From 88d1a730b9733b89dbcc6e5ecfc736ebb29b2c1c Mon Sep 17 00:00:00 2001
From: Hongwei <hongwei@tesobe.com>
Date: Sat, 18 Jul 2026 08:23:20 +0200
Subject: [PATCH 1/5] fix: correct Berlin Group SCA authorisation URL segment
 order

The payment SCA endpoints called /obp/v1.3/berlin-group/... but
OBP-API registers these routes at /berlin-group/v1.3/... with no
/obp/ prefix, so both the create-authorisation POST and OTP-submit
PUT calls were hitting a non-existent path.
---
 apps/portal/src/routes/(protected)/otp/+page.server.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/apps/portal/src/routes/(protected)/otp/+page.server.ts b/apps/portal/src/routes/(protected)/otp/+page.server.ts
index 4b303bac..80df6529 100644
--- a/apps/portal/src/routes/(protected)/otp/+page.server.ts
+++ b/apps/portal/src/routes/(protected)/otp/+page.server.ts
@@ -81,7 +81,7 @@ export const actions = {
 
 				// Step 1: Create authorisation
 				const authResponse = await obp_requests.post(
-					`/obp/v1.3/berlin-group/${paymentService}/${paymentProduct}/${paymentId}/authorisations`,
+					`/berlin-group/v1.3/${paymentService}/${paymentProduct}/${paymentId}/authorisations`,
 					{},
 					token
 				);
@@ -90,7 +90,7 @@ export const actions = {
 
 				// Step 2: Submit OTP to authorisation
 				await obp_requests.put(
-					`/obp/v1.3/berlin-group/${paymentService}/${paymentProduct}/${paymentId}/authorisations/${authorisationId}`,
+					`/berlin-group/v1.3/${paymentService}/${paymentProduct}/${paymentId}/authorisations/${authorisationId}`,
 					{ scaAuthenticationData: otp },
 					token
 				);

From a80a60a6e42e9691e96a511b749d92bd7908d271 Mon Sep 17 00:00:00 2001
From: Hongwei <hongwei@tesobe.com>
Date: Sat, 18 Jul 2026 09:45:14 +0200
Subject: [PATCH 2/5] fix(portal): call the Berlin Group native SCA endpoints
 for BG consent approval

The SCA confirmation page submitted the OTP to
/obp/v3.1.0/banks/{bank}/consents/{id}/challenge, which only
transitions consents in status INITIATED -- Berlin Group consents are
created in status received, so this endpoint could never succeed
regardless of OTP correctness.

Call the real BG-native pair instead: start the authorisation in
load() (POST .../consents/{id}/authorisations) and submit the answer
in the form action (PUT .../consents/{id}/authorisations/{authorisationId}),
threading the authorisationId through a hidden form field.
---
 apps/portal/src/lib/obp/types.ts              | 12 ++++
 .../+page.server.ts                           | 56 ++++++++++++++-----
 .../+page.svelte                              |  1 +
 3 files changed, 54 insertions(+), 15 deletions(-)

diff --git a/apps/portal/src/lib/obp/types.ts b/apps/portal/src/lib/obp/types.ts
index 62a9e5eb..641c4bba 100644
--- a/apps/portal/src/lib/obp/types.ts
+++ b/apps/portal/src/lib/obp/types.ts
@@ -312,6 +312,18 @@ export interface OBPBGPaymentAuthorisation {
     sca_status: string;
 }
 
