fix(centralui): SessionExpiry skips redirect after dispose (review 2026-10-21 07/C-3)

src/ZB.MOM.WW.ScadaBridge.CentralUI/Components/Shared/SessionExpiry.razor

@@ -87,7 +87,11 @@
 
         if (status == Unauthorized)
         {
-            await InvokeAsync(() => Navigation.NavigateTo("/login", forceLoad: true));
+            // Dispose cancels the CTS but cannot cancel an in-flight ping; skip the redirect
+            // (and swallow a racing disposal) so the fire-and-forget poll task never faults.
+            if (_cts is { IsCancellationRequested: true }) return;
+            try { await InvokeAsync(() => Navigation.NavigateTo("/login", forceLoad: true)); }
+            catch (ObjectDisposedException) { }
         }
     }
 

tests/ZB.MOM.WW.ScadaBridge.CentralUI.Tests/Auth/SessionExpiryComponentTests.cs

@@ -37,6 +37,25 @@ public class SessionExpiryComponentTests : BunitContext
         Assert.EndsWith("/login", nav.Uri);
     }
 
+    /// <summary>Verifies a 401 landing after disposal neither redirects nor throws (review 2026-10-21 07/C-3).</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    [Fact]
+    public async Task CheckSession_ExpiredAfterDispose_DoesNotRedirectOrThrow()
+    {
+        var module = JSInterop.SetupModule(ModulePath);
+        module.Setup<int>("ping", "/auth/ping").SetResult(401);
+
+        var nav = Services.GetRequiredService<NavigationManager>();
+        var before = nav.Uri;
+        var cut = Render<SessionExpiry>();
+        var instance = cut.Instance;
+        await cut.InvokeAsync(() => ((IDisposable)instance).Dispose());
+
+        await instance.CheckSessionAsync();
+
+        Assert.Equal(before, nav.Uri);
+    }
+
     /// <summary>Verifies that a live session does not redirect.</summary>
     /// <returns>A task that represents the asynchronous operation.</returns>
     [Fact]