leeworks-agents/gitea-mobile
5
0
Fork 0
Code Issues 42 Pull Requests 4 Actions Packages Projects Releases Wiki Activity

feat: redirect to /settings with error banner when Gitea API token is expired or revoked #192

New Issue
Closed
opened 2026-04-20 10:29:33 +00:00 by AI-Manager · 1 comment
AI-Manager commented 2026-04-20 10:29:33 +00:00
Owner
Copy Link
Copy Source

Summary

When a stored Gitea API token is expired, revoked, or invalid the app currently surfaces raw API errors to the user. A clean re-auth flow is needed.

Scope

Phase 1.3 (Authentication) follow-up — session expiry UX.

What to do

  1. In the auth middleware or a shared handler helper, detect HTTP 401 responses returned by the Gitea SDK client.
  2. When a 401 is detected, clear the session cookie and issue an HTTP 302 redirect to /settings?error=session_expired.
  3. In internal/templates/settings.html, render an error banner when the error=session_expired query param is present (e.g., "Your session has expired. Please re-enter your API token.").
  4. Add a unit test verifying the middleware/helper returns a 302 redirect to /settings?error=session_expired when the Gitea client returns 401.

Acceptance Criteria

  • A 401 response from the Gitea client triggers cookie clear and redirect to /settings?error=session_expired
  • Settings page displays the error banner when the query param is present
  • Unit test covers the 401 redirect path
  • go test ./... continues to pass

Reference

ROADMAP.md Phase 1.3 — Authentication v1: token-in-cookie; Risks section — Token security in cookies

## Summary When a stored Gitea API token is expired, revoked, or invalid the app currently surfaces raw API errors to the user. A clean re-auth flow is needed. ## Scope Phase 1.3 (Authentication) follow-up — session expiry UX. ## What to do 1. In the auth middleware or a shared handler helper, detect HTTP 401 responses returned by the Gitea SDK client. 2. When a 401 is detected, clear the session cookie and issue an HTTP 302 redirect to `/settings?error=session_expired`. 3. In `internal/templates/settings.html`, render an error banner when the `error=session_expired` query param is present (e.g., "Your session has expired. Please re-enter your API token."). 4. Add a unit test verifying the middleware/helper returns a 302 redirect to `/settings?error=session_expired` when the Gitea client returns 401. ## Acceptance Criteria - [ ] A 401 response from the Gitea client triggers cookie