asab_webui_shell 27.7.5-alpha.0 → 27.8.1

package/dist/containers/Application.js

@@ -12,6 +12,7 @@ var _axios = _interopRequireDefault(require("axios"));
 var _asab_webui_components = require("asab_webui_components");
 var _jsonParseWithBigInt2 = require("../utils/jsonParseWithBigInt");
 var _statusAlerts = require("../utils/statusAlerts.js");
+var _pageLifecycle = require("../utils/pageLifecycle");
 var _Header = _interopRequireDefault(require("./Header"));
 var _Sidebar = _interopRequireDefault(require("./Sidebar"));
 var _ToastContainer = _interopRequireDefault(require("./Toast/ToastContainer.js"));
@@ -34,6 +35,7 @@ var _BrandingService = _interopRequireDefault(require("../services/BrandingServi
 var _TitleService = _interopRequireDefault(require("../services/TitleService"));
 var _HelpService = _interopRequireDefault(require("./Header/Help/HelpService"));
 var _AccessDeniedCard = _interopRequireDefault(require("../modules/tenant/access/AccessDeniedCard"));
+var _LoginLoopCard = require("../modules/auth/components/LoginLoopCard");
 var _ApplicationRouter = _interopRequireDefault(require("./Router/ApplicationRouter"));
 var _SuspenseScreen = _interopRequireDefault(require("../screens/SuspenseScreen"));
 var _OfflineIndication = require("../modules/attentionrequired/components/OfflineIndication.js");
@@ -65,6 +67,7 @@ class Application extends _react.Component {
     this.Navigation = new _Navigation.default(this);
     this.SplashscreenRequestors = new Set(); // If not empty, the splash screen will be rendered
     this.AxiosInterceptors = new Set();
+    this.AxiosResponseErrorInterceptors = new Set(); // Interceptors for handling error responses from the server (e.g 401)
     this.WebSocketInterceptors = new Set();
     this.HeaderService = new _HeaderService.default(this, "HeaderService");
     this.ThemeService = new _ThemeService.default(this, "ThemeService");
@@ -106,6 +109,7 @@ class Application extends _react.Component {
     // Subscribe and unsubscribe handlers for connectivity detection
     this._initConnectivitySubscription = this._initConnectivitySubscription.bind(this);
     this._unsubscribeConnectivity = null;
+    this._unsubscribePageHide = null;
     this.ConfigService.addDefaults(props.configdefaults);
     this.addSplashScreenRequestor(this);
     this.state.splashscreenRequestors = this.SplashscreenRequestors.size;
@@ -360,23 +364,37 @@ class Application extends _react.Component {
       }
       // If the request was satisfied (application/json and presence of BigInt) return the modified object. If not, we return unchanged object
       return response;
-    }, function (error) {
-      var _error$config, _error$response, _error$response2;
-      if (!((_error$config = error.config) !== null && _error$config !== void 0 && _error$config._networkingIndicatorOff)) {
-        that.popNetworkingIndicator();
-      }
-      that.popPrintReadyIndicator();
-      var contentType = error === null || error === void 0 || (_error$response = error.response) === null || _error$response === void 0 || (_error$response = _error$response.headers) === null || _error$response === void 0 ? void 0 : _error$response['content-type'];
-      // Check if the response content type is 'application/json' and data is a string
-      if (contentType !== null && contentType !== void 0 && contentType.startsWith('application/json') && typeof (error === null || error === void 0 || (_error$response2 = error.response) === null || _error$response2 === void 0 ? void 0 : _error$response2.data) === 'string') {
-        try {
-          error.response.data = JSON.parse(error.response.data);
-        } catch (e) {
-          console.error("Error parsing error of the error body:", e);
+    }, /*#__PURE__*/function () {
+      var _ref2 = (0, _asyncToGenerator2.default)(function* (error) {
+        var _error$config, _error$response, _error$response2;
+        if (!((_error$config = error.config) !== null && _error$config !== void 0 && _error$config._networkingIndicatorOff)) {
+          that.popNetworkingIndicator();
         }
-      }
-      return Promise.reject(error);
-    });
+        that.popPrintReadyIndicator();
+        var contentType = error === null || error === void 0 || (_error$response = error.response) === null || _error$response === void 0 || (_error$response = _error$response.headers) === null || _error$response === void 0 ? void 0 : _error$response['content-type'];
+        // Check if the response content type is 'application/json' and data is a string
+        if (contentType !== null && contentType !== void 0 && contentType.startsWith('application/json') && typeof (error === null || error === void 0 || (_error$response2 = error.response) === null || _error$response2 === void 0 ? void 0 : _error$response2.data) === 'string') {
+          try {
+            error.response.data = JSON.parse(error.response.data);
+          } catch (e) {
+            console.error("Error parsing error of the error body:", e);
+          }
+        }
+
+        // Call registered response error interceptors (e.g. for 401 handling)
+        for (var _interceptor of that.AxiosResponseErrorInterceptors.keys()) {
+          try {
+            yield _interceptor(error);
+          } catch (interceptorError) {
+            console.error("Error in AxiosResponseErrorInterceptors", interceptorError);
+          }
+        }
+        return Promise.reject(error);
+      });
+      return function (_x) {
+        return _ref2.apply(this, arguments);
+      };
+    }());
     return axios;
   }
 
@@ -401,6 +419,12 @@ class Application extends _react.Component {
   removeAxiosInterceptor(interceptor) {
     this.AxiosInterceptors.delete(interceptor);
   }
+  addAxiosResponseErrorInterceptor(interceptor) {
+    this.AxiosResponseErrorInterceptors.add(interceptor);
+  }
+  removeAxiosResponseErrorInterceptor(interceptor) {
+    this.AxiosResponseErrorInterceptors.delete(interceptor);
+  }
   addWebSocketInterceptor(interceptor) {
     this.WebSocketInterceptors.add(interceptor);
   }
@@ -520,6 +544,8 @@ class Application extends _react.Component {
 
