changing layout

ui/app/src/auth.tsx

@@ -1,26 +1,21 @@
 import { createContext, useCallback, useContext, useEffect, useMemo, useState, type ReactNode } from 'react'
-import { requestSession, signInWithGoogle, signOut, type User } from './api'
+import { requestSession } from './api'
 
+// There is no sign-in or sign-out: the upstream SSO proxy decides whether the
+// current request carries the owner's identity.
 type AuthState = {
-  user: User | null
   loading: boolean
+  authenticated: boolean
+  canEdit: boolean
   error: string | null
-  signIn: () => Promise<void>
-  signOut: () => Promise<void>
+  refresh: () => Promise<void>
 }
 
 const AuthContext = createContext<AuthState | undefined>(undefined)
 
-function getUser(result: { authenticated?: boolean; user?: User; capabilities?: Record<string, boolean>; canEdit?: boolean; token?: string; accessToken?: string; sessionToken?: string }) {
-  const token = result.token ?? result.accessToken ?? result.sessionToken
-  if (token) sessionStorage.setItem('cms.auth.token', token)
-  if (result.authenticated === false) return null
-  if (!result.user && !token && result.authenticated !== true) return null
-  return { ...(result.user ?? {}), capabilities: { ...result.capabilities, ...(result.canEdit !== undefined ? { canEdit: result.canEdit } : {}), ...result.user?.capabilities } }
-}
-
 export function AuthProvider({ children }: { children: ReactNode }) {
-  const [user, setUser] = useState<User | null>(null)
+  const [authenticated, setAuthenticated] = useState(false)
+  const [canEdit, setCanEdit] = useState(false)
   const [loading, setLoading] = useState(true)
   const [error, setError] = useState<string | null>(null)
 
@@ -28,10 +23,12 @@ export function AuthProvider({ children }: { children: ReactNode }) {
     try {
       setError(null)
       const session = await requestSession()
-      setUser(session ? getUser(session) : null)
+      setAuthenticated(session?.authenticated === true)
+      setCanEdit(session?.canEdit === true)
     } catch (err) {
-      setUser(null)
-      setError(err instanceof Error ? err.message : 'Unable to check your session.')
+      setAuthenticated(false)
+      setCanEdit(false)
+      setError(err instanceof Error ? err.message : 'Unable to check your SSO session.')
     } finally {
       setLoading(false)
     }
@@ -39,23 +36,7 @@ export function AuthProvider({ children }: { children: ReactNode }) {
 
   useEffect(() => { void refresh() }, [refresh])
 
-  const signIn = useCallback(async () => {
-    setError(null)
-    try {
-      const result = await signInWithGoogle()
-      setUser(getUser(result))
-    } catch (err) {
-      setError(err instanceof Error ? err.message : 'Sign-in failed.')
-    }
-  }, [])
-
-  const logOut = useCallback(async () => {
-    await signOut().catch(() => undefined)
-    sessionStorage.removeItem('cms.auth.token')
-    setUser(null)
-  }, [])
-
-  const value = useMemo(() => ({ user, loading, error, signIn, signOut: logOut }), [user, loading, error, signIn, logOut])
+  const value = useMemo(() => ({ loading, authenticated, canEdit, error, refresh }), [loading, authenticated, canEdit, error, refresh])
   return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>
 }
 
@@ -63,4 +44,4 @@ export function useAuth() {
   const context = useContext(AuthContext)
   if (!context) throw new Error('useAuth must be used inside AuthProvider')
   return context
-}
+}