feat: authorize iOS Hermes accounts and secure session isolation

Sources/Features/Conversation/ConversationView.swift

@@ -4,26 +4,32 @@ import SwiftUI
 /// Owns one session across all tabs. Changing tabs never ends a conversation.
 struct ConversationView: View {
     @ObservedObject var settings: SettingsStore
+    @ObservedObject var auth: AuthStore
+    let user: AuthUser
+    let bearerToken: String
     @State private var session: VoiceSession
     @State private var activeServerURL: String
     @State private var pendingServerURL: String?
     @State private var isReplacingSession = false
     @State private var selectedTab = 0
 
-    init(settings: SettingsStore) {
+    init(settings: SettingsStore, auth: AuthStore, user: AuthUser, bearerToken: String) {
+        self.auth = auth
+        self.user = user
+        self.bearerToken = bearerToken
         self.settings = settings
         let url = settings.trimmedServerURL
         _activeServerURL = State(initialValue: url)
-        _session = State(initialValue: Self.makeSession(url, settings: settings))
+        _session = State(initialValue: Self.makeSession(url, settings: settings, bearerToken: bearerToken, userID: user.id))
     }
 
-    private static func makeSession(_ url: String, settings: SettingsStore) -> VoiceSession {
+    private static func makeSession(_ url: String, settings: SettingsStore, bearerToken: String, userID: String) -> VoiceSession {
         guard case .success(let config) = ServerConfig.parse(url) else {
             preconditionFailure("Stored server URL failed validation; init sanitizes to a valid value.")
         }
-        let session = VoiceSession(config: config, tokenClient: TokenClient(config: config), settings: settings)
+        let session = VoiceSession(config: config, tokenClient: TokenClient(config: config, bearerToken: bearerToken), settings: settings, userID: userID)
         #if DEBUG
-        if ProcessInfo.processInfo.arguments.contains("--ui-fixtures") {
+        if userID == "offline-fixture", ProcessInfo.processInfo.arguments.contains("--ui-fixtures") {
             session.transcriptHandler.receiveDataTranscript(role: .user, text: "Help me plan a quiet weekend.")
             session.transcriptHandler.receiveDataTranscript(role: .agent, text: "Let’s leave some room to breathe. A walk, a good book, and time for your favorite music would be a lovely start.")
             session.taskStore.injectSampleEvents()
@@ -45,7 +51,12 @@ struct ConversationView: View {
         TabView(selection: $selectedTab) {
             NavigationStack {
                 ConversationContent(settings: settings, session: session)
-                    .toolbar { settingsLink }
+                    .toolbar {
+                        settingsLink
+                        ToolbarItem(placement: .topBarLeading) {
+                            Button("Sign out") { Task { await auth.logout { await session.disconnect() } } }
+                        }
+                    }
             }
             .tabItem { Label("Talk", systemImage: "bubble.left.and.bubble.right") }
             .tag(0)
@@ -57,7 +68,16 @@ struct ConversationView: View {
         .onChange(of: settings.textMode) { _, enabled in
             Task { await session.applyTextMode(enabled) }
         }
-        .onChange(of: settings.serverURL) { _, value in replaceServer(value) }
+        .onChange(of: settings.serverURL) { _, value in
+            if auth.fixture { replaceServer(value) }
+        }
+        .onAppear {
+            auth.disconnectAccount = { [weak session] in await session?.disconnect() }
+            session.onUnauthorized = { [weak auth, weak session] in
+                await auth?.logout { await session?.disconnect() }
+            }
+        }
+        .disabled(auth.isBusy || auth.token == nil)
     }
 
     @ToolbarContentBuilder private var settingsLink: some ToolbarContent {
@@ -84,7 +104,7 @@ struct ConversationView: View {
                 guard next != activeServerURL else { continue }
                 await session.disconnect()
                 activeServerURL = next
-                session = Self.makeSession(next, settings: settings)
+                session = Self.makeSession(next, settings: settings, bearerToken: bearerToken, userID: user.id)
             }
             isReplacingSession = false
         }
@@ -167,6 +187,10 @@ private struct ConversationContent: View {
                 if failureNotice != nil { failureBanner }
             } else {
                 statusStrip
+                if let activity = session.assistantActivity {
+                    Label(activity, systemImage: "clock").font(.callout)
+                        .padding().accessibilityIdentifier("assistant.progress")
+                }
                 if session.isReconnecting { reconnectBanner }
                 if failureNotice != nil { failureBanner }
                 TranscriptListView(events: transcripts.events, onClear: transcripts.clearAll)
@@ -610,4 +634,4 @@ extension VoiceSession {
     }
 }
 
-#Preview { ConversationView(settings: SettingsStore()) }
+#Preview { AuthenticationRoot(settings: SettingsStore()) }