|
| 1 | +<script lang="ts"> |
| 2 | + // DidiBadge — the shell's didi.sh identity affordance (spec increment 2, |
| 3 | + // shell half). Lives in the header so it carries across every mounted |
| 4 | + // micro-app: the identity is shell-level, not per-remote. |
| 5 | + // |
| 6 | + // Signed-in state comes from the WORKSPACE session frame (didi_id is |
| 7 | + // server-verified on the WS upgrade — never client-asserted); the email |
| 8 | + // shown alongside comes from the id service's /api/me. Sign-in follows |
| 9 | + // the headless contract: this panel owns the pixels and calls the |
| 10 | + // magic-link endpoints directly. In dev the id service echoes the raw |
| 11 | + // token (echo_login_tokens), so sign-in completes without a mailbox; |
| 12 | + // in prod the same panel becomes "check your email". |
| 13 | +
|
| 14 | + import { workspace } from '@augment-it/workspace'; |
| 15 | +
|
| 16 | + // Rsbuild injects PUBLIC_* env at build; shell tsconfig has no env |
| 17 | + // typings, hence the cast. Defaults to the local dev id service. |
| 18 | + const ID_BASE = |
| 19 | + ((import.meta as { env?: Record<string, string> }).env?.PUBLIC_ID_BASE as |
| 20 | + | string |
| 21 | + | undefined) ?? 'http://localhost:4000'; |
| 22 | +
|
| 23 | + let email = $state(''); |
| 24 | + let busy = $state(false); |
| 25 | + let notice = $state(''); |
| 26 | + let me = $state<{ email?: string; name?: string } | null>(null); |
| 27 | +
|
| 28 | + const didiId = $derived(workspace.user?.didi_id ?? null); |
| 29 | +
|
| 30 | + $effect(() => { |
| 31 | + if (didiId && !me) { |
| 32 | + fetch(`${ID_BASE}/api/me`, { credentials: 'include' }) |
| 33 | + .then((r) => (r.ok ? r.json() : null)) |
| 34 | + .then((j) => { |
| 35 | + me = j; |
| 36 | + }) |
| 37 | + .catch(() => {}); |
| 38 | + } |
| 39 | + }); |
| 40 | +
|
| 41 | + async function signIn(e: SubmitEvent) { |
| 42 | + e.preventDefault(); |
| 43 | + if (!email || busy) return; |
| 44 | + busy = true; |
| 45 | + notice = ''; |
| 46 | + try { |
| 47 | + const issue = await fetch(`${ID_BASE}/api/magic-links`, { |
| 48 | + method: 'POST', |
| 49 | + credentials: 'include', |
| 50 | + headers: { 'content-type': 'application/json' }, |
| 51 | + body: JSON.stringify({ email, app: 'augment-it' }), |
| 52 | + }).then((r) => r.json()); |
| 53 | +
|
| 54 | + if (issue.dev_token) { |
| 55 | + const redeem = await fetch(`${ID_BASE}/api/magic-links/redeem`, { |
| 56 | + method: 'POST', |
| 57 | + credentials: 'include', |
| 58 | + headers: { 'content-type': 'application/json' }, |
| 59 | + body: JSON.stringify({ token: issue.dev_token }), |
| 60 | + }); |
| 61 | + if (redeem.ok) { |
| 62 | + // Cookie is set — reload so the WS upgrade carries it and the |
| 63 | + // workspace re-verifies. (A transport reconnect would also work; |
| 64 | + // reload is the honest v0.) |
| 65 | + window.location.reload(); |
| 66 | + return; |
| 67 | + } |
| 68 | + notice = 'Redeem failed — token expired?'; |
| 69 | + } else { |
| 70 | + // Invite-only: unknown emails get the same 202 (no enumeration). |
