Error(`Lazy module for ${route.path} does not have a default export`);
-        }
-        resolvedComponents.set(route.LazyComponent, module.default);
-        return module.default;
-    });
+async function resolveLazyRoute(route: LazyComponentRoute): Promise<LazyRouteModule['default']> {
+    const module = await route.LazyComponent();
+    if (!module?.default) {
+        throw new Error(`Lazy module for ${route.path} does not have a default export`);
+    }
+    resolvedComponents.set(route.LazyComponent, module.default);
+    return module.default;
 }
 
 /**
@@ -64,21 +63,25 @@ function LazyRouteComponent({ route, spinner }: LazyRouteComponentProps) {
     const [Component, setComponent] = useState<LazyRouteModule['default'] | null>(
         () => resolvedComponents.get(route.LazyComponent) ?? null,
     );
+    const [error, setError] = useState<unknown>();
     useEffect(() => {
         // A slow import must not land after this instance moved on (unmount, or a route object
         // swap without a path change): the stale module would overwrite the current one.
         let stale = false;
-        void resolveLazyRoute(route).then((component) => {
-            if (!stale) {
-                // we need to wrap the component type in an arrow function
-                // otherwise the setState function will execute the function as a state update function
-                setComponent(() => component);
-            }
-        });
+        void resolveLazyRoute(route).then(
+            (component) => {
+                if (!stale) setComponent(() => component);
+            },
+            (error: unknown) => {
+                // Render failures through the surrounding error boundary, including import failures.
+                if (!stale) setError(() => error);
+            },
+        );
         return () => {
             stale = true;
         };
     }, [route]);
 
+    if (error !== undefined) throw error;
     return Component ? <Component /> : spinner || null;
 }

package/src/session/UserSession.test.ts

@@ -1,17 +1,64 @@
 import type { VertesiaClient } from '@vertesia/client';
+import { type AuthTokenPayload, PrincipalType } from '@vertesia/common';
 import { describe, expect, it, vi } from 'vitest';
 import { UserSession } from './UserSession';
 
+const projectToken: AuthTokenPayload = {
+    sub: 'test-user',
+    name: 'Test User',
+    type: PrincipalType.User,
+    account: { id: 'test-account', name: 'Test Account' },
+    account_roles: [],
+    accounts: [],
+    project: { id: 'test-project', name: 'Test Project', account: 'test-account' },
+    apps: [],
+    iss: 'https://auth.example.com',
+    aud: 'test-client',
+    exp: 4102444800,
+};
+
+function encodeToken(payload: AuthTokenPayload): string {
+    return `${btoa(JSON.stringify({ alg: 'none' }))}.${btoa(JSON.stringify(payload))}.`;
+}
+
 function createSession(onboardingProgress: () => Promise<Record<string, boolean>>) {
     const client = {
         account: { onboardingProgress },
+        withAuthCallback: vi.fn(),
     } as unknown as VertesiaClient;
     const setSession = vi.fn<(session: UserSession) => void>();
     const session = new UserSession(client, setSession);
+    session.authToken = { ...projectToken };
     return { session, setSession };
 }
 
 describe('UserSession.fetchOnboardingStatus', () => {
+    it('skips onboarding before authentication without publishing a status', async () => {
+        const onboardingProgress = vi.fn(async () => ({ project_created: true }));
+        const { session, setSession } = createSession(onboardingProgress);
+        session.authToken = undefined;
+
+        await expect(session.fetchOnboardingStatus()).resolves.toBe(false);
+        expect(onboardingProgress).not.toHaveBeenCalled();
+        expect(session.onboardingComplete).toBeUndefined();
+        expect(setSession).not.toHaveBeenCalled();
+    });
+
+    it('defers onboarding during account-only login and loads it after project selection', async () => {
+        const onboardingProgress = vi.fn(async () => ({ project_created: true }));
+        const { session, setSession } = createSession(onboardingProgress);
+
+        await session.login(encodeToken({ ...projectToken, project: undefined }));
+        expect(onboardingProgress).not.toHaveBeenCalled();
+        expect(session.onboardingComplete).toBeUndefined();
+        expect(setSession).not.toHaveBeenCalled();
+
+        await session.login(encodeToken(projectToken));
+        expect(onboardingProgress).toHaveBeenCalledOnce();
+        expect(session.onboardingComplete).toBe(true);
+        expect(setSession).toHaveBeenCalledOnce();
+    });
+
     it('does not replace the session when an incomplete status is unchanged', async () => {
         const { session, setSession } = createSession(async () => ({ project_created: false }));
         session.onboardingComplete = false;
@@ -37,3 +84,21 @@ describe('UserSession.fetchOnboardingStatus', () => {
         expect(setSession.mock.calls[0]?.[0]?.onboardingComplete).toBe(false);
     });
 });
+
+describe('UserSession.signOut', () => {
+    it('keeps the receiver when used as a callback, including cloned sessions', () => {
+        const { session } = createSession(async () => ({}));
+        const clone = session.clone();
+        const logout = vi.spyOn(session, 'logout').mockImplementation(() => undefined);
+        const cloneLogout = vi.spyOn(clone, 'logout').mockImplementation(() => undefined);
+        const { signOut } = session;
+        const { signOut: signOutClone } = clone;
+
+        signOut();
+        expect(logout).toHaveBeenCalledOnce();
+        expect(cloneLogout).not.toHaveBeenCalled();
+        signOutClone();
+        expect(cloneLogout).toHaveBeenCalledOnce();
+        expect(logout).toHaveBeenCalledOnce();
+    });
+});

