fix: skip silent OIDC on callback page to prevent race condition

AuthProvider.build() was initiating silent OIDC while the callback
page was processing the auth code, causing PKCE state to be cleared.
Now checks if on /callback route and skips silent OIDC initiation.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -7,6 +7,94 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.1.5] - 2026-01-04
+
+### Fixed
+- Race condition in OIDC callback: AuthProvider.build() was initiating silent OIDC while the callback page was processing, causing PKCE state to be cleared. Now skips silent OIDC when on `/callback` route.
+
+## [1.1.4] - 2026-01-04
+
+### Fixed
+- Silent OIDC fallback: when `prompt=none` fails with `login_required` (no Authentik session), automatically fall back to regular OIDC flow to show login UI
+
+## [1.1.3] - 2026-01-04
+
+### Changed
+- **Web auth uses silent OIDC with JWT Bearer tokens**
+  - Uses `prompt=none` to silently obtain JWT when Authentik session exists (via NPM forward auth)
+  - Flutter sends Bearer token to core-api instead of relying on forward auth cookies
+  - Fixes cross-subdomain cookie issues between home.schweitz.net and api.schweitz.net
+  - Callback now syncs with `/auth/sync` to get user profile and roles from core-api
+  - API interceptor now adds Bearer token on web (previously skipped)
+
+## [1.1.2] - 2026-01-04
+
+### Changed
+- **Web auth simplified**: Skip Flutter OIDC on web - NPM forward auth handles it
+  - NPM authenticates at proxy level before app loads
+  - No more redundant OIDC redirect after NPM auth completes
+  - Fixes "Cannot use Ref after disposed" error from conflicting auth flows
+  - Mobile still uses Flutter OIDC flow
+
+### Added
+- Logout now redirects to Authentik to end SSO session
+  - Clears local tokens AND invalidates Authentik session
+  - Uses OIDC end_session_endpoint from discovery document
+  - Redirects back to app after Authentik logout completes
+
+## [1.1.0] - 2026-01-04
+
+### Changed
+- **Dockerfile rebuild fix**: Added `flutter clean` before build to prevent stale cached artifacts
+  - VERSION build arg added for explicit cache busting
+  - Reordered build steps: clean → pub get → build_runner → health.json → flutter build
+  - Ensures deployed app always matches the version in health.json
+
+### Fixed
+- Replaced deprecated `dart:html` with `package:web` in iframe_view_web.dart
+  - Uses `web.HTMLIFrameElement` instead of `html.IFrameElement`
+  - Fixes deprecation warnings for Flutter 3.x web builds
+
+## [1.0.12] - 2026-01-04
+
+### Changed
+- Removed login page - auth now auto-initiates from AppScaffold
+  - No more redirect to /login, just auto-start OIDC if not authenticated
+  - Shows loading screen during auth, error screen on failure with retry
+  - Seamless experience when Authentik session exists
+
+### Removed
+- Removed /login route and _LoginPage widget
+
+## [1.0.11] - 2026-01-04
+
+### Changed
+- Web auth now extracts user info directly from JWT instead of syncing with core-api
+  - Eliminates CORS preflight issues with /auth/sync endpoint
+  - Decodes JWT claims (name, email, groups) client-side
+  - Bearer token will be used for API authentication
+
+## [1.0.10] - 2026-01-04
+
+### Fixed
+- Fixed OIDC callback route being redirected to login before processing
+  - Moved callback route exception check BEFORE the auth redirect check in router
+  - This was preventing token exchange from ever happening
+- Added favicon.ico to web root for proper browser tab icon display
+
+## [1.0.9] - 2026-01-04
+
+### Fixed
+- Fixed OIDC callback Riverpod state modification error
+  - Deferred callback processing to `addPostFrameCallback` to avoid modifying state during widget build
+
+## [1.0.8] - 2026-01-04
+
+### Changed
+- Switched from hash-based URLs (`/#/login`) to path-based URLs (`/login`)
+  - Required for OIDC callback to work correctly
+  - Uses conditional import to avoid breaking mobile/desktop builds
+
 ## [1.0.7] - 2026-01-04
 
