fix(backend): remove dev auth bypass

Always register auth handlers and use requireSession
regardless of NODE_ENV.

Co-authored-by: Ona <no-reply@ona.com>

apps/aelis-backend/src/engine/http.test.ts

@@ -1,7 +1,7 @@
 import type { ActionDefinition, ContextEntry, FeedItem, FeedSource } from "@aelis/core"
 
 import { contextKey } from "@aelis/core"
-import { describe, expect, test } from "bun:test"
+import { describe, expect, spyOn, test } from "bun:test"
 import { Hono } from "hono"
 
 import { mockAuthSessionMiddleware } from "../auth/session-middleware.ts"
@@ -72,12 +72,12 @@ describe("GET /api/feed", () => {
 			},
 		]
 		const manager = new UserSessionManager({
-			providers: [() => createStubSource("test", items)],
+			providers: [async () => createStubSource("test", items)],
 		})
 		const app = buildTestApp(manager, "user-1")
 
 		// Prime the cache
-		const session = manager.getOrCreate("user-1")
+		const session = await manager.getOrCreate("user-1")
 		await session.engine.refresh()
 		expect(session.engine.lastFeed()).not.toBeNull()
 
@@ -105,7 +105,7 @@ describe("GET /api/feed", () => {
 			},
 		]
 		const manager = new UserSessionManager({
-			providers: [() => createStubSource("test", items)],
+			providers: [async () => createStubSource("test", items)],
 		})
 		const app = buildTestApp(manager, "user-1")
 
@@ -136,7 +136,7 @@ describe("GET /api/feed", () => {
 				throw new Error("connection timeout")
 			},
 		}
-		const manager = new UserSessionManager({ providers: [() => failingSource] })
+		const manager = new UserSessionManager({ providers: [async () => failingSource] })
 		const app = buildTestApp(manager, "user-1")
 
 		const res = await app.request("/api/feed")
@@ -148,6 +148,27 @@ describe("GET /api/feed", () => {
 		expect(body.errors[0]!.sourceId).toBe("failing")
 		expect(body.errors[0]!.error).toBe("connection timeout")
 	})
+
+	test("returns 503 when all providers fail", async () => {
+		const manager = new UserSessionManager({
+			providers: [
+				async () => {
+					throw new Error("provider down")
+				},
+			],
+		})
+		const app = buildTestApp(manager, "user-1")
+
+		const spy = spyOn(console, "error").mockImplementation(() => {})
+
+		const res = await app.request("/api/feed")
+
+		expect(res.status).toBe(503)
+		const body = (await res.json()) as { error: string }
+		expect(body.error).toBe("Service unavailable")
+
+		spy.mockRestore()
+	})
 })
 
 describe("GET /api/context", () => {
@@ -158,12 +179,12 @@ describe("GET /api/context", () => {
 	// The mock auth middleware always injects this hardcoded user ID
 	const mockUserId = "k7Gx2mPqRvNwYs9TdLfA4bHcJeUo1iZn"
 
-	function buildContextApp(userId?: string) {
+	async function buildContextApp(userId?: string) {
 		const manager = new UserSessionManager({
-			providers: [() => createStubSource("weather", [], contextEntries)],
+			providers: [async () => createStubSource("weather", [], contextEntries)],
 		})
 		const app = buildTestApp(manager, userId)
-		const session = manager.getOrCreate(mockUserId)
+		const session = await manager.getOrCreate(mockUserId)
 		return { app, session }
 	}
 
@@ -177,7 +198,7 @@ describe("GET /api/context", () => {
 	})
 
 	test("returns 400 when key param is missing", async () => {
-		const { app } = buildContextApp("user-1")
+		const { app } = await buildContextApp("user-1")
 
 		const res = await app.request("/api/context")
 
@@ -187,7 +208,7 @@ describe("GET /api/context", () => {
 	})
 
 	test("returns 400 when key is invalid JSON", async () => {
-		const { app } = buildContextApp("user-1")
+		const { app } = await buildContextApp("user-1")
 
 		const res = await app.request("/api/context?key=notjson")
 