     // Subscribe to Application.status! once PubSub is available
     this._initConnectivitySubscription();
+    // Bridge window page lifecycle events to Application.lifecycle!
+    this._initPageLifecycleBridge();
     // Add print-landscape class to body if not present
     if (!document.body.classList.contains('print-landscape')) {
       document.body.classList.add('print-landscape');
@@ -552,6 +578,12 @@ class Application extends _react.Component {
       this._unsubscribeConnectivity();
       this._unsubscribeConnectivity = null;
     }
+
+    // Unsubscribe from Application.lifecycle! PubSub for pagehide event
+    if (this._unsubscribePageHide) {
+      this._unsubscribePageHide();
+      this._unsubscribePageHide = null;
+    }
     this._clearOfflineIndicationTimeout();
     this._clearPrintReadyTimeout();
     document.body.removeAttribute('print-ready');
@@ -635,7 +667,7 @@ class Application extends _react.Component {
   		addAlertFromException will always use "danger" color as its background and the full exception will be printed into the console
   */
   addAlertFromException(exception, message) {
-    var _exception$response, _exception$response2, _this$AppStore$dispat3, _this$AppStore3;
+    var _exception$response, _this$AppStore2, _exception$response2, _this$AppStore$dispat3, _this$AppStore4;
     var expire = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : 30;
     var shouldBeTranslated = arguments.length > 3 && arguments[3] !== undefined ? arguments[3] : false;
     var component = arguments.length > 4 && arguments[4] !== undefined ? arguments[4] : null;
@@ -646,11 +678,15 @@ class Application extends _react.Component {
     if ((exceptionStatus === 502 || exceptionStatus === 503 || exceptionStatus === 504) && this._indicateGatewayTimeout()) {
       return;
     }
+    // Skip 401 alert when session has expired
+    if (exceptionStatus === 401 && (_this$AppStore2 = this.AppStore) !== null && _this$AppStore2 !== void 0 && (_this$AppStore2 = _this$AppStore2.getState()) !== null && _this$AppStore2 !== void 0 && (_this$AppStore2 = _this$AppStore2.auth) !== null && _this$AppStore2 !== void 0 && _this$AppStore2.sessionExpired) {
+      return;
+    }
     // Handle specific response statuses and set the appropriate level and message
     var statusAlert = _statusAlerts.STATUS_ALERTS[exceptionStatus];
     if (statusAlert) {
-      var _this$AppStore$dispat2, _this$AppStore2;
-      (_this$AppStore$dispat2 = (_this$AppStore2 = this.AppStore).dispatch) === null || _this$AppStore$dispat2 === void 0 || _this$AppStore$dispat2.call(_this$AppStore2, {
+      var _this$AppStore$dispat2, _this$AppStore3;
+      (_this$AppStore$dispat2 = (_this$AppStore3 = this.AppStore).dispatch) === null || _this$AppStore$dispat2 === void 0 || _this$AppStore$dispat2.call(_this$AppStore3, {
         type: _actions.ADD_ALERT,
         level: statusAlert.level,
         message: statusAlert.message,
@@ -692,7 +728,7 @@ class Application extends _react.Component {
         }, exception.message));
       }
     }
-    (_this$AppStore$dispat3 = (_this$AppStore3 = this.AppStore).dispatch) === null || _this$AppStore$dispat3 === void 0 || _this$AppStore$dispat3.call(_this$AppStore3, {
+    (_this$AppStore$dispat3 = (_this$AppStore4 = this.AppStore).dispatch) === null || _this$AppStore$dispat3 === void 0 || _this$AppStore$dispat3.call(_this$AppStore4, {
       type: _actions.ADD_ALERT,
       level: "danger",
       message: exceptionMessage,
@@ -736,12 +772,12 @@ class Application extends _react.Component {
   	It takes a parameter called "status" to indicate whether to turn the full-screen mode on or off.
   */
   setFullScreenMode(status) {
-    var _state$fullscreenmode, _this$AppStore$dispat4, _this$AppStore4;
+    var _state$fullscreenmode, _this$AppStore$dispat4, _this$AppStore5;
     var state = this.AppStore.getState();
     if (status === 'on' && (state === null || state === void 0 || (_state$fullscreenmode = state.fullscreenmode) === null || _state$fullscreenmode === void 0 ? void 0 : _state$fullscreenmode.status) === 'on') {
       status = 'off';
     }
-    (_this$AppStore$dispat4 = (_this$AppStore4 = this.AppStore).dispatch) === null || _this$AppStore$dispat4 === void 0 || _this$AppStore$dispat4.call(_this$AppStore4, {
+    (_this$AppStore$dispat4 = (_this$AppStore5 = this.AppStore).dispatch) === null || _this$AppStore$dispat4 === void 0 || _this$AppStore$dispat4.call(_this$AppStore5, {
       type: _actions.SET_FULLSCREEN_MODE,
       status: status
     });
@@ -770,6 +806,8 @@ class Application extends _react.Component {
         id: "app-main"
       }, /*#__PURE__*/_react.default.createElement(_AccessDeniedCard.default, {
         app: this
+      }), /*#__PURE__*/_react.default.createElement(_LoginLoopCard.LoginLoopCard, {
+        app: this
       })))))
     );
     return /*#__PURE__*/_react.default.createElement(_asab_webui_components.AppStoreProvider, {
@@ -813,9 +851,9 @@ Application.prototype._initConnectivitySubscription = function () {
   if (this.PubSub && typeof this.PubSub.subscribe === 'function') {
     if (!this._unsubscribeConnectivity) {
       this._unsubscribeConnectivity = this.PubSub.subscribe('Application.status!', value => {
-        var _this$AppStore$dispat5, _this$AppStore5;
+        var _this$AppStore$dispat5, _this$AppStore6;
         // Prefer store so UI updates predictably
-        (_this$AppStore$dispat5 = (_this$AppStore5 = this.AppStore).dispatch) === null || _this$AppStore$dispat5 === void 0 || _this$AppStore$dispat5.call(_this$AppStore5, {
+        (_this$AppStore$dispat5 = (_this$AppStore6 = this.AppStore).dispatch) === null || _this$AppStore$dispat5 === void 0 || _this$AppStore$dispat5.call(_this$AppStore6, {
           type: _actions.SET_CONNECTIVITY_STATUS,
           status: value.status
         });
@@ -829,4 +867,18 @@ Application.prototype._initConnectivitySubscription = function () {
   */
   setTimeout(this._initConnectivitySubscription, 0);
 };
+
+/*
+	On Application lifecycle events, bridge the events to PubSub topic Application.lifecycle!
+*/
+Application.prototype._initPageLifecycleBridge = function () {
+  if (this._unsubscribePageHide) return;
+  this._unsubscribePageHide = (0, _pageLifecycle.subscribePageHide)(event => {
+    var _this$PubSub, _this$PubSub$publish;
+    (_this$PubSub = this.PubSub) === null || _this$PubSub === void 0 || (_this$PubSub$publish = _this$PubSub.publish) === null || _this$PubSub$publish === void 0 || _this$PubSub$publish.call(_this$PubSub, 'Application.lifecycle!', {
+      type: 'pagehide',
+      persisted: event.persisted
+    });
+  });
+};
 var _default = exports.default = Application;

package/dist/containers/Navigation/index.js

@@ -19,7 +19,21 @@ class Navigation extends _react.Component {
     		path: '/some/path',	// Url path
     		end: true,		// Whether path must be matched exactly
     		name: 'Some Name',	// Route name
-    		component: ReactComponent // Component to be rendered
+    		openFor: ['/some/path/*'], // Optional array of routes to keep the item open
+    		icon: 'bi bi-folder', // Icon
+    		resource: 'some:resource:access', // Resource to check access for
+    		order: 100, // Order of the item
+    		children: [ // Optional array of children
+    			{
+    				path: '/some/path/child',
+    				end: true,
+    				name: 'Child Name',
+    				openFor: ['/some/path/child'], // Optional array of routes to keep the child highlighted
+    				icon: 'bi bi-file', // Icon
+    				resource: 'some:resource:access', // Resource to check access for
+    				order: 100, // Order of the child
+    			}
+    		],
     	}
     */
 

