toga-ai 1.0.337 → 1.0.338

package/knowledge/2.0/apps/toga2-commerce/INDEX.md

@@ -6,7 +6,7 @@
 | [Cart Bundle Submission & the bundleUuid Identity Contract](features/cart-bundle-submission-and-identity.md) | How cart **bundles** (kits) are turned into `SalesOrderItems` when a cart is submitted or an existing order is edited, and the **identity-field contract** every | src/api/syncSalesOrderItemsFromLocalStorageCartToApi.ts, src/utils/formatSalesOrderBundlesFromApi.ts, src/stores/useCartStoreZu.ts, src/pages/OrderDetails/helpers/formatSalesOrderDataFromLocalStorage.ts, src/pages/OrderDetails/view/components/OrderItems.tsx |
 | [Cart Notification Emails — duplicate prevention](features/cart-notification-emails.md) | On the cart "Notifications" section a user can add CC email addresses to an order. | src/pages/Cart/CartPage.tsx, src/pages/Cart/view/cartForm/CartForm.tsx, src/stores/useEmailOptionsStore.ts, src/stores/useCartSalesQuoteZu.ts, src/pages/Cart/viewModel/FIELDS/*/*/*/CARTPAGE.ts |
 | [Cart Page — config-driven form architecture (current state + planned refactor)](features/cart-page-config-architecture.md) | The Cart page (`src/pages/Cart/`) is the most config-heavy page in `toga2-commerce`. | src/pages/Cart/CartPage.tsx, src/pages/Cart/view/cartForm/CartForm.tsx, src/pages/Cart/view/cartForm/CartFormSection.tsx, src/pages/Cart/view/cartForm/CartFormRenderer.tsx, src/pages/Cart/view/EditCart.tsx, src/pages/Cart/view/EditOrder.tsx, src/pages/Cart/viewModel/useEditOrderOrEditCartViewModel.ts, src/pages/Cart/viewModel/FIELDS/*/*/*/CARTPAGE.ts, src/hooks/useAssignClientFields.ts |
-| [Client Fields — per-tenant / language / role content & config](features/client-fields.md) | Almost no user-facing text, field layout, or page config is hard-coded in `toga2-commerce`. | src/fieldsConfig/index.ts, src/fieldsConfig/getClientLoginFields.ts, src/fieldsConfig/clientFields/COMPASS.json, src/fieldsConfig/clientFields/COMPASSCANADA.json, src/fieldsConfig/clientFields/QUAD.json, src/pages/Cart/api/CartApi.ts, src/hooks/useAssignClientFields.ts, src/hooks/useDynamicConditionalFieldOptions.ts, src/stores/useFieldsStore.ts, src/components/BaseDetailField/BaseDetailField.tsx |
+| [Client Fields — per-tenant / language / role content & config](features/client-fields.md) | Almost no user-facing text, field layout, or page config is hard-coded in `toga2-commerce`. | src/fieldsConfig/index.ts, src/fieldsConfig/getClientLoginFields.ts, src/fieldsConfig/clientFields/COMPASS.json, src/fieldsConfig/clientFields/COMPASSCANADA.json, src/fieldsConfig/clientFields/QUAD.json, src/pages/Cart/api/CartApi.ts, src/hooks/useAuthenticationFlow.ts, src/contexts/AuthContext.tsx, src/pages/Login/viewModel/useLoginPageViewModel.ts, src/hooks/useAssignClientFields.ts, src/hooks/useDynamicConditionalFieldOptions.ts, src/stores/useFieldsStore.ts, src/components/BaseDetailField/BaseDetailField.tsx |
 | [Config-Driven Expedited Shipping Gating (Cart)](features/expedited-shipping-gating.md) | On the toga2-commerce **Cart** page, expedited shipping options (**"2nd Day EOB"** and **"Next Day Air"**) are only offered in the *Shipping Method* dropdown wh | toga2-commerce/src/pages/Cart/helpers/shippingOptionGates.ts, toga2-commerce/src/pages/Cart/viewModel/FIELDS/shared/shippingOptionGates.ts, toga2-commerce/src/pages/Cart/view/cartForm/CartForm.tsx, toga2-commerce/src/pages/Cart/CartPage.tsx |
 | [Multi-Tenant Resolution & Theming](features/multi-tenant-theming.md) | `toga2-commerce` serves multiple clients from one codebase. | src/themeConfig/themes.json, src/themeConfig/ThemeContext.tsx, src/themeConfig/types.ts, src/components/ThemeSwitcher/ThemeSwitcher.tsx, src/components/AuthLayout/AuthLayout.tsx, src/api/axiosInstance.ts, src/contexts/AuthContext.tsx, tailwind.config.js |
 | [AWS Amplify Build & Deploy (non-prod environments)](workflows/amplify-build-and-deploy.md) | How `toga2-commerce` (React + Vite, "commerce2-react") builds and deploys on **AWS Amplify**. | toga2-commerce/amplify.yml, toga2-commerce/.gitattributes, toga2-commerce/package.json, toga2-commerce/.github/workflows/sync-stage-environments.yml |

