setOpen(false)} style={{position:"fixed", inset:0, zIndex:40}}/>
);
};
/* ---------------------------------------------------------------- session ---
A BLOCKING sign-in gate, not a dismissible banner.
Every screen in this build reads Supabase and every policy keys off
auth.uid(), so signed out the whole platform is empty by construction. The
first version of this was a banner above the page, and that was the wrong
shape: it left 69 screens rendering their empty states underneath, each one
looking like a system with no data in it.
So the gate covers the app until there is a session. Three things it
deliberately does NOT do:
* It does not gate /dev/connection. That page is the diagnostics for the
very thing stopping you signing in, and it holds no tenant data. A gate
you cannot get behind to fix the reason it is up is a locked door with
the key inside.
* It does not say "sign in" when Supabase is not configured. Signing in is
impossible then, and the fix is two globals in index.html — a different
problem with a different answer.
* It does not stop at the token. GoTrue will happily authenticate a user
who has no row in `users`, and RLS then returns nothing from every table
— which looks exactly like a working login onto an empty database. The
gate resolves current_app_user() before it lets go.
Additive: new components and their mount, nothing existing changed. */
const SB_GATE_OPEN_PATHS = ["/dev/connection"];
/* WHO MAY OPEN THE PLATFORM — and it is no longer a constant here.
It was `SB_GATE_MAX_LEVEL = 0`: admit Super Admins, refuse everyone else.
That was honest about being a placeholder and wrong for the architecture,
which has a skin admin signing in at their own brand's host:
iwakiri.com the platform console. Super admins.
admin.juegojoker.com JuegoJoker's back office. Its own operators.
juegojoker.com the player site — a different application.
One number cannot express that, because the answer depends on the HOST as
well as the person. And the moment it depends on a comparison between two
values that both arrive in the browser, it stops being a rule: `me.user_level`
and the brand's id are both editable by whoever is being refused.
So the whole decision moved into surface_access() (supabase/034), which reads
the caller from the session and returns a verdict. The host goes up — the
database cannot see a Host header, so someone has to tell it — but saying
the wrong one cannot elevate anybody: claiming the console host still asks
whether YOUR level is 0, and claiming another brand's host still asks whether
YOU belong to it.
This is still a DOOR, not a permission model. Everything behind it is scoped
by row-level security to the caller's own subtree, so admitting more roles
does not widen what any of them can see. The difference is that the door now
consults something the person knocking cannot edit. */
const SB_GATE_SURFACE_LABEL = {
console: "the platform console",
admin: "a brand's back office",
frontend: "the player site",
api: "the frontend API",
};
/* The enrolment QR.
GoTrue renders the code for us and returns it on the enrol response, so there
is no QR encoder in this repo and no library to load — which also means
nothing here has to be right about Reed-Solomon for someone to sign in.
It arrives either as an SVG document or as a data: URI, depending on the
GoTrue version, and both go into an
{LANGS.map(l => (
)}
{ setLang(l); setOpen(false); }}
style={{
padding:"9px 12px", display:"flex", alignItems:"center", gap:10,
cursor:"pointer", fontSize:13,
background: l.code === lang.code ? "var(--p-50)" : "transparent",
color: l.code === lang.code ? "var(--p-700)" : "var(--text-primary)",
fontWeight: l.code === lang.code ? 600 : 500,
}}
onMouseEnter={e=>{ if(l.code!==lang.code) e.currentTarget.style.background="var(--n-25)"; }}
onMouseLeave={e=>{ if(l.code!==lang.code) e.currentTarget.style.background="transparent"; }}>
{l.flag}
{l.label}
{l.code === lang.code && }
))}
No QR image was returned. Paste this into your authenticator app:
{uri || "(no setup URI)"}
{state === "unconfigured" ? "Not connected"
: state === "unlinked" ? "Signed in, but not an operator"
: state === "blocked" ? "This account is blocked"
: state === "door" ? (doorTitle[door && door.reason] || "Not enough access")
: state === "enrol" ? "Set up your second factor"
: state === "enrolling" ? "Scan this, then confirm"
: state === "challenge" ? "Second factor"
: state === "expired" ? "Session expired"
: state === "checking" ? "Checking your account…"
: "Sign in"}
{state === "unconfigured"
? <>This build has no database configured, so there is nothing to sign in to.
: state === "unlinked"
? <>Your login worked. It is just not linked to an operator account.
: state === "blocked"
? <>Signed in as {me.username}, but
users.blocked is set on that account.
: state === "door"
? (door.reason === "unknown_host"
? <>{door.host || "this hostname"} is not a domain of any brand, and is not the platform console either.
: door.reason === "wrong_application"
? <>{door.host} is {surfaceLabel(door.surface)}{door.skin_name ? <> for {door.skin_name} : null}. This build is the back office.
: door.reason === "wrong_brand"
? <>Signed in as {me.username} ({roleName(me.user_level)}), who belongs to a different brand than {door.skin_name || door.host}.
: door.reason === "check_absent"
? <>Signed in as {me.username} ({roleName(me.user_level)}). surface_access() is not in this database, so who may open which address cannot be answered — and this build admits Super Admin only until it can.
: door.reason === "unreachable"
? <>The database could not be asked whether this address admits you, so this build admits Super Admin only until it can.