 ### Fixed

Dockerfile

@@ -3,16 +3,24 @@ FROM ghcr.io/cirruslabs/flutter:stable AS builder
 
 WORKDIR /app
 
-# Copy dependency files first for better caching
-COPY pubspec.yaml ./
+# VERSION arg busts cache when version changes in pubspec.yaml
+# Extract version: docker build --build-arg VERSION=$(grep '^version:' pubspec.yaml | cut -d' ' -f2) .
+ARG VERSION=0.0.0
+RUN echo "Building version: $VERSION"
 
-# Get dependencies (generates pubspec.lock)
+# Copy dependency files first for better caching
+COPY pubspec.yaml pubspec.lock* ./
+
+# Get dependencies
 RUN flutter pub get
 
 # Copy the rest of the application
 COPY . .
 
-# Generate code with build_runner
+# Clean any cached build artifacts to ensure fresh build
+RUN flutter clean && flutter pub get
+
+# Generate code with build_runner (after clean for fresh generation)
 RUN dart run build_runner build --delete-conflicting-outputs
 
 # Generate health.json with version info

lib/core/api/api_interceptors.dart

@@ -10,8 +10,7 @@ import 'package:tatlock_ui/core/error/app_exception.dart';
 /// Adds authentication token to requests.
 ///
 /// - **LAN mode**: Skipped entirely (no auth required)
-/// - **Web**: Skipped (cookies handle auth via NPM forward auth)
-/// - **Mobile**: Adds Bearer token from OIDC authentication
+/// - **Web + Mobile**: Adds Bearer token from OIDC authentication
 class AuthInterceptor extends Interceptor {
   AuthInterceptor(this._ref);
 
@@ -25,17 +24,11 @@ class AuthInterceptor extends Interceptor {
       return;
     }
 
-    // Skip Bearer token on web - cookies handle auth via NPM forward auth
-    if (kIsWeb) {
-      handler.next(options);
-      return;
-    }
-
-    // Mobile: Add Bearer token from OIDC authentication
+    // Add Bearer token for all platforms (web + mobile)
     final authState = _ref.read(authProvider);
 
     authState.whenData((auth) {
-      if (auth.isAuthenticated && auth.accessToken != null && auth.accessToken != 'web-session') {
+      if (auth.isAuthenticated && auth.accessToken != null) {
         options.headers['Authorization'] = 'Bearer ${auth.accessToken}';
       }
     });

lib/core/auth/auth_provider.dart

@@ -1,4 +1,4 @@
-import 'dart:convert';
+import 'dart:convert' show jsonDecode, jsonEncode;
 import 'dart:developer' as developer;
 
 import 'package:flutter/foundation.dart' show kIsWeb;
@@ -40,10 +40,51 @@ class AuthNotifier extends _$AuthNotifier {
 
   @override
   Future<AuthState> build() async {
-    // Load stored auth on all platforms
+    // On web with auth required, use silent OIDC to get JWT
+    if (kIsWeb && AppConfig.requiresAuth) {
+      // Skip silent OIDC if we're on the callback page (it will handle auth)
+      final currentUrl = web_utils.getCurrentUrl();
+      if (currentUrl.contains('/callback')) {
+        developer.log('Web: On callback page, skipping silent OIDC', name: 'auth');
+        return const AuthState();
+      }
+
+      // First check if we have stored tokens
+      final storedAuth = await _loadStoredAuth();
+      if (storedAuth.isAuthenticated && !storedAuth.isTokenExpired) {
+        developer.log('Web: Using stored tokens for ${storedAuth.userName}', name: 'auth');
+        return storedAuth;
+      }
+
+      // No valid tokens - initiate silent OIDC
+      // NPM forward auth ensures user has Authentik session
+      // prompt=none will get us a token instantly without UI
+      developer.log('Web: No valid tokens, initiating silent OIDC', name: 'auth');
+      _initiateSilentOidc();
+
+      // Return unauthenticated state - will redirect before this matters
+      return const AuthState();
+    }
+
+    // Mobile/LAN: Load stored auth from SharedPreferences
     return _loadStoredAuth();
   }
 
