From a9c7cb5f398839be1299e3a51cf24d587df8835e Mon Sep 17 00:00:00 2001
From: Chris <wtc.justin82@gmail.com>
Date: Wed, 1 Apr 2026 01:48:06 +0800
Subject: [PATCH] fix(auth): relax keycloak audience check and auto-redirect
 logged-in user

---
 backend/app/core/config.py       |  2 +-
 frontend/src/pages/LoginPage.vue | 17 +++++++++++++++--
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/backend/app/core/config.py b/backend/app/core/config.py
index 6fa681f..6e0a190 100644
--- a/backend/app/core/config.py
+++ b/backend/app/core/config.py
@@ -106,7 +106,7 @@ class Settings(BaseSettings):
     @property
     def idp_audience(self) -> str:
         if self.use_keycloak:
-            return self.keycloak_audience or self.keycloak_client_id
+            return self.keycloak_audience
         return self.authentik_audience or self.authentik_client_id
 
     @property
diff --git a/frontend/src/pages/LoginPage.vue b/frontend/src/pages/LoginPage.vue
index 18f98ff..2065e4c 100644
--- a/frontend/src/pages/LoginPage.vue
+++ b/frontend/src/pages/LoginPage.vue
@@ -35,11 +35,14 @@
 </template>
 
 <script setup>
-import { ref } from 'vue'
-import { useRoute } from 'vue-router'
+import { onMounted, ref } from 'vue'
+import { useRoute, useRouter } from 'vue-router'
 import { getOidcAuthorizeUrl } from '@/api/auth'
+import { useAuthStore } from '@/stores/auth'
 
 const route = useRoute()
+const router = useRouter()
+const authStore = useAuthStore()
 
 const loginLoading = ref(false)
 const error = ref('')
@@ -49,6 +52,16 @@ function getPostLoginRedirect() {
   return typeof redirect === 'string' ? redirect : '/me'
 }
 
+onMounted(async () => {
+  if (!authStore.isLoggedIn) return
+  try {
+    await authStore.fetchMe()
+    router.replace(getPostLoginRedirect())
+  } catch (_err) {
+    authStore.logout()
+  }
+})
+
 async function handleLogin() {
   loginLoading.value = true
   error.value = ''