feat: add browser auth shell

surfaces/shell/src/host-protocol.ts

@@ -43,8 +43,10 @@ const SEMANTIC_VERSION_PATTERN =
   /^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(?:-(?:(?:0|[1-9][0-9]*|[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9][0-9]*|[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+[0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*)?$/u;
 
 export type HostProtocolErrorCode =
-  /** The caller is not signed in, or lacks `core.modules.ui.read`. */
+  /** The caller is not signed in. */
   | "HOST_UNAUTHENTICATED"
+  /** The caller is signed in but may not read the Dashboard resource. */
+  | "HOST_ACCESS_DENIED"
   /** The API answered, but not with something this shell understands. */
   | "HOST_RESPONSE_INVALID"
   /** The API could not be reached, or failed. */
@@ -61,6 +63,7 @@ export type HostProtocolErrorCode =
   | "DISPLAY_ACCESS_DENIED";
 
 const errorMessages: Readonly<Record<HostProtocolErrorCode, string>> = Object.freeze({
+  HOST_ACCESS_DENIED: "You do not have access to the Ekklesia Dashboard.",
   HOST_REQUEST_FAILED: "Ekklesia could not be reached.",
   HOST_RESPONSE_INVALID: "Ekklesia returned a response this host does not understand.",
   HOST_UNAUTHENTICATED: "You need to sign in to Ekklesia to use this page.",
@@ -460,7 +463,9 @@ export async function loadDashboardNavigation(
   signal?: AbortSignal,
 ): Promise<DashboardNavigation> {
   return parseDashboardNavigation(
-    await requestPlatformJson(config, DASHBOARD_NAVIGATION_PATH, signal),
+    await requestPlatformJson(config, DASHBOARD_NAVIGATION_PATH, signal, {
+      forbidden: "HOST_ACCESS_DENIED",
+    }),
   );
 }