refactor(ui): drop the client-side Registry eligibility lease

- Remove the eligibility provider, access boundary, and lease plumbing
- Route access-denied action results straight to the profile page
- Seed the sidebar Registry entry from one server-side evaluation
- Align the e2e fixture with the renamed registry artifacts endpoints

Author: Alan-TheGentleman

ui/actions/registry/registry.test.ts

@@ -24,7 +24,6 @@ import {
   refreshRegistryCollections,
   removeRegistryArtifact,
   refreshRegistryCredential,
-  refreshRegistryEligibility,
   submitRegistryCredential,
 } from "./registry";
 
@@ -92,10 +91,7 @@ const catalogResponse = () =>
 beforeEach(() => {
   vi.stubGlobal("fetch", fetchMock);
   authMock.mockResolvedValue({ accessToken: "access-token" });
-  evaluateAccessMock.mockResolvedValue({
-    status: "eligible",
-    leaseDurationMs: 30_000,
-  });
+  evaluateAccessMock.mockResolvedValue({ status: "eligible" });
   fetchMock.mockReset();
   pollTaskUntilSettledMock.mockReset();
 });
@@ -150,20 +146,6 @@ describe("Registry guarded reads", () => {
     },
   );
 
-  it("returns only the current eligibility result without Registry I/O", async () => {
-    // Given
-    const access = { status: "unknown" } as const;
-    evaluateAccessMock.mockResolvedValue(access);
-
-    // When
-    const result = await refreshRegistryEligibility();
-
-    // Then
-    expect(result).toEqual(access);
-    expect(evaluateAccessMock).toHaveBeenCalledWith("access-token");
-    expect(fetchMock).not.toHaveBeenCalled();
-  });
-
   it("bootstraps in credential, tenant-artifact, providers, then complete-catalog order", async () => {
     // Given
     fetchMock
@@ -176,9 +158,9 @@ describe("Registry guarded reads", () => {
     const result = await getRegistryBootstrap();
 
     // Then
+    expect(result).not.toHaveProperty("leaseDurationMs");
     expect(result).toEqual({
       status: "ready",
-      leaseDurationMs: 30_000,
       state: {
         status: "ready",
         credential: activeCredential,
@@ -229,9 +211,9 @@ describe("Registry guarded reads", () => {
       const result = await getRegistryBootstrap();
 
       // Then
+      expect(result).not.toHaveProperty("leaseDurationMs");
       expect(result).toEqual({
         status: "ready",
-        leaseDurationMs: 30_000,
         state: {
           status: expectedStatus,
           credential,
@@ -369,7 +351,7 @@ describe("Registry guarded reads", () => {
   it("rechecks access between separate actions after permission revocation", async () => {
     // Given
     evaluateAccessMock
-      .mockResolvedValueOnce({ status: "eligible", leaseDurationMs: 30_000 })
+      .mockResolvedValueOnce({ status: "eligible" })
       .mockResolvedValueOnce({ status: "ineligible" });
     fetchMock.mockResolvedValueOnce(credentialResponse());
 

ui/actions/registry/registry.ts

@@ -33,18 +33,16 @@ import {
   RegistryCatalogPageError,
 } from "./registry.adapter";
 
-type GuardedRegistryAccess = { accessToken: string; leaseDurationMs: number };
-
 interface RegistryAddArtifactInput {
   normalizedName: string;
   versionSpec?: string;
 }
 
-async function getRegistryAccess(): Promise<GuardedRegistryAccess | null> {
+async function getRegistryAccess(): Promise<string | null> {
   const accessToken = (await auth())?.accessToken;
   const access = await evaluateRegistryAccess(accessToken);
   return access.status === REGISTRY_ACCESS.ELIGIBLE && accessToken?.trim()
-    ? { accessToken, leaseDurationMs: access.leaseDurationMs }
+    ? accessToken
     : null;
 }
 
