@vertesia/ui 1.6.0-dev.20261004.085740Z → 1.6.0-dev.20261009.095813Z

package/src/shell/login/SignInReturningStep.tsx

@@ -21,6 +21,8 @@ interface SignInReturningStepProps {
     session: LastSuccessfulLogin;
     onNotYou: () => void;
     onProviderClicked: (provider: ProviderId) => void;
+    /** The address signs in with a password, so the parent shows the password step instead. */
+    onPasswordRequired: (email: string) => void;
     redirectTo?: string;
 }
 
@@ -28,6 +30,7 @@ export default function SignInReturningStep({
     session,
     onNotYou,
     onProviderClicked,
+    onPasswordRequired,
     redirectTo,
 }: SignInReturningStepProps) {
     const { t } = useUITranslation();
@@ -36,14 +39,23 @@ export default function SignInReturningStep({
     const avatar = <SignInInitialsBadge initials={emailInitial(session.email)} />;
     // A stored tenantName means we resolved the user's organization.
     const hasTenant = !!session.tenantName;
+    const lastProvider = session.lastProvider;
     const primaryLabel =
-        session.lastProvider === 'oidc'
-            ? t('auth.continueWithSignIn')
-            : t('auth.continueWithProvider', { provider: providerLabel(session.lastProvider) });
+        lastProvider === 'password'
+            ? t('auth.password.continue')
+            : lastProvider === 'oidc'
+              ? t('auth.continueWithSignIn')
+              : t('auth.continueWithProvider', { provider: providerLabel(lastProvider) });
 
-    const continueWith = async (provider: ProviderId) => {
-        onProviderClicked(provider);
-        await startSignIn(provider, session.email, redirectTo);
+    const continueWithLastProvider = async () => {
+        if (lastProvider === 'password') {
+            onPasswordRequired(session.email);
+            return;
+        }
+        onProviderClicked(lastProvider);
+        // The stored provider can be stale: the address may now resolve to a password tenant.
+        const result = await startSignIn(lastProvider, session.email, redirectTo);
+        if (!result.ok && result.reason === 'password-required') onPasswordRequired(session.email);
     };
 
     return (
@@ -76,9 +88,9 @@ export default function SignInReturningStep({
 
             <div className="flex flex-col gap-2">
                 <SignInProviderButton
-                    provider={session.lastProvider}
+                    provider={lastProvider}
                     label={primaryLabel}
-                    onClick={() => continueWith(session.lastProvider)}
+                    onClick={continueWithLastProvider}
                     variant="filled"
                 />
                 <SignInStepButton variant="ghost" onClick={onNotYou}>

package/src/shell/login/SignInTenantStep.tsx

@@ -8,13 +8,15 @@ import {
     SignInStepLayout,
 } from './SignInPrimitives';
 import SignInWithProviderButton from './SignInWithProviderButton';
-import { type ProviderId, providerLabel } from './signInUtils';
+import { providerLabel, type RedirectProviderId } from './signInUtils';
 
 interface SignInTenantStepProps {
     email: string;
     tenant: TenantInfo;
     onBack: () => void;
     onProviderClicked: () => void;
+    /** The tenant re-resolved as a password tenant, so the parent shows the password step. */
+    onPasswordRequired: (email: string) => void;
     redirectTo?: string;
 }
 
@@ -32,12 +34,13 @@ export default function SignInTenantStep({
     tenant,
     onBack,
     onProviderClicked,
+    onPasswordRequired,
     redirectTo,
 }: SignInTenantStepProps) {
     const { t } = useUITranslation();
     const tenantName = tenant.label || tenant.name || t('auth.blocked.tenantFallback');
     // Brands keep their identity; anything else routes through OIDC.
-    const provider: ProviderId =
+    const provider: RedirectProviderId =
         tenant.provider === 'google' || tenant.provider === 'github' || tenant.provider === 'microsoft'
             ? tenant.provider
             : 'oidc';
@@ -68,6 +71,7 @@ export default function SignInTenantStep({
                     redirectTo={redirectTo}
                     variant="filled"
                     onClick={onProviderClicked}
+                    onPasswordRequired={() => onPasswordRequired(email)}
                 />
                 <SignInStepButton variant="ghost" onClick={onBack}>
                     {t('auth.tenant.notPartOf', { name: tenantName })}

package/src/shell/login/SignInWithProviderButton.tsx

@@ -1,15 +1,17 @@
 import { useUITranslation } from '@vertesia/ui/i18n';
 import { SignInProviderButton } from './SignInPrimitives';
-import { type ProviderId, providerLabel, startSignIn, startSignInWithoutTenant } from './signInUtils';
+import { providerLabel, type RedirectProviderId, startSignIn, startSignInWithoutTenant } from './signInUtils';
 
 interface SignInWithProviderButtonProps {
-    provider: ProviderId;
+    provider: RedirectProviderId;
     /** Email for the tenant-aware flow. Omit for a no-tenant sign-in (e.g. SignInModal). */
     email?: string;
     redirectTo?: string;
     variant?: 'outline' | 'filled';
     /** Fired on click, before the redirect. */
     onClick?: () => void;
+    /** Fired instead of a redirect when the email resolves to a password tenant. */
+    onPasswordRequired?: () => void;
 }
 
