kifaru 1.0.174 → 1.0.178

package/dashboard/assurance.html

@@ -2489,7 +2489,7 @@ ${f.dpa.map((d) => " - " + d).join("\n")}`
         )
       }
       function startRun() {
-        getToken() ? (window.location.href = "/assessments") : openLogin()
+        signedIn() ? (window.location.href = "/assessments") : openLogin()
       }
 
       function switchTab(name) {
@@ -2543,17 +2543,33 @@ ${f.dpa.map((d) => " - " + d).join("\n")}`
           return ""
         }
       }
+      // The loopback dev sign-in establishes an httpOnly cookie session; no
+      // bearer token is returned, so this flag tracks that it succeeded.
+      function devSessionActive() {
+        try {
+          return localStorage.getItem("kifaru_dev_session") === "1"
+        } catch (_) {
+          return false
+        }
+      }
+      function setDevSession(on) {
+        try {
+          on ? localStorage.setItem("kifaru_dev_session", "1") : localStorage.removeItem("kifaru_dev_session")
+        } catch (_) {}
+      }
+      function signedIn() {
+        return Boolean(getToken()) || devSessionActive()
+      }
       async function autoDiscoverToken() {
         let t = getToken()
-        if (t) return t
+        if (t || devSessionActive()) return t
         try {
-          const r = await fetch("/api/v1/auth/dev-token")
+          // Session-scoped dev sign-in: the gateway sets an httpOnly session
+          // cookie for loopback browsers and returns no token.
+          const r = await fetch("/api/v1/auth/dev-token", { credentials: "include" })
           if (r.ok) {
             const d = await r.json()
-            if (d?.token) {
-              setToken(d.token)
-              return d.token
-            }
+            if (d?.ok) setDevSession(true)
           }
         } catch (_) {}
         return ""
@@ -2565,7 +2581,7 @@ ${f.dpa.map((d) => " - " + d).join("\n")}`
       }
       function openLogin() {
         $("#loginErr").textContent = ""
-        $("#logoutBtn").hidden = !getToken()
+        $("#logoutBtn").hidden = !signedIn()
         $("#loginModal").hidden = false
         setTimeout(() => $("#loginEmail").focus(), 30)
       }
@@ -2658,6 +2674,8 @@ ${f.dpa.map((d) => " - " + d).join("\n")}`
       }
       function signOut() {
         setToken("")
+        setDevSession(false)
+        fetch("/api/v1/auth/logout", { method: "POST", credentials: "include" }).catch(() => {})
         LIVE = null
         ACTIVE_RUN = null
         findingDetailCache.clear()