feat(auth): per-tab auth sessions (sessionStorage source of truth) behind NEXT_PUBLIC_IBL_PER_TAB_AUTH - #467
Open
sonegillis1 wants to merge 5 commits into
Open
feat(auth): per-tab auth sessions (sessionStorage source of truth) behind NEXT_PUBLIC_IBL_PER_TAB_AUTH#467sonegillis1 wants to merge 5 commits into
sonegillis1 wants to merge 5 commits into
Conversation
…lai-js 2.7.3 Routes token/tenant reads+writes through @iblai/iblai-js/web-utils authStorage: useLocalStorage (covers all token hooks), LocalStorageService (data-layer), hasNonExpiredAuthToken/isLoggedIn/handleLogout(per-tab)/saveUserObjectToLocalStorage, API auth headers, lib/handlers install loop, Code/Cowork/speech reads, and the Tauri offline snapshot (session-first read, restore to both). Flag off = today. Typecheck clean. NEXT_PUBLIC_IBL_PER_TAB_AUTH in .env.example. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
mentorai now imports getAuthItem/setAuthItem/etc. from the SDK, so the
hand-listed vi.mock('@iblai/iblai-js/web-utils') factories that exercise those
paths threw "No <fn> export is defined on the mock". Add a shared flag-OFF
localStorage passthrough (globalThis.__iblAuthStorageMock in vitest.setup.ts)
and spread it into the affected factories. use-user.test gains a web-utils mock
too: getAuthItem is now a value import that would otherwise pull the full SDK
runtime (redux-toolkit query -> react-redux batch) into a test that only
partially mocks react-redux.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The restore guard checked sessionStorage||localStorage together, so when the localStorage seed already matched it skipped the sessionStorage write — exactly the case per-tab restore must cover (populate this tab's session source-of-truth offline). Check each store on its own. Mirrors the same fix in skillsai; applied to both the desktop (main.rs) and mobile (lib.rs) hand-synced copies. Flag-ON path; flag ships off. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Mirrors the skillsai fix in both hand-synced copies (main.rs desktop, lib.rs mobile): restore each store only when empty, so a fresh offline launch hydrates but a running tab's live per-tab session is never overwritten by a stale snapshot. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
PR E2E - FAILEDFull report, traces and screenshots
|
conradmugabe
approved these changes
Aug 31, 2026
…dule Same RSC-safety fix as skillsai. Importing getAuthItem/etc. from the @iblai/iblai-js/web-utils barrel pulls a top-level React.createContext (via @iblai/web-utils 2.2.2) into the server bundle; lib/utils.ts's cn() is used by RSC components, so the server bundle would crash with 'createContext is not a function'. Add lib/auth-storage.ts (a dependency-free mirror of the SDK's flag-OFF/flag-ON policy) and repoint lib/utils, lib/handlers, the use-local-storage hook, use-user, use-speech, use-opencode-402, features/utils and coding-mode-button to it. Only the Tenant type still comes from the barrel. Production build passes; typecheck clean; auth-storage covered. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
PR E2E - OKFull report, traces and screenshots
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Wires mentorai onto the SDK's per-tab
authStoragepolicy (released in@iblai/iblai-js@2.7.3), gated byNEXT_PUBLIC_IBL_PER_TAB_AUTH(default off = byte-identical to today).Under the flag, sessionStorage becomes each tab's auth source of truth and localStorage keeps only the most-recent login as a seed, so different tabs can stay signed into different tenants — ending the recurring tenant-switch clobber. Off, every path is the current localStorage behavior.
Changes
lib/utils.ts—LocalStorageService,hasNonExpiredAuthToken,isLoggedIn,handleLogout(tab-localclearPerTabSession),saveUserObjectToLocalStorage→ authStorage.hooks/use-local-storage.ts— routes every token hook (dm/axd/edx/tenant/userData/…) throughgetAuthItem/setAuthItem/removeAuthItem.features/utils.ts(API auth headers),lib/handlers.ts(iframe AUTH_UPDATE install),coding-mode-button.tsx,use-opencode-402.ts,use-speech.ts,use-user.ts→getAuthItem.src-tauri/src/{main,lib}.rs— offline snapshot readssessionStorage[k] ?? localStorage[k], restore writes both..env.example— documentsNEXT_PUBLIC_IBL_PER_TAB_AUTH.@iblai/iblai-js→ 2.7.3.Tests
__iblAuthStorageMockpassthrough added tovitest.setup.tsand spread into the web-utils mocks that exercise the new imports.Rollout
Land off (no behavior change) → enable
NEXT_PUBLIC_IBL_PER_TAB_AUTH=truein staging → run the multi-tab verification matrix → production. Paired with the skillsai PR.