fix(ui): a signed-in person is never shown the sign-in form

The router rendered `#/login`, `#/register` and `#/reset` before it checked
for a user. A browser signed in as one account, opening on a `#/login` left
in the address bar, drew the login form (prefilled by the browser with
another account) under a navigation bar and a sidebar already showing the
first account and its Administration entry.

`#/login` and `#/register` now need no one signed in, and a signed-in person
landing on either is sent home with `location.replace`, so Back does not lead
to the form again. `#/reset` stays reachable: that flow signs in half-way and
still has its progress and result to show.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T6jPTeocXA1BePekdsgPya

2 files changed, 70 insertions, 1 deletions

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/app.js b/packages/meshbay-hub/src/meshbay_hub/static/app.js
index ee0ab07..87c4e33 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/app.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/app.js
@@ -668,6 +668,15 @@ function App() {
   const route = useRoute();
   const [theme, setTheme] = useState(getInitialTheme);
   const [user, setUser] = useState(loadAuth);
+  // Signed in, on the sign-in or sign-up form. A session restored under a
+  // `#/login` still in the address bar drew the login form, prefilled by the
+  // browser, beneath a navigation bar already showing the account. Home instead,
+  // with `replace` so Back does not lead to the form again. Not `#/reset`: that
+  // flow signs in half-way and still has its progress and result to show.
+  const onAuthForm = route === '/login' || route === '/register';
+  useEffect(() => {
+    if (user && onAuthForm) window.location.replace('#/');
+  }, [user, onAuthForm]);
   // A desktop build with a remembered device signs in without asking. Null
   // until it has tried, so nothing renders a sign-in form the user is about to
   // be taken past.
@@ -1007,7 +1016,7 @@ function App() {
     // Signing in with this device's key. Showing a form here would be showing
     // one the user is about to be taken past.
     page = html`<p class="page-message">${t('status.connecting')}</p>`;
-  } else if (route === '/login' || route === '/register' || route === '/reset') {
+  } else if ((onAuthForm && !user) || route === '/reset') {
     page = route === '/register'
       ? html`<${RegisterPage} />`
       : route === '/reset'
diff --git a/packages/meshbay-hub/tests/test_signed_in_never_sees_the_login_form.py b/packages/meshbay-hub/tests/test_signed_in_never_sees_the_login_form.py
new file mode 100644
index 0000000..547f7d4
--- /dev/null
+++ b/packages/meshbay-hub/tests/test_signed_in_never_sees_the_login_form.py
@@ -0,0 +1,60 @@
+"""
+A signed-in person is never shown the sign-in form.
+
+Found live on meshbay.org (2026-09-14): a browser already signed in as one
+account opened on `#/login` — a hash left in the address bar, restored with the
+session — and the router drew the login form, prefilled by the browser with
+another account's name and passphrase, under a navigation bar and a sidebar
+that already showed the first account and its Administration entry. The router
+tested the route before it tested for a user.
+
+Source-level, as the other routing guards here are: the SPA has no component
+test harness, and the whole defect is the order of two conditions.
+"""
+
+import re
+from pathlib import Path
+
+import pytest
+
+STATIC = Path(__file__).resolve().parents[1] / "src" / "meshbay_hub" / "static"
+APP = STATIC / "app.js"
+
+pytestmark = pytest.mark.skipif(not APP.exists(), reason="SPA sources unavailable")
+
+
+@pytest.fixture(scope="module")
+def app_body() -> str:
+    source = APP.read_text(encoding="utf-8")
+    start = source.index("\nfunction App() {")
+    return source[start:source.index("\n}\n", start)]
+
+
+def _branch_rendering(body: str, page: str) -> str:
+    """The `else if (...)` condition of the branch that renders `page`."""
+    at = body.index(f"<${{{page}}}")
+    head = body.rindex("} else if (", 0, at)
+    return body[head:body.index("{\n", head)]
+
+
+def test_the_login_and_register_forms_need_no_one_signed_in(app_body):
+    cond = _branch_rendering(app_body, "RegisterPage")
+    assert "!user" in cond, (
+        f"the sign-in/sign-up branch renders whoever is signed in: {cond!r}")
+    assert re.search(r"onAuthForm\s*&&\s*!user", cond)
+
+
+def test_the_reset_flow_is_not_cut_off_when_it_signs_in(app_body):
+    """ResetPasswordPage calls onLogin, then shows progress and a result. Gating
+    it on `!user` would unmount it the moment it signs the person in."""
+    cond = _branch_rendering(app_body, "ResetPasswordPage")
+    assert "route === '/reset'" in cond
+    assert not re.search(r"route === '/reset'\s*&&\s*!user", cond)
+
+
+def test_a_signed_in_person_on_the_form_is_sent_home_without_a_history_entry(app_body):
+    assert "const onAuthForm = route === '/login' || route === '/register';" in app_body
+    effect = app_body[app_body.index("if (user && onAuthForm)"):]
+    effect = effect[:effect.index("\n")]
+    assert "window.location.replace('#/')" in effect, (
+        "Back must not lead to the form again")