feat(auth): add generic OIDC login with mandatory groups

frontend/src/shell/AppShell.session-target.test.tsx

@@ -0,0 +1,108 @@
+import { act, render, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { beforeEach, expect, test, vi } from "vitest";
+import { http, HttpResponse } from "msw";
+import { AppShell } from "./AppShell";
+import { server } from "../test/msw";
+import { FakeEventSource } from "../test/fakeEventSource";
+import { clearAuthState, setAuthState } from "../auth/authState";
+import { useSessionStore } from "../store/sessionStore";
+
+function renderShell() {
+  const client = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+  return render(<QueryClientProvider client={client}><AppShell /></QueryClientProvider>);
+}
+
+function deferred() {
+  let resolve!: () => void;
+  const promise = new Promise<void>((onResolve) => { resolve = onResolve; });
+  return { promise, resolve };
+}
+
+beforeEach(() => {
+  clearAuthState();
+  setAuthState({
+    issuer: "local", subject: "user-a", roles: ["user"], permissions: ["session.use"],
+    isAdmin: false, csrfToken: null, session: null,
+  });
+  FakeEventSource.instances = [];
+  (globalThis as { EventSource: typeof EventSource }).EventSource = FakeEventSource as unknown as typeof EventSource;
+  useSessionStore.getState().resetSession();
+  server.use(
+    http.get("/api/me", () => HttpResponse.json({ issuer: "local", subject: "user-a", isAdmin: false })),
+    http.get("/api/settings", () => HttpResponse.json({ workspace: "default", provider: "test", model: "test", thinking: "low" })),
+    http.get("/api/workspaces", () => HttpResponse.json([])),
+    http.get("/api/models", () => HttpResponse.json({ models: [] })),
+    http.post("/api/runtime/prewarm", () => new HttpResponse(null, { status: 202 })),
+  );
+});
+
+test("a held stop for s1 cannot reset the newer active s2 session", async () => {
+  const closeGate = deferred();
+  const closeStarted = deferred();
+  const active = (id: string, question: string) => ({
+    id, status: "open", question, summary: null, created_at: "2026-01-02T00:00:00Z",
+    updated_at: null, author: null, name: null, group: null, archived: false, active: true,
+  });
+  server.use(
+    http.get("/api/sessions", () => HttpResponse.json([active("s1", "Active one"), active("s2", "Active two")])),
+    http.post("/api/sessions/:id/resume", ({ params }) => HttpResponse.json({ id: params.id, alreadyActive: false })),
+    http.get("/api/sessions/:id", ({ params }) => HttpResponse.json({ id: params.id, status: "open", phase: 1 })),
+    http.post("/api/sessions/s1/close", async () => {
+      closeStarted.resolve();
+      await closeGate.promise;
+      return new HttpResponse(null, { status: 204 });
+    }),
+  );
+  renderShell();
+  await userEvent.click(await screen.findByTestId("session-item-s1"));
+  await waitFor(() => expect(FakeEventSource.instances.at(-1)?.url).toContain("/sessions/s1/events"));
+  await userEvent.click(screen.getByRole("button", { name: /stop and save session/i }));
+  await userEvent.click(await screen.findByRole("button", { name: "Stop & save" }));
+  await closeStarted.promise;
+
+  await userEvent.click(screen.getByTestId("session-item-s2"));
+  await waitFor(() => expect(FakeEventSource.instances.at(-1)?.url).toContain("/sessions/s2/events"));
+  act(() => useSessionStore.setState({ currentPhase: "F2" }));
+  closeGate.resolve();
+  await new Promise((resolve) => setImmediate(resolve));
+
+  expect(FakeEventSource.instances.at(-1)?.url).toContain("/sessions/s2/events");
+  expect(FakeEventSource.instances.at(-1)?.closed).toBe(false);
+  expect(useSessionStore.getState().currentPhase).toBe("F2");
+});
+
+test("a held new-session completion cannot replace the newer active s2 target", async () => {
+  const createGate = deferred();
+  const createStarted = deferred();
+  server.use(
+    http.get("/api/sessions", () => HttpResponse.json([{
+      id: "s2", status: "open", question: "Current session", summary: null,
+      created_at: "2026-01-02T00:00:00Z", updated_at: null, author: null, name: null,
+      group: null, archived: false, active: true,
+    }])),
+    http.post("/api/sessions", async () => {
+      createStarted.resolve();
+      await createGate.promise;
+      return HttpResponse.json({ id: "s3" });
+    }),
+    http.post("/api/sessions/:id/resume", ({ params }) => HttpResponse.json({ id: params.id, alreadyActive: false })),
+    http.get("/api/sessions/:id", ({ params }) => HttpResponse.json({ id: params.id, status: "open", phase: 1 })),
+  );
+  renderShell();
+  const composer = screen.getByRole("textbox", { name: /new question/i });
+  await userEvent.type(composer, "Held new question");
+  await userEvent.click(screen.getByRole("button", { name: /send/i }));
+  await createStarted.promise;
+
+  await userEvent.click(screen.getByTestId("session-item-s2"));
+  await waitFor(() => expect(FakeEventSource.instances.at(-1)?.url).toContain("/sessions/s2/events"));
+  act(() => useSessionStore.setState({ currentPhase: "F2" }));
+  createGate.resolve();
+  await new Promise((resolve) => setImmediate(resolve));
+
+  expect(FakeEventSource.instances.at(-1)?.url).toContain("/sessions/s2/events");
+  expect(FakeEventSource.instances.at(-1)?.closed).toBe(false);
+  expect(useSessionStore.getState().currentPhase).toBe("F2");
+});

