@vertesia/ui 1.5.0 → 1.5.1

package/src/i18n/locales/zh.json

@@ -245,6 +245,17 @@
     "auth.email.placeholder": "you@company.com",
     "auth.email.title": "欢迎使用 Vertesia",
     "auth.error": "错误：{{message}}",
+    "auth.password.body": "请输入此账户的密码。",
+    "auth.password.continue": "使用密码继续",
+    "auth.password.eyebrow": "密码登录",
+    "auth.password.failed": "无法登录，请重试。",
+    "auth.password.invalidCredentials": "电子邮件或密码不正确。",
+    "auth.password.label": "密码",
+    "auth.password.notAvailable": "此电子邮件不支持密码登录。",
+    "auth.password.required": "请输入密码。",
+    "auth.password.submit": "登录",
+    "auth.password.title": "输入密码",
+    "auth.password.tooManyAttempts": "尝试次数过多。请等待几分钟后重试。",
     "auth.pending.authenticating": "正在认证",
     "auth.pending.body": "请稍候 — 我们正在为您安全跳转。只需稍候片刻。",
     "auth.pending.cancel": "取消",
@@ -365,6 +376,7 @@
     "mcpConnections.label": "MCP",
     "mcpConnections.manage": "管理 MCP 连接",
     "mcpConnections.managedByApp": "由应用管理",
+    "mcpConnections.noAuthentication": "无需身份验证",
     "mcpConnections.settings": "设置",
     "mcpConnections.subtitle": "管理可用于此对话的 MCP 服务器。",
     "mcpConnections.title": "MCP",
@@ -474,10 +486,10 @@
     "store.actions.changeContentTypeDesc": "更改选中文档的内容类型",
     "store.actions.changeType": "更改类型",
     "store.actions.chooseExistingCollections": "从现有集合中选择",
-    "store.actions.chooseWorkflowRule": "选择要启动的工作流规则：",
     "store.actions.confirmDeleteAll": "确定要删除所有选中的对象吗？此操作无法撤销。",
     "store.actions.confirmDeleteSelected": "确定要删除选中的对象吗？\n这不是从集合中移除。",
     "store.actions.confirmRemoveFromCollection": "确定要从此集合中移除所选对象吗？",
+    "store.actions.confirmRunIntake": "重新运行内容摄取会重新处理选中的对象，可能覆盖其内容类型和属性。是否继续？",
     "store.actions.createNew": "新建",
     "store.actions.delete": "删除",
     "store.actions.deleteObjects": "删除对象",
@@ -486,20 +498,22 @@
     "store.actions.errorDeletingObjects": "删除对象时出错",
     "store.actions.errorExportProperties": "导出属性时出错",
     "store.actions.errorRemovingObjects": "从集合中移除对象时出错",
-    "store.actions.errorStartingWorkflow": "启动工作流时出错",
+    "store.actions.errorStartingIntake": "启动内容摄取失败",
     "store.actions.exportAllObjectProperties": "导出所有对象属性",
     "store.actions.exportProperties": "导出属性",
+    "store.actions.intakeStarted": "内容摄取已启动",
+    "store.actions.intakeStartedOn_one": "已对 {{count}} 个对象启动内容摄取",
+    "store.actions.intakeStartedOn_other": "已对 {{count}} 个对象启动内容摄取",
     "store.actions.noCollectionContext": "没有集合上下文",
     "store.actions.noObjectsSelected": "未选择任何对象",
     "store.actions.pleaseSelectObjectsToDelete": "请选择要删除的对象",
     "store.actions.pleaseSelectObjectsToRemove": "请选择要从集合中移除的对象",
+    "store.actions.pleaseSelectObjectsToRunIntake": "请选择要运行内容摄取的对象",
     "store.actions.removeFromCollection": "从集合中移除",
     "store.actions.removeFromCollectionDesc": "从此集合中移除所选对象",
+    "store.actions.runIntake": "运行内容摄取",
+    "store.actions.runIntakeDesc": "对选中的对象重新运行标准内容摄取流程",
     "store.actions.selectCollection": "选择集合",
-    "store.actions.startWorkflow": "启动工作流",
-    "store.actions.startWorkflowByRule": "按规则启动工作流",
-    "store.actions.startWorkflowDesc": "对选中的对象启动工作流",
-    "store.actions.workflowStarted": "工作流已启动",
     "store.allowedContentTypes": "允许的内容类型",
     "store.allowedContentTypesOptionalDescription": "可选择限定可添加到集合中的内容类型。如果未设置，则允许所有内容类型。",
     "store.allowedContentTypesSelectDescription": "选择可添加到集合中的内容类型。如果未设置，则允许所有内容类型。",
@@ -571,7 +585,6 @@
     "store.failedToExportDocument": "导出文档失败",
     "store.failedToFetchRoleMappings": "获取角色映射失败",
     "store.failedToFetchTypes": "获取对象类型失败",
-    "store.failedToFetchWorkflows": "获取工作流失败",
     "store.failedToGetDownloadUrl": "获取下载URL失败",
     "store.failedToLoadDocument": "加载文档失败",
     "store.failedToLoadType": "加载类型失败",
@@ -661,6 +674,7 @@
     "store.showingFirst128K": "仅显示前128K个字符",
     "store.size": "大小",
     "store.staticCollection": "静态集合",
+    "store.status": "状态",
     "store.strictMode": "严格模式",
     "store.successfullyCopied": "已成功复制{{type}}到剪贴板",
     "store.successfullyExportedTo": "已成功导出为{{format}}",
@@ -675,6 +689,9 @@
     "store.typeCreated": "类型已创建",
     "store.typeDescription": "可选择内容类型以为集合分配自定义属性和数据。",
     "store.typeSelectDescription": "选择内容类型以为集合分配自定义属性和数据。",
+    "store.typeStatus.active": "已启用",
+    "store.typeStatus.draft": "草稿",
+    "store.typeStatus.draftHint": "摄取时不参与自动类型选择。仍可将此类型直接分配给文档。",
     "store.unknown": "未知",
     "store.unsavedChanges": "未保存的更改",
     "store.updated": "更新时间",