 // "Continue with <provider>" button that owns its sign-in redirect.
@@ -19,6 +21,7 @@ export default function SignInWithProviderButton({
     redirectTo,
     variant = 'outline',
     onClick,
+    onPasswordRequired,
 }: SignInWithProviderButtonProps) {
     const { t } = useUITranslation();
     const label =
@@ -26,15 +29,16 @@ export default function SignInWithProviderButton({
             ? t('auth.continueWithSignIn')
             : t('auth.continueWithProvider', { provider: providerLabel(provider) });
 
-    const signIn = () => {
+    const signIn = async () => {
         onClick?.();
-        if (email) {
-            void startSignIn(provider, email, redirectTo);
-        } else {
+        if (!email) {
             // OIDC needs a resolved tenant; the no-email path is only hit by no-tenant buttons.
             startSignInWithoutTenant(provider, redirectTo);
+            return;
         }
+        const result = await startSignIn(provider, email, redirectTo);
+        if (!result.ok && result.reason === 'password-required') onPasswordRequired?.();
     };
 
-    return <SignInProviderButton provider={provider} label={label} onClick={signIn} variant={variant} />;
+    return <SignInProviderButton provider={provider} label={label} onClick={() => void signIn()} variant={variant} />;
 }

package/src/shell/login/SigninScreen.tsx

@@ -18,7 +18,7 @@ import SignInRecoveryStep, { type SignInRecoveryKind } from './SignInRecoverySte
 import SignInRestrictedEnvStep from './SignInRestrictedEnvStep';
 import SignInTenantBlockedStep from './SignInTenantBlockedStep';
 import SignupForm from './SignupForm';
-import { isInviteRequiredError, readPendingSignin, resetSignInState } from './signInUtils';
+import { isInviteRequiredError, isTenantSignIn, readPendingSignin, resetSignInState } from './signInUtils';
 
 /** Presentation only: the shared screen still owns session gating and recovery transitions. */
 export interface SignInScreenViewProps {
@@ -152,7 +152,12 @@ function SigninScreenImpl({
     useEffect(() => {
         if (!authError) return;
         if (authError instanceof UserNotFoundError) {
-            setMode('signup');
+            if (isTenantSignIn()) {
+                setEmail(authError.email);
+                setMode('blocked');
+            } else {
+                setMode('signup');
+            }
         } else if (authError instanceof RestrictedEnvironmentError) {
             setMode('restricted');
         } else if (authError instanceof RequestedScopeUnavailableError) {
@@ -280,7 +285,7 @@ function SigninScreenImpl({
                 onUseDifferentAccount={useDifferentAccount}
             />
         );
-    } else if (mode === 'signup' && !localStorage.getItem('tenantName')) {
+    } else if (mode === 'signup' && !isTenantSignIn()) {
         content = <SignupForm onSignup={onSignup} goBack={startOver} />;
     } else {
         // Every remaining mode is a core one; an unmatched recovery mode falls through to the

package/src/shell/login/signInUtils.ts

@@ -1,17 +1,22 @@
 import { Env } from '@vertesia/ui/env';
 import { getFirebaseAuth, setFirebaseTenant } from '@vertesia/ui/session';
+import { FirebaseError } from 'firebase/app';
 import {
     type AuthProvider,
     signOut as firebaseSignOut,
     GithubAuthProvider,
     GoogleAuthProvider,
     OAuthProvider,
+    signInWithEmailAndPassword,
     signInWithRedirect,
 } from 'firebase/auth';
 
 // Matches auth-tenants.json `provider` values. Tenant context is derived from
 // email resolution at sign-in time, not encoded here.
-export type ProviderId = 'google' | 'github' | 'microsoft' | 'oidc';
+export type ProviderId = 'google' | 'github' | 'microsoft' | 'oidc' | 'password';
+
+/** Providers that sign in by redirecting to an identity provider. `password` signs in in place. */
+export type RedirectProviderId = Exclude<ProviderId, 'password'>;
 
 export interface LastSuccessfulLogin {
     email: string;
@@ -82,6 +87,13 @@ export function clearPendingSignin(): void {
     }
 }
 
+/**
+ * Detects a tenant sign-in by the key's presence, including tenants with an empty label or name.
+ */
+export function isTenantSignIn(): boolean {
+    return localStorage.getItem('tenantName') !== null;
+}
+
 /**
  * Promotes the pending sign-in record to the last-successful-login entry, stamping the
  * authenticated user's display name.
@@ -166,28 +178,28 @@ const buildOidcProvider: ProviderBuilder = (email) => {
     return p;
 };
 
