From d52a0fad12194e86a1e273b7bd0b49408cab2397 Mon Sep 17 00:00:00 2001
From: Mike Teehan <mike.teehan@gmail.com>
Date: Tue, 28 Jul 2026 02:44:09 +0000
Subject: [PATCH] fix: check tryRefreshToken result in WS reconnect, clear
 permissions on logout

The token refresh callback in websocket.js ignored its ok parameter, causing
an infinite reconnect loop when the server rejected the refresh attempt. On
failure, redirect to login instead of reconnecting with a cleared token.

clearAuthTokens() now also removes vw:permissions from sessionStorage to
prevent stale permissions from persisting across logout/login cycles. Also
removed duplicate vw:user removeItem call.
---
 webui/static/hoover/api.js       |  2 +-
 webui/static/hoover/websocket.js | 14 +++++++++-----
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/webui/static/hoover/api.js b/webui/static/hoover/api.js
index ab88e80..2bf8cf9 100644
--- a/webui/static/hoover/api.js
+++ b/webui/static/hoover/api.js
@@ -47,7 +47,7 @@ function clearAuthTokens() {
     sessionStorage.removeItem('vw:access_ttl');
     sessionStorage.removeItem('vw:session_id');
     sessionStorage.removeItem('vw:user');
-    sessionStorage.removeItem('vw:user');
+    sessionStorage.removeItem('vw:permissions');
     if (typeof window.__authRefreshTimer__ !== 'undefined') {
         clearTimeout(window.__authRefreshTimer__);
         window.__authRefreshTimer__ = undefined;
diff --git a/webui/static/hoover/websocket.js b/webui/static/hoover/websocket.js
index 10f15d6..2109f13 100644
--- a/webui/static/hoover/websocket.js
+++ b/webui/static/hoover/websocket.js
@@ -7,7 +7,7 @@
  */
 
 import { refreshByTopic } from './model.js?v=9';
-import { tryRefreshToken } from './api.js?v=12';
+import { tryRefreshToken, redirectLogin } from './api.js?v=12';
 
 let _wsConn = null;
 let _wsReconnectMs = 0;
@@ -56,10 +56,14 @@ function _wsConnect() {
             _wsRefreshing = true;
             tryRefreshToken().then(ok => {
                 _wsRefreshing = false;
-                _wsFailCount = 0;
-                _wsReconnectMs = 0;
-                _wsConn = null;
-                setTimeout(_wsConnect, 100);
+                if (ok) {
+                    _wsFailCount = 0;
+                    _wsReconnectMs = 0;
+                    _wsConn = null;
+                    setTimeout(_wsConnect, 100);
+                } else {
+                    redirectLogin();
+                }
             }).catch(() => {
                 _wsRefreshing = false;
                 _wsReconnectMs = Math.min(_wsReconnectMs * 2 + 1000, 15000);