##update fix session dan tampilan screen

server/api/auth/keycloak-login.ts

@@ -5,6 +5,51 @@ export default defineEventHandler(async (event) => {
   console.log('🔐 Keycloak Login Handler Called')
   console.log('📍 Method:', getMethod(event))
   
+  // === STALE SESSION CLEANUP ===
+  // Check for existing session and clean up if invalid/expired
+  const existingSessionId = getCookie(event, 'user_session')
+  
+  if (existingSessionId) {
+    console.log('🔍 Existing session cookie found, validating...')
+    
+    try {
+      const { getSession, deleteSession } = await import('~/server/utils/sessionStore')
+      const session = getSession(existingSessionId)
+      
+      if (session) {
+        // Check if session is expired
+        const isExpired = Date.now() > session.expiresAt
+        
+        if (isExpired) {
+          console.log('🧹 Cleaning up expired session...')
+          deleteSession(existingSessionId)
+          deleteCookie(event, 'user_session')
+          deleteCookie(event, 'oauth_state')
+          console.log('✅ Expired session cleared')
+        } else {
+          console.log('⚠️ Valid session exists, clearing to allow fresh login...')
+          deleteSession(existingSessionId)
+          deleteCookie(event, 'user_session')
+          deleteCookie(event, 'oauth_state')
+          console.log('✅ Existing session cleared for fresh login')
+        }
+      } else {
+        console.log('🧹 Session cookie exists but no session in store, clearing cookie...')
+        deleteCookie(event, 'user_session')
+        deleteCookie(event, 'oauth_state')
+        console.log('✅ Stale cookie cleared')
+      }
+    } catch (error) {
+      console.warn('⚠️ Error during session cleanup:', error)
+      // Clear cookies anyway to be safe
+      deleteCookie(event, 'user_session')
+      deleteCookie(event, 'oauth_state')
+    }
+  } else {
+    console.log('ℹ️ No existing session found, proceeding with fresh login')
+  }
+  // === END STALE SESSION CLEANUP ===
+  
   try {
     const config = useRuntimeConfig()
     

server/api/auth/validate-session.post.ts

@@ -0,0 +1,75 @@
+// server/api/auth/validate-session.post.ts
+export default defineEventHandler(async (event) => {
+  const config = useRuntimeConfig()
+  const sessionId = getCookie(event, 'user_session')
+  
+  console.log('🔍 Session validation endpoint called')
+  console.log('🍪 Session cookie exists:', !!sessionId)
+  
+  if (!sessionId) {
+    console.log('❌ No session cookie found')
+    return { valid: false, reason: 'no_session' }
+  }
+  
+  try {
+    const { getSession, deleteSession } = await import('~/server/utils/sessionStore')
+    const session = getSession(sessionId)
+    
+    if (!session) {
+      console.log('❌ Session not found in store')
+      deleteCookie(event, 'user_session')
+      return { valid: false, reason: 'session_not_found' }
+    }
+    
+    // Check local expiry
+    if (Date.now() > session.expiresAt) {
+      console.log('⏰ Session has expired locally')
+      deleteSession(sessionId)
+      deleteCookie(event, 'user_session')
+      return { valid: false, reason: 'session_expired' }
+    }
+    
+    // Validate with Keycloak userinfo endpoint
+    try {
+      const userInfoUrl = `${config.keycloakIssuer}/protocol/openid-connect/userinfo`
+      console.log('🔗 Validating with Keycloak:', userInfoUrl)
+      
+      const userInfo = await $fetch(userInfoUrl, {
+        headers: {
+          Authorization: `Bearer ${session.accessToken}`
+        }
+      })
+      
+      console.log('✅ Session is valid with Keycloak')
+      return { 
+        valid: true, 
+        user: {
+          id: session.user.id,
+          email: session.user.email,
+          name: session.user.name
+        }
+      }
+    } catch (keycloakError: any) {
+      // If Keycloak returns 401, the session is invalid on their side
+      if (keycloakError.status === 401 || keycloakError.statusCode === 401) {
+        console.log('❌ Keycloak session has expired (401)')
+        deleteSession(sessionId)
+        deleteCookie(event, 'user_session')
+        return { valid: false, reason: 'keycloak_session_expired' }
+      }
+      
+      // For other errors, log but don't invalidate the session
+      console.warn('⚠️ Keycloak validation error (non-401):', keycloakError.message)
+      throw keycloakError
+    }
+  } catch (error: any) {
+    console.error('❌ Session validation error:', error)
+    // On error, clear the session to be safe
+    deleteCookie(event, 'user_session')
+    return { 
+      valid: false, 
+      reason: 'validation_error',
+      error: error.message 
+    }
+  }
+})