package/dist/containers/Sidebar/SidebarItem.js

@@ -21,7 +21,8 @@ var SidebarItem = _ref => {
     setOpen = _ref.setOpen,
     isSmallResolution = _ref.isSmallResolution,
     _ref$beacon = _ref.beacon,
-    beacon = _ref$beacon === void 0 ? undefined : _ref$beacon;
+    beacon = _ref$beacon === void 0 ? undefined : _ref$beacon,
+    openFor = _ref.openFor;
   var location = (0, _reactRouter.useLocation)();
   var _useTranslation = (0, _reactI18next.useTranslation)(),
     t = _useTranslation.t;
@@ -38,10 +39,10 @@ var SidebarItem = _ref => {
   var itemBeacon = beacon === null || beacon === void 0 ? void 0 : beacon["beacon.".concat(lowercasedItemName)];
   (0, _react.useEffect)(() => {
     // TODO: refactor the handling of active and open states, since it does not behave as expected in some cases
-    if (isOpen && !isActive) {
+    if (isOpen && !isActive && !matchesOpenFor(location.pathname, openFor)) {
       setOpen(false);
     }
-    setActive(item.url && (location.pathname === item.url || location.pathname.startsWith(item.url + '/')) ? true : false);
+    setActive(Boolean(item.url && (location.pathname === item.url || location.pathname.startsWith(item.url + '/'))) || matchesOpenFor(location.pathname, item.openFor));
   }, [location]);
   return /*#__PURE__*/_react.default.createElement("div", {
     className: "nav-item"
@@ -103,6 +104,10 @@ var SidebarCollapsibleItem = _ref2 => {
   // Should collapsed item uncollapse
   (0, _react.useEffect)(() => {
     if (item.children && !isOpen) {
+      if (matchesOpenFor(location.pathname, item.openFor)) {
+        setOpen(true);
+        return;
+      }
       for (var child of item.children) {
         if (location.pathname.includes(child.url)) {
           setOpen(true);
@@ -164,6 +169,7 @@ var SidebarCollapsibleItem = _ref2 => {
       isOpen: isOpen,
       setOpen: setOpen,
       isSmallResolution: isSmallResolution,
+      openFor: item.openFor,
       beacon: itemsBeacon["beacon.".concat(child === null || child === void 0 || (_child$name = child.name) === null || _child$name === void 0 ? void 0 : _child$name.toLowerCase())] && childBeacon(itemsBeacon, "beacon.".concat(child.name.toLowerCase()))
     });
   })));
@@ -186,4 +192,16 @@ var childBeacon = (data, key) => {
   return data[key] ? {
     [key]: data[key]
   } : {};
+};
+
+// Optional item.openFor patterns, e.g. ['/route/*'] - keeps parent open on matching routes
+var matchesOpenFor = (pathname, patterns) => {
+  var _patterns$some;
+  return (_patterns$some = patterns === null || patterns === void 0 ? void 0 : patterns.some(p => {
+    if (p.endsWith('*')) {
+      var prefix = p.slice(0, -1);
+      return pathname.startsWith(prefix) || pathname === prefix.slice(0, -1);
+    }
+    return pathname === p || pathname.startsWith(p + '/');
+  })) !== null && _patterns$some !== void 0 ? _patterns$some : false;
 };

package/dist/modules/auth/components/LoginLoopCard.js

@@ -0,0 +1,37 @@
+"use strict";
+
+var _interopRequireDefault = require("@babel/runtime/helpers/interopRequireDefault");
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.LoginLoopCard = LoginLoopCard;
+var _react = _interopRequireDefault(require("react"));
+var _reactI18next = require("react-i18next");
+var _reactstrap = require("reactstrap");
+require("./LoginLoopCard.scss");
+function LoginLoopCard(props) {
+  var _props$app;
+  var _useTranslation = (0, _reactI18next.useTranslation)(),
+    t = _useTranslation.t;
+
+  // Validate if AuthModule is present
+  var hasAuthModule = (_props$app = props.app) === null || _props$app === void 0 || (_props$app = _props$app.Modules) === null || _props$app === void 0 ? void 0 : _props$app.some(m => m.Name === 'AuthModule');
+  if (!hasAuthModule) {
+    return null;
+  }
+
+  // Read the number of login attempts from sessionStorage and render the card if the number is greater than 10
+  var attempts = parseInt(sessionStorage.getItem('SeaCatLoginAttempts') || '0', 10);
+  if (!Number.isFinite(attempts) || attempts <= 10) {
+    return null;
+  }
+  return /*#__PURE__*/_react.default.createElement("div", {
+    className: "auth-login-loop-wrapper"
+  }, /*#__PURE__*/_react.default.createElement(_reactstrap.Card, null, /*#__PURE__*/_react.default.createElement(_reactstrap.CardHeader, {
+    className: "card-header-flex"
+  }, /*#__PURE__*/_react.default.createElement("div", {
+    className: "flex-fill text-center"
+  }, /*#__PURE__*/_react.default.createElement("h2", {
+    className: "text-primary"
+  }, t('ASABAuthModule|Authentication error')))), /*#__PURE__*/_react.default.createElement(_reactstrap.CardBody, null, t('ASABAuthModule|Too many login redirects occurred. Please contact application administrator.'))));
+}

package/dist/modules/auth/components/LoginLoopCard.scss

@@ -0,0 +1,6 @@
+.auth-login-loop-wrapper {
+	position: absolute;
+	z-index: 99999;
+	left: 50%; /*Horizontally center*/
+	transform: translateX(-50%); /*Horizontally center*/
+}

package/dist/modules/auth/index.js

@@ -46,6 +46,12 @@ class AuthModule extends _asab_webui_components.Module {
 
     this.SessionExpiration = null; // Session expiration as defined in user info
     this.sessionValidationInterval = null; // Initialize session validation interval
+    this._sessionExpired = false; // Guard which ensures _triggerSessionExpired() runs at most once
+    this._unsubscribeLifecycle = null; // Unsubscribe function for the Application.lifecycle! subscription (set by _markAuthPageActive)
+
+    // Login-loop protection counts consecutive login redirects and resets on auth success
+    var _n = parseInt(sessionStorage.getItem('SeaCatLoginAttempts') || '0', 10);
+    this._loginAttempts = Number.isFinite(_n) ? _n : 0;
 
     // Access control screen
     app.Router.addRoute({
@@ -86,6 +92,21 @@ class AuthModule extends _asab_webui_components.Module {
           */
           return;
         }
+
+        /*
+        	Duplicated tabs clone sessionStorage and SeaCatAuthTabActive is set
+        	while the tab is live and cleared on pagehide (refresh/close).
+        	If the flag (SeaCatAuthTabActive) is still present at startup,
+        	then its evaluated as a clone and it drops tokens and re-authenticate.
+        	Skipping the evaluation during the OAuth `code` redirect
+        */
+        if (authorization_code === null && _this.OAuthTokens != null && sessionStorage.getItem('SeaCatAuthTabActive')) {
+          _this.OAuthTokens = null;
+          sessionStorage.removeItem('SeaCatOAuth2Tokens');
+          sessionStorage.removeItem('SeaCatAuthTabActive');
+          yield _this._attemptLogin(_this.RedirectURL, false);
+          return;
+        }
         if (authorization_code !== null) {
           yield _this._exchangeCodeForTokens(authorization_code);
           // Remove 'code' from a query string
@@ -125,13 +146,19 @@ class AuthModule extends _asab_webui_components.Module {
           if (!result) {
             // User info not found - go to login
             sessionStorage.removeItem('SeaCatOAuth2Tokens');
-            var force_login_prompt = true;
-            yield _this.Api.login(_this.RedirectURL, force_login_prompt);
+            sessionStorage.removeItem('SeaCatAuthTabActive');
+            var force_login_prompt = false;
+            yield _this._attemptLogin(_this.RedirectURL, force_login_prompt);
             return;
           }
 
+          // Mark current tab as holding an active auth session
+          _this._markAuthPageActive();
+
           // Add interceptor with Bearer token in the Header into axios calls
           _this.App.addAxiosInterceptor(_this.authInterceptor());
+          // Add response error interceptor to handle 401 Unauthorized globally
+          _this.App.addAxiosResponseErrorInterceptor(_this.unauthorizedInterceptor());
           // Add webSocket interceptor with Bearer token into websocket calls
           _this.App.addWebSocketInterceptor(_this.webSocketAuthInterceptor());
 