package/src/shell/login/SignInIcons.tsx

@@ -1,4 +1,4 @@
-import { LockKeyhole } from 'lucide-react';
+import { KeyRound, LockKeyhole } from 'lucide-react';
 import type { ComponentType, SVGProps } from 'react';
 import type { ProviderId } from './signInUtils';
 
@@ -58,6 +58,7 @@ export const PROVIDER_ICONS: Record<ProviderId, ComponentType<{ className?: stri
     github: GithubIcon,
     microsoft: MicrosoftIcon,
     oidc: OidcIcon,
+    password: KeyRound,
 };
 
 export function providerIcon(provider: ProviderId | string | undefined): ComponentType<{ className?: string }> {

package/src/shell/login/SignInPasswordRequired.test.tsx

@@ -0,0 +1,82 @@
+import { fireEvent, render, screen, waitFor } from '@testing-library/react';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+const mocks = vi.hoisted(() => ({ startSignIn: vi.fn() }));
+
+vi.mock('@vertesia/ui/i18n', () => ({
+    useUITranslation: () => ({ t: (key: string) => key }),
+}));
+
+vi.mock('./signInUtils', async (importOriginal) => ({
+    ...(await importOriginal<typeof import('./signInUtils')>()),
+    startSignIn: mocks.startSignIn,
+}));
+
+const { default: SignInProvidersStep } = await import('./SignInProvidersStep');
+const { default: SignInReturningStep } = await import('./SignInReturningStep');
+
+const EMAIL = 'claude@reviewers.vertesia.io';
+
+// A provider click enters the pending screen before the redirect starts. When the address turns
+// out to belong to a password tenant there is no redirect, so the step must hand over to the
+// password step instead of leaving the user on the pending spinner.
+describe('password-required after a provider click', () => {
+    afterEach(() => {
+        mocks.startSignIn.mockReset();
+        document.body.innerHTML = '';
+    });
+
+    it('routes the provider list to the password step', async () => {
+        mocks.startSignIn.mockResolvedValue({ ok: false, reason: 'password-required' });
+        const onPasswordRequired = vi.fn();
+        render(
+            <SignInProvidersStep
+                email={EMAIL}
+                onBack={vi.fn()}
+                onProviderClicked={vi.fn()}
+                onPasswordRequired={onPasswordRequired}
+            />,
+        );
+
+        fireEvent.click(screen.getAllByRole('button', { name: /auth.continueWithProvider/ })[0]);
+
+        await waitFor(() => expect(onPasswordRequired).toHaveBeenCalledWith(EMAIL));
+    });
+
+    it('routes a returning user with a stale provider to the password step', async () => {
+        mocks.startSignIn.mockResolvedValue({ ok: false, reason: 'password-required' });
+        const onProviderClicked = vi.fn();
+        const onPasswordRequired = vi.fn();
+        render(
+            <SignInReturningStep
+                session={{ email: EMAIL, lastProvider: 'google' }}
+                onNotYou={vi.fn()}
+                onProviderClicked={onProviderClicked}
+                onPasswordRequired={onPasswordRequired}
+            />,
+        );
+
+        fireEvent.click(screen.getByRole('button', { name: /auth.continueWithProvider/ }));
+
+        await waitFor(() => expect(onPasswordRequired).toHaveBeenCalledWith(EMAIL));
+        expect(onProviderClicked).toHaveBeenCalledWith('google');
+    });
+
+    it('does not leave the redirect path when the sign-in started', async () => {
+        mocks.startSignIn.mockResolvedValue({ ok: true });
+        const onPasswordRequired = vi.fn();
+        render(
+            <SignInReturningStep
+                session={{ email: EMAIL, lastProvider: 'google' }}
+                onNotYou={vi.fn()}
+                onProviderClicked={vi.fn()}
+                onPasswordRequired={onPasswordRequired}
+            />,
+        );
+
+        fireEvent.click(screen.getByRole('button', { name: /auth.continueWithProvider/ }));
+
+        await waitFor(() => expect(mocks.startSignIn).toHaveBeenCalledOnce());
+        expect(onPasswordRequired).not.toHaveBeenCalled();
+    });
+});