+// Berlin Group Consent Authorisation (SCA) types
+export interface OBPBGStartConsentAuthorisation {
+    scaStatus: string;
+    authorisationId: string;
+    pushMessage: string;
+    _links: { scaStatus: string };
+}
+export interface OBPBGConsentAuthorisationResult {
+    scaStatus: string;
+    _links?: { scaStatus?: { href?: string } };
+}
+
 // Personal Data Field (User Attribute)
 export interface OBPPersonalDataField {
     user_attribute_id: string;
diff --git a/apps/portal/src/routes/(protected)/confirm-bg-consent-request-sca/+page.server.ts b/apps/portal/src/routes/(protected)/confirm-bg-consent-request-sca/+page.server.ts
index 5e74f7b2..f3edb51b 100644
--- a/apps/portal/src/routes/(protected)/confirm-bg-consent-request-sca/+page.server.ts
+++ b/apps/portal/src/routes/(protected)/confirm-bg-consent-request-sca/+page.server.ts
@@ -4,20 +4,47 @@ import type { RequestEvent, Actions } from '@sveltejs/kit';
 import { redirect, isRedirect } from '@sveltejs/kit';
 import { obp_requests } from '$lib/obp/requests';
 import { OBPRequestError } from '@obp/shared/obp';
-import { env } from '$env/dynamic/private';
+import type {
+	OBPBGStartConsentAuthorisation,
+	OBPBGConsentAuthorisationResult
+} from '$lib/obp/types';
 
 export async function load(event: RequestEvent) {
 	const consentId = event.url.searchParams.get('CONSENT_ID');
 
-
 	if (!consentId) {
 		return {
 			loadError: 'Missing required parameter: CONSENT_ID.',
 			consentId: '',
-			};
+			authorisationId: ''
+		};
+	}
+
+	const token = event.locals.session.data.oauth?.access_token;
+	if (!token) {
+		return {
+			loadError: 'No access token found in session.',
+			consentId,
+			authorisationId: ''
+		};
 	}
 
-	return { consentId };
+	try {
+		const startResponse: OBPBGStartConsentAuthorisation = await obp_requests.post(
+			`/berlin-group/v1.3/consents/${consentId}/authorisations`,
+			{ scaAuthenticationData: '' },
+			token
+		);
+
+		return { consentId, authorisationId: startResponse.authorisationId };
+	} catch (e) {
+		logger.error('Error starting BG consent authorisation:', e);
+		let errorMessage = 'Failed to start consent authorisation.';
+		if (e instanceof OBPRequestError) {
+			errorMessage = e.message;
+		}
+		return { loadError: errorMessage, consentId, authorisationId: '' };
+	}
 }
 
 export const actions = {
@@ -25,35 +52,34 @@ export const actions = {
 		const formData = await request.formData();
 		const otp = formData.get('otp') as string;
 		const consentId = formData.get('consentId') as string;
+		const authorisationId = formData.get('authorisationId') as string;
 
 		if (!otp) {
 			return { message: 'Please enter the OTP code.' };
 		}
 
+		if (!authorisationId) {
+			return { message: 'Missing authorisation id. Please reload the page.' };
+		}
+
 		const token = locals.session.data.oauth?.access_token;
 		if (!token) {
 			return { message: 'No access token found in session.' };
 		}
 
-		const defaultBankId = env.DEFAULT_BANK_ID;
-		if (!defaultBankId) {
-			logger.error('DEFAULT_BANK_ID environment variable is not set');
-			return { message: 'Server configuration error: DEFAULT_BANK_ID is not set.' };
-		}
-
 		try {
-			const response = await obp_requests.post(
-				`/obp/v3.1.0/banks/${defaultBankId}/consents/${consentId}/challenge`,
-				{ answer: otp },
+			const response: OBPBGConsentAuthorisationResult = await obp_requests.put(
+				`/berlin-group/v1.3/consents/${consentId}/authorisations/${authorisationId}`,
+				{ scaAuthenticationData: otp },
 				token
 			);
 
