@vertesia/ui 1.5.0 → 1.6.0-dev.20260918.061604Z

package/src/session/auth/composable.renewal.test.ts

@@ -0,0 +1,170 @@
+// @vitest-environment jsdom
+//
+// Renewal of a Central Auth session: the case where the browser holds an STS JWT, nothing else, and
+// that JWT has expired. There is no Firebase user to mint a replacement from and no refresh token,
+// so the token layer either bounces through the broker or the page dead-ends until someone reloads
+// it by hand.
+import { NO_ACCESSIBLE_ACCOUNT_ERROR_CODE } from '@vertesia/common';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const logger = { debug: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn() };
+
+vi.mock('@vertesia/ui/env', () => ({
+    Env: {
+        endpoints: { sts: 'https://sts.test', studio: 'https://studio.test', auth: 'https://auth.test/' },
+        logger,
+    },
+}));
+
+// No Firebase user: that is what makes this a Central Auth session rather than a Firebase one.
+vi.mock('./firebase', () => ({
+    getFirebaseAuth: () => ({ currentUser: null }),
+    getFirebaseAuthToken: vi.fn(),
+}));
+
+function unsignedJwt(payload: Record<string, unknown>): string {
+    const encode = (value: string) => btoa(value).replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
+    return `${encode(JSON.stringify({ alg: 'none', typ: 'JWT' }))}.${encode(JSON.stringify(payload))}.signature`;
+}
+
+const ACCOUNT_ID = 'account-1';
+const PROJECT_ID = 'project-1';
+
+/** A token STS would accept back for re-issuance: its own issuer, and real authorization claims. */
+function stsToken(secondsFromNow: number): string {
+    return unsignedJwt({
+        iss: 'https://sts.test',
+        exp: Math.floor(Date.now() / 1000) + secondsFromNow,
+        account: { id: ACCOUNT_ID },
+        project: { id: PROJECT_ID },
+        permissions: ['content:read'],
+    });
+}
+
+function okResponse(token: string): Response {
+    return new Response(JSON.stringify({ token }), { status: 200 });
+}
+
+let replace: ReturnType<typeof vi.fn>;
+
+beforeEach(() => {
+    vi.restoreAllMocks();
+    vi.resetModules();
+    localStorage.clear();
+    sessionStorage.clear();
+    logger.info.mockClear();
+    logger.warn.mockClear();
+
+    // `location.replace` is the redirect under test; jsdom's own implementation would only warn.
+    replace = vi.fn();
+    vi.stubGlobal('location', {
+        href: 'https://cloud.test/studio/environments',
+        replace,
+    });
+    // `shouldRedirectToCentralAuth()` is "not Firebase mode", which is the default here.
+    window.AUTH_MODE = undefined;
+});
+
+describe('forced refresh of a Central Auth session', () => {
+    it('re-mints through STS instead of handing back the credential it already holds', async () => {
+        // The bug this pins: the refresh path adopted a still-valid Vertesia token as its own
+        // result, so `refreshAuthToken()` -- whose whole purpose is to re-read claims STS
+        // recomputes on every issuance, such as `apps` after an ACE change -- silently returned the
+        // very token whose claims were suspect. A Central Auth session has no other credential, so
+        // the no-op was total there.
+        const fetchMock = vi.spyOn(globalThis, 'fetch').mockResolvedValue(okResponse(stsToken(7200)));
+
+        const { getComposableToken } = await import('./composable');
+        // Adopted without a round-trip, which is the right call when nothing forced a refresh.
+        const first = await getComposableToken(ACCOUNT_ID, PROJECT_ID, stsToken(3600));
+        expect(fetchMock).not.toHaveBeenCalled();
+
+        const refreshed = await getComposableToken(undefined, undefined, undefined, true);
+
+        // Before the fix this was zero: the same shortcut swallowed the forced refresh too.
+        expect(fetchMock).toHaveBeenCalledTimes(1);
+        expect(refreshed.token.exp).toBeGreaterThan(first.token.exp);
+    });
+});
+
+describe('an expired Central Auth session', () => {
+    /**
+     * Establish a session whose token is already inside the five-minute renewal window, then answer
+     * the renewal attempt with `status`. This is the shape of the reported incident: the tab sat
