Merge pull request #512 from paulmeier/fix/oidc-sso-state-403-510

fix(oidc): make SSO callback idempotent + evict stale legacy service worker (#510)

frontend/src/lib/utils/killLegacyServiceWorker.ts

@@ -0,0 +1,28 @@
+export async function killLegacyServiceWorker(): Promise<void> {
+	if (typeof navigator === 'undefined' || !('serviceWorker' in navigator)) return;
+
+	try {
+		const registrations = await navigator.serviceWorker.getRegistrations();
+		const legacy = registrations.filter((r) => {
+			const url = r.active?.scriptURL ?? r.waiting?.scriptURL ?? r.installing?.scriptURL ?? '';
+			return url.endsWith('/sw.js');
+		});
+		if (legacy.length === 0) return;
+
+		await Promise.all(legacy.map((r) => r.unregister()));
+
+		if ('caches' in window) {
+			const keys = await caches.keys();
+			await Promise.all(
+				keys.filter((k) => k.startsWith('oxicloud-cache')).map((k) => caches.delete(k))
+			);
+		}
+
+		if (navigator.serviceWorker.controller && !sessionStorage.getItem('legacy-sw-killed')) {
+			sessionStorage.setItem('legacy-sw-killed', '1');
+			location.reload();
+		}
+	} catch {
+		/* best-effort cleanup */
+	}
+}

frontend/src/routes/+layout.svelte

@@ -11,6 +11,7 @@
 	import { session } from '$lib/stores/session.svelte';
 	import { ui } from '$lib/stores/ui.svelte';
 	import { hashUrlToPath } from '$lib/utils/hashRedirect';
+	import { killLegacyServiceWorker } from '$lib/utils/killLegacyServiceWorker';
 
 	let { children } = $props();
 
@@ -35,6 +36,8 @@
 	let ready = $state(false);
 
 	onMount(async () => {
+		await killLegacyServiceWorker();
+
 		// The instant HTML boot splash has done its job — the app is mounted, so
 		// the route (login renders immediately; protected routes show their own
 		// loading state) is already in the DOM behind it.