@@ -197,7 +218,7 @@ describe("GET /api/context", () => {
 	})
 
 	test("returns 400 when key is not an array", async () => {
-		const { app } = buildContextApp("user-1")
+		const { app } = await buildContextApp("user-1")
 
 		const res = await app.request('/api/context?key="string"')
 
@@ -207,7 +228,7 @@ describe("GET /api/context", () => {
 	})
 
 	test("returns 400 when key contains invalid element types", async () => {
-		const { app } = buildContextApp("user-1")
+		const { app } = await buildContextApp("user-1")
 
 		const res = await app.request("/api/context?key=[true,null,[1,2]]")
 
@@ -217,7 +238,7 @@ describe("GET /api/context", () => {
 	})
 
 	test("returns 400 when key is an empty array", async () => {
-		const { app } = buildContextApp("user-1")
+		const { app } = await buildContextApp("user-1")
 
 		const res = await app.request("/api/context?key=[]")
 
@@ -227,7 +248,7 @@ describe("GET /api/context", () => {
 	})
 
 	test("returns 400 when match param is invalid", async () => {
-		const { app } = buildContextApp("user-1")
+		const { app } = await buildContextApp("user-1")
 
 		const res = await app.request('/api/context?key=["aelis.weather"]&match=invalid')
 
@@ -237,7 +258,7 @@ describe("GET /api/context", () => {
 	})
 
 	test("returns exact match with match=exact", async () => {
-		const { app, session } = buildContextApp("user-1")
+		const { app, session } = await buildContextApp("user-1")
 		await session.engine.refresh()
 
 		const res = await app.request('/api/context?key=["aelis.weather","weather"]&match=exact')
@@ -249,7 +270,7 @@ describe("GET /api/context", () => {
 	})
 
 	test("returns 404 with match=exact when only prefix would match", async () => {
-		const { app, session } = buildContextApp("user-1")
+		const { app, session } = await buildContextApp("user-1")
 		await session.engine.refresh()
 
 		const res = await app.request('/api/context?key=["aelis.weather"]&match=exact')
@@ -258,7 +279,7 @@ describe("GET /api/context", () => {
 	})
 
 	test("returns prefix match with match=prefix", async () => {
-		const { app, session } = buildContextApp("user-1")
+		const { app, session } = await buildContextApp("user-1")
 		await session.engine.refresh()
 
 		const res = await app.request('/api/context?key=["aelis.weather"]&match=prefix')
@@ -275,7 +296,7 @@ describe("GET /api/context", () => {
 	})
 
 	test("default mode returns exact match when available", async () => {
-		const { app, session } = buildContextApp("user-1")
+		const { app, session } = await buildContextApp("user-1")
 		await session.engine.refresh()
 
 		const res = await app.request('/api/context?key=["aelis.weather","weather"]')
@@ -287,7 +308,7 @@ describe("GET /api/context", () => {
 	})
 
 	test("default mode falls back to prefix when no exact match", async () => {
-		const { app, session } = buildContextApp("user-1")
+		const { app, session } = await buildContextApp("user-1")
 		await session.engine.refresh()
 
 		const res = await app.request('/api/context?key=["aelis.weather"]')
@@ -303,7 +324,7 @@ describe("GET /api/context", () => {
 	})
 
 	test("returns 404 when neither exact nor prefix matches", async () => {
-		const { app, session } = buildContextApp("user-1")
+		const { app, session } = await buildContextApp("user-1")
 		await session.engine.refresh()
 
 		const res = await app.request('/api/context?key=["nonexistent"]')

apps/aelis-backend/src/engine/http.ts

@@ -33,7 +33,14 @@ export function registerFeedHttpHandlers(
 async function handleGetFeed(c: Context<Env>) {
 	const user = c.get("user")!
 	const sessionManager = c.get("sessionManager")
-	const session = sessionManager.getOrCreate(user.id)
+
+	let session
+	try {
+		session = await sessionManager.getOrCreate(user.id)
+	} catch (err) {
+		console.error("[handleGetFeed] Failed to create session:", err)
+		return c.json({ error: "Service unavailable" }, 503)
+	}
 
 	const feed = await session.feed()
 
