Skip to content

fix: [Portal] If you sign out of the portal while logged in and using an application that requires authentication, the system will trigger three "Access Denied" error messages. #7805

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shaohuzhang1 merged 1 commit into from
Nov 10, 2026
Merged

fix: [Portal] If you sign out of the portal while logged in and using an application that requires authentication, the system will trigger three "Access Denied" error messages. #7805

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions ui/src/conversation-panel/left-sidebar/account-menu/index.vue
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,11 +28,17 @@ const tokenPercentage = computed(() => {
const userPwdDialogRef = useTemplateRef<InstanceType<typeof UserPwdDialog>>('userPwdDialogRef')
const apiKeyDialogRef = useTemplateRef<InstanceType<typeof ApiKeyDialog>>('apiKeyDialogRef')

// 退出对话账号后重新导航，由守卫处理后续认证。
// 退出对话账号后回到当前场景首页，不停留在上一用户的对话；由守卫决定匿名认证或跳转登录页。
const handleLogout = () => {
return auth
.logout()
.then(() => router.replace({ path: router.currentRoute.value.fullPath, force: true }))
.then(() =>
router.replace(
route.meta.portal
? { name: 'portal-application-list', force: true }
: { name: 'chat-home', params: { accessToken: route.params.accessToken }, force: true },
),
)
.catch(() => {})
}

@shaohuzhang1 shaohuzhang1 Nov 10, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No syntax-only problem, but there are several important issues in this change:

1. force: true is not a Vue Router 4 option

router.replace({ ..., force: true }) is not a valid Vue Router 4 location property. It may cause a TypeScript error or be ignored at runtime. It will not force guards to re-run or force a same-route navigation.

If you need to force re-evaluation, prefer navigating to a public/entry route and letting the guard redirect, or explicitly revalidate auth. Avoid router.go(0) unless a full reload is acceptable.

2. Reusing route.params.accessToken after logout is risky

After auth.logout(), route.params.accessToken is presumably the old user's token. Passing it into the new chat-home location can:

  • keep an invalid/stale token in the URL and browser history
  • leak the previous token
  • cause the guard to treat the old token as valid
  • break if accessToken is undefined or string[], especially for a required named-route param
  • produce the same location as the current route, causing a duplicated navigation and preventing guards from running

Prefer navigating to a token-less/public entry route and let the auth guard resolve the new anonymous session. If chat-home truly requires a token, obtain a fresh token from auth state after logout, not from the old route.

3. route is read asynchronously

route.meta.portal and route.params.accessToken are read inside .then() after auth.logout() completes. If logout triggers any navigation or route state change, you may read a different route than the one logout was initiated from. Capture the values before logout if that matters:

const wasPortal = Boolean(route.meta.portal)

4. Hard-coded route names may miss required params/query

portal-application-list and chat-home may require params such as tenant ID, locale, redirect, etc. If those are missing, navigation can fail or be redirected unexpectedly. Consider a single canonical post-logout entry route and let the guard decide the final destination.

5. .catch(() => {}) hides all failures

This swallows both logout failures and navigation failures. If logout fails, the user may still be authenticated but the UI may appear logged out. At minimum log the error; ideally show feedback and distinguish logout failure from navigation failure.

6. No loading/disabled state

Double-clicking logout can trigger multiple auth.logout() calls and multiple navigations. Consider a loading flag or disabling the logout action while it is in progress.

Suggested direction

const handleLogout = async () => {
  const wasPortal = Boolean(route.meta.portal)

  try {
    await auth.logout()

    await router.replace(
      wasPortal
        ? { name: 'portal-application-list' }
        : { path: '/' }, // or a known public entry route; let the guard resolve auth
    )
  } catch (error) {
    // log/show feedback instead of silently swallowing
    console.error('Logout or post-logout navigation failed', error)
  }
}

If chat-home requires accessToken, do not pass the old token. Either let the guard redirect from a public route, or use a freshly obtained token after logout. Also remove force: true.

Expand Down
Loading