Move hosted Subrouter onboarding to Stack Auth

web/app/[locale]/dashboard/dashboard-shell.tsx

@@ -34,11 +34,6 @@ export function DashboardShell({ children }: { children: React.ReactNode }) {
           label: t("vaultSessions"),
           active: pathname.startsWith("/dashboard/vault/sessions"),
         },
-        {
-          href: "/dashboard/vault/cli-auth",
-          label: t("vaultCliSetup"),
-          active: pathname.startsWith("/dashboard/vault/cli-auth"),
-        },
       ],
     },
     {

web/app/[locale]/dashboard/layout.tsx

@@ -8,9 +8,8 @@ import { DashboardShell } from "./dashboard-shell";
 
 // Auth redirects are owned by each page, not this layout: a layout cannot see
 // the requested URL, so redirecting here would send unauthenticated visitors
-// to a fixed return path and drop page-specific query params (e.g. the
-// ?code=... on /dashboard/vault/cli-auth). Every page under /dashboard must
-// check getUser() itself and build its own sign-in return path.
+// to a fixed return path and drop page-specific query params. Every page under
+// /dashboard must check getUser() itself and build its own sign-in return path.
 export default async function DashboardLayout({
   children,
 }: {

web/app/[locale]/dashboard/subrouter/page.tsx

@@ -3,20 +3,17 @@ import { headers } from "next/headers";
 import { redirect } from "next/navigation";
 import { buildAlternates, openGraphDefaults, seoDescription, twitterSummary } from "@/i18n/seo";
 import { Link } from "@/i18n/navigation";
-import { cloudDb } from "@/db/client";
-import { isStackConfigured } from "@/app/lib/stack";
+import { getStackServerApp, isStackConfigured } from "@/app/lib/stack";
 import { localizedVaultPath, vaultSignInHref } from "@/app/lib/vault-auth";
-import {
-  createSubrouterClient,
-  subrouterRuntimeConfig,
-  type SubrouterAccount,
-} from "@/services/subrouter/client";
-import { getTenantForTeam } from "@/services/subrouter/tenants";
+import type { SubrouterAccount } from "@/services/subrouter/types";
+import { hostedSubrouterCutoverReadyForTeam } from "@/services/subrouter/cutover";
+import { createHostedSubrouterClient } from "@/services/subrouter/hostedClient";
 import {
   authorizedSubrouterTeams,
 } from "@/services/subrouter/routeHelpers";
 import {
   isSubrouterAuthorizationError,
+  SubrouterAuthorizationUnavailableError,
   verifySubrouterRequest,
   withSubrouterAuthorizationDeadline,
 } from "@/services/vms/auth";
@@ -35,11 +32,13 @@ type PageProps = {
 type DashboardTeam = {
   readonly id: string;
   readonly name: string;
+  readonly use: boolean;
   readonly manageAccounts: boolean;
 };
 
 type AccountState =
   | { readonly kind: "ok"; readonly accounts: readonly SubrouterAccount[] }
+  | { readonly kind: "migrationPending" }
   | { readonly kind: "notConfigured" }
   | { readonly kind: "error" };
 
