John O'Keefe
aaf57a66a2
THE CLASS: the /api JWT middleware's TokenLookup is
"cookie:token,header:Authorization:Bearer" — the token cookie always
rides same-origin fetches, so a signed-in user never needs the
localStorage bearer. But a dozen call sites gated their fetch on
`localStorage.getItem("token")` and early-returned when absent. The
global 401 interceptor CLEARS that localStorage entry on any session
rotation/blip — after which every gated write silently did nothing:
theme changes reverted on reload (the reported "can no longer change
themes", on top of the interpolation bug d5dbaa48 fixed), chain-order
selects, collection deletion, Add-to-collection submits, filter
save/load/delete, conflict actions, linking actions, stats charts,
tag suggestions, device management, admin scanner actions — all dead
for perfectly authenticated cookie users.
Fix: storage.ts exports authHeaders() (bearer when present, cookie
carries otherwise) and every gate/header site now uses it — theme.ts,
collections.ts (htmx auth, doRemoveBook/doBulkRemove, setChainOrder),
bookPicker submit, filter_builder suggestions + match count,
collection-rules apply hook, bookshelf save/load/delete filter,
conflicts x4, linking x3, admin scanner actions + polls (requireToken
removed — its "Session expired" toast fired for cookie users too),
dashboard preferences/sections, custom-section-builder, header
scanner poll, stats x3, tag suggestions, profile delete-account
(which also wrongly redirected cookie users to /login), and
device-management x4. Reads keep their graceful-empty behavior; the
bearers still ride along when present.
Pinned: the knob-matrix theme spec now REMOVES localStorage.token and
asserts the theme PUT still fires (cookie-only) and the class flips —
the exact strand that started this.
Found by noticing the panel browser's Nord click switched the class
but produced no PUT: the persistence half was gated on a token the
401 interceptor had cleared.
43 lines
1.1 KiB
TypeScript
43 lines
1.1 KiB
TypeScript
import { Alpine } from "./alpine";
|
|
import { authHeaders, removeToken } from "./storage";
|
|
import { showToast } from "./toast";
|
|
|
|
async function confirmDeleteAccount(): Promise<void> {
|
|
if (
|
|
!confirm(
|
|
"Are you sure? All preferences and devices will be deleted. This action cannot be undone.",
|
|
)
|
|
) {
|
|
return;
|
|
}
|
|
|
|
// This page is SSR-gated — reaching this script means authed (the
|
|
// middleware would have redirected). A localStorage-token check
|
|
// wrongly bounced cookie-authed users to /login (2026-10-31).
|
|
|
|
try {
|
|
const response = await fetch("/api/auth/profile", {
|
|
method: "DELETE",
|
|
headers: authHeaders(),
|
|
});
|
|
|
|
if (response.ok) {
|
|
removeToken();
|
|
localStorage.removeItem("user");
|
|
window.location.href = "/login?deleted=true";
|
|
} else {
|
|
const error = await response.json();
|
|
showToast(error.error || "Failed to delete account", "error");
|
|
}
|
|
} catch (error) {
|
|
console.error("Failed to delete account", error);
|
|
showToast("Failed to delete account", "error");
|
|
}
|
|
}
|
|
|
|
export { confirmDeleteAccount };
|
|
|
|
Alpine.data("profile", () => ({
|
|
confirmDeleteAccount,
|
|
}));
|