@@ -142,7 +169,7 @@ class AuthModule extends _asab_webui_components.Module {
             if (!tenantAuthorized) {
               // If tenant not authorized, redirect to Access denied card
               var _force_login_prompt = false;
-              yield _this.Api.login(_this.RedirectURL, _force_login_prompt);
+              yield _this._attemptLogin(_this.RedirectURL, _force_login_prompt);
               return;
             }
           }
@@ -160,7 +187,7 @@ class AuthModule extends _asab_webui_components.Module {
             */
             if (resources == undefined) {
               var _force_login_prompt2 = false;
-              yield _this.Api.login(_this.RedirectURL, _force_login_prompt2);
+              yield _this._attemptLogin(_this.RedirectURL, _force_login_prompt2);
               return;
             }
             (_this$App = _this.App) === null || _this$App === void 0 || (_this$App = _this$App.AppStore) === null || _this$App === void 0 || (_this$App$dispatch = _this$App.dispatch) === null || _this$App$dispatch === void 0 || _this$App$dispatch.call(_this$App, {
@@ -176,12 +203,15 @@ class AuthModule extends _asab_webui_components.Module {
           }
         }
         if (_this.UserInfo == null && _this.MustAuthenticate) {
-          // TODO: force_login_prompt = true to break authentication failure loop
           var _force_login_prompt3 = false;
-          yield _this.Api.login(_this.RedirectURL, _force_login_prompt3);
+          yield _this._attemptLogin(_this.RedirectURL, _force_login_prompt3);
           return;
         }
       }
+
+      // Authorization completed successfully so reset the login-loop counter
+      _this._loginAttempts = 0;
+      sessionStorage.removeItem('SeaCatLoginAttempts');
       _this.App.removeSplashScreenRequestor(_this);
     })();
   }
@@ -192,12 +222,56 @@ class AuthModule extends _asab_webui_components.Module {
     };
     return interceptor;
   }
+
+  // Handle 401 Unauthorized responses from the server
+  unauthorizedInterceptor() {
+    var _this2 = this;
+    var handlingPromise = null; // Shared promise so concurrent 401s await the same refresh/expire flow
+    return /*#__PURE__*/function () {
+      var _ref = (0, _asyncToGenerator2.default)(function* (error) {
+        var _error$response, _error$config, _error$config2;
+        if ((error === null || error === void 0 || (_error$response = error.response) === null || _error$response === void 0 ? void 0 : _error$response.status) !== 401) return;
+
+        // If session expired, do not continue
+        if (_this2._sessionExpired) return;
+
+        // Ignore 401s from auth endpoints themselves to avoid loops
+        var requestBaseURL = error === null || error === void 0 || (_error$config = error.config) === null || _error$config === void 0 ? void 0 : _error$config.baseURL;
+        var requestPath = error === null || error === void 0 || (_error$config2 = error.config) === null || _error$config2 === void 0 ? void 0 : _error$config2.url;
+        var oidcURL = _this2.App.getServiceURL('openidconnect');
+        var seacatAuthURL = _this2.App.getServiceURL('seacat-auth');
+        // Ignore 401 requests from the oidc service (token/userinfo endpoints) to avoid refresh loops
+        // For seacat-auth, only ignore the internal /openidconnect/* sub-path (used by the internal userinfo call)
+        if (requestBaseURL && (requestBaseURL === oidcURL || requestBaseURL === seacatAuthURL && (requestPath === '/openidconnect' || requestPath !== null && requestPath !== void 0 && requestPath.startsWith('/openidconnect/')))) {
+          return;
+        }
+        if (!handlingPromise) {
+          handlingPromise = (0, _asyncToGenerator2.default)(function* () {
+            try {
+              yield _this2._refreshTokens();
+              var isUserInfoUpdated = yield _this2.updateUserInfo();
+              if (!isUserInfoUpdated) {
+                _this2._triggerSessionExpired();
+              }
+            } finally {
+              handlingPromise = null;
+            }
+          })();
+        }
+        // Await so sessionExpired is set before callers reach addAlertFromException
+        yield handlingPromise;
+      });
+      return function (_x) {
+        return _ref.apply(this, arguments);
+      };
+    }();
+  }
   webSocketAuthInterceptor() {
     // Return a function to ensure that the token is always current and not static
     return () => "access_token_".concat(this.OAuthTokens['access_token']);
   }
   simulateUserinfo(mock_userinfo) {
-    var _this2 = this;
+    var _this3 = this;
     return (0, _asyncToGenerator2.default)(function* () {
       /*
       	This method takes parameters from wepack.dev.js settings
@@ -217,7 +291,7 @@ class AuthModule extends _asab_webui_components.Module {
       		...
       	],
       	*/
-      _this2.App.addAlert("warning", "ASABAuthModule|You are using MOCK_USERINFO!", 1, true);
+      _this3.App.addAlert("warning", "ASABAuthModule|You are using MOCK_USERINFO!", 1, true);
       var mockParams = mock_userinfo;
       if (mockParams.resources) {
         mockParams["resources"] = Object.values(mockParams.resources);
@@ -228,13 +302,13 @@ class AuthModule extends _asab_webui_components.Module {
       if (mockParams.tenants) {
         mockParams["tenants"] = Object.values(mockParams.tenants);
       }
-      if (_this2.App.AppStore) {
-        var _this2$App$AppStore$d, _this2$App$AppStore, _this2$App$AppStore$d2, _this2$App$AppStore2;
-        (_this2$App$AppStore$d = (_this2$App$AppStore = _this2.App.AppStore).dispatch) === null || _this2$App$AppStore$d === void 0 || _this2$App$AppStore$d.call(_this2$App$AppStore, {
+      if (_this3.App.AppStore) {
+        var _this3$App$AppStore$d, _this3$App$AppStore, _this3$App$AppStore$d2, _this3$App$AppStore2;
+        (_this3$App$AppStore$d = (_this3$App$AppStore = _this3.App.AppStore).dispatch) === null || _this3$App$AppStore$d === void 0 || _this3$App$AppStore$d.call(_this3$App$AppStore, {
           type: _actions.types.AUTH_USERINFO,
           payload: mockParams
         });
-        (_this2$App$AppStore$d2 = (_this2$App$AppStore2 = _this2.App.AppStore).dispatch) === null || _this2$App$AppStore$d2 === void 0 || _this2$App$AppStore$d2.call(_this2$App$AppStore2, {
+        (_this3$App$AppStore$d2 = (_this3$App$AppStore2 = _this3.App.AppStore).dispatch) === null || _this3$App$AppStore$d2 === void 0 || _this3$App$AppStore$d2.call(_this3$App$AppStore2, {
           type: _actions.types.AUTH_RESOURCES,
           resources: mockParams["resources"]
         });
@@ -242,8 +316,8 @@ class AuthModule extends _asab_webui_components.Module {
 
       /** Check for TenantService and pass tenants list obtained from userinfo */
       var availableTenants = mockParams.tenants;
-      if (_this2.App.Services.TenantService) {
-        yield _this2.App.Services.TenantService.setTenants(availableTenants, _this2._getAuthorizedTenant(mockParams));
+      if (_this3.App.Services.TenantService) {
+        yield _this3.App.Services.TenantService.setTenants(availableTenants, _this3._getAuthorizedTenant(mockParams));
       }
     })();
   }
@@ -251,7 +325,11 @@ class AuthModule extends _asab_webui_components.Module {
     this.App.addSplashScreenRequestor(this);
     this._stopSessionExpirationValidation(); // Stop session validation and clear the timeout
 
