Merge pull request #3523 from rommapp/copilot/bugfix-bypass-autologin-feature

Fix bypass_autologin overwritten by 403 interceptor during app initialization

Author: gantoine

frontend/src/services/api/index.ts

@@ -74,9 +74,17 @@ api.interceptors.response.use(
       const params = new URLSearchParams(search);
       const fullPath = pathname + search;
 
-      // Don't redirect to login if already on an auth-exempt route
+      // Don't redirect to login if already on an auth-exempt route.
+      // Also resolve the route from the browser URL to handle the case where
+      // the router hasn't been started yet (e.g., during app initialization),
+      // which would otherwise cause router.currentRoute.value.name to be undefined.
       const currentRoute = router.currentRoute.value.name?.toString() ?? "";
-      if (isAuthExemptRoute(currentRoute)) {
+      const resolvedRoute = router.resolve(window.location.pathname);
+      const resolvedRouteName = resolvedRoute.name?.toString() ?? "";
+      if (
+        isAuthExemptRoute(currentRoute) ||
+        isAuthExemptRoute(resolvedRouteName)
+      ) {
         return Promise.reject(error);
       }
 

frontend/src/views/Auth/Login.vue

@@ -2,7 +2,7 @@
 import type { Emitter } from "mitt";
 import { inject, onMounted, ref } from "vue";
 import { useI18n } from "vue-i18n";
-import { useRouter } from "vue-router";
+import { useRoute, useRouter } from "vue-router";
 import { refetchCSRFToken } from "@/services/api";
 import identityApi from "@/services/api/identity";
 import storeAuth from "@/stores/auth";
@@ -14,6 +14,7 @@ const heartbeatStore = storeHeartbeat();
 const authStore = storeAuth();
 const emitter = inject<Emitter<Events>>("emitter");
 const router = useRouter();
+const route = useRoute();
 const username = ref("");
 const password = ref("");
 const visiblePassword = ref(false);
@@ -97,8 +98,7 @@ async function loginOIDC() {
 }
 
 onMounted(async () => {
-  const params = new URLSearchParams(window.location.search);
-  const bypassAutologin = params.get("bypass_autologin") === "true";
+  const bypassAutologin = route.query.bypass_autologin === "true";
   if (oidcEnabled && oidcAutologin && !bypassAutologin) {
     loginOIDC();
   }