Bastion Auth

A collection of authentication components and utilities built around Bastion SSO. Includes session management via TanStack Query, a profile dropdown, sign-out dialog, and pre-configured Axios instances.

Installation

npx shadcn@latest add https://befame-registry.example.com/r/auth-provider.json

---

AuthProvider

Wraps your app (or a route subtree) to validate the current session on mount. On a 401 response from /auth/me it automatically redirects to the Bastion SSO page. While loading, a centered spinner is shown.

Usage

import { AuthProvider } from '@/components/bastion/auth-provider'

export default function App() {
  return (
    <AuthProvider config={{ allowGuest: true, redirectOnUnauthenticated: false }}>
      <RouterOutlet />
    </AuthProvider>
  )
}

Guest mode

Set allowGuest to let unauthenticated users view the app without being redirected.

Disabling redirects (development)

Set redirectOnUnauthenticated to false to skip the SSO redirect while developing locally.

Props

Prop	Type	Default	Description
children	ReactNode	—	Content to render once the session is validated.
config.allowGuest	boolean	false	When true, unauthenticated users are not redirected.

useUserInfo hook

Access the current user from any component inside AuthProvider.

import { useUserInfo } from '@/components/bastion/auth-provider'

function MyComponent() {
  const { value: user } = useUserInfo()
  return <p>Hello, {user?.givenName}</p>
}

Returns AuthContextValue:

Field	Type	Description
value	AuthUser | null	The currently authenticated user, or null.
set	(data: AuthUser) => void	Manually update the in-memory user (rarely needed).

AuthUser shape

interface AuthUser {
  id: string
  login: string
  name: string
  givenName: string
  identityType: number
  roles: string[]
  email: string | null
  phone: string | null
}

---

ProfileDropdown

An avatar button that opens a dropdown with the user's name/email, a link to the Bastion profile page, and a sign-out action. When no user is authenticated, a Zaloguj się button is shown instead.

Usage

import { ProfileDropdown } from '@/components/bastion/profile-dropdown'

<ProfileDropdown />

Place it in your header or sidebar — it reads the current user from useAuthStore automatically.

---

SignOutDialog

A confirmation dialog that calls the logout endpoint, resets the auth store, and closes itself.

Usage

import { SignOutDialog } from '@/components/bastion/sign-out-dialog'
import { useState } from 'react'

function MyHeader() {
  const [open, setOpen] = useState(false)

  return (
    <>
      <button onClick={() => setOpen(true)}>Sign out</button>
      <SignOutDialog open={open} onOpenChange={setOpen} />
    </>
  )
}

Props

Prop	Type	Description
open	boolean	Whether the dialog is visible.
onOpenChange	(open: boolean) => void	Called when the dialog should open or close.

---

Utilities (utils.ts)

buildBastionRedirectUrl(redirectUri?)

Returns the Bastion SSO URL, optionally including a post-login redirect and the app ID.

import { buildBastionRedirectUrl } from '@/components/bastion/utils'

// Redirect to SSO, then back to the current page
window.location.href = buildBastionRedirectUrl(window.location.href)

Parameter	Type	Description
redirectUri	string (optional)	URL the user is sent to after login.

buildBastionProfileUrl()

Returns the Bastion management URL (no parameters).

import { buildBastionProfileUrl } from '@/components/bastion/utils'

window.open(buildBastionProfileUrl(), '_blank')

getApiUrl(endpoint)

Prepends API_BASE_URL to a relative endpoint string.

import { getApiUrl } from '@/components/bastion/utils'

const url = getApiUrl('/users') // → https://example.com/api/v1/users

api / grotApi

Pre-configured Axios instances with withCredentials: true and JSON content-type headers. Both include a response interceptor that redirects to the Bastion SSO page on 401 (after confirming the session is truly expired).

import { api, grotApi } from '@/components/bastion/utils'

// Use like a normal Axios instance
const { data } = await api.get('/users')
const { data: me } = await grotApi.get('/auth/me')

Instance	Base URL env var	Typical use
api	VITE_API_URL / VITE_APP_BASE_URL	App-specific backend
grotApi	VITE_APP_GROT_API_URL	Bastion / Grot auth API

---

Environment Variables

Variable	Required	Description
VITE_BASTION_URL	Yes	Base URL of the Bastion service.
VITE_APP_ID	No	App identifier sent to Bastion SSO.
VITE_API_URL	Dev only	Full base URL for api in development.
VITE_APP_BASE_URL	Prod	Base URL prefix; api/v1 is appended.
VITE_APP_GROT_API_URL	Yes	Base URL for grotApi (Grot/Bastion API).
VITE_DISABLE_AUTH_REDIRECT	No	Set to "true" to disable SSO redirects locally.