fix and update

apps/frontend/app/auth/login/page.tsx

@@ -34,7 +34,9 @@ import { Tabs, TabsContent, TabsList, TabsTrigger } from '@/components/ui/tabs';
 
 import type { AuthTokens, LoginMethod, OtpChannel, OtpSendResponse } from '@/lib/api';
 
-import { createQrLoginSession, pollQrLoginSession } from '@/lib/api';
+import { createQrLoginSession, fetchFedcmSessionStatus, pollQrLoginSession } from '@/lib/api';
+
+import { isFedcmLoginPopup } from '@/lib/fedcm-login-bridge';
 
 import {
   clearOtpResendAvailableAt,
@@ -104,7 +106,7 @@ export default function LoginPage() {
 
   const { showToast } = useToast();
 
-  const { ldapEnabled, ldapUseLdaps } = usePublicSettings();
+  const { ldapEnabled, ldapUseLdaps, publicApiUrl } = usePublicSettings();
 
 
 
@@ -261,6 +263,22 @@ export default function LoginPage() {
 
 
 
+  useEffect(() => {
+    if (!isFedcmLoginPopup()) return;
+    let cancelled = false;
+
+    void (async () => {
+      const status = await fetchFedcmSessionStatus(publicApiUrl);
+      if (cancelled || !status?.active || !status.requiresPin || !status.sessionId) return;
+      setPendingSessionId(status.sessionId);
+      setStep('pin');
+    })();
+
+    return () => {
+      cancelled = true;
+    };
+  }, [publicApiUrl]);
+
   useEffect(() => {
     if (step !== 'otp' || !recipient) return;
     const saved = readOtpResendAvailableAt(recipient);

apps/frontend/components/id/auth-provider.tsx

@@ -34,7 +34,7 @@ import {
   subscribeApiReady,
   subscribeApiNotReady,
 } from '@/lib/api';
-import { finalizeFedcmLogin, shouldFinalizeFedcmLogin } from '@/lib/fedcm-login-bridge';
+import { finalizeFedcmLogin, isFedcmLoginPopup, shouldFinalizeFedcmLogin } from '@/lib/fedcm-login-bridge';
 import { FedcmApiLoginStatusBridge } from './fedcm-api-login-status';
 import { usePublicSettings } from './public-settings-provider';
 import { useToast } from './toast-provider';
@@ -201,6 +201,10 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
     if (cachedUser) {
       setUser(cachedUser);
     }
+    const accessToken = window.localStorage.getItem(AUTH_TOKEN_KEY);
+    if (accessToken) {
+      void syncFedcmSession(accessToken);
+    }
   }, [user?.id]);
 
   const warmUpAndApplySession = React.useCallback(
@@ -678,11 +682,16 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
         setIsLoading(false);
       }
 
-      if (pathname.startsWith('/auth/')) {
+      if (pathname.startsWith('/auth/') && !isFedcmLoginPopup()) {
         router.replace('/');
+        return;
+      }
+
+      if (shouldFinalizeFedcmLogin(pathname) || isFedcmLoginPopup()) {
+        await finalizeFedcmLogin(response.accessToken);
       }
     },
-    [clearPinLock, pathname, router, user?.id, warmUpAndApplySession]
+    [pathname, router, user?.id, warmUpAndApplySession]
   );
 
   const handlePinUnlock = React.useCallback(
@@ -783,7 +792,7 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
       )}
       <PinLockModal open={isPinLocked} isSubmitting={pinSubmitting} error={pinError} onSubmit={handlePinUnlock} />
       <FedcmApiLoginStatusBridge
-        active={isSessionReady && hasStoredSession && !isPinLocked}
+        active={isSessionReady && hasStoredSession && Boolean(token)}
         accessToken={token}
         publicApiUrl={publicApiUrl}
       />

apps/frontend/lib/api.ts

@@ -598,6 +598,29 @@ export async function syncFedcmSession(accessToken?: string | null) {
   }
 }
 
+export interface FedcmSessionStatus {
+  active: boolean;
+  requiresPin: boolean;
+  sessionId: string | null;
+  userId: string | null;
+}
+
+export async function fetchFedcmSessionStatus(apiBase: string): Promise<FedcmSessionStatus | null> {
+  if (typeof window === 'undefined' || !apiBase.trim()) return null;
+  const base = apiBase.replace(/\/+$/, '');
+  try {
+    const response = await fetch(`${base}/fedcm/session/status`, {
+      method: 'GET',
+      credentials: 'include',
+      cache: 'no-store'
+    });
+    if (!response.ok) return null;
+    return (await response.json()) as FedcmSessionStatus;
+  } catch {
+    return null;
+  }
+}
+
 let fedcmSyncTimer: ReturnType<typeof setTimeout> | null = null;
 let fedcmSyncInFlight = false;
 

apps/frontend/lib/fedcm-login-bridge.ts

@@ -45,3 +45,11 @@ export async function finalizeFedcmLogin(accessToken: string) {
 export function shouldFinalizeFedcmLogin(pathname: string) {
   return pathname.startsWith('/auth/login');
 }
+
+export function isFedcmLoginPopup() {
+  if (typeof window === 'undefined') return false;
+  if (window.opener) return true;
+  if (window.IdentityProvider?.close) return true;
+  const params = new URLSearchParams(window.location.search);
+  return params.get('fedcm') === '1';
+}