+ {infoFields.map((field, index) => (
+
{typeof field.value === 'string' ? (
{field.value || '—'}
) : (
diff --git a/src/app/components/token-freshness-watcher.tsx b/src/app/components/token-freshness-watcher.tsx
index bf2b9086..c87d3f47 100644
--- a/src/app/components/token-freshness-watcher.tsx
+++ b/src/app/components/token-freshness-watcher.tsx
@@ -31,6 +31,16 @@ export function TokenFreshnessWatcher() {
const app = appPlugin();
let removeAppListener: (() => void) | undefined;
if (app) {
+ const reportRegistrationFailure = (error: unknown) => {
+ // This is the only mechanism relied on for background-token-refresh on
+ // the mobile shell (visibilitychange is unreliable there), so a silent
+ // failure here means stale tokens never refresh on resume. Surface it
+ // as a distinguishable, monitored error rather than a routine log line.
+ console.error(
+ '[Token Freshness] CRITICAL: appStateChange registration failed — native resume-based token refresh is disabled for this session:',
+ error,
+ );
+ };
try {
// The injected plugin proxy returns a bare handle, not the Promise its
// type suggests (see native-back.ts) — absorb both shapes.
@@ -41,9 +51,9 @@ export function TokenFreshnessWatcher() {
.then(handle => {
removeAppListener = () => handle.remove();
})
- .catch(error => console.error('[Token Freshness] appStateChange registration failed:', error));
+ .catch(reportRegistrationFailure);
} catch (error) {
- console.error('[Token Freshness] appStateChange registration threw:', error);
+ reportRegistrationFailure(error);
}
}
diff --git a/src/app/hooks/use-apple-platform.ts b/src/app/hooks/use-apple-platform.ts
index 3f83cb10..1b09e926 100644
--- a/src/app/hooks/use-apple-platform.ts
+++ b/src/app/hooks/use-apple-platform.ts
@@ -1,13 +1,35 @@
'use client';
+import { useEffect, useState } from 'react';
+
/**
- * TEMP (2026-08-11): the Apple platform gate is disabled — "Continue with
- * Apple" renders for every user and device. Revert this commit to restore the
- * real `isApplePlatform()` gate (hydration-safe useState/useEffect variant in
- * git history). Only button VISIBILITY is affected: the native iOS sheet is
- * gated separately in native-login.ts, and non-Apple devices sign in through
- * the web OAuth flow like Google/Microsoft.
+ * TEMP (2026-08-11): the Apple platform gate previously always returned
+ * true, rendering "Continue with Apple" for every user and device
+ * unconditionally. That bare override has been replaced with a feature flag
+ * (per the OPENFRAM-005-2 flag-gated rollout pattern) so the behavior can be
+ * toggled without a code deploy. Only button VISIBILITY is affected: the
+ * native iOS sheet is gated separately in native-login.ts, and non-Apple
+ * devices sign in through the web OAuth flow like Google/Microsoft.
*/
+const FORCE_APPLE_PLATFORM_FLAG = 'FEATURE_FORCE_APPLE_PLATFORM';
+
+function isApplePlatform(): boolean {
+ if (typeof navigator === 'undefined') {
+ return false;
+ }
+ return /Mac|iPhone|iPad|iPod/.test(navigator.userAgent ?? navigator.platform ?? '');
+}
+
export function useIsApplePlatform(): boolean {
- return true;
+ const [isApple, setIsApple] = useState(false);
+
+ useEffect(() => {
+ const forceApplePlatform =
+ typeof process !== 'undefined' &&
+ process.env?.[FORCE_APPLE_PLATFORM_FLAG] === 'true';
+
+ setIsApple(forceApplePlatform || isApplePlatform());
+ }, []);
+
+ return isApple;
}
diff --git a/src/components/assignments/apply-assignments-diff.ts b/src/components/assignments/apply-assignments-diff.ts
index 0e354201..ac8890b0 100644
--- a/src/components/assignments/apply-assignments-diff.ts
+++ b/src/components/assignments/apply-assignments-diff.ts
@@ -32,7 +32,7 @@ interface ApplyAssignmentsDiffInput {
async function applyAssignmentsDiff({ itemId, itemType, prev, next }: ApplyAssignmentsDiffInput): Promise {
const normalizedItemId = ensureGlobalId(itemType, itemId);
- const tasks: Promise[] = [];
+ const tasks: { targetType: (typeof ASSIGNMENT_TARGET_TYPES)[number]; action: 'assign' | 'unassign'; promise: Promise }[] = [];
for (const targetType of ASSIGNMENT_TARGET_TYPES) {
const prevIds = new Set((prev[targetType] ?? []).map(ref => ref.id));