+  /// Initiate silent OIDC flow on web.
+  ///
+  /// Uses prompt=none to get a token without showing login UI.
+  /// Relies on existing Authentik session (established via NPM forward auth).
+  Future<void> _initiateSilentOidc() async {
+    try {
+      final oidcService = OidcServiceWeb();
+      final authUrl = await oidcService.getAuthorizationUrl(silent: true);
+      developer.log('Redirecting to silent OIDC: $authUrl', name: 'auth');
+      web_utils.redirectTo(authUrl);
+    } catch (e) {
+      developer.log('Failed to initiate silent OIDC: $e', name: 'auth');
+    }
+  }
+
   Future<AuthState> _loadStoredAuth() async {
     try {
       final prefs = await SharedPreferences.getInstance();
@@ -270,7 +311,12 @@ class AuthNotifier extends _$AuthNotifier {
       final authDatasource = ref.read(authDatasourceProvider);
       final syncResponse = await authDatasource.syncUser(tokens.accessToken);
 
-      // Step 3: Store credentials and user data
+      developer.log(
+        'Synced user: ${syncResponse.name} with ${syncResponse.roles.length} roles',
+        name: 'auth',
+      );
+
+      // Step 3: Store credentials and user data from sync response
       await _storeAuth(
         accessToken: tokens.accessToken,
         refreshToken: tokens.refreshToken,
@@ -298,10 +344,7 @@ class AuthNotifier extends _$AuthNotifier {
         preferences: syncResponse.preferences,
       ));
 
-      developer.log(
-        'Authenticated as ${syncResponse.name} with ${syncResponse.roles.length} roles',
-        name: 'auth',
-      );
+      developer.log('Authenticated as ${syncResponse.name}', name: 'auth');
 
       // Clean up the URL by removing the query parameters
       web_utils.replaceUrl('/');
@@ -315,10 +358,27 @@ class AuthNotifier extends _$AuthNotifier {
   }
 
   /// Sign out and clear stored credentials.
+  ///
+  /// On web, also redirects to Authentik's logout endpoint to end the SSO session.
   Future<void> signOut() async {
+    // Clear local storage first
     await _clearStoredAuth();
     state = const AsyncData(AuthState());
-    developer.log('Signed out', name: 'auth');
+    developer.log('Signed out locally', name: 'auth');
+
+    // On web, redirect to Authentik logout to end SSO session
+    if (kIsWeb && AppConfig.requiresAuth) {
+      try {
+        final oidcService = OidcServiceWeb();
+        final logoutUrl = await oidcService.getLogoutUrl();
+        developer.log('Redirecting to Authentik logout', name: 'auth');
+        web_utils.redirectTo(logoutUrl);
+      } catch (e) {
+        developer.log('Failed to get logout URL: $e', name: 'auth');
+        // Local logout already done, just reload to trigger re-auth
+        web_utils.redirectTo('/');
+      }
+    }
   }
 
   /// Update user preferences.

lib/core/auth/oidc_service_web.dart

@@ -34,7 +34,12 @@ class OidcServiceWeb implements OidcService {
   ///
   /// Returns a URL that the browser should navigate to for authentication.
   /// The [codeVerifier] and [state] are stored for later verification.
-  Future<String> getAuthorizationUrl() async {
+  ///
+  /// If [silent] is true, adds `prompt=none` to skip login UI.
+  /// This is used when the user already has an Authentik session (via NPM).
+  /// Authentik will instantly redirect back with a code, or return an error
+  /// if there's no valid session.
+  Future<String> getAuthorizationUrl({bool silent = false}) async {
     // Fetch OIDC discovery document
     final discovery = await _fetchDiscovery();
     final authEndpoint = discovery['authorization_endpoint'] as String;
@@ -59,10 +64,11 @@ class OidcServiceWeb implements OidcService {
       'code_challenge': codeChallenge,
       'code_challenge_method': 'S256',
       'state': state,
+      if (silent) 'prompt': 'none', // Silent auth - no UI, instant redirect
     };
 
     final uri = Uri.parse(authEndpoint).replace(queryParameters: params);
-    developer.log('Authorization URL: $uri', name: 'oidc_web');
+    developer.log('Authorization URL (silent=$silent): $uri', name: 'oidc_web');
     return uri.toString();
   }
 
