setup-flows-auth

Wires a React app for Cognite Flows authentication so it can talk to CDF inside Fusion, intended for migrating an existing React app to Flows or for cases where no Flows auth is yet in place. It is a no-op when a valid auth setup already exists. Two distinct flows are supported and selected from the app.json infra field: the Apps API flow (the new Fusion app host) uses connectToHostApp from @cognite/app-sdk, while the Classic flow (legacy Files API) uses DuneAuthProvider and useDune() from @cognite/dune. When app.json is absent, the skill asks the user and defaults to Apps API, since that is the default for the Cognite CLI's apps create command.

The workflow first reads package.json, the entry file (src/main.tsx or src/index.tsx), vite.config.ts, and app.json to decide whether to act, treating the setup as already valid if DuneAuthProvider wraps the app in the Classic case, or if CogniteSdkProvider from @cognite/app-sdk/react wraps the app and components consume it via useCogniteSdk() in the Apps API case (requiring @cognite/app-sdk >= 0.5.1). It detects the package manager from the lock file and installs only missing dependencies: for Classic, @cognite/dune, @cognite/sdk, @tanstack/react-query, and the dev dependency vite-plugin-mkcert; for Apps API, @cognite/app-sdk in place of @cognite/dune plus the same others. The Vite config is then augmented without removing existing plugins, adding base: "./" for iframe deployment, mkcert() for HTTPS, fusionOpenPlugin() to open the dev URL inside Fusion, and, for Apps API only, manifestCspPlugin() which must be listed first so it can set the CSP header before any HTML response.

Entry-file wiring differs by flow. The Classic flow wraps App in DuneAuthProvider inside a QueryClientProvider and consumes the authenticated CogniteClient via useDune(). The Apps API flow does not wrap main.tsx in an auth provider; instead App.tsx uses CogniteSdkProvider (which handles the Comlink handshake plus loading and error states via loadingFallback and errorFallback props) and nested components read the client through useCogniteSdk(), which throws if called outside the provider. A final cleanup step removes superseded code such as custom CDF auth providers, manual CogniteClient instantiation, OIDC token-management code, and CDF environment variables, since Flows and the host provide those, flagging anything uncertain to the user rather than deleting it.