+     * idle, the token aged out, and the next click tried to renew from a credential STS refuses.
+     */
+    async function sessionThenRenewalFailure(status: number, body?: unknown) {
+        const nearlyExpired = stsToken(60);
+        vi.spyOn(globalThis, 'fetch')
+            .mockResolvedValueOnce(okResponse(nearlyExpired))
+            .mockResolvedValueOnce(new Response(body === undefined ? null : JSON.stringify(body), { status }));
+
+        const { getComposableToken } = await import('./composable');
+        await getComposableToken(ACCOUNT_ID, PROJECT_ID, nearlyExpired);
+        return getComposableToken;
+    }
+
+    it('bounces through the broker rather than dead-ending', async () => {
+        const getComposableToken = await sessionThenRenewalFailure(401);
+
+        await expect(getComposableToken(ACCOUNT_ID, PROJECT_ID)).rejects.toThrow();
+
+        expect(replace).toHaveBeenCalledTimes(1);
+        const url = new URL(replace.mock.calls[0][0] as string);
+        expect(url.origin).toBe('https://auth.test');
+        expect(url.searchParams.get('sts')).toBe('https://sts.test');
+        expect(url.searchParams.get('redirect_uri')).toBe('https://cloud.test/studio/environments');
+        // The broker echoes `state` back; the return leg verifies it against this record.
+        expect(url.searchParams.get('state')).toBe(sessionStorage.getItem('auth_state'));
+    });
+
+    it('redirects once per expiry, not once per failing call', async () => {
+        // Every in-flight request fails at the same moment, and the first failure discards the
+        // credential -- so the calls behind it reach the "no credential at all" branch. Without the
+        // cooldown each one would start its own navigation.
+        const getComposableToken = await sessionThenRenewalFailure(401);
+
+        await expect(getComposableToken(ACCOUNT_ID, PROJECT_ID)).rejects.toThrow();
+        await expect(getComposableToken(ACCOUNT_ID, PROJECT_ID)).rejects.toThrow(/Cannot acquire/);
+
+        expect(replace).toHaveBeenCalledTimes(1);
+    });
+
+    it('does not redirect again for a broker round-trip that just failed', async () => {
+        // The loop guard, from the other side of the navigation: module state is gone, so the
+        // cooldown has to be read back from sessionStorage. A broker that returns a credential STS
+        // also refuses would otherwise bounce the browser between the two forever.
+        sessionStorage.setItem('vt.centralAuthRenewalAt', String(Date.now() - 1_000));
+        const getComposableToken = await sessionThenRenewalFailure(401);
+
+        await expect(getComposableToken(ACCOUNT_ID, PROJECT_ID)).rejects.toThrow();
+
+        expect(replace).not.toHaveBeenCalled();
+        expect(logger.warn).toHaveBeenCalledWith(expect.stringContaining('already attempted'), expect.anything());
+    });
+
+    it('leaves an account-level refusal alone', async () => {
+        // The broker would hand back the same identity and STS would refuse it again. This is a
+        // question for the recovery screen, not for another round-trip.
+        const getComposableToken = await sessionThenRenewalFailure(403, {
+            errorCode: NO_ACCESSIBLE_ACCOUNT_ERROR_CODE,
+        });
+
+        await expect(getComposableToken(ACCOUNT_ID, PROJECT_ID)).rejects.toThrow();
+
+        expect(replace).not.toHaveBeenCalled();
+    });
+});
+
+describe('a browser with no session yet', () => {
+    it('does not redirect from the token layer', async () => {
+        // First load is UserSessionProvider's to route: it holds the account/project selection this
+        // layer cannot see, and it already redirects. Renewing from here would race it.
+        vi.spyOn(globalThis, 'fetch').mockResolvedValue(new Response(null, { status: 401 }));
+
+        const { getComposableToken } = await import('./composable');
+        await expect(getComposableToken(ACCOUNT_ID, PROJECT_ID, stsToken(-60))).rejects.toThrow();
+
+        expect(replace).not.toHaveBeenCalled();
+    });
+});

package/src/session/auth/composable.test.ts

@@ -5,7 +5,10 @@ function makeJwt(payload: Record<string, unknown>) {
     return `${encode({ alg: 'ES256', typ: 'JWT' })}.${encode(payload)}.signature`;
 }
 
