fix: redirect authenticated users away from /login

[iAliF]

The login page unconditionally cleared the auth token and query cache on every mount, forcing a re-login even when a valid session already existed. It now checks the stored token with getCurrentAdmin() (the same check the dashboard route loader uses) and redirects to the dashboard if it's still valid, only clearing the session when it's missing or invalid. The check is skipped for the Telegram MiniApp flow, which manages its own auth token independently.

Summary

Type of change

• Bug fix
• New feature
• Breaking change
• Refactor / cleanup
• Documentation
• Tests / CI

Checklist

• I tested the change locally or explained why it cannot be tested.
• I added or updated tests for behavior changes.
• I updated documentation, translations, or examples if needed.
• I checked database migrations when models or schema changed.
• I did not include secrets, tokens, private keys, or unrelated changes.

Summary by CodeRabbit

• Bug Fixes
  • Improved login-session behavior when navigating to and from the login page.
  • Automatically redirects already-authenticated users to the dashboard.
  • Safely validates any stored token before proceeding, with reliable handling of aborted requests.
  • Cleans up invalid/expired sessions (canceling active requests and clearing cached data) only when access is rejected.
  • Kept the existing Telegram MiniApp authentication flow unchanged.

[coderabbitai]

Important

Review skipped

No new commits to review since the last review.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e9aeca4f-eb81-46f3-9ef4-1501bef6b034

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

The login page separates route redirection from authentication cleanup, validates stored non-Telegram tokens with getCurrentAdmin, redirects valid sessions to /, and preserves the Telegram MiniApp flow.

Changes

Login session flow

Layer / File(s)	Summary
Route redirect behavior dashboard/src/pages/login.tsx	Leaving the login route now triggers only a redirect to /login; token removal, request cancellation, and query-cache clearing are no longer performed by this effect.
Stored-token validation dashboard/src/pages/login.tsx	Non-Telegram sessions validate stored tokens with getCurrentAdmin, redirect valid sessions to /, and clean up only 401/403 failures; aborts and token races are ignored safely, while Telegram sessions skip this validation.

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

I’m a bunny guarding the login gate,
Checking old tokens before it’s late.
Good ones hop home, bad ones depart,
Telegram keeps its special start.
Clean paths and caches, bright and new—
A carrot-powered flow for you!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main change: authenticated users are redirected away from /login.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@dashboard/src/pages/login.tsx`:
- Around line 157-168: Update the getCurrentAdmin effect to capture the current
auth token and create an AbortController for the request, ignoring aborted
requests and responses made with a stale token. In the catch handler, remove the
token and clear React Query state only when this request confirms a 401 or 403
authentication failure; preserve the current session for other HTTP errors, and
abort the controller during cleanup.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ae82b83b-50a5-4fdb-9294-1fbb37f5f588

📥 Commits

Reviewing files that changed from the base of the PR and between c8886ab and f0a9d37.

📒 Files selected for processing (1)

• dashboard/src/pages/login.tsx

[iAliF]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.