From 572172c424656d16be8090ac6bd46260fac3a574 Mon Sep 17 00:00:00 2001
From: Scarriffle <admin@scarriffle.com>
Date: Mon, 6 Jul 2026 21:22:33 +0200
Subject: [PATCH] fix(web): stay logged in when app initialisation fails after
 reload
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

boot() ran token validation and launchApp() inside the SAME try/catch, so ANY
error during app init (a failed calendar/event fetch, a render error) cleared
the token and bounced a validly-authenticated user to the login screen — the
"logged out on every F5" bug. Now /auth/me validates the token alone; launchApp()
runs outside that catch, so a data/render error can no longer log the user out.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 frontend/js/app.js | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/frontend/js/app.js b/frontend/js/app.js
index eda0fdc..5b1f26c 100644
--- a/frontend/js/app.js
+++ b/frontend/js/app.js
@@ -23,14 +23,23 @@ async function boot() {
   // Check if already logged in
   const token = localStorage.getItem('token');
   if (token) {
+    let authed = false;
     try {
-      await api.get('/auth/me'); // validate token
-      await launchApp();
-      return;
+      await api.get('/auth/me'); // validate the TOKEN only
+      authed = true;
     } catch (_) {
+      // The token is genuinely invalid/expired — clear it and show login.
       localStorage.removeItem('token');
       localStorage.removeItem('user');
     }
+    if (authed) {
+      // Token is valid → stay logged in. launchApp() runs OUTSIDE the auth
+      // try/catch on purpose: a later data/render error inside app init must
+      // never bounce a validly-authenticated user back to the login screen
+      // (that was the "logged out on every reload" bug).
+      await launchApp();
+      return;
+    }
   }
 
   showScreen('login');