fix: leave the oidc callback page when the sign-in fails

packages/web-runtime/src/services/auth/authService.ts

@@ -339,7 +339,13 @@ export class AuthService implements AuthServiceInterface {
       })
     } catch (e) {
       console.warn('error during authentication:', e)
-      return this.handleAuthError(unref(this.router.currentRoute))
+      await this.handleAuthError(unref(this.router.currentRoute))
+
+      // the callback page is anonymous, so no navigation follows that lets the
+      // authGuard show the access denied page. Navigate there explicitly.
+      if (this.hasAuthErrorOccurred) {
+        return this.router.replace({ name: 'accessDenied' })
+      }
     }
   }
 

packages/web-runtime/tests/unit/services/auth/authService.spec.ts

@@ -94,6 +94,36 @@ describe('AuthService', () => {
       }
     )
 
+    it('navigates to the access denied page when the sign-in response has no matching state', async () => {
+      const authService = new AuthService()
+
+      Object.defineProperty(authService, 'userManager', {
+        value: {
+          signinRedirectCallback: vi
+            .fn()
+            .mockRejectedValue(new Error('No matching state found in storage'))
+        }
+      })
+
+      const router = createRouter({
+        routes: [
+          {
+            path: '/web-oidc-callback',
+            name: 'oidcCallback',
+            component: {},
+            meta: { authContext: 'anonymous' }
+          }
+        ]
+      })
+      await router.push('/web-oidc-callback?code=code&state=unknown-state')
+      const replaceSpy = vi.spyOn(router, 'replace').mockResolvedValue(undefined)
+
+      initAuthService({ authService, router })
+      await authService.signInCallback()
+
+      expect(replaceSpy).toHaveBeenCalledWith({ name: 'accessDenied' })
+    })
+
     it('applies delegated token updates received after sign-in', async () => {
       const authService = new AuthService()
       const updateContext = vi.fn()