fix(auth): resolve post-login navigate race condition and add version display (#68) (#70)

Root cause: when auth.me() failed during initial navigation, the catch block called navigate('/login') without clearing _pendingLoginRedirect. The outer finally then fired a second concurrent navigate('/login'), which held isNavigating=true while running. If the user submitted the login form (or iCloud Keychain autofilled credentials) before the second navigation completed, navigate('/', user) was silently blocked by the isNavigating guard — login appeared to succeed but the app never advanced to the dashboard. Fix: clear _pendingLoginRedirect in the catch block so the finally handler does not spawn the duplicate navigation. Also adds a GET /api/v1/version endpoint (no auth required) and shows the version on the login page, so users can verify their PWA has received the latest cached JS. Resolves #68 Co-authored-by: Ulas Kalayci <ulas.kalayci@googlemail.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-04-21 08:19:53 +02:00
parent c1bdd4361d
commit d1ec7367a0
22 changed files with 711 additions and 657 deletions
@@ -7,6 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

 ## [Unreleased]

+## [0.20.41] - 2026-04-21
+
+### Fixed
+- Race condition in `router.js`: when `auth.me()` failed during initial navigation, `_pendingLoginRedirect` was not cleared before calling `navigate('/login')` from the catch block, causing the `finally` handler to launch a second concurrent navigation. If the second navigation was still in progress when the user submitted the login form, `navigate('/', user)` was silently blocked — login appeared to succeed but the dashboard never loaded (most noticeable on iOS Safari PWA with iCloud Keychain autofill)
+
+### Added
+- Version number displayed on the login page (fetched from new `GET /api/v1/version` endpoint, no auth required), so users can verify which release their PWA is running
+
 ## [0.20.40] - 2026-04-21

 ### Changed