Fix: Complete OIDC login flow - exchange code for tokens on frontend

The backend redirected to /?oidc_code=<code> after successful OIDC auth, but the frontend never exchanged this code for JWT tokens. The user was redirected back to the login page every time. - app.js: Detect oidc_code in URL params before token check, call POST /api/auth/oidc/exchange, store tokens, reload clean - auth.js: Fallback handler if oidc_code lands on login page Fixes #90
2026-02-13 21:33:45 +01:00
parent d0d5489994
commit 33ed3bd66c
2 changed files with 130 additions and 0 deletions
@@ -531,6 +531,62 @@ document.addEventListener('DOMContentLoaded', () => {
        return;
    }
    
+    // --- OIDC exchange code handling (fallback if landing on login page) ---
+    const urlParams = new URLSearchParams(window.location.search);
+    const oidcCode = urlParams.get('oidc_code');
+    
+    if (oidcCode) {
+        console.log('OIDC exchange code detected on login page, exchanging...');
+        (async () => {
+            try {
+                const resp = await fetch('/api/auth/oidc/exchange', {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify({ code: oidcCode })
+                });
+                
+                if (!resp.ok) {
+                    console.error('OIDC exchange failed:', resp.status);
+                    return; // Fall through to normal login page
+                }
+                
+                const data = await resp.json();
+                const token = data.access_token || data.token;
+                const refreshToken = data.refresh_token || data.refreshToken;
+                
+                if (token) {
+                    localStorage.setItem(TOKEN_KEY, token);
+                    if (refreshToken) localStorage.setItem(REFRESH_TOKEN_KEY, refreshToken);
+                    
+                    // Parse JWT expiry
+                    const tokenParts = token.split('.');
+                    if (tokenParts.length === 3) {
+                        try {
+                            const payload = JSON.parse(atob(tokenParts[1]));
+                            if (payload.exp) {
+                                const expiryDate = new Date(payload.exp * 1000);
+                                if (!isNaN(expiryDate.getTime())) {
+                                    localStorage.setItem(TOKEN_EXPIRY_KEY, expiryDate.toISOString());
+                                }
+                            }
+                        } catch (e) { /* ignore parse errors */ }
+                    }
+                    
+                    if (data.user) {
+                        localStorage.setItem(USER_DATA_KEY, JSON.stringify(data.user));
+                    }
+                    
+                    // Redirect to main app
+                    window.location.href = '/?no_redirect=true';
+                    return;
+                }
+            } catch (err) {
+                console.error('OIDC exchange error:', err);
+            }
+        })();
+        return; // Don't initialize login page while exchanging
+    }
+    
    if (authInitialized) {
        console.log('Auth already initialized, skipping');
        return;