@vertesia/ui 1.6.0-dev.20260918.063824Z → 1.6.0-dev.20260918.090710Z

package/src/session/UserSession.ts

@@ -7,6 +7,8 @@ import { createContext, useContext } from 'react';
 import { getComposableToken } from './auth/composable';
 import { authReturnUrl, centralAuthUrl, mountRootUrl, shouldRedirectToCentralAuth } from './auth/domainRouting';
 import { getFirebaseAuth } from './auth/firebase';
+import { gatewayFetch, loadGatewaySession, logoutGatewaySession, usesGatewaySession } from './auth/gateway';
+import { clearAppOAuth, getAppOAuthToken, usesAppOAuth } from './auth/oauth';
 
 import { LastSelectedAccountId_KEY, LastSelectedProjectId_KEY } from './constants';
 
@@ -31,9 +33,14 @@ class UserSession {
             this.client = client;
         } else {
             this.client = new VertesiaClient({
-                serverUrl: Env.endpoints.studio,
-                storeUrl: Env.endpoints.zeno,
+                serverUrl: usesGatewaySession()
+                    ? `${window.location.origin}/__appgen/session/studio`
+                    : Env.endpoints.studio,
+                storeUrl: usesGatewaySession()
+                    ? `${window.location.origin}/__appgen/session/store`
+                    : Env.endpoints.zeno,
                 tokenServerUrl: Env.endpoints.sts,
+                fetch: usesGatewaySession() ? gatewayFetch : undefined,
             });
         }
 
@@ -73,6 +80,9 @@ class UserSession {
     }
 
     get rawAuthToken() {
+        if (usesAppOAuth()) return getAppOAuthToken();
+        if (usesGatewaySession())
+            return Promise.reject(new Error('Gateway session credentials are not available to application JavaScript'));
         return getComposableToken().then((res) => {
             const token = res?.rawToken;
             if (!token) {
@@ -89,6 +99,17 @@ class UserSession {
      * stale — STS recomputes the `apps` claim from ACEs on every issuance.
      */
     async refreshAuthToken(): Promise<AuthTokenPayload> {
+        if (usesGatewaySession()) {
+            const payload = await this.loginGatewaySession();
+            this.setSession?.(this.clone());
+            return payload;
+        }
+        if (usesAppOAuth()) {
+            clearAppOAuth();
+            this.authToken = jwtDecode<AuthTokenPayload>(await getAppOAuthToken());
+            this.setSession?.(this.clone());
+            return this.authToken;
+        }
         const res = await getComposableToken(undefined, undefined, undefined, true);
         const token = res?.rawToken;
         if (!token) {
@@ -133,12 +154,47 @@ class UserSession {
         return Promise.resolve();
     }
 
+    async loginGatewaySession() {
+        this.authToken = await loadGatewaySession();
+        this.client.withAuthCallback(undefined);
+        this.authError = undefined;
+        this.isLoading = false;
+        Env.onLogin?.(this.authToken);
+        return this.authToken;
+    }
+
     isLoggedIn() {
         return !!this.authToken;
     }
 
     logout() {
         console.log('Logging out');
+        if (usesGatewaySession()) {
+            void logoutGatewaySession()
+                .then(() => {
+                    this.authToken = undefined;
+                    this.authError = undefined;
+                    this.isLoading = false;
+                    Env.onLogout?.();
+                    this.setSession?.(this.clone());
+                })
+                .catch((error: unknown) => {
+                    this.authError = error instanceof Error ? error : new Error(String(error));
+                    this.setSession?.(this.clone());
+                });
+            return;
+        }
+
+        if (usesAppOAuth()) {
+            clearAppOAuth();
+            this.client.withAuthCallback(undefined);
+            this.authToken = undefined;
+            this.authError = undefined;
+            this.isLoading = false;
+            Env.onLogout?.();
+            this.setSession?.(this.clone());
+            return;
+        }
 
         if (shouldRedirectToCentralAuth()) {
             // Redirect to central auth for logout