@@ -46,7 +53,7 @@ async function handleGetFeed(c: Context<Env>) {
 	})
 }
 
-function handleGetContext(c: Context<Env>) {
+async function handleGetContext(c: Context<Env>) {
 	const keyParam = c.req.query("key")
 	if (!keyParam) {
 		return c.json({ error: 'Invalid or missing "key" parameter: must be a JSON array' }, 400)
@@ -70,7 +77,15 @@ function handleGetContext(c: Context<Env>) {
 
 	const user = c.get("user")!
 	const sessionManager = c.get("sessionManager")
-	const session = sessionManager.getOrCreate(user.id)
+
+	let session
+	try {
+		session = await sessionManager.getOrCreate(user.id)
+	} catch (err) {
+		console.error("[handleGetContext] Failed to create session:", err)
+		return c.json({ error: "Service unavailable" }, 503)
+	}
+
 	const context = session.engine.currentContext()
 	const key = contextKey(...parsed)
 

apps/aelis-backend/src/location/http.ts

@@ -44,7 +44,15 @@ async function handleUpdateLocation(c: Context<Env>) {
 
 	const user = c.get("user")!
 	const sessionManager = c.get("sessionManager")
-	const session = sessionManager.getOrCreate(user.id)
+
+	let session
+	try {
+		session = await sessionManager.getOrCreate(user.id)
+	} catch (err) {
+		console.error("[handleUpdateLocation] Failed to create session:", err)
+		return c.json({ error: "Service unavailable" }, 503)
+	}
+
 	await session.engine.executeAction("aelis.location", "update-location", {
 		lat: result.lat,
 		lng: result.lng,

apps/aelis-backend/src/server.ts

@@ -2,10 +2,10 @@ import { LocationSource } from "@aelis/source-location"
 import { Hono } from "hono"
 
 import { registerAuthHandlers } from "./auth/http.ts"
-import { mockAuthSessionMiddleware, requireSession } from "./auth/session-middleware.ts"
+import { requireSession } from "./auth/session-middleware.ts"
+import { registerFeedHttpHandlers } from "./engine/http.ts"
 import { createFeedEnhancer } from "./enhancement/enhance-feed.ts"
 import { createLlmClient } from "./enhancement/llm-client.ts"
-import { registerFeedHttpHandlers } from "./engine/http.ts"
 import { registerLocationHttpHandlers } from "./location/http.ts"
 import { UserSessionManager } from "./session/index.ts"
 import { WeatherSourceProvider } from "./weather/provider.ts"
@@ -26,7 +26,7 @@ function main() {
 
 	const sessionManager = new UserSessionManager({
 		providers: [
-			() => new LocationSource(),
+			async () => new LocationSource(),
 			new WeatherSourceProvider({
 				credentials: {
 					privateKey: process.env.WEATHERKIT_PRIVATE_KEY!,
@@ -43,16 +43,11 @@ function main() {
 
 	app.get("/health", (c) => c.json({ status: "ok" }))
 
-	const isDev = process.env.NODE_ENV !== "production"
-	const authSessionMiddleware = isDev ? mockAuthSessionMiddleware("dev-user") : requireSession
-
-	if (!isDev) {
-		registerAuthHandlers(app)
-	}
+	registerAuthHandlers(app)
 
 	registerFeedHttpHandlers(app, {
 		sessionManager,
-		authSessionMiddleware,
+		authSessionMiddleware: requireSession,
 	})
 	registerLocationHttpHandlers(app, { sessionManager })
 

apps/aelis-backend/src/session/feed-source-provider.ts

@@ -1,9 +1,9 @@
 import type { FeedSource } from "@aelis/core"
 
 export interface FeedSourceProvider {
-	feedSourceForUser(userId: string): FeedSource
+	feedSourceForUser(userId: string): Promise<FeedSource>
 }
 
