update

backend/app/main.py

@@ -2316,8 +2316,9 @@ async def unipile_webhook(request: Request, db: Session = Depends(get_db)):
 
 
 @app.get("/api/unipile/webhook-url-hint")
-async def unipile_webhook_url_hint(request: Request):
+async def unipile_webhook_url_hint(request: Request, t: TenantContext = Depends(get_tenant_context)):
     """Public URL your UniPile webhooks should POST to (same host as this API)."""
+    _ = t
     root = _public_origin_from_request(request)
     post_url = f"{root}/api/webhooks/unipile"
     return {
@@ -4779,7 +4780,7 @@ async def download_sequences(file_id: str = Query(...), t: TenantContext = Depen
 
 
 @app.get("/api/smartlead-campaigns")
-async def get_smartlead_campaigns():
+async def get_smartlead_campaigns(t: TenantContext = Depends(get_tenant_context)):
     """Get list of campaigns from Smartlead"""
     try:
         client = SmartleadClient()

frontend/src/App.jsx

@@ -1,5 +1,7 @@
 import React from "react";
 import { BrowserRouter, Routes, Route, Navigate } from "react-router-dom";
+import { AuthProvider } from "./context/AuthContext";
+import RequireAuth from "./components/auth/RequireAuth";
 import { GeneratorWorkflowProvider } from "./context/GeneratorWorkflowContext";
 import EmailSequenceGenerator from "./pages/EmailSequenceGenerator";
 import Contacts from "./pages/Contacts";
@@ -12,17 +14,21 @@ import "./index.css";
 export default function App() {
   return (
     <BrowserRouter>
-      <GeneratorWorkflowProvider>
-      <Routes>
-        <Route path="/" element={<EmailSequenceGenerator />} />
-        <Route path="/contacts" element={<Contacts />} />
-        <Route path="/leads" element={<Leads />} />
-        <Route path="/deals" element={<Deals />} />
-        <Route path="/dashboard" element={<SalesDashboard />} />
-        <Route path="/settings" element={<Settings />} />
-        <Route path="/history" element={<Navigate to="/leads" replace />} />
-      </Routes>
-      </GeneratorWorkflowProvider>
+      <AuthProvider>
+        <RequireAuth>
+          <GeneratorWorkflowProvider>
+            <Routes>
+              <Route path="/" element={<EmailSequenceGenerator />} />
+              <Route path="/contacts" element={<Contacts />} />
+              <Route path="/leads" element={<Leads />} />
+              <Route path="/deals" element={<Deals />} />
+              <Route path="/dashboard" element={<SalesDashboard />} />
+              <Route path="/settings" element={<Settings />} />
+              <Route path="/history" element={<Navigate to="/leads" replace />} />
+            </Routes>
+          </GeneratorWorkflowProvider>
+        </RequireAuth>
+      </AuthProvider>
     </BrowserRouter>
   );
 }

frontend/src/components/auth/RequireAuth.jsx

@@ -0,0 +1,21 @@
+import React from 'react';
+import { useAuth } from '@/context/AuthContext';
+import SignIn from '@/pages/SignIn';
+
+/**
+ * Blocks the app until the user has a valid Google session.
+ * API routes remain protected server-side; this prevents browsing the UI while signed out.
+ */
+export default function RequireAuth({ children }) {
+    const { phase, signedIn } = useAuth();
+
+    if (phase === 'loading') {
+        return <SignIn />;
+    }
+
+    if (!signedIn) {
+        return <SignIn />;
+    }
+
+    return children;
+}

frontend/src/components/layout/GoogleAuthBar.jsx

@@ -1,74 +1,27 @@
-import React, { useCallback, useEffect, useState } from 'react';
-import { Link, useLocation, useSearchParams } from 'react-router-dom';
+import React from 'react';
+import { Link, useLocation } from 'react-router-dom';
 import { LogOut, Settings } from 'lucide-react';
 import { Button } from '@/components/ui/button';
 import { cn } from '@/lib/utils';
 import { apiFetch } from '@/lib/api';
+import { useAuth } from '@/context/AuthContext';
 
