Skip to content

fix(auth): Keep a refused read of the current user from ending the session - #102

Merged
nfebe merged 1 commit into
mainfrom
fix/users-me-session-logout
Aug 14, 2026
Merged

fix(auth): Keep a refused read of the current user from ending the session#102
nfebe merged 1 commit into
mainfrom
fix/users-me-session-logout

Conversation

@nfebe

@nfebe nfebe commented Aug 14, 2026

Copy link
Copy Markdown
Contributor

Signing in with a legacy API key bounced straight back to the login screen: the agent refuses the current-user read for an actor with no user record, and the panel could not tell that from a dead session. Held outside the session check until flatrun/agent#208 ships.

…ssion

Signing in with a legacy API key bounced the operator straight back to the
login screen. The agent refuses the current-user read for an authenticated
actor that has no user record, and the panel could not tell that from a
session that had ended, so it discarded the token.

The read now sits outside the session check, so its answer cannot end the
session. A session already known dead still stops it. Removable once
flatrun/agent#208 is in a release.
@cloudflare-workers-and-pages

Copy link
Copy Markdown

Deploying flatrun-ui with  Cloudflare Pages  Cloudflare Pages

Latest commit: 23522bd
Status: ✅  Deploy successful!
Preview URL: https://131dc039.flatrun-ui.pages.dev
Branch Preview URL: https://fix-users-me-session-logout.flatrun-ui.pages.dev

View logs

@sourceant

sourceant Bot commented Aug 14, 2026

Copy link
Copy Markdown

Code Review Summary

This PR addresses a UX bug where users with legacy API keys (who lack a user record in the agent) were being immediately logged out upon signing in. This was caused by the /users/me endpoint returning a 401 error, which the frontend incorrectly interpreted as a signal that the entire session was invalid. The fix allows /users/me to be handled outside the global session gate.

🚀 Key Improvements

  • Bypassing the session gate for /users/me in src/services/api.ts prevents unnecessary session termination for actors without user records.
  • Refactoring the request interceptor in src/services/api.ts to check sessionRejected before incrementing the inFlight request counter avoids a potential state leak where the counter could become permanently out of sync.
  • Introduction of a regression test in src/services/api.test.ts to verify that a refused current-user read does not impact other concurrent requests.

@sourceant sourceant Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review complete. No specific code suggestions were generated. See the overview comment for a summary.

@nfebe
nfebe merged commit 06445da into main Aug 14, 2026
5 checks passed
@nfebe
nfebe deleted the fix/users-me-session-logout branch August 14, 2026 23:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant