diff --git a/hugo/layouts/signin.html b/hugo/layouts/signin.html
index e202c709d..2078cdb88 100644
--- a/hugo/layouts/signin.html
+++ b/hugo/layouts/signin.html
@@ -53,6 +53,21 @@ Sign In
+ {{/*
+ Active-session nudge (follow-up to #2626). When the visitor already has an
+ IAS SSO session, clicking a provider silently reuses that session's IdP
+ instead of the chosen one (the approuter can't forward OIDC prompt=login,
+ and IAS has no idp-keyed force-reauth — verified on tenant atxgsg7zi). We
+ can't force re-auth without breaking the silent returning-visitor path, so
+ we make the state visible: tell the user to sign out first to switch IdP.
+ Hidden by default; revealed only when header.html's checkAuth resolves to
+ an authenticated session (data-authenticated="true" / auth-resolved event).
+ */}}
+
+ Already signed in. To switch to a different provider,
+ sign out first.
+
+
By signing in, you accept our
Privacy Policy and
@@ -72,6 +87,38 @@
Sign In
a.href += '&returnTo=' + encodeURIComponent(rt);
});
})();
+
+ // Active-session nudge (#2626 follow-up). header.html's checkAuth() already
+ // probes /auth/user and records the result on plus
+ // an 'auth-resolved' event. maybeAutoLogin is suppressed on /signin, so there
+ // is no redirect race — we only reveal the hint when a session is confirmed.
+ (function () {
+ var nudge = document.getElementById('signin-session-nudge');
+ if (!nudge) return;
+
+ function reveal(isAuthed) {
+ nudge.hidden = !isAuthed;
+ }
+
+ // Catch the event if it fires after this script, and the already-resolved
+ // case where the attribute is set before we attach the listener.
+ document.addEventListener('auth-resolved', function (e) {
+ reveal(!!(e.detail && e.detail.authenticated));
+ });
+ if (document.documentElement.dataset.authenticated === 'true') reveal(true);
+
+ var logout = document.getElementById('signin-session-logout');
+ if (logout) {
+ logout.addEventListener('click', function (e) {
+ e.preventDefault();
+ // Reuse header.html's logout (sets autologin.optout, clears joule.*
+ // session keys, then redirects to /logout). Fall back to /logout if the
+ // header hasn't exposed it yet.
+ if (typeof window.handleLogout === 'function') window.handleLogout();
+ else window.location.href = '/logout';
+ });
+ }
+ })();
{{ end }}