package/src/shell/login/SignInPasswordStep.test.tsx

@@ -0,0 +1,71 @@
+import { fireEvent, render, screen, waitFor } from '@testing-library/react';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+const mocks = vi.hoisted(() => ({ signInWithPassword: vi.fn() }));
+
+vi.mock('@vertesia/ui/i18n', () => ({
+    useUITranslation: () => ({ t: (key: string) => key }),
+}));
+
+vi.mock('./signInUtils', () => ({ signInWithPassword: mocks.signInWithPassword }));
+
+const { default: SignInPasswordStep } = await import('./SignInPasswordStep');
+
+const EMAIL = 'claude@reviewers.vertesia.io';
+
+function submitWith(password: string) {
+    fireEvent.change(screen.getByLabelText('auth.password.label'), { target: { value: password } });
+    fireEvent.click(screen.getByRole('button', { name: /auth.password.submit/ }));
+}
+
+describe('SignInPasswordStep', () => {
+    afterEach(() => {
+        mocks.signInWithPassword.mockReset();
+        document.body.innerHTML = '';
+    });
+
+    it('asks for a password before calling sign-in', () => {
+        render(<SignInPasswordStep email={EMAIL} onBack={vi.fn()} />);
+
+        fireEvent.click(screen.getByRole('button', { name: /auth.password.submit/ }));
+
+        expect(screen.getByRole('alert').textContent).toBe('auth.password.required');
+        expect(mocks.signInWithPassword).not.toHaveBeenCalled();
+    });
+
+    it('shows the failure and lets the user retry', async () => {
+        mocks.signInWithPassword.mockResolvedValue({ ok: false, reason: 'invalid-credentials' });
+        render(<SignInPasswordStep email={EMAIL} onBack={vi.fn()} />);
+
+        submitWith('wrong');
+
+        await waitFor(() => expect(screen.getByRole('alert').textContent).toBe('auth.password.invalidCredentials'));
+        expect(mocks.signInWithPassword).toHaveBeenCalledWith(EMAIL, 'wrong');
+        expect((screen.getByRole('button', { name: /auth.password.submit/ }) as HTMLButtonElement).disabled).toBe(
+            false,
+        );
+    });
+
+    // Success hands off to the session's auth-state listener, which unmounts the screen; until then
+    // the button must stay disabled so a second click cannot start a second sign-in.
+    it('keeps the submit disabled after a successful sign-in', async () => {
+        mocks.signInWithPassword.mockResolvedValue({ ok: true });
+        render(<SignInPasswordStep email={EMAIL} onBack={vi.fn()} />);
+
+        submitWith('secret');
+
+        await waitFor(() => expect(mocks.signInWithPassword).toHaveBeenCalledOnce());
+        const submit = screen.getAllByRole('button').find((b) => (b as HTMLButtonElement).type === 'submit');
+        expect((submit as HTMLButtonElement).disabled).toBe(true);
+        expect(screen.queryByRole('alert')).toBeNull();
+    });
+
+    it('returns to the email step from the change link', () => {
+        const onBack = vi.fn();
+        render(<SignInPasswordStep email={EMAIL} onBack={onBack} />);
+
+        fireEvent.click(screen.getByRole('button', { name: 'auth.change' }));
+
+        expect(onBack).toHaveBeenCalledOnce();
+    });
+});

package/src/shell/login/SignInPasswordStep.tsx

@@ -0,0 +1,103 @@
+import { Spinner } from '@vertesia/ui/core';
+import { useUITranslation } from '@vertesia/ui/i18n';
+import { ArrowRight } from 'lucide-react';
+import { useEffect, useRef, useState } from 'react';
+import {
+    SignInEmailRow,
+    SignInPasswordField,
+    SignInStepButton,
+    SignInStepHeader,
+    SignInStepLayout,
+} from './SignInPrimitives';
