🐛 Bugfix: Session 184.2: How to fix the broken login flow for embedded...

Date: 2026-03-06
Time: 17:07:04 UTC
Session: gspace1-184.3
Agent: angular
Confidence: 95%
Status: ✅ Documented

📋 Decision Context

Question:

Session 184.2: How to fix the broken login flow for embedded iframes that incorrectly show the desktop auth flow ("Opening Vitto...")?

Task: Fix login flow for iframe/desktop/mobile/chrome-extension

🎯 Decision Made

Chosen:

Separated embedded iframe auth from desktop/mobile auth in appAuthGuard. Embedded iframes now redirect to /login (inline form) instead of /welcome (desktop deep-link flow). Added safety net in DesktopWelcomeComponent. LoginComponent now handles returnUrl and embedded mode. GoGrabAiPanelComponent now includes auth token in iframe URL params.

Options Considered:

1. Make guard async to wait for postMessage auth
2. Don't guard panel routes for embedded context
3. Separate embedded from native in guard and redirect to /login

💭 Reasoning

Root cause: The guard lumped isEmbedded with isDesktop/isMobile, redirecting all to /welcome. /welcome is designed for native apps with deep-link OAuth. For iframes, the /login page with an inline form is correct. The timing race (postMessage auth arrives after guard runs) was also addressed by including auth tokens in iframe URLs, matching the Chrome extension pattern.

📁 Files Involved

• apps/gograb-ai/src/app/core/guards/desktop-auth.guard.ts
• apps/gograb-ai/src/app/pages/desktop-welcome/desktop-welcome.component.ts
• apps/gograb-ai/src/app/pages/login/login.component.ts
• libs/libs-ux/embeddable-bridge/src/lib/components/gograb-ai-panel.component.ts

🔗 Related

• Decision ID: dev_1772816824564_mxl3efi
• Session: 184
• Workspace: gspace1

Auto-generated by MCP Smart Consolidation