-			if (response.status === 'ACCEPTED' || response.status === 'VALID') {
+			if (response.scaStatus === 'valid') {
 				redirect(303, `/confirm-bg-consent-request-redirect-uri?CONSENT_ID=${consentId}`);
 			}
 
 			return {
-				message: `Challenge was not accepted. Status: ${response.status}`
+				message: `Challenge was not accepted. Status: ${response.scaStatus}`
 			};
 		} catch (e) {
 			if (isRedirect(e)) throw e;
diff --git a/apps/portal/src/routes/(protected)/confirm-bg-consent-request-sca/+page.svelte b/apps/portal/src/routes/(protected)/confirm-bg-consent-request-sca/+page.svelte
index 41d65eb9..2f999ee4 100644
--- a/apps/portal/src/routes/(protected)/confirm-bg-consent-request-sca/+page.svelte
+++ b/apps/portal/src/routes/(protected)/confirm-bg-consent-request-sca/+page.svelte
@@ -25,6 +25,7 @@
 
 			<form method="post" class="space-y-4">
 				<input type="hidden" name="consentId" value={data.consentId} />
+				<input type="hidden" name="authorisationId" value={data.authorisationId} />
 
 				<div>
 					<label

From 053ff866169fc004138ec46a6d6c355f312f05ae Mon Sep 17 00:00:00 2001
From: Hongwei <hongwei@tesobe.com>
Date: Wed, 22 Jul 2026 07:55:50 +0200
Subject: [PATCH 3/5] feat(portal): let the PSU pick accounts before
 authorising a UK consent

The UK consent approval page only showed Confirm/Deny with no account
selection, and the SCA page's POST .../authorise call omitted account_ids
entirely. OBP-API's authorise endpoint now requires account_ids and rejects
any account the PSU doesn't hold, so this call was failing with 400.

Fetch the PSU's own accounts at the consent's bank (GET /my/accounts,
filtered by bank_id) and let them check which ones the requested
permissions apply to. Carry the selection through the SCA redirect as a
comma-joined account_ids query param, then a hidden form field, and
include it in the final POST .../authorise body.
---
 .../uk-consent-request-sca/+page.server.ts    | 26 ++++++--
 .../uk-consent-request-sca/+page.svelte       |  1 +
 .../uk-consent-request/+page.server.ts        | 59 +++++++++++++++++--
 .../uk-consent-request/+page.svelte           | 46 ++++++++++++++-
 4 files changed, 121 insertions(+), 11 deletions(-)

diff --git a/apps/portal/src/routes/(protected)/uk-consent-request-sca/+page.server.ts b/apps/portal/src/routes/(protected)/uk-consent-request-sca/+page.server.ts
index f1b9b06d..090f4fbe 100644
--- a/apps/portal/src/routes/(protected)/uk-consent-request-sca/+page.server.ts
+++ b/apps/portal/src/routes/(protected)/uk-consent-request-sca/+page.server.ts
@@ -18,6 +18,9 @@ export async function load(event: RequestEvent) {
 	const bankId = event.url.searchParams.get('bank_id');
 	const challengeId = event.url.searchParams.get('challenge_id');
 	const requestedOidcReturnUrl = event.url.searchParams.get('oidc_return_url');
+	// The accounts the PSU selected on /uk-consent-request, carried through as a comma-joined
+	// query param -- OBP-API's authorise endpoint requires account_ids in the final POST body.
+	const accountIds = event.url.searchParams.get('account_ids') || '';
 
 	if (!consentId || !bankId || !challengeId) {
 		return {
@@ -25,13 +28,21 @@ export async function load(event: RequestEvent) {
 			consentId: consentId || '',
 			bankId: bankId || '',
 			challengeId: challengeId || '',
-			oidcReturnUrl: ''
+			oidcReturnUrl: '',
+			accountIds: ''
 		};
 	}
 
 	const token = event.locals.session.data.oauth?.access_token;
 	if (!token) {
-		return { loadError: 'Unauthorized: No access token found in session.', consentId, bankId, challengeId, oidcReturnUrl: '' };
+		return {
+			loadError: 'Unauthorized: No access token found in session.',
+			consentId,
+			bankId,
+			challengeId,
+			oidcReturnUrl: '',
+			accountIds: ''
+		};
 	}
 
 	const oidcReturnUrl =
@@ -42,7 +53,7 @@ export async function load(event: RequestEvent) {
 		logger.warn(`Rejected untrusted oidc_return_url: ${requestedOidcReturnUrl}`);
 	}
 
