danvics/pediatric-ai-scribe-v3
1
0
Fork 0
Code Issues Pull requests Projects Releases 16 Packages Wiki Activity Actions

Fix: local-auth users lose Password/2FA/Sessions after refresh

Browse source 
Previous check was strict (canLocalAuth !== true → hide). On a
transient /me hiccup or when the boot cache lagged, a legit local
user saw empty Settings with none of the sections they should see.

Inverted the predicate: hide only when canLocalAuth === false
(explicit SSO-only signal from the server). Undefined/missing now
defaults to show — local-auth users never lose their own UI.
Still hides correctly for the documented SSO-only case because the
/me endpoint sets the flag to false explicitly for those users.
This commit is contained in:
Daniel 2026-04-14 05:32:30 +02:00
parent 6c7d687dd0
commit 3df137d93f
1 changed files with 6 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
public/js/auth.js
View file

@ -745,16 +745,15 @@ document.addEventListener('DOMContentLoaded', function() {
} }
// Keep cache in sync // Keep cache in sync
window.CURRENT_USER = data.user; window.CURRENT_USER = data.user;
// Sections are display:none by default in the HTML. Reveal them only // Sections are display:none by default. Show them unless the server
// for users with a real password hash (canLocalAuth === true). // explicitly marks this user as SSO-only (canLocalAuth === false).
// SSO-only users never see password change, 2FA, or session // Missing/undefined flag defaults to showing — safer than hiding a
// management — session revoke can't stick against an active IdP // legit local user's sections due to a transient fetch hiccup.
// session, so showing it would be misleading.
var pwSection = document.getElementById('change-password-section'); var pwSection = document.getElementById('change-password-section');
var twofaSection = document.getElementById('2fa-section'); var twofaSection = document.getElementById('2fa-section');
var sessionsSection = document.getElementById('sessions-section'); var sessionsSection = document.getElementById('sessions-section');
if (data.user.canLocalAuth !== true) { if (data.user.canLocalAuth === false) {
return; return; // SSO-only — keep sections hidden
} }
if (pwSection) pwSection.style.display = ''; if (pwSection) pwSection.style.display = '';
if (twofaSection) twofaSection.style.display = ''; if (twofaSection) twofaSection.style.display = '';