-async function importComposableAuth(authTokenProvider?: () => Promise<string | undefined>) {
+async function importComposableAuth(
+    authTokenProvider?: () => Promise<string | undefined>,
+    defaultAuthSelection?: { accountId?: string; projectId?: string },
+) {
     vi.resetModules();
     const [{ Env }, composableAuth] = await Promise.all([import('@vertesia/ui/env'), import('./composable')]);
     Env.init({
@@ -20,6 +23,7 @@ async function importComposableAuth(authTokenProvider?: () => Promise<string | u
             sts: 'https://sts.dev1.vertesia.io',
         },
         authTokenProvider,
+        defaultAuthSelection,
     });
     return composableAuth;
 }
@@ -374,3 +378,21 @@ describe('resolveAuthSelection', () => {
         });
     });
 });
+
+describe('configured workspace selection', () => {
+    afterEach(() => localStorage.clear());
+    it.each([
+        [{ accountId: 'env-a', projectId: 'env-p' }, '', { accountId: 'env-a', projectId: 'env-p' }],
+        [{ projectId: 'env-p' }, '', { accountId: undefined, projectId: 'env-p' }],
+        [{ accountId: 'env-a' }, '', { accountId: 'env-a', projectId: 'env-a-cached-p' }],
+        [{ accountId: 'env-a', projectId: 'env-p' }, '?p=url-p', { accountId: undefined, projectId: 'url-p' }],
+        [{ accountId: 'env-a', projectId: 'env-p' }, '?a=url-a', { accountId: 'url-a', projectId: undefined }],
+        [{ accountId: 'env-a', projectId: 'env-p' }, '?a=url-a&p=url-p', { accountId: 'url-a', projectId: 'url-p' }],
+    ] as const)('selects %j with URL %s', async (selection, query, expected) => {
+        localStorage.setItem('composableai.lastSelectedAccountId', 'old-a');
+        localStorage.setItem('composableai.lastSelectedProjectId-old-a', 'old-p');
+        localStorage.setItem('composableai.lastSelectedProjectId-env-a', 'env-a-cached-p');
+        const { resolveAuthSelection } = await importComposableAuth(undefined, selection);
+        expect(resolveAuthSelection(new URL(`https://app.example.test/${query}`))).toEqual(expected);
+    });
+});

package/src/session/auth/composable.ts

@@ -10,11 +10,86 @@ import {
 import { Env } from '@vertesia/ui/env';
 import { jwtDecode } from 'jwt-decode';
 import { LastSelectedAccountId_KEY, LastSelectedProjectId_KEY } from '../constants';
+import { generateAuthState } from './authState';
+import {
+    authReturnUrl,
+    buildCentralAuthRedirectUrl,
+    centralAuthUrl,
+    shouldRedirectToCentralAuth,
+} from './domainRouting';
 import { getFirebaseAuth, getFirebaseAuthToken } from './firebase';
 
 let AUTH_TOKEN_RAW: string | undefined;
 let AUTH_TOKEN: AuthTokenPayload | undefined;
 
