visual

public/index.php

@@ -17,8 +17,9 @@ $keycloakConfig = ConfigLoader::load($projectRoot, 'keycloak');
 $registrationConfig = ConfigLoader::load($projectRoot, 'registration');
 $auth = new KeycloakAuth($keycloakConfig);
 $accountGate = new AccountGate($registrationConfig);
+$hasAuthenticatedSession = $auth->ensureAuthenticatedSession();
 
-if (!$auth->isAuthenticated()) {
+if (!$hasAuthenticatedSession) {
     $statusRedirect = AuthStatusRedirect::consume();
 
     if ($statusRedirect !== null) {
@@ -27,7 +28,7 @@ if (!$auth->isAuthenticated()) {
     }
 }
 
-if ($auth->isAuthenticated()) {
+if ($hasAuthenticatedSession) {
     $currentUser = is_array($_SESSION['desktop_auth']['user'] ?? null) ? $_SESSION['desktop_auth']['user'] : [];
     $accountCheck = $accountGate->checkUsername((string) ($currentUser['username'] ?? ''));
 
@@ -42,7 +43,7 @@ if ($auth->isAuthenticated()) {
 }
 
 if (
-    !$auth->isAuthenticated()
+    !$hasAuthenticatedSession
     && $auth->isConfigured()
     && empty($_SESSION['desktop_silent_sso_attempted'])
 ) {
@@ -51,6 +52,15 @@ if (
     exit;
 }
 
+if (
+    !$hasAuthenticatedSession
+    && $auth->isConfigured()
+    && $auth->enforceLogin()
+) {
+    header('Location: /auth/keycloak', true, 302);
+    exit;
+}
+
 $app = new App($projectRoot);
 $desktopPayload = $app->desktopPayload();