From 402422bf302104b34eab4b0ff32f4daf14c1a91d Mon Sep 17 00:00:00 2001
From: jbergner <jbergner@send.nrw>
Date: Mon, 24 Aug 2026 23:03:42 +0200
Subject: [PATCH] Loop-Fix

---
 .../main/resources/js/sessionguard-access.js  | 53 +++----------------
 1 file changed, 6 insertions(+), 47 deletions(-)

diff --git a/guacamole-extension/src/main/resources/js/sessionguard-access.js b/guacamole-extension/src/main/resources/js/sessionguard-access.js
index 6aef9c8..231b973 100644
--- a/guacamole-extension/src/main/resources/js/sessionguard-access.js
+++ b/guacamole-extension/src/main/resources/js/sessionguard-access.js
@@ -63,52 +63,12 @@
         });
     }
 
-    function recoverFromGuacamoleLogout() {
-        if (redirecting) {
-            return;
-        }
-
-        // Guacamole authentication tokens live in the selected webapp process.
-        // A worker failover/restart can therefore cause Guacamole to enter its
-        // logged-out state even though the upstream SessionGuard/PocketID
-        // browser session is still valid. Never turn that condition into a
-        // full IdP logout. Re-enter Guacamole and let header auth mint a fresh
-        // Guacamole token instead.
-        getAccessSessionStatus().then(function (response) {
-            if (response.ok) {
-                redirect(safeReturnURL());
-            }
-            else if (response.status === 401 || response.status === 403) {
-                redirect(loginURL());
-            }
-        }).catch(function () {
-            // Keep Guacamole's normal logged-out UI visible during a transient
-            // SessionGuard outage instead of forcing any logout/login loop.
-        });
-    }
-
-    function watchForGuacamoleLoggedOutState() {
-        function loggedOutModalPresent() {
-            return document.querySelector('.logged-out-modal') !== null;
-        }
-
-        if (loggedOutModalPresent()) {
-            recoverFromGuacamoleLogout();
-            return;
-        }
-
-        var observer = new MutationObserver(function () {
-            if (loggedOutModalPresent()) {
-                observer.disconnect();
-                recoverFromGuacamoleLogout();
-            }
-        });
-
-        observer.observe(document.documentElement, {
-            childList: true,
-            subtree: true
-        });
-    }
+    // Guacamole owns its own authentication state. Do not automatically
+    // reload the SPA merely because Guacamole is in its logged-out state.
+    // With header authentication, Guacamole's built-in "Login again" action
+    // can re-authenticate against the next request. Automatic reload here
+    // creates a / -> /#/ -> / loop while the SessionGuard access session is
+    // still perfectly valid.
 
     function watchForExplicitLogout() {
         // Guacamole assigns the CSS class "logout" to its explicit logout
@@ -133,7 +93,6 @@
 
     function start() {
         watchForExplicitLogout();
-        watchForGuacamoleLoggedOutState();
         checkAccessSession();
         window.setInterval(checkAccessSession, STATUS_INTERVAL_MS);
     }