feat: integrate tenant SSO and remote toggle

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

frontend/src/api/client.ts

@@ -93,11 +93,7 @@ function apiURL(path: string): string {
 
 function tenantHeader(): Record<string, string> {
   const tenant = tenantFromHostname(window.location.hostname)
-  const apiKey = import.meta.env.VITE_GO_LOOSE_API_KEY
-  return {
-    ...(tenant ? { 'X-Tenant-Id': tenant } : {}),
-    ...(typeof apiKey === 'string' && apiKey !== '' ? { 'X-API-Key': apiKey } : {}),
-  }
+  return tenant ? { 'X-Tenant-Id': tenant } : {}
 }
 
 async function request<T>(

frontend/src/app/App.tsx

@@ -9,7 +9,7 @@ import {DataProvider} from './DataContext'
 
 export default function App() {
     const location = useLocation();
-    const {authenticated, sessionExpired, completeLogin, logout} = useAuthSession();
+    const {authenticated, sessionExpired, ssoStatus, completeLogin, logout} = useAuthSession();
     if (location.pathname.startsWith('/participant/')) {
         return (
             <Routes>
@@ -20,6 +20,9 @@ export default function App() {
         )
     }
     if (!authenticated) {
+        if (ssoStatus !== 'idle') {
+            return <main className="login-shell"><p>Redirecting to sign in…</p></main>
+        }
         return <LoginPage onLogin={completeLogin} sessionExpired={sessionExpired}/>
     }
     return (

frontend/src/components/actions/Account.tsx

@@ -1,16 +1,31 @@
 import { useEffect, useState } from 'react'
-import { useNavigate } from 'react-router-dom'
+import { useLocation, useNavigate } from 'react-router-dom'
 import { authStorage, invalidateSession, SESSION_EXPIRED_EVENT } from '../../api/client'
 
+const ssoHosts = new Set(['nmbs.guess.dev', 'ypto.guess.dev'])
+
+export function isSSOHost() {
+  return ssoHosts.has(window.location.hostname)
+}
+
 export function useAuthSession() {
+  const location = useLocation()
+  const sso = isSSOHost() && !location.pathname.startsWith('/participant/')
   const [authenticated, setAuthenticated] = useState(() => Boolean(authStorage.token()))
   const [sessionExpired, setSessionExpired] = useState(false)
+  const [redirecting, setRedirecting] = useState(false)
+  const needsSSO = sso && !authenticated && !authStorage.token()
+  const ssoStatus = !needsSSO ? 'idle' : redirecting ? 'redirecting' : 'checking'
   const navigate = useNavigate()
 
   useEffect(() => {
     function handleSessionExpired() {
       setAuthenticated(false)
       setSessionExpired(true)
+      if (isSSOHost() && !window.location.pathname.startsWith('/participant/')) {
+        window.location.replace('/api/auth/login')
+        return
+      }
       navigate('/login', { replace: true })
     }
 
@@ -18,6 +33,36 @@ export function useAuthSession() {
     return () => window.removeEventListener(SESSION_EXPIRED_EVENT, handleSessionExpired)
   }, [navigate])
 
+  useEffect(() => {
+    if (!needsSSO) return
+    let cancelled = false
+    void (async () => {
+      try {
+        const response = await fetch('/api/auth/session', {
+          headers: { Accept: 'application/json' },
+          credentials: 'same-origin',
+          redirect: 'manual',
+        })
+        if (cancelled) return
+        if (response.ok) {
+          authStorage.save(await response.json())
+          setAuthenticated(true)
+          setSessionExpired(false)
+          return
+        }
+      } catch {
+        // The browser redirect below starts a fresh Go Loose login.
+      }
+      if (!cancelled) {
+        setRedirecting(true)
+        window.location.replace('/api/auth/login')
+      }
+    })()
+    return () => {
+      cancelled = true
+    }
+  }, [needsSSO])
+
   useEffect(() => {
     if (!authenticated) return
     const expiresAt = authStorage.expiresAt()
@@ -41,7 +86,8 @@ export function useAuthSession() {
     authStorage.clear()
     setAuthenticated(false)
     setSessionExpired(false)
+    if (isSSOHost()) window.location.assign('/api/auth/logout')
   }
 
-  return { authenticated, sessionExpired, completeLogin, logout }
+  return { authenticated, sessionExpired, ssoStatus, completeLogin, logout }
 }