fix: skip silent OIDC on callback page to prevent race condition

AuthProvider.build() was initiating silent OIDC while the callback
page was processing the auth code, causing PKCE state to be cleared.
Now checks if on /callback route and skips silent OIDC initiation.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.1.5] - 2026-01-04
+
+### Fixed
+- Race condition in OIDC callback: AuthProvider.build() was initiating silent OIDC while the callback page was processing, causing PKCE state to be cleared. Now skips silent OIDC when on `/callback` route.
+
+## [1.1.4] - 2026-01-04
+
+### Fixed
+- Silent OIDC fallback: when `prompt=none` fails with `login_required` (no Authentik session), automatically fall back to regular OIDC flow to show login UI
+
 ## [1.1.3] - 2026-01-04
 
 ### Changed

lib/core/auth/auth_provider.dart

@@ -42,6 +42,13 @@ class AuthNotifier extends _$AuthNotifier {
   Future<AuthState> build() async {
     // On web with auth required, use silent OIDC to get JWT
     if (kIsWeb && AppConfig.requiresAuth) {
+      // Skip silent OIDC if we're on the callback page (it will handle auth)
+      final currentUrl = web_utils.getCurrentUrl();
+      if (currentUrl.contains('/callback')) {
+        developer.log('Web: On callback page, skipping silent OIDC', name: 'auth');
+        return const AuthState();
+      }
+
       // First check if we have stored tokens
       final storedAuth = await _loadStoredAuth();
       if (storedAuth.isAuthenticated && !storedAuth.isTokenExpired) {

lib/routing/app_router.dart

@@ -137,6 +137,13 @@ class _OidcCallbackPageState extends ConsumerState<_OidcCallbackPage> {
 
     // Check for error from Authentik
     if (widget.error != null) {
+      // Silent OIDC (prompt=none) failed - no existing session
+      // Fall back to regular OIDC flow to show login UI
+      if (widget.error == 'login_required') {
+        ref.read(authProvider.notifier).signIn();
+        return;
+      }
+
       setState(() {
         _isProcessing = false;
         _error = widget.errorDescription ?? widget.error;

pubspec.yaml

@@ -16,7 +16,7 @@ publish_to: 'none' # Remove this line if you wish to publish to pub.dev
 # https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/CoreFoundationKeys.html
 # In Windows, build-name is used as the major, minor, and patch parts
 # of the product and file versions while build-number is used as the build suffix.
-version: 1.1.3+1
+version: 1.1.5+1
 
 environment:
   sdk: ^3.10.4