From b18e341aee365818a95bb9eea4ba5269618b15c0 Mon Sep 17 00:00:00 2001
From: Charles Graham <charles.r.graham@usace.army.mil>
Date: Thu, 30 Jul 2026 12:06:15 -0500
Subject: [PATCH] Prefer OpenID for Swagger login when available

Signed-off-by: Charles Graham <charles.r.graham@usace.army.mil>
---
 cda-gui/src/pages/swagger-ui/index.jsx | 28 +++++++++-----------------
 1 file changed, 10 insertions(+), 18 deletions(-)

diff --git a/cda-gui/src/pages/swagger-ui/index.jsx b/cda-gui/src/pages/swagger-ui/index.jsx
index 021162416..132429e8e 100644
--- a/cda-gui/src/pages/swagger-ui/index.jsx
+++ b/cda-gui/src/pages/swagger-ui/index.jsx
@@ -40,18 +40,6 @@ function isLocalOrigin(url) {
   return isLoopbackHost(new URL(url).hostname);
 }
 
-async function isCwmsLoginAvailable() {
-  try {
-    const response = await fetch(`${window.location.origin}/CWMSLogin`, {
-      cache: "no-store",
-      redirect: "manual",
-    });
-    return response.type === "opaqueredirect" || response.status < 400;
-  } catch {
-    return false;
-  }
-}
-
 function getKeycloakConfig(spec) {
   const scheme = getOpenIdConnectScheme(spec);
   if (!scheme?.openIdConnectUrl) {
@@ -178,18 +166,22 @@ export default function SwaggerUI() {
       }
       normalizeOpenIdConnectUrls(spec);
       const keycloakConfig = getKeycloakConfig(spec);
-      const hasCwmsLogin = getCwmsLoginScheme(spec) && (await isCwmsLoginAvailable());
-      const nextCustomAuthType = hasCwmsLogin
-        ? "cwms"
-        : keycloakConfig
-          ? "openid"
+      const hasCwmsLogin = Boolean(getCwmsLoginScheme(spec));
+      // Some non-T7 deployments advertise CwmsAAACacAuth even though their
+      // /CWMSLogin route is only a generic landing page. Prefer a usable
+      // OpenID configuration when both schemes are present; T7 deployments
+      // that advertise only CWMS AAA still use the shared CWMS session flow.
+      const nextCustomAuthType = keycloakConfig
+        ? "openid"
+        : hasCwmsLogin
+          ? "cwms"
           : null;
 
       if (customAuthType !== nextCustomAuthType) {
         setCustomAuthType(nextCustomAuthType);
       }
 
-      if (hasCwmsLogin) {
+      if (nextCustomAuthType === "cwms") {
         setAuthUiMode("cwms-login");
       } else if (nextCustomAuthType === "openid" && keycloakConfig) {
         const keycloakConfigSignature = JSON.stringify(keycloakConfig);