fix(dashboard): kill no-auth login loop + cold-load flash#4813
Merged
Conversation
The dashboard service worker was cache-first for the app shell with a never-bumped CACHE_NAME, so a new deploy kept serving the stale index.html (pointing at old hashed bundles) forever. On no-auth localhost the stale build looped on /dashboard/login; even after a fix, soft navigations re-served the broken shell. - Bump CACHE_NAME v1 -> v2 so activate purges the old cache. - Navigations are network-first (index.html re-fetches new asset hashes; falls back to cache only when offline). - Hashed static assets stay cache-first (immutable, content-addressed). - /v1/, /auth/, and */events are network-only (never cache live data) — the old SW only network-firsted /api/ which does not exist. Generated by Hephaestus (Aegis dev agent)
In no-auth/zero-config mode (authMode null, no token), the dashboard authenticates via probePublicAccess in init(). But revalidate() only restored cookie/token sessions (authMode 'oidc'/'token') and fell through to clearAuthState for authMode null — so any revalidate call (e.g. the session-expiry guard tick) logged the user out, causing an intermittent ~1s login flash on cold load. Guard the no-token branch: when authMode is null there is nothing to revalidate, so preserve isAuthenticated instead of clearing. Verified: fresh-tab soft-navigate stays on Overview (17/17 samples, 0 login flashes; previously ~1 LOGIN per load). Generated by Hephaestus (Aegis dev agent)
![aegis-gh-agent[bot]](https://avatars.githubusercontent.com/u/106186915?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
✅ Approved — All 9 gates pass
PR #4813 — fix(dashboard): kill no-auth login loop + cold-load flash
Gate Sweep
| # | Gate | Status |
|---|---|---|
| 1 | Review completed | ✅ Full diff reviewed |
| 2 | No conflicts | ✅ mergeable: MERGEABLE |
| 3 | CI green | ✅ 17/17 checks pass (incl. helm-smoke, test ubuntu-20/22, dashboard-e2e) |
| 4 | No regressions | ✅ All existing tests pass |
| 5 | Unit tests | ✅ 36/36 dashboard auth tests pass (per PR body) |
| 6 | E2E / UAT | ✅ Live verification: 17/17 soft-nav samples, 0 login flashes |
| 7 | Documented | ✅ PR body explains root cause + verification steps |
| 8 | Security clean | ✅ No secrets, scoped to no-auth path only |
| 9 | Targets develop |
✅ baseRefName: develop |
Review Notes
- sw.js: Correct cache-bust strategy (v1→v2, network-first navigations, cache-first hashed assets). The
/v1/+/auth/+*/eventsnetwork-only paths fix the stale API route mismatch. - useAuthStore.ts: The
authMode === nullguard is the right fix — preservesprobePublicAccess-established auth instead of spuriously clearing on revalidate tick. - Scope discipline: Only affects no-auth/localhost path. Production auth deployments are untouched.
- Conventional commit:
fix(dashboard):— correct, nofeat-minor-bump-gatetrigger.
LGTM. 👁️
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Aegis version
Developed with: v${v}
Problem
On a no-auth (zero-config / localhost) deployment the dashboard was unreliable on cold load:
Root causes
Changes
Verification
Notes
Both fixes only affect the no-auth / zero-config localhost path. Production deployments with real auth (API key / OIDC) do not exercise `probePublicAccess` / the no-auth `revalidate` branch and are unaffected.