@jskit-ai/auth-web 0.1.196 → 0.1.198

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/auth-web",
-  "version": "0.1.196",
+  "version": "0.1.198",
   "type": "module",
   "scripts": {
     "test": "node --test"
@@ -25,10 +25,10 @@
     "@mdi/js": "^7.4.47"
   },
   "peerDependencies": {
-    "@jskit-ai/auth-core": "0.1.194",
-    "@jskit-ai/http-runtime": "0.1.194",
-    "@jskit-ai/kernel": "0.1.196",
-    "@jskit-ai/shell-web": "0.1.200",
+    "@jskit-ai/auth-core": "0.1.196",
+    "@jskit-ai/http-runtime": "0.1.196",
+    "@jskit-ai/kernel": "0.1.198",
+    "@jskit-ai/shell-web": "0.1.202",
     "@tanstack/vue-query": "^5.90.5",
     "pinia": "^3.0.4",
     "vue": "^3.5.13",

package/patterns/auth-surface/PATTERN.md

@@ -60,6 +60,10 @@ a user as a side effect.
 - Public auth routes do not require an existing session.
 - Protected routes use the framework auth policy rather than page-local checks.
 - Login, sign-out, and reset views use the public auth components/composables.
+- A custom login view must preserve the default view's initial session check:
+  already authenticated people return to the validated requested destination.
+  Process incoming login callbacks before that redirect, and keep signed-out
+  people on the login form. This also covers managed preview identity changes.
 - Profile placements are conditional on the current authenticated state.
 - Transient mutation failures use the application toast; initial load failures
   remain in the affected surface.
@@ -81,6 +85,8 @@ placements, and post-auth destinations while retaining the runtime contracts.
 
 Exercise failed and successful login, sign-out, reset, protected navigation,
 keyboard interaction, warm-cache return navigation, and browser refresh.
+Open the login route with an existing authenticated session and confirm it
+returns to the requested screen; repeat signed out and confirm the form remains.
 
 ## Avoid
 

package/test/loginViewActions.test.js

@@ -55,6 +55,44 @@ function createMinimalLoginViewState(requestedReturnTo = "/") {
   };
 }
 
+for (const authenticated of [true, false]) {
+  test(`login initialization ${authenticated ? "redirects an existing session" : "keeps the signed-out form"}`, async (t) => {
+    const state = createMinimalLoginViewState("/w/acme/bookings?date=2026-09-16");
+    const destinations = [];
+    const originalWindow = globalThis.window;
+    globalThis.window = {
+      location: {
+        href: "https://example.com/auth/login",
+        replace: (path) => destinations.push(path)
+      }
+    };
+    t.after(() => {
+      if (originalWindow === undefined) delete globalThis.window;
+      else globalThis.window = originalWindow;
+      clearAuthCsrfTokenCache();
+    });
+    const fetch = t.mock.method(globalThis, "fetch", async (url) => {
+      assert.equal(url, "/api/session");
+      return createJsonResponse({ authenticated, csrfToken: "csrf-session" });
+    });
+    const actions = useLoginViewActions({
+      state,
+      validation: {},
+      queryClient: {
+        fetchQuery: ({ queryFn }) => queryFn()
+      },
+      errorRuntime: { report: (entry) => assert.fail(entry.message) }
+    });
+
+    await actions.initializeOnMounted();
+
+    assert.equal(fetch.mock.callCount(), 1);
+    assert.deepEqual(destinations, authenticated ? [state.requestedReturnTo.value] : []);
+    assert.equal(state.loading.value, false);
+    assert.equal(state.errorMessage.value, "");
+  });
+}
+
 test("useLoginViewActions preserves the intended destination when starting OAuth sign-in", () => {
   const state = createMinimalLoginViewState("/w/acme/workouts/2026-05-07?tab=chart");
   const assignedTargets = [];