From 1c8f15514cc2054b473caca56af25295654686c6 Mon Sep 17 00:00:00 2001 From: type-two Date: Fri, 26 Jun 2026 17:25:21 +1000 Subject: [PATCH] =?UTF-8?q?fix(auth):=20login=20loop=20=E2=80=94=20signin(?= =?UTF-8?q?)=20wiped=20the=20stored=20token=20with=20the=20empty=20token-b?= =?UTF-8?q?ox?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit After redirecting from /login with the token in localStorage, signin() read the (empty) #tok gate input and overwrote TOKEN with '', so /me 401'd → removeItem + bounce back to /login → loop. Now keeps the stored token when the box is empty. Co-Authored-By: Claude Opus 4.8 --- site/admin.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/site/admin.html b/site/admin.html index a6b5a9e..97b30d6 100644 --- a/site/admin.html +++ b/site/admin.html @@ -97,7 +97,7 @@ async function api(path){ const r = await fetch('/admin'+path, { headers: hdr() let ROLE = 'staff'; async function signin(){ - TOKEN = $('#tok') ? $('#tok').value.trim() : TOKEN; + TOKEN = ($('#tok') && $('#tok').value.trim()) || TOKEN; // keep the stored token if the box is empty let me; try { me = await api('/me'); } catch(e){ localStorage.removeItem('rg_token'); location.replace('/login'); return; } ROLE = me.role || 'staff'; localStorage.setItem('rg_token', TOKEN);