From 7f5ad2aaca5bfb8c32d6ebe9efd126114c53b941 Mon Sep 17 00:00:00 2001 From: bruno Date: Fri, 10 Jul 2026 15:57:14 -0400 Subject: [PATCH] =?UTF-8?q?fix:=20login/logout=20flow=20=E2=80=94=20protec?= =?UTF-8?q?ted=20routes=20+=20redirect=20to=20login=20on=20logout?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Logout now redirects to /auth/login?provider=local instead of / - Dashboard / and /workspace check auth and redirect to login if no session - _get_user_or_redirect() helper added for reusable auth checks - No more fallback admin user on dashboard — explicit login required - Routes without session redirect to login page --- app/routers/auth.py | 4 ++-- app/routers/dashboard.py | 10 +++++++++- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/app/routers/auth.py b/app/routers/auth.py index 456e181..0b21f81 100644 --- a/app/routers/auth.py +++ b/app/routers/auth.py @@ -272,8 +272,8 @@ async def callback( @router.get("/logout") async def logout(): - """Clear session and redirect to dashboard.""" - response = RedirectResponse(url="/", status_code=302) + """Clear session and redirect to login page.""" + response = RedirectResponse(url="/auth/login?provider=local", status_code=302) response.delete_cookie("flowdeck_session") return response diff --git a/app/routers/dashboard.py b/app/routers/dashboard.py index 9170a8c..156e55c 100644 --- a/app/routers/dashboard.py +++ b/app/routers/dashboard.py @@ -4,7 +4,7 @@ from __future__ import annotations import logging from fastapi import APIRouter, Request, Query -from fastapi.responses import HTMLResponse +from fastapi.responses import HTMLResponse, RedirectResponse from app.services.gitea_client import gitea from app.auth.session import SessionManager @@ -14,6 +14,14 @@ logger = logging.getLogger(__name__) router = APIRouter(tags=["dashboard"]) +def _get_user_or_redirect(request: Request): + """Return decoded user or a RedirectResponse to login page.""" + user = SessionManager.decode_session(request.cookies.get("flowdeck_session", "")) + if not user: + return RedirectResponse("/auth/login?provider=local", status_code=302) + return user + + def _sidebar_data(request: Request, repos: list[dict]) -> dict: user = SessionManager.decode_session(request.cookies.get("flowdeck_session", "")) ws = user.get("login", "Bruno") if user else "Bruno"