@vertesia/ui 1.6.0-dev.20260912.110338Z → 1.6.0-dev.20260918.063824Z

package/src/session/auth/domainRouting.ts

@@ -10,11 +10,10 @@ declare global {
 /**
  * The broker this app sends users to for sign-in and logout.
  *
- * Hard-coded until now, which meant every consumer of this package reached the same deployment no
- * matter what was running. It is read from the environment so a single app can be pointed at a
- * different broker, and it keeps this default so an app that configures nothing is unaffected.
+ * A gateway or app can select a regional broker through Env.endpoints.auth.
+ * Unconfigured apps use the first-party central broker.
  */
-export const DEFAULT_CENTRAL_AUTH_URL = 'https://internal-auth.vertesia.app/';
+export const DEFAULT_CENTRAL_AUTH_URL = 'https://auth.vertesia.io/';
 
 export function centralAuthUrl(): string {
     const configured = Env.endpoints.auth;

package/src/session/auth/firebase.test.ts

@@ -0,0 +1,25 @@
+import { Env } from '@vertesia/ui/env';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { getFirebaseAuth, setFirebaseTenant } from './firebase';
+
+vi.mock('firebase/app', () => ({ initializeApp: vi.fn(() => ({})) }));
+vi.mock('firebase/auth', () => ({ getAuth: vi.fn(() => ({ tenantId: null })) }));
+
+describe('configured Firebase tenant', () => {
+    afterEach(() => vi.restoreAllMocks());
+
+    it('initializes redirect handling with the tenant and skips email discovery', async () => {
+        vi.spyOn(Env, 'firebase', 'get').mockReturnValue({
+            apiKey: 'key',
+            authDomain: 'app.example.com',
+            projectId: 'project',
+            tenantId: 'fixed-tenant',
+        });
+        const fetchSpy = vi.spyOn(globalThis, 'fetch');
+        expect(getFirebaseAuth().tenantId).toBe('fixed-tenant');
+        const tenant = await setFirebaseTenant('someone@another-company.com');
+        expect(tenant?.firebaseTenantId).toBe('fixed-tenant');
+        expect(tenant?.provider).toBe('oidc');
+        expect(fetchSpy).not.toHaveBeenCalled();
+    });
+});

package/src/session/auth/firebase.ts

@@ -37,11 +37,21 @@ export function getFirebaseAnalytics(): Analytics {
 export function getFirebaseAuth(): Auth {
     if (!_firebaseAuth) {
         _firebaseAuth = getAuth(getFirebaseApp());
+        _firebaseAuth.tenantId = Env.firebase?.tenantId ?? null;
     }
     return _firebaseAuth;
 }
 
 export async function setFirebaseTenant(tenantEmail?: string) {
+    if (Env.firebase?.tenantId) {
+        getFirebaseAuth().tenantId = Env.firebase.tenantId;
+        return {
+            firebaseTenantId: Env.firebase.tenantId,
+            provider: Env.firebase.providerType ?? 'oidc',
+            name: '',
+            label: '',
+        };
+    }
     if (!tenantEmail) {
         console.log('No tenant name or email specified, skipping tenant setup');
         return;

package/src/shell/login/SignInAuthPending.tsx

@@ -28,10 +28,10 @@ export default function SignInAuthPending({ provider, onCancel }: SignInAuthPend
             </div>
 
             <div className="w-full flex flex-col gap-2">
-                <SignInStepButton variant="loading">
+                <div className="flex justify-center">
                     <Spinner />
-                    <span>{t('auth.pending.authenticating')}</span>
-                </SignInStepButton>
+                </div>
+                <span>{t('auth.pending.authenticating')}</span>
                 {onCancel && (
                     <SignInStepButton variant="ghost" onClick={onCancel}>
                         {t('auth.pending.cancel')}

package/src/shell/login/SignInEmailStep.test.tsx

@@ -0,0 +1,32 @@
+import { cleanup, fireEvent, render, screen, waitFor } from '@testing-library/react';
+import { afterEach, expect, it, vi } from 'vitest';
+import SignInEmailStep from './SignInEmailStep';
+
+const resolveTenant = vi.hoisted(() => vi.fn());
+vi.mock('@vertesia/ui/session', () => ({ setFirebaseTenant: resolveTenant }));
+vi.mock('@vertesia/ui/i18n', () => ({ useUITranslation: () => ({ t: (key: string) => key }) }));
+afterEach(() => {
+    cleanup();
+    vi.clearAllMocks();
+});
+
+it('keeps feedback visible and prevents duplicate requests while tenant discovery is pending', async () => {
+    let finish!: () => void;
+    resolveTenant.mockReturnValue(
+        new Promise<void>((resolve) => {
+            finish = resolve;
+        }),
+    );
+    const onProceed = vi.fn();
+    render(<SignInEmailStep initialEmail="person@example.com" onProceed={onProceed} />);
+    const button = screen.getByRole('button', { name: 'auth.continue' });
+    fireEvent.click(button);
+    expect(screen.queryByRole('button', { name: 'auth.continue' })).toBeNull();
+    expect(screen.getByRole('textbox')).toBeTruthy();
+    expect(screen.getByRole('status')).toBeTruthy();
+    expect(button.contains(screen.getByRole('status'))).toBe(false);
+    fireEvent.submit(screen.getByRole('textbox').closest('form')!);
+    expect(resolveTenant).toHaveBeenCalledTimes(1);
+    finish();
+    await waitFor(() => expect(onProceed).toHaveBeenCalledWith('person@example.com', undefined));
+});

