edde746andClaude Fable 5.1
ce03857588
A local Seerr account with request rights could sign in to Plezy but never saw the Request action. POST /auth/local loads only the columns it needs to check the password, so the entity it returns carries the class default permissions of 0 (and the email as display name); the session stored that snapshot and the detail screen gated Request on it. Sign-in now ignores the login body and reads the user back through GET /auth/me with the fresh cookie, for every method. SeerrUser.permissions is required, so a user without a mask fails sign-in instead of persisting 0. Two related gaps kept an affected session broken until a manual reconnect: - Seerr answers an expired session with 403, never 401, so the silent re-auth never ran. A 403 now re-auths once GET /auth/me confirms the cookie is dead; a 403 from a live session stays a permission denial so a Quick Connect session is not unlinked over one. - Nothing refreshed a stored session's permissions. The account provider now re-reads the user on bind, so sessions persisted with 0 by earlier builds, and admin-side permission changes, reach the Request action on the next launch. close #2213 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
14 lines
466 B
Dart
14 lines
466 B
Dart
// GENERATED CODE - DO NOT MODIFY BY HAND
|
|
|
|
part of 'seerr_user.dart';
|
|
|
|
// **************************************************************************
|
|
// JsonSerializableGenerator
|
|
// **************************************************************************
|
|
|
|
SeerrUser _$SeerrUserFromJson(Map<String, dynamic> json) => SeerrUser(
|
|
id: (json['id'] as num).toInt(),
|
|
displayName: json['displayName'] as String?,
|
|
permissions: (json['permissions'] as num).toInt(),
|
|
);
|