@@ -228,54 +226,42 @@ async function confirmRegistryMutation(
 }
 
 function bootstrapReady(
-  access: GuardedRegistryAccess,
   state: RegistryBootstrapState,
 ): RegistryBootstrapResult {
-  return {
-    status: REGISTRY_BOOTSTRAP_STATE.READY,
-    leaseDurationMs: access.leaseDurationMs,
-    state,
-  };
+  return { status: REGISTRY_BOOTSTRAP_STATE.READY, state };
 }
 
 function bootstrapFailure(
-  access: GuardedRegistryAccess,
   failure: RegistryFailureResult,
 ): RegistryBootstrapResult {
   if (failure.status === REGISTRY_FAILURE.ACCESS_DENIED) {
     return { status: REGISTRY_FAILURE.ACCESS_DENIED };
   }
-  return bootstrapReady(access, {
+  return bootstrapReady({
     status:
       failure.status === REGISTRY_FAILURE.ONBOARDING
         ? REGISTRY_BOOTSTRAP_STATE.ERROR
         : failure.status,
   });
 }
 
-export async function refreshRegistryEligibility() {
-  return evaluateRegistryAccess((await auth())?.accessToken);
-}
-
 export async function getRegistryBootstrap(): Promise<RegistryBootstrapResult> {
-  const access = await getRegistryAccess();
-  if (!access) return { status: REGISTRY_FAILURE.ACCESS_DENIED };
+  const accessToken = await getRegistryAccess();
+  if (!accessToken) return { status: REGISTRY_FAILURE.ACCESS_DENIED };
 
-  const credentialRead = await readRegistryCredential(access.accessToken);
+  const credentialRead = await readRegistryCredential(accessToken);
   if (credentialRead.status !== REGISTRY_CREDENTIAL_READ.STATUS) {
-    return bootstrapFailure(access, credentialRead);
+    return bootstrapFailure(credentialRead);
   }
-  const tenantArtifactsRead = await readRegistryTenantArtifacts(
-    access.accessToken,
-  );
+  const tenantArtifactsRead = await readRegistryTenantArtifacts(accessToken);
   if (tenantArtifactsRead.status !== "ready") {
-    return bootstrapFailure(access, tenantArtifactsRead);
+    return bootstrapFailure(tenantArtifactsRead);
   }
 
   const { credential } = credentialRead;
   const { tenantArtifacts } = tenantArtifactsRead;
   if (!hasActiveRegistryCredential(credential)) {
-    return bootstrapReady(access, {
+    return bootstrapReady({
       status: credential.validationPending
         ? REGISTRY_BOOTSTRAP_STATE.VALIDATION_PENDING
         : REGISTRY_BOOTSTRAP_STATE.ONBOARDING,
@@ -284,26 +270,23 @@ export async function getRegistryBootstrap(): Promise<RegistryBootstrapResult> {
     });
   }
 
-  const providers = await readRegistryProviders(access.accessToken, credential);
-  if (providers.status !== "ready") return bootstrapFailure(access, providers);
-  const catalog = await readCompleteRegistryCatalog(
-    access.accessToken,
-    credential,
-  );
+  const providers = await readRegistryProviders(accessToken, credential);
+  if (providers.status !== "ready") return bootstrapFailure(providers);
+  const catalog = await readCompleteRegistryCatalog(accessToken, credential);
   if (catalog.status === REGISTRY_FAILURE.ACCESS_DENIED) {
     return { status: REGISTRY_FAILURE.ACCESS_DENIED };
   }
   if (catalog.status === REGISTRY_CATALOG.INCOMPLETE) {
-    return bootstrapReady(access, {
+    return bootstrapReady({
       status: REGISTRY_BOOTSTRAP_STATE.INCOMPLETE,
       catalog,
     });
   }
   if (catalog.status !== REGISTRY_CATALOG.COMPLETE) {
-    return bootstrapFailure(access, catalog);
+    return bootstrapFailure(catalog);
   }
 
-  return bootstrapReady(access, {
+  return bootstrapReady({
     status: REGISTRY_BOOTSTRAP_STATE.READY,
     credential,
     catalog,
@@ -314,20 +297,18 @@ export async function getRegistryBootstrap(): Promise<RegistryBootstrapResult> {
 export async function refreshRegistryCredential(): Promise<RegistryCredentialReadResult> {
   const access = await getRegistryAccess();
   if (!access) return { status: REGISTRY_FAILURE.ACCESS_DENIED };
-  return readRegistryCredential(access.accessToken);
+  return readRegistryCredential(access);
 }
 
 export async function refreshRegistryCollections(): Promise<RegistryCollectionsResult> {
   const access = await getRegistryAccess();
   if (!access) return { status: REGISTRY_FAILURE.ACCESS_DENIED };
 
