Changeset 0.37.14 (#226)

Co-authored-by: gobha <jasafpro@gmail.com>
Co-committed-by: gobha <jasafpro@gmail.com>

src/js/sw/sdk/auth.js

@@ -30,6 +30,7 @@ export function createAuth() {
     let _policies = {};
     let _refreshTimer = null;
     let _refreshPromise = null;
+    let _booting = false;
     let _restClient = null;
     let _emit = () => {};
 
@@ -69,6 +70,7 @@ export function createAuth() {
         _groups = [];
         _policies = {};
         localStorage.removeItem(_storageKey);
+        sessionStorage.removeItem('sw-chat-active');
         document.cookie = 'sb_token=; path=/; max-age=0';
         if (_refreshTimer) { clearTimeout(_refreshTimer); _refreshTimer = null; }
     }
@@ -194,11 +196,19 @@ export function createAuth() {
          */
         async boot() {
             _loadTokens();
-            if (!_refreshToken) return;
+            if (!_refreshToken) {
+                // No tokens in localStorage — clear any stale sb_token cookie
+                // so Go SSR middleware doesn't trust a leftover cookie.
+                document.cookie = 'sb_token=; path=/; max-age=0';
+                return;
+            }
 
             // Unknown token age — schedule refresh soon
             _scheduleRefresh(60);
 
+            // Suppress _on401Failure redirect during boot — boot handles 401 itself.
+            _booting = true;
+
             // Fetch permissions (validates the access token)
             try {
                 await _fetchPermissions();
@@ -215,6 +225,8 @@ export function createAuth() {
                     // Network error or other — keep tokens, user may be offline
                     console.warn('[sw.auth] Boot: permissions fetch failed (keeping tokens):', e.message);
                 }
+            } finally {
+                _booting = false;
             }
 
             if (_accessToken) {
@@ -233,8 +245,15 @@ export function createAuth() {
 
         _on401Failure() {
             _clearTokens();
+            // During boot(), auth.boot() handles 401 gracefully — don't redirect.
+            if (_booting) return;
+            // Already on login page — don't redirect (prevents blank-page reload loop
+            // when stale localStorage tokens trigger 401 during SDK boot on /login).
             const base = window.__BASE__ || '';
-            window.location.href = base + '/login';
+            const loginPath = base + '/login';
+            const here = window.location.pathname.replace(/\/+$/, '');
+            if (here === loginPath) return;
+            window.location.href = loginPath;
         },
 
         _setAuth(data) { _setAuth(data); },