Maurice
79cd3095e0
On a slow line an OIDC-only login page drew the email and password form while it asked the server which sign-in it offers, then the SSO button once it knew, and only then left for the identity provider. Both looked like something to fill in or click. Until the config answers, the page now shows a short wait instead of the form, and on an OIDC-only instance it becomes a screen that only says where it is going, "Taking you to Keycloak…", with nothing to fill in. A repeat visit announces that redirect at once from the cached config. Should the redirect not have left the page after eight seconds, a quiet link continues by hand. The redirect still never runs on a cached config, right after a sign-out or after a failed sign-in at the provider. That last case now loads the config as well, so an OIDC-only instance shows its own screen with the error rather than a password form nobody can use.
@trek/shared
Single source of truth for TREK's API contracts, expressed as Zod schemas and consumed by both the server (request validation + inferred DTO types) and the client (typed requests/responses).
This package is part of the incremental NestJS + React 19 migration (see the "Brownfield Rewrite" board). It is intentionally dormant until modules start importing it — adding it changes nothing for users.
Rules
- One folder per domain:
src/<domain>/<domain>.schema.ts(+.spec.ts). - Domain-agnostic building blocks live in
src/common/. - A route is only considered migrated once its contract lives here.
- Schemas are the source of truth; server DTOs and client types are inferred from them
(
z.infer<typeof schema>), never hand-duplicated.
Consumption (dev)
Both apps resolve @trek/shared to this package's TypeScript source:
- Server (
tsx): viapathsinserver/tsconfig.json. - Client (
vite): viaresolve.aliasinclient/vite.config.ts(+pathsfor the type-checker).
Production packaging (Docker / workspace wiring) is introduced in card F2, when the server first depends on this package at runtime. Until then prod builds are untouched.
Not yet here
The canonical error envelope is finalised in card F5 (it must match TREK's current Express error responses byte-for-byte), so it is deliberately not invented in F1.