 /**
- * Sign-in (Google). Workspace details and switching context live in Settings / session. OAuth callback sets session.
+ * Signed-in user menu (sign-out, settings). Sign-in is handled by RequireAuth + SignIn page.
  */
 export default function GoogleAuthBar() {
     const location = useLocation();
-    const [searchParams, setSearchParams] = useSearchParams();
-    const [phase, setPhase] = useState('loading');
-    const [googleOn, setGoogleOn] = useState(false);
-    const [user, setUser] = useState(null);
-    const refresh = useCallback(async () => {
-        try {
-            const [st, me] = await Promise.all([
-                apiFetch('/api/auth/status').then((r) => r.json()),
-                apiFetch('/api/auth/me').then((r) => (r.ok ? r.json() : null)),
-            ]);
-            setGoogleOn(!!st.googleConfigured);
-            setUser(me);
-            setPhase('ready');
-            if (typeof window !== 'undefined') {
-                window.dispatchEvent(new CustomEvent('emailout-auth-changed'));
-            }
-        } catch {
-            setPhase('error');
-        }
-    }, []);
-
-    useEffect(() => {
-        refresh();
-    }, [refresh]);
-
-    useEffect(() => {
-        const err = searchParams.get('auth_error');
-        if (!err) return;
-        if (err === 'access_denied') {
-            console.info('Google sign-in was cancelled.');
-        } else if (err === 'invite_email_mismatch') {
-            console.warn(
-                'Invitation email does not match your Google account. Sign in with the invited address.'
-            );
-        } else {
-            console.warn('Google sign-in error:', err);
-        }
-        const next = new URLSearchParams(searchParams);
-        next.delete('auth_error');
-        setSearchParams(next, { replace: true });
-    }, [searchParams, setSearchParams]);
+    const { phase, googleOn, user, refresh } = useAuth();
 
     const logout = async () => {
         try {
             await apiFetch('/api/auth/logout', { method: 'POST' });
-            setUser(null);
-            if (typeof window !== 'undefined') {
-                window.dispatchEvent(new CustomEvent('emailout-auth-changed'));
-            }
+            await refresh();
         } catch (e) {
             console.error(e);
         }
     };
 
-    const inviteParam = searchParams.get('invite');
-    const googleHref = inviteParam
-        ? `/api/auth/google?invite=${encodeURIComponent(inviteParam)}`
-        : '/api/auth/google';
-
     if (phase === 'loading' || (phase === 'ready' && !googleOn)) {
         if (phase === 'loading') {
             return (
@@ -81,94 +34,53 @@ export default function GoogleAuthBar() {
         return null;
     }
 
-    if (phase === 'error') {
+    if (phase === 'error' || !user) {
         return null;
     }
 
-    if (user) {
-        const settingsActive =
-            location.pathname === '/settings' || location.pathname.startsWith('/settings/');
-        return (
-            <div className="flex max-w-[min(100vw-6rem,28rem)] flex-wrap items-center justify-end gap-2">
-                <Button
-                    asChild
-                    variant="ghost"
-                    size="icon"
-                    className={cn(
-                        'h-9 w-9 shrink-0 text-slate-600 hover:text-violet-700 hover:bg-violet-50',
-                        settingsActive && 'text-violet-700 bg-violet-50'
-                    )}
-                    title="Settings"
-                    aria-current={settingsActive ? 'page' : undefined}
-                >
-                    <Link to="/settings">
-                        <Settings className="h-5 w-5" aria-hidden />
-                        <span className="sr-only">Settings</span>
-                    </Link>
-                </Button>
-                {user.picture ? (
-                    <img
-                        src={user.picture}
-                        alt=""
-                        className="h-8 w-8 shrink-0 rounded-full border border-slate-200 object-cover"
-                        referrerPolicy="no-referrer"
-                    />
-                ) : null}
-                <span className="hidden min-w-0 truncate text-sm text-slate-600 lg:inline">
-                    {user.name || user.email || 'Signed in'}
-                </span>
-                <Button
-                    type="button"
-                    variant="outline"
-                    size="sm"
-                    className="shrink-0 gap-1"
-                    onClick={logout}
-                    title="Sign out"
-                >
-                    <LogOut className="h-3.5 w-3.5" />
-                    <span className="hidden sm:inline">Sign out</span>
-                </Button>
-            </div>
-        );
-    }
-
-    return (
-        <Button
-            asChild
-            variant="outline"
-            size="sm"
-            className={cn(
-                'shrink-0 gap-2 border-slate-200 bg-white text-slate-800 shadow-sm',
-                'hover:bg-slate-50'
-            )}
-        >
-            <a href={googleHref} className="inline-flex items-center gap-2">
-                <GoogleMark className="h-4 w-4 shrink-0" />
-                <span className="whitespace-nowrap">Sign in with Google</span>
-            </a>
-        </Button>
-    );
-}
+    const settingsActive =
+        location.pathname === '/settings' || location.pathname.startsWith('/settings/');
 