+/**
+ * Whether this tab ever held a token.
+ *
+ * Separates "the session expired" from "there is no session yet". Only the first is renewed from
+ * here; the first load is UserSessionProvider's, and it has the account/project selection that
+ * this layer does not.
+ */
+let HAD_SESSION = false;
+
+/** Session-storage stamp of the last renewal redirect, so the cooldown survives the navigation. */
+const RENEWAL_ATTEMPT_KEY = 'vt.centralAuthRenewalAt';
+const RENEWAL_COOLDOWN_MS = 60_000;
+
+/**
+ * Renew an expired Central Auth session by bouncing through the broker.
+ *
+ * A Central Auth session holds exactly one credential -- the STS JWT, in memory -- and STS refuses
+ * it once it has expired. There is no Firebase user in this browser to mint a replacement from and
+ * no refresh token, so the only way back is the broker, which still has the user's own session and
+ * returns a fresh identity token without prompting. That is precisely what a manual reload does
+ * today; doing it here turns a page that dead-ends on "Cannot acquire a composable token" into a
+ * redirect the user usually does not notice.
+ *
+ * The cooldown is the important part. If the broker returns a credential STS also rejects, an
+ * unguarded redirect bounces the browser between the two forever -- and a redirect loop is a worse
+ * failure than the error page it replaced, because it never comes to rest anywhere the user can
+ * read. One attempt per minute, recorded in sessionStorage because the module state does not
+ * survive the navigation this function starts.
+ *
+ * Returns whether a redirect was started.
+ */
+function renewExpiredCentralAuthSession(): boolean {
+    if (!HAD_SESSION || !shouldRedirectToCentralAuth()) {
+        return false;
+    }
+
+    let lastAttempt = 0;
+    try {
+        lastAttempt = Number(sessionStorage.getItem(RENEWAL_ATTEMPT_KEY) ?? '0');
+    } catch {
+        // sessionStorage unavailable -- treated as "no previous attempt", so the redirect is
+        // allowed once and the failure surfaces normally if it does not stick.
+    }
+    if (Number.isFinite(lastAttempt) && lastAttempt > 0 && Date.now() - lastAttempt < RENEWAL_COOLDOWN_MS) {
+        Env.logger.warn('Central Auth session renewal already attempted; surfacing the failure instead', {
+            vertesia: { last_attempt_ms_ago: Date.now() - lastAttempt },
+        });
+        return false;
+    }
+
+    try {
+        sessionStorage.setItem(RENEWAL_ATTEMPT_KEY, String(Date.now()));
+    } catch {
+        // Without the stamp the cooldown cannot be enforced across the navigation. Still worth
+        // redirecting once: the alternative is a page the user can only fix by reloading manually.
+    }
+
+    Env.logger.info('Renewing an expired Central Auth session through the broker');
+    const url = buildCentralAuthRedirectUrl(
+        centralAuthUrl(),
+        Env.endpoints.sts ?? 'https://sts.vertesia.io',
+        authReturnUrl(),
+        generateAuthState(),
+    );
+    location.replace(url.toString());
+    return true;
+}
+
 function clearRejectedPersistedScope(accountId?: string, projectId?: string) {
     if (!accountId) return;
 
@@ -62,8 +137,11 @@ function identityFromAcceptedToken(token: string): AuthenticatedIdentity | undef
 }
 
 export function resolveAuthSelection(currentUrl: URL): { accountId?: string; projectId?: string } {
-    const urlAccount = currentUrl.searchParams.get('a') ?? undefined;
-    const urlProject = currentUrl.searchParams.get('p') ?? undefined;
+    // A URL selection owns the whole pair: never attach an unrelated configured account/project.
+    const hasUrlScope = currentUrl.searchParams.has('a') || currentUrl.searchParams.has('p');
+    const defaults = hasUrlScope ? undefined : Env.defaultAuthSelection;
+    const urlAccount = currentUrl.searchParams.get('a') ?? defaults?.accountId;
+    const urlProject = currentUrl.searchParams.get('p') ?? defaults?.projectId;
     const accountId =
         urlAccount ??
         (urlProject === undefined ? (localStorage.getItem(LastSelectedAccountId_KEY) ?? undefined) : undefined);
@@ -434,6 +512,7 @@ export async function getComposableToken(
         cachedTokenMatchesScope &&
         AUTH_TOKEN.exp > Date.now() / 1000 + 300
     ) {
+        HAD_SESSION = true;
         return { rawToken: AUTH_TOKEN_RAW, token: AUTH_TOKEN, error: false };
     }
 
