fix: a 429 or 5xx on the session check shows the error page instead of signing the user out

Merged
HA
2d ago
+19-2

Summary

Small bug found while chasing a flaky E2E test. The root layout's load treats any failed /api/v1/auth/me as "nobody is signed in" (+layout.ts), so a 429 from the rate limiter or a 5xx sends a signed-in user to the login page. A local Playwright run on 4 workers shows it: the backend answered /auth/me with 429 76 times, and 10 admin tests landed on "Sign in to your account" with valid sessions.

Changes

Only a 401 or no answer at all still means no user. Any other error throws SvelteKit's error(status, detail), so the error page shows it and the session stays.

Type of Change

  • Bug fix (non-breaking change that fixes an issue)
  • New feature (non-breaking change that adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation update
  • Refactoring (no functional changes)
  • CI/CD or tooling changes

Test Plan

  • Backend unit tests pass (cd backend && uv run pytest tests/unit)
  • Frontend unit tests pass (cd frontend && npm run test)
  • Backend E2E tests pass (docker compose exec -T backend sh -c 'uv sync --group test --no-dev --frozen --no-install-project --no-build && pytest tests/e2e')
  • Frontend E2E tests pass (cd frontend && npm run test:e2e)
  • API spec and client regenerated if routes or schemas changed (./deploy.sh openapi, then ./deploy.sh types), never edited by hand
  • Manual testing performed

Validation: lint, svelte-check, format:check and the coverage run (870 tests) pass, with two new cases for a 429 and a 500.

Checklist

  • My code follows the project's style guidelines
  • I have run pre-commit run --all-files and all checks pass
  • I have added tests that prove my fix/feature works
  • I have updated documentation if needed
  • My changes don't introduce new warnings

Summary by cubic

Fixes the session check so a 429 rate limit or 5xx response shows the error page instead of signing an authenticated user out.

Previously, any failed /api/v1/auth/me request was treated as "nobody is signed in", so transient backend errors sent users to the login page. Now only a 401 or no answer at all means no user; other failures throw a SvelteKit error and keep the session.

  • Adds test cases covering a 429 and a 500 response.