@woodsportal/hubspot-kit 1.0.41-dev.4 → 1.0.41-dev.6

package/templates/scaffold/auth/_shared/src/env.ts

@@ -0,0 +1,59 @@
+import { createEnv } from '@t3-oss/env-core'
+import { z } from 'zod'
+
+const defaultHubspotObjectIds =
+  '{"contacts":"0-1","companies":"0-2","deals":"0-3","tickets":"0-5"}'
+
+export function parseHubspotDefaultObjectIds(raw: unknown): Record<string, string> {
+  if (typeof raw === 'object' && raw !== null && !Array.isArray(raw)) {
+    return raw as Record<string, string>
+  }
+  try {
+    return JSON.parse(String(raw ?? defaultHubspotObjectIds))
+  } catch {
+    return JSON.parse(defaultHubspotObjectIds)
+  }
+}
+
+export const env = createEnv({
+  server: {
+    SERVER_URL: z.string().url().optional(),
+  },
+  clientPrefix: 'VITE_',
+  client: {
+    VITE_NODE_ENV: z.enum(['local', 'dev', 'prod', 'stg', 'development', 'production', 'staging']).default('local'),
+    VITE_PUBLIC_REST_API_ENDPOINT: z
+      .string()
+      .url()
+      .default('https://api.dev.woodsportal.com'),
+    VITE_DEV_PORTAL_ID: z.union([z.string(), z.number()]).optional(),
+    VITE_LOCAL_HUB_ID: z.union([z.string(), z.number()]).optional(),
+    VITE_DEV_HUB_ID: z.union([z.string(), z.number()]).optional(),
+    VITE_LOGIN_DETAILS: z.string().default('wp.c.auth.login'),
+    VITE_SUBSCRIPTION_TYPE: z.string().default('wp.c.auth.sub'),
+    VITE_PAGINATION_DATA: z.string().default('wp.c.ui.pag'),
+    VITE_PORTAL: z.string().default('wp.c.auth.portal'),
+    VITE_AUTH_TOKEN_KEY: z.string().default('woodsportal_access_token'),
+    VITE_REFRESH_TOKEN: z.string().default('wp.c.auth.refresh'),
+    VITE_AUTH_USER_KEY: z.string().default('wp.c.auth.login'),
+    VITE_ROUTE_MENU_CONFIG_KEY: z.string().default('wp.c.ui.menu'),
+    VITE_ASSOCIATION_VIEW_URL_KEY: z.string().default('wp.c.ui.assoc'),
+    VITE_COOKIE_EXPIRE: z.string().default('7'),
+    VITE_TABLE_PAGE_LIMIT: z.string().default('25'),
+    VITE_HUBSPOT_DEFAULT_OBJECT_IDS: z.any().default(defaultHubspotObjectIds),
+  },
+  runtimeEnv: import.meta.env,
+  emptyStringAsUndefined: true,
+})
+
+export const TABLE_PAGE_LIMIT = Math.max(
+  1,
+  Number.parseInt(env.VITE_TABLE_PAGE_LIMIT, 10) || 25,
+)
+
+export const HUBSPOT_DEFAULT_OBJECT_IDS = parseHubspotDefaultObjectIds(
+  env.VITE_HUBSPOT_DEFAULT_OBJECT_IDS,
+)
+
+export const isLocal =
+  env.VITE_NODE_ENV === 'local' || env.VITE_NODE_ENV === 'development'

package/templates/scaffold/auth/_shared/src/features/auth/app-bootstrap-guards.ts

@@ -0,0 +1,14 @@
+export type BootstrapRefreshDecisionInput = {
+  isMfaPendingSession: boolean
+  hasRefresh: boolean
+  isPublicAuthRoute: boolean
+}
+
+export function shouldBootstrapRefreshSession(
+  input: BootstrapRefreshDecisionInput,
+): boolean {
+  if (input.isMfaPendingSession || input.isPublicAuthRoute) {
+    return false
+  }
+  return input.hasRefresh
+}