@@ -209,4 +215,31 @@ class OidcServiceWeb implements OidcService {
     return List.generate(length, (_) => chars[random.nextInt(chars.length)])
         .join();
   }
+
+  /// Get the logout URL to redirect the browser to for SSO logout.
+  ///
+  /// [idToken] is optional but recommended for logout verification.
+  /// After logout, Authentik redirects back to [postLogoutRedirectUri].
+  Future<String> getLogoutUrl({String? idToken}) async {
+    final discovery = await _fetchDiscovery();
+    final endSessionEndpoint = discovery['end_session_endpoint'] as String?;
+
+    if (endSessionEndpoint == null) {
+      // Fallback: just redirect to home, local state already cleared
+      developer.log('No end_session_endpoint in discovery', name: 'oidc_web');
+      return AppConfig.webBaseUrl;
+    }
+
+    final params = <String, String>{
+      'post_logout_redirect_uri': AppConfig.webBaseUrl,
+    };
+
+    if (idToken != null) {
+      params['id_token_hint'] = idToken;
+    }
+
+    final uri = Uri.parse(endSessionEndpoint).replace(queryParameters: params);
+    developer.log('Logout URL: $uri', name: 'oidc_web');
+    return uri.toString();
+  }
 }

lib/core/config/url_strategy.dart

@@ -0,0 +1,5 @@
+/// URL strategy with conditional imports for web/non-web platforms.
+library;
+
+export 'url_strategy_stub.dart'
+    if (dart.library.js_interop) 'url_strategy_web.dart';

lib/core/config/url_strategy_stub.dart

@@ -0,0 +1,4 @@
+/// Stub for non-web platforms - does nothing.
+void configureUrlStrategy() {
+  // No-op on mobile/desktop
+}

lib/core/config/url_strategy_web.dart

@@ -0,0 +1,10 @@
+/// Web-specific URL strategy configuration.
+library;
+
+import 'package:flutter_web_plugins/url_strategy.dart';
+
+void configureUrlStrategy() {
+  // Use path-based URLs instead of hash-based (e.g., /login instead of /#/login)
+  // Required for OIDC callback to work properly
+  usePathUrlStrategy();
+}

lib/features/front_hall/presentation/widgets/iframe_view_web.dart

@@ -1,8 +1,8 @@
-import 'dart:html' as html;
 import 'dart:ui_web' as ui_web;
 
 import 'package:flutter/material.dart';
 import 'package:url_launcher/url_launcher.dart';
+import 'package:web/web.dart' as web;
 
 /// Embedded iframe view for displaying external content (web only).
 ///
@@ -31,7 +31,7 @@ class IframeView extends StatefulWidget {
 
 class _IframeViewState extends State<IframeView> {
   late final String _viewType;
-  late html.IFrameElement _iframe;
+  late web.HTMLIFrameElement _iframe;
   bool _isLoading = true;
 
   @override
@@ -42,17 +42,18 @@ class _IframeViewState extends State<IframeView> {
   }
 
   void _createIframe() {
-    _iframe = html.IFrameElement()
+    _iframe = web.document.createElement('iframe') as web.HTMLIFrameElement
       ..src = widget.url
       ..style.border = 'none'
       ..style.width = '100%'
       ..style.height = '100%'
-      ..allow = 'fullscreen'
-      ..onLoad.listen((_) {
-        if (mounted) {
-          setState(() => _isLoading = false);
-        }
-      });
+      ..allow = 'fullscreen';
+
+    _iframe.onLoad.listen((_) {
+      if (mounted) {
+        setState(() => _isLoading = false);
+      }
+    });
 
     // Register the view factory
     ui_web.platformViewRegistry.registerViewFactory(

lib/main.dart

@@ -4,11 +4,15 @@ import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 
 import 'app.dart';
+import 'core/config/url_strategy.dart';
 import 'version.g.dart';
 
 void main() {
   WidgetsFlutterBinding.ensureInitialized();
 
