fix(webapp): stop the public landing page looping to /login under the /api base path (#1334)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: FelixTJDietrich

webapp/src/integrations/auth/sessionExpiry.test.ts

@@ -7,6 +7,10 @@ import { refreshAccessToken } from "./sessionRefresh";
 vi.mock("./sessionRefresh", () => ({ refreshAccessToken: vi.fn() }));
 const refreshMock = vi.mocked(refreshAccessToken);
 
+// Prod serves the API under /api (Traefik strips it); pin a base path so the exemptions are exercised
+// the way they run in prod — the GET /api/user probe must be exempt exactly like /user is locally.
+vi.mock("@/environment", () => ({ default: { serverUrl: "http://localhost/api" } }));
+
 // jsdom's window.location is not directly assignable; replace it with a stub exposing `assign` plus
 // the pathname/search/origin the handler reads.
 function stubLocation(pathname: string, search = ""): { assigned: string[] } {
@@ -130,6 +134,30 @@ describe("handlePossibleSessionExpiry", () => {
 		expect(assigned).toHaveLength(0);
 	});
 
+	it("does NOT handle a 401 from the GET /api/user probe (prod /api base path)", () => {
+		// A logged-out visitor on the public landing (pathname "/") probes the session; the /api-prefixed
+		// probe must be exempt, not drive the login redirect.
+		const { assigned } = stubLocation("/");
+		const handled = handlePossibleSessionExpiry(
+			res(401, "http://localhost/api/user"),
+			makeQueryClient(),
+		);
+		expect(handled).toBe(false);
+		expect(refreshMock).not.toHaveBeenCalled();
+		expect(assigned).toHaveLength(0);
+	});
+
+	it("does NOT handle a 401 from /api/auth/* endpoints (prod /api base path)", () => {
+		const { assigned } = stubLocation("/");
+		const handled = handlePossibleSessionExpiry(
+			res(401, "http://localhost/api/auth/refresh"),
+			makeQueryClient(),
+		);
+		expect(handled).toBe(false);
+		expect(refreshMock).not.toHaveBeenCalled();
+		expect(assigned).toHaveLength(0);
+	});
+
 	it("does NOT handle a 401 from /auth/* endpoints (refresh must not recurse)", () => {
 		const { assigned } = stubLocation("/");
 		const handled = handlePossibleSessionExpiry(

webapp/src/integrations/auth/sessionExpiry.ts

@@ -1,8 +1,22 @@
 import type { QueryClient } from "@tanstack/react-query";
 import { getCurrentUserQueryKey } from "@/api/@tanstack/react-query.gen";
+import environment from "@/environment";
 import { safeReturnTo } from "@/integrations/auth/guard";
 import { refreshAccessToken } from "@/integrations/auth/sessionRefresh";
 
+/**
+ * The API client prefixes every request with `environment.serverUrl` (`/api` in prod where Traefik
+ * strips it, empty in local dev). Returns that base path so the endpoint exemptions below match across
+ * deploys, not just the local unprefixed shape.
+ */
+function apiBasePath(): string {
+	try {
+		return new URL(environment.serverUrl, window.location.origin).pathname.replace(/\/$/, "");
+	} catch {
+		return "";
+	}
+}
+
 /**
  * Paths whose own 401 must NOT trigger a redirect-to-login. The `GET /user` identity probe
  * legitimately 401s while logged out (and is the query the login page itself reads), so reacting
@@ -18,6 +32,11 @@ function isExemptFromSessionExpiry(pathname: string, url: string): boolean {
 	} catch {
 		// Leave requestPath as-is for an unparseable URL.
 	}
+	// Strip the API base path so `/api/user` (prod) matches the same exemptions as `/user` (local dev).
+	const base = apiBasePath();
+	if (base && requestPath.startsWith(`${base}/`)) {
+		requestPath = requestPath.slice(base.length);
+	}
 	if (requestPath === "/user") return true;
 	if (requestPath.startsWith("/auth/")) return true;
 	// Don't redirect when we're already on (or heading to) the login page.