From dca4da50ed3da8b2e9fd5c7236cfd1f859174d28 Mon Sep 17 00:00:00 2001
From: Oliver Kieselbach <oliver.kieselbach@outlook.com>
Date: Wed, 10 Jun 2026 00:33:29 +0200
Subject: [PATCH] fix re-auth for session detail and diag page

---
 .../app/diagnosis/[sessionId]/page.tsx              | 13 ++++++++++---
 .../app/sessions/[sessionId]/page.tsx               | 13 ++++++++++---
 2 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/src/Web/autopilot-monitor-web/app/diagnosis/[sessionId]/page.tsx b/src/Web/autopilot-monitor-web/app/diagnosis/[sessionId]/page.tsx
index 562e3b6c..63286cb4 100644
--- a/src/Web/autopilot-monitor-web/app/diagnosis/[sessionId]/page.tsx
+++ b/src/Web/autopilot-monitor-web/app/diagnosis/[sessionId]/page.tsx
@@ -246,11 +246,18 @@ export default function DiagnosisPage() {
   );
   const warningEvents = events.filter((e) => e.severity === "Warning");
 
+  // Keep this early-return wrapped in <ProtectedRoute>: on a fresh direct
+  // navigation (new tab, bookmark, shared link) the auth cache is empty, so the
+  // tenant-gated fetch never runs and `loading` stays true forever. Without the
+  // gate here we'd hang on "Loading diagnosis..." and never trigger the MSAL
+  // login redirect. See the matching note in app/sessions/[sessionId]/page.tsx.
   if (loading) {
     return (
-      <div className="min-h-screen bg-gray-50 flex items-center justify-center">
-        <div className="text-gray-600">Loading diagnosis...</div>
-      </div>
+      <ProtectedRoute>
+        <div className="min-h-screen bg-gray-50 flex items-center justify-center">
+          <div className="text-gray-600">Loading diagnosis...</div>
+        </div>
+      </ProtectedRoute>
     );
   }
 
diff --git a/src/Web/autopilot-monitor-web/app/sessions/[sessionId]/page.tsx b/src/Web/autopilot-monitor-web/app/sessions/[sessionId]/page.tsx
index ca7098eb..134aed6f 100644
--- a/src/Web/autopilot-monitor-web/app/sessions/[sessionId]/page.tsx
+++ b/src/Web/autopilot-monitor-web/app/sessions/[sessionId]/page.tsx
@@ -352,11 +352,18 @@ export default function SessionDetailPage() {
 
   // Only show full-page loading spinner on the very first load (no data yet).
   // Subsequent refreshes (SignalR, 30s poll) keep the existing UI visible.
+  // NOTE: this early-return MUST stay wrapped in <ProtectedRoute>. On a fresh
+  // direct navigation (new tab, bookmark, shared link) the auth cache is empty,
+  // so `loading` never flips and we'd render this branch forever — bypassing the
+  // auth gate and hanging on "Loading session details..." without ever triggering
+  // the MSAL login redirect. Wrapping here lets ProtectedRoute drive re-auth.
   if (loading && !session && events.length === 0) {
     return (
-      <div className="min-h-screen bg-gray-50 flex items-center justify-center">
-        <div className="text-gray-600">Loading session details...</div>
-      </div>
+      <ProtectedRoute>
+        <div className="min-h-screen bg-gray-50 flex items-center justify-center">
+          <div className="text-gray-600">Loading session details...</div>
+        </div>
+      </ProtectedRoute>
     );
   }