+  // Use path-based URLs on web (no-op on mobile/desktop)
+  configureUrlStrategy();
+
   developer.log(
     '${AppVersion.name} v${AppVersion.fullVersion}',
     name: 'tatlock_ui',

lib/routing/app_router.dart

@@ -3,7 +3,6 @@ import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:go_router/go_router.dart';
 import 'package:riverpod_annotation/riverpod_annotation.dart';
 import 'package:tatlock_ui/core/auth/auth_provider.dart';
-import 'package:tatlock_ui/core/config/app_config.dart';
 import 'package:tatlock_ui/features/control_room/router.dart';
 import 'package:tatlock_ui/features/front_hall/presentation/pages/front_hall_page.dart';
 import 'package:tatlock_ui/features/security/router.dart';
@@ -16,51 +15,16 @@ abstract class AppRoutes {
   static const frontHall = '/';
   static const parlor = '/parlor';
   static const settings = '/settings';
-  static const login = '/login';
   static const callback = '/callback';
 }
 
 /// Provides the GoRouter instance.
 @riverpod
 GoRouter appRouter(Ref ref) {
-  final authState = ref.watch(authProvider);
-
   return GoRouter(
     initialLocation: AppRoutes.frontHall,
     debugLogDiagnostics: true,
-    redirect: (context, state) {
-      // No auth required in LAN mode
-      if (!AppConfig.requiresAuth) {
-        return null;
-      }
-
-      final isAuthenticated = authState.value?.isAuthenticated ?? false;
-      final isLoginRoute = state.matchedLocation == AppRoutes.login;
-
-      // If not authenticated, redirect to login (except if already on login)
-      if (!isAuthenticated && !isLoginRoute) {
-        return AppRoutes.login;
-      }
-
-      // If authenticated and on login page, redirect to home
-      if (isAuthenticated && isLoginRoute) {
-        return AppRoutes.frontHall;
-      }
-
-      // Allow callback route through without auth check
-      if (state.matchedLocation == AppRoutes.callback) {
-        return null;
-      }
-
-      return null;
-    },
     routes: [
-      // Login route (outside shell - no app scaffold)
-      GoRoute(
-        path: AppRoutes.login,
-        name: 'login',
-        builder: (context, state) => const _LoginPage(),
-      ),
       // OIDC callback route (handles auth code exchange)
       GoRoute(
         path: AppRoutes.callback,
@@ -136,131 +100,6 @@ class _PlaceholderPage extends StatelessWidget {
   }
 }
 
