Allow login to SaaS for desktop instead of offline mode (#4941)

# Description of Changes
Makes the desktop options to sign in with your Stirling account, or sign
into self-hosted:

<img width="608" height="456" alt="image"
src="https://github.com/user-attachments/assets/a49988ab-db3f-4333-b242-790aee5c07c6"
/>

The first option still runs everything locally, just enforces that
you've signed in for now. Future work will enable sending operations
that can't be run locally to the server.

frontend/src-tauri/src/commands/auth.rs

@@ -127,7 +127,7 @@ pub async fn clear_user_info(app_handle: AppHandle) -> Result<(), String> {
     Ok(())
 }
 
-// Response types for Spring Boot login
+// Response types for Spring Boot login (self-hosted)
 #[derive(Debug, Deserialize)]
 struct SpringBootSession {
     access_token: String,
@@ -145,6 +145,24 @@ struct SpringBootLoginResponse {
     user: SpringBootUser,
 }
 
+// Response types for Supabase login (SaaS)
+#[derive(Debug, Deserialize)]
+struct SupabaseUserMetadata {
+    full_name: Option<String>,
+}
+
+#[derive(Debug, Deserialize)]
+struct SupabaseUser {
+    email: Option<String>,
+    user_metadata: Option<SupabaseUserMetadata>,
+}
+
+#[derive(Debug, Deserialize)]
+struct SupabaseLoginResponse {
+    access_token: String,
+    user: SupabaseUser,
+}
+
 #[derive(Debug, Serialize)]
 pub struct LoginResponse {
     pub token: String,
@@ -153,7 +171,7 @@ pub struct LoginResponse {
 }
 
 /// Login command - makes HTTP request from Rust to bypass CORS
-/// Supports Spring Boot authentication (self-hosted)
+/// Supports both Supabase authentication (SaaS) and Spring Boot authentication (self-hosted)
 #[tauri::command]
 pub async fn login(
     server_url: String,
@@ -162,54 +180,124 @@ pub async fn login(
 ) -> Result<LoginResponse, String> {
     log::info!("Login attempt for user: {} to server: {}", username, server_url);
 
-    // Build login URL
-    let login_url = format!("{}/api/v1/auth/login", server_url.trim_end_matches('/'));
-    log::debug!("Login URL: {}", login_url);
+    // Detect if this is Supabase (SaaS) or Spring Boot (self-hosted)
+    // Compare against the configured SaaS server URL from environment
+    let saas_server_url = env!("VITE_SAAS_SERVER_URL");
+    let is_supabase = server_url.trim_end_matches('/') == saas_server_url.trim_end_matches('/');
+    log::info!("Authentication type: {}", if is_supabase { "Supabase (SaaS)" } else { "Spring Boot (Self-hosted)" });
 
     // Create HTTP client
     let client = reqwest::Client::new();
 
