From c4a10c712978a02de25c605a315a70ffdeff27eb Mon Sep 17 00:00:00 2001
From: Mike Teehan <mike.teehan@gmail.com>
Date: Tue, 28 Jul 2026 02:16:24 +0000
Subject: [PATCH] refactor: switch auth data from localStorage to
 sessionStorage

Aligns user and permissions storage with the existing sessionStorage-based
token model. Eliminates the dual-write pattern and stale cross-session data.
---
 webui/static/app.js                    | 2 +-
 webui/static/hoover/api.js             | 3 +--
 webui/static/hoover/components/auth.js | 7 +++----
 webui/static/pages/passkeys.js         | 2 +-
 webui/static/pages/users.js            | 4 ++--
 5 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/webui/static/app.js b/webui/static/app.js
index e423724..88bd032 100644
--- a/webui/static/app.js
+++ b/webui/static/app.js
@@ -33,7 +33,7 @@ const _NavBase = [
 
 function getNav() {
     const nav = [..._NavBase];
-    const perms = JSON.parse(localStorage.getItem('vw:permissions') || 'null');
+    const perms = JSON.parse(sessionStorage.getItem('vw:permissions') || 'null');
     if (perms && perms.auth === 'rw') {
         nav.push({ path: '/users', label: 'Users' });
     }
diff --git a/webui/static/hoover/api.js b/webui/static/hoover/api.js
index 7c7efa7..ab88e80 100644
--- a/webui/static/hoover/api.js
+++ b/webui/static/hoover/api.js
@@ -47,7 +47,7 @@ function clearAuthTokens() {
     sessionStorage.removeItem('vw:access_ttl');
     sessionStorage.removeItem('vw:session_id');
     sessionStorage.removeItem('vw:user');
-    localStorage.removeItem('vw:user');
+    sessionStorage.removeItem('vw:user');
     if (typeof window.__authRefreshTimer__ !== 'undefined') {
         clearTimeout(window.__authRefreshTimer__);
         window.__authRefreshTimer__ = undefined;
@@ -112,7 +112,6 @@ async function tryRefreshToken() {
             }
             if (json.data.user) {
                 sessionStorage.setItem('vw:user', JSON.stringify(json.data.user));
-                localStorage.setItem('vw:user', JSON.stringify(json.data.user));
             }
             return true;
         } catch {
diff --git a/webui/static/hoover/components/auth.js b/webui/static/hoover/components/auth.js
index 9538cf8..703d63c 100644
--- a/webui/static/hoover/components/auth.js
+++ b/webui/static/hoover/components/auth.js
@@ -46,10 +46,9 @@ export async function checkSession() {
     if (result.ok) {
         const { user, permissions } = result.data || {};
         if (user) {
-            localStorage.setItem('vw:user', JSON.stringify(user));
             sessionStorage.setItem('vw:user', JSON.stringify(user));
             if (permissions) {
-                localStorage.setItem('vw:permissions', JSON.stringify(permissions));
+                sessionStorage.setItem('vw:permissions', JSON.stringify(permissions));
             }
             return true;
         }
@@ -125,9 +124,9 @@ export function handleLoginSuccess(data, redirectPath = '/dashboard') {
             sessionStorage.setItem('vw:session_id', tokens.session_id);
         }
         if (user) {
-            localStorage.setItem('vw:user', JSON.stringify(user));
+            sessionStorage.setItem('vw:user', JSON.stringify(user));
             if (permissions) {
-                localStorage.setItem('vw:permissions', JSON.stringify(permissions));
+                sessionStorage.setItem('vw:permissions', JSON.stringify(permissions));
             }
         }
         scheduleTokenRefresh();
diff --git a/webui/static/pages/passkeys.js b/webui/static/pages/passkeys.js
index 7a795cf..f7701e5 100644
--- a/webui/static/pages/passkeys.js
+++ b/webui/static/pages/passkeys.js
@@ -92,7 +92,7 @@ function addCredentialModal() {
                         setModalProcessing(true);
                         refreshModals();
 
-                        const user = JSON.parse(localStorage.getItem('vw:user') || 'null');
+                        const user = JSON.parse(sessionStorage.getItem('vw:user') || 'null');
                         const username = user?.username || '';
                         if (!username) {
                             toast('Username not available', 'error');
diff --git a/webui/static/pages/users.js b/webui/static/pages/users.js
index b3df558..3af323c 100644
--- a/webui/static/pages/users.js
+++ b/webui/static/pages/users.js
@@ -21,12 +21,12 @@ const SUBSYSTEMS = [
 ];
 
 function currentUser() {
-    const u = JSON.parse(localStorage.getItem('vw:user') || 'null');
+    const u = JSON.parse(sessionStorage.getItem('vw:user') || 'null');
     return u ? u.username : '';
 }
 
 function hasAuthAdmin() {
-    const perms = JSON.parse(localStorage.getItem('vw:permissions') || 'null');
+    const perms = JSON.parse(sessionStorage.getItem('vw:permissions') || 'null');
     return perms && perms.auth === 'rw';
 }