-	return { consentId, bankId, challengeId, oidcReturnUrl };
+	return { consentId, bankId, challengeId, oidcReturnUrl, accountIds };
 }
 
 export const actions = {
@@ -53,10 +64,17 @@ export const actions = {
 		const bankId = formData.get('bankId') as string;
 		const challengeId = formData.get('challengeId') as string;
 		const oidcReturnUrlRaw = formData.get('oidcReturnUrl') as string;
+		const accountIds = ((formData.get('accountIds') as string) || '')
+			.split(',')
+			.map((id) => id.trim())
+			.filter(Boolean);
 
 		if (!otp) {
 			return { message: 'Please enter the OTP code.' };
 		}
+		if (accountIds.length === 0) {
+			return { message: 'No accounts were selected for this consent. Please start over.' };
+		}
 
 		const token = locals.session.data.oauth?.access_token;
 		if (!token) {
@@ -76,7 +94,7 @@ export const actions = {
 			// the PSU only if the challenge answer is correct; a wrong answer leaves it unauthorised.
 			await obp_requests.post(
 				`/obp/v5.1.0/banks/${bankId}/consents/${consentId}/authorise`,
-				{ challenge_id: challengeId, answer: otp },
+				{ challenge_id: challengeId, answer: otp, account_ids: accountIds },
 				token
 			);
 		} catch (e) {
diff --git a/apps/portal/src/routes/(protected)/uk-consent-request-sca/+page.svelte b/apps/portal/src/routes/(protected)/uk-consent-request-sca/+page.svelte
index 9b7df79f..c14f472b 100644
--- a/apps/portal/src/routes/(protected)/uk-consent-request-sca/+page.svelte
+++ b/apps/portal/src/routes/(protected)/uk-consent-request-sca/+page.svelte
@@ -40,6 +40,7 @@
 			<input type="hidden" name="bankId" value={data.bankId} />
 			<input type="hidden" name="challengeId" value={data.challengeId} />
 			<input type="hidden" name="oidcReturnUrl" value={data.oidcReturnUrl} />
+			<input type="hidden" name="accountIds" value={data.accountIds} />
 
 			<button type="submit" class="btn preset-filled-primary-500 w-full">
 				Verify &amp; Authorise
diff --git a/apps/portal/src/routes/(protected)/uk-consent-request/+page.server.ts b/apps/portal/src/routes/(protected)/uk-consent-request/+page.server.ts
index 4038acbe..2620e03c 100644
--- a/apps/portal/src/routes/(protected)/uk-consent-request/+page.server.ts
+++ b/apps/portal/src/routes/(protected)/uk-consent-request/+page.server.ts
@@ -31,15 +31,33 @@ export async function load(event: RequestEvent) {
 	const requestedOidcReturnUrl = event.url.searchParams.get('oidc_return_url');
 
 	if (!consentId) {
-		return { loadError: 'Missing required parameter: CONSENT_ID.', consentId: '', bankId: bankId || '', apiStandard, oidcReturnUrl: '' };
+		return {
+			loadError: 'Missing required parameter: CONSENT_ID.',
+			consentId: '',
+			bankId: bankId || '',
+			apiStandard,
+			oidcReturnUrl: ''
+		};
 	}
 	if (!bankId) {
-		return { loadError: 'Missing required parameter: bank_id.', consentId, bankId: '', apiStandard, oidcReturnUrl: '' };
+		return {
+			loadError: 'Missing required parameter: bank_id.',
+			consentId,
+			bankId: '',
+			apiStandard,
+			oidcReturnUrl: ''
+		};
 	}
 
 	const token = event.locals.session.data.oauth?.access_token;
 	if (!token) {
-		return { loadError: 'Unauthorized: No access token found in session.', consentId, bankId, apiStandard, oidcReturnUrl: '' };
+		return {
+			loadError: 'Unauthorized: No access token found in session.',
+			consentId,
+			bankId,
+			apiStandard,
+			oidcReturnUrl: ''
+		};
 	}
 