-    // Make login request
-    let response = client
-        .post(&login_url)
-        .json(&serde_json::json!({
-            "username": username,
+    if is_supabase {
+        // Supabase authentication flow
+        let login_url = format!("{}/auth/v1/token?grant_type=password", server_url.trim_end_matches('/'));
+
+        // Supabase public API key from environment variable (required at compile time)
+        // Set VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY before building
+        let supabase_key = env!("VITE_SUPABASE_PUBLISHABLE_DEFAULT_KEY");
+
+        let request_body = serde_json::json!({
+            "email": username,
             "password": password,
-        }))
-        .send()
-        .await
-        .map_err(|e| format!("Network error: {}", e))?;
-
-    let status = response.status();
-    log::debug!("Login response status: {}", status);
-
-    if !status.is_success() {
-        let error_text = response
-            .text()
-            .await
-            .unwrap_or_else(|_| "Unknown error".to_string());
-        log::error!("Login failed with status {}: {}", status, error_text);
-
-        return Err(if status.as_u16() == 401 {
-            "Invalid username or password".to_string()
-        } else if status.as_u16() == 403 {
-            "Access denied".to_string()
-        } else {
-            format!("Login failed: {}", status)
         });
+
+        let response = client
+            .post(&login_url)
+            .header("Content-Type", "application/json;charset=UTF-8")
+            .header("apikey", supabase_key)
+            .header("Authorization", format!("Bearer {}", supabase_key))
+            .header("X-Client-Info", "supabase-js-web/2.58.0")
+            .header("X-Supabase-Api-Version", "2024-01-01")
+            .json(&request_body)
+            .send()
+            .await
+            .map_err(|e| format!("Network error: {}", e))?;
+
+        let status = response.status();
+
+        if !status.is_success() {
+            let error_text = response
+                .text()
+                .await
+                .unwrap_or_else(|_| "Unknown error".to_string());
+            log::error!("Supabase login failed with status {}: {}", status, error_text);
+
+            return Err(if status.as_u16() == 400 || status.as_u16() == 401 {
+                "Invalid username or password".to_string()
+            } else if status.as_u16() == 403 {
+                "Access denied".to_string()
+            } else {
+                format!("Login failed: {}", status)
+            });
+        }
+
+        // Parse Supabase response format
+        let login_response: SupabaseLoginResponse = response
+            .json()
+            .await
+            .map_err(|e| format!("Failed to parse Supabase response: {}", e))?;
+
+        let email = login_response.user.email.clone();
+        let username = login_response.user.user_metadata
+            .as_ref()
+            .and_then(|m| m.full_name.clone())
+            .or_else(|| email.clone())
+            .unwrap_or_else(|| username);
+
+        log::info!("Supabase login successful for user: {}", username);
+
+        Ok(LoginResponse {
+            token: login_response.access_token,
+            username,
+            email,
+        })
+    } else {
+        // Spring Boot authentication flow
+        let login_url = format!("{}/api/v1/auth/login", server_url.trim_end_matches('/'));
+        log::debug!("Spring Boot login URL: {}", login_url);
+
+        let response = client
+            .post(&login_url)
+            .json(&serde_json::json!({
+                "username": username,
+                "password": password,
+            }))
+            .send()
+            .await
+            .map_err(|e| format!("Network error: {}", e))?;
+
+        let status = response.status();
+        log::debug!("Spring Boot login response status: {}", status);
+
+        if !status.is_success() {
+            let error_text = response
+                .text()
+                .await
+                .unwrap_or_else(|_| "Unknown error".to_string());
+            log::error!("Spring Boot login failed with status {}: {}", status, error_text);
+
+            return Err(if status.as_u16() == 401 {
+                "Invalid username or password".to_string()
+            } else if status.as_u16() == 403 {
+                "Access denied".to_string()
+            } else {
+                format!("Login failed: {}", status)
+            });
+        }
+
+        // Parse Spring Boot response format
+        let login_response: SpringBootLoginResponse = response
+            .json()
+            .await
+            .map_err(|e| format!("Failed to parse Spring Boot response: {}", e))?;
+
+        log::info!("Spring Boot login successful for user: {}", login_response.user.username);
+
+        Ok(LoginResponse {
+            token: login_response.session.access_token,
+            username: login_response.user.username,
+            email: login_response.user.email,
+        })
     }
-
-    // Parse Spring Boot response format
-    let login_response: SpringBootLoginResponse = response
-        .json()
-        .await
-        .map_err(|e| format!("Failed to parse response: {}", e))?;
-
-    log::info!("Login successful for user: {}", login_response.user.username);
-
-    Ok(LoginResponse {
-        token: login_response.session.access_token,
-        username: login_response.user.username,
-        email: login_response.user.email,
-    })
 }

frontend/src-tauri/src/commands/backend.rs

@@ -349,11 +349,11 @@ pub async fn start_backend(
     };
 
     match mode {
-        ConnectionMode::Offline => {
-            add_log("🔌 Running in Offline mode - starting local backend".to_string());
+        ConnectionMode::SaaS => {
+            add_log("☁️ Running in SaaS mode - starting local backend".to_string());
         }
-        ConnectionMode::Server => {
-            add_log("🌐 Running in Server mode - starting local backend (for hybrid execution support)".to_string());
+        ConnectionMode::SelfHosted => {
+            add_log("🌐 Running in Self-Hosted mode - starting local backend (for hybrid execution support)".to_string());
         }
     }
 

frontend/src-tauri/src/commands/connection.rs

@@ -31,7 +31,7 @@ pub async fn get_connection_config(
     let mode = store
         .get(CONNECTION_MODE_KEY)
         .and_then(|v| serde_json::from_value(v.clone()).ok())
-        .unwrap_or(ConnectionMode::Offline);
+        .unwrap_or(ConnectionMode::SaaS);
 
     let server_config: Option<ServerConfig> = store
         .get(SERVER_CONFIG_KEY)
@@ -109,3 +109,22 @@ pub async fn is_first_launch(app_handle: AppHandle) -> Result<bool, String> {
 
     Ok(!setup_completed)
 }
+
+#[tauri::command]
+pub async fn reset_setup_completion(app_handle: AppHandle) -> Result<(), String> {
+    log::info!("Resetting setup completion flag");
+
+    let store = app_handle
+        .store(STORE_FILE)
+        .map_err(|e| format!("Failed to access store: {}", e))?;
+
+    // Reset setup completion flag to force SetupWizard on next launch
+    store.set(FIRST_LAUNCH_KEY, serde_json::json!(false));
+
+    store
+        .save()
+        .map_err(|e| format!("Failed to save store: {}", e))?;
+
+    log::info!("Setup completion flag reset successfully");
+    Ok(())
+}

frontend/src-tauri/src/commands/mod.rs

@@ -10,6 +10,7 @@ pub use files::{add_opened_file, clear_opened_files, get_opened_files};
 pub use connection::{
     get_connection_config,
     is_first_launch,
+    reset_setup_completion,
     set_connection_mode,
 };
 pub use auth::{