@swiss-ai-hub/web 0.291.7 → 0.291.8

package/app.vue

@@ -3,6 +3,12 @@
     <NuxtPage />
     <Toast />
     <ConfirmDialog />
+    <div
+      v-if="homeResolving"
+      class="fixed inset-0 z-50 flex items-center justify-center bg-white dark:bg-surface-900"
+    >
+      <ProgressSpinner />
+    </div>
   </NuxtLayout>
 </template>
 
@@ -17,6 +23,10 @@ const localePath = useLocalePath()
 const route = useRoute()
 const toast = useToast()
 useNotificationPoller()
+
+// Overlay lives at the root, not the page: the home-redirect middleware
+// redirects before any page mounts, so the page can't show it.
+const homeResolving = useHomeResolving()
 client.setConfig({
   baseURL: '/api/v1',
   auth: async () => {

package/composables/useHomeResolving.ts

@@ -0,0 +1,2 @@
+// useState, not createSharedComposable: the writer is a route middleware, not a component.
+export const useHomeResolving = () => useState<boolean>('home-resolving', () => false)

package/middleware/auth.global.ts

@@ -40,6 +40,7 @@ export default defineNuxtRouteMiddleware(async (to) => {
         await $auth.signinSilent()
       }
       catch {
+        await $auth.removeUser()
         if (import.meta.client && to.fullPath !== '/' && !isAuthPath) {
           sessionStorage.setItem(REDIRECT_KEY, to.fullPath)
         }

package/middleware/home-redirect.ts

@@ -0,0 +1,30 @@
+import { getMyTenants } from '@core/sdk/client'
+
+import { useLocalePath } from '#i18n'
+
+const REDIRECT_KEY = 'aihub_redirect_after_login'
+
+// Redirect runs in the guard pipeline, not the page: a page-component redirect
+// here can be dropped by an in-flight navigation.
+export default defineNuxtRouteMiddleware(async () => {
+  useHomeResolving().value = true
+
+  const localePath = useLocalePath()
+
+  const response = await getMyTenants({ composable: '$fetch' }).catch(() => null)
+  const tenants = response?.tenants ?? []
+  if (!tenants.length) {
+    return
+  }
+
+  const storedRedirect = sessionStorage.getItem(REDIRECT_KEY)
+  sessionStorage.removeItem(REDIRECT_KEY)
+
+  if (storedRedirect && storedRedirect !== '/') {
+    return navigateTo(storedRedirect, { replace: true })
+  }
+  if (tenants.length === 1) {
+    return navigateTo(localePath(`/${tenants[0].id}/service/openai`), { replace: true })
+  }
+  return navigateTo(localePath('/select-tenant'), { replace: true })
+})

package/package.json

@@ -3,7 +3,7 @@
   "license": "AGPL-3.0-or-later",
   "author": "bbv Software Services AG (https://www.bbv.ch)",
   "type": "module",
-  "version": "0.291.7",
+  "version": "0.291.8",
   "description": "Swiss AI Hub - Admin & Management UI (Nuxt 3 layer)",
   "main": "./nuxt.config.ts",
   "repository": {

package/pages/index.vue

@@ -1,10 +1,6 @@
 <template>
   <div class="flex h-screen items-center justify-center">
-    <ProgressSpinner v-if="tenantsAreLoading" />
-    <div
-      v-else-if="!tenants?.length"
-      class="text-center"
-    >
+    <div class="text-center">
       <h1 class="mb-4 text-2xl font-bold">
         {{ t('tenant.no_tenant_title') }}
       </h1>
@@ -16,44 +12,8 @@
 </template>
 
 <script setup lang="ts">
-import { getMyTenants } from '@core/sdk/client'
-
-const REDIRECT_KEY = 'aihub_redirect_after_login'
+// Shown only when the user has no tenants; home-redirect middleware redirects otherwise.
+definePageMeta({ middleware: 'home-redirect' })
 
 const { t } = useI18n()
-const localePath = useLocalePath()
-
-const tenantsAreLoading = ref(true)
-const tenants = ref<{ id: string }[] | null>(null)
-
-onMounted(async () => {
-  try {
-    const response = await getMyTenants({ composable: '$fetch' })
-    tenants.value = response.tenants
-
-    if (!response.tenants?.length) {
-      tenantsAreLoading.value = false
-      return
-    }
-
-    const storedRedirect = sessionStorage.getItem(REDIRECT_KEY)
-    sessionStorage.removeItem(REDIRECT_KEY)
-
-    if (storedRedirect && storedRedirect !== '/') {
-      await navigateTo(storedRedirect, { replace: true })
-      return
-    }
-
-    if (response.tenants.length === 1) {
-      const tenant = response.tenants[0]
-      await navigateTo(localePath(`/${tenant.id}/service/openai`), { replace: true })
-      return
-    }
-
-    await navigateTo(localePath('/select-tenant'), { replace: true })
-  }
-  catch {
-    tenantsAreLoading.value = false
-  }
-})
 </script>

package/plugins/home-resolving.client.ts

@@ -0,0 +1,13 @@
+// In a plugin, not app.vue, so afterEach registers before the initial navigation
+// — otherwise a full load landing on the home route never clears the flag.
+export default defineNuxtPlugin(() => {
+  const router = useRouter()
+  const homeResolving = useHomeResolving()
+
+  router.afterEach(() => {
+    homeResolving.value = false
+  })
+  router.onError(() => {
+    homeResolving.value = false
+  })
+})

package/plugins/oidc-client.ts

@@ -40,35 +40,17 @@ export default defineNuxtPlugin(async ({ $i18n, $router }) => {
     $router.push(`/${locale}/auth/login`)
   })
 
-  auth.events.addSilentRenewError((error) => {
+  auth.events.addSilentRenewError(async (error) => {
     console.error('Silent renew error:', error)
-    // The refresh token is rejected (typically: Keycloak invalidated it).
-    // Without a working renew path, the SDK starts sending unauthenticated
-    // requests on the next navigation — surfacing as 401s downstream. Send
-    // the user to the login page now so they re-auth in place.
+    // Refresh token rejected (e.g. Keycloak invalidated it): drop the dead
+    // session before redirecting so it is not reused.
+    await auth.removeUser()
     const locale = $i18n.locale.value
     $router.push(`/${locale}/auth/login`)
   })
 
-  // Check for user session on startup
-  try {
-    const user = await auth.getUser()
-    if (user && !user.expired) {
-      console.log('User already logged in')
-    }
-    else if (user?.expired) {
-      console.log('User session expired, attempting renewal')
-      try {
-        await auth.signinSilent()
-      }
-      catch (e) {
-        console.error('Failed to renew session:', e)
-      }
-    }
-  }
-  catch (e) {
-    console.error('Error checking initial user state:', e)
-  }
+  // Session renewal is handled per-navigation by middleware/auth.global.ts;
+  // intentionally not done here (it would block app bootstrap).
 
   return {
     provide: {