+import { type PasswordSignInFailure, signInWithPassword } from './signInUtils';
+
+interface SignInPasswordStepProps {
+    email: string;
+    tenantName?: string;
+    onBack: () => void;
+}
+
+/** Password sign-in for an address whose tenant issues passwords instead of federating an IdP. */
+export default function SignInPasswordStep({ email, tenantName, onBack }: SignInPasswordStepProps) {
+    const { t } = useUITranslation();
+    const [password, setPassword] = useState('');
+    const [failure, setFailure] = useState<PasswordSignInFailure | null>(null);
+    const [emptyError, setEmptyError] = useState(false);
+    const [loading, setLoading] = useState(false);
+    const inputRef = useRef<HTMLInputElement>(null);
+
+    useEffect(() => {
+        inputRef.current?.focus();
+    }, []);
+
+    const submit = async (e: React.FormEvent) => {
+        e.preventDefault();
+        if (loading) return;
+        if (!password) {
+            setEmptyError(true);
+            return;
+        }
+        setEmptyError(false);
+        setFailure(null);
+        setLoading(true);
+        const result = await signInWithPassword(email, password);
+        if (!result.ok) {
+            setFailure(result.reason);
+            setLoading(false);
+        }
+        // On success the spinner stays up: the session's auth-state listener finishes the login and
+        // unmounts this screen.
+    };
+
+    // Literal keys, one per failure, so i18next-cli extraction sees every message.
+    const failureMessage = (reason: PasswordSignInFailure) => {
+        switch (reason) {
+            case 'invalid-credentials':
+                return t('auth.password.invalidCredentials');
+            case 'too-many-attempts':
+                return t('auth.password.tooManyAttempts');
+            case 'not-password-tenant':
+                return t('auth.password.notAvailable');
+            case 'failed':
+                return t('auth.password.failed');
+        }
+    };
+    const error = emptyError ? t('auth.password.required') : failure ? failureMessage(failure) : undefined;
+
+    return (
+        <SignInStepLayout>
+            <SignInStepHeader
+                eyebrow={tenantName ?? t('auth.password.eyebrow')}
+                title={t('auth.password.title')}
+                body={t('auth.password.body')}
+            />
+
+            <SignInEmailRow email={email} actionLabel={t('auth.change')} onAction={onBack} />
+
+            <form onSubmit={submit} noValidate className={`flex flex-col ${error ? 'gap-2' : 'gap-6'}`}>
+                <SignInPasswordField
+                    inputRef={inputRef}
+                    label={t('auth.password.label')}
+                    value={password}
+                    onChange={(value) => {
+                        setPassword(value);
+                        if (emptyError) setEmptyError(false);
+                    }}
+                    invalid={!!error}
+                    error={error}
+                />
+
+                <SignInStepButton type="submit" disabled={loading}>
+                    {loading ? (
+                        <Spinner />
+                    ) : (
+                        <>
+                            <span>{t('auth.password.submit')}</span>
+                            <ArrowRight className="!size-3.5" />
+                        </>
+                    )}
+                </SignInStepButton>
+            </form>
+        </SignInStepLayout>
+    );
+}

