auto_login answers {"auto_login": false} when auto-login is off

It answered 403, so every anonymous visit logged a failed request before
the login page appeared. The answer is now 200 with auto_login false,
like /v1/session answers unauthenticated visitors, and useGetAutoLogin
reads it and sets autoLogin to false. A request that fails still clears
autoLogin and retries as before.

Co-authored-by: Hanzo Dev <[email protected]>

src/backend/base/flow/api/v1/login.py

@@ -133,13 +133,7 @@ async def auto_login(response: Response, db: DbSession):
 
         return tokens
 
-    raise HTTPException(
-        status_code=status.HTTP_403_FORBIDDEN,
-        detail={
-            "message": "Auto login is disabled.",
-            "auto_login": False,
-        },
-    )
+    return {"auto_login": False}
 
 
 @router.post("/refresh", include_in_schema=False)

src/frontend/src/controllers/API/api.tsx

@@ -78,8 +78,7 @@ function ApiInterceptor() {
         if (shouldRetryRefresh) {
           if (
             error?.config?.url?.includes("github") ||
-            error?.config?.url?.includes("public") ||
-            error?.config?.url?.includes("auto_login")
+            error?.config?.url?.includes("public")
           ) {
             return Promise.reject(error);
           }

src/frontend/src/controllers/API/queries/auth/use-get-autologin.ts

@@ -19,7 +19,7 @@ export interface AutoLoginResponse {
   health_check_max_retries: number;
 }
 
-export interface AutoLoginErrorResponse {
+export interface AutoLoginDisabledResponse {
   auto_login?: boolean;
 }
 
@@ -44,7 +44,9 @@ export const useGetAutoLogin: useQueryFunctionType<undefined, undefined> = (
     }
 
     try {
-      const response = await api.get<Users>(`${getURL("AUTOLOGIN")}`);
+      const response = await api.get<Users & AutoLoginDisabledResponse>(
+        `${getURL("AUTOLOGIN")}`,
+      );
       const user = response.data;
       if (user && user["access_token"]) {
         user["refresh_token"] = "auto";
@@ -52,15 +54,15 @@ export const useGetAutoLogin: useQueryFunctionType<undefined, undefined> = (
         setUserData(user);
         setAutoLogin(true);
         resetTimer();
+      } else if (user?.auto_login === false) {
+        // The backend answers {"auto_login": false} when auto-login is off.
+        setAutoLogin(false);
       }
     } catch (e) {
-      const error = e as AxiosError<AutoLoginErrorResponse>;
+      const error = e as AxiosError;
       if (error.name !== "CanceledError") {
         setAutoLogin(false);
-        // Don't retry if backend explicitly says auto-login is disabled
-        const autoLoginDisabledByBackend =
-          error.response?.data?.auto_login === false;
-        if (!isLoginPage && !autoLoginDisabledByBackend) {
+        if (!isLoginPage) {
           await handleAutoLoginError();
         }
       }