Portals directory · Frame (b) · route /portals

States

States are contract, not decoration. The directory ships with every one of these or it ships a happy-path-only launcher. Loading, the fresh-install empty case, a failed list with retry, and — the load-bearing one — the fail-closed permission-denied / read-only case: a caller without manage authority sees no launch affordances at all. A 403 is an authorization result shown in place, never a sign-in redirect (only a 401 re-authenticates).

d1 · Loading — GET /api/v1/admin/portals in flight

Portals you manage

Loading…

d2 · Empty — the caller manages no portals yet (a real, non-error case)

Portals you manage

0 portals

No portals to manage

You don't manage any portals yet. When a portal is provisioned and you're granted admin on it, it appears here — ready to open in its own tab.

d3 · Error — the list request failed (non-2xx / network)

Portals you manage

Couldn't load

d4 · Launch affordance — the action is explicitly external (new tab)

Northwind Active Soft

portal.northwind.example

Open portal

opens portal.northwind.example in a new tab

d5 · Suspended portal — fail-closed: no launch affordance is rendered

Acme Reseller Suspended Soft

portal.acme.example

d6 · Permission-denied / read-only — no manage authority ⇒ zero launch affordances

Portals

Read-only

Northwind Active Soft

portal.northwind.example

— no access —

Mendys Robotics Active Hard

live.mendysrobotics.com

— no access —

Acceptance. d1 aria-busy skeleton while GET /api/v1/admin/portals is in flight. d2 empty is real — a caller can legitimately manage zero portals; it is not an error. d3 renders [data-action="retry"] and never a sign-in redirect (the session is intact). d4 the launch action is unmistakably external — new tab, with a hint. d5 a suspended portal exposes no enabled launch affordance. d6 is the fail-closed contract: a caller without manage authority (Permit ReBAC) gets a 403 shown in place and no launch anchor or button is emitted for any row — the launch column is absent, not merely disabled, so there is nothing to open. Only a 401 re-authenticates.