-export type FeedSourceProviderFn = (userId: string) => FeedSource
+export type FeedSourceProviderFn = (userId: string) => Promise<FeedSource>
 
 export type FeedSourceProviderInput = FeedSourceProvider | FeedSourceProviderFn

apps/aelis-backend/src/session/user-session-manager.test.ts

@@ -1,7 +1,7 @@
 import type { WeatherKitClient, WeatherKitResponse } from "@aelis/source-weatherkit"
 
 import { LocationSource } from "@aelis/source-location"
-import { describe, expect, mock, test } from "bun:test"
+import { describe, expect, mock, spyOn, test } from "bun:test"
 
 import { WeatherSourceProvider } from "../weather/provider.ts"
 import { UserSessionManager } from "./user-session-manager.ts"
@@ -11,38 +11,38 @@ const mockWeatherClient: WeatherKitClient = {
 }
 
 describe("UserSessionManager", () => {
-	test("getOrCreate creates session on first call", () => {
-		const manager = new UserSessionManager({ providers: [() => new LocationSource()] })
+	test("getOrCreate creates session on first call", async () => {
+		const manager = new UserSessionManager({ providers: [async () => new LocationSource()] })
 
-		const session = manager.getOrCreate("user-1")
+		const session = await manager.getOrCreate("user-1")
 
 		expect(session).toBeDefined()
 		expect(session.engine).toBeDefined()
 	})
 
-	test("getOrCreate returns same session for same user", () => {
-		const manager = new UserSessionManager({ providers: [() => new LocationSource()] })
+	test("getOrCreate returns same session for same user", async () => {
+		const manager = new UserSessionManager({ providers: [async () => new LocationSource()] })
 
-		const session1 = manager.getOrCreate("user-1")
-		const session2 = manager.getOrCreate("user-1")
+		const session1 = await manager.getOrCreate("user-1")
+		const session2 = await manager.getOrCreate("user-1")
 
 		expect(session1).toBe(session2)
 	})
 
-	test("getOrCreate returns different sessions for different users", () => {
-		const manager = new UserSessionManager({ providers: [() => new LocationSource()] })
+	test("getOrCreate returns different sessions for different users", async () => {
+		const manager = new UserSessionManager({ providers: [async () => new LocationSource()] })
 
-		const session1 = manager.getOrCreate("user-1")
-		const session2 = manager.getOrCreate("user-2")
+		const session1 = await manager.getOrCreate("user-1")
+		const session2 = await manager.getOrCreate("user-2")
 
 		expect(session1).not.toBe(session2)
 	})
 
-	test("each user gets independent source instances", () => {
-		const manager = new UserSessionManager({ providers: [() => new LocationSource()] })
+	test("each user gets independent source instances", async () => {
+		const manager = new UserSessionManager({ providers: [async () => new LocationSource()] })
 
-		const session1 = manager.getOrCreate("user-1")
-		const session2 = manager.getOrCreate("user-2")
+		const session1 = await manager.getOrCreate("user-1")
+		const session2 = await manager.getOrCreate("user-2")
 
 		const source1 = session1.getSource<LocationSource>("aelis.location")
 		const source2 = session2.getSource<LocationSource>("aelis.location")
@@ -50,58 +50,58 @@ describe("UserSessionManager", () => {
 		expect(source1).not.toBe(source2)
 	})
 
-	test("remove destroys session and allows re-creation", () => {
-		const manager = new UserSessionManager({ providers: [() => new LocationSource()] })
+	test("remove destroys session and allows re-creation", async () => {
+		const manager = new UserSessionManager({ providers: [async () => new LocationSource()] })
 
-		const session1 = manager.getOrCreate("user-1")
+		const session1 = await manager.getOrCreate("user-1")
 		manager.remove("user-1")
-		const session2 = manager.getOrCreate("user-1")
+		const session2 = await manager.getOrCreate("user-1")
 
 		expect(session1).not.toBe(session2)
 	})
 
 	test("remove is no-op for unknown user", () => {
-		const manager = new UserSessionManager({ providers: [() => new LocationSource()] })
+		const manager = new UserSessionManager({ providers: [async () => new LocationSource()] })
 
 		expect(() => manager.remove("unknown")).not.toThrow()
 	})
 
 	test("accepts function providers", async () => {
-		const manager = new UserSessionManager({ providers: [() => new LocationSource()] })
+		const manager = new UserSessionManager({ providers: [async () => new LocationSource()] })
 
-		const session = manager.getOrCreate("user-1")
+		const session = await manager.getOrCreate("user-1")
 		const result = await session.engine.refresh()
 
 		expect(result.errors).toHaveLength(0)
 	})
 