package/src/session/UserSession.ts

@@ -5,15 +5,13 @@ import { jwtDecode } from 'jwt-decode';
 import { createContext, useContext } from 'react';
 
 import { getComposableToken } from './auth/composable';
-import { authReturnUrl, mountRootUrl, shouldRedirectToCentralAuth } from './auth/domainRouting';
+import { authReturnUrl, centralAuthUrl, mountRootUrl, shouldRedirectToCentralAuth } from './auth/domainRouting';
 import { getFirebaseAuth } from './auth/firebase';
 
 import { LastSelectedAccountId_KEY, LastSelectedProjectId_KEY } from './constants';
 
 export { LastSelectedAccountId_KEY, LastSelectedProjectId_KEY };
 
-const CENTRAL_AUTH_REDIRECT = 'https://internal-auth.vertesia.app/';
-
 export interface UserSessionLoginOptions {
     loadOnboardingStatus?: boolean;
 }
@@ -44,6 +42,7 @@ class UserSession {
         }
 
         this.logout = this.logout.bind(this);
+        this.signOut = this.signOut.bind(this);
     }
 
     get store() {
@@ -151,7 +150,7 @@ class UserSession {
             this.setSession = undefined;
             this.client.withAuthCallback(undefined);
 
-            const logoutUrl = new URL(CENTRAL_AUTH_REDIRECT);
+            const logoutUrl = new URL(centralAuthUrl());
             const currentUrl = authReturnUrl();
             logoutUrl.pathname = '/logout';
             logoutUrl.searchParams.set('redirect_uri', currentUrl.toString());
@@ -251,6 +250,9 @@ class UserSession {
     }
 
     async fetchOnboardingStatus(): Promise<boolean> {
+        if (!this.project?.id) {
+            return false;
+        }
         if (this.onboardingComplete) {
             console.log('Onboarding already completed');
             return false;

package/src/session/UserSessionProvider.strict-mode.test.tsx

@@ -0,0 +1,44 @@
+import { cleanup, render, waitFor } from '@testing-library/react';
+import { Env } from '@vertesia/ui/env';
+import { StrictMode } from 'react';
+import { afterEach, expect, it, vi } from 'vitest';
+import { redirectToCentralAuth } from './auth/domainRouting';
+import { UserSessionProvider } from './UserSessionProvider';
+
+vi.mock('./auth/useAuthState', () => ({ useAuthState: () => ({}) }));
+vi.mock('./auth/domainRouting', async (importOriginal) => ({
+    ...(await importOriginal<typeof import('./auth/domainRouting')>()),
+    shouldRedirectToCentralAuth: () => true,
+    redirectToCentralAuth: vi.fn(),
+}));
+
+afterEach(() => {
+    cleanup();
+    vi.clearAllMocks();
+});
+
+it('continues authentication after StrictMode cancels the first host-token attempt', async () => {
+    const authTokenProvider = vi.fn(async () => undefined);
+    Env.init({
+        name: 'test',
+        version: '1',
+        type: 'development',
+        isLocalDev: true,
+        isDocker: false,
+        endpoints: {
+            studio: 'https://api.example.com',
+            zeno: 'https://api.example.com',
+            sts: 'https://sts.example.com',
+        },
+        authTokenProvider,
+    });
+    render(
+        <StrictMode>
+            <UserSessionProvider>
+                <span>App</span>
+            </UserSessionProvider>
+        </StrictMode>,
+    );
+    await waitFor(() => expect(redirectToCentralAuth).toHaveBeenCalledTimes(1));
+    expect(authTokenProvider).toHaveBeenCalledTimes(2);
+});

