From c222aa2511567cc15821a6367223884109424bce Mon Sep 17 00:00:00 2001
From: shad <shad@flow-master.ai>
Date: Sun, 14 Jun 2026 13:22:55 +0400
Subject: [PATCH] fix(login): honest SSO state instead of silent 404

Microsoft SSO endpoint exists at auth-service but returns 503
'Microsoft SSO is not configured' for the canvas tenant. Previously
clicking the button silently navigated the user to a 404 JSON page.

handleSSO now probes the endpoint first:
- 3xx -> follow redirect (real SSO flow)
- 503 -> 'Microsoft sign-in is not yet enabled on this tenant'
- 404 -> 'Microsoft sign-in is not wired to this environment yet'
- network error -> surface the reason

Closes Oracle gap #6 with truthful UX while leaving the SSO path
ready to light up once the tenant Azure AD config is in place.
---
 src/scenes/Login.tsx | 25 +++++++++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

diff --git a/src/scenes/Login.tsx b/src/scenes/Login.tsx
index 211f4b1..c83b4c8 100644
--- a/src/scenes/Login.tsx
+++ b/src/scenes/Login.tsx
@@ -52,8 +52,29 @@ export default function Login() {
     }
   };
 
-  const handleSSO = () => {
-    window.location.href = "/api/v1/auth/microsoft/login";
+  const handleSSO = async () => {
+    setError(null);
+    setLoading(true);
+    try {
+      const probe = await fetch("/api/v1/auth/microsoft/login", { method: "GET", redirect: "manual" });
+      if (probe.status >= 300 && probe.status < 400) {
+        window.location.href = "/api/v1/auth/microsoft/login";
+        return;
+      }
+      if (probe.status === 503) {
+        setError("Microsoft sign-in is not yet enabled on this tenant. Use developer sign-in below for now.");
+        return;
+      }
+      if (probe.status === 404) {
+        setError("Microsoft sign-in is not wired to this environment yet. Use developer sign-in below for now.");
+        return;
+      }
+      window.location.href = "/api/v1/auth/microsoft/login";
+    } catch (e) {
+      setError(`Microsoft sign-in unreachable: ${(e as Error).message}`);
+    } finally {
+      setLoading(false);
+    }
   };
 
   return (