+    // Clear login-loop counter so a fresh login after logout starts from 0
+    this._loginAttempts = 0;
+    sessionStorage.removeItem('SeaCatLoginAttempts');
     sessionStorage.removeItem('SeaCatOAuth2Tokens');
+    sessionStorage.removeItem('SeaCatAuthTabActive');
     var promise = this.Api.logout(this.OAuthTokens['access_token']);
     if (promise == null) {
       window.location.reload();
@@ -262,9 +340,9 @@ class AuthModule extends _asab_webui_components.Module {
       window.location.reload();
     });
   }
-  validateNavigation(_ref) {
+  validateNavigation(_ref3) {
     var _state$navigation, _this$App$AppStore$di, _this$App$AppStore;
-    var resources = _ref.resources;
+    var resources = _ref3.resources;
     var state = this.App.AppStore.getState();
     var navItems = (_state$navigation = state.navigation) === null || _state$navigation === void 0 ? void 0 : _state$navigation.navItems;
     var authorizedNavItems = [];
@@ -345,47 +423,47 @@ class AuthModule extends _asab_webui_components.Module {
     return valid;
   }
   updateUserInfo() {
-    var _this3 = this;
+    var _this4 = this;
     return (0, _asyncToGenerator2.default)(function* () {
-      var _this3$UserInfo;
-      var internal = _this3.OAuthTokens.internal || false;
+      var _this4$UserInfo;
+      var internal = _this4.OAuthTokens.internal || false;
       if (!internal) {
         var _response$data;
         var response;
         try {
-          response = yield _this3.Api.userinfo(_this3.OAuthTokens.access_token);
+          response = yield _this4.Api.userinfo(_this4.OAuthTokens.access_token);
         } catch (err) {
           console.error("Failed to update user info", err);
-          _this3.UserInfo = null;
-          if (_this3.App.AppStore) {
-            var _this3$App$AppStore$d, _this3$App$AppStore;
-            (_this3$App$AppStore$d = (_this3$App$AppStore = _this3.App.AppStore).dispatch) === null || _this3$App$AppStore$d === void 0 || _this3$App$AppStore$d.call(_this3$App$AppStore, {
+          _this4.UserInfo = null;
+          if (_this4.App.AppStore) {
+            var _this4$App$AppStore$d, _this4$App$AppStore;
+            (_this4$App$AppStore$d = (_this4$App$AppStore = _this4.App.AppStore).dispatch) === null || _this4$App$AppStore$d === void 0 || _this4$App$AppStore$d.call(_this4$App$AppStore, {
               type: _actions.types.AUTH_USERINFO,
-              payload: _this3.UserInfo
+              payload: _this4.UserInfo
             });
           }
           return false;
         }
-        _this3.UserInfo = response.data;
-        _this3.SessionExpiration = (_response$data = response.data) === null || _response$data === void 0 ? void 0 : _response$data.exp;
+        _this4.UserInfo = response.data;
+        _this4.SessionExpiration = (_response$data = response.data) === null || _response$data === void 0 ? void 0 : _response$data.exp;
       } else {
         var _response$data2;
         var _response;
         try {
-          _response = yield _this3.Api.userinfo(_this3.OAuthTokens.access_token, internal);
+          _response = yield _this4.Api.userinfo(_this4.OAuthTokens.access_token, internal);
         } catch (err) {
           console.error("Failed to update user info", err);
-          _this3.UserInfo = null;
-          if (_this3.App.AppStore) {
-            var _this3$App$AppStore$d2, _this3$App$AppStore2;
-            (_this3$App$AppStore$d2 = (_this3$App$AppStore2 = _this3.App.AppStore).dispatch) === null || _this3$App$AppStore$d2 === void 0 || _this3$App$AppStore$d2.call(_this3$App$AppStore2, {
+          _this4.UserInfo = null;
+          if (_this4.App.AppStore) {
+            var _this4$App$AppStore$d2, _this4$App$AppStore2;
+            (_this4$App$AppStore$d2 = (_this4$App$AppStore2 = _this4.App.AppStore).dispatch) === null || _this4$App$AppStore$d2 === void 0 || _this4$App$AppStore$d2.call(_this4$App$AppStore2, {
               type: _actions.types.AUTH_USERINFO,
-              payload: _this3.UserInfo
+              payload: _this4.UserInfo
             });
           }
           return false;
         }
-        _this3.UserInfo = _response.data;
+        _this4.UserInfo = _response.data;
 
         // If the resource is `{'*': [....]}` then it is a global resources token (i.e. for API keys)
         var resources = _response.data.resources;
@@ -394,43 +472,43 @@ class AuthModule extends _asab_webui_components.Module {
           var tenant = (0, _extractTenantFromUrl.extractTenantFromUrl)();
           if (tenant) {
             // Monkey patch the userinfo to add the tenant and resources
-            _this3.UserInfo['tenants'] = [tenant];
-            _this3.UserInfo['resources'][tenant] = resources['*'];
+            _this4.UserInfo['tenants'] = [tenant];
+            _this4.UserInfo['resources'][tenant] = resources['*'];
           } else {
-            var _this3$App, _this3$App$dispatch;
+            var _this4$App, _this4$App$dispatch;
             console.error("Tenant not found in URL - if the global resources token is used, the tenant must be specified in the URL");
-            _this3.UserInfo = null;
-            _this3.SessionExpiration = null;
-            (_this3$App = _this3.App) === null || _this3$App === void 0 || (_this3$App = _this3$App.AppStore) === null || _this3$App === void 0 || (_this3$App$dispatch = _this3$App.dispatch) === null || _this3$App$dispatch === void 0 || _this3$App$dispatch.call(_this3$App, {
+            _this4.UserInfo = null;
+            _this4.SessionExpiration = null;
+            (_this4$App = _this4.App) === null || _this4$App === void 0 || (_this4$App = _this4$App.AppStore) === null || _this4$App === void 0 || (_this4$App$dispatch = _this4$App.dispatch) === null || _this4$App$dispatch === void 0 || _this4$App$dispatch.call(_this4$App, {
               type: _actions.types.AUTH_USERINFO,
               payload: null
             });
             return false;
           }
         }
-        _this3.SessionExpiration = (_response$data2 = _response.data) === null || _response$data2 === void 0 ? void 0 : _response$data2.exp;
+        _this4.SessionExpiration = (_response$data2 = _response.data) === null || _response$data2 === void 0 ? void 0 : _response$data2.exp;
       }
-      if (_this3.App.AppStore) {
-        var _this3$App$AppStore$d3, _this3$App$AppStore3;
-        (_this3$App$AppStore$d3 = (_this3$App$AppStore3 = _this3.App.AppStore).dispatch) === null || _this3$App$AppStore$d3 === void 0 || _this3$App$AppStore$d3.call(_this3$App$AppStore3, {
+      if (_this4.App.AppStore) {
+        var _this4$App$AppStore$d3, _this4$App$AppStore3;
+        (_this4$App$AppStore$d3 = (_this4$App$AppStore3 = _this4.App.AppStore).dispatch) === null || _this4$App$AppStore$d3 === void 0 || _this4$App$AppStore$d3.call(_this4$App$AppStore3, {
           type: _actions.types.AUTH_USERINFO,
-          payload: _this3.UserInfo
+          payload: _this4.UserInfo
         });
       }
 
