Tighten the Platform wiring after review

Shares the session-expiry rule and contract response parsing instead of copying
them, makes the view model the wire shape, nests Settings entries with the server's
answer as the default gate, and isolates fixture sections from the settings screen.
Moves banners below the native titlebar, restores focus after a failed confirm,
lays out gate actions in a row, and keeps zone assets out of the proxy.

Author: waleedlatif1

apps/sim/app/api/organizations/surface/route.ts

@@ -14,7 +14,7 @@ export const GET = defineInternalJsonRoute({
   operation: organizationOperations.readSurface,
   rateLimit: internalRateLimits.none({
     reason:
-      'Read once per Platform document, as the legacy organization layout reads it per render',
+      'Read per Platform server render, as the legacy organization layout reads it per render',
   }),
   errorPolicy: internalOrganizationErrorPolicy,
   mapInput: () => ({}),

apps/sim/app/workspace/[workspaceId]/components/session-expired/session-expired.tsx

@@ -1,23 +1,12 @@
 'use client'
 
-import { useCallback, useEffect, useRef, useState } from 'react'
 import { Chip, cn, useNativeSurfaceOcclusionReady } from '@sim/emcn'
-import { useSession } from '@/lib/auth/client'
+import { useSessionExpiry } from '@/lib/auth/session-expiry'
 import { recoverFromStaleSession } from '@/lib/auth/stale-session-recovery'
 
 /**
  * Cleanly logs out when the session dies while the app is mounted.
  *
- * The workspace shell's auth gate is a Server Component, so it only re-evaluates
- * on a server render — a session that expires or is revoked mid-visit leaves the
- * SPA mounted and silently failing every request, with nothing to redirect it.
- * This watches the canonical session query for that transition instead.
- *
- * Detection keys off the transition, never off a single failed request: it
- * activates only once a session that was live settles to `null`. A signed-out
- * visitor never arms it (there was no session to lose), and `error` is excluded
- * so an offline blip or a 5xx can never masquerade as an expiry.
- *
  * Recovery goes through {@link recoverFromStaleSession}: an expired session's
  * cookies are never cleared server-side (better-auth's customSession plugin
  * swallows the deletion headers), and a request still carrying a session cookie
@@ -27,35 +16,10 @@ import { recoverFromStaleSession } from '@/lib/auth/stale-session-recovery'
  * would recreate the redirect loop.
  */
 export function SessionExpired() {
-  const { data: session, isPending, error } = useSession()
-  const startedRef = useRef(false)
-  const [sawSession, setSawSession] = useState(false)
-  const [wasImpersonation, setWasImpersonation] = useState(false)
-  const [failed, setFailed] = useState(false)
-
-  if (!sawSession && session?.user) {
-    setSawSession(true)
-  }
-  if (!wasImpersonation && session?.session?.impersonatedBy) {
-    setWasImpersonation(true)
-  }
-
-  const expired = sawSession && !isPending && !error && !session?.user
+  const { expired, failed, wasImpersonation, attemptRecovery } =
+    useSessionExpiry(recoverFromStaleSession)
   const nativeSurfaceReady = useNativeSurfaceOcclusionReady(expired, 'takeover')
 
-  const attemptRecovery = useCallback(() => {
-    setFailed(false)
-    void recoverFromStaleSession().then((recovered) => {
-      if (!recovered) setFailed(true)
-    })
-  }, [])
-
-  useEffect(() => {
-    if (!expired || startedRef.current) return
-    startedRef.current = true
-    attemptRecovery()
-  }, [expired, attemptRecovery])
-
   if (!expired) {
     return null
   }

apps/sim/lib/api/client/request.ts

@@ -211,6 +211,14 @@ export async function requestJson<C extends AnyApiRouteContract>(
     ...(input.keepalive === undefined ? {} : { keepalive: input.keepalive }),
   })
 
