From ce68af5be3aec53be3a6d5e690a5d084d8de55a3 Mon Sep 17 00:00:00 2001
From: Leo Vasanko <leo@git>
Date: Mon, 16 Feb 2026 23:38:23 +0000
Subject: [PATCH] Correct OIDC mode handling in restricted app.

---
 frontend/auth/restricted/RestrictedApi.vue | 13 ++++++++++++-
 frontend/src/components/RestrictedAuth.vue |  9 +++++++--
 2 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/frontend/auth/restricted/RestrictedApi.vue b/frontend/auth/restricted/RestrictedApi.vue
index a9d8fb7..3fb1b4d 100644
--- a/frontend/auth/restricted/RestrictedApi.vue
+++ b/frontend/auth/restricted/RestrictedApi.vue
@@ -36,7 +36,18 @@ function extractRemoteToken() {
 
 // Parse URL hash fragment
 const hashParams = new URLSearchParams(window.location.hash.slice(1))
-const authMode = ['reauth', 'forbidden'].includes(hashParams.get('mode')) ? hashParams.get('mode') : 'login'
+
+// Determine auth mode based on URL path
+// - /auth/restricted/oidc: OIDC flow, no session dependency
+// - /auth/restricted/iframe: iframe embedding, mode from hash params
+// - Other paths: forward auth, mode from hash params
+let authMode
+if (window.location.pathname === '/auth/restricted/oidc') {
+  authMode = 'oidc'
+} else {
+  // Both iframe and forward auth use hash params for mode (forbidden/login/reauth)
+  authMode = ['reauth', 'forbidden'].includes(hashParams.get('mode')) ? hashParams.get('mode') : 'login'
+}
 
 function postToParent(message) {
   if (window.parent && window.parent !== window) {
diff --git a/frontend/src/components/RestrictedAuth.vue b/frontend/src/components/RestrictedAuth.vue
index b5a2ca3..6bc6645 100644
--- a/frontend/src/components/RestrictedAuth.vue
+++ b/frontend/src/components/RestrictedAuth.vue
@@ -66,7 +66,7 @@ const props = defineProps({
   mode: {
     type: String,
     default: 'login',
-    validator: (value) => ['login', 'reauth', 'forbidden'].includes(value)
+    validator: (value) => ['login', 'reauth', 'forbidden', 'oidc'].includes(value)
   },
   oidcQueryString: {
     type: String,
@@ -275,7 +275,12 @@ watch(initializing, (newVal) => {
 
 onMounted(async () => {
   await fetchSettings()
-  await validateSession()
+  // OIDC mode doesn't depend on session state - skip validation
+  if (props.mode !== 'oidc') {
+    await validateSession()
+  } else {
+    currentView.value = 'login'
+  }
   initializing.value = false
 
   // Add click handler for inline links