fix(ui): a signed-in person is never shown the sign-in form

The router rendered `#/login`, `#/register` and `#/reset` before it checked
for a user. A browser signed in as one account, opening on a `#/login` left
in the address bar, drew the login form (prefilled by the browser with
another account) under a navigation bar and a sidebar already showing the
first account and its Administration entry.

`#/login` and `#/register` now need no one signed in, and a signed-in person
landing on either is sent home with `location.replace`, so Back does not lead
to the form again. `#/reset` stays reachable: that flow signs in half-way and
still has its progress and result to show.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T6jPTeocXA1BePekdsgPya

1 files changed, 60 insertions, 0 deletions

diff --git a/packages/meshbay-hub/tests/test_signed_in_never_sees_the_login_form.py b/packages/meshbay-hub/tests/test_signed_in_never_sees_the_login_form.py
new file mode 100644
index 0000000..547f7d4
--- /dev/null
+++ b/packages/meshbay-hub/tests/test_signed_in_never_sees_the_login_form.py
@@ -0,0 +1,60 @@
+"""
+A signed-in person is never shown the sign-in form.
+
+Found live on meshbay.org (2026-09-14): a browser already signed in as one
+account opened on `#/login` — a hash left in the address bar, restored with the
+session — and the router drew the login form, prefilled by the browser with
+another account's name and passphrase, under a navigation bar and a sidebar
+that already showed the first account and its Administration entry. The router
+tested the route before it tested for a user.
+
+Source-level, as the other routing guards here are: the SPA has no component
+test harness, and the whole defect is the order of two conditions.
+"""
+
+import re
+from pathlib import Path
+
+import pytest
+
+STATIC = Path(__file__).resolve().parents[1] / "src" / "meshbay_hub" / "static"
+APP = STATIC / "app.js"
+
+pytestmark = pytest.mark.skipif(not APP.exists(), reason="SPA sources unavailable")
+
+
+@pytest.fixture(scope="module")
+def app_body() -> str:
+    source = APP.read_text(encoding="utf-8")
+    start = source.index("\nfunction App() {")
+    return source[start:source.index("\n}\n", start)]
+
+
+def _branch_rendering(body: str, page: str) -> str:
+    """The `else if (...)` condition of the branch that renders `page`."""
+    at = body.index(f"<${{{page}}}")
+    head = body.rindex("} else if (", 0, at)
+    return body[head:body.index("{\n", head)]
+
+
+def test_the_login_and_register_forms_need_no_one_signed_in(app_body):
+    cond = _branch_rendering(app_body, "RegisterPage")
+    assert "!user" in cond, (
+        f"the sign-in/sign-up branch renders whoever is signed in: {cond!r}")
+    assert re.search(r"onAuthForm\s*&&\s*!user", cond)
+
+
+def test_the_reset_flow_is_not_cut_off_when_it_signs_in(app_body):
+    """ResetPasswordPage calls onLogin, then shows progress and a result. Gating
+    it on `!user` would unmount it the moment it signs the person in."""
+    cond = _branch_rendering(app_body, "ResetPasswordPage")
+    assert "route === '/reset'" in cond
+    assert not re.search(r"route === '/reset'\s*&&\s*!user", cond)
+
+
+def test_a_signed_in_person_on_the_form_is_sent_home_without_a_history_entry(app_body):
+    assert "const onAuthForm = route === '/login' || route === '/register';" in app_body
+    effect = app_body[app_body.index("if (user && onAuthForm)"):]
+    effect = effect[:effect.index("\n")]
+    assert "window.location.replace('#/')" in effect, (
+        "Back must not lead to the form again")