-function GoogleMark({ className }) {
     return (
-        <svg className={className} viewBox="0 0 24 24" aria-hidden>
-            <path
-                fill="#4285F4"
-                d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z"
-            />
-            <path
-                fill="#34A853"
-                d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z"
-            />
-            <path
-                fill="#FBBC05"
-                d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z"
-            />
-            <path
-                fill="#EA4335"
-                d="M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z"
-            />
-        </svg>
+        <div className="flex max-w-[min(100vw-6rem,28rem)] flex-wrap items-center justify-end gap-2">
+            <Button
+                asChild
+                variant="ghost"
+                size="icon"
+                className={cn(
+                    'h-9 w-9 shrink-0 text-slate-600 hover:text-violet-700 hover:bg-violet-50',
+                    settingsActive && 'text-violet-700 bg-violet-50'
+                )}
+                title="Settings"
+                aria-current={settingsActive ? 'page' : undefined}
+            >
+                <Link to="/settings">
+                    <Settings className="h-5 w-5" aria-hidden />
+                    <span className="sr-only">Settings</span>
+                </Link>
+            </Button>
+            {user.picture ? (
+                <img
+                    src={user.picture}
+                    alt=""
+                    className="h-8 w-8 shrink-0 rounded-full border border-slate-200 object-cover"
+                    referrerPolicy="no-referrer"
+                />
+            ) : null}
+            <span className="hidden min-w-0 truncate text-sm text-slate-600 lg:inline">
+                {user.name || user.email || 'Signed in'}
+            </span>
+            <Button
+                type="button"
+                variant="outline"
+                size="sm"
+                className="shrink-0 gap-1"
+                onClick={logout}
+                title="Sign out"
+            >
+                <LogOut className="h-3.5 w-3.5" />
+                <span className="hidden sm:inline">Sign out</span>
+            </Button>
+        </div>
     );
 }

frontend/src/context/AuthContext.jsx

@@ -0,0 +1,62 @@
+import React, {
+    createContext,
+    useCallback,
+    useContext,
+    useEffect,
+    useMemo,
+    useState,
+} from 'react';
+import { apiFetch } from '@/lib/api';
+
+const AuthContext = createContext(null);
+
+export function AuthProvider({ children }) {
+    const [phase, setPhase] = useState('loading');
+    const [googleOn, setGoogleOn] = useState(false);
+    const [user, setUser] = useState(null);
+
+    const refresh = useCallback(async () => {
+        try {
+            const [st, meRes] = await Promise.all([
+                apiFetch('/api/auth/status').then((r) => r.json()),
+                apiFetch('/api/auth/me'),
+            ]);
+            setGoogleOn(!!st.googleConfigured);
+            setUser(meRes.ok ? await meRes.json() : null);
+            setPhase('ready');
+        } catch {
+            setPhase('error');
+        }
+    }, []);
+
+    useEffect(() => {
+        refresh();
+    }, [refresh]);
+
+    useEffect(() => {
+        const onAuth = () => refresh();
+        window.addEventListener('emailout-auth-changed', onAuth);
+        return () => window.removeEventListener('emailout-auth-changed', onAuth);
+    }, [refresh]);
+
+    const value = useMemo(
+        () => ({
+            phase,
+            googleOn,
+            user,
+            signedIn: !!user,
+            refresh,
+        }),
+        [phase, googleOn, user, refresh]
+    );
+
+    return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>;
+}
+
+export function useAuth() {
+    const ctx = useContext(AuthContext);
+    if (!ctx) {
+        throw new Error('useAuth must be used within AuthProvider');
+    }
+    return ctx;
+}

frontend/src/pages/Settings.jsx

@@ -203,10 +203,7 @@ export default function Settings() {
         return (
             <AppShell title="Settings">
                 <div className="rounded-2xl border border-slate-200 bg-white p-8 text-center shadow-sm">
-                    <p className="text-slate-600 mb-4">Sign in to manage workspace settings.</p>
-                    <Button asChild variant="default">
-                        <a href="/api/auth/google">Sign in with Google</a>
-                    </Button>
+                    <p className="text-slate-600">Could not load your profile. Try signing out and back in.</p>
                 </div>
             </AppShell>
         );