package/src/shell/login/SignInPrimitives.tsx

@@ -363,6 +363,11 @@ export function SignInOrDivider({ children }: { children: ReactNode }) {
     );
 }
 
+const SIGNIN_INPUT_CLASS =
+    'h-[42px] px-3.5 rounded-md border border-border bg-background text-sm text-foreground placeholder:text-muted ' +
+    'outline-none transition focus:border-info focus:ring-4 focus:ring-info/15 ' +
+    'aria-[invalid=true]:border-destructive aria-[invalid=true]:ring-destructive/15';
+
 interface SignInEmailFieldProps {
     inputRef?: Ref<HTMLInputElement>;
     label: ReactNode;
@@ -393,7 +398,7 @@ export function SignInEmailField({
                 id="vt-login-email"
                 name="vt-login-email"
                 type="email"
-                className="h-[42px] px-3.5 rounded-md border border-border bg-background text-sm text-foreground placeholder:text-muted outline-none transition focus:border-info focus:ring-4 focus:ring-info/15 aria-[invalid=true]:border-destructive aria-[invalid=true]:ring-destructive/15"
+                className={SIGNIN_INPUT_CLASS}
                 placeholder={placeholder}
                 value={value}
                 onChange={(e) => onChange(e.target.value)}
@@ -414,3 +419,50 @@ export function SignInEmailField({
         </div>
     );
 }
+
+interface SignInPasswordFieldProps {
+    inputRef?: Ref<HTMLInputElement>;
+    label: ReactNode;
+    value: string;
+    onChange: (value: string) => void;
+    invalid?: boolean;
+    error?: ReactNode;
+}
+
+/**
+ * Labeled password input with an inline error. Unlike the email field it leaves password managers
+ * enabled: a password account's credential is issued once and is expected to be stored in one.
+ */
+export function SignInPasswordField({
+    inputRef,
+    label,
+    value,
+    onChange,
+    invalid = false,
+    error,
+}: SignInPasswordFieldProps) {
+    return (
+        <div className="flex flex-col gap-1.5">
+            <label htmlFor="vt-login-password" className="text-xs font-medium text-foreground/80">
+                {label}
+            </label>
+            <input
+                ref={inputRef}
+                id="vt-login-password"
+                name="vt-login-password"
+                type="password"
+                className={SIGNIN_INPUT_CLASS}
+                value={value}
+                onChange={(e) => onChange(e.target.value)}
+                aria-invalid={invalid}
+                aria-describedby={error ? 'vt-login-password-error' : undefined}
+                autoComplete="current-password"
+            />
+            {error && (
+                <div id="vt-login-password-error" role="alert" className="text-xs text-destructive">
+                    {error}
+                </div>
+            )}
+        </div>
+    );
+}