package/src/shell/login/SignInEmailStep.tsx

@@ -67,16 +67,20 @@ export default function SignInEmailStep({ initialEmail, onProceed }: SignInEmail
                     error={submitError ? t('auth.email.invalidError') : undefined}
                 />
 
-                <SignInStepButton type="submit" disabled={loading}>
-                    {loading ? (
+                {loading ? (
+                    <div
+                        role="status"
+                        aria-label={t('auth.pending.authenticating')}
+                        className="h-[42px] flex items-center justify-center"
+                    >
                         <Spinner />
-                    ) : (
-                        <>
-                            <span>{t('auth.continue')}</span>
-                            <ArrowRight className="!size-3.5" />
-                        </>
-                    )}
-                </SignInStepButton>
+                    </div>
+                ) : (
+                    <SignInStepButton type="submit">
+                        <span>{t('auth.continue')}</span>
+                        <ArrowRight className="!size-3.5" />
+                    </SignInStepButton>
+                )}
             </form>
         </SignInStepLayout>
     );

package/src/shell/login/signInUtils.ts

@@ -1,3 +1,4 @@
+import { Env } from '@vertesia/ui/env';
 import { getFirebaseAuth, setFirebaseTenant } from '@vertesia/ui/session';
 import {
     type AuthProvider,
@@ -197,7 +198,7 @@ export async function startSignIn(
     } else {
         // No tenant — clear any stale tenant routing from a prior attempt.
         localStorage.removeItem('tenantName');
-        if (auth.tenantId) auth.tenantId = null;
+        auth.tenantId = Env.firebase?.tenantId ?? null;
     }
 
     writePendingSignin({ email, provider: effectiveIdp, tenantName });
@@ -205,12 +206,19 @@ export async function startSignIn(
     return { ok: true };
 }
 
-/** Starts a provider sign-in directly, skipping email/tenant resolution and clearing any tenant routing. */
+/** Starts sign-in without email discovery, preserving an explicitly configured tenant. */
 export function startSignInWithoutTenant(provider: ProviderId, redirectTo?: string): void {
     const auth = getFirebaseAuth();
     localStorage.removeItem('tenantName');
-    if (auth.tenantId) auth.tenantId = null;
-    void signInWithRedirect(auth, buildFirebaseProvider(provider, undefined, redirectTo));
+    auth.tenantId = Env.firebase?.tenantId ?? null;
+    void signInWithRedirect(
+        auth,
+        buildFirebaseProvider(
+            Env.firebase?.tenantId ? ((Env.firebase.providerType as ProviderId) ?? 'oidc') : provider,
+            undefined,
+            redirectTo,
+        ),
+    );
 }
 
 export function providerLabel(id: ProviderId): string {

package/src/widgets/markdown/CollaborativeMarkdownRenderer.test.tsx

@@ -412,11 +412,19 @@ describe('collaborative Markdown actions', () => {
         await user.click(screen.getByRole('button', { name: 'Insert component after this block' }));
         await user.click(await screen.findByRole('menuitem', { name: 'Paragraph' }));
 
-        const editor = await screen.findByRole('textbox');
+        // The lazy editor first renders a textarea with the same template text. Wait for
+        // the actual rich-text editor before selecting and pasting into its content.
+        const editor = await waitFor(() => {
+            const textbox = screen.getByRole('textbox');
+            expect(textbox.getAttribute('contenteditable')).toBe('true');
+            expect(textbox.textContent).toBe('Paragraph');
+            return textbox;
+        });
         await user.click(editor);
+        await user.keyboard('{Control>}a{/Control}');
         // Paste in one operation — char-by-char typing races ProseMirror in jsdom and drops chars.
         await user.paste('Inserted paragraph.');
-        await waitFor(() => expect(editor.textContent ?? '').toContain('Inserted paragraph.'));
+        await waitFor(() => expect(editor.textContent).toBe('Inserted paragraph.'));
         fireEvent.click(screen.getByRole('button', { name: 'Send' }));
 
         await waitFor(() => expect(onAction).toHaveBeenCalledTimes(1));
@@ -425,7 +433,7 @@ describe('collaborative Markdown actions', () => {
                 action: 'edit',
                 user_change: {
                     before: 'Original paragraph.',
-                    after: expect.stringMatching(/^Original paragraph\.\n\n.*Inserted paragraph\.$/),
+                    after: 'Original paragraph.\n\nInserted paragraph.',
                 },
             }),
         );