Description
Authentication and Workspace Entry covers the user-facing boundary between an anonymous browser and an authorized Dots workspace. It includes sign-in, gated signup, invitation resolution and acceptance, forgotten-password and reset flows, comment verification, first account onboarding, and creation of an additional workspace when the actor holds the required capability. The authentication gate distinguishes a true unauthenticated response from a transport failure, so connectivity problems do not silently look like logout.
Each flow uses dedicated validation, accessible field feedback, and explicit alternate paths. Invitation pages resolve the invite before presenting acceptance, password forms map known server errors into actionable copy, and the authenticated tree mounts only after session state is ready. Workspace creation is reachable from the workspace switcher but remains hidden when the actor lacks provisioning permission.
Selling Points
- Provides a complete identity journey from invitation or signup through authenticated workspace access.
- Prevents network faults from masquerading as expired sessions, reducing accidental sign-out loops and user confusion.
- Keeps authorization gates honest by hiding workspace creation when the current actor cannot perform it.
- Uses consistent pre-auth presentation and field validation across login, recovery, and invitation flows.
- Supports direct invitation and verification links without requiring the user to navigate through the signed-in shell first.
User Story
A new teammate opens an invitation link, reviews the resolved workspace identity, creates their account, and accepts the invitation. On a later visit, a temporary API outage produces a retryable boot error rather than sending them to login. An authorized owner can also create another workspace directly from the switcher.
Extension Surface
Authentication is fixed core. apps/web/src/modules/access/AuthGate.tsx owns the closed session-state branch that admits or rejects the authenticated tree, and apps/web/src/modules/access/lib/auth-routes.ts defines the sanctioned anonymous destinations. Themes and copy can follow the design system, but there is no supported external authentication-screen or authorization-resolver plugin seam in this UI.
Capabilities & Limits
- Supports sign-in, gated signup, invite acceptance, password recovery, reset, and verification flows.
- Distinguishes loading, unauthenticated, ready, and retryable transport-error states.
- Provides capability-gated additional-workspace creation.
- Limit: the browser does not derive permissions or tenant identity; it trusts the server-resolved session and cannot grant access on its own.
Implementation Map
apps/web/src/modules/access/AuthGate.tsxapps/web/src/modules/access/LoginPage.tsxapps/web/src/modules/access/AcceptInvitePage.tsxapps/web/src/modules/access/WorkspaceCreatePage.tsx