package/src/session/UserSessionProvider.strict-mode.test.tsx

@@ -3,6 +3,7 @@ import { Env } from '@vertesia/ui/env';
 import { StrictMode } from 'react';
 import { afterEach, expect, it, vi } from 'vitest';
 import { redirectToCentralAuth } from './auth/domainRouting';
+import { useUserSession } from './UserSession';
 import { UserSessionProvider } from './UserSessionProvider';
 
 vi.mock('./auth/useAuthState', () => ({ useAuthState: () => ({}) }));
@@ -15,6 +16,8 @@ vi.mock('./auth/domainRouting', async (importOriginal) => ({
 afterEach(() => {
     cleanup();
     vi.clearAllMocks();
+    vi.unstubAllGlobals();
+    delete window.__VERTESIA_RUNTIME_CONFIG__;
 });
 
 it('continues authentication after StrictMode cancels the first host-token attempt', async () => {
@@ -42,3 +45,36 @@ it('continues authentication after StrictMode cancels the first host-token attem
     await waitFor(() => expect(redirectToCentralAuth).toHaveBeenCalledTimes(1));
     expect(authTokenProvider).toHaveBeenCalledTimes(2);
 });
+
+it('bootstraps a gateway session from claims without starting broker authentication', async () => {
+    window.__VERTESIA_RUNTIME_CONFIG__ = { authMode: 'central', gatewaySession: true };
+    const claims = { sub: 'gateway-user', name: 'Gateway User', account: { id: 'a' }, project: { id: 'p' } };
+    const fetch = vi.fn(async (_request: Request) => Response.json(claims));
+    vi.stubGlobal('fetch', fetch);
+    Env.init({
+        name: 'gateway',
+        version: '1',
+        type: 'production',
+        isLocalDev: false,
+        isDocker: false,
+        endpoints: {
+            studio: 'https://api.example.com',
+            zeno: 'https://api.example.com',
+            sts: 'https://sts.example.com',
+        },
+    });
+    function Probe() {
+        const session = useUserSession();
+        return <span>{session.user?.name}</span>;
+    }
+    const view = render(
+        <StrictMode>
+            <UserSessionProvider>
+                <Probe />
+            </UserSessionProvider>
+        </StrictMode>,
+    );
+    await view.findByText('Gateway User');
+    expect(redirectToCentralAuth).not.toHaveBeenCalled();
+    expect(fetch.mock.calls.every(([request]) => new URL(request.url).pathname === '/__appgen/session')).toBe(true);
+});

package/src/session/UserSessionProvider.tsx

@@ -14,6 +14,8 @@ import {
 } from './auth/composable';
 import { buildCentralAuthRedirectUrl, redirectToCentralAuth, shouldRedirectToCentralAuth } from './auth/domainRouting';
 import { getFirebaseAuth } from './auth/firebase';
+import { usesGatewaySession } from './auth/gateway';
+import { getAppOAuthToken, usesAppOAuth } from './auth/oauth';
 import { useAuthState } from './auth/useAuthState';
 import { UserSession, UserSessionContext } from './UserSession';
 
@@ -130,6 +132,28 @@ export function UserSessionProvider({ children, loadOnboardingStatus = true }: U
             },
         });
 
+        if (usesGatewaySession() || usesAppOAuth()) {
+            let cancelled = false;
+            session.setSession = setSession;
+            const initialize = usesGatewaySession()
+                ? session.loginGatewaySession()
+                : getAppOAuthToken().then((token) => session.login(token, { loadOnboardingStatus: false }));
+            void initialize
+                .then(() => {
+                    if (!cancelled) setSession(session.clone());
+                })
+                .catch((error: unknown) => {
+                    if (cancelled) return;
+                    session.isLoading = false;
+                    session.authError = error instanceof Error ? error : new Error(String(error));
+                    setSession(session.clone());
+                });
+            return () => {
+                cancelled = true;
+                hasInitiatedAuthRef.current = false;
+            };
+        }
+
         if (Env.isLocalDev && Env.devAuthToken) {
             session.setSession = setSession;
             getComposableToken(selectedAccount, selectedProject, Env.devAuthToken)