package/templates/scaffold/auth/_shared/src/features/auth/auth-navigation.ts

@@ -0,0 +1,81 @@
+import { Routes } from '@/config/routes'
+import { normalizeRouterPath } from '@/utils/normalize-router-path'
+import {
+  hardReplaceToHashPath,
+  historyReplaceFirstNavigate,
+  readHashPathname,
+  readRouterPathname,
+  type SafeAuthRouter,
+} from '@/utils/safe-router-navigation'
+import { resolvePostLoginPath, type PostLoginRouter } from '@/features/auth/resolve-post-login-path'
+
+export type AuthNavigationRouter = PostLoginRouter
+
+let navigationState = {
+  inFlight: false,
+  lastTarget: '',
+  lastAt: 0,
+}
+
+function normalizeTarget(path: string): string {
+  return normalizeRouterPath(path)
+}
+
+export function isRouterAtPath(router: SafeAuthRouter, path: string): boolean {
+  const target = normalizeTarget(path)
+  const pathname = normalizeTarget(readRouterPathname(router))
+  const hashPath = normalizeTarget(readHashPathname())
+  return pathname === target && hashPath === target
+}
+
+function shouldSkipNavigation(target: string): boolean {
+  const now = Date.now()
+  return (
+    navigationState.inFlight ||
+    (navigationState.lastTarget === target && now - navigationState.lastAt < 2000)
+  )
+}
+
+async function runCoordinatedNavigation(router: SafeAuthRouter, rawTarget: string): Promise<void> {
+  const target = normalizeTarget(rawTarget)
+  if (!target || isRouterAtPath(router, target) || shouldSkipNavigation(target)) {
+    return
+  }
+  navigationState = { inFlight: true, lastTarget: target, lastAt: Date.now() }
+  try {
+    await historyReplaceFirstNavigate(router, target)
+    await new Promise<void>((resolve) => window.setTimeout(resolve, 100))
+    if (!isRouterAtPath(router, target)) {
+      hardReplaceToHashPath(target)
+    }
+  } finally {
+    navigationState = { inFlight: false, lastTarget: target, lastAt: Date.now() }
+  }
+}
+
+export function navigateAfterFullAuth(router: AuthNavigationRouter, target?: string): void {
+  const resolved = target ?? resolvePostLoginPath(router)
+  if (isRouterAtPath(router, resolved)) {
+    return
+  }
+  void runCoordinatedNavigation(router, resolved)
+}
+
+export function navigateToMfaGate(router: SafeAuthRouter): void {
+  if (isRouterAtPath(router, Routes.twoFa)) {
+    return
+  }
+  void runCoordinatedNavigation(router, Routes.twoFa)
+}
+
+export function navigateToLogin(router: SafeAuthRouter, path: string = Routes.login): Promise<void> {
+  const target = normalizeTarget(path)
+  if (isRouterAtPath(router, target)) {
+    return Promise.resolve()
+  }
+  return runCoordinatedNavigation(router, target)
+}
+
+export function resetAuthNavigationState(): void {
+  navigationState = { inFlight: false, lastTarget: '', lastAt: 0 }
+}

package/templates/scaffold/auth/_shared/src/features/auth/auth-route-paths.ts

@@ -0,0 +1,29 @@
+import { Routes } from '@/config/routes'
+import { normalizeRouterPath } from '@/utils/normalize-router-path'
+
+const PUBLIC_AUTH_PATHS = new Set<string>([
+  Routes.login,
+  Routes.twoFa,
+  Routes.unauthorized,
+  Routes.ssoLogin,
+])
+
+export function readHashPathname(): string {
+  if (typeof window === 'undefined') {
+    return Routes.app
+  }
+  const segment = window.location.hash.replace(/^#/, '').split('?')[0] || Routes.app
+  return normalizeRouterPath(segment.startsWith('/') ? segment : `/${segment}`)
+}
+
+export function isPublicAuthRoute(pathname: string): boolean {
+  const normalized = normalizeRouterPath(pathname)
+  if (PUBLIC_AUTH_PATHS.has(normalized)) {
+    return true
+  }
+  return normalized.startsWith('/login')
+}
+
+export function isProtectedHashPath(): boolean {
+  return !isPublicAuthRoute(readHashPathname())
+}

package/templates/scaffold/auth/_shared/src/features/auth/auth-session-events.ts

@@ -0,0 +1,2 @@
+/** Fired after login/MFA stores tokens so route guards re-check session. */
+export const AUTH_SESSION_CHANGED = 'woodsportal:auth-session-changed'

