From c64f988ba233bd9e8d5479c3a4b131e3cc44eab3 Mon Sep 17 00:00:00 2001
From: Mike Teehan <mike.teehan@gmail.com>
Date: Thu, 30 Jul 2026 23:30:56 +0000
Subject: [PATCH] fix: dhcp auto-sync UI refresh, users.js null guard, and
 login toast escaping

---
 webui/static/pages/dhcp.js  | 1 +
 webui/static/pages/login.js | 5 +++--
 webui/static/pages/users.js | 5 ++---
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/webui/static/pages/dhcp.js b/webui/static/pages/dhcp.js
index 33edc57..64d57b9 100644
--- a/webui/static/pages/dhcp.js
+++ b/webui/static/pages/dhcp.js
@@ -213,6 +213,7 @@ export default definePage({
                             let msg = 'dnsmasq applied';
                             if (synced && synced.length) {
                                 msg += ' (auto-synced: ' + synced.join(', ') + ')';
+                                synced.forEach(s => modelFetch(s));
                             }
                             toast(msg, 'success');
                             modelFetch('dnsmasq');
diff --git a/webui/static/pages/login.js b/webui/static/pages/login.js
index 6ca3b9c..3f08dd4 100644
--- a/webui/static/pages/login.js
+++ b/webui/static/pages/login.js
@@ -16,6 +16,7 @@ import {
     handleLoginSuccess,
     webauthnSupported,
     startAuthentication,
+    esc,
 } from '/static/hoover/index.js';
 
 function LoginPage() {
@@ -89,7 +90,7 @@ async function doPasswordLogin() {
 
     if (res.ok) {
         handleLoginSuccess(res.data);
-        toast('Welcome, ' + username, 'success');
+        toast('Welcome, ' + esc(username), 'success');
     } else {
         errEl.textContent = res.error || 'Login failed';
     }
@@ -173,7 +174,7 @@ const passkeyClickHandler = async () => {
 
         if (finishRes.ok) {
             handleLoginSuccess(finishRes.data);
-            toast('Welcome, ' + username, 'success');
+            toast('Welcome, ' + esc(username), 'success');
         } else {
             errEl.textContent = finishRes.error || 'Passkey authentication failed';
         }
diff --git a/webui/static/pages/users.js b/webui/static/pages/users.js
index 20b07e0..ce09b7c 100644
--- a/webui/static/pages/users.js
+++ b/webui/static/pages/users.js
@@ -5,8 +5,7 @@
  * Requires auth: rw permission.
  */
 
-import { h, definePage, reactive } from '/static/hoover/index.js';
-import { html, PageHeader, Table, Badge, ConfirmDelete, Empty, Card, openModal, closeModal, formModal, apiFetch, toast, esc } from '/static/hoover/index.js';
+import { h, definePage, reactive, html, PageHeader, Table, Badge, ConfirmDelete, openModal, closeModal, formModal, apiFetch, toast, esc } from '/static/hoover/index.js';
 
 const BUILTIN_ADMIN = 'admin';
 
@@ -69,7 +68,7 @@ async function loadUsers(abortController) {
 }
 
 function permissionLevel(perms, subsystem) {
-    return perms[subsystem] || '—';
+    return perms?.[subsystem] || '—';
 }
 
 function openCreateUserModal() {