package/knowledge/2.0/apps/toga2-commerce/features/client-fields.md

@@ -6,7 +6,7 @@ project: TOGa Commerce
 client: shared
 type: feature
 status: active
-updated: 2026-07-10
+updated: 2026-07-14
 owners: ["apeterson", "tcox"]
 files:
   - src/fieldsConfig/index.ts
@@ -15,6 +15,9 @@ files:
   - src/fieldsConfig/clientFields/COMPASSCANADA.json
   - src/fieldsConfig/clientFields/QUAD.json
   - src/pages/Cart/api/CartApi.ts
+  - src/hooks/useAuthenticationFlow.ts
+  - src/contexts/AuthContext.tsx
+  - src/pages/Login/viewModel/useLoginPageViewModel.ts
   - src/hooks/useAssignClientFields.ts
   - src/hooks/useDynamicConditionalFieldOptions.ts
   - src/stores/useFieldsStore.ts
@@ -53,7 +56,11 @@ resolved per tenant, per language, and per role**. There are **two layers**:
   QUAD are `false`.
 - `userApiFields` — the allow-list of user columns fetched at login; importantly it includes the
   tenant's **role flags**: COMPASS/COMPASSCANADA carry `_isAdmin`, `_isSupervisor`, `_isSuperAdmin`;
-  QUAD carries `_isGlobalAdmin`, `_isItShopper`, `_isBuyer`. All include `_personaIds`.
+  QUAD carries `_isGlobalAdmin`, `_isItShopper`, `_isBuyer`. All include `_personaIds`. This key is
+  now the **single source** for every auth-flow user fetch: `AuthContext.tsx`,
+  `useLoginPageViewModel.ts`, and `useAuthenticationFlow.ts` (the SAML post-auth fetch) all resolve
+  it via `getClientLoginFields(host).userApiFields` — there is no longer any hardcoded copy of the
+  user field list anywhere in the app (see the `useAuthenticationFlow` note below).
 - `fetchUsersApiFields` — the allow-list of user columns fetched by the **view-as user search**
   (`fetchUsers()` in `src/pages/Cart/api/CartApi.ts`, driven from `NavIconList.tsx`). Distinct from
   `userApiFields` (which is the login fetch). COMPASS/COMPASSCANADA use the 14-field default list;
@@ -79,6 +86,23 @@ touching Cart code.
 same hardcoded QUAD-vs-default field-list pattern and is a candidate for the identical config
 treatment in a future ticket.
 
+### `userApiFields` and the SAML post-auth fetch (`useAuthenticationFlow`)
+
+`src/hooks/useAuthenticationFlow.ts` no longer hardcodes the user field list for the SAML post-auth
+user fetch. It previously carried an `if (hostNameCode === "QUAD") […] else […]` branch whose two
+lists were **exact element-for-element duplicates** (same order) of the `userApiFields` already in
+`COMPASS.json` / `COMPASSCANADA.json` / `QUAD.json`. It now resolves the list via
+`getClientLoginFields(hostNameCode).userApiFields` — no JSON changes were needed. This is the same
+"config, not `if (client === …)` branches" centralization as the `fetchUsersApiFields`/C6 refactor
+above (sibling ticket TRUE-80015 did the identical treatment for `fetchUsers()` in `CartApi.ts`;
+`useAuthenticationFlow` was TRUE-80017). With this change, `useAuthenticationFlow` was the **last
+remaining hardcoded duplicate** of the user field list — `AuthContext.tsx` and
+`useLoginPageViewModel.ts` already consumed config — so all user-field lists in the app now flow
+through `getClientLoginFields`. Behavior-identical for all tenants, `tsc` clean.
+
+Note: **COMPASSCANADA** previously fell into the generic `else` branch and now resolves to its own
+`COMPASSCANADA.json` (currently identical content to COMPASS — a future divergence point).
+
 ## Layer B — the per-page FIELDS registry
 
 `src/fieldsConfig/index.ts` (~1100 lines) imports every page's per-tenant field constants (which
@@ -219,4 +243,10 @@ Common field attributes: `uuid`, `label`, `valueKey` (path into the data object)
   QUAD = 8-field), replacing the `if (fieldKey === "QUAD")` branch with a config lookup (C6). Noted
   the deliberate QUAD `supervisorUser.*` omission and the `fetchUser()` follow-up candidate. Refactor
   only, no behavior change; `tsc --noEmit` clean. (tcox)
+- 2026-07-14 — Removed the last hardcoded user-field list: `useAuthenticationFlow.ts` (SAML post-auth
+  fetch) now reads `getClientLoginFields(hostNameCode).userApiFields` instead of an
+  `if (hostNameCode === "QUAD") … else …` duplicate of the JSON lists (TRUE-80017; sibling of the
+  TRUE-80015 `fetchUsers` refactor). All user-field lists now flow through config;
+  COMPASSCANADA now resolves its own JSON rather than the generic `else`. Behavior-identical, `tsc`
+  clean. (tcox)
 </content>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.337",
+  "version": "1.0.338",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",