package/src/session/UserSessionProvider.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it } from 'vitest';
 import { RequestedScopeUnavailableError } from './auth/composable';
-import { sanitizeRejectedScopeUrl } from './UserSessionProvider';
+import { buildCentralAuthRedirectUrl, sanitizeRejectedScopeUrl } from './UserSessionProvider';
 
 describe('sanitizeRejectedScopeUrl', () => {
     it.each([
@@ -67,3 +67,64 @@ describe('sanitizeRejectedScopeUrl', () => {
         expect(error.requestedScope).toBe('project');
     });
 });
+
+describe('buildCentralAuthRedirectUrl', () => {
+    const RETURN_URL = new URL('https://app.example.test/studio/dashboard?tab=runs');
+    const STS = 'https://sts.example.test';
+
+    it('carries the sts, redirect_uri and state parameters', () => {
+        const url = buildCentralAuthRedirectUrl('https://auth.example.test/', STS, RETURN_URL, 'state-123');
+
+        expect(url.origin).toBe('https://auth.example.test');
+        expect(url.pathname).toBe('/');
+        expect(url.searchParams.get('sts')).toBe(STS);
+        expect(url.searchParams.get('redirect_uri')).toBe(RETURN_URL.toString());
+        expect(url.searchParams.get('state')).toBe('state-123');
+    });
+
+    it('carries the selected account and project through a gateway-mounted app redirect', () => {
+        const returnUrl = new URL('https://apps.example.test/tenants/t/apps/a/versions/v/app/?view=grid');
+        const url = buildCentralAuthRedirectUrl('https://auth.example.test/', STS, returnUrl, 'state-123', {
+            accountId: 'account-1',
+            projectId: 'project-1',
+        });
+
+        expect(url.searchParams.get('redirect_uri')).toBe(
+            'https://apps.example.test/tenants/t/apps/a/versions/v/app/?view=grid&p=project-1&a=account-1',
+        );
+    });
+
+    // The endpoint is configurable, so it can arrive with a query of its own. Concatenating
+    // `?sts=...` onto it folds the parameter into the existing value and Central Auth sees no sts.
+    it('preserves a query already present on the configured endpoint', () => {
+        const url = buildCentralAuthRedirectUrl('https://auth.example.test/?tenant=acme', STS, RETURN_URL, 'state-123');
+
+        expect(url.searchParams.get('tenant')).toBe('acme');
+        expect(url.searchParams.get('sts')).toBe(STS);
+        expect(url.searchParams.get('redirect_uri')).toBe(RETURN_URL.toString());
+        expect(url.searchParams.get('state')).toBe('state-123');
+    });
+
+    // Same hazard from the other side: appended after a fragment, the parameters land inside it.
+    it('keeps the parameters out of a fragment on the configured endpoint', () => {
+        const url = buildCentralAuthRedirectUrl('https://auth.example.test/#section', STS, RETURN_URL, 'state-123');
+
+        expect(url.hash).toBe('#section');
+        expect(url.searchParams.get('sts')).toBe(STS);
+        expect(url.searchParams.get('state')).toBe('state-123');
+    });
+
+    it('preserves a path prefix on the configured endpoint', () => {
+        const url = buildCentralAuthRedirectUrl('https://auth.example.test/signin', STS, RETURN_URL, 'state-123');
+
+        expect(url.pathname).toBe('/signin');
+        expect(url.searchParams.get('sts')).toBe(STS);
+    });
+
+    it('percent-encodes the parameter values', () => {
+        const url = buildCentralAuthRedirectUrl('https://auth.example.test/', STS, RETURN_URL, 'a b&c=d');
+
+        expect(url.search).toContain('sts=https%3A%2F%2Fsts.example.test');
+        expect(url.searchParams.get('state')).toBe('a b&c=d');
+    });
+});

