fix(auth) don't treat a rejected login as an expired session #38

Merged

araemer merged 1 commit from fix-login-401-session-expired into stage

2026-09-26 06:24:25 +00:00

araemer commented

2026-09-26 06:15:17 +00:00

Owner

Problem

A failed password login showed "Deine Sitzung ist abgelaufen. Bitte melde dich erneut an." above the correct "Login fehlgeschlagen!" message, and fired a pointless POST /auth/refresh.

apiClient treated every 401 as an expired session: refresh → clear session → SESSION_EXPIRED_EVENT → redirect to /login?reason=session_expired. For /auth/login a 401 just means wrong credentials.

Fix

apiClient.post takes an optional ApiRequestConfig. With isCredentialExchange: true, a 401 skips the refresh/expiry flow and is thrown as a plain ApiError, which the login page already handles.
Set on POST /auth/login and POST /passkey/authenticate/complete. All other requests behave as before.

Verification

npm run build, npm run lint (2 existing warnings in an untouched file), npm run test (187 passed)
In the browser (Playwright MCP): a wrong password gives a 401 and shows only "Login fehlgeschlagen…", with no refresh call and the URL staying /login. A correct login still lands on /recipe/list.

🤖 Generated with Claude Code

## Problem A failed password login showed **"Deine Sitzung ist abgelaufen. Bitte melde dich erneut an."** above the correct "Login fehlgeschlagen!" message, and fired a pointless `POST /auth/refresh`. `apiClient` treated every 401 as an expired session: refresh → clear session → `SESSION_EXPIRED_EVENT` → redirect to `/login?reason=session_expired`. For `/auth/login` a 401 just means wrong credentials. ## Fix - `apiClient.post` takes an optional `ApiRequestConfig`. With `isCredentialExchange: true`, a 401 skips the refresh/expiry flow and is thrown as a plain `ApiError`, which the login page already handles. - Set on `POST /auth/login` and `POST /passkey/authenticate/complete`. All other requests behave as before. ## Verification - `npm run build`, `npm run lint` (2 existing warnings in an untouched file), `npm run test` (187 passed) - In the browser (Playwright MCP): a wrong password gives a 401 and shows only "Login fehlgeschlagen…", with no refresh call and the URL staying `/login`. A correct login still lands on `/recipe/list`. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

araemer added 1 commit

2026-09-26 06:15:17 +00:00

fix(auth) don't treat a rejected login as an expired session

/ test (pull_request) Successful in 46s

Details

aff49ac5b3

A 401 from POST /auth/login (or passkey authenticate/complete) means wrong
credentials, but apiClient handled it like any other 401: it tried a token
refresh, cleared the session and fired SESSION_EXPIRED_EVENT, so the login
page showed "Deine Sitzung ist abgelaufen" above "Login fehlgeschlagen".

apiClient.post now accepts an optional ApiRequestConfig; with
isCredentialExchange set, a 401 skips the refresh/expiry flow and is thrown
as a plain ApiError for the caller to handle.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

araemer merged commit a27a8ec17c into stage

2026-09-26 06:24:25 +00:00

araemer referenced this pull request from a commit

2026-09-26 06:24:26 +00:00

Merge pull request 'fix(auth) don't treat a rejected login as an expired session' (#38) from fix-login-401-session-expired into stage

araemer referenced this pull request

2026-10-25 07:17:26 +00:00

WIP: fix(shopping-list) keep item reasons and ticks of deleted users, shown as "Unbekannt" #65