feat(frontend): remove Auth0, make Better Auth the default (Phase 2)

[nhyiramante1]

Summary

Removes Auth0 from the frontend and makes Better Auth the default authentication
path on every real-auth surface (standalone editor + Word task pane), and persists the
device-flow token so sessions survive a page reload. Demo mode is kept (Google Docs runs
in it). Builds on the device flow + manual code-entry already merged in #469.

What changed

Provider collapse

• appAuthContext.tsx: delete the Auth0 adapter and the ?auth=betterauth opt-in gate.
  Better Auth is the default; Demo is used in demo mode. Adapters remain separate
  components (chosen by the selector) to respect the rules of hooks.
• pages/app/index.tsx: remove Auth0Provider; the approval link is a themed button
  calling editorAPI.openExternal; drop the Microsoft/Facebook provider icons (Google only).

EditorAPI decoupled from Auth0

• types.d.ts: replace doLogin/doLogout(auth0Client) with a surface-specific
  openExternal(url).
• wordEditorAPI.ts: delete the Auth0 dialog/popup.html bounce; openExternal uses
  Office.context.ui.openBrowserWindow, guarded so unsupported hosts fail explainably.
• googleDocsEditorAPI.ts: delete dead Auth0 placeholder code (GDocs is demo mode).
• editor/index.tsx, editorContext.tsx: conform to the new interface.

Token persistence (survive refresh)

• authTokenStore.ts (new): guarded localStorage token store (try/catch so embedded
  webviews that block storage degrade to in-memory).
• useDeviceAuth.ts: persist on success, clear on logout/reset, and hydrate-on-mount
  (validate a stored token via /api/protected before forcing a new login).
• authTokenStore.test.ts (new): round-trip + guarded-failure paths.

Auth0 teardown

• Delete popup.tsx/popup.html; remove the popup webpack entry and the AUTH0_*
  DefinePlugin entries from both webpack configs (keep BETTER_AUTH_DEVICE_CLIENT_ID);
  remove @auth0/auth0-react.
• Reword two stale "bypass Auth0" comments; privacy-policy wording updated (see below).

Verification

• tsc, lint, npm test (23/23), npm run build — all green on top of main.
• Manual E2E, both surfaces:
  • Standalone editor (editor.html?page=editor, no query param): Better Auth by
    default → manual code entry + Google account chooser → authenticated; refresh stays
    signed in (persistence); sign-out clears.
  • Word task pane (sideloaded desktop): openBrowserWindow opened the system
    browser, login succeeded, and the session persisted across closing/reopening the
    pane.
  • Demo (?page=demo, Google Docs) unchanged.

Notable details for review

• getAccessToken rejects with an Error that also carries an error property — this
  reconciles authTokenContext's contract (reads e.error) with the
  prefer-promise-reject-errors lint rule.
• No mountedRef: cancellation is driven solely by the AbortController signal; hydration
  commits through the same safeSet guard.
• localStorage token persistence is XSS-exposed, but matches Auth0's prior
  cacheLocation="localstorage" posture, so it doesn't raise the existing risk level.

Non-goals

• Protect the OpenAI route / attach the token to AI requests.
• Change Google Docs or demo behavior beyond removing dead Auth0 code.
• Microsoft/other providers.

Follow-ups (not blockers)

• Privacy policy wording: privacypolicy.html has a TODO(auth) — team should confirm
  the final phrasing for "Google sign-in via Better Auth" and remove the comment.
• Per-code brute-force lockout: low risk at 8-char codes + 4-minute expiry, but the
  right hardening before any broader rollout.
• Auth UI polish: themed taskpane status, branded approval page, and Google
  consent-screen branding — separate pass.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR removes Auth0 from the frontend and makes Better Auth the default authentication flow across real-auth surfaces (standalone editor + Word task pane), adding guarded token persistence so Better Auth sessions survive reloads.

Changes:

• Removed Auth0 frontend integration (providers, popup entrypoint, webpack env defines, dependency removal).
• Introduced a surface-agnostic EditorAPI.openExternal(url) to open the Better Auth approval page appropriately per host.
• Added guarded localStorage token persistence + hydration-on-mount for Better Auth device flow, including unit tests.

Reviewed changes

Copilot reviewed 16 out of 18 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
frontend/webpack.google-docs.config.js	Removes Auth0 DefinePlugin env values from the Google Docs build.
frontend/webpack.config.js	Removes the popup entry + popup HtmlWebpackPlugin and Auth0 env defines.
frontend/src/types.d.ts	Replaces Auth0-specific login/logout API with EditorAPI.openExternal(url).
frontend/src/static/privacypolicy.html	Updates auth-related wording; adds a TODO comment about final phrasing.
frontend/src/popup.tsx	Deletes Auth0 popup bridge implementation.
frontend/src/popup.html	Deletes Auth0 popup HTML entrypoint.
frontend/src/pages/app/index.tsx	Removes Auth0Provider usage; updates device-flow approval UI to use openExternal; removes non-Google provider icons.
frontend/src/index-gdocs.tsx	Updates comments to reflect demo-mode behavior without Auth0 references.
frontend/src/hooks/useDeviceAuth.ts	Adds token persistence + hydration-on-mount with validation via /api/protected.
frontend/src/editor/index.tsx	Removes Auth0 login/logout implementation; adds openExternal for standalone editor.
frontend/src/contexts/editorContext.tsx	Updates the default EditorAPI shape to include openExternal.
frontend/src/contexts/appAuthContext.tsx	Removes Auth0 adapter/opt-in gate; Better Auth becomes default except demo mode.
frontend/src/api/wordEditorAPI.ts	Replaces Auth0 dialog flow with openExternal using Office.context.ui.openBrowserWindow.
frontend/src/api/googleDocsEditorAPI.ts	Removes dead Auth0 placeholder code; provides openExternal implementation.
frontend/src/api/authTokenStore.ts	Adds guarded localStorage token store for Better Auth access tokens.
frontend/src/api/tests/authTokenStore.test.ts	Adds unit tests covering token store round-trip and guarded failure behavior.
frontend/package.json	Removes @auth0/auth0-react dependency.
frontend/package-lock.json	Removes Auth0 packages and transitive deps from lockfile.

Files not reviewed (1)

• frontend/package-lock.json: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.