From 0a1a2923dcf670087fb894a2b9168a66edbf9ad1 Mon Sep 17 00:00:00 2001
From: Lance <zhai@vergex.trade>
Date: Fri, 17 Apr 2026 11:17:17 +0800
Subject: [PATCH] fix(auth): prevent SetupPage remount from wiping freshly-set
 auth token (#1481)

After #1470 moved routing into react-router, SetupPage is rendered at two
different tree positions (top-level guard + /setup Route). When register
success flushSync-sets `user`, the top-level guard stops matching and the
Route-level SetupPage mounts as a new instance, re-running its cleanup
useEffect and removing the auth_token that handlePostAuthSuccess just wrote.
Subsequent requests 401 and bounce the user back to /login.

Redirect /setup to /welcome when user is already set so SetupPage is never
re-mounted during the auth transition.
---
 web/src/router/AppRoutes.tsx | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/web/src/router/AppRoutes.tsx b/web/src/router/AppRoutes.tsx
index 6469643e..7ee5d2e8 100644
--- a/web/src/router/AppRoutes.tsx
+++ b/web/src/router/AppRoutes.tsx
@@ -439,7 +439,9 @@ export function AppRoutes() {
         <Route
           path={ROUTES.setup}
           element={
-            systemConfig?.initialized ? (
+            user ? (
+              <Navigate to={ROUTES.welcome} replace />
+            ) : systemConfig?.initialized ? (
               <Navigate to={ROUTES.login} replace />
             ) : (
               <SetupPage />