package/src/session/auth/domainRouting.ts

@@ -1,5 +1,7 @@
 import { Env } from '@vertesia/ui/env';
 import { generateAuthState } from './authState';
+import { gatewayLoginUrl, usesGatewaySession } from './gateway';
+import { getAppOAuthToken, usesAppOAuth } from './oauth';
 
 declare global {
     interface Window {
@@ -145,6 +147,14 @@ export function clearCentralAuthRoundTripMarker(): void {
  * into producing different `redirect_uri` / `state` / `sts` values for the same page load.
  */
 export function redirectToCentralAuth(selection: AuthSelection = {}): void {
+    if (usesAppOAuth()) {
+        void getAppOAuthToken().catch((error: unknown) => Env.logger.error('Application OAuth sign-in failed', error));
+        return;
+    }
+    if (usesGatewaySession()) {
+        window.location.replace(gatewayLoginUrl());
+        return;
+    }
     const url = buildCentralAuthRedirectUrl(
         centralAuthUrl(),
         Env.endpoints.sts ?? 'https://sts.vertesia.io',
@@ -177,6 +187,7 @@ export function redirectToCentralAuth(selection: AuthSelection = {}): void {
  * chunks that the navigation is about to discard.
  */
 export function isCentralAuthRedirectPending(): boolean {
+    if (usesGatewaySession() || usesAppOAuth()) return false;
     if (!shouldRedirectToCentralAuth()) return false;
     if (Env.authTokenProvider) return false;
     if (Env.isLocalDev && Env.devAuthToken) return false;

package/src/session/auth/gateway.test.ts

@@ -0,0 +1,82 @@
+// @vitest-environment node
+import { afterEach, beforeEach, expect, it, vi } from 'vitest';
+import { gatewayFetch, gatewayLoginUrl, loadGatewaySession, logoutGatewaySession, usesGatewaySession } from './gateway';
+
+const replace = vi.fn();
+beforeEach(() => {
+    const browser = {
+        location: {
+            href: 'https://app.example/reports?a=account&p=project#chart',
+            origin: 'https://app.example',
+            replace,
+        },
+        __VERTESIA_RUNTIME_CONFIG__: { authMode: 'central', gatewaySession: true },
+    };
+    vi.stubGlobal('window', Object.assign(browser, { parent: browser }));
+});
+afterEach(() => {
+    vi.unstubAllGlobals();
+    vi.clearAllMocks();
+});
+
+it('activates only for a standalone app explicitly served with a gateway session', () => {
+    expect(usesGatewaySession()).toBe(true);
+    window.__VERTESIA_RUNTIME_CONFIG__ = { authMode: 'central' };
+    expect(usesGatewaySession()).toBe(false);
+    window.__VERTESIA_RUNTIME_CONFIG__ = { authMode: 'central', gatewaySession: true };
+    Object.defineProperty(window, 'parent', { value: {} });
+    expect(usesGatewaySession()).toBe(false);
+});
+it('preserves account, project and deep link through the existing OAuth login route', () => {
+    const url = new URL(gatewayLoginUrl());
+    expect(url.origin + url.pathname).toBe('https://app.example/__appgen/auth/login');
+    expect(url.searchParams.get('target')).toBe('/reports?a=account&p=project#chart');
+});
+it('uses same-origin cookies and never forwards browser bearer credentials', async () => {
+    const fetch = vi.fn(async (_request: Request) => new Response('{}'));
+    vi.stubGlobal('fetch', fetch);
+    await gatewayFetch('https://app.example/__appgen/session/studio/api/v1/apps', {
+        headers: { Authorization: 'Bearer browser-token' },
+    });
+    const request = fetch.mock.calls[0]?.[0] as Request | undefined;
+    expect(request?.headers.get('authorization')).toBeNull();
+    expect(request?.headers.get('x-vertesia-app-session')).toBe('1');
+    expect(request?.credentials).toBe('same-origin');
+    await expect(gatewayFetch('https://other.example/api')).rejects.toThrow('application origin');
+    expect(fetch).toHaveBeenCalledTimes(1);
+});
+it('redirects an expired session into CIMD login without invoking the direct broker', async () => {
+    vi.stubGlobal(
+        'fetch',
+        vi.fn(
+            async () =>
+                new Response('{}', {
+                    status: 401,
+                    headers: { 'x-vertesia-session-required': '1' },
+                }),
+        ),
+    );
+    void loadGatewaySession();
+    await vi.waitFor(() => expect(replace).toHaveBeenCalledWith(gatewayLoginUrl()));
+});
+it('surfaces outages and ordinary upstream 401s instead of creating login loops', async () => {
+    vi.stubGlobal(
+        'fetch',
+        vi.fn(async () => new Response('{}', { status: 503 })),
+    );
+    await expect(loadGatewaySession()).rejects.toThrow('503');
+    vi.stubGlobal(
+        'fetch',
+        vi.fn(async () => new Response('{}', { status: 401 })),
+    );
+    expect((await gatewayFetch('https://app.example/api')).status).toBe(401);
+    expect(replace).not.toHaveBeenCalled();
+});
+it('loads claims without a JWT and signs out through a protected POST', async () => {
+    const claims = { sub: 'user', account: { id: 'account' }, project: { id: 'project' } };
+    const fetch = vi.fn(async (_request: Request) => new Response(JSON.stringify(claims)));
+    vi.stubGlobal('fetch', fetch);
+    expect(await loadGatewaySession()).toEqual(claims);
+    await logoutGatewaySession();
+    expect(fetch.mock.calls.at(-1)?.[0].method).toBe('POST');
+});