package/src/session/UserSessionProvider.tsx

@@ -12,7 +12,7 @@ import {
     resolveAuthSelection,
     UserNotFoundError,
 } from './auth/composable';
-import { redirectToCentralAuth, shouldRedirectToCentralAuth } from './auth/domainRouting';
+import { buildCentralAuthRedirectUrl, redirectToCentralAuth, shouldRedirectToCentralAuth } from './auth/domainRouting';
 import { getFirebaseAuth } from './auth/firebase';
 import { useAuthState } from './auth/useAuthState';
 import { UserSession, UserSessionContext } from './UserSession';
@@ -23,6 +23,10 @@ function clearAuthHash() {
     window.history.replaceState(window.history.state, '', `${url.pathname}${url.search}`);
 }
 
+// Re-exported from its new home in ./auth/domainRouting, which the token layer can import without
+// a cycle -- it renews an expired Central Auth session through the same URL.
+export { buildCentralAuthRedirectUrl };
+
 export function sanitizeRejectedScopeUrl(
     currentUrl: URL,
     error: RequestedScopeUnavailableError,
@@ -268,6 +272,7 @@ export function UserSessionProvider({ children, loadOnboardingStatus = true }: U
             session.setSession = setSession;
             void Env.authTokenProvider()
                 .then(async (injectedToken) => {
+                    if (cancelled) return;
                     if (!injectedToken) {
                         startFirebaseOrCentralAuth();
                         return;
@@ -283,6 +288,7 @@ export function UserSessionProvider({ children, loadOnboardingStatus = true }: U
                     if (!cancelled) setSession(session.clone());
                 })
                 .catch((err: unknown) => {
+                    if (cancelled) return;
                     if (surfaceAuthError(err)) return;
                     console.warn('Auth: failed to initialize injected auth token', err);
                     Env.logger.warn('Failed to initialize injected auth token', {
@@ -298,6 +304,7 @@ export function UserSessionProvider({ children, loadOnboardingStatus = true }: U
                 });
             return () => {
                 cancelled = true;
+                hasInitiatedAuthRef.current = false;
                 unsubscribe?.();
             };
         }
@@ -305,6 +312,7 @@ export function UserSessionProvider({ children, loadOnboardingStatus = true }: U
         startFirebaseOrCentralAuth();
         return () => {
             cancelled = true;
+            hasInitiatedAuthRef.current = false;
             unsubscribe?.();
         };
     };