-/// Login page displayed when user is not authenticated.
-class _LoginPage extends ConsumerWidget {
-  const _LoginPage();
-
-  @override
-  Widget build(BuildContext context, WidgetRef ref) {
-    final authAsync = ref.watch(authProvider);
-    final colorScheme = Theme.of(context).colorScheme;
-
-    return Scaffold(
-      body: Center(
-        child: ConstrainedBox(
-          constraints: const BoxConstraints(maxWidth: 400),
-          child: Card(
-            child: Padding(
-              padding: const EdgeInsets.all(32),
-              child: Column(
-                mainAxisSize: MainAxisSize.min,
-                children: [
-                  Icon(
-                    Icons.home_work_outlined,
-                    size: 64,
-                    color: colorScheme.primary,
-                  ),
-                  const SizedBox(height: 24),
-                  Text(
-                    'Tatlock Estate',
-                    style: Theme.of(context).textTheme.headlineMedium?.copyWith(
-                          fontWeight: FontWeight.w600,
-                        ),
-                  ),
-                  const SizedBox(height: 8),
-                  Text(
-                    'Sign in to access the estate management system',
-                    style: Theme.of(context).textTheme.bodyMedium?.copyWith(
-                          color: colorScheme.onSurfaceVariant,
-                        ),
-                    textAlign: TextAlign.center,
-                  ),
-                  const SizedBox(height: 32),
-                  authAsync.when(
-                    data: (_) => _buildSignInContent(context, ref),
-                    loading: () => const Column(
-                      children: [
-                        SizedBox(
-                          width: 24,
-                          height: 24,
-                          child: CircularProgressIndicator(strokeWidth: 2),
-                        ),
-                        SizedBox(height: 16),
-                        Text('Checking authentication...'),
-                      ],
-                    ),
-                    error: (error, _) => _buildErrorContent(context, ref, error),
-                  ),
-                ],
-              ),
-            ),
-          ),
-        ),
-      ),
-    );
-  }
-
-  Widget _buildSignInContent(BuildContext context, WidgetRef ref) {
-    // Same sign in button for both web and mobile
-    return FilledButton.icon(
-      onPressed: () => ref.read(authProvider.notifier).signIn(),
-      icon: const Icon(Icons.login),
-      label: const Text('Sign in with Authentik'),
-      style: FilledButton.styleFrom(
-        minimumSize: const Size(double.infinity, 48),
-      ),
-    );
-  }
-
-  Widget _buildErrorContent(BuildContext context, WidgetRef ref, Object error) {
-    final colorScheme = Theme.of(context).colorScheme;
-
-    return Column(
-      children: [
-        Container(
-          padding: const EdgeInsets.all(12),
-          decoration: BoxDecoration(
-            color: colorScheme.errorContainer,
-            borderRadius: BorderRadius.circular(8),
-          ),
-          child: Row(
-            children: [
-              Icon(Icons.error_outline, color: colorScheme.onErrorContainer),
-              const SizedBox(width: 12),
-              Expanded(
-                child: Text(
-                  _formatError(error),
-                  style: TextStyle(color: colorScheme.onErrorContainer),
-                ),
-              ),
-            ],
-          ),
-        ),
-        const SizedBox(height: 16),
-        OutlinedButton.icon(
-          onPressed: () => ref.read(authProvider.notifier).signIn(),
-          icon: const Icon(Icons.refresh),
-          label: const Text('Try again'),
-          style: OutlinedButton.styleFrom(
-            minimumSize: const Size(double.infinity, 48),
-          ),
-        ),
-      ],
-    );
-  }
-
-  String _formatError(Object error) {
-    final message = error.toString();
-    if (message.contains('user_cancelled')) {
-      return 'Sign in was cancelled';
-    }
-    if (message.contains('network')) {
-      return 'Network error. Please check your connection.';
-    }
-    return 'Authentication failed. Please try again.';
-  }
-}
-
 /// OIDC callback page that handles the authorization code exchange.
 class _OidcCallbackPage extends ConsumerStatefulWidget {
   const _OidcCallbackPage({
@@ -286,12 +125,25 @@ class _OidcCallbackPageState extends ConsumerState<_OidcCallbackPage> {
   @override
   void initState() {
     super.initState();
-    _processCallback();
+    // Defer callback processing to avoid Riverpod state modification during build
+    WidgetsBinding.instance.addPostFrameCallback((_) {
+      _processCallback();
+    });
   }
 
   Future<void> _processCallback() async {
+    // Check mounted before any async work
+    if (!mounted) return;
+
     // Check for error from Authentik
     if (widget.error != null) {
+      // Silent OIDC (prompt=none) failed - no existing session
+      // Fall back to regular OIDC flow to show login UI
+      if (widget.error == 'login_required') {
+        ref.read(authProvider.notifier).signIn();
+        return;
+      }
+
       setState(() {
         _isProcessing = false;
         _error = widget.errorDescription ?? widget.error;
@@ -308,12 +160,15 @@ class _OidcCallbackPageState extends ConsumerState<_OidcCallbackPage> {
       return;
     }
 
+    // Get notifier reference before async gap to avoid disposed ref errors
+    final authNotifier = ref.read(authProvider.notifier);
+
     // Exchange code for tokens
     try {
-      await ref.read(authProvider.notifier).handleOidcCallback(
-            widget.code!,
-            widget.callbackState!,
-          );
+      await authNotifier.handleOidcCallback(
+        widget.code!,
+        widget.callbackState!,
+      );
 
       // Navigate to home on success
       if (mounted) {
@@ -373,9 +228,9 @@ class _OidcCallbackPageState extends ConsumerState<_OidcCallbackPage> {
                     ),
                     const SizedBox(height: 16),
                     OutlinedButton.icon(
-                      onPressed: () => context.go(AppRoutes.login),
-                      icon: const Icon(Icons.arrow_back),
-                      label: const Text('Back to Login'),
+                      onPressed: () => context.go(AppRoutes.frontHall),
+                      icon: const Icon(Icons.refresh),
+                      label: const Text('Try again'),
                       style: OutlinedButton.styleFrom(
                         minimumSize: const Size(double.infinity, 48),
                       ),