-	test("accepts object providers", () => {
+	test("accepts object providers", async () => {
 		const provider = new WeatherSourceProvider({ client: mockWeatherClient })
 		const manager = new UserSessionManager({
-			providers: [() => new LocationSource(), provider],
+			providers: [async () => new LocationSource(), provider],
 		})
 
-		const session = manager.getOrCreate("user-1")
+		const session = await manager.getOrCreate("user-1")
 
 		expect(session.getSource("aelis.weather")).toBeDefined()
 	})
 
-	test("accepts mixed providers", () => {
+	test("accepts mixed providers", async () => {
 		const provider = new WeatherSourceProvider({ client: mockWeatherClient })
 		const manager = new UserSessionManager({
-			providers: [() => new LocationSource(), provider],
+			providers: [async () => new LocationSource(), provider],
 		})
 
-		const session = manager.getOrCreate("user-1")
+		const session = await manager.getOrCreate("user-1")
 
 		expect(session.getSource("aelis.location")).toBeDefined()
 		expect(session.getSource("aelis.weather")).toBeDefined()
 	})
 
 	test("refresh returns feed result through session", async () => {
-		const manager = new UserSessionManager({ providers: [() => new LocationSource()] })
+		const manager = new UserSessionManager({ providers: [async () => new LocationSource()] })
 
-		const session = manager.getOrCreate("user-1")
+		const session = await manager.getOrCreate("user-1")
 		const result = await session.engine.refresh()
 
 		expect(result).toHaveProperty("context")
@@ -111,9 +111,9 @@ describe("UserSessionManager", () => {
 	})
 
 	test("location update via executeAction works", async () => {
-		const manager = new UserSessionManager({ providers: [() => new LocationSource()] })
+		const manager = new UserSessionManager({ providers: [async () => new LocationSource()] })
 
-		const session = manager.getOrCreate("user-1")
+		const session = await manager.getOrCreate("user-1")
 		await session.engine.executeAction("aelis.location", "update-location", {
 			lat: 51.5074,
 			lng: -0.1278,
@@ -126,10 +126,10 @@ describe("UserSessionManager", () => {
 	})
 
 	test("subscribe receives updates after location push", async () => {
-		const manager = new UserSessionManager({ providers: [() => new LocationSource()] })
+		const manager = new UserSessionManager({ providers: [async () => new LocationSource()] })
 		const callback = mock()
 
-		const session = manager.getOrCreate("user-1")
+		const session = await manager.getOrCreate("user-1")
 		session.engine.subscribe(callback)
 
 		await session.engine.executeAction("aelis.location", "update-location", {
@@ -146,16 +146,16 @@ describe("UserSessionManager", () => {
 	})
 
 	test("remove stops reactive updates", async () => {
-		const manager = new UserSessionManager({ providers: [() => new LocationSource()] })
+		const manager = new UserSessionManager({ providers: [async () => new LocationSource()] })
 		const callback = mock()
 
-		const session = manager.getOrCreate("user-1")
+		const session = await manager.getOrCreate("user-1")
 		session.engine.subscribe(callback)
 
 		manager.remove("user-1")
 
 		// Create new session and push location — old callback should not fire
-		const session2 = manager.getOrCreate("user-1")
+		const session2 = await manager.getOrCreate("user-1")
 		await session2.engine.executeAction("aelis.location", "update-location", {
 			lat: 51.5074,
 			lng: -0.1278,
@@ -167,4 +167,93 @@ describe("UserSessionManager", () => {
 