package/src/session/auth/composable.renewal.test.ts

@@ -0,0 +1,170 @@
+// @vitest-environment jsdom
+//
+// Renewal of a Central Auth session: the case where the browser holds an STS JWT, nothing else, and
+// that JWT has expired. There is no Firebase user to mint a replacement from and no refresh token,
+// so the token layer either bounces through the broker or the page dead-ends until someone reloads
+// it by hand.
+import { NO_ACCESSIBLE_ACCOUNT_ERROR_CODE } from '@vertesia/common';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const logger = { debug: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn() };
+
+vi.mock('@vertesia/ui/env', () => ({
+    Env: {
+        endpoints: { sts: 'https://sts.test', studio: 'https://studio.test', auth: 'https://auth.test/' },
+        logger,
+    },
+}));
+
+// No Firebase user: that is what makes this a Central Auth session rather than a Firebase one.
+vi.mock('./firebase', () => ({
+    getFirebaseAuth: () => ({ currentUser: null }),
+    getFirebaseAuthToken: vi.fn(),
+}));
+
+function unsignedJwt(payload: Record<string, unknown>): string {
+    const encode = (value: string) => btoa(value).replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
+    return `${encode(JSON.stringify({ alg: 'none', typ: 'JWT' }))}.${encode(JSON.stringify(payload))}.signature`;
+}
+
+const ACCOUNT_ID = 'account-1';
+const PROJECT_ID = 'project-1';
+
+/** A token STS would accept back for re-issuance: its own issuer, and real authorization claims. */
+function stsToken(secondsFromNow: number): string {
+    return unsignedJwt({
+        iss: 'https://sts.test',
+        exp: Math.floor(Date.now() / 1000) + secondsFromNow,
+        account: { id: ACCOUNT_ID },
+        project: { id: PROJECT_ID },
+        permissions: ['content:read'],
+    });
+}
+
+function okResponse(token: string): Response {
+    return new Response(JSON.stringify({ token }), { status: 200 });
+}
+
+let replace: ReturnType<typeof vi.fn>;
+
+beforeEach(() => {
+    vi.restoreAllMocks();
+    vi.resetModules();
+    localStorage.clear();
+    sessionStorage.clear();
+    logger.info.mockClear();
+    logger.warn.mockClear();
+
+    // `location.replace` is the redirect under test; jsdom's own implementation would only warn.
+    replace = vi.fn();
+    vi.stubGlobal('location', {
+        href: 'https://cloud.test/studio/environments',
+        replace,
+    });
+    // `shouldRedirectToCentralAuth()` is "not Firebase mode", which is the default here.
+    window.AUTH_MODE = undefined;
+});
+
+describe('forced refresh of a Central Auth session', () => {
+    it('re-mints through STS instead of handing back the credential it already holds', async () => {
+        // The bug this pins: the refresh path adopted a still-valid Vertesia token as its own
+        // result, so `refreshAuthToken()` -- whose whole purpose is to re-read claims STS
+        // recomputes on every issuance, such as `apps` after an ACE change -- silently returned the
+        // very token whose claims were suspect. A Central Auth session has no other credential, so
+        // the no-op was total there.
+        const fetchMock = vi.spyOn(globalThis, 'fetch').mockResolvedValue(okResponse(stsToken(7200)));
+
+        const { getComposableToken } = await import('./composable');
+        // Adopted without a round-trip, which is the right call when nothing forced a refresh.
+        const first = await getComposableToken(ACCOUNT_ID, PROJECT_ID, stsToken(3600));
+        expect(fetchMock).not.toHaveBeenCalled();
+
+        const refreshed = await getComposableToken(undefined, undefined, undefined, true);
+
+        // Before the fix this was zero: the same shortcut swallowed the forced refresh too.
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+        expect(refreshed.token.exp).toBeGreaterThan(first.token.exp);
+    });
+});
+
+describe('an expired Central Auth session', () => {
+    /**
+     * Establish a session whose token is already inside the five-minute renewal window, then answer
+     * the renewal attempt with `status`. This is the shape of the reported incident: the tab sat
+     * idle, the token aged out, and the next click tried to renew from a credential STS refuses.
+     */
+    async function sessionThenRenewalFailure(status: number, body?: unknown) {
+        const nearlyExpired = stsToken(60);
+        vi.spyOn(globalThis, 'fetch')
+            .mockResolvedValueOnce(okResponse(nearlyExpired))
+            .mockResolvedValueOnce(new Response(body === undefined ? null : JSON.stringify(body), { status }));
+
+        const { getComposableToken } = await import('./composable');
+        await getComposableToken(ACCOUNT_ID, PROJECT_ID, nearlyExpired);
+        return getComposableToken;
+    }
+
+    it('bounces through the broker rather than dead-ending', async () => {
+        const getComposableToken = await sessionThenRenewalFailure(401);
+
+        await expect(getComposableToken(ACCOUNT_ID, PROJECT_ID)).rejects.toThrow();
+
+        expect(replace).toHaveBeenCalledTimes(1);
+        const url = new URL(replace.mock.calls[0][0] as string);
+        expect(url.origin).toBe('https://auth.test');
+        expect(url.searchParams.get('sts')).toBe('https://sts.test');
+        expect(url.searchParams.get('redirect_uri')).toBe('https://cloud.test/studio/environments');
+        // The broker echoes `state` back; the return leg verifies it against this record.
+        expect(url.searchParams.get('state')).toBe(sessionStorage.getItem('auth_state'));
+    });
+
+    it('redirects once per expiry, not once per failing call', async () => {
+        // Every in-flight request fails at the same moment, and the first failure discards the
+        // credential -- so the calls behind it reach the "no credential at all" branch. Without the
+        // cooldown each one would start its own navigation.
+        const getComposableToken = await sessionThenRenewalFailure(401);
+
+        await expect(getComposableToken(ACCOUNT_ID, PROJECT_ID)).rejects.toThrow();
+        await expect(getComposableToken(ACCOUNT_ID, PROJECT_ID)).rejects.toThrow(/Cannot acquire/);
+
+        expect(replace).toHaveBeenCalledTimes(1);
+    });
+
+    it('does not redirect again for a broker round-trip that just failed', async () => {
+        // The loop guard, from the other side of the navigation: module state is gone, so the
+        // cooldown has to be read back from sessionStorage. A broker that returns a credential STS
+        // also refuses would otherwise bounce the browser between the two forever.
+        sessionStorage.setItem('vt.centralAuthRenewalAt', String(Date.now() - 1_000));
+        const getComposableToken = await sessionThenRenewalFailure(401);
+
+        await expect(getComposableToken(ACCOUNT_ID, PROJECT_ID)).rejects.toThrow();
+
+        expect(replace).not.toHaveBeenCalled();
+        expect(logger.warn).toHaveBeenCalledWith(expect.stringContaining('already attempted'), expect.anything());
+    });
+
+    it('leaves an account-level refusal alone', async () => {
+        // The broker would hand back the same identity and STS would refuse it again. This is a
+        // question for the recovery screen, not for another round-trip.
+        const getComposableToken = await sessionThenRenewalFailure(403, {
+            errorCode: NO_ACCESSIBLE_ACCOUNT_ERROR_CODE,
+        });
+
+        await expect(getComposableToken(ACCOUNT_ID, PROJECT_ID)).rejects.toThrow();
+
+        expect(replace).not.toHaveBeenCalled();
+    });
+});
+
+describe('a browser with no session yet', () => {
+    it('does not redirect from the token layer', async () => {
+        // First load is UserSessionProvider's to route: it holds the account/project selection this
+        // layer cannot see, and it already redirects. Renewing from here would race it.
+        vi.spyOn(globalThis, 'fetch').mockResolvedValue(new Response(null, { status: 401 }));
+
+        const { getComposableToken } = await import('./composable');
+        await expect(getComposableToken(ACCOUNT_ID, PROJECT_ID, stsToken(-60))).rejects.toThrow();
+
+        expect(replace).not.toHaveBeenCalled();
+    });
+});