-const PROVIDER_BUILDERS: Record<ProviderId, ProviderBuilder> = {
+const PROVIDER_BUILDERS: Record<RedirectProviderId, ProviderBuilder> = {
     google: buildGoogleProvider,
     github: buildGithubProvider,
     microsoft: buildMicrosoftProvider,
     oidc: buildOidcProvider,
 };
 
-function buildFirebaseProvider(idp: ProviderId, email?: string, redirectTo?: string): AuthProvider {
+function buildFirebaseProvider(idp: RedirectProviderId, email?: string, redirectTo?: string): AuthProvider {
     return PROVIDER_BUILDERS[idp](email, redirectTo);
 }
 
 export async function startSignIn(
-    provider: ProviderId,
+    provider: RedirectProviderId,
     email: string,
     redirectTo?: string,
-): Promise<{ ok: true } | { ok: false; reason: 'no-email' }> {
+): Promise<{ ok: true } | { ok: false; reason: 'no-email' | 'password-required' }> {
     if (!email) return { ok: false, reason: 'no-email' };
 
     // A tenant-mapped email uses the tenant's provider (overriding `provider`); otherwise use `provider`.
     const tenant = await setFirebaseTenant(email);
     const auth = getFirebaseAuth();
-    let effectiveIdp = provider;
+    let effectiveIdp: ProviderId = provider;
     let tenantName: string | undefined;
 
     if (tenant) {
@@ -201,20 +213,68 @@ export async function startSignIn(
         auth.tenantId = Env.firebase?.tenantId ?? null;
     }
 
+    // A password tenant has no identity provider to redirect to; its step collects the password.
+    if (effectiveIdp === 'password') return { ok: false, reason: 'password-required' };
+
     writePendingSignin({ email, provider: effectiveIdp, tenantName });
     void signInWithRedirect(auth, buildFirebaseProvider(effectiveIdp, email, redirectTo));
     return { ok: true };
 }
 
+export type PasswordSignInFailure = 'not-password-tenant' | 'invalid-credentials' | 'too-many-attempts' | 'failed';
+
+// Firebase reports an unknown user, a wrong password and a disabled user with distinct codes on
+// some SDK versions; they are folded into one answer so the form does not reveal which it was.
+const INVALID_CREDENTIAL_CODES = new Set([
+    'auth/invalid-credential',
+    'auth/invalid-email',
+    'auth/user-disabled',
+    'auth/user-not-found',
+    'auth/wrong-password',
+]);
+
+export function passwordFailureReason(err: unknown): Exclude<PasswordSignInFailure, 'not-password-tenant'> {
+    if (!(err instanceof FirebaseError)) return 'failed';
+    if (INVALID_CREDENTIAL_CODES.has(err.code)) return 'invalid-credentials';
+    if (err.code === 'auth/too-many-requests') return 'too-many-attempts';
+    return 'failed';
+}
+
+/**
+ * Signs in a user of a password tenant, in place — there is no redirect. Only an address whose
+ * domain resolves to a tenant configured for password sign-in may use it; the tenant is resolved
+ * again here rather than trusted from the caller, so a returning session cannot carry a stale one.
+ * On success the session's auth-state listener completes the login.
+ */
+export async function signInWithPassword(
+    email: string,
+    password: string,
+): Promise<{ ok: true } | { ok: false; reason: PasswordSignInFailure }> {
+    const tenant = await setFirebaseTenant(email);
+    if (!tenant) return { ok: false, reason: 'failed' };
+    if (tenant.provider !== 'password') return { ok: false, reason: 'not-password-tenant' };
+
+    const tenantName = tenant.label || tenant.name || undefined;
+    localStorage.setItem('tenantName', tenantName ?? '');
+    writePendingSignin({ email, provider: 'password', tenantName });
+    try {
+        await signInWithEmailAndPassword(getFirebaseAuth(), email, password);
+        return { ok: true };
+    } catch (err: unknown) {
+        clearPendingSignin();
+        return { ok: false, reason: passwordFailureReason(err) };
+    }
+}
+
 /** Starts sign-in without email discovery, preserving an explicitly configured tenant. */
-export function startSignInWithoutTenant(provider: ProviderId, redirectTo?: string): void {
+export function startSignInWithoutTenant(provider: RedirectProviderId, redirectTo?: string): void {
     const auth = getFirebaseAuth();
     localStorage.removeItem('tenantName');
     auth.tenantId = Env.firebase?.tenantId ?? null;
     void signInWithRedirect(
         auth,
         buildFirebaseProvider(
-            Env.firebase?.tenantId ? ((Env.firebase.providerType as ProviderId) ?? 'oidc') : provider,
+            Env.firebase?.tenantId ? ((Env.firebase.providerType as RedirectProviderId) ?? 'oidc') : provider,
             undefined,
             redirectTo,
         ),