package/src/shell/login/SignInProvidersStep.tsx

@@ -1,27 +1,31 @@
 import { useUITranslation } from '@vertesia/ui/i18n';
 import { SignInEmailRow, SignInProviderButton, SignInStepHeader, SignInStepLayout } from './SignInPrimitives';
-import { type ProviderId, providerLabel, startSignIn } from './signInUtils';
+import { type ProviderId, providerLabel, type RedirectProviderId, startSignIn } from './signInUtils';
 
 interface SignInProvidersStepProps {
     email: string;
     onBack: () => void;
     onProviderClicked: (provider: ProviderId) => void;
+    /** The address resolved to a password tenant on retry, so the parent shows the password step. */
+    onPasswordRequired: (email: string) => void;
     redirectTo?: string;
 }
 
-const PROVIDERS: ProviderId[] = ['google', 'github', 'microsoft'];
+const PROVIDERS: RedirectProviderId[] = ['google', 'github', 'microsoft'];
 
 export default function SignInProvidersStep({
     email,
     onBack,
     onProviderClicked,
+    onPasswordRequired,
     redirectTo,
 }: SignInProvidersStepProps) {
     const { t } = useUITranslation();
 
-    const pick = async (provider: ProviderId) => {
+    const pick = async (provider: RedirectProviderId) => {
         onProviderClicked(provider);
-        await startSignIn(provider, email, redirectTo);
+        const result = await startSignIn(provider, email, redirectTo);
+        if (!result.ok && result.reason === 'password-required') onPasswordRequired(email);
     };
 
     return (

package/src/shell/login/SignInReturningStep.tsx

@@ -21,6 +21,8 @@ interface SignInReturningStepProps {
     session: LastSuccessfulLogin;
     onNotYou: () => void;
     onProviderClicked: (provider: ProviderId) => void;
+    /** The address signs in with a password, so the parent shows the password step instead. */
+    onPasswordRequired: (email: string) => void;
     redirectTo?: string;
 }
 
@@ -28,6 +30,7 @@ export default function SignInReturningStep({
     session,
     onNotYou,
     onProviderClicked,
+    onPasswordRequired,
     redirectTo,
 }: SignInReturningStepProps) {
     const { t } = useUITranslation();
@@ -36,14 +39,23 @@ export default function SignInReturningStep({
     const avatar = <SignInInitialsBadge initials={emailInitial(session.email)} />;
     // A stored tenantName means we resolved the user's organization.
     const hasTenant = !!session.tenantName;
+    const lastProvider = session.lastProvider;
     const primaryLabel =
-        session.lastProvider === 'oidc'
-            ? t('auth.continueWithSignIn')
-            : t('auth.continueWithProvider', { provider: providerLabel(session.lastProvider) });
+        lastProvider === 'password'
+            ? t('auth.password.continue')
+            : lastProvider === 'oidc'
+              ? t('auth.continueWithSignIn')
+              : t('auth.continueWithProvider', { provider: providerLabel(lastProvider) });
 
-    const continueWith = async (provider: ProviderId) => {
-        onProviderClicked(provider);
-        await startSignIn(provider, session.email, redirectTo);
+    const continueWithLastProvider = async () => {
+        if (lastProvider === 'password') {
+            onPasswordRequired(session.email);
+            return;
+        }
+        onProviderClicked(lastProvider);
+        // The stored provider can be stale: the address may now resolve to a password tenant.
+        const result = await startSignIn(lastProvider, session.email, redirectTo);
+        if (!result.ok && result.reason === 'password-required') onPasswordRequired(session.email);
     };
 
     return (
@@ -76,9 +88,9 @@ export default function SignInReturningStep({
 
             <div className="flex flex-col gap-2">
                 <SignInProviderButton
-                    provider={session.lastProvider}
+                    provider={lastProvider}
                     label={primaryLabel}
-                    onClick={() => continueWith(session.lastProvider)}
+                    onClick={continueWithLastProvider}
                     variant="filled"
                 />
                 <SignInStepButton variant="ghost" onClick={onNotYou}>