-  const providers = await readRegistryProviders(access.accessToken, null);
+  const providers = await readRegistryProviders(access, null);
   if (providers.status !== "ready") return providers;
-  const catalog = await readCompleteRegistryCatalog(access.accessToken, null);
+  const catalog = await readCompleteRegistryCatalog(access, null);
   if (catalog.status !== REGISTRY_CATALOG.COMPLETE) return catalog;
-  const tenantArtifactsRead = await readRegistryTenantArtifacts(
-    access.accessToken,
-  );
+  const tenantArtifactsRead = await readRegistryTenantArtifacts(access);
   return tenantArtifactsRead.status === "ready"
     ? {
         status: REGISTRY_CATALOG.COMPLETE,
@@ -353,7 +334,7 @@ export async function addRegistryArtifact({
       headers: {
         Accept: "application/vnd.api+json",
         "Content-Type": "application/vnd.api+json",
-        Authorization: `Bearer ${access.accessToken}`,
+        Authorization: `Bearer ${access}`,
       },
       body: JSON.stringify({
         data: {
@@ -379,7 +360,7 @@ export async function addRegistryArtifact({
     );
   }
 
-  return confirmRegistryMutation(access.accessToken, normalizedName, true);
+  return confirmRegistryMutation(access, normalizedName, true);
 }
 
 export async function removeRegistryArtifact(
@@ -397,7 +378,7 @@ export async function removeRegistryArtifact(
         cache: "no-store",
         headers: {
           Accept: "application/vnd.api+json",
-          Authorization: `Bearer ${access.accessToken}`,
+          Authorization: `Bearer ${access}`,
         },
       },
     );
@@ -409,7 +390,7 @@ export async function removeRegistryArtifact(
   }
   if (!response.ok) return { status: REGISTRY_FAILURE.ERROR };
 
-  return confirmRegistryMutation(access.accessToken, normalizedName, false);
+  return confirmRegistryMutation(access, normalizedName, false);
 }
 
 export async function submitRegistryCredential(
@@ -418,7 +399,7 @@ export async function submitRegistryCredential(
   const access = await getRegistryAccess();
   if (!access) return { status: REGISTRY_FAILURE.ACCESS_DENIED };
 
-  const priorCredential = await readRegistryCredential(access.accessToken);
+  const priorCredential = await readRegistryCredential(access);
   if (priorCredential.status !== REGISTRY_CREDENTIAL_READ.STATUS) {
     return priorCredential;
   }
@@ -431,7 +412,7 @@ export async function submitRegistryCredential(
       headers: {
         Accept: "application/vnd.api+json",
         "Content-Type": "application/vnd.api+json",
-        Authorization: `Bearer ${access.accessToken}`,
+        Authorization: `Bearer ${access}`,
       },
       body: JSON.stringify({
         data: { type: "registry-credentials", attributes: { api_key: key } },
@@ -448,7 +429,7 @@ export async function submitRegistryCredential(
   const taskCompleted =
     submission.status === "pending" &&
     (await credentialTaskCompleted(submission.taskId));
-  const credential = await readRegistryCredential(access.accessToken);
+  const credential = await readRegistryCredential(access);
   if (credential.status !== REGISTRY_CREDENTIAL_READ.STATUS) return credential;
 
   return credentialActionResult(
@@ -470,7 +451,7 @@ export async function disconnectRegistryCredential(): Promise<RegistryCredential
       cache: "no-store",
       headers: {
         Accept: "application/vnd.api+json",
-        Authorization: `Bearer ${access.accessToken}`,
+        Authorization: `Bearer ${access}`,
       },
     });
   } catch {
@@ -480,8 +461,8 @@ export async function disconnectRegistryCredential(): Promise<RegistryCredential
     return { status: REGISTRY_FAILURE.ACCESS_DENIED };
   }
 