| 71 | + notice = |
| 72 | + 'If that address has a didi.sh ID, a sign-in link was sent. ' + |
| 73 | + '(dev: seed with `mix id.seed` — no dev token came back)'; |
| 74 | + } |
| 75 | + } catch { |
| 76 | + notice = `id service unreachable at ${ID_BASE}`; |
| 77 | + } |
| 78 | + busy = false; |
| 79 | + } |
| 80 | +
|
| 81 | + async function signOut() { |
| 82 | + try { |
| 83 | + await fetch(`${ID_BASE}/api/session`, { method: 'DELETE', credentials: 'include' }); |
| 84 | + } catch { |
| 85 | + // cookie may outlive an unreachable id service; reload clears state |
| 86 | + } |
| 87 | + window.location.reload(); |
| 88 | + } |
| 89 | +</script> |
| 90 | + |
| 91 | +<details class="didi"> |
| 92 | + <summary |
| 93 | + class="didi-badge" |
| 94 | + class:on={didiId !== null} |
| 95 | + title={didiId ? `didi.sh · ${didiId}` : 'No didi.sh ID connected'} |
| 96 | + > |
| 97 | + <span class="didi-mark" aria-hidden="true">▣</span> |
| 98 | + {#if didiId} |
| 99 | + <span class="didi-label">{me?.email ?? didiId.slice(0, 8)}</span> |
| 100 | + {:else} |
| 101 | + <span class="didi-label didi-label--muted">sign in</span> |
| 102 | + {/if} |
| 103 | + </summary> |
| 104 | + |
| 105 | + <div class="didi-pop"> |
| 106 | + {#if didiId} |
| 107 | + <p class="didi-pop__head">didi.sh ID · connected</p> |
| 108 | + {#if me?.name}<p class="didi-row"><span>name</span>{me.name}</p>{/if} |
| 109 | + {#if me?.email}<p class="didi-row"><span>email</span>{me.email}</p>{/if} |
| 110 | + <p class="didi-row"><span>sub</span>{didiId}</p> |
| 111 | + <p class="didi-row"><span>verified</span>on WS upgrade · JWKS</p> |
| 112 | + <button class="didi-btn" onclick={signOut}>Sign out everywhere</button> |
| 113 | + {:else} |
| 114 | + <p class="didi-pop__head">Connect your didi.sh ID</p> |
| 115 | + <form onsubmit={signIn}> |
| 116 | + <input |
| 117 | + class="didi-input" |
| 118 | + type="email" |
| 119 | + placeholder="you@example.com" |
| 120 | + bind:value={email} |
| 121 | + required |
| 122 | + /> |
| 123 | + <button class="didi-btn didi-btn--primary" disabled={busy}> |
| 124 | + {busy ? 'signing in…' : 'Send magic link'} |
| 125 | + </button> |
| 126 | + </form> |
| 127 | + {#if notice}<p class="didi-notice">{notice}</p>{/if} |
| 128 | + <p class="didi-fine">Invite-only · no passwords · one login across didi.sh</p> |
| 129 | + {/if} |
| 130 | + </div> |
| 131 | +</details> |
| 132 | + |
| 133 | +<style> |
| 134 | + .didi { |
| 135 | + position: relative; |
| 136 | + } |
| 137 | + .didi-badge { |
| 138 | + display: inline-flex; |
| 139 | + align-items: center; |
| 140 | + gap: 5px; |
| 141 | + padding: 3px 9px; |
| 142 | + border: 1px solid var(--color-border-strong, rgba(255, 255, 255, 0.2)); |
| 143 | + border-radius: 999px; |
| 144 | + cursor: pointer; |
| 145 | + list-style: none; |
| 146 | + font-size: 11px; |
| 147 | + color: var(--color-text-dim, #9a9a9a); |
| 148 | + background: transparent; |
| 149 | + user-select: none; |
| 150 | + } |
| 151 | + .didi-badge::-webkit-details-marker { |
| 152 | + display: none; |
| 153 | + } |