 	// oidc_return_url must point back to a configured OIDC provider host — otherwise it becomes
@@ -69,7 +87,32 @@ export async function load(event: RequestEvent) {
 		logger.warn('Could not fetch UK consent details:', e);
 	}
 
-	return { consentId, bankId, apiStandard, oidcReturnUrl, status, permissions, expirationDateTime };
+	// The PSU must pick which of their own accounts this consent's permissions apply to --
+	// OBP-API only binds/grants access for accounts the authorising user actually holds
+	// (POST .../authorise requires account_ids, and rejects any account the PSU doesn't hold).
+	let userAccounts: { accountId: string; label: string }[] = [];
+	try {
+		const accountsResponse = await obp_requests.get('/obp/v6.0.0/my/accounts', token);
+		userAccounts = (accountsResponse.accounts || [])
+			.filter((account: any) => account.bank_id === bankId)
+			.map((account: any) => ({
+				accountId: account.id,
+				label: account.label || account.id
+			}));
+	} catch (e) {
+		logger.warn('Could not fetch user accounts:', e);
+	}
+
+	return {
+		consentId,
+		bankId,
+		apiStandard,
+		oidcReturnUrl,
+		status,
+		permissions,
+		expirationDateTime,
+		userAccounts
+	};
 }
 
 export const actions = {
@@ -78,6 +121,7 @@ export const actions = {
 		const consentId = formData.get('consentId') as string;
 		const bankId = formData.get('bankId') as string;
 		const oidcReturnUrlRaw = formData.get('oidcReturnUrl') as string;
+		const selectedAccountIds = formData.getAll('selectedAccountIds') as string[];
 
 		const token = locals.session.data.oauth?.access_token;
 		if (!token) {
@@ -94,6 +138,10 @@ export const actions = {
 			return { message: 'No valid return URL was provided to complete the flow.' };
 		}
 
+		if (selectedAccountIds.length === 0) {
+			return { message: 'Please select at least one account to grant access to.' };
+		}
+
 		let challengeId = '';
 		try {
 			// Start SCA: OBP-API issues a one-time challenge (OTP) to the PSU. The consent is only
@@ -117,7 +165,8 @@ export const actions = {
 			CONSENT_ID: consentId,
 			bank_id: bankId,
 			challenge_id: challengeId,
-			oidc_return_url: oidcReturnUrl
+			oidc_return_url: oidcReturnUrl,
+			account_ids: selectedAccountIds.join(',')
 		});
 		redirect(303, `/uk-consent-request-sca?${params.toString()}`);
 	},
diff --git a/apps/portal/src/routes/(protected)/uk-consent-request/+page.svelte b/apps/portal/src/routes/(protected)/uk-consent-request/+page.svelte
index 2f83c74b..a4354d64 100644
--- a/apps/portal/src/routes/(protected)/uk-consent-request/+page.svelte
+++ b/apps/portal/src/routes/(protected)/uk-consent-request/+page.svelte
@@ -74,13 +74,55 @@
 			{/if}
 		</div>
 