frontend/src/shell/AppShell.tsx

@@ -80,6 +80,8 @@ export function AppShell() {
   } as CSSProperties;
   const [activeSessionId, setActiveSessionId] = useState<string | null>(null);
   const activeSessionIdRef = useRef<string | null>(null);
+  const activeSessionEpochRef = useRef(0);
+  const newSessionOperationRef = useRef<{ target: string | null; epoch: number } | null>(null);
   const resumeInvocationRef = useRef(0);
   const latestResumeIntentRef = useRef<{ token: number; id: string } | null>(null);
   const resumeInFlightRef = useRef(new Map<string, {
@@ -165,6 +167,7 @@ export function AppShell() {
 
   function selectActiveSession(id: string | null) {
     // Keep async Resume completions synchronized before React commits the state update.
+    if (activeSessionIdRef.current !== id) activeSessionEpochRef.current += 1;
     activeSessionIdRef.current = id;
     setActiveSessionId(id);
   }
@@ -505,6 +508,7 @@ export function AppShell() {
 
   function startNewSession() {
     invalidateResumeIntent();
+    newSessionOperationRef.current = null;
     resetSession();
     // Starting a new question closes any open session detail panel: the reader is
     // moving away from that session, so its left-hand box must not linger.
@@ -519,11 +523,18 @@ export function AppShell() {
   }
 
   function beginSessionCreation() {
+    newSessionOperationRef.current = {
+      target: activeSessionIdRef.current,
+      epoch: activeSessionEpochRef.current,
+    };
     setAwaitingQuestion(false);
     setCreatingSession(true);
   }
 
   function finishSessionCreation(id: string) {
+    const operation = newSessionOperationRef.current;
+    newSessionOperationRef.current = null;
+    if (!operation || operation.target !== activeSessionIdRef.current || operation.epoch !== activeSessionEpochRef.current) return;
     // React batches these updates, preserving the provisional session view
     // while useSessionStream opens the durable session's SSE channel.
     selectActiveSession(id);
@@ -533,21 +544,25 @@ export function AppShell() {
   }
 
   function failSessionCreation(message?: string) {
+    const operation = newSessionOperationRef.current;
+    newSessionOperationRef.current = null;
+    if (!operation || operation.target !== activeSessionIdRef.current || operation.epoch !== activeSessionEpochRef.current) return;
     setCreatingSession(false);
     resetSession();
     toast.error(message ?? "Failed to create session. Your question is ready to retry.");
   }
 
   async function stopSession() {
-    if (!activeSessionId) return;
-    const id = activeSessionId;
+    const id = activeSessionIdRef.current;
+    if (!id) return;
     const guard = captureAuthOperation({ sessionId: id, disposalEpoch: operationEpochRef.current });
     if (!guard) return;
     invalidateResumeIntent();
     try {
       await closeSession(id);
     } finally {
-      if (!isAuthOperationCurrent(guard, { sessionId: id, disposalEpoch: operationEpochRef.current })) return;
+      if (!isAuthOperationCurrent(guard, { sessionId: id, disposalEpoch: operationEpochRef.current })
+        || activeSessionIdRef.current !== id) return;
       resetSession();
       selectActiveSession(null);
       setAwaitingQuestion(false);
@@ -643,7 +658,7 @@ export function AppShell() {
                   </header>
                 )}
                 <CentralStatus working={working} />
-                {activeSessionId && <WidgetHost sessionId={activeSessionId} />}
+                {activeSessionId && <WidgetHost key={`widget:${activeSessionId}:${activeSessionEpochRef.current}`} sessionId={activeSessionId} />}
                 {finalized && !agentActive && (
                   <div className="rounded-2xl border border-border/80 bg-card p-5 text-center shadow-md">
                     <p className="text-sm text-muted-foreground">
@@ -668,6 +683,7 @@ export function AppShell() {
             <div className="rounded-2xl border border-border/80 bg-card shadow-md transition-colors focus-within:border-primary/50 focus-within:ring-3 focus-within:ring-ring/15">
               <div className="px-2.5 py-2">
                 <SteerInput
+                  key={`steer:${activeSessionId ?? "new"}:${activeSessionEpochRef.current}`}
                   sessionId={activeSessionId}
                   onSessionCreating={beginSessionCreation}
                   onSessionCreated={finishSessionCreation}

frontend/src/shell/SteerInput.test.tsx

@@ -113,6 +113,38 @@ test("a delayed steer from user A cannot mutate user B's store or composer", asy
   view.unmount();
 });
 