lib/shared/layouts/app_scaffold.dart

@@ -1,5 +1,9 @@
+import 'package:flutter/foundation.dart' show kIsWeb;
 import 'package:flutter/material.dart';
+import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:go_router/go_router.dart';
+import 'package:tatlock_ui/core/auth/auth_provider.dart';
+import 'package:tatlock_ui/core/config/app_config.dart';
 import 'package:tatlock_ui/features/control_room/router.dart';
 import 'package:tatlock_ui/features/security/router.dart';
 import 'package:tatlock_ui/routing/app_router.dart';
@@ -7,6 +11,11 @@ import 'package:tatlock_ui/shared/layouts/widgets/top_header_bar.dart';
 
 /// Main application scaffold with top header navigation.
 ///
+/// Handles authentication automatically:
+/// - If not authenticated, auto-initiates OIDC flow
+/// - Shows loading state during authentication
+/// - Shows error state if auth fails (with retry)
+///
 /// Layout structure per UI_LAYOUT.md:
 /// ```
 /// ┌─────────────────────────────────────────────────────────────────┐
@@ -15,16 +24,62 @@ import 'package:tatlock_ui/shared/layouts/widgets/top_header_bar.dart';
 /// │  BODY: Room page content (may include room-specific sidebar)    │
 /// └─────────────────────────────────────────────────────────────────┘
 /// ```
-class AppScaffold extends StatelessWidget {
+class AppScaffold extends ConsumerStatefulWidget {
   const AppScaffold({super.key, required this.child});
 
   final Widget child;
 
+  @override
+  ConsumerState<AppScaffold> createState() => _AppScaffoldState();
+}
+
+class _AppScaffoldState extends ConsumerState<AppScaffold> {
   // Header height must match TopHeaderBar._headerHeight
   static const double _headerHeight = 56.0;
 
+  bool _authInitiated = false;
+
   @override
   Widget build(BuildContext context) {
+    // No auth required in LAN mode - show content directly
+    if (!AppConfig.requiresAuth) {
+      return _buildScaffold(context);
+    }
+
+    // Watch auth state (works for both web and mobile)
+    final authAsync = ref.watch(authProvider);
+
+    return authAsync.when(
+      data: (authState) {
+        if (authState.isAuthenticated) {
+          // Authenticated - show the app
+          _authInitiated = false; // Reset for next time
+          return _buildScaffold(context);
+        }
+
+        // On web, NPM handles auth - if we're here without auth, something is wrong
+        // (NPM should have redirected to Authentik before we loaded)
+        if (kIsWeb) {
+          return _buildAuthErrorScreen(context, 'Authentication required');
+        }
+
+        // Mobile: Not authenticated - auto-initiate OIDC
+        if (!_authInitiated) {
+          _authInitiated = true;
+          WidgetsBinding.instance.addPostFrameCallback((_) {
+            ref.read(authProvider.notifier).signIn();
+          });
+        }
+
+        // Show loading while redirecting to Authentik
+        return _buildAuthLoadingScreen(context, 'Redirecting to sign in...');
+      },
+      loading: () => _buildAuthLoadingScreen(context, 'Loading user info...'),
+      error: (error, _) => _buildAuthErrorScreen(context, error),
+    );
+  }
+
+  Widget _buildScaffold(BuildContext context) {
     return Scaffold(
       body: Stack(
         children: [
@@ -32,7 +87,7 @@ class AppScaffold extends StatelessWidget {
           Positioned.fill(
             child: Padding(
               padding: const EdgeInsets.only(top: _headerHeight),
-              child: child,
+              child: widget.child,
             ),
           ),
 