package/src/session/auth/gateway.ts

@@ -0,0 +1,49 @@
+import type { AuthTokenPayload } from '@vertesia/common';
+
+export function usesGatewaySession(): boolean {
+    if (typeof window === 'undefined' || window.parent !== window) return false;
+    const config = window.__VERTESIA_RUNTIME_CONFIG__;
+    return config?.authMode === 'central' && config.gatewaySession === true;
+}
+
+export function gatewayLoginUrl(): string {
+    const current = new URL(window.location.href);
+    const url = new URL('/__appgen/auth/login', current.origin);
+    url.searchParams.set('target', `${current.pathname}${current.search}${current.hash}`);
+    return url.toString();
+}
+
+/** Same-origin cookie transport. The gateway attaches its OAuth credential upstream. */
+export async function gatewayFetch(input: RequestInfo, init?: RequestInit): Promise<Response> {
+    const request = new Request(input, init);
+    if (new URL(request.url).origin !== window.location.origin) {
+        throw new Error('Gateway session requests must stay on the application origin');
+    }
+    const headers = new Headers(request.headers);
+    headers.delete('authorization');
+    headers.set('x-vertesia-app-session', '1');
+    const response = await fetch(new Request(request, { headers, credentials: 'same-origin', cache: 'no-store' }));
+    if (response.status === 401 && response.headers.get('x-vertesia-session-required') === '1') {
+        window.location.replace(gatewayLoginUrl());
+        // Navigation owns recovery. Do not fall back to Firebase or the direct broker flow.
+        return new Promise(() => {});
+    }
+    return response;
+}
+
+export async function loadGatewaySession(): Promise<AuthTokenPayload> {
+    const response = await gatewayFetch(new URL('/__appgen/session', window.location.origin).toString());
+    if (!response.ok) throw new Error(`Application session could not be loaded (${response.status})`);
+    const payload: AuthTokenPayload = await response.json();
+    if (!payload.sub || !payload.account?.id || !payload.project?.id) {
+        throw new Error('Application session returned invalid user information');
+    }
+    return payload;
+}
+
+export async function logoutGatewaySession(): Promise<void> {
+    const response = await gatewayFetch(new URL('/__appgen/session/logout', window.location.origin).toString(), {
+        method: 'POST',
+    });
+    if (!response.ok) throw new Error(`Application sign-out failed (${response.status})`);
+}

