4 Commits

Include renames

Author	SHA1	Message	Date
lobo	d9a39dda22	feat(auth): use the cookie session and refresh on 401 ... The token is no longer stored; a tbp_session flag remembers the login. apiFetch renews the session once on a 401 and sends the request again. Parallel requests and other tabs share one refresh, because Auth revokes the session when a refresh token is used twice. Only a 401 from the refresh ends the session; a 502 or no network shows the normal error.	2026-09-25 13:45:08 +02:00
lobo	5ff8d48c53	refactor(auth): send login token through apiFetch ... All authenticated calls now use apiFetch, and only utils/auth.js touches the stored token. The cookie login can then change these two files instead of every page.	2026-09-25 11:29:14 +02:00
lobo	d4c0f8d8f3	feat(auth): tell the user when the session expired ... Every 401 from Auth or Core now goes through useSessionExpired: the login page says the session expired and returns to the last page after login. App no longer removes a token that only the browser clock calls expired, so a backend 401 is the one signal. A 403 on the profile now shows an error instead.	2026-09-24 13:29:09 +02:00
lobo	8fa605aff0	feat(nav): add header navigation and show Steam ID on dashboard ... Header links to Dashboard, Library and Settings. The logo, the login page and the landing page lead logged-in users to the dashboard. Expired tokens are removed, and a 403 on the dashboard logs out. Remove the dev dummy token.	2026-09-24 08:57:03 +02:00