@@ -447,6 +526,7 @@ export async function getComposableToken(
         if (!AUTH_TOKEN.exp) {
             throw new Error('Invalid composable token');
         }
+        HAD_SESSION = true;
         return { rawToken: AUTH_TOKEN_RAW, token: AUTH_TOKEN, error: false };
     }
 
@@ -458,7 +538,14 @@ export async function getComposableToken(
         } else if (!devAuthToken) {
             // Embedded apps can reacquire a fresh credential from their host after their cached token expires.
             const refreshCredential = (await Env.authTokenProvider?.()) ?? initToken ?? AUTH_TOKEN_RAW;
+            // `forceRefresh` has to defeat this shortcut, not just the cache above it. A caller
+            // asking for a forced refresh wants claims recomputed -- `refreshAuthToken()` exists so
+            // a stale `apps` claim can be re-read after an ACE change, and STS recomputes it on
+            // every issuance. Adopting the credential we already hold satisfies the check and
+            // returns the very token whose claims were suspect, silently making the call a no-op
+            // for exactly the sessions that have no other credential to fall back on.
             if (
+                !forceRefresh &&
                 refreshCredential &&
                 isVertesiaIssuedToken(refreshCredential) &&
                 canUseVertesiaTokenDirectly(refreshCredential, selectedAccount, selectedProject)
@@ -488,6 +575,13 @@ export async function getComposableToken(
                 clearRejectedPersistedScope(selectedAccount, selectedProject);
             }
         }
+        // An expired Central Auth session presents as a rejected credential: the JWT we sent STS to
+        // renew from is the one that timed out. The broker can still vouch for the user. Only this
+        // error -- a scope or account failure is about who the user is, and the broker would hand
+        // back the same identity and the same refusal.
+        if (error instanceof CredentialError) {
+            renewExpiredCentralAuthSession();
+        }
         throw error;
     }
 
@@ -498,6 +592,10 @@ export async function getComposableToken(
                 project_id: selectedProject,
             },
         });
+        // Reached once the credential has already been discarded -- typically the call after the
+        // one that saw STS reject it. Same remedy, and the cooldown keeps this from redirecting a
+        // second time for the same expiry.
+        renewExpiredCentralAuthSession();
         throw new Error('Cannot acquire a composable token');
     }
 
@@ -514,6 +612,7 @@ export async function getComposableToken(
         throw new Error('Invalid composable token');
     }
 
+    HAD_SESSION = true;
     return { rawToken: AUTH_TOKEN_RAW, token: AUTH_TOKEN, error: false };
 }
 

package/src/session/auth/domainRouting.test.ts

@@ -1,12 +1,12 @@
 import { Env } from '@vertesia/ui/env';
-import { afterEach, describe, expect, it, vi } from 'vitest';
+import { afterEach, describe, expect, it } from 'vitest';
 import {
-    centralAuthRedirectUrl,
+    centralAuthUrl,
     clearCentralAuthRoundTripMarker,
+    DEFAULT_CENTRAL_AUTH_URL,
     isCentralAuthRedirectPending,
     markCentralAuthRoundTripStarted,
     mountRootUrl,
-    redirectToCentralAuth,
     shouldRedirectToCentralAuth,
     shouldUseFirebaseAuth,
 } from './domainRouting';
@@ -40,24 +40,6 @@ describe('domainRouting', () => {
         expect(shouldRedirectToCentralAuth()).toBe(true);
     });
 