       // Check for TenantService and pass tenants list obtained from userinfo resources
-      var availableTenants = _this3.UserInfo.tenants;
+      var availableTenants = _this4.UserInfo.tenants;
       if (availableTenants == null || availableTenants.length === 0) {
-        var _this3$UserInfo$resou;
+        var _this4$UserInfo$resou;
         // Fallback to tenant from resources if tenants list is not available
-        availableTenants = Object.keys((_this3$UserInfo$resou = _this3.UserInfo.resources) !== null && _this3$UserInfo$resou !== void 0 ? _this3$UserInfo$resou : {}).filter(tenant => tenant !== '*');
+        availableTenants = Object.keys((_this4$UserInfo$resou = _this4.UserInfo.resources) !== null && _this4$UserInfo$resou !== void 0 ? _this4$UserInfo$resou : {}).filter(tenant => tenant !== '*');
       }
-      if (((_this3$UserInfo = _this3.UserInfo) === null || _this3$UserInfo === void 0 ? void 0 : _this3$UserInfo.tenants) == null) {
+      if (((_this4$UserInfo = _this4.UserInfo) === null || _this4$UserInfo === void 0 ? void 0 : _this4$UserInfo.tenants) == null) {
         // This is a monkey patch to add the tenants list to the userinfo if missing
-        _this3.UserInfo['tenants'] = availableTenants;
+        _this4.UserInfo['tenants'] = availableTenants;
       }
-      if (_this3.App.Services.TenantService) {
-        yield _this3.App.Services.TenantService.setTenants(availableTenants, _this3._getAuthorizedTenant(_this3.UserInfo) // Get the authorized tenant
+      if (_this4.App.Services.TenantService) {
+        yield _this4.App.Services.TenantService.setTenants(availableTenants, _this4._getAuthorizedTenant(_this4.UserInfo) // Get the authorized tenant
         );
       }
       return true;
@@ -439,12 +517,13 @@ class AuthModule extends _asab_webui_components.Module {
 
   // Method for obtaining and storing the OAuth tokens based on authorization code
   _exchangeCodeForTokens(authorization_code) {
-    var _this4 = this;
+    var _this5 = this;
     return (0, _asyncToGenerator2.default)(function* () {
       try {
-        var response = yield _this4.Api.token_authorization_code(authorization_code, _this4.RedirectURL);
-        _this4.OAuthTokens = response.data;
+        var response = yield _this5.Api.token_authorization_code(authorization_code, _this5.RedirectURL);
+        _this5.OAuthTokens = response.data;
         sessionStorage.setItem('SeaCatOAuth2Tokens', JSON.stringify(response.data));
+        _this5._markAuthPageActive();
         return true;
       } catch (err) {
         console.error("Failed to update token", err);
@@ -453,18 +532,61 @@ class AuthModule extends _asab_webui_components.Module {
     })();
   }
 
+  /*
+  	Mark current tab as holding an active auth session
+  	Cleared on pagehide (refresh/close) so the next load keeps tokens
+  	A duplicated tab inherits the uncleared flag >> it is detected as a clone
+  */
+  _markAuthPageActive() {
+    sessionStorage.setItem('SeaCatAuthTabActive', '1'); // 1 stands for true (active)
+    // Subscribe just once, it is not intentional to trigger pagehide twice
+    if (this._unsubscribeLifecycle) return;
+    // Subscribe to the pagehide event
+    this._unsubscribeLifecycle = this.App.PubSub.subscribe('Application.lifecycle!', _ref4 => {
+      var type = _ref4.type,
+        persisted = _ref4.persisted;
+      if (type === 'pagehide' && !persisted) {
+        sessionStorage.removeItem('SeaCatAuthTabActive');
+      }
+    });
+  }
+
+  /*
+  	Login-loop protection wrapper around Api.login()
+  		Each call increments SeaCatLoginAttempts in sessionStorage. After more than
+  	MAX_LOGIN_ATTEMPTS consecutive redirects without a successful auth, further
+  	redirects are suppressed.
+  		The counter is cleared when initialize() completes successfully.
+  */
+  _attemptLogin(redirectURL) {
+    var _arguments = arguments,
+      _this6 = this;
+    return (0, _asyncToGenerator2.default)(function* () {
+      var force_login_prompt = _arguments.length > 1 && _arguments[1] !== undefined ? _arguments[1] : false;
+      var MAX_LOGIN_ATTEMPTS = 10;
+      _this6._loginAttempts += 1;
+      sessionStorage.setItem('SeaCatLoginAttempts', String(_this6._loginAttempts));
+      if (_this6._loginAttempts > MAX_LOGIN_ATTEMPTS) {
+        // The info card for a user who ends up in a login redirect loop is shown by LoginLoopCard via sessionStorage SeaCatLoginAttempts
+        console.error("AuthModule: Login redirect loop detected! ".concat(_this6._loginAttempts, " consecutive login redirects occurred! Please validate the authentication configuration."));
+        return;
+      }
+      yield _this6.Api.login(redirectURL, force_login_prompt);
+    })();
+  }
+
   // Method for refreshing OAuth tokens
   _refreshTokens() {
-    var _this5 = this;
+    var _this7 = this;
     return (0, _asyncToGenerator2.default)(function* () {
-      var _this5$OAuthTokens;
+      var _this7$OAuthTokens;
       // If no refresh_token found, return false
-      if (!((_this5$OAuthTokens = _this5.OAuthTokens) !== null && _this5$OAuthTokens !== void 0 && _this5$OAuthTokens.refresh_token)) {
+      if (!((_this7$OAuthTokens = _this7.OAuthTokens) !== null && _this7$OAuthTokens !== void 0 && _this7$OAuthTokens.refresh_token)) {
         return false;
       }
       try {
-        var response = yield _this5.Api.token_refresh(_this5.OAuthTokens.refresh_token);
-        _this5.OAuthTokens = response.data;
+        var response = yield _this7.Api.token_refresh(_this7.OAuthTokens.refresh_token);
+        _this7.OAuthTokens = response.data;
         sessionStorage.setItem('SeaCatOAuth2Tokens', JSON.stringify(response.data));
         return true;
       } catch (err) {
@@ -489,11 +611,47 @@ class AuthModule extends _asab_webui_components.Module {
     }
   }
 
+  // Trigger session expiration UI: show alert, disable UI, stop validation loop
+  _triggerSessionExpired() {
+    if (this._sessionExpired) return;
+    this._sessionExpired = true;
+    clearTimeout(this.sessionValidationInterval);
+    this.sessionValidationInterval = null;
+
+    // Remove the SeaCatAuthTabActive flag and unsubscribe from the pagehide subscription
+    sessionStorage.removeItem('SeaCatAuthTabActive');
+    if (this._unsubscribeLifecycle) {
+      this._unsubscribeLifecycle();
+      this._unsubscribeLifecycle = null;
+    }
+    this.App.addAlert("info", "ASABAuthModule|Your session has expired.", 3600 * 1000, true, alert => /*#__PURE__*/_react.default.createElement(_SessionExpirationAlert.SessionExpirationAlert, {
+      alert: alert
+    }));
+    if (this.App.AppStore) {
+      var _this$App$AppStore$di2, _this$App$AppStore2;
+      (_this$App$AppStore$di2 = (_this$App$AppStore2 = this.App.AppStore).dispatch) === null || _this$App$AppStore$di2 === void 0 || _this$App$AppStore$di2.call(_this$App$AppStore2, {
+        type: _actions.types.AUTH_SESSION_EXPIRATION,
+        sessionExpired: true
+      });
+
+      // Disable UI elements
+      [...document.querySelectorAll('#app-sidebar .nav-link, [class^="btn"]:not(.alert-button), [class*=" btn"]:not(.alert-button), .btn-group a, .page-item, input, select')].forEach(i => {
+        i.classList.add("disabled");
+        i.setAttribute("disabled", "");
+      });
+
+      // Reload on navigation actions
+      window.addEventListener("popstate", () => {
+        window.location.reload();
+      });
+    }
+  }
+
   // Loop validating session expiration
   _startSessionExpirationValidation() {
-    var _this6 = this;
+    var _this8 = this;
     return (0, _asyncToGenerator2.default)(function* () {
-      if (!_this6.SessionExpiration) {
+      if (!_this8.SessionExpiration) {
         console.warn("Session expiration is not set.");
         return;
       }
@@ -502,7 +660,7 @@ class AuthModule extends _asab_webui_components.Module {
       var MAX_SESSION_DURATION = Math.pow(2, 31) - 1;
 