+  return readContractResponse(contract, response)
+}
+
+/** Validates a contract's JSON response, or throws the `ApiClientError` its failure amounts to. */
+export async function readContractResponse<C extends AnyApiRouteContract>(
+  contract: C,
+  response: Response
+): Promise<ContractJsonResponse<C>> {
   const { parsed, raw } = await readResponseBody(response)
   if (!response.ok) {
     throw new ApiClientError({

apps/sim/lib/auth/session-expiry.ts

@@ -0,0 +1,51 @@
+'use client'
+
+import { useCallback, useEffect, useRef, useState } from 'react'
+import { useSession } from '@/lib/auth/client'
+
+/**
+ * Notices a session dying while the app is mounted, and recovers from it.
+ *
+ * A surface's auth gate is a Server Component, so it only re-evaluates on a server render — a
+ * session that expires or is revoked mid-visit leaves the SPA mounted and silently failing every
+ * request, with nothing to redirect it. This watches the canonical session query for that
+ * transition instead.
+ *
+ * Detection keys off the transition, never off a single failed request: it activates only once a
+ * session that was live settles to `null`. A signed-out visitor never arms it (there was no session
+ * to lose), and `error` is excluded so an offline blip or a 5xx can never masquerade as an expiry.
+ *
+ * `recover` must keep a stable identity, and resolves false when sign-out failed and the surface
+ * should offer a retry.
+ */
+export function useSessionExpiry(recover: () => Promise<boolean>) {
+  const { data: session, isPending, error } = useSession()
+  const startedRef = useRef(false)
+  const [sawSession, setSawSession] = useState(false)
+  const [wasImpersonation, setWasImpersonation] = useState(false)
+  const [failed, setFailed] = useState(false)
+
+  if (!sawSession && session?.user) {
+    setSawSession(true)
+  }
+  if (!wasImpersonation && session?.session?.impersonatedBy) {
+    setWasImpersonation(true)
+  }
+
+  const expired = sawSession && !isPending && !error && !session?.user
+
+  const attemptRecovery = useCallback(() => {
+    setFailed(false)
+    void recover().then((recovered) => {
+      if (!recovered) setFailed(true)
+    })
+  }, [recover])
+
+  useEffect(() => {
+    if (!expired || startedRef.current) return
+    startedRef.current = true
+    attemptRecovery()
+  }, [expired, attemptRecovery])
+
+  return { expired, failed, wasImpersonation, attemptRecovery }
+}

apps/sim/lib/core/config/public-env.ts

@@ -1,6 +1,5 @@
 import { PUBLIC_ENV_ATTRIBUTE } from '@/lib/core/config/env'
 
-/** Every `NEXT_PUBLIC_*` value currently in `process.env`. */
 export function readPublicEnv(): Record<string, string | undefined> {
   return Object.fromEntries(
     Object.entries(process.env).filter(([key]) => /^NEXT_PUBLIC_/i.test(key))

apps/sim/lib/navigation/paths.ts

@@ -26,7 +26,7 @@ export const WORKSPACES_PATH = '/workspace'
 export const WORKSPACE_SETTINGS_PATH = `${WORKSPACES_PATH}?redirect=settings`
 
 /** Root of the organization surface; `/o` alone resolves like {@link APP_ENTRY_PATH}. */
-const ORGANIZATIONS_PATH = '/o'
+export const ORGANIZATIONS_PATH = '/o'
 
 /**
  * Every destination under one organization's surface, built from one place so the

apps/sim/lib/organizations/application/surface.ts

@@ -52,7 +52,7 @@ export const readOrganizationSurface: OperationUseCase<
       resolveOrganizationSurfaceFlags(organizationId, userId),
       canBrowsePeople(organizationId, context.viewer.role),
       isSimLinksEnabled(organizationId),
-      /** Decides which links are drawn; the pages behind them authorize for themselves. */
+      // Decides which links are drawn; the pages behind them authorize for themselves.
       isPlatformAdmin(userId).catch((error: unknown) => {
         logger.warn('Could not resolve platform administration navigation', {
           error: getErrorMessage(error),

apps/sim/platform/README.md

@@ -102,7 +102,7 @@ bun run --cwd apps/sim test:platform:desktop
 
 The Platform type check generates Next.js route types and checks the isolated project. The repository type check runs it alongside the existing app’s TypeScript project.
 