package/templates/scaffold/auth/_shared/src/features/auth/auth-session.ts

@@ -0,0 +1,26 @@
+import { api } from '@/integrations/woodsportal-sdk'
+import { AUTH_SESSION_CHANGED } from '@/features/auth/auth-session-events'
+
+/** Starter tier: no MFA gate — always false until _full layer overrides. */
+export function isMfaPendingSession(): boolean {
+  return false
+}
+
+/** Full portal session (starter tier: SDK fully authenticated). */
+export function isFullyAuthenticatedSession(): boolean {
+  return api.auth.session.isFullyAuthenticated()
+}
+
+export function clearMfaPendingLoginSession(): void {
+  api.auth.session.clearAccessToken()
+  if (typeof window !== 'undefined') {
+    window.dispatchEvent(new CustomEvent(AUTH_SESSION_CHANGED))
+  }
+}
+
+export type MfaBootRecoveryResult = 'pending' | 'orphan_cleared' | 'stale_token_cleared' | 'none'
+
+/** Starter tier: no MFA recovery on boot. _full layer replaces this module. */
+export async function recoverMfaGateOnBoot(): Promise<MfaBootRecoveryResult> {
+  return 'none'
+}

package/templates/scaffold/auth/_shared/src/features/auth/clear-client-auth-session.ts

@@ -0,0 +1,62 @@
+import {
+  clearClientIframeRefreshLocalKeys,
+  clearClientSessionStorageKeys,
+  resetSessionStores,
+  signalSessionChanged,
+  WP_STORAGE_KEYS,
+} from 'woodsportal-client-sdk'
+import { api } from '@/integrations/woodsportal-sdk'
+import { clearClientAuthCookies } from '@/utils/cookie'
+import {
+  captureLoginEmailBeforeSessionClear,
+  clearLoginPreAuthSession,
+  extractLoginEmailFromPayload,
+  getStoredLoginEmail,
+} from '@/features/auth/login-email-storage'
+import { clearMfaPendingLoginSession } from '@/features/auth/auth-session'
+import { AUTH_SESSION_CHANGED } from '@/features/auth/auth-session-events'
+
+let queryCacheClearHandler: (() => void) | undefined
+
+export function registerClientSessionQueryClear(handler: () => void): void {
+  queryCacheClearHandler = handler
+}
+
+export function clearClientAuthSession(options?: { signalCrossTab?: boolean }): void {
+  captureLoginEmailBeforeSessionClear(() => {
+    const details = api.auth.session.getLoggedInDetails?.() as Record<string, unknown> | undefined
+    return (
+      extractLoginEmailFromPayload(details) ??
+      extractLoginEmailFromPayload({ email: getStoredLoginEmail() }) ??
+      undefined
+    )
+  })
+
+  clearClientAuthCookies()
+  clearMfaPendingLoginSession()
+  clearLoginPreAuthSession()
+  clearClientSessionStorageKeys()
+  clearClientIframeRefreshLocalKeys()
+  try {
+    window.localStorage?.removeItem(WP_STORAGE_KEYS.c.auth.refreshLock)
+  } catch {
+    // ignore
+  }
+  api.auth.session.clearAccessToken()
+  resetSessionStores()
+  api.auth.session.resetSessionAuthState()
+  api.auth.session.clearSessionRefreshExhaustedState?.()
+
+  try {
+    queryCacheClearHandler?.()
+  } catch {
+    // ignore
+  }
+
+  if (typeof window !== 'undefined') {
+    if (options?.signalCrossTab !== false) {
+      signalSessionChanged('rev')
+    }
+    window.dispatchEvent(new CustomEvent(AUTH_SESSION_CHANGED))
+  }
+}

package/templates/scaffold/auth/_shared/src/features/auth/components/starter-login.tsx