       // Proactivelly validate session expiration
-      var lastKnownExpiration = _this6.SessionExpiration; // Last known session expiration
+      var lastKnownExpiration = _this8.SessionExpiration; // Last known session expiration
       var sessionStartTime = Date.now() / 1000; // Session start time
       var sessionDuration = lastKnownExpiration - sessionStartTime; // Session duration
       // Prevent glitches on very large time remaining values
@@ -515,9 +673,9 @@ class AuthModule extends _asab_webui_components.Module {
       var warningDisplayed = false; // Tracks if the "about to expire" warning has been shown
 
       var _validateSession = /*#__PURE__*/function () {
-        var _ref2 = (0, _asyncToGenerator2.default)(function* () {
+        var _ref5 = (0, _asyncToGenerator2.default)(function* () {
           var currentTime = Date.now() / 1000; // Convert milliseconds to seconds
-          var timeRemaining = _this6.SessionExpiration - currentTime; // Time difference for triggering "about to expire" warning
+          var timeRemaining = _this8.SessionExpiration - currentTime; // Time difference for triggering "about to expire" warning
           // Prevent glitches on very large time remaining values
           if (timeRemaining > MAX_SESSION_DURATION) {
             // Set timeout to maximum allowed value
@@ -527,13 +685,13 @@ class AuthModule extends _asab_webui_components.Module {
           // Validate session on half of the session expiration or if the remaining time is <= 5min
           if (!refreshSessionDone && (timeRemaining <= 300 || currentTime >= sessionMidpoint)) {
             refreshSessionDone = true;
-            var tokensRefreshed = yield _this6._refreshTokens();
+            var tokensRefreshed = yield _this8._refreshTokens();
             // Recalculate if session expiration was extended
             if (tokensRefreshed) {
-              yield _this6.updateUserInfo(); // Update userinfo
+              yield _this8.updateUserInfo(); // Update userinfo
               // If current session expiration differs from last known expiration, recalculate session variables
-              if (_this6.SessionExpiration !== lastKnownExpiration) {
-                lastKnownExpiration = _this6.SessionExpiration;
+              if (_this8.SessionExpiration !== lastKnownExpiration) {
+                lastKnownExpiration = _this8.SessionExpiration;
                 sessionStartTime = currentTime;
                 sessionDuration = lastKnownExpiration - sessionStartTime;
                 // Prevent glitches on very large time remaining values
@@ -549,55 +707,32 @@ class AuthModule extends _asab_webui_components.Module {
 
           // If remaining time is between 1 and 60s, repetitivelly ask for userInfo and trigger "about to expire" warning
           if (timeRemaining <= 60 && timeRemaining > 0) {
-            var _tokensRefreshed = yield _this6._refreshTokens(); // Returns true/false if token is refreshed/not refreshed
-            yield _this6.updateUserInfo(); // Continue updating user info
+            var _tokensRefreshed = yield _this8._refreshTokens(); // Returns true/false if token is refreshed/not refreshed
+            yield _this8.updateUserInfo(); // Continue updating user info
             if (!_tokensRefreshed && !warningDisplayed) {
-              _this6.App.addAlert("info", "General|Your session will expire soon", 30, true);
+              _this8.App.addAlert("info", "General|Your session will expire soon", 30, true);
               warningDisplayed = true; // Mark the warning as displayed
             }
           }
 
           // Validation on expired session
-          if (_this6.SessionExpiration <= currentTime) {
+          if (_this8.SessionExpiration <= currentTime) {
             // Handle refresh token prior updating user info
-            yield _this6._refreshTokens();
+            yield _this8._refreshTokens();
             // Handle session expiration
-            var isUserInfoUpdated = yield _this6.updateUserInfo();
+            var isUserInfoUpdated = yield _this8.updateUserInfo();
             if (!isUserInfoUpdated) {
               // Stop further checks
-              clearTimeout(_this6.sessionValidationInterval);
-              _this6.sessionValidationInterval = null;
-              _this6.App.addAlert("info", "ASABAuthModule|Your session has expired.", 3600 * 1000, true, alert => /*#__PURE__*/_react.default.createElement(_SessionExpirationAlert.SessionExpirationAlert, {
-                alert: alert
-              }));
-              // Disable UI elements
-              if (_this6.App.AppStore) {
-                var _this6$App$AppStore$d, _this6$App$AppStore;
-                (_this6$App$AppStore$d = (_this6$App$AppStore = _this6.App.AppStore).dispatch) === null || _this6$App$AppStore$d === void 0 || _this6$App$AppStore$d.call(_this6$App$AppStore, {
-                  type: _actions.types.AUTH_SESSION_EXPIRATION,
-                  sessionExpired: true
-                });
-
-                // Disable UI elements
-                [...document.querySelectorAll('#app-sidebar .nav-link, [class^="btn"]:not(.alert-button), [class*=" btn"]:not(.alert-button), .btn-group a, .page-item, input, select')].forEach(i => {
-                  i.classList.add("disabled");
-                  i.setAttribute("disabled", "");
-                });
-
-                // Reload on navigation actions
-                window.addEventListener("popstate", () => {
-                  window.location.reload();
-                });
-              }
+              _this8._triggerSessionExpired();
               return;
             }
           }
 
           // Re-trigger validation after 10 seconds
-          _this6.sessionValidationInterval = setTimeout(_validateSession, 10000);
+          _this8.sessionValidationInterval = setTimeout(_validateSession, 10000);
         });
         return function validateSession() {
-          return _ref2.apply(this, arguments);
+          return _ref5.apply(this, arguments);
         };
       }();
 
@@ -609,7 +744,7 @@ class AuthModule extends _asab_webui_components.Module {
   // Stop looping on session expiration validation
   _stopSessionExpirationValidation() {
     if (this.sessionValidationInterval) {
-      clearInterval(this.sessionValidationInterval);
+      clearTimeout(this.sessionValidationInterval);
       this.sessionValidationInterval = null;
     }
   }