+test("a held steer for s1 cannot complete into the active s2 operation scope", async () => {
+  let release!: () => void;
+  let started!: () => void;
+  let settled!: () => void;
+  const held = new Promise<void>((resolve) => { release = resolve; });
+  const requestStarted = new Promise<void>((resolve) => { started = resolve; });
+  const requestSettled = new Promise<void>((resolve) => { settled = resolve; });
+  server.use(http.post("/api/sessions/s1/steer", async () => {
+    started();
+    try {
+      await held;
+      return new HttpResponse(null, { status: 204 });
+    } finally {
+      settled();
+    }
+  }));
+
+  const view = render(<SteerInput sessionId="s1" />);
+  const input = screen.getByRole("textbox");
+  await userEvent.type(input, "Keep s1 isolated");
+  await userEvent.click(screen.getByRole("button", { name: /invia|send|steer/i }));
+  await requestStarted;
+
+  view.rerender(<SteerInput sessionId="s2" />);
+  act(() => useSessionStore.getState().setLastUserEntry({ kind: "input", text: "s2 owned" }));
+  release();
+  await act(async () => { await requestSettled; });
+
+  expect(useSessionStore.getState().lastUserEntry).toEqual({ kind: "input", text: "s2 owned" });
+  expect(input).toHaveValue("Keep s1 isolated");
+});
+
 test("a settings preflight from user A prevents session POST after user B logs in", async () => {
   let releaseSettings!: () => void;
   let settingsStarted!: () => void;

frontend/src/shell/SteerInput.tsx

@@ -51,6 +51,12 @@ export function SteerInput({
   const taRef = useRef<HTMLTextAreaElement | null>(null);
   const operationEpochRef = useRef(0);
   useEffect(() => () => { operationEpochRef.current += 1; }, []);
+  useEffect(() => {
+    // A new active session owns a new composer operation scope. Invalidate any held request
+    // before it can write the old session's completion into the new target.
+    operationEpochRef.current += 1;
+    setBusy(false);
+  }, [sessionId]);
 
   // Merge our own ref (for autosizing) with the forwarded one (parent focus).
   function attachRef(el: HTMLTextAreaElement | null) {

frontend/src/shell/WidgetHost.response.test.tsx

@@ -92,3 +92,37 @@ test("a delayed gate response from user A cannot clear user B's pending gate", a
   expect(useSessionStore.getState().pendingWidget?.id).toBe("gate-b");
   expect(useSessionStore.getState().lastUserEntry).toBeNull();
 });
+
+test("a held s1 gate response cannot clear the pending s2 gate", async () => {
+  let release!: () => void;
+  let started!: () => void;
+  let settled!: () => void;
+  const held = new Promise<void>((resolve) => { release = resolve; });
+  const requestStarted = new Promise<void>((resolve) => { started = resolve; });
+  const requestSettled = new Promise<void>((resolve) => { settled = resolve; });
+  server.use(http.post("/api/sessions/s1/response", async () => {
+    started();
+    try {
+      await held;
+      return new HttpResponse(null, { status: 204 });
+    } finally {
+      settled();
+    }
+  }));
+  useSessionStore.setState({
+    pendingWidget: { id: "gate-s1", widget: "select", options: [{ id: "s1", label: "Answer s1" }] },
+  });
+  const view = render(<WidgetHost sessionId="s1" />);
+  await userEvent.click(screen.getByRole("button", { name: "Answer s1" }));
+  await requestStarted;
+
+  view.rerender(<WidgetHost sessionId="s2" />);
+  act(() => useSessionStore.setState({
+    pendingWidget: { id: "gate-s2", widget: "select", options: [{ id: "s2", label: "Answer s2" }] },
+  }));
+  release();
+  await act(async () => { await requestSettled; });
+
+  expect(useSessionStore.getState().pendingWidget?.id).toBe("gate-s2");
+  expect(useSessionStore.getState().lastUserEntry).toBeNull();
+});

frontend/src/shell/WidgetHost.tsx

@@ -15,6 +15,12 @@ export function WidgetHost({ sessionId }: { sessionId: string | null }) {
   const responseInFlight = useRef(false);
   const operationEpochRef = useRef(0);
   useEffect(() => () => { operationEpochRef.current += 1; }, []);
+  useEffect(() => {
+    // A gate belongs to its active session target, not merely the authenticated user.
+    operationEpochRef.current += 1;
+    responseInFlight.current = false;
+    setResponding(false);
+  }, [sessionId]);
   if (!pending) return null;
   const Renderer = resolve(pending.widget);
   const onRespond = async (r: UiResponse) => {