From 803332e6a3f65b9a620c70cd549ed80ace12511d Mon Sep 17 00:00:00 2001
From: jtricerolph <info@tricerolph.com>
Date: Fri, 10 Jul 2026 11:44:01 +0000
Subject: [PATCH] Fix expired session showing EmbeddedFallback instead of login
 page

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 frontend/src/api.ts                  |  4 ++++
 frontend/src/components/AuthGate.tsx | 16 +++-------------
 2 files changed, 7 insertions(+), 13 deletions(-)

diff --git a/frontend/src/api.ts b/frontend/src/api.ts
index 0c40c1f9..62c4b75d 100644
--- a/frontend/src/api.ts
+++ b/frontend/src/api.ts
@@ -8,6 +8,10 @@ async function request<T>(path: string, opts: RequestInit = {}): Promise<T> {
     headers: { 'Content-Type': 'application/json', ...opts.headers },
     ...opts,
   })
+  if (res.status === 401) {
+    ;(window.top ?? window).location.href = '/login'
+    throw new Error('Unauthenticated')
+  }
   if (!res.ok) {
     const err = await res.json().catch(() => ({ error: res.statusText }))
     throw new Error((err as { error?: string }).error || `Request failed: ${res.status}`)
diff --git a/frontend/src/components/AuthGate.tsx b/frontend/src/components/AuthGate.tsx
index a8b10095..09e71593 100644
--- a/frontend/src/components/AuthGate.tsx
+++ b/frontend/src/components/AuthGate.tsx
@@ -12,30 +12,20 @@ export function useAuth() {
 
 export default function AuthGate({ children }: { children: React.ReactNode }) {
   const [user, setUser] = useState<User | null>(null)
-  const [error, setError] = useState<string | null>(null)
 
   useEffect(() => {
     fetch('/reports/api/auth/verify?app=reports', { credentials: 'include' })
       .then(r => {
-        if (r.status === 401 || r.status === 403) {
-          window.location.href = `/portal?redirect=${encodeURIComponent(window.location.href)}`
+        if (!r.ok) {
+          ;(window.top ?? window).location.href = '/login'
           return null
         }
-        if (!r.ok) throw new Error(`Auth check failed: ${r.status}`)
         return r.json()
       })
       .then(data => { if (data) setUser(data) })
-      .catch(err => setError(err.message))
+      .catch(() => { ;(window.top ?? window).location.href = '/login' })
   }, [])
 
-  if (error) {
-    return (
-      <div style={{ padding: 32, color: '#991b1b', fontFamily: 'sans-serif' }}>
-        Authentication error: {error}
-      </div>
-    )
-  }
-
   if (!user) {
     return (
       <div style={{