@@ -0,0 +1,76 @@
+import { useState } from 'react'
+import { useRouter } from '@tanstack/react-router'
+import { toast } from 'sonner'
+import { Button } from '@/components/ui/Button'
+import { Form, FormField } from '@/components/ui/Form'
+import { Input } from '@/components/ui/Input'
+import { api } from '@/integrations/woodsportal-sdk'
+import { handleAuthLoginResponse, MFA_REQUIRED_SCAFFOLD_MESSAGE } from '@/features/auth/login-session-bridge'
+import { resolveAuthLoginErrorMessage } from '@/features/auth/resolve-auth-login-error-message'
+import {
+  getStoredLoginEmail,
+  setStoredLoginEmail,
+} from '@/features/auth/login-email-storage'
+
+export function StarterLogin() {
+  const router = useRouter()
+  const [email, setEmail] = useState(getStoredLoginEmail() ?? '')
+  const [password, setPassword] = useState('')
+  const [isSubmitting, setIsSubmitting] = useState(false)
+
+  const onSubmit = async (event: React.FormEvent) => {
+    event.preventDefault()
+    setIsSubmitting(true)
+    try {
+      setStoredLoginEmail(email)
+      const { login } = api.auth.login({})
+      const response = await login({ username: email.trim(), password })
+      const result = await handleAuthLoginResponse(response, router)
+      if (!result.success) {
+        if (result.reason === 'mfa_required') {
+          toast.error(MFA_REQUIRED_SCAFFOLD_MESSAGE)
+        } else {
+          toast.error('Login failed — no access token returned.')
+        }
+        return
+      }
+      if (!result.mfaRequired) {
+        toast.success('Signed in')
+      }
+    } catch (error) {
+      toast.error(resolveAuthLoginErrorMessage(error))
+    } finally {
+      setIsSubmitting(false)
+    }
+  }
+
+  return (
+    <div className="w-full max-w-md rounded-lg border border-gray-200 bg-white p-6 shadow-sm">
+      <h1 className="mb-2 text-xl font-semibold text-gray-900">Sign in</h1>
+      <p className="mb-6 text-sm text-gray-600">Use your portal email and password.</p>
+      <Form onSubmit={onSubmit}>
+        <FormField label="Email">
+          <Input
+            type="email"
+            autoComplete="email"
+            required
+            value={email}
+            onChange={(e) => setEmail(e.target.value)}
+          />
+        </FormField>
+        <FormField label="Password">
+          <Input
+            type="password"
+            autoComplete="current-password"
+            required
+            value={password}
+            onChange={(e) => setPassword(e.target.value)}
+          />
+        </FormField>
+        <Button type="submit" className="w-full" disabled={isSubmitting}>
+          {isSubmitting ? 'Signing in…' : 'Sign in'}
+        </Button>
+      </Form>
+    </div>
+  )
+}

package/templates/scaffold/auth/_shared/src/features/auth/login-email-storage.ts

@@ -0,0 +1,64 @@
+import { WP_STORAGE_KEYS } from 'woodsportal-client-sdk'
+
+const LOGIN_EMAIL_KEY = WP_STORAGE_KEYS.c.login.email
+
+function isValidEmail(value: string): boolean {
+  return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value.trim())
+}
+
+export function extractLoginEmailFromPayload(
+  payload: Record<string, unknown> | null | undefined,
+): string | null {
+  if (!payload || typeof payload !== 'object') {
+    return null
+  }
+  const loggedInDetails = payload.loggedInDetails
+  if (loggedInDetails && typeof loggedInDetails === 'object') {
+    const email = (loggedInDetails as Record<string, unknown>).email
+    if (typeof email === 'string' && isValidEmail(email)) {
+      return email.trim().toLowerCase()
+    }
+  }
+  for (const key of ['email', 'username'] as const) {
+    const value = payload[key]
+    if (typeof value === 'string' && isValidEmail(value)) {
+      return value.trim().toLowerCase()
+    }
+  }
+  return null
+}
+
+export function captureLoginEmailBeforeSessionClear(
+  resolveLoggedInEmail?: () => string | null | undefined,
+): void {
+  if (getStoredLoginEmail()) {
+    return
+  }
+  const email = resolveLoggedInEmail?.()
+  if (email) {
+    setStoredLoginEmail(email)
+  }
+}
+
+export function getStoredLoginEmail(): string | null {
+  if (typeof window === 'undefined') {
+    return null
+  }
+  const stored = sessionStorage.getItem(LOGIN_EMAIL_KEY)?.trim().toLowerCase() ?? ''
+  return stored && isValidEmail(stored) ? stored : null
+}
+
+export function setStoredLoginEmail(email: string): void {
+  if (typeof window === 'undefined') {
+    return
+  }
+  const normalized = email.trim().toLowerCase()
+  if (!isValidEmail(normalized)) {
+    return
+  }
+  sessionStorage.setItem(LOGIN_EMAIL_KEY, normalized)
+}
+
+export function clearLoginPreAuthSession(): void {
+  // starter scaffold: no pre-login passkey state
+}

package/templates/scaffold/auth/_shared/src/features/auth/login-session-bridge.ts