frontend/src/pages/SignIn.jsx

@@ -0,0 +1,127 @@
+import React, { useEffect } from 'react';
+import { useSearchParams } from 'react-router-dom';
+import { Loader2, Zap } from 'lucide-react';
+import { Button } from '@/components/ui/button';
+import { cn } from '@/lib/utils';
+import { useAuth } from '@/context/AuthContext';
+
+export default function SignIn() {
+    const { phase, googleOn } = useAuth();
+    const [searchParams, setSearchParams] = useSearchParams();
+
+    useEffect(() => {
+        const err = searchParams.get('auth_error');
+        if (!err) return;
+        if (err === 'access_denied') {
+            console.info('Google sign-in was cancelled.');
+        } else if (err === 'invite_email_mismatch') {
+            console.warn(
+                'Invitation email does not match your Google account. Sign in with the invited address.'
+            );
+        } else {
+            console.warn('Google sign-in error:', err);
+        }
+        const next = new URLSearchParams(searchParams);
+        next.delete('auth_error');
+        setSearchParams(next, { replace: true });
+    }, [searchParams, setSearchParams]);
+
+    const inviteParam = searchParams.get('invite');
+    const googleHref = inviteParam
+        ? `/api/auth/google?invite=${encodeURIComponent(inviteParam)}`
+        : '/api/auth/google';
+
+    if (phase === 'loading') {
+        return (
+            <div className="flex min-h-[100dvh] items-center justify-center bg-gradient-to-br from-slate-50 via-white to-violet-50">
+                <Loader2 className="h-10 w-10 animate-spin text-violet-600" aria-label="Loading" />
+            </div>
+        );
+    }
+
+    if (phase === 'error') {
+        return (
+            <div className="flex min-h-[100dvh] items-center justify-center bg-gradient-to-br from-slate-50 via-white to-violet-50 px-4">
+                <div className="max-w-md rounded-2xl border border-slate-200 bg-white p-8 text-center shadow-sm">
+                    <p className="text-slate-700">Could not reach the server. Refresh and try again.</p>
+                </div>
+            </div>
+        );
+    }
+
+    if (!googleOn) {
+        return (
+            <div className="flex min-h-[100dvh] items-center justify-center bg-gradient-to-br from-slate-50 via-white to-violet-50 px-4">
+                <div className="max-w-md rounded-2xl border border-amber-200 bg-white p-8 text-center shadow-sm">
+                    <p className="font-medium text-slate-800">Google sign-in is not configured</p>
+                    <p className="mt-2 text-sm text-slate-600">
+                        Set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET on the server to enable access.
+                    </p>
+                </div>
+            </div>
+        );
+    }
+
+    return (
+        <div className="flex min-h-[100dvh] flex-col items-center justify-center bg-gradient-to-br from-slate-50 via-white to-violet-50 px-4 py-12">
+            <div className="w-full max-w-md rounded-2xl border border-slate-200 bg-white p-8 shadow-lg shadow-violet-100/50 sm:p-10">
+                <div className="mb-8 flex flex-col items-center text-center">
+                    <div className="mb-4 flex h-14 w-14 items-center justify-center rounded-2xl bg-gradient-to-br from-violet-600 to-purple-600 shadow-lg shadow-violet-200">
+                        <Zap className="h-7 w-7 text-white" aria-hidden />
+                    </div>
+                    <h1 className="text-2xl font-bold text-slate-800">SequenceAI</h1>
+                    <p className="mt-1 text-sm text-slate-500">CRM Workspace</p>
+                </div>
+
+                <p className="mb-6 text-center text-slate-600">
+                    Sign in with your Google account to access campaigns, contacts, leads, and deals.
+                </p>
+
+                {inviteParam ? (
+                    <p className="mb-6 rounded-lg bg-violet-50 px-4 py-3 text-center text-sm text-violet-800">
+                        You have a workspace invitation. Sign in with the email address that received the
+                        invite.
+                    </p>
+                ) : null}
+
+                <Button
+                    asChild
+                    size="lg"
+                    className={cn(
+                        'w-full gap-3 bg-white text-slate-800 border border-slate-200 shadow-sm',
+                        'hover:bg-slate-50'
+                    )}
+                    variant="outline"
+                >
+                    <a href={googleHref} className="inline-flex items-center justify-center gap-3">
+                        <GoogleMark className="h-5 w-5 shrink-0" />
+                        <span>Sign in with Google</span>
+                    </a>
+                </Button>
+            </div>
+        </div>
+    );
+}
+
+function GoogleMark({ className }) {
+    return (
+        <svg className={className} viewBox="0 0 24 24" aria-hidden>
+            <path
+                fill="#4285F4"
+                d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z"
+            />
+            <path
+                fill="#34A853"
+                d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z"
+            />
+            <path
+                fill="#FBBC05"
+                d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z"
+            />
+            <path
+                fill="#EA4335"
+                d="M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z"
+            />
+        </svg>
+    );
+}