package/src/session/auth/composable.test.ts

@@ -5,7 +5,10 @@ function makeJwt(payload: Record<string, unknown>) {
     return `${encode({ alg: 'ES256', typ: 'JWT' })}.${encode(payload)}.signature`;
 }
 
-async function importComposableAuth(authTokenProvider?: () => Promise<string | undefined>) {
+async function importComposableAuth(
+    authTokenProvider?: () => Promise<string | undefined>,
+    defaultAuthSelection?: { accountId?: string; projectId?: string },
+) {
     vi.resetModules();
     const [{ Env }, composableAuth] = await Promise.all([import('@vertesia/ui/env'), import('./composable')]);
     Env.init({
@@ -20,6 +23,7 @@ async function importComposableAuth(authTokenProvider?: () => Promise<string | u
             sts: 'https://sts.dev1.vertesia.io',
         },
         authTokenProvider,
+        defaultAuthSelection,
     });
     return composableAuth;
 }
@@ -374,3 +378,21 @@ describe('resolveAuthSelection', () => {
         });
     });
 });
+
+describe('configured workspace selection', () => {
+    afterEach(() => localStorage.clear());
+    it.each([
+        [{ accountId: 'env-a', projectId: 'env-p' }, '', { accountId: 'env-a', projectId: 'env-p' }],
+        [{ projectId: 'env-p' }, '', { accountId: undefined, projectId: 'env-p' }],
+        [{ accountId: 'env-a' }, '', { accountId: 'env-a', projectId: 'env-a-cached-p' }],
+        [{ accountId: 'env-a', projectId: 'env-p' }, '?p=url-p', { accountId: undefined, projectId: 'url-p' }],
+        [{ accountId: 'env-a', projectId: 'env-p' }, '?a=url-a', { accountId: 'url-a', projectId: undefined }],
+        [{ accountId: 'env-a', projectId: 'env-p' }, '?a=url-a&p=url-p', { accountId: 'url-a', projectId: 'url-p' }],
+    ] as const)('selects %j with URL %s', async (selection, query, expected) => {
+        localStorage.setItem('composableai.lastSelectedAccountId', 'old-a');
+        localStorage.setItem('composableai.lastSelectedProjectId-old-a', 'old-p');
+        localStorage.setItem('composableai.lastSelectedProjectId-env-a', 'env-a-cached-p');
+        const { resolveAuthSelection } = await importComposableAuth(undefined, selection);
+        expect(resolveAuthSelection(new URL(`https://app.example.test/${query}`))).toEqual(expected);
+    });
+});