From df3b808792daa745b5b0d5b9896ddca8849fe8b1 Mon Sep 17 00:00:00 2001
From: Christophe Besson <cbesson@gmail.com>
Date: Mon, 14 Sep 2026 16:16:45 +0200
Subject: fix(ui): a signed-in person is never shown the sign-in form

The router rendered `#/login`, `#/register` and `#/reset` before it checked
for a user. A browser signed in as one account, opening on a `#/login` left
in the address bar, drew the login form (prefilled by the browser with
another account) under a navigation bar and a sidebar already showing the
first account and its Administration entry.

`#/login` and `#/register` now need no one signed in, and a signed-in person
landing on either is sent home with `location.replace`, so Back does not lead
to the form again. `#/reset` stays reachable: that flow signs in half-way and
still has its progress and result to show.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T6jPTeocXA1BePekdsgPya
---
 packages/meshbay-hub/src/meshbay_hub/static/app.js | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

(limited to 'packages/meshbay-hub/src')

diff --git a/packages/meshbay-hub/src/meshbay_hub/static/app.js b/packages/meshbay-hub/src/meshbay_hub/static/app.js
index ee0ab07..87c4e33 100644
--- a/packages/meshbay-hub/src/meshbay_hub/static/app.js
+++ b/packages/meshbay-hub/src/meshbay_hub/static/app.js
@@ -668,6 +668,15 @@ function App() {
   const route = useRoute();
   const [theme, setTheme] = useState(getInitialTheme);
   const [user, setUser] = useState(loadAuth);
+  // Signed in, on the sign-in or sign-up form. A session restored under a
+  // `#/login` still in the address bar drew the login form, prefilled by the
+  // browser, beneath a navigation bar already showing the account. Home instead,
+  // with `replace` so Back does not lead to the form again. Not `#/reset`: that
+  // flow signs in half-way and still has its progress and result to show.
+  const onAuthForm = route === '/login' || route === '/register';
+  useEffect(() => {
+    if (user && onAuthForm) window.location.replace('#/');
+  }, [user, onAuthForm]);
   // A desktop build with a remembered device signs in without asking. Null
   // until it has tried, so nothing renders a sign-in form the user is about to
   // be taken past.
@@ -1007,7 +1016,7 @@ function App() {
     // Signing in with this device's key. Showing a form here would be showing
     // one the user is about to be taken past.
     page = html`<p class="page-message">${t('status.connecting')}</p>`;
-  } else if (route === '/login' || route === '/register' || route === '/reset') {
+  } else if ((onAuthForm && !user) || route === '/reset') {
     page = route === '/register'
       ? html`<${RegisterPage} />`
       : route === '/reset'
-- 
cgit v1.2.3