danvics/pediatric-ai-scribe-v3
1
0
Fork 0
Code Issues Pull requests Projects Releases 14 Packages Wiki Activity Actions

Fix: local-auth users lose Password/2FA/Sessions after refresh

Browse source 
Previous check was strict (canLocalAuth !== true → hide). On a
transient /me hiccup or when the boot cache lagged, a legit local
user saw empty Settings with none of the sections they should see.

Inverted the predicate: hide only when canLocalAuth === false
(explicit SSO-only signal from the server). Undefined/missing now
defaults to show — local-auth users never lose their own UI.
Still hides correctly for the documented SSO-only case because the
/me endpoint sets the flag to false explicitly for those users.
This commit is contained in:
Daniel 2026-04-14 05:32:30 +02:00
parent 5b0c296a88
commit 2f3e608c88
1 changed files with 6 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
public/js/auth.js
View file

@ -745,16 +745,15 @@ document.addEventListener('DOMContentLoaded', function() {
}
// Keep cache in sync
window.CURRENT_USER = data.user;
// Sections are display:none by default in the HTML. Reveal them only
// for users with a real password hash (canLocalAuth === true).
// SSO-only users never see password change, 2FA, or session
// management — session revoke can't stick against an active IdP
// session, so showing it would be misleading.
// Sections are display:none by default. Show them unless the server
// explicitly marks this user as SSO-only (canLocalAuth === false).
// Missing/undefined flag defaults to showing — safer than hiding a
// legit local user's sections due to a transient fetch hiccup.
var pwSection = document.getElementById('change-password-section');
var twofaSection = document.getElementById('2fa-section');
var sessionsSection = document.getElementById('sessions-section');
if (data.user.canLocalAuth !== true) {
return;
if (data.user.canLocalAuth === false) {
return; // SSO-only — keep sections hidden
}
if (pwSection) pwSection.style.display = '';
if (twofaSection) twofaSection.style.display = '';