package/src/session/auth/oauth.test.ts

@@ -0,0 +1,173 @@
+// @vitest-environment node
+import { afterEach, beforeEach, expect, it, vi } from 'vitest';
+
+const origin = 'https://standalone.vercel.app';
+const issuer = 'https://sts.dev1.vertesia.io';
+const clientId = `${origin}/.well-known/oauth-client/vertesia-app`;
+const storage = new Map<string, string>();
+const replace = vi.fn();
+let browser: {
+    location: { href: string; origin: string; replace: typeof replace };
+    parent?: unknown;
+    history: { state: null; replaceState: ReturnType<typeof vi.fn> };
+};
+let requests: { url: string; init?: RequestInit }[];
+function jwt(): string {
+    return `e30.${btoa(
+        JSON.stringify({
+            iss: issuer,
+            client_id: clientId,
+            exp: Date.now() / 1000 + 3600,
+            sub: 'user',
+            account: { id: 'a' },
+            project: { id: 'p' },
+        }),
+    )}.signature`;
+}
+async function setup() {
+    vi.resetModules();
+    const { Env } = await import('../../env');
+    Env.init({
+        name: 'test',
+        version: '1',
+        type: 'production',
+        isLocalDev: false,
+        isDocker: false,
+        endpoints: { studio: 'https://api.dev1.vertesia.io', zeno: 'https://api.dev1.vertesia.io', sts: issuer },
+        oauth: { clientId, redirectUri: `${origin}/app` },
+    });
+    return import('./oauth');
+}
+beforeEach(() => {
+    storage.clear();
+    requests = [];
+    browser = {
+        location: { href: `${origin}/app/report?a=a&p=p#chart`, origin, replace },
+        history: {
+            state: null,
+            replaceState: vi.fn((_state, _title, target: URL) => {
+                browser.location.href = target.toString();
+            }),
+        },
+    };
+    browser.parent = browser;
+    vi.stubGlobal('window', browser);
+    vi.stubGlobal('sessionStorage', {
+        getItem: (key: string) => storage.get(key) ?? null,
+        setItem: (key: string, value: string) => storage.set(key, value),
+        removeItem: (key: string) => storage.delete(key),
+    });
+    vi.stubGlobal(
+        'fetch',
+        vi.fn(async (input: string | URL, init?: RequestInit) => {
+            const url = String(input);
+            requests.push({ url, init });
+            if (url.endsWith('/.well-known/oauth-authorization-server'))
+                return Response.json({
+                    issuer,
+                    authorization_endpoint: 'https://preview.cloud.dev1.vertesia.io/oauth/authorize',
+                    token_endpoint: `${issuer}/oauth/token`,
+                });
+            if (url === clientId)
+                return Response.json({
+                    redirect_uris: [`${origin}/app`],
+                    scope: 'openid profile content:read offline_access',
+                });
+            if (url === `${issuer}/oauth/token`) return Response.json({ access_token: jwt(), token_type: 'Bearer' });
+            throw new Error(`Unexpected request: ${url}`);
+        }),
+    );
+});
+afterEach(() => {
+    vi.unstubAllGlobals();
+    vi.clearAllMocks();
+});
+
+it('uses CIMD and PKCE, exchanges the callback once and restores the app deep link', async () => {
+    const oauth = await setup();
+    expect(oauth.usesAppOAuth()).toBe(true);
+    void oauth.getAppOAuthToken();
+    await vi.waitFor(() => expect(replace).toHaveBeenCalledTimes(1));
+    const authorize = new URL(replace.mock.calls[0][0]);
+    expect(authorize.searchParams.get('client_id')).toBe(clientId);
+    expect(authorize.searchParams.get('redirect_uri')).toBe(`${origin}/app`);
+    expect(authorize.searchParams.get('scope')).toBe('openid profile content:read');
+    expect(authorize.searchParams.get('project_id')).toBe('p');