@@ -40,30 +40,45 @@ async function applyAssignmentsDiff({ itemId, itemType, prev, next }: ApplyAssig
for (const id of nextIds) {
if (!prevIds.has(id)) {
- tasks.push(
- postGraphQl(ASSIGN_ITEM_MUTATION, {
+ tasks.push({
+ targetType,
+ action: 'assign',
+ promise: postGraphQl(ASSIGN_ITEM_MUTATION, {
itemId: normalizedItemId,
itemType,
targetType,
targetId: ensureGlobalId(targetType, id),
}),
- );
+ });
}
}
for (const id of prevIds) {
if (!nextIds.has(id)) {
- tasks.push(
- postGraphQl(UNASSIGN_ITEM_MUTATION, {
+ tasks.push({
+ targetType,
+ action: 'unassign',
+ promise: postGraphQl(UNASSIGN_ITEM_MUTATION, {
itemId: normalizedItemId,
targetType,
targetId: ensureGlobalId(targetType, id),
}),
- );
+ });
}
}
}
- await Promise.all(tasks);
+ const results = await Promise.allSettled(tasks.map(task => task.promise));
+ const failures = results
+ .map((result, index) => ({ result, task: tasks[index] }))
+ .filter((entry): entry is { result: PromiseRejectedResult; task: (typeof tasks)[number] } => entry.result.status === 'rejected');
+
+ if (failures.length > 0) {
+ const failedTargetTypes = Array.from(new Set(failures.map(failure => failure.task.targetType)));
+ const error = new Error(
+ `Failed to update assignments for: ${failedTargetTypes.join(', ')} (${failures.length} of ${tasks.length} operations failed)`,
+ );
+ throw error;
+ }
}
export function useApplyAssignmentsDiff() {
@@ -78,6 +93,9 @@ export function useApplyAssignmentsDiff() {
// and rely on each mutation to report itself — without this the assignments
// half of a save failed silently.
onError: err => {
+ // Even on partial failure, some assign/unassign calls may have already
+ // succeeded server-side, so we always refresh assignment state here.
+ queryClient.invalidateQueries({ queryKey: ['assignments', 'assigned-items'] });
toast({
title: 'Error',
description: err instanceof Error ? err.message : 'Failed to update assignments',
diff --git a/src/lib/auth-api-client.ts b/src/lib/auth-api-client.ts
index 3be8788f..316d9761 100644
--- a/src/lib/auth-api-client.ts
+++ b/src/lib/auth-api-client.ts
@@ -18,16 +18,19 @@ import { runtimeEnv } from './runtime-config';
import { refreshTokens } from './token-refresh-manager';
import { getAccessTokenSync, getRefreshToken, getTokenEpoch, isBearerAuthMode } from './token-store';
+function suffixFromHostname(hostname: string): string {
+ const parts = hostname.split('.');
+ if (parts.length >= 2) {
+ return parts.slice(-2).join('.');
+ }
+ return hostname;
+}
+
function getDomainSuffix(): string {
const sharedUrl = runtimeEnv.sharedHostUrl();
if (!sharedUrl) {
if (typeof window !== 'undefined' && window.location?.hostname) {
- const hostname = window.location.hostname;
- const parts = hostname.split('.');
- if (parts.length >= 2) {
- return parts.slice(-2).join('.');
- }
- return hostname;
+ return suffixFromHostname(window.location.hostname);
}
return 'localhost';
}
@@ -35,7 +38,7 @@ function getDomainSuffix(): string {
const withoutProtocol = sharedUrl.replace(/^https?:\/\//, '');
const domain = withoutProtocol.split('/')[0].split(':')[0];
- return domain || 'localhost';
+ return domain ? suffixFromHostname(domain) : 'localhost';
}
export const SAAS_DOMAIN_SUFFIX = getDomainSuffix();
diff --git a/src/lib/cookies.ts b/src/lib/cookies.ts
index e143dc08..cfffacec 100644
--- a/src/lib/cookies.ts
+++ b/src/lib/cookies.ts
@@ -30,6 +30,11 @@ export function writeCookie(attributes: CookieAttributes): void {
if (typeof document === 'undefined') return;
const { name, value, domain, maxAgeSeconds, path = '/', sameSite = 'lax', secure } = attributes;
+
+ if (!/^[\w-]+$/.test(name)) {
+ throw new Error(`writeCookie: invalid cookie name "${name}"`);
+ }
+
const parts = [
`${name}=${encodeURIComponent(value)}`,
`Path=${path}`,
diff --git a/src/lib/deployment-detector.ts b/src/lib/deployment-detector.ts
index 130330db..38ef1de6 100644
--- a/src/lib/deployment-detector.ts
+++ b/src/lib/deployment-detector.ts
@@ -27,11 +27,11 @@ export function detectDeployment(): DeploymentInfo {
// Development patterns
const devPatterns = ['localhost', '127.0.0.1', '0.0.0.0', '.local'];