-  const credential = await readRegistryCredential(access.accessToken);
-  const tenantArtifacts = await readRegistryTenantArtifacts(access.accessToken);
+  const credential = await readRegistryCredential(access);
+  const tenantArtifacts = await readRegistryTenantArtifacts(access);
   if (credential.status !== REGISTRY_CREDENTIAL_READ.STATUS) return credential;
   if (tenantArtifacts.status !== "ready") return tenantArtifacts;
   if (!response.ok) return { status: REGISTRY_FAILURE.ERROR };

ui/app/(prowler)/layout.tsx

@@ -6,13 +6,13 @@ import { ReactNode, Suspense } from "react";
 
 import { getProviders } from "@/actions/providers";
 import { getScansByState } from "@/actions/scans/scans";
+import { auth } from "@/auth.config";
 import MainLayout from "@/components/layout/main-layout/main-layout";
 import {
   OnboardingCheckpointWatcher,
   OnboardingGate,
   OnboardingSequenceBanner,
 } from "@/components/onboarding";
-import { RegistryEligibilityProvider } from "@/components/registry/registry-eligibility-provider";
 import { RuntimePublicConfig } from "@/components/runtime-config/runtime-public-config";
 import { NavigationProgress } from "@/components/shadcn/navigation-progress";
 import { Toaster } from "@/components/shadcn/toast";
@@ -21,6 +21,8 @@ import { GlobalSidePanel } from "@/components/side-panel";
 import { FeedbackSurvey } from "@/components/survey/feedback-survey";
 import { fontMono, fontSans } from "@/config/fonts";
 import { siteConfig } from "@/config/site";
+import { REGISTRY_ACCESS } from "@/lib/registry/access";
+import { evaluateRegistryAccess } from "@/lib/registry/access.server";
 import { isCloud } from "@/lib/shared/env";
 import { cn } from "@/lib/utils";
 import { StoreInitializer } from "@/store/ui/store-initializer";
@@ -57,6 +59,13 @@ export default async function RootLayout({
   // Skip Cloud-only onboarding fetches and orchestrators in OSS.
   const cloudEnabled = isCloud();
 
+  // One-time server-side Registry gate per request: only an ELIGIBLE answer
+  // shows the sidebar entry; UNKNOWN and INELIGIBLE both hide it. Started
+  // here so it resolves in parallel with the Cloud onboarding fetches.
+  const registryAccessPromise = auth().then((session) =>
+    evaluateRegistryAccess(session?.accessToken),
+  );
+
   // Fail-open: unknown scan state is treated as "has data" so the banner never blocks
   // progression on a fetch error.
   let hasCompletedScan = true;
@@ -79,6 +88,9 @@ export default async function RootLayout({
       : undefined;
   }
 
+  const registryEligible =
+    (await registryAccessPromise).status === REGISTRY_ACCESS.ELIGIBLE;
+
   return (
     <html suppressHydrationWarning lang="en">
       <head>
@@ -99,7 +111,9 @@ export default async function RootLayout({
             <NavigationProgress />
           </Suspense>
           {/* Store uses boolean; gate receives tri-state to fail open on fetch errors. */}
-          <StoreInitializer values={{ hasProviders: hasProviders ?? false }} />
+          <StoreInitializer
+            values={{ hasProviders: hasProviders ?? false, registryEligible }}
+          />
           {cloudEnabled && (
             <>
               <OnboardingGate hasProviders={hasProviders} />
@@ -109,9 +123,7 @@ export default async function RootLayout({
               <OnboardingSequenceBanner hasCompletedScan={hasCompletedScan} />
             </>
           )}
-          <RegistryEligibilityProvider>
-            <MainLayout>{children}</MainLayout>
-          </RegistryEligibilityProvider>
+          <MainLayout>{children}</MainLayout>
           {cloudEnabled && <FeedbackSurvey />}
           {/* Always mounted: it hosts the detail (finding/resource) views in
               every deployment; the AI tab inside is cloud-gated on its own. */}

ui/app/(prowler)/registry/page.tsx

@@ -1,7 +1,6 @@
 import { redirect } from "next/navigation";
 
 import { getRegistryBootstrap } from "@/actions/registry/registry";
-import { RegistryAccessBoundary } from "@/components/registry/registry-access-boundary";
 import { RegistryExplorer } from "@/components/registry/registry-explorer";
 import { ContentLayout } from "@/components/shadcn/content-layout/content-layout";
 import { REGISTRY_FAILURE } from "@/types/registry";
@@ -14,11 +13,7 @@ export default async function RegistryPage() {
 
   return (
     <ContentLayout title="Registry">
-      <RegistryAccessBoundary
-        initialLeaseDurationMs={bootstrap.leaseDurationMs}
-      >
-        <RegistryExplorer initialState={bootstrap.state} />
-      </RegistryAccessBoundary>
+      <RegistryExplorer initialState={bootstrap.state} />
     </ContentLayout>
   );
 }