John O'Keefe
aaf57a66a2
THE CLASS: the /api JWT middleware's TokenLookup is
"cookie:token,header:Authorization:Bearer" — the token cookie always
rides same-origin fetches, so a signed-in user never needs the
localStorage bearer. But a dozen call sites gated their fetch on
`localStorage.getItem("token")` and early-returned when absent. The
global 401 interceptor CLEARS that localStorage entry on any session
rotation/blip — after which every gated write silently did nothing:
theme changes reverted on reload (the reported "can no longer change
themes", on top of the interpolation bug d5dbaa48 fixed), chain-order
selects, collection deletion, Add-to-collection submits, filter
save/load/delete, conflict actions, linking actions, stats charts,
tag suggestions, device management, admin scanner actions — all dead
for perfectly authenticated cookie users.
Fix: storage.ts exports authHeaders() (bearer when present, cookie
carries otherwise) and every gate/header site now uses it — theme.ts,
collections.ts (htmx auth, doRemoveBook/doBulkRemove, setChainOrder),
bookPicker submit, filter_builder suggestions + match count,
collection-rules apply hook, bookshelf save/load/delete filter,
conflicts x4, linking x3, admin scanner actions + polls (requireToken
removed — its "Session expired" toast fired for cookie users too),
dashboard preferences/sections, custom-section-builder, header
scanner poll, stats x3, tag suggestions, profile delete-account
(which also wrongly redirected cookie users to /login), and
device-management x4. Reads keep their graceful-empty behavior; the
bearers still ride along when present.
Pinned: the knob-matrix theme spec now REMOVES localStorage.token and
asserts the theme PUT still fires (cookie-only) and the class flips —
the exact strand that started this.
Found by noticing the panel browser's Nord click switched the class
but produced no PUT: the persistence half was gated on a token the
401 interceptor had cleared.
79 lines
2.0 KiB
TypeScript
79 lines
2.0 KiB
TypeScript
const ALL_LIBRARIES = "__all__";
|
|
|
|
function getToken(): string | null {
|
|
return localStorage.getItem("token");
|
|
}
|
|
|
|
function setToken(token: string): void {
|
|
localStorage.setItem("token", token);
|
|
}
|
|
|
|
function removeToken(): void {
|
|
localStorage.removeItem("token");
|
|
}
|
|
|
|
function getRefreshToken(): string | null {
|
|
return localStorage.getItem("refresh_token");
|
|
}
|
|
|
|
function setRefreshToken(token: string): void {
|
|
localStorage.setItem("refresh_token", token);
|
|
}
|
|
|
|
function removeRefreshToken(): void {
|
|
localStorage.removeItem("refresh_token");
|
|
}
|
|
|
|
function getTheme(): string {
|
|
return localStorage.getItem("theme") || "tokyo-night";
|
|
}
|
|
|
|
function setTheme(theme: string): void {
|
|
localStorage.setItem("theme", theme);
|
|
}
|
|
|
|
function getSelectedLibrary(): string {
|
|
const stored = localStorage.getItem("selectedLibrary");
|
|
if (stored === ALL_LIBRARIES) return "";
|
|
if (stored) return stored;
|
|
return "";
|
|
}
|
|
|
|
// Headers for same-origin /api fetches: the localStorage bearer when
|
|
// present, otherwise nothing — the token COOKIE (always sent on
|
|
// same-origin requests) carries auth, since the middleware's
|
|
// TokenLookup checks cookie:token before the header. NEVER gate a
|
|
// call on the bearer's presence: the global 401 interceptor clears
|
|
// localStorage, and token-gated calls then strand every click that
|
|
// should persist ("can no longer change themes", 2026-10-31).
|
|
function authHeaders(): Record<string, string> {
|
|
const token = localStorage.getItem("token");
|
|
return token ? { Authorization: `Bearer ${token}` } : {};
|
|
}
|
|
|
|
function setSelectedLibrary(libraryId: string): void {
|
|
const value = libraryId === "" ? ALL_LIBRARIES : libraryId;
|
|
localStorage.setItem("selectedLibrary", value);
|
|
document.cookie = `selectedLibrary=${encodeURIComponent(value)};path=/;max-age=${365 * 24 * 60 * 60};samesite=lax`;
|
|
}
|
|
|
|
function clearAll(): void {
|
|
localStorage.clear();
|
|
}
|
|
|
|
export {
|
|
ALL_LIBRARIES,
|
|
authHeaders,
|
|
clearAll,
|
|
getRefreshToken,
|
|
getSelectedLibrary,
|
|
getTheme,
|
|
getToken,
|
|
removeRefreshToken,
|
|
removeToken,
|
|
setRefreshToken,
|
|
setSelectedLibrary,
|
|
setTheme,
|
|
setToken,
|
|
};
|