feat(chat): scope agent to current organization

packages/auth/src/web/hooks.ts

@@ -1,12 +1,13 @@
 import { useForm } from "@tanstack/react-form";
+import { useCallback, useRef, useState } from "react";
 import { toast } from "sonner";
 
 import { signInSchema, signUpSchema } from "../shared/forms";
 import { authClient } from "./auth-client";
 
-type AuthFormOptions = {
+interface AuthFormOptions {
   readonly onSuccess?: () => void;
-};
+}
 
 export const useSignInForm = ({ onSuccess }: AuthFormOptions = {}) =>
   useForm({
@@ -23,7 +24,7 @@ export const useSignInForm = ({ onSuccess }: AuthFormOptions = {}) =>
             toast.success("Signed in successfully");
             onSuccess?.();
           },
-        },
+        }
       );
     },
     validators: { onSubmit: signInSchema },
@@ -34,7 +35,11 @@ export const useSignUpForm = ({ onSuccess }: AuthFormOptions = {}) =>
     defaultValues: { confirmPassword: "", email: "", name: "", password: "" },
     onSubmit: async ({ formApi, value }) => {
       await authClient.signUp.email(
-        { email: value.email.trim(), name: value.name.trim(), password: value.password },
+        {
+          email: value.email.trim(),
+          name: value.name.trim(),
+          password: value.password,
+        },
         {
           onError: ({ error }) => {
             toast.error(error.message || error.statusText);
@@ -44,8 +49,48 @@ export const useSignUpForm = ({ onSuccess }: AuthFormOptions = {}) =>
             toast.success("Account created successfully");
             onSuccess?.();
           },
-        },
+        }
       );
     },
     validators: { onSubmit: signUpSchema },
   });
+
+/**
+ * Resolve the current Better Auth/Convex JWT access token for the signed-in
+ * session. Uses the installed `convex.token` plugin endpoint (the supported
+ * API) and caches the result so repeated fetches within a session reuse it.
+ * Returns null when the user is not authenticated.
+ */
+export const useConvexAccessToken = (): (() => Promise<string | null>) => {
+  const cachedTokenRef = useRef<string | null>(null);
+  const pendingRef = useRef<Promise<string | null> | null>(null);
+  const [, forceRender] = useState(0);
+
+  return useCallback(async (): Promise<string | null> => {
+    if (cachedTokenRef.current) {
+      return cachedTokenRef.current;
+    }
+    if (pendingRef.current) {
+      return pendingRef.current;
+    }
+    pendingRef.current = (async (): Promise<string | null> => {
+      try {
+        const { data } = await authClient.convex.token({
+          fetchOptions: { throw: false },
+        });
+        const token = data?.token ?? null;
+        cachedTokenRef.current = token;
+        if (!token) {
+          forceRender((n) => n + 1);
+        }
+        return token;
+      } catch {
+        cachedTokenRef.current = null;
+        return null;
+      } finally {
+        pendingRef.current = null;
+      }
+    })();
+    return await pendingRef.current;
+  }, []);
+};

packages/auth/src/web/index.ts

@@ -1,4 +1,5 @@
 export { authClient } from "./auth-client";
 export { WebAuthProvider } from "./auth-provider";
+export { useConvexAccessToken } from "./hooks";
 export { LoginForm } from "./login-form";
 export { SignupForm } from "./signup-form";