@@ -0,0 +1,72 @@
+import { api } from '@/integrations/woodsportal-sdk'
+import {
+  navigateAfterFullAuth,
+  type AuthNavigationRouter,
+} from '@/features/auth/auth-navigation'
+import { resolvePostLoginPath } from '@/features/auth/resolve-post-login-path'
+import { AUTH_SESSION_CHANGED } from '@/features/auth/auth-session-events'
+import { signalSessionChanged } from 'woodsportal-client-sdk'
+import {
+  extractLoginEmailFromPayload,
+  setStoredLoginEmail,
+} from '@/features/auth/login-email-storage'
+
+function notifyAuthSessionChanged(): void {
+  if (typeof window === 'undefined') return
+  signalSessionChanged('login')
+  window.dispatchEvent(new CustomEvent(AUTH_SESSION_CHANGED))
+}
+
+type AuthRouter = AuthNavigationRouter
+
+function unwrapLoginPayload(
+  response: { data?: Record<string, unknown>; statusMsg?: string } | Record<string, unknown>,
+): Record<string, unknown> {
+  return (response?.data ?? response ?? {}) as Record<string, unknown>
+}
+
+export type HandleAuthLoginResponseOptions = {
+  clearPreHashQuery?: () => void
+  onSubscriptionType?: (subscriptionType: string) => void
+}
+
+export type HandleAuthLoginResponseResult =
+  | { success: false; reason: 'no_token' | 'mfa_required' }
+  | { success: true; mfaRequired: true }
+  | { success: true; mfaRequired: false }
+
+/** Shown when the hub requires MFA but the project used `--auth starter` or `sso`. */
+export const MFA_REQUIRED_SCAFFOLD_MESSAGE =
+  'This hub requires MFA. Re-init with wp init --auth full (see docs/AUTH-SCAFFOLD.md).'
+
+export async function handleAuthLoginResponse(
+  response: { data?: Record<string, unknown>; statusMsg?: string } | Record<string, unknown>,
+  router: AuthRouter,
+  options: HandleAuthLoginResponseOptions = {},
+): Promise<HandleAuthLoginResponseResult> {
+  const data = unwrapLoginPayload(response)
+  const tokenData = (data.tokenData ?? {}) as { token?: string }
+  const sessionToken = api.auth.session.getAccessToken()
+  const token = tokenData.token ?? sessionToken ?? undefined
+
+  if (!token) {
+    return { success: false, reason: 'no_token' }
+  }
+
+  const loginEmail = extractLoginEmailFromPayload(data)
+  if (loginEmail) {
+    setStoredLoginEmail(loginEmail)
+  }
+
+  if (data.twoFactorRequired === true) {
+    return { success: false, reason: 'mfa_required' }
+  }
+
+  const loggedInDetails = (data.loggedInDetails ?? {}) as { subscriptionType?: string }
+  options.onSubscriptionType?.(loggedInDetails.subscriptionType ?? 'BASIC')
+
+  options.clearPreHashQuery?.()
+  notifyAuthSessionChanged()
+  navigateAfterFullAuth(router, resolvePostLoginPath(router))
+  return { success: true, mfaRequired: false }
+}

package/templates/scaffold/auth/_shared/src/features/auth/post-login-path.ts

@@ -0,0 +1,17 @@
+import { Routes } from '@/config/routes'
+import { normalizeRouterPath } from '@/utils/normalize-router-path'
+
+const AUTH_RETURN_PATHS = new Set<string>([
+  Routes.login,
+  Routes.twoFa,
+  Routes.unauthorized,
+  Routes.ssoLogin,
+])
+
+export function isBlockedPostLoginPath(path: string): boolean {
+  const normalized = normalizeRouterPath(path)
+  if (AUTH_RETURN_PATHS.has(normalized)) {
+    return true
+  }
+  return normalized.startsWith('/login')
+}

package/templates/scaffold/auth/_shared/src/features/auth/resolve-auth-login-error-message.ts

@@ -0,0 +1,52 @@
+const GENERIC_AUTH_FAILED_MESSAGES = new Set([
+  'Authentication Failed',
+  'Invalid credentials provided.',
+])
+
+type LoginErrorPayload = {
+  errorCode?: unknown
+  errorMessage?: unknown
+  validationErrors?: unknown
+}
+
+function extractFirstValidationMessage(validationErrors: unknown): string | null {
+  if (validationErrors == null || typeof validationErrors !== 'object') {
+    return null
+  }
+  const first = Object.values(validationErrors as Record<string, unknown>)[0]
+  if (typeof first === 'string') {
+    return first
+  }
+  if (Array.isArray(first) && typeof first[0] === 'string') {
+    return first[0]
+  }
+  return null
+}
+
+export function resolveAuthLoginErrorMessage(error: unknown): string {
+  const fallback = 'Wrong email or password'
+  if (error == null || typeof error !== 'object') {
+    return fallback
+  }
+  const data = (error as { response?: { data?: LoginErrorPayload } }).response?.data
+  if (!data) {
+    return fallback
+  }
+  const validationMessage = extractFirstValidationMessage(data.validationErrors)
+  if (validationMessage) {
+    return validationMessage
+  }
+  const errorCode = typeof data.errorCode === 'string' ? data.errorCode : undefined
+  const errorMessage =
+    typeof data.errorMessage === 'string' ? data.errorMessage.trim() : ''
+  if (!errorMessage) {
+    return fallback
+  }
+  if (
+    errorCode === 'AUTHENTICATION_FAILED' &&
+    GENERIC_AUTH_FAILED_MESSAGES.has(errorMessage)
+  ) {
+    return fallback
+  }
+  return errorMessage
+}

