diff --git a/app/components/forms/login-form.tsx b/app/components/forms/login-form.tsx index e9d09abf..f7453aae 100644 --- a/app/components/forms/login-form.tsx +++ b/app/components/forms/login-form.tsx @@ -140,13 +140,28 @@ export function LoginForm() { setWarning(''); }, []); + // Clear the sessionStorage adding-account flag when leaving the login page so + // it does not persist across unrelated future visits. + useEffect(() => { + return () => { + try { sessionStorage.removeItem('wewrite_adding_account'); } catch { /* ignore */ } + }; + }, []); + // Redirect if already authenticated (but not when adding another account) useEffect(() => { // searchParams can be null before Next.js resolves the URL; hasSearchParam // also checks window.location as a fallback so we never accidentally redirect // away when the user is in the middle of an add-another-account flow. const urlHasSwitchAccount = hasSearchParam(searchParams, 'switchAccount'); - if (!authLoading && isAuthenticated && !urlHasSwitchAccount) { + // Also check sessionStorage as a backup — set by MobileAccountMenu before + // navigating here. This covers iOS PWA and other mobile environments where + // window.location.href may behave as a soft navigation and the URL param is + // not yet detectable at the moment the redirect guard first fires. + const sessionHasAddingAccount = (() => { + try { return sessionStorage.getItem('wewrite_adding_account') === '1'; } catch { return false; } + })(); + if (!authLoading && isAuthenticated && !urlHasSwitchAccount && !sessionHasAddingAccount) { router.push('/home'); } }, [isAuthenticated, authLoading, router, searchParams]); diff --git a/app/components/layout/MobileAccountMenu.tsx b/app/components/layout/MobileAccountMenu.tsx index 96910852..3569040d 100644 --- a/app/components/layout/MobileAccountMenu.tsx +++ b/app/components/layout/MobileAccountMenu.tsx @@ -131,6 +131,11 @@ export default function MobileAccountMenu() { event.preventDefault(); event.stopPropagation(); setIsOpen(false); + // Set a sessionStorage flag BEFORE navigating so the login page's redirect + // guard has a reliable backup signal even if the URL param check fails (e.g. + // on iOS PWA where window.location.href may behave as a soft navigation and + // useSearchParams can be stale at the moment the guard first fires). + try { sessionStorage.setItem('wewrite_adding_account', '1'); } catch { /* ignore */ } // Use window.location.href instead of router.push so the page performs a // full reload. With router.push (client-side nav) the AuthProvider is // already settled (isLoading=false, isAuthenticated=true) and the login