From 346ca75d689f0a72302559a6396345e9d9639017 Mon Sep 17 00:00:00 2001
From: Jeroen Schweitzer <jeroen@imagin.studio>
Date: Sun, 4 Jan 2026 13:17:03 +0100
Subject: [PATCH] fix(auth): callback route redirect order + favicon.ico
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Move callback route exception check BEFORE auth redirect check
- This was preventing OIDC token exchange from ever happening
- Add favicon.ico to web root for browser tab icon

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---
 CHANGELOG.md                |   8 ++++++++
 lib/routing/app_router.dart |  10 +++++-----
 pubspec.yaml                |   2 +-
 web/favicon.ico             | Bin 0 -> 4286 bytes
 web/index.html              |   1 +
 5 files changed, 15 insertions(+), 6 deletions(-)
 create mode 100644 web/favicon.ico

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 59bcbea..c84c64c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.0.10] - 2026-01-04
+
+### Fixed
+- Fixed OIDC callback route being redirected to login before processing
+  - Moved callback route exception check BEFORE the auth redirect check in router
+  - This was preventing token exchange from ever happening
+- Added favicon.ico to web root for proper browser tab icon display
+
 ## [1.0.9] - 2026-01-04
 
 ### Fixed
diff --git a/lib/routing/app_router.dart b/lib/routing/app_router.dart
index eb4a7fa..bf22835 100644
--- a/lib/routing/app_router.dart
+++ b/lib/routing/app_router.dart
@@ -34,6 +34,11 @@ GoRouter appRouter(Ref ref) {
         return null;
       }
 
+      // Allow callback route through without auth check (must be checked FIRST!)
+      if (state.matchedLocation == AppRoutes.callback) {
+        return null;
+      }
+
       final isAuthenticated = authState.value?.isAuthenticated ?? false;
       final isLoginRoute = state.matchedLocation == AppRoutes.login;
 
@@ -47,11 +52,6 @@ GoRouter appRouter(Ref ref) {
         return AppRoutes.frontHall;
       }
 
-      // Allow callback route through without auth check
-      if (state.matchedLocation == AppRoutes.callback) {
-        return null;
-      }
-
       return null;
     },
     routes: [
diff --git a/pubspec.yaml b/pubspec.yaml
index ea11c5b..f62089d 100644
--- a/pubspec.yaml
+++ b/pubspec.yaml
@@ -16,7 +16,7 @@ publish_to: 'none' # Remove this line if you wish to publish to pub.dev
 # https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html
 # In Windows, build-name is used as the major, minor, and patch parts
 # of the product and file versions while build-number is used as the build suffix.
-version: 1.0.9+1
+version: 1.0.10+1
 
