adminforth 3.24.4 → 3.24.6

package/dist/spa/src/App.vue

@@ -286,7 +286,14 @@ async function loadConfig() {
   publicConfigLoaded.value = true;
 
   await initRouter();
-  if (resp && !resp.loggedIn && route.meta.sidebarAndHeader !== 'none') {
+  if (resp?.loggedIn) {
+    // the flag the login route guard reads is only ever set by a login, so a 401 can leave it
+    // saying "signed out" for a session the server still honours
+    userStore.authorize();
+    if (route.name === 'login') {
+      await router.replace(route.query.next?.toString() || { name: 'home' });
+    }
+  } else if (resp && route.meta.sidebarAndHeader !== 'none') {
     // for custom layouts we don't force login, they are allowed to be rendered for anonymous user
     await handleNotAuthorized();
   }

package/dist/spa/src/utils/session.ts

@@ -0,0 +1,31 @@
+// The auth cookie is HttpOnly, so the server is the only place that knows whether a session is live.
+export async function hasLiveSession(): Promise<boolean> {
+  const baseUrl = (import.meta as any).env?.VITE_ADMINFORTH_PUBLIC_PATH || '';
+  try {
+    const response = await fetch(`${baseUrl}/adminapi/v1/check_auth`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: '{}',
+      signal: AbortSignal.timeout(5000),
+    });
+    if (response.status !== 200) {
+      return false;
+    }
+    // a proxy or captive portal can answer 200 with its own page, so the body has to say so too
+    return (await response.json().catch(() => null))?.ok === true;
+  } catch {
+    return false;
+  }
+}
+
+let inFlight: Promise<boolean> | null = null;
+
+/** A 401 can be transient while the cookie is still good. Only worth asking if we thought we were signed in. */
+export async function sessionSurvives401(): Promise<boolean> {
+  if (localStorage.getItem('isAuthorized') !== 'true') {
+    return false;
+  }
+  // an outage 401s every call on the page at once, and they all want the same answer
+  inFlight ??= hasLiveSession().finally(() => { inFlight = null; });
+  return inFlight;
+}

package/dist/spa/src/utils/utils.ts

@@ -14,6 +14,7 @@ import { useI18n } from 'vue-i18n';
 import { onBeforeRouteLeave } from 'vue-router';
 import { reconnect } from '@/websocket';
 import { ADMINFORTH_CLIENT_ID_HEADER, getAdminForthClientId } from './clientId';
+import { sessionSurvives401 } from './session';
 
 
 
@@ -103,10 +104,16 @@ async function tryAutologin(autologin: string): Promise<boolean> {
   return !!coreStore.adminUser;
 }
 
-export async function handleNotAuthorized() {
+/** @returns false when the session turned out to be alive and nothing was signed out. */
+export async function handleNotAuthorized(): Promise<boolean> {
+  // one 401 during a restart must not throw away a session the server still honours
+  if (await sessionSurvives401()) {
+    return false;
+  }
   useUserStore().unauthorize();
   useCoreStore().resetAdminUser();
   await redirectToLogin();
+  return true;
 }
 
 export async function redirectToLogin() {
@@ -157,7 +164,10 @@ export async function callApi({path, method, body, headers, silentError = false,
   try {
     const r = await fetch(fullPath, options);
     if (r.status == 401 && !path.includes('/login')) {
-      await handleNotAuthorized();
+      // when the session survived there is no redirect coming, so the failure has to be visible
+      if (!await handleNotAuthorized() && !silentError) {
+        adminforth.alert({variant:'danger', message: t('Something went wrong, please try again later'),})
+      }
       return null;
     }
     return await r.json();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "adminforth",
-  "version": "3.24.4",
+  "version": "3.24.6",
   "description": "OpenSource Agent-Native forth-generation admin panel",
   "keywords": [
     "adminforth",