+    expect(authorize.searchParams.get('code_challenge_method')).toBe('S256');
+    const txn = JSON.parse(storage.get('vertesia.oauth.transaction') ?? '{}');
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(txn.verifier));
+    expect(authorize.searchParams.get('code_challenge')).toBe(Buffer.from(digest).toString('base64url'));
+    browser.location.href = `${origin}/app?code=one-time-code&state=${authorize.searchParams.get('state')}`;
+    const callback = await setup();
+    const token = await callback.getAppOAuthToken();
+    expect(token).toBeTruthy();
+    const exchange = requests.find((request) => request.url.endsWith('/oauth/token'));
+    if (!exchange) throw new Error('Expected a code exchange');
+    const body = exchange.init?.body as URLSearchParams;
+    expect(body.get('code_verifier')).toBe(txn.verifier);
+    expect(body.get('grant_type')).toBe('authorization_code');
+    expect(body.has('client_secret')).toBe(false);
+    expect(storage.has('vertesia.oauth.transaction')).toBe(false);
+    expect(browser.location.href).toBe(`${origin}/app/report?a=a&p=p#chart`);
+    expect(await callback.getAppOAuthToken()).toBe(token);
+    expect(requests.filter((request) => request.url.endsWith('/oauth/token'))).toHaveLength(1);
+});
+it('rejects a forged callback before contacting the token endpoint', async () => {
+    browser.location.href = `${origin}/app?code=forged&state=wrong`;
+    const oauth = await setup();
+    await expect(oauth.getAppOAuthToken()).rejects.toThrow('Invalid or expired');
+    expect(requests).toHaveLength(0);
+});
+it('rejects discovery for a different issuer', async () => {
+    vi.stubGlobal(
+        'fetch',
+        vi.fn(async () => Response.json({ issuer: 'https://wrong.test' })),
+    );
+    const oauth = await setup();
+    await expect(oauth.getAppOAuthToken()).rejects.toThrow('issuer mismatch');
+    expect(replace).not.toHaveBeenCalled();
+});
+it('does not override Firebase, embedded apps, gateway sessions, or unconfigured local apps', async () => {
+    const oauth = await setup();
+    const win = window as unknown as Record<string, unknown>;
+    win.AUTH_MODE = 'firebase';
+    expect(oauth.usesAppOAuth()).toBe(false);
+    win.AUTH_MODE = 'central';
+    win.parent = {};
+    expect(oauth.usesAppOAuth()).toBe(false);
+    win.parent = window;
+    win.__VERTESIA_RUNTIME_CONFIG__ = { authMode: 'central', gatewaySession: true };
+    expect(oauth.usesAppOAuth()).toBe(false);
+    win.__VERTESIA_RUNTIME_CONFIG__ = undefined;
+    const { Env } = await import('../../env');
+    Env.init({
+        name: 'local',
+        version: '1',
+        type: 'development',
+        isLocalDev: true,
+        isDocker: false,
+        endpoints: { studio: issuer, zeno: issuer, sts: issuer },
+    });
+    expect(oauth.usesAppOAuth()).toBe(false);
+});
+
+it('supports a registered client ID without fetching a CIMD', async () => {
+    const oauth = await setup();
+    const { Env } = await import('../../env');
+    Env.init({
+        name: 'registered',
+        version: '1',
+        type: 'production',
+        isLocalDev: false,
+        isDocker: false,
+        endpoints: { studio: issuer, zeno: issuer, sts: issuer },
+        oauth: { clientId: 'registered-client-id', redirectUri: `${origin}/app`, scopes: ['openid', 'content:read'] },
+    });
+    void oauth.getAppOAuthToken();
+    await vi.waitFor(() => expect(replace).toHaveBeenCalledTimes(1));
+    const authorize = new URL(replace.mock.calls[0][0]);
+    expect(authorize.searchParams.get('client_id')).toBe('registered-client-id');
+    expect(authorize.searchParams.get('scope')).toBe('openid content:read');
+    expect(authorize.searchParams.has('consent_required')).toBe(false);
+    expect(requests).toHaveLength(1);
+});