4 Commits

Include renames

Author	SHA1	Message	Date
lobo	2a22789435	test: data router, one render helper, fetchRoutes in every test	2026-09-29 16:15:50 +02:00
lobo	afe00ceae9	feat(admin): add the admin users page and view as	2026-09-27 12:18:10 +02:00
lobo	d9a39dda22	feat(auth): use the cookie session and refresh on 401 ... The token is no longer stored; a tbp_session flag remembers the login. apiFetch renews the session once on a 401 and sends the request again. Parallel requests and other tabs share one refresh, because Auth revokes the session when a refresh token is used twice. Only a 401 from the refresh ends the session; a 502 or no network shows the normal error.	2026-09-25 13:45:08 +02:00
lobo	d4c0f8d8f3	feat(auth): tell the user when the session expired ... Every 401 from Auth or Core now goes through useSessionExpired: the login page says the session expired and returns to the last page after login. App no longer removes a token that only the browser clock calls expired, so a backend 401 is the one signal. A 403 on the profile now shows an error instead.	2026-09-24 13:29:09 +02:00