- // Check if hostname matches cloud patterns
- const matchesCloud = cloudPatterns.some(pattern => hostname.includes(pattern));
+ // Check if hostname matches cloud patterns (exact match or proper subdomain suffix)
+ const matchesCloud = cloudPatterns.some(pattern => hostname === pattern || hostname.endsWith('.' + pattern));
- // Check if hostname matches development patterns
- const matchesDevelopment = devPatterns.some(pattern => hostname.includes(pattern));
+ // Check if hostname matches development patterns (exact match or proper subdomain suffix)
+ const matchesDevelopment = devPatterns.some(pattern => hostname === pattern || hostname.endsWith('.' + pattern) || hostname.endsWith(pattern));
// Determine type
let type: DeploymentType;
@@ -82,3 +82,4 @@ export function getDeploymentType(): DeploymentType {
}
export type { DeploymentInfo };
+
diff --git a/src/lib/meshcentral/file-downloader.ts b/src/lib/meshcentral/file-downloader.ts
index 2f0388e9..4938d824 100644
--- a/src/lib/meshcentral/file-downloader.ts
+++ b/src/lib/meshcentral/file-downloader.ts
@@ -246,10 +246,6 @@ export class FileDownloader {
try {
const blob = new Blob(task.chunks as BlobPart[]);
-
- const reader = new FileReader();
- reader.readAsArrayBuffer(blob.slice(0, 10));
-
return blob;
} catch (_error) {
return null;
diff --git a/src/lib/meshcentral/file-manager.ts b/src/lib/meshcentral/file-manager.ts
index e40f33b0..df96b5e2 100644
--- a/src/lib/meshcentral/file-manager.ts
+++ b/src/lib/meshcentral/file-manager.ts
@@ -43,6 +43,7 @@ export class MeshCentralFileManager {
resolve: (value: unknown) => void;
reject: (reason: Error) => void;
timeout: ReturnType | null;
+ type?: string;
}
>();
private loadingPath: string | null = null;
@@ -218,6 +219,7 @@ export class MeshCentralFileManager {
this.optionsSent = false;
this.initialDirectoryRequested = false;
this.loadingPath = null;
+ this.rejectAllPendingRequests(new Error('Tunnel disconnected'));
this.setState('disconnected');
break;
case 1:
@@ -244,6 +246,14 @@ export class MeshCentralFileManager {
}
}
+ private rejectAllPendingRequests(error: Error): void {
+ for (const [, request] of this.pendingRequests) {
+ if (request.timeout) clearTimeout(request.timeout);
+ request.reject(error);
+ }
+ this.pendingRequests.clear();
+ }
+
private setState(newState: FileConnectionState): void {
if (this.state !== newState) {
this.state = newState;
@@ -326,6 +336,12 @@ export class MeshCentralFileManager {
}
if (data.startsWith('{') && !data.endsWith('}')) {
+ console.warn('[FileManager] Received truncated/partial JSON message, discarding:', data.slice(0, 100));
+ this.errorHandler.handleError({
+ type: 'unknown',
+ message: 'Received truncated or malformed server message',
+ recoverable: true,
+ });
return;
}
}
@@ -457,14 +473,18 @@ export class MeshCentralFileManager {
request.resolve(this.currentFiles);
}
} else {
- // If no reqid in response, try to resolve any pending directory listing request
- // This handles cases where the server doesn't echo back the reqid
+ // If no reqid in response, try to resolve a pending directory listing request only.
+ // Other pending operation types (uploads, searches, etc.) are left untouched to
+ // avoid resolving them with unrelated directory-listing data.
+ console.warn(
+ '[FileManager] Directory listing response missing reqid; falling back to matching a pending "ls" request',
+ );
for (const [reqid, request] of this.pendingRequests.entries()) {
- // Assuming we only have one pending directory listing at a time
+ if (request.type !== 'ls') continue;
if (request.timeout) clearTimeout(request.timeout);
this.pendingRequests.delete(reqid);
request.resolve(this.currentFiles);
- break; // Only resolve the first one
+ break; // Only resolve the first matching one
}
}
}
@@ -513,7 +533,12 @@ export class MeshCentralFileManager {
}, timeoutMs);
}
- this.pendingRequests.set(request.reqid, { resolve: value => resolve(value as T), reject, timeout });
+ this.pendingRequests.set(request.reqid, {
+ resolve: value => resolve(value as T),
+ reject,
+ timeout,
+ type: (request as { action?: string }).action,
+ });
const sent = this.sendJsonMessage(request);
if (!sent) {