@@ -71,9 +70,15 @@ export default async function SubrouterOverviewPage({ params, searchParams }: Pa
     redirect("/");
   }
   const requestHeaders = await headers();
-  let authorized: Awaited<ReturnType<typeof authorizedSubrouterTeams>> | null;
+  const tokenStore = {
+    headers: { get: (name: string) => requestHeaders.get(name) },
+  };
+  let authenticated: {
+    readonly authorized: Awaited<ReturnType<typeof authorizedSubrouterTeams>>;
+    readonly accessToken: string | null;
+  } | null;
   try {
-    authorized = await withSubrouterAuthorizationDeadline(
+    authenticated = await withSubrouterAuthorizationDeadline(
       async (signal) => {
         const user = await verifySubrouterRequest(
           new Request("https://cmux.com/dashboard/subrouter", {
@@ -82,7 +87,20 @@ export default async function SubrouterOverviewPage({ params, searchParams }: Pa
           signal,
           { allowCookie: true, listAllTeams: true },
         );
-        return user ? authorizedSubrouterTeams(user) : null;
+        if (!user) return null;
+        const authorized = await authorizedSubrouterTeams(user);
+        let authJson: Awaited<ReturnType<ReturnType<typeof getStackServerApp>["getAuthJson"]>>;
+        try {
+          authJson = await getStackServerApp().getAuthJson({ tokenStore });
+        } catch {
+          throw new SubrouterAuthorizationUnavailableError(
+            "Stack session refresh unavailable",
+          );
+        }
+        return {
+          authorized,
+          accessToken: authJson?.accessToken ?? null,
+        };
       },
     );
   } catch (error) {
@@ -101,26 +119,30 @@ export default async function SubrouterOverviewPage({ params, searchParams }: Pa
       </div>
     );
   }
-  if (!authorized) {
+  if (!authenticated) {
+    redirect(vaultSignInHref(localizedVaultPath(locale, "/dashboard/subrouter")));
+  }
+  if (!authenticated.accessToken) {
     redirect(vaultSignInHref(localizedVaultPath(locale, "/dashboard/subrouter")));
   }
 
   const [tPage, t] = await Promise.all([
     getTranslations({ locale, namespace: "dashboard.subrouter" }),
     getTranslations({ locale, namespace: "dashboard.aiAccounts" }),
   ]);
-  const teams = authorized
+  const teams = authenticated.authorized
     .filter((candidate) => candidate.use || candidate.manageAccounts)
     .map((candidate) => ({
       id: candidate.teamId,
       name: candidate.teamName,
+      use: candidate.use,
       manageAccounts: candidate.manageAccounts,
     }));
   if (teams.length === 0) {
     redirect("/dashboard");
   }
   const selectedTeam = selectTeam(teams, team);
-  const accountState = await loadAccounts(selectedTeam);
+  const accountState = await loadAccounts(selectedTeam, authenticated.accessToken);
   const dateFormatter = new Intl.DateTimeFormat(locale, {
     dateStyle: "medium",
     timeStyle: "short",
@@ -155,6 +177,8 @@ export default async function SubrouterOverviewPage({ params, searchParams }: Pa
 
       {accountState.kind === "notConfigured" ? (
         <StatusPanel title={t("notConfiguredTitle")} body={t("notConfiguredBody")} />
+      ) : accountState.kind === "migrationPending" ? (
+        <StatusPanel title={t("migrationPendingTitle")} body={t("migrationPendingBody")} />
       ) : accountState.kind === "error" ? (
         <StatusPanel title={t("loadErrorTitle")} body={t("loadErrorBody")} />
       ) : (
@@ -262,19 +286,24 @@ function selectTeam(teams: readonly DashboardTeam[], requestedTeamId: string | u
   return teams[0];
 }
 
-async function loadAccounts(team: DashboardTeam): Promise<AccountState> {
-  const config = subrouterRuntimeConfig();
-  if (!config) return { kind: "notConfigured" };
-
+async function loadAccounts(
+  team: DashboardTeam,
+  accessToken: string,
+): Promise<AccountState> {
   try {
-    const client = createSubrouterClient({
-      baseUrl: config.baseUrl,
-      adminToken: config.adminToken,
-    });
-    const tenant = await getTenantForTeam(cloudDb(), team.id, {
-      tenantKeySecret: config.tenantKeySecret,
+    if (!await hostedSubrouterCutoverReadyForTeam(team.id)) {
+      return { kind: "migrationPending" };
+    }
+    const client = createHostedSubrouterClient();
+    if (!client.tenantControlConfigured) {
+      return { kind: "notConfigured" };
+    }
+    const tenant = await client.exchangeTeam(accessToken, {
+      teamId: team.id,
+      teamName: team.name,
+      use: team.use,
+      manageAccounts: team.manageAccounts,
     });
-    if (!tenant) return { kind: "ok", accounts: [] };
     const accounts = await client.listAccounts(tenant.tenantKey);
     return { kind: "ok", accounts };
   } catch {