@@ -51,6 +106,115 @@ class AppScaffold extends StatelessWidget {
     );
   }
 
+  Widget _buildAuthLoadingScreen(BuildContext context, String message) {
+    final colorScheme = Theme.of(context).colorScheme;
+
+    return Scaffold(
+      body: Center(
+        child: Column(
+          mainAxisAlignment: MainAxisAlignment.center,
+          children: [
+            Icon(
+              Icons.home_work_outlined,
+              size: 64,
+              color: colorScheme.primary,
+            ),
+            const SizedBox(height: 24),
+            Text(
+              'Tatlock Estate',
+              style: Theme.of(context).textTheme.headlineMedium?.copyWith(
+                    fontWeight: FontWeight.w600,
+                  ),
+            ),
+            const SizedBox(height: 32),
+            const SizedBox(
+              width: 24,
+              height: 24,
+              child: CircularProgressIndicator(strokeWidth: 2),
+            ),
+            const SizedBox(height: 16),
+            Text(
+              message,
+              style: Theme.of(context).textTheme.bodyMedium?.copyWith(
+                    color: colorScheme.onSurfaceVariant,
+                  ),
+            ),
+          ],
+        ),
+      ),
+    );
+  }
+
+  Widget _buildAuthErrorScreen(BuildContext context, Object error) {
+    final colorScheme = Theme.of(context).colorScheme;
+
+    return Scaffold(
+      body: Center(
+        child: ConstrainedBox(
+          constraints: const BoxConstraints(maxWidth: 400),
+          child: Card(
+            child: Padding(
+              padding: const EdgeInsets.all(32),
+              child: Column(
+                mainAxisSize: MainAxisSize.min,
+                children: [
+                  Icon(
+                    Icons.error_outline,
+                    size: 64,
+                    color: colorScheme.error,
+                  ),
+                  const SizedBox(height: 24),
+                  Text(
+                    'Authentication Failed',
+                    style: Theme.of(context).textTheme.headlineMedium?.copyWith(
+                          fontWeight: FontWeight.w600,
+                        ),
+                  ),
+                  const SizedBox(height: 16),
+                  Container(
+                    padding: const EdgeInsets.all(12),
+                    decoration: BoxDecoration(
+                      color: colorScheme.errorContainer,
+                      borderRadius: BorderRadius.circular(8),
+                    ),
+                    child: Text(
+                      _formatError(error),
+                      style: TextStyle(color: colorScheme.onErrorContainer),
+                      textAlign: TextAlign.center,
+                    ),
+                  ),
+                  const SizedBox(height: 24),
+                  FilledButton.icon(
+                    onPressed: () {
+                      _authInitiated = false;
+                      ref.read(authProvider.notifier).signIn();
+                    },
+                    icon: const Icon(Icons.refresh),
+                    label: const Text('Try again'),
+                    style: FilledButton.styleFrom(
+                      minimumSize: const Size(double.infinity, 48),
+                    ),
+                  ),
+                ],
+              ),
+            ),
+          ),
+        ),
+      ),
+    );
+  }
+
+  String _formatError(Object error) {
+    final message = error.toString();
+    if (message.contains('user_cancelled')) {
+      return 'Sign in was cancelled';
+    }
+    if (message.contains('network')) {
+      return 'Network error. Please check your connection.';
+    }
+    return 'Authentication failed. Please try again.';
+  }
+
   int _selectedIndex(BuildContext context) {
     final location = GoRouterState.of(context).matchedLocation;
 

pubspec.yaml

@@ -16,7 +16,7 @@ publish_to: 'none' # Remove this line if you wish to publish to pub.dev
 # https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html
 # In Windows, build-name is used as the major, minor, and patch parts
 # of the product and file versions while build-number is used as the build suffix.
-version: 1.0.7+1
+version: 1.1.5+1
 
 environment:
   sdk: ^3.10.4
@@ -30,6 +30,8 @@ environment:
 dependencies:
   flutter:
     sdk: flutter
+  flutter_web_plugins:
+    sdk: flutter
 
   # State Management
   flutter_riverpod: ^3.0.0

tool/generate_health_json.dart

@@ -2,6 +2,8 @@
 // Generates web/health.json from pubspec.yaml
 // Run: dart run tool/generate_health_json.dart
 
+// ignore_for_file: avoid_print
+
 import 'dart:convert';
 import 'dart:io';
 

web/index.html

@@ -27,6 +27,7 @@
   <link rel="apple-touch-icon" href="icons/Icon-192.png">
 
   <!-- Favicon -->
+  <link rel="icon" type="image/x-icon" href="favicon.ico"/>
   <link rel="icon" type="image/png" href="favicon.png"/>
 
   <title>Tatlock</title>