Repository navigation
Stop treating an Auth outage as a successful local save - #171
Merged
Merged
Conversation
Signed-in writes asked the Auth server who the user was. When that call failed, the app stored the source only in the browser and showed success. The id already in the session is enough, and a missing user now fails the save instead of hiding it. Co-authored-by: Gáborjáni-Szabó Ádám <Programcode@users.noreply.github.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
Note 🎁 Summarized by CodeRabbit Free
Comment |
# Conflicts: # src/lib/stores/session-store.ts
Programcode
marked this pull request as ready for review
October 22, 2026 12:26
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A failed call to the Auth server was treated as "signed out." Saves then wrote only in this browser and the page still looked successful, so the work never reached the database.
I found this by re-reading the October security notes against current
mainand tracinggetUser()in the session, settings, debate, and sparring stores. There are no open GitHub issues. A 503 from/auth/v1/userused to skip the server write.The stores now use the user id the app already has, then the local session, when the Auth server does not answer. A write with no user id throws instead of pretending it saved. If adding a library source fails, the library shows a toast: "Could not save this source." (Spanish and Hungarian catalogs have the same key).
UI change for the preview: that new failure toast on the library page. Nothing else on the page layout changed.
Verified locally (GitHub Actions is out of minutes, so this is not a CI pass):
npx vitest runon the new session-save test plus settings migration, debate context, and debate gates (43 passed)npx eslinton the touched filesnpm run typechecknpm run docs:checkNot run:
npm run verify(the e2e smoke suite) and a click-through in the browser.