-    it('carries the selected account and project through central auth for a gateway-mounted app', () => {
-        const redirect = centralAuthRedirectUrl({
-            centralAuthUrl: 'https://internal-auth.vertesia.app/',
-            stsEndpoint: 'https://sts.example.test',
-            returnUrl: new URL('https://apps.example.test/tenants/t/apps/a/versions/v/app/?view=grid'),
-            state: 'state-1',
-            accountId: 'account-1',
-            projectId: 'project-1',
-        });
-        const returnUrl = new URL(redirect.searchParams.get('redirect_uri') || '');
-
-        expect(redirect.searchParams.get('sts')).toBe('https://sts.example.test');
-        expect(redirect.searchParams.get('state')).toBe('state-1');
-        expect(returnUrl.toString()).toBe(
-            'https://apps.example.test/tenants/t/apps/a/versions/v/app/?view=grid&p=project-1&a=account-1',
-        );
-    });
-
     describe('mountRootUrl', () => {
         it('returns the deep gateway mount root (dropping any deep route / query / hash)', () => {
             const mount = 'https://gw.example.com/tenants/05948c_5ed5f4/apps/furniture-catalog/versions/v1/app/';
@@ -80,6 +62,37 @@ describe('domainRouting', () => {
     });
 });
 
+describe('centralAuthUrl', () => {
+    function initEnv(auth?: string) {
+        Env.init({
+            name: 'test',
+            version: '0',
+            isLocalDev: true,
+            isDocker: false,
+            type: 'development',
+            endpoints: { studio: 'https://studio.test', zeno: 'https://zeno.test', sts: 'https://sts.test', auth },
+        });
+    }
+
+    it('falls back to the default broker when no auth endpoint is configured', () => {
+        initEnv(undefined);
+        expect(centralAuthUrl()).toBe(DEFAULT_CENTRAL_AUTH_URL);
+        expect(DEFAULT_CENTRAL_AUTH_URL).toBe('https://internal-auth.vertesia.app/');
+    });
+
+    it('uses the configured auth endpoint when one is set', () => {
+        initEnv('https://auth.vertesia.io/');
+        expect(centralAuthUrl()).toBe('https://auth.vertesia.io/');
+    });
+
+    // An empty string is what an unset VITE_* override collapses to; it must not become the broker
+    // URL, or the app would redirect to its own origin instead of a login page.
+    it('treats an empty auth endpoint as unconfigured', () => {
+        initEnv('');
+        expect(centralAuthUrl()).toBe(DEFAULT_CENTRAL_AUTH_URL);
+    });
+});
+
 // The boot-time counterpart of the redirect UserSessionProvider performs after mounting. It must
 // answer true only when that provider is certain to redirect, because an app's entry module skips
 // the whole React tree on the strength of it -- and false whenever the answer is not certain, which
@@ -116,7 +129,7 @@ describe('isCentralAuthRedirectPending', () => {
         expect(isCentralAuthRedirectPending()).toBe(true);
     });
 
