From 2f3e608c889be219516395aa039d61851af4e554 Mon Sep 17 00:00:00 2001 From: Daniel Date: Tue, 14 Apr 2026 05:32:30 +0200 Subject: [PATCH] Fix: local-auth users lose Password/2FA/Sessions after refresh MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Previous check was strict (canLocalAuth !== true → hide). On a transient /me hiccup or when the boot cache lagged, a legit local user saw empty Settings with none of the sections they should see. Inverted the predicate: hide only when canLocalAuth === false (explicit SSO-only signal from the server). Undefined/missing now defaults to show — local-auth users never lose their own UI. Still hides correctly for the documented SSO-only case because the /me endpoint sets the flag to false explicitly for those users. --- public/js/auth.js | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/public/js/auth.js b/public/js/auth.js index c3d1ab3..a218169 100644 --- a/public/js/auth.js +++ b/public/js/auth.js @@ -745,16 +745,15 @@ document.addEventListener('DOMContentLoaded', function() { } // Keep cache in sync window.CURRENT_USER = data.user; - // Sections are display:none by default in the HTML. Reveal them only - // for users with a real password hash (canLocalAuth === true). - // SSO-only users never see password change, 2FA, or session - // management — session revoke can't stick against an active IdP - // session, so showing it would be misleading. + // Sections are display:none by default. Show them unless the server + // explicitly marks this user as SSO-only (canLocalAuth === false). + // Missing/undefined flag defaults to showing — safer than hiding a + // legit local user's sections due to a transient fetch hiccup. var pwSection = document.getElementById('change-password-section'); var twofaSection = document.getElementById('2fa-section'); var sessionsSection = document.getElementById('sessions-section'); - if (data.user.canLocalAuth !== true) { - return; + if (data.user.canLocalAuth === false) { + return; // SSO-only — keep sections hidden } if (pwSection) pwSection.style.display = ''; if (twofaSection) twofaSection.style.display = '';