+		<!-- Account Selection -->
+		<div class="mb-6 rounded-lg bg-white p-6 shadow-md dark:bg-gray-800">
+			<h2 class="mb-4 text-lg font-semibold text-gray-900 dark:text-gray-100">
+				Select Accounts
+			</h2>
+			{#if data.userAccounts?.length}
+				<p class="mb-4 text-sm text-gray-700 dark:text-gray-300">
+					Choose which of your accounts the requested permissions apply to:
+				</p>
+				<div class="space-y-3" data-testid="uk-consent-account-list">
+					{#each data.userAccounts as account}
+						<label
+							class="flex cursor-pointer items-center gap-3 rounded-md border p-3 hover:bg-gray-50 dark:border-gray-600 dark:hover:bg-gray-700"
+						>
+							<input
+								type="checkbox"
+								name="selectedAccountIds"
+								form="confirmForm"
+								value={account.accountId}
+								class="checkbox"
+								data-testid="uk-consent-account-checkbox"
+							/>
+							<div>
+								<span class="font-medium text-gray-900 dark:text-gray-100">{account.label}</span>
+								<span class="ml-2 font-mono text-xs text-gray-500 dark:text-gray-400"
+									>{account.accountId}</span
+								>
+							</div>
+						</label>
+					{/each}
+				</div>
+			{:else}
+				<p class="text-error-500 text-sm" data-testid="uk-consent-no-accounts">
+					You have no accounts at this bank, so this consent cannot be authorised.
+				</p>
+			{/if}
+		</div>
+
 		<!-- Actions -->
 		<div class="flex gap-4">
-			<form method="post" action="?/confirm" class="flex-1">
+			<form method="post" action="?/confirm" id="confirmForm" class="flex-1">
 				<input type="hidden" name="consentId" value={data.consentId} />
 				<input type="hidden" name="bankId" value={data.bankId} />
 				<input type="hidden" name="oidcReturnUrl" value={data.oidcReturnUrl} />
-				<button type="submit" class="btn preset-filled-primary-500 w-full">
+				<button
+					type="submit"
+					class="btn preset-filled-primary-500 w-full"
+					disabled={!data.userAccounts?.length}
+				>
 					Confirm Consent
 				</button>
 			</form>

From 9f989a54994b608b907d1ff891dad8eecd7b5615 Mon Sep 17 00:00:00 2001
From: Hongwei <hongwei@tesobe.com>
Date: Wed, 22 Jul 2026 09:03:28 +0200
Subject: [PATCH 4/5] fix(portal): preserve query params in the UK consent form
 action URLs

SvelteKit's "?/actionName" shorthand replaces the page's entire query
string rather than appending to it. load() requires CONSENT_ID/bank_id
from the URL, so submitting a bare "?/confirm" or "?/deny" stripped them --
on any non-redirecting action response (e.g. a validation failure) load()
re-ran against the stripped URL and threw its own "Missing required
parameter" error, masking the action's real message.

Preserve the existing query string per SvelteKit's documented convention
for named actions on a page with search params.
---
 .../uk-consent-request/+page.svelte           | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/apps/portal/src/routes/(protected)/uk-consent-request/+page.svelte b/apps/portal/src/routes/(protected)/uk-consent-request/+page.svelte
index a4354d64..c22cfaf3 100644
--- a/apps/portal/src/routes/(protected)/uk-consent-request/+page.svelte
+++ b/apps/portal/src/routes/(protected)/uk-consent-request/+page.svelte
@@ -1,5 +1,20 @@
 <script lang="ts">
 	let { data, form } = $props();
+
+	// SvelteKit's `?/actionName` shorthand REPLACES the page's entire query string, not
+	// appends to it. Since load() requires CONSENT_ID/bank_id from the URL, submitting a
+	// bare "?/confirm" strips them -- on any non-redirecting action response (e.g. a
+	// validation failure) load() re-runs against the stripped URL and throws its own
+	// "Missing required parameter" error, masking the action's real message. Preserve the
+	// existing query string per SvelteKit's documented convention (append with "&").
+	let actionQuery = $derived(
+		new URLSearchParams({
+			CONSENT_ID: data.consentId,
+			bank_id: data.bankId,
+			api_standard: data.apiStandard,
+			oidc_return_url: data.oidcReturnUrl
+		}).toString()
+	);
 </script>
 