package/templates/scaffold/auth/_shared/src/features/auth/resolve-post-login-path.ts

@@ -0,0 +1,21 @@
+import { Routes } from '@/config/routes'
+import { isBlockedPostLoginPath } from '@/features/auth/post-login-path'
+import { normalizeRouterPath } from '@/utils/normalize-router-path'
+import type { SafeAuthRouter } from '@/utils/safe-router-navigation'
+
+export type PostLoginRouter = SafeAuthRouter & {
+  state: {
+    location?: {
+      search?: { r?: string; [key: string]: string | undefined }
+      pathname?: string
+    }
+  }
+}
+
+export function resolvePostLoginPath(router: PostLoginRouter): string {
+  const redirect = router.state.location?.search?.r
+  if (redirect && !isBlockedPostLoginPath(String(redirect))) {
+    return normalizeRouterPath(String(redirect))
+  }
+  return Routes.portal
+}

package/templates/scaffold/auth/_shared/src/features/auth/use-portal-session.ts

@@ -0,0 +1,25 @@
+import { useEffect, useMemo, useState } from 'react'
+import { AUTH_SESSION_CHANGED } from '@/features/auth/auth-session-events'
+import { isFullyAuthenticatedSession, isMfaPendingSession } from '@/features/auth/auth-session'
+
+function useAuthSessionRevision(): number {
+  const [revision, setRevision] = useState(0)
+  useEffect(() => {
+    const bump = () => setRevision((value) => value + 1)
+    window.addEventListener(AUTH_SESSION_CHANGED, bump)
+    return () => window.removeEventListener(AUTH_SESSION_CHANGED, bump)
+  }, [])
+  return revision
+}
+
+export { useAuthSessionRevision }
+
+export function usePortalSession(): boolean {
+  const revision = useAuthSessionRevision()
+  return useMemo(() => isFullyAuthenticatedSession(), [revision])
+}
+
+export function useIsMfaPendingSession(): boolean {
+  const revision = useAuthSessionRevision()
+  return useMemo(() => isMfaPendingSession(), [revision])
+}

package/templates/scaffold/auth/_shared/src/features/auth/use-signed-in-email.ts

@@ -0,0 +1,55 @@
+import { useEffect, useState } from 'react'
+
+import { api } from '@/integrations/woodsportal-sdk'
+import { getStoredLoginEmail } from '@/features/auth/login-email-storage'
+import { usePortalSession } from '@/features/auth/use-portal-session'
+
+function readEmailFromProfile(data: unknown): string | null {
+  if (data == null || typeof data !== 'object') {
+    return null
+  }
+  const root = data as Record<string, unknown>
+  const profile = (root.data ?? root) as Record<string, unknown>
+  const email = profile.email
+  return typeof email === 'string' && email.trim() !== '' ? email.trim() : null
+}
+
+export function useSignedInEmail(): { email: string | null; isLoading: boolean } {
+  const isAuthenticated = usePortalSession()
+  const [email, setEmail] = useState<string | null>(() => getStoredLoginEmail())
+  const [isLoading, setIsLoading] = useState(false)
+
+  useEffect(() => {
+    if (!isAuthenticated) {
+      setEmail(null)
+      setIsLoading(false)
+      return
+    }
+
+    const stored = getStoredLoginEmail()
+    if (stored) {
+      setEmail(stored)
+      return
+    }
+
+    setIsLoading(true)
+    const { me } = api.auth.me({
+      onSuccess: (data) => {
+        setEmail(readEmailFromProfile(data) ?? getStoredLoginEmail())
+        setIsLoading(false)
+      },
+      onError: () => {
+        setEmail(getStoredLoginEmail())
+        setIsLoading(false)
+      },
+      onLoadingChange: (loading) => {
+        if (!loading) {
+          setIsLoading(false)
+        }
+      },
+    })
+    void me()
+  }, [isAuthenticated])
+
+  return { email, isLoading }
+}