v1.4.7 - fix(auth): regular users stay signed in - opening the Library no longer signs every non-admin out and bounces them back to the login page
🩹 Hotfix
- Every non-admin account was signed out a second or two after opening the Library: a red "Session expired" message ("signed out after a period of inactivity") flashed and the login page came back. The login page returns you to where you were, so every later sign-in landed on the Library again and bounced again - for regular users it looked like signing in no longer worked. Admin accounts were never affected.
- Root cause: the Library and series pages loaded the admin naming patterns (used only by the admin Standardize / Rename tools) for everyone, and the admin settings refused a regular user with HTTP 401. Since v1.4.5 the app treats a 401 from its own API as a sign the session has ended (the fix for dead pages after a long idle, #204), so a plain permission refusal signed the user out. Inactivity had nothing to do with it.
- A 401 now only prompts a check: the app asks the server whether the session is still there, and signs out only when the server confirms it is gone (the cookie lapsed, or the inactivity limit was reached). A check that can't be answered never signs anyone out. A real expiry still sends you to the login page and back to the page you were on afterwards.
- The Library and series pages load the admin naming patterns for admins only.
- Admin-only actions now refuse a signed-in non-admin with 403 Forbidden instead of 401 (admin settings, trophy management, repack, health snooze, request status changes); 401 stays for requests with no session at all.
📦 Upgrading
Standard three-service compose: docker compose pull && docker compose down && docker compose up -d. No compose, environment, or schema changes. Regular users who were stuck can sign in normally as soon as the update is running.
🧪 Verification
- Tests first: a 401 while the server still holds the session no longer signs the user out (red → green); a real expiry (empty session or the inactivity flag) still does; a failed, 500 or non-JSON session check never does; a burst of 401s asks the server once; a refusal doesn't use up the page's one sign-out; the seven admin-only handlers answer a signed-in USER 403 and a missing session 401 (7 red → green). Mutation check: restoring "sign out on any 401" turns the guard tests red
- tsc clean, vitest 1511 passed / 2 skipped, eslint 0 errors, npm run build exit 0 - on this release and on dev with it merged in (1687 passed / 2 skipped)
- Live (lab, regular user): /library and a series page stay up with no admin-settings request; a leftover 401 makes one session check and the user stays; clearing the session server-side and making the next request still lands on /login with the return path; an admin's Library still loads the naming patterns