 <div class="mx-auto max-w-2xl p-8">
@@ -114,7 +129,7 @@
 
 		<!-- Actions -->
 		<div class="flex gap-4">
-			<form method="post" action="?/confirm" id="confirmForm" class="flex-1">
+			<form method="post" action="?{actionQuery}&/confirm" id="confirmForm" class="flex-1">
 				<input type="hidden" name="consentId" value={data.consentId} />
 				<input type="hidden" name="bankId" value={data.bankId} />
 				<input type="hidden" name="oidcReturnUrl" value={data.oidcReturnUrl} />
@@ -126,7 +141,7 @@
 					Confirm Consent
 				</button>
 			</form>
-			<form method="post" action="?/deny" class="flex-1">
+			<form method="post" action="?{actionQuery}&/deny" class="flex-1">
 				<input type="hidden" name="oidcReturnUrl" value={data.oidcReturnUrl} />
 				<button type="submit" class="btn preset-filled-error-500 w-full">
 					Deny

From b23d0229fa7d96d2a827d7a63fd45995072b926d Mon Sep 17 00:00:00 2001
From: Hongwei <hongwei@tesobe.com>
Date: Wed, 22 Jul 2026 09:17:28 +0200
Subject: [PATCH 5/5] fix: stop the login page's auto-refresh from racing the
 OAuth state cookie

When exactly one provider is available, +page.server.ts's load() normally
auto-redirects straight to /login/{provider}, which mints a fresh
obp_oauth_state cookie. This page only renders that single-provider case
when an error/success message is suppressing the redirect (e.g. a failed
login retry) -- and it still ran a 60-second invalidateAll() interval in
that state. If invalidateAll() raced a real click on the provider link,
the interval's response could overwrite the state cookie the click's own
request had just set, causing an intermittent "Security validation
failed" state mismatch on the callback.

Skip the refresh interval whenever only one provider is available, and
disable preload on the provider link so hovering/tapping it can't mint an
extra state cookie ahead of the real navigation.
---
 apps/portal/src/routes/login/+page.svelte | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/apps/portal/src/routes/login/+page.svelte b/apps/portal/src/routes/login/+page.svelte
index a2dcea42..b114e4ba 100644
--- a/apps/portal/src/routes/login/+page.svelte
+++ b/apps/portal/src/routes/login/+page.svelte
@@ -45,7 +45,19 @@
 
 
     onMount(() => {
-        // Auto-refresh every 60 seconds to show provider status changes
+        // Auto-refresh every 60 seconds to show provider status changes.
+        // Skipped whenever exactly one provider is available: that's precisely the
+        // condition +page.server.ts's load() uses to auto-redirect straight into
+        // `/login/{provider}` (which mints a fresh OAuth state cookie as a side
+        // effect). This page only renders with a single available provider when an
+        // error/success message is suppressing that auto-redirect (e.g. the user
+        // landed here after a failed login and is about to retry) — invalidateAll()
+        // racing a real click on the provider link here would silently overwrite the
+        // state cookie the click's own request just set, causing an intermittent
+        // "Security validation failed" state mismatch on the callback.
+        if (data.availableProviders.length === 1) {
+            return;
+        }
         refreshInterval = setInterval(() => {
             invalidateAll();
         }, 60000);
@@ -179,7 +191,7 @@
                 <p class="text-center text-sm text-gray-300">Choose your authentication provider:</p>
                 {#each data.availableProviders as provider}
                     <button type="button" class="btn preset-filled-primary-500 mx-auto w-full" data-testid="provider-{provider.provider}">
-                        <a href="/login/{provider.provider}" class="w-full flex items-center justify-between">
+                        <a href="/login/{provider.provider}" data-sveltekit-preload-data="off" class="w-full flex items-center justify-between">
                             <span class="flex items-center gap-2">
                                 <span class="text-green-400">●</span>
                                 {formatProviderName(provider.provider)}