: <>Signed in as {me.username} ({roleName(me.user_level)}). {surfaceLabel(door.surface)[0].toUpperCase() + surfaceLabel(door.surface).slice(1)}{door.skin_name ? <> for {door.skin_name} : null} does not admit that role.)
: state === "enrol"
? <>Signed in as {me.username}. This account has no second factor yet, and the database will not answer a password-only session.
: state === "enrolling"
? <>Add this to an authenticator app, then type the code it shows. The first correct code is what turns the factor on.
: state === "challenge"
? <>Signed in as {me.username}. Enter the six-digit code from your authenticator app.
: state === "expired"
? <>Your session ran out. Everything below is closed until you sign in again.
: <>Sign in to continue. Row-level security keys off your account, so every screen is closed until you do — nothing is broken.}
Set
)}
{state === "unlinked" && (
window.SUPABASE_URL and window.SUPABASE_ANON_KEY in
index.html. Both are required — with either missing every request fails
before it leaves the browser.
The auth user signed in has no row in
)}
{state === "checking" && users with its
auth_user_id. Every policy resolves the caller through that row, so the
platform would open onto empty tables on every screen — which is why this stops here
rather than letting you in to find out screen by screen.
Fix: run
supabase/002_seed_dev.sql with iwk.email set to
this address, or set auth_user_id on an existing operator.
Resolving your operator account…
}
{state === "door" && (
{door.reason === "unknown_host" ? (
<>
Which brand a hostname belongs to is data, not configuration in this build:
)}
{state === "blocked" && (
resolve_host() strips a surface prefix — admin.,
www., fapi. — and looks the rest up in
skin_domains. Nothing matched, so there is no brand to open.
Fix: add the brand's base domain on the Skins screen —
) : door.reason === "wrong_application" ? (
<>
The same database serves the player site, the frontend API and the back office,
and they are separate deployments. Rendering a back office here would put operator
screens on a player's hostname, which is why this refuses instead.
example.com,
not admin.example.com. The prefixed hosts then resolve to it on
their own.
Operators sign in at
) : door.reason === "wrong_brand" ? (
<>
Your account is senior enough — it belongs to another brand. Row-level security
would have shown you your own subtree with this brand's name on the page, which
is a more confusing thing to see than this message.
admin.{door.base_domain || door.host}.
Sign in at your own brand's address, or ask a Super Admin — they can open any
brand's back office.
) : (door.reason === "check_absent" || door.reason === "unreachable") ? (
<>
Domain routing decides which brand each hostname belongs to and who may open it.
Until surface_access() answers, neither question can be, so this
build falls back to the rule that predates it: Super Admin only. That is the
most restrictive door in the schema, and row-level security underneath is
unchanged — nobody sees a row they could not already see.
Fix: apply
supabase/RUN_ALL.sql, which includes
supabase/034_surface_access.sql. Then reload.
{door.status ? <> The call returned {door.status}. : null}
{door.status === 403
? <> A 403 means the function is there but authenticated has no
EXECUTE on it — re-applying grants it.
: null}
{door.detail}
) : (
<>
Who may open which address is one row per surface in surface_apps,
read by surface_access() — not a constant in this file, and not a
comparison made in your browser. It is a door, not a permission model: everything
behind it is still scoped by row-level security to your own subtree.
)}
A blocked operator is refused at the door rather than let in to find every action
failing one at a time. Another Super Admin can clear it on the Users screen.
)}
{state === "enrol" && (
<>
The real platform runs two-factor middleware on every back-office route. So does this
one, except the check is in the database rather than in front of it: until this
session has answered a second factor,
{/* Say what the button is about to do. A half-finished enrolment is
what GoTrue's "a factor with that name already exists" is about,
and this screen used to report that error with no way to act on
it. It is cleared automatically now — but silently clearing
something is only acceptable if the screen said it would. */}
{staleFactors.length > 0 && (
current_app_user() returns no row
and every table reads as empty. There is no setting that turns it off, and no
screen that works without it.
You will need an authenticator app — Google Authenticator, 1Password, Aegis, Bitwarden
or any other TOTP app. Nothing is sent by SMS.
This account has {staleFactors.length === 1 ? "a half-finished enrolment" : `${staleFactors.length} half-finished enrolments`} —
a QR code that was generated and never confirmed with a code. That is not a second
factor and it is what blocks a new one, so it will be removed when you continue.
{staleFactors.length === 1 && (
)}
{factors && factors.known === false && (
If you already scanned it, you do not need to start again: enter the six-digit
code it is showing and that finishes the enrolment.
)}
The auth server did not return this account’s factor list, so this screen
cannot tell whether an enrolment was already started. Setting up will still work —
the new factor is given a name nothing can already hold.
)}
{/* The one case the old screen could not express: a scanned but
unconfirmed factor. Entering its code finishes the job, and
that is strictly better than throwing the secret away and
making the operator scan a second one. */}
{staleFactors.length === 1 && (
)}
)}
{state === "enrolling" && enrol && (
<>
If you cannot scan it, add the key by hand:
This is the only time it is shown. It is not written to this
machine, and there is no way to display it again — starting over
is the recovery path, not retrieval.
)}
{state === "challenge" && (
)}
{(state === "signedout" || state === "expired") && (
)}
{err && (
{enrol.secret}{diag.verdict || ""}
{(diag.checks || []).map(c => `${c.ok ? "ok " : "FAIL"} ${c.name}${c.detail ? " — " + c.detail : ""}`).join("\n")}
)}
{diag === "running" && Running…}