package/src/shell/login/SignInTenantStep.tsx

@@ -8,13 +8,15 @@ import {
     SignInStepLayout,
 } from './SignInPrimitives';
 import SignInWithProviderButton from './SignInWithProviderButton';
-import { type ProviderId, providerLabel } from './signInUtils';
+import { providerLabel, type RedirectProviderId } from './signInUtils';
 
 interface SignInTenantStepProps {
     email: string;
     tenant: TenantInfo;
     onBack: () => void;
     onProviderClicked: () => void;
+    /** The tenant re-resolved as a password tenant, so the parent shows the password step. */
+    onPasswordRequired: (email: string) => void;
     redirectTo?: string;
 }
 
@@ -32,12 +34,13 @@ export default function SignInTenantStep({
     tenant,
     onBack,
     onProviderClicked,
+    onPasswordRequired,
     redirectTo,
 }: SignInTenantStepProps) {
     const { t } = useUITranslation();
     const tenantName = tenant.label || tenant.name || t('auth.blocked.tenantFallback');
     // Brands keep their identity; anything else routes through OIDC.
-    const provider: ProviderId =
+    const provider: RedirectProviderId =
         tenant.provider === 'google' || tenant.provider === 'github' || tenant.provider === 'microsoft'
             ? tenant.provider
             : 'oidc';
@@ -68,6 +71,7 @@ export default function SignInTenantStep({
                     redirectTo={redirectTo}
                     variant="filled"
                     onClick={onProviderClicked}
+                    onPasswordRequired={() => onPasswordRequired(email)}
                 />
                 <SignInStepButton variant="ghost" onClick={onBack}>
                     {t('auth.tenant.notPartOf', { name: tenantName })}

package/src/shell/login/SignInWithProviderButton.tsx

@@ -1,15 +1,17 @@
 import { useUITranslation } from '@vertesia/ui/i18n';
 import { SignInProviderButton } from './SignInPrimitives';
-import { type ProviderId, providerLabel, startSignIn, startSignInWithoutTenant } from './signInUtils';
+import { providerLabel, type RedirectProviderId, startSignIn, startSignInWithoutTenant } from './signInUtils';
 
 interface SignInWithProviderButtonProps {
-    provider: ProviderId;
+    provider: RedirectProviderId;
     /** Email for the tenant-aware flow. Omit for a no-tenant sign-in (e.g. SignInModal). */
     email?: string;
     redirectTo?: string;
     variant?: 'outline' | 'filled';
     /** Fired on click, before the redirect. */
     onClick?: () => void;
+    /** Fired instead of a redirect when the email resolves to a password tenant. */
+    onPasswordRequired?: () => void;
 }
 
 // "Continue with <provider>" button that owns its sign-in redirect.
@@ -19,6 +21,7 @@ export default function SignInWithProviderButton({
     redirectTo,
     variant = 'outline',
     onClick,
+    onPasswordRequired,
 }: SignInWithProviderButtonProps) {
     const { t } = useUITranslation();
     const label =
@@ -26,15 +29,16 @@ export default function SignInWithProviderButton({
             ? t('auth.continueWithSignIn')
             : t('auth.continueWithProvider', { provider: providerLabel(provider) });
 
-    const signIn = () => {
+    const signIn = async () => {
         onClick?.();
-        if (email) {
-            void startSignIn(provider, email, redirectTo);
-        } else {
+        if (!email) {
             // OIDC needs a resolved tenant; the no-email path is only hit by no-tenant buttons.
             startSignInWithoutTenant(provider, redirectTo);
+            return;
         }
+        const result = await startSignIn(provider, email, redirectTo);
+        if (!result.ok && result.reason === 'password-required') onPasswordRequired?.();
     };
 
-    return <SignInProviderButton provider={provider} label={label} onClick={signIn} variant={variant} />;
+    return <SignInProviderButton provider={provider} label={label} onClick={() => void signIn()} variant={variant} />;
 }