-    it('is false when AUTH_MODE is firebase, which signs in without the broker', () => {
+    it('is false on a Firebase-allowlisted host, which signs in without the broker', () => {
         initEnv({});
         (globalThis as { window?: unknown }).window = { AUTH_MODE: 'firebase', location: { hash: '' } };
         expect(isCentralAuthRedirectPending()).toBe(false);
@@ -199,46 +212,3 @@ describe('central auth round-trip marker', () => {
         expect(document.cookie).toBe('vtsauth=; Path=/; Max-Age=0; SameSite=Lax; Secure');
     });
 });
-
-// The shared redirect must preserve release/1.5's gateway selection and write state that
-// the provider's hook accepts when the broker returns.
-describe('redirectToCentralAuth', () => {
-    afterEach(() => {
-        vi.unstubAllGlobals();
-        sessionStorage.clear();
-        Env.init();
-    });
-
-    it('keeps the gateway mount and selection, records state, and marks the round trip before navigating', async () => {
-        const { verifyAuthState, clearAuthState } = await import('./authState');
-        const mount = 'https://apps.test/tenants/t/apps/a/versions/v/app/';
-        const document = { baseURI: mount, cookie: '' };
-        const replace = vi.fn((target: string) => {
-            const url = new URL(target);
-            expect(document.cookie).toBe('vtsauth=1; Path=/; Max-Age=300; SameSite=Lax; Secure');
-            expect(verifyAuthState(url.searchParams.get('state'))).toBeUndefined();
-        });
-        vi.stubGlobal('window', { location: { href: 'https://apps.test/?view=grid#old', protocol: 'https:' } });
-        vi.stubGlobal('document', document);
-        vi.stubGlobal('location', { replace });
-        Env.init({
-            name: 'test',
-            version: '0',
-            isLocalDev: false,
-            isDocker: false,
-            type: 'production',
-            endpoints: { studio: 'https://studio.test', zeno: 'https://zeno.test', sts: 'https://sts.test/?x=1&y=2' },
-        });
-
-        redirectToCentralAuth({ accountId: 'account-1', projectId: 'project-1' });
-
-        expect(replace).toHaveBeenCalledOnce();
-        const url = new URL(replace.mock.calls[0][0]);
-        expect(url.origin).toBe('https://internal-auth.vertesia.app');
-        expect(url.searchParams.get('sts')).toBe('https://sts.test/?x=1&y=2');
-        expect(url.searchParams.get('redirect_uri')).toBe(`${mount}?p=project-1&a=account-1`);
-        expect(verifyAuthState('wrong')).toContain('State mismatched');
-        clearAuthState();
-        expect(verifyAuthState(url.searchParams.get('state'))).toContain('State mismatched');
-    });
-});

package/src/session/auth/domainRouting.ts

@@ -7,6 +7,20 @@ declare global {
     }
 }
 
+/**
+ * The broker this app sends users to for sign-in and logout.
+ *
+ * Hard-coded until now, which meant every consumer of this package reached the same deployment no
+ * matter what was running. It is read from the environment so a single app can be pointed at a
+ * different broker, and it keeps this default so an app that configures nothing is unaffected.
+ */
+export const DEFAULT_CENTRAL_AUTH_URL = 'https://internal-auth.vertesia.app/';
+
+export function centralAuthUrl(): string {
+    const configured = Env.endpoints.auth;
+    return configured ? configured : DEFAULT_CENTRAL_AUTH_URL;
+}
+
 export function shouldUseFirebaseAuth(_hostname?: string) {
     return window.AUTH_MODE === 'firebase';
 }
@@ -15,35 +29,11 @@ export function shouldRedirectToCentralAuth(_hostname?: string) {
     return !shouldUseFirebaseAuth();
 }
 
-interface CentralAuthRedirectOptions {
-    centralAuthUrl: string;
-    stsEndpoint: string;
-    returnUrl: URL;
-    state: string;
+interface AuthSelection {
     accountId?: string;
     projectId?: string;
 }
 
-/** Build a central-auth round trip without losing the app's requested account/project selection. */
-export function centralAuthRedirectUrl({
-    centralAuthUrl,
-    stsEndpoint,
-    returnUrl,
-    state,
-    accountId,
-    projectId,
-}: CentralAuthRedirectOptions): URL {
-    const selectedReturnUrl = new URL(returnUrl);
-    if (projectId) selectedReturnUrl.searchParams.set('p', projectId);
-    if (accountId) selectedReturnUrl.searchParams.set('a', accountId);
-
-    const url = new URL(centralAuthUrl);
-    url.searchParams.set('sts', stsEndpoint);
-    url.searchParams.set('redirect_uri', selectedReturnUrl.toString());
-    url.searchParams.set('state', state);
-    return url;
-}
-
 /**
  * The page URL to return to after a central-auth round-trip (`redirect_uri`).
  *
@@ -82,6 +72,33 @@ export function mountRootUrl(): URL {
     return url;
 }
 