 		expect(callback).not.toHaveBeenCalled()
 	})
+
+	test("creates session with successful providers when some fail", async () => {
+		const manager = new UserSessionManager({
+			providers: [
+				async () => new LocationSource(),
+				async () => {
+					throw new Error("provider failed")
+				},
+			],
+		})
+
+		const spy = spyOn(console, "error").mockImplementation(() => {})
+
+		const session = await manager.getOrCreate("user-1")
+
+		expect(session).toBeDefined()
+		expect(session.getSource("aelis.location")).toBeDefined()
+		expect(spy).toHaveBeenCalled()
+
+		spy.mockRestore()
+	})
+
+	test("throws AggregateError when all providers fail", async () => {
+		const manager = new UserSessionManager({
+			providers: [
+				async () => {
+					throw new Error("first failed")
+				},
+				async () => {
+					throw new Error("second failed")
+				},
+			],
+		})
+
+		await expect(manager.getOrCreate("user-1")).rejects.toBeInstanceOf(AggregateError)
+	})
+
+	test("concurrent getOrCreate for same user returns same session", async () => {
+		let callCount = 0
+		const manager = new UserSessionManager({
+			providers: [
+				async () => {
+					callCount++
+					// Simulate async work to widen the race window
+					await new Promise((resolve) => setTimeout(resolve, 10))
+					return new LocationSource()
+				},
+			],
+		})
+
+		const [session1, session2] = await Promise.all([
+			manager.getOrCreate("user-1"),
+			manager.getOrCreate("user-1"),
+		])
+
+		expect(session1).toBe(session2)
+		expect(callCount).toBe(1)
+	})
+
+	test("remove during in-flight getOrCreate prevents session from being stored", async () => {
+		let resolveProvider: () => void
+		const providerGate = new Promise<void>((r) => {
+			resolveProvider = r
+		})
+
+		const manager = new UserSessionManager({
+			providers: [
+				async () => {
+					await providerGate
+					return new LocationSource()
+				},
+			],
+		})
+
+		const sessionPromise = manager.getOrCreate("user-1")
+
+		// remove() while provider is still resolving
+		manager.remove("user-1")
+
+		// Let the provider finish
+		resolveProvider!()
+
+		await expect(sessionPromise).rejects.toThrow("removed during creation")
+
+		// A fresh getOrCreate should produce a new session, not the cancelled one
+		const freshSession = await manager.getOrCreate("user-1")
+		expect(freshSession).toBeDefined()
+		expect(freshSession.engine).toBeDefined()
+	})
 })

apps/aelis-backend/src/session/user-session-manager.ts

@@ -1,3 +1,5 @@
+import type { FeedSource } from "@aelis/core"
+
 import type { FeedEnhancer } from "../enhancement/enhance-feed.ts"
 import type { FeedSourceProviderInput } from "./feed-source-provider.ts"
 
@@ -10,6 +12,7 @@ export interface UserSessionManagerConfig {
 
 export class UserSessionManager {
 	private sessions = new Map<string, UserSession>()
+	private pending = new Map<string, Promise<UserSession>>()
 	private readonly providers: FeedSourceProviderInput[]
 	private readonly feedEnhancer: FeedEnhancer | null
 
@@ -18,16 +21,28 @@ export class UserSessionManager {
 		this.feedEnhancer = config.feedEnhancer ?? null
 	}
 
-	getOrCreate(userId: string): UserSession {
-		let session = this.sessions.get(userId)
-		if (!session) {
-			const sources = this.providers.map((p) =>
-				typeof p === "function" ? p(userId) : p.feedSourceForUser(userId),
-			)
-			session = new UserSession(sources, this.feedEnhancer)
+	async getOrCreate(userId: string): Promise<UserSession> {
+		const existing = this.sessions.get(userId)
+		if (existing) return existing
+
+		const inflight = this.pending.get(userId)
+		if (inflight) return inflight
+
+		const promise = this.createSession(userId)
+		this.pending.set(userId, promise)
+		try {
+			const session = await promise
+			// If remove() was called while we were awaiting, it clears the
+			// pending entry. Detect that and destroy the session immediately.
+			if (!this.pending.has(userId)) {
+				session.destroy()
+				throw new Error(`Session for user ${userId} was removed during creation`)
+			}
 			this.sessions.set(userId, session)
+			return session
+		} finally {
+			this.pending.delete(userId)
 		}
-		return session
 	}
 
