From 1782547b9e2a363767dd6951c2449d076d033c2d Mon Sep 17 00:00:00 2001
From: Leo Vasanko <git@vasanko.com>
Date: Thu, 4 Dec 2025 03:56:17 +0000
Subject: [PATCH] Fix infinitely nested login iframes when the restricted app
 notices it needs login.

---
 frontend/src/utils/api.js | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/frontend/src/utils/api.js b/frontend/src/utils/api.js
index f3b53f8..4929766 100644
--- a/frontend/src/utils/api.js
+++ b/frontend/src/utils/api.js
@@ -228,16 +228,11 @@ export async function apiFetch(url, options = {}) {
         // If we can't parse JSON, no iframe available
       }
 
-      if (authInfo?.iframe) {
-        // If an auth iframe is already open (from app or another request), don't open another
-        // Just return the response so the caller can handle it
-        if (isAuthIframeOpen()) {
-          return response
-        }
+      // Authenticate via iframe (if not already in a frame, and no existing #auth-iframe)
+      if (authInfo?.iframe && window === window.top && !isAuthIframeOpen()) {
         // Show auth iframe and wait for success (throws AuthCancelledError on cancel)
         await showAuthIframe(authInfo.iframe)
-        // Loop to retry the original request
-        continue
+        continue  // Retry the original request
       }
     }