e4edd34e3c* studio/frontend: reconcile stale must_change_password localStorage flag The client OR's a localStorage flag against /api/auth/status everywhere it gates change-password routing, but never clears the flag when the server flips requires_password_change back to false. A user whose default admin password was already rotated (change-password from another browser, the CLI reset-password command, or a recreated auth DB) keeps that flag, so: 1. requirePasswordChangeFlow lets them sit on the change-password route. 2. Back to login bounces via requireGuest, hasActiveSession (which only checks key presence, not validity), then getPostAuthRoute, which sends the user back because the flag is still set. End result: the user is pinned on change-password and cannot escape without clearing localStorage by hand. Fix the three places that compare server status to the flag: - auth-guards.ts fetchAuthStatus: clear the local flag whenever the server reports requires_password_change = false. - auth-guards.ts requireGuest: call fetchAuthStatus before routing so a stale flag cannot decide getPostAuthRoute. - auth-form.tsx initializeAuthForm: same reconcile inside the page so the change-password page redirects to login as soon as it loads when the server no longer requires a change. - api.ts redirectToAuth: same reconcile in the fetch wrapper's auth redirect. After the reconcile the redundant mustChangePassword() OR clauses are no longer load bearing for the change-password gates; the server's fetchAuthStatus is now the single source of truth. * shorter comments around auth-status reconcile * studio/auth: make localStorage reconcile bidirectional |
||
|---|---|---|
| .. | ||
| backend | ||
| frontend | ||
| src-tauri | ||
| __init__.py | ||
| install_llama_prebuilt.py | ||
| install_python_stack.py | ||
| LICENSE.AGPL-3.0 | ||
| setup.bat | ||
| setup.ps1 | ||
| setup.sh | ||
| Unsloth_Studio_Colab.ipynb | ||