From 0c0907ad4c6c093b9b529ed2fcb6631f2d7494a7 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 28 Sep 2026 15:22:15 +0800 Subject: [PATCH] fix(web): wrong current password or TOTP code no longer bounces to login POST /auth/password and /auth/totp answer 401 for a wrong password/code; the global 401 handler treated that as an expired session and redirected to /login. Both mutations now pass noAuthRedirect so the form shows the field error. Co-Authored-By: Claude Opus 5.5 --- apps/web/app/api/auth.ts | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/apps/web/app/api/auth.ts b/apps/web/app/api/auth.ts index e6576da6..d60cb011 100644 --- a/apps/web/app/api/auth.ts +++ b/apps/web/app/api/auth.ts @@ -46,7 +46,8 @@ export function useLogout() { export function useChangePassword() { return useMutation({ mutationFn: (body: PasswordChangeRequest) => - apiData("/auth/password", { method: "POST", body }), + // 旧密码错误也是 401:留在页面显示字段错误,不当成会话失效跳登录 + apiData("/auth/password", { method: "POST", body, noAuthRedirect: true }), }); } @@ -61,7 +62,8 @@ export function useTotpStatus(enabled = true) { export function useTotpAction() { const qc = useQueryClient(); return useMutation({ - mutationFn: (body: TotpAction) => apiData("/auth/totp", { method: "POST", body }), + mutationFn: (body: TotpAction) => + apiData("/auth/totp", { method: "POST", body, noAuthRedirect: true }), onSuccess: () => { qc.invalidateQueries({ queryKey: qk.all("auth") }); },