 	remove(userId: string): void {
@@ -36,5 +51,36 @@ export class UserSessionManager {
 			session.destroy()
 			this.sessions.delete(userId)
 		}
+		// Cancel any in-flight creation so getOrCreate won't store the session
+		this.pending.delete(userId)
+	}
+
+	private async createSession(userId: string): Promise<UserSession> {
+		const results = await Promise.allSettled(
+			this.providers.map((p) =>
+				typeof p === "function" ? p(userId) : p.feedSourceForUser(userId),
+			),
+		)
+
+		const sources: FeedSource[] = []
+		const errors: unknown[] = []
+
+		for (const result of results) {
+			if (result.status === "fulfilled") {
+				sources.push(result.value)
+			} else {
+				errors.push(result.reason)
+			}
+		}
+
+		if (sources.length === 0 && errors.length > 0) {
+			throw new AggregateError(errors, "All feed source providers failed")
+		}
+
+		for (const error of errors) {
+			console.error("[UserSessionManager] Feed source provider failed:", error)
+		}
+
+		return new UserSession(sources, this.feedEnhancer)
 	}
 }

apps/aelis-backend/src/tfl/provider.ts

@@ -13,7 +13,7 @@ export class TflSourceProvider implements FeedSourceProvider {
 		this.options = options
 	}
 
-	feedSourceForUser(_userId: string): TflSource {
+	async feedSourceForUser(_userId: string): Promise<TflSource> {
 		return new TflSource(this.options)
 	}
 }

apps/aelis-backend/src/weather/provider.ts

@@ -9,7 +9,7 @@ export class WeatherSourceProvider implements FeedSourceProvider {
 		this.options = options
 	}
 
-	feedSourceForUser(_userId: string): WeatherSource {
+	async feedSourceForUser(_userId: string): Promise<WeatherSource> {
 		return new WeatherSource(this.options)
 	}
 }

apps/aelis-client/package.json

@@ -22,6 +22,7 @@
 		"@react-navigation/bottom-tabs": "^7.4.0",
 		"@react-navigation/elements": "^2.6.3",
 		"@react-navigation/native": "^7.1.8",
+		"@tanstack/react-query": "^5.90.21",
 		"expo": "~54.0.33",
 		"expo-constants": "~18.0.13",
 		"expo-dev-client": "~6.0.20",

apps/aelis-client/src/api/auth-middleware.ts

@@ -0,0 +1,6 @@
+import { ApiRequestMiddleware } from "./client"
+
+export const authMiddleware: ApiRequestMiddleware = (_url, init) => {
+	// TODO: placeholder auth middleware
+	return init
+}

apps/aelis-client/src/api/client.ts

@@ -0,0 +1,39 @@
+import { createContext, useContext } from "react"
+
+export type ApiRequestMiddleware = (
+	url: Parameters<typeof fetch>[0],
+	init: RequestInit,
+) => RequestInit
+
+export class ApiClient {
+	private readonly baseUrl: string
+	private readonly middlewares: readonly ApiRequestMiddleware[]
+
+	static noop = new ApiClient({ baseUrl: "" })
+
+	constructor({
+		baseUrl,
+		middlewares = [],
+	}: {
+		baseUrl: string
+		middlewares?: ApiRequestMiddleware[]
+	}) {
+		this.baseUrl = baseUrl
+		this.middlewares = middlewares
+	}
+
+	async request<T>(...[url, init = {}]: Parameters<typeof fetch>): Promise<[Response, T]> {
+		const finalInit = this.middlewares.reduce(
+			(prevInit, middleware) => middleware(url, prevInit),
+			init,
+		)
+		return fetch(this.baseUrl ? new URL(url.toString(), this.baseUrl) : url, finalInit).then((res) =>
+			Promise.all([Promise.resolve(res), res.json()]),
+		)
+	}
+}
+
+export const ApiClientContext = createContext(ApiClient.noop)
+export function useApiClient() {
+	return useContext(ApiClientContext)
+}

apps/aelis-client/src/app/_layout.tsx

@@ -1,17 +1,29 @@
 import "react-native-reanimated"
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query"
 import { Stack } from "expo-router"
 import { StatusBar } from "expo-status-bar"
+import React from "react"
 import { useColorScheme } from "react-native"
 import tw, { useDeviceContext } from "twrnc"
 