 environment:
   sdk: ^3.10.4
diff --git a/web/favicon.ico b/web/favicon.ico
new file mode 100644
index 0000000000000000000000000000000000000000..cab054db0a6fd0c79b0a26b4e234ab533a5d38ff
GIT binary patch
literal 4286
zcmeHJX;2hb5N^SkvNRs3DO1J(3Ie(adoeRRdmpeYs~juBA`n1fxd{*;fCzHCB3_^n
zxg!Cu2*@RZM^IugF$pLhSTW{DN-L>K{9(l)p)*TWs^Sl*0`rq^s%PePzxTfGo_Vhy
zz&z%%vI5f`nwJ5*3jp?vFe;ETV$x57vCUyF19KUeT?R7a;z8=j0<C}o35x}^!$zPt
zI)KE{5!^`<h;{4XV}oIKlTR~hcVaTQtlJ8tjSO7uO2L*yAl`=s)N)uvo5Larz=EF<
zVNZfB=-5`k4KD%i-Y<YiEC(Xyz%(;YZ;~=`0W60&l_g|)I{?R0vXrn(+)mgZK1w;9
z?BE8q_B&;@_j598yWCQx6$U?>oj%TMt=S<(Yj`<lH}I0G%=wYC<1ZK;gXpUBfH(%>
zQcLGd?=?OO=iL<~>zi?*@EM8%Um#KW966tkAiwih+%`~%m4~zw>7H(*RLb!O{Mws8
z(udBI)UodAgPg*eIx+@Dh-PGb*|PFob{zvHY&;kp__vp62t~o;NS=L+;*bJVs170-
zUW&5o53#uCBsM0?P@Q5#;_S${u)5QauDS_QPRA51Q>!C~#=tQAYIVTv@ooE}#OXC9
z0TXR`BJ497&{)@jqUs(DEhxu~`Zm-jWFXlvfU?`KFuS@0gL89GSkT-mQFN<h8@k?>
zac9n-Jn|PL-N*S+KRj4Y>)coE3e`2A%W%fw3KIM4^;p(>4!ytq4F%s#pz_uW+<xT|
zO1d5+`}9+EP0D|wmS%=Yx&7xA{I0bMe&^JIPGQ+Of)IFZCj@o}YzzJ}I5Aef*7J;E
z<*U}TO?aXHARfz2!-}5M=y&@UjJh<8mE}k9Ky4iowRh1ut-jfRq4Pqm`qFzUUZa^-
zc4i8esnrF;=}>wvdqLblB>Tg!LpMc5=%PQ*qVPnz2evfUp-w8tu9`#~xg3w>`_s@*
zslvY2CJe1Oh3veRcKwwn+8rYk8r$wa;SRGlXNuxGyP;?})9fDJFtY(L7bg_gCRBfh
z`Xfzv^<oFsRa9c@sazbq7?0N)(y+d=3a_>`Vtug=KgvzLsjKUA3cHUs(p%%u`t0RQ
z>7nHAUWhgZf-#x|Z|;UrNmA(xZNm`yHuj?Kcsm9)4PshnI}Uay;OIGj?5j<|mRwit
zJ?e@DdqRHS>hyuuHzNm_1w1Q$lfyD6C$L(&dcIC3Y*D0@Ayv|kZb|!45fq7Txz%{I
zFc3S6BzU<*j5TpA%-g;W2an6~LcSOS<(z9S_Ut9H&89tUc2K*J&|r)KZ;7xhKEQP>
z#z%+|8a_t2I$@ZSLLWgE?vUxxKPCou1*ma<FbfYyaIiFzM!kZ*PCN1zn_`$PgiL*5
zxS4uG`uIxthr->QA|ur7@<<K4EnF?Qq2!(z-XbtOB(m#YdWIXGHpZ@hejw21kwHsd
z_YskK`=Y!+{096v$;qJPu)&qjwa^ObLM5NH%-A6Xj*Y`xp49rqDo5uPDyh3QueiOL
z&Z`M&O|dy$9kH&~)rHD+Cy33ankb&EA+yZ@fE&Swtzsc~P$aR1@j*?vSSqFN!1db;
z9KS-~d8GoGWPFGD&*mKov(p;X>=qA75Rm^#EbuI?q2tWV*ZzOK)i5z^Tw(#<DmiFK
zf@ErczFepX<LUGC>|mpwqtEx?YGP?7W~DnxWobytSL*0s?#APS><wf8*AE%X5!kC%
z!xj+@8kVhv$lX7Mm)`U}zohp8-`F$CORgG{3*{*u1m8AX=Lss)H)G`gge!*w8kzzH
zpATG8IG>iuSBP}}YiNC#CFK)jZ7=pPS5p+&SgZu`Cf5H+{n}gtE&(*x1!%qi1PTwJ
z+`NEPGG`-70+fsJwZ3zWxeUx@VEPQ;bQqT){>1F8Ie-&PC1)htB+O~X^qkaT&OFoU
aX0p%Zdok1gDvudwj`+t?#Fv&h9sU7^cBn`I

literal 0
HcmV?d00001

diff --git a/web/index.html b/web/index.html
index 18de1b4..03fd5cd 100644
--- a/web/index.html
+++ b/web/index.html
@@ -27,6 +27,7 @@
   <link rel="apple-touch-icon" href="icons/Icon-192.png">
 
   <!-- Favicon -->
+  <link rel="icon" type="image/x-icon" href="favicon.ico"/>
   <link rel="icon" type="image/png" href="favicon.png"/>
 
   <title>Tatlock</title>