From b0e711f9f7e0d2d9f6b39dd987004d2f9b1dcda7 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Mon, 9 Nov 2026 12:11:26 +0000
Subject: dashboard: nothing shown or read after logging out, back button
 included

After "log out" the page went to the login page, and the browser's back button brought
it back as it was (kept whole in its history): the map, the peers and the console went
on updating, by the stream it still had open and the subscriptions' token it still
held, though the session had ended (the document box, reading anew, got 401s).

Now leaving for the login page (`toLogin`: logging out, or the login ending) stops the
page's reading first: its stream, its subscriptions, its timers and tokens. And a page
the browser brings back whole (`pageshow`, `persisted`) loads again instead, so it
reads with the session it has now, and without one goes to the login page.
---
 src/api/dashboard/dashboard.html | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

(limited to 'src/api')

diff --git a/src/api/dashboard/dashboard.html b/src/api/dashboard/dashboard.html
index dd37f29..a20e64c 100644
--- a/src/api/dashboard/dashboard.html
+++ b/src/api/dashboard/dashboard.html
@@ -2719,7 +2719,7 @@ async function logOut() {
       "The page is let in still, by other means."));
     obtainTokens();
   } catch (_) {
-    location.assign("../login");
+    toLogin();
   }
 }
 // The user's credentials: its keys (`/auth/keys`): each edited (its name, its line),
@@ -2904,7 +2904,7 @@ async function obtainTokens() {
     showWho();
     // The login ended (or none): to the login page; else (the node away) again soon.
     if ([400, 401, 403].includes(error.status)) {
-      location.assign("../login");
+      toLogin();
       return;
     }
     tokenTimer = setTimeout(obtainTokens, 30000);
@@ -4374,6 +4374,22 @@ remakeForm.addEventListener("submit", event => {
     .catch(error => remakeResult("Proposing failed: " + error, true));
 });
 
+// To the login page, the page's reading stopped first: its stream, its subscriptions,
+// its timers and tokens. A page the browser brings back from its history as it was
+// (back, forward: `pageshow` of a page kept whole) is loaded again instead, so it shows
+// nothing its session no longer lets it read, and goes to the login page without one.
+function toLogin() {
+  clearTimeout(retry);
+  retry = null;
+  if (events) events.close();
+  for (const entry of subscribed.values()) entry.stop();
+  subscribed.clear();
+  clearTimeout(tokenTimer);
+  clearTimeout(figuresTimer);
+  token = narrowToken = null;
+  location.assign("../login");
+}
+addEventListener("pageshow", event => { if (event.persisted) location.reload(); });
 // Opened from another member's page (`handOver`) with a token: it begins this browser's
 // session here before anything is read, with no login page in between. Without a
 // session, `obtainTokens` goes to the login page.
-- 
cgit v1.3.1