+import { authMiddleware } from "@/api/auth-middleware"
+import { ApiClient, ApiClientContext } from "@/api/client"
+
+const queryClient = new QueryClient()
+const apiClient = new ApiClient({
+	baseUrl: process.env.EXPO_PUBLIC_API_BASE_URL ?? "",
+	middlewares: [authMiddleware],
+})
+
 export default function RootLayout() {
 	useDeviceContext(tw)
+
 	const colorScheme = useColorScheme()
 	const headerBg = colorScheme === "dark" ? "#1c1917" : "#f5f5f4"
 	const headerTint = colorScheme === "dark" ? "#e7e5e4" : "#1c1917"
 
 	return (
-		<>
+		<ContextProvider>
 			<Stack
 				screenOptions={{
 					headerShown: false,
@@ -40,6 +52,14 @@ export default function RootLayout() {
 				/>
 			</Stack>
 			<StatusBar style="auto" />
-		</>
+		</ContextProvider>
+	)
+}
+
+function ContextProvider({ children }: React.PropsWithChildren) {
+	return (
+		<QueryClientProvider client={queryClient}>
+			<ApiClientContext value={apiClient}>{children}</ApiClientContext>
+		</QueryClientProvider>
 	)
 }

apps/aelis-client/src/feed/queries.ts

@@ -0,0 +1,13 @@
+import { queryOptions } from "@tanstack/react-query"
+
+import { useApiClient } from "@/api/client"
+
+import { FeedItem } from "./types"
+
+export function useFeedQuery() {
+	const api = useApiClient()
+	return queryOptions({
+		queryKey: ["feed"],
+		queryFn: async () => api.request<{ items: FeedItem[] }>("/feed?render=json-render"),
+	})
+}

apps/aelis-client/src/feed/types.ts

@@ -0,0 +1,5 @@
+import { Spec } from "@json-render/core"
+
+export interface FeedItem {
+	ui: Spec
+}

bun.lock

@@ -46,6 +46,7 @@
         "@react-navigation/bottom-tabs": "^7.4.0",
         "@react-navigation/elements": "^2.6.3",
         "@react-navigation/native": "^7.1.8",
+        "@tanstack/react-query": "^5.90.21",
         "expo": "~54.0.33",
         "expo-constants": "~18.0.13",
         "expo-dev-client": "~6.0.20",
@@ -1189,6 +1190,10 @@
 
     "@tailwindcss/vite": ["@tailwindcss/vite@4.2.1", "", { "dependencies": { "@tailwindcss/node": "4.2.1", "@tailwindcss/oxide": "4.2.1", "tailwindcss": "4.2.1" }, "peerDependencies": { "vite": "^5.2.0 || ^6 || ^7" } }, "sha512-TBf2sJjYeb28jD2U/OhwdW0bbOsxkWPwQ7SrqGf9sVcoYwZj7rkXljroBO9wKBut9XnmQLXanuDUeqQK0lGg/w=="],
 
+    "@tanstack/query-core": ["@tanstack/query-core@5.90.20", "", {}, "sha512-OMD2HLpNouXEfZJWcKeVKUgQ5n+n3A2JFmBaScpNDUqSrQSjiveC7dKMe53uJUg1nDG16ttFPz2xfilz6i2uVg=="],
+
+    "@tanstack/react-query": ["@tanstack/react-query@5.90.21", "", { "dependencies": { "@tanstack/query-core": "5.90.20" }, "peerDependencies": { "react": "^18 || ^19" } }, "sha512-0Lu6y5t+tvlTJMTO7oh5NSpJfpg/5D41LlThfepTixPYkJ0sE2Jj0m0f6yYqujBwIXlId87e234+MxG3D3g7kg=="],
+
     "@tsconfig/node10": ["@tsconfig/node10@1.0.12", "", {}, "sha512-UCYBaeFvM11aU2y3YPZ//O5Rhj+xKyzy7mvcIoAjASbigy8mHMryP5cK7dgjlz2hWxh1g5pLw084E0a/wlUSFQ=="],
 
     "@tsconfig/node12": ["@tsconfig/node12@1.0.11", "", {}, "sha512-cqefuRsh12pWyGsIoBKJA9luFu3mRxCA+ORZvA4ktLSzIuCUtWVxGIuXigEwO5/ywWFMZ2QEGKWvkZG1zDMTag=="],