+/**
+ * The broker URL a sign-in or renewal round-trip navigates to.
+ *
+ * Every parameter goes on through `searchParams`, never by concatenating a query string onto
+ * `centralAuth`. The endpoint is configurable, so it may already carry its own query or a
+ * fragment -- and appending `?sts=...` to one of those folds the parameter into the existing value
+ * or hides it in the fragment, leaving Central Auth with no `sts` at all. `searchParams` also
+ * percent-encodes the values, which the interpolated URLs did not.
+ */
+export function buildCentralAuthRedirectUrl(
+    centralAuth: string,
+    stsUrl: string,
+    returnUrl: URL,
+    state: string,
+    selection: AuthSelection = {},
+): URL {
+    const selectedReturnUrl = new URL(returnUrl);
+    if (selection.projectId) selectedReturnUrl.searchParams.set('p', selection.projectId);
+    if (selection.accountId) selectedReturnUrl.searchParams.set('a', selection.accountId);
+
+    const url = new URL(centralAuth);
+    url.searchParams.set('sts', stsUrl);
+    url.searchParams.set('redirect_uri', selectedReturnUrl.toString());
+    url.searchParams.set('state', state);
+    return url;
+}
+
 /**
  * A short-lived marker saying "a Central Auth round-trip is in flight for this browser".
  *
@@ -128,14 +145,14 @@ export function clearCentralAuthRoundTripMarker(): void {
  * and {@link isCentralAuthRedirectPending}'s counterpart inside `UserSessionProvider` cannot drift
  * into producing different `redirect_uri` / `state` / `sts` values for the same page load.
  */
-export function redirectToCentralAuth(selection: { accountId?: string; projectId?: string } = {}): void {
-    const url = centralAuthRedirectUrl({
-        centralAuthUrl: 'https://internal-auth.vertesia.app/',
-        stsEndpoint: Env.endpoints.sts ?? 'https://sts.vertesia.io',
-        returnUrl: authReturnUrl(),
-        state: generateAuthState(),
-        ...selection,
-    });
+export function redirectToCentralAuth(selection: AuthSelection = {}): void {
+    const url = buildCentralAuthRedirectUrl(
+        centralAuthUrl(),
+        Env.endpoints.sts ?? 'https://sts.vertesia.io',
+        authReturnUrl(),
+        generateAuthState(),
+        selection,
+    );
     markCentralAuthRoundTripStarted();
     location.replace(url.toString());
 }
@@ -149,7 +166,7 @@ export function redirectToCentralAuth(selection: { accountId?: string; projectId
  * that provider from redirecting is therefore knowable up front, and this predicate enumerates
  * them in the same order:
  *
- *   - Apps configured with Firebase auth sign in in place rather than at the broker;
+ *   - Firebase-allowlisted hosts sign in in place rather than at the broker;
  *   - a host app that injects a token through `Env.authTokenProvider` may not need the broker
  *     (and when its token turns out to be empty the provider still redirects — answering `false`
  *     here just lets the normal flow decide, which is the safe direction);

package/src/session/auth/firebase.test.ts

@@ -0,0 +1,25 @@
+import { Env } from '@vertesia/ui/env';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { getFirebaseAuth, setFirebaseTenant } from './firebase';
+
+vi.mock('firebase/app', () => ({ initializeApp: vi.fn(() => ({})) }));
+vi.mock('firebase/auth', () => ({ getAuth: vi.fn(() => ({ tenantId: null })) }));
+
+describe('configured Firebase tenant', () => {
+    afterEach(() => vi.restoreAllMocks());
+
+    it('initializes redirect handling with the tenant and skips email discovery', async () => {
+        vi.spyOn(Env, 'firebase', 'get').mockReturnValue({
+            apiKey: 'key',
+            authDomain: 'app.example.com',
+            projectId: 'project',
+            tenantId: 'fixed-tenant',
+        });
+        const fetchSpy = vi.spyOn(globalThis, 'fetch');
+        expect(getFirebaseAuth().tenantId).toBe('fixed-tenant');
+        const tenant = await setFirebaseTenant('someone@another-company.com');
+        expect(tenant?.firebaseTenantId).toBe('fixed-tenant');
+        expect(tenant?.provider).toBe('oidc');
+        expect(fetchSpy).not.toHaveBeenCalled();
+    });
+});