package/dist/modules/tenant/TenantDropdown.js

@@ -7,15 +7,11 @@ Object.defineProperty(exports, "__esModule", {
 exports.default = TenantDropdown;
 var _slicedToArray2 = _interopRequireDefault(require("@babel/runtime/helpers/slicedToArray"));
 var _react = _interopRequireWildcard(require("react"));
-var _reactRouter = require("react-router");
 var _asab_webui_components = require("asab_webui_components");
 var _reactI18next = require("react-i18next");
-var _seacatAuth = require("asab_webui_components/seacat-auth");
 var _reactstrap = require("reactstrap");
 function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function _interopRequireWildcard(e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (var _t in e) "default" !== _t && {}.hasOwnProperty.call(e, _t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, _t)) && (i.get || i.set) ? o(f, _t, i) : f[_t] = e[_t]); return f; })(e, t); }
-function TenantDropdown(_ref) {
-  var _app$Modules;
-  var app = _ref.app;
+function TenantDropdown() {
   var _useTranslation = (0, _reactI18next.useTranslation)(),
     t = _useTranslation.t;
   var _useState = (0, _react.useState)(false),
@@ -34,9 +30,6 @@ function TenantDropdown(_ref) {
     var _state$tenant2;
     return state === null || state === void 0 || (_state$tenant2 = state.tenant) === null || _state$tenant2 === void 0 ? void 0 : _state$tenant2.tenants;
   });
-  var canCreateTenant = (app === null || app === void 0 || (_app$Modules = app.Modules) === null || _app$Modules === void 0 ? void 0 : _app$Modules.some(obj => (obj === null || obj === void 0 ? void 0 : obj.Name) === "LmioTrexModule")) && (0, _seacatAuth.isAuthorized)(['lmio:tenant:create'], app);
-  var tenantsAvailable = tenants && tenants.length > 0;
-  var showDropdown = tenantsAvailable || canCreateTenant;
   var hasSearch = (tenants === null || tenants === void 0 ? void 0 : tenants.length) >= 10; // Display search input if there is >= 10 tenants
   var toggle = () => {
     setIsOpen(prev => !prev);
@@ -59,12 +52,12 @@ function TenantDropdown(_ref) {
     className: "bi bi-house-lock pe-2"
   }), /*#__PURE__*/_react.default.createElement(TenantLabel, {
     tenant: current
-  })), isOpen && showDropdown && /*#__PURE__*/_react.default.createElement(_reactstrap.DropdownMenu, {
+  })), isOpen && (tenants === null || tenants === void 0 ? void 0 : tenants.length) > 0 && /*#__PURE__*/_react.default.createElement(_reactstrap.DropdownMenu, {
     className: "shadow overflow-y-auto".concat(hasSearch ? ' pt-0' : ''),
     style: {
       maxHeight: '20em'
     }
-  }, tenantsAvailable && /*#__PURE__*/_react.default.createElement(_react.default.Fragment, null, /*#__PURE__*/_react.default.createElement(_reactstrap.DropdownItem, {
+  }, /*#__PURE__*/_react.default.createElement(_reactstrap.DropdownItem, {
     header: true
   }, t('General|Tenants')), hasSearch && /*#__PURE__*/_react.default.createElement(_reactstrap.Input, {
     value: searchInput,
@@ -78,14 +71,9 @@ function TenantDropdown(_ref) {
     href: '?tenant=' + tenant + '#/'
   }, /*#__PURE__*/_react.default.createElement(TenantLabel, {
     tenant: tenant
-  })))), canCreateTenant && /*#__PURE__*/_react.default.createElement(_react.default.Fragment, null, tenantsAvailable && /*#__PURE__*/_react.default.createElement(_reactstrap.DropdownItem, {
-    divider: true
-  }), /*#__PURE__*/_react.default.createElement(_reactstrap.DropdownItem, {
-    tag: _reactRouter.Link,
-    to: "/config/tenant/!create"
-  }, t('TenantDropdown|Create tenant')))));
+  })))));
 }
-function TenantLabel(_ref2) {
-  var tenant = _ref2.tenant;
+function TenantLabel(_ref) {
+  var tenant = _ref.tenant;
   return /*#__PURE__*/_react.default.createElement("span", null, tenant);
 }

package/dist/utils/pageLifecycle.js

@@ -0,0 +1,87 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.subscribePageHide = subscribePageHide;
+/*
+	Page lifecycle helpers
+
+	Low-level fan-out wrappers around browser page lifecycle events.
+	These are used exclusively by Application._initPageLifecycleBridge to build
+	the app-level PubSub topic `Application.lifecycle!`
+
+	Exported event types bridged:
+	  'pagehide' - subscribePageHide
+	  TODO: implement 'pageshow'
+
+	subscribePageHide attaches a single window 'pagehide' listener and fans out
+	to registered callbacks. Callers receive the native PageTransitionEvent and
+	should check event.persisted when they care about bfcache vs real unload.
+
+	Returns an unsubscribe function. The window listener is removed when the
+	last subscriber unsubscribes.
+
+	An optional AbortSignal can be passed as the second argument to tie the
+	subscription lifetime to an AbortController - the callback is removed
+	automatically when the signal is aborted, without needing to call the
+	returned unsubscribe function explicitly.
+
+	Usage:
+
+	PREFERRED - subscribe via the app-level PubSub topic Application.lifecycle!
+	Current types: 'pagehide'  (more will be added, e.g. 'pageshow')
+
+		import { usePubSub } from 'asab_webui_components';
+
+		function MyComponent() {
+			const { subscribe } = usePubSub();
+			useEffect(() => {
+				const unsubscribe = subscribe('Application.lifecycle!', ({ type, persisted }) => {
+				if (type === 'pagehide' && !persisted) {
+					// real unload
+				}
+				});
+				return unsubscribe; // React cleans up on unmount
+			}, []);
+		}
+*/
+
+var pageHideCallbacks = new Set();
+function onPageHide(event) {
+  pageHideCallbacks.forEach(callback => {
+    try {
+      callback(event);
+    } catch (err) {
+      console.error('pageLifecycle: pagehide callback failed', err);
+    }
+  });
+}
+
+// Subscribe to window 'pagehide' event
+function subscribePageHide(callback, signal) {
+  if (typeof callback !== 'function') {
+    return () => {};
+  }
+  if (typeof window === 'undefined') {
+    return () => {};
+  }
+  if (signal !== null && signal !== void 0 && signal.aborted) {
+    return () => {};
+  }
+  var wasEmpty = pageHideCallbacks.size === 0;
+  pageHideCallbacks.add(callback);
+  if (wasEmpty) {
+    window.addEventListener('pagehide', onPageHide);
+  }
+  var unsubscribe = () => {
+    pageHideCallbacks.delete(callback);
+    if (pageHideCallbacks.size === 0 && typeof window !== 'undefined') {
+      window.removeEventListener('pagehide', onPageHide);
+    }
+  };
+  signal === null || signal === void 0 || signal.addEventListener('abort', unsubscribe, {
+    once: true
+  });
+  return unsubscribe;
+}

package/dist/utils/statusAlerts.js

@@ -9,8 +9,13 @@ exports.STATUS_ALERTS = void 0;
 	This is a extension to the addAlertFromException function in the Application.js file.
 	
 	The 502, 503 and 504 errors are handled directly in the Application.js file, since it does not render an alert at all.
+	The 401 alert is suppressed in Application.js when the session has expired (AuthModule shows SessionExpirationAlert).
 */
 var STATUS_ALERTS = exports.STATUS_ALERTS = {
+  401: {
+    level: 'warning',
+    message: 'General|Unauthorized request. Please contact the administrator.'
+  },
   408: {
     level: 'warning',
     message: 'General|The request timed out. Please try again.'

package/dist/utils/statusAlerts.jsx

@@ -3,8 +3,13 @@
 	This is a extension to the addAlertFromException function in the Application.js file.
 	
 	The 502, 503 and 504 errors are handled directly in the Application.js file, since it does not render an alert at all.
+	The 401 alert is suppressed in Application.js when the session has expired (AuthModule shows SessionExpirationAlert).
 */
 export const STATUS_ALERTS = {
+	401: {
+		level: 'warning',
+		message: 'General|Unauthorized request. Please contact the administrator.',
+	},
 	408: {
 		level: 'warning',
 		message: 'General|The request timed out. Please try again.',

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "asab_webui_shell",
-	"version": "27.7.5-alpha.0",
+	"version": "27.8.1",
 	"license": "BSD-3-Clause",
 	"description": "TeskaLabs ASAB WebUI Shell Application",
 	"contributors": [