| 154 | + .didi-badge.on { |
| 155 | + color: var(--color-thread, #55e0d2); |
| 156 | + border-color: color-mix(in oklab, var(--color-thread, #55e0d2) 45%, transparent); |
| 157 | + background: color-mix(in oklab, var(--color-thread, #55e0d2) 10%, transparent); |
| 158 | + } |
| 159 | + .didi-mark { |
| 160 | + font-size: 12px; |
| 161 | + } |
| 162 | + .didi-label--muted { |
| 163 | + opacity: 0.8; |
| 164 | + } |
| 165 | +
|
| 166 | + .didi-pop { |
| 167 | + position: absolute; |
| 168 | + right: 0; |
| 169 | + top: calc(100% + 8px); |
| 170 | + z-index: 90; |
| 171 | + width: 280px; |
| 172 | + padding: 12px 14px; |
| 173 | + border: 1px solid var(--color-border-strong, rgba(255, 255, 255, 0.2)); |
| 174 | + border-radius: 8px; |
| 175 | + background: var(--color-bg-elevated, #1b1b22); |
| 176 | + box-shadow: 0 18px 40px -18px rgba(0, 0, 0, 0.6); |
| 177 | + font-size: 12px; |
| 178 | + } |
| 179 | + .didi-pop__head { |
| 180 | + margin: 0 0 8px; |
| 181 | + font-family: var(--font__mono, monospace); |
| 182 | + font-size: 10px; |
| 183 | + letter-spacing: 0.14em; |
| 184 | + text-transform: uppercase; |
| 185 | + color: var(--color-text-dim, #9a9a9a); |
| 186 | + } |
| 187 | + .didi-row { |
| 188 | + display: flex; |
| 189 | + gap: 8px; |
| 190 | + margin: 3px 0; |
| 191 | + font-family: var(--font__mono, monospace); |
| 192 | + font-size: 11px; |
| 193 | + overflow-wrap: anywhere; |
| 194 | + } |
| 195 | + .didi-row span { |
| 196 | + flex: 0 0 56px; |
| 197 | + color: var(--color-text-dim, #9a9a9a); |
| 198 | + text-transform: uppercase; |
| 199 | + font-size: 9px; |
| 200 | + letter-spacing: 0.12em; |
| 201 | + padding-top: 2px; |
| 202 | + } |
| 203 | + .didi-input { |
| 204 | + width: 100%; |
| 205 | + padding: 7px 9px; |
| 206 | + margin-bottom: 8px; |
| 207 | + border: 1px solid var(--color-border-strong, rgba(255, 255, 255, 0.2)); |
| 208 | + border-radius: 5px; |
| 209 | + background: var(--color-bg, #101014); |
| 210 | + color: var(--color-text, #eee); |
| 211 | + font-size: 12px; |
| 212 | + } |
| 213 | + .didi-btn { |
| 214 | + width: 100%; |
| 215 | + padding: 7px 9px; |
| 216 | + border: 1px solid var(--color-border-strong, rgba(255, 255, 255, 0.25)); |
| 217 | + border-radius: 5px; |
| 218 | + background: transparent; |
| 219 | + color: var(--color-text, #eee); |
| 220 | + font-size: 12px; |
| 221 | + cursor: pointer; |
| 222 | + } |
| 223 | + .didi-btn--primary { |
| 224 | + background: var(--color-accent, #4ecf95); |
| 225 | + border-color: var(--color-accent, #4ecf95); |
| 226 | + color: var(--color-bg, #101014); |
| 227 | + font-weight: 600; |
| 228 | + } |
| 229 | + .didi-btn:disabled { |
| 230 | + opacity: 0.6; |
| 231 | + cursor: wait; |
| 232 | + } |
| 233 | + .didi-notice { |
| 234 | + margin: 8px 0 0; |
| 235 | + color: var(--color-accent-warm, #d29a62); |
| 236 | + font-size: 11px; |
| 237 | + } |
| 238 | + .didi-fine { |
| 239 | + margin: 10px 0 0; |
| 240 | + color: var(--color-text-dim, #9a9a9a); |
| 241 | + font-size: 10px; |
| 242 | + } |
| 243 | +</style> |
0 commit comments