-`bun run --cwd apps/sim test:platform:live` runs `checks/live/` against an app and database you have started, using `PLATFORM_LIVE_ORIGIN`, `PLATFORM_LIVE_EMAIL`, `PLATFORM_LIVE_PASSWORD` and `PLATFORM_LIVE_ORGANIZATION_NAME`. Supply `PLATFORM_LIVE_REPORT_PATH` to save its JSON report.
+`bun run --cwd apps/sim test:platform:live` runs `checks/live/` against an app and database you have started, using `PLATFORM_LIVE_ORIGIN`, `PLATFORM_LIVE_EMAIL`, `PLATFORM_LIVE_PASSWORD` and `PLATFORM_LIVE_ORGANIZATION_NAME`. The member needs build access: anyone else lands on a legacy route. Supply `PLATFORM_LIVE_REPORT_PATH` to save its JSON report.
 
 The browser suite starts separate production servers with fixtures enabled and disabled. Supply `PLATFORM_REPORT_PATH` to save JSON, failure screenshots and traces. Next uses webpack for this nested app: the installed Turbopack also discovers the parent Sim project's proxy and instrumentation. Watch for that boundary when upgrading Next.
 

apps/sim/platform/app/(shell)/_components/destinations.ts

@@ -7,33 +7,26 @@ export const PLATFORM_DESTINATIONS = [
   { id: 'integrations', label: 'Integrations', icon: 'I070', value: '/integrations' },
 ] as const
 
+const [HOME, SETTINGS, INTEGRATIONS] = PLATFORM_DESTINATIONS
+
 /** The legacy navigation's gates and order. Search and Benchmark stay on the legacy surface. */
 export function resolveLiveDestinations(organization: PlatformOrganization): ShellDestination[] {
-  const { access, navFlags } = organization
+  const { mothershipAvailable, canBuild, searchAccess, navFlags } = organization
   const routes = legacyRoutes(organization)
+  const search = { id: 'search', label: 'Search', icon: 'I089', value: routes.search } as const
+  const people = { id: 'people', label: 'People', icon: 'I104', value: '/people' } as const
+  const benchmark = {
+    id: 'benchmark',
+    label: 'Benchmark',
+    icon: 'I046',
+    value: routes.benchmark,
+  } as const
   return [
-    ...(access.mothershipAvailable && access.canBuild
-      ? [{ id: 'home', label: 'Home', icon: 'I104' as const, value: '/home' }]
-      : []),
-    ...(access.searchAccess.memberScoped
-      ? [{ id: 'search', label: 'Search', icon: 'I089' as const, value: routes.search }]
-      : []),
-    ...(navFlags.people
-      ? [{ id: 'people', label: 'People', icon: 'I104' as const, value: '/people' }]
-      : []),
-    ...(access.searchAccess.memberScoped
-      ? [
-          {
-            id: 'integrations',
-            label: 'Integrations',
-            icon: 'I070' as const,
-            value: '/integrations',
-          },
-        ]
-      : []),
-    ...(navFlags.benchmark
-      ? [{ id: 'benchmark', label: 'Benchmark', icon: 'I046' as const, value: routes.benchmark }]
-      : []),
-    { id: 'settings', label: 'Settings', icon: 'I116', value: '/settings' },
+    ...(mothershipAvailable && canBuild ? [HOME] : []),
+    ...(searchAccess.memberScoped ? [search] : []),
+    ...(navFlags.people ? [people] : []),
+    ...(searchAccess.memberScoped ? [INTEGRATIONS] : []),
+    ...(navFlags.benchmark ? [benchmark] : []),
+    SETTINGS,
   ]
 }

apps/sim/platform/app/(shell)/_components/model.ts

@@ -83,7 +83,7 @@ export interface ShellData {
   /** So a list can tell loading and failure from empty. Absent means the data is simply there. */
   status?: { workspaces: ShellQueryStatus; chats: ShellQueryStatus; profile: ShellQueryStatus }
   workspaceCreation?: { canCreate: boolean; organizationId: string | null; reason: string | null }
-  /** Viewer standing, access, deployment and flags. Absent outside a live session. */
+  /** Absent outside a live session. */
   surface?: PlatformOrganization
   /** The viewer's gated navigation. Absent means the static destination lists. */
   destinations?: readonly ShellDestination[]