Repository navigation
feat(apollo-vertex): let the shell run on an app-provided session - #1462
Draft
ruudandriessen wants to merge 2 commits into
Draft
ruudandriessen wants to merge 2 commits into
ruudandriessen wants to merge 2 commits into
Conversation
ApolloShell decided whether to render the app from useAuth().accessToken, so an app that authenticates without a browser token (a platform session cookie, for example) could only reuse the shell by passing a fake token. That value would then reach anything that reads accessToken as a bearer. - The gate now reads isAuthenticated. ShellAuthProvider derives it from the token, so its behaviour is unchanged. - New unauthenticatedElement prop replaces the sign-in screen, e.g. with an element that redirects to the platform login. - Document providing AuthContext directly instead of ShellAuthProvider. - vitest resolves tsconfig paths so component tests can render the shell.
A landing item such as /acme prefixes every section under it, so the sidebar highlighted it together with /acme/projects. The sidebar now keeps only the item that owns the most specific match among item and child paths, as the minimal header already does.
Contributor
Dependency License Review
License distribution
Excluded packages
|
There was a problem hiding this comment.
🟡 Changes recommended
Sub-items in an unselected navigation group can remain highlighted alongside the selected standalone item.
1 open issue
What changed in this PR
Enables ApolloShell to use app-provided authentication, including cookie-based sessions without browser access tokens, and refines sidebar navigation highlighting.
Changes:
- Gate access on
isAuthenticatedand allow a custom signed-out element. - Select the most specific navigation owner for sidebar highlighting.
- Document external authentication and add regression tests with TypeScript path resolution.
| File | Description |
|---|---|
packages/apollo-vertex/vitest.config.ts |
Enable TypeScript path mappings in tests. |
packages/apollo-vertex/registry/shell/shell.tsx |
Support tokenless sessions and custom signed-out content. |
packages/apollo-vertex/registry/shell/shell.test.tsx |
Add authentication gate tests. |
packages/apollo-vertex/registry/shell/shell-sidebar.tsx |
Restrict parent highlighting to the selected navigation owner. |
packages/apollo-vertex/registry/shell/shell-nav-active.ts |
Add most-specific navigation owner selection. |
packages/apollo-vertex/registry/shell/shell-nav-active.test.tsx |
Cover navigation ownership and overlapping paths. |
packages/apollo-vertex/registry/shell/shell-auth-provider.tsx |
Document app-provided authentication context. |
apps/apollo-vertex/content/docs/patterns/shell.mdx |
Explain external authentication and navigation highlighting. |
Review effort: Balanced
Comment on lines
+225
to
+227
| const row = isActiveItem | ||
| ? itemState | ||
| : { ...itemState, prefixActive: false, current: false }; |
Contributor
📊 Coverage + size by packagePer-package coverage and bundle size on this PR. New-line coverage = of the source lines this PR adds or changes, the % hit by tests.
"Coverage" is each package's own |
Contributor
Storybook visual diff✅ No stories are affected by this PR's changes; nothing to compare. Logs Updated (PT): Oct 23, 2026, 06:27:55 AM |
ruudandriessen
added
the
dev-packages
Contributor
📦 Dev Packages
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Apps that already authenticate outside the browser can't reuse
ApolloShellas it is. Peak-hosted apps are one example: a platform.peak.aiHttpOnly session cookie carries their auth, and no token ever reaches the browser. They keep a fork of the shell for three reasons:useAuth().accessToken, notisAuthenticated. With cookie auth there is no token, so the only way through is a fake one. That fake value then reaches anything that readsaccessTokenas a bearer token, such as the data-fabric and insights adapters and the AI-chat tools./is matched exactly. In a workspace-scoped app the/<workspace>home link stays highlighted on every section page. The minimal header already avoids this by highlighting only the most specific match.What
isAuthenticated.ShellAuthProvidersets it toaccessToken != null, so apps using the built-in OAuth flow behave exactly as before.unauthenticatedElementprop onApolloShell. It renders instead ofShellLoginwhile the user is signed out, for example an element that redirects to the platform login. When it is not set, the default sign-in screen is unchanged.AuthContextitself instead of mountingShellAuthProvider, withaccessToken: null.activeNavItemPathpicks the item that owns the most specific match among item paths and sub-item paths. Only that item gets the current or prefix-active styling. A group whose sub-item sits outside the group's own path still owns that sub-item, the case fixed in c869233.vitest.config.tsusesresolve.tsconfigPathsinstead of a single@alias. Component tests can then resolve the@/components/ui/*imports the shell uses.There is no breaking change. Without
unauthenticatedElementthe shell renders what it rendered before. Sidebar highlighting changes only when one nav item's path is a prefix of another's.Verification
All of these pass locally:
typecheck,lint(0 warnings, 0 errors),format:checkandknip;shell.test.tsxandactiveNavItemPathcases;buildwithcheck-dist,registry:build, and the full docs-appbuild.lint:depsreports only the existingno-circularwarnings.Two of the new gate tests fail against the old
shell.tsx: renderingunauthenticatedElement, and rendering the app for a session that has no access token. The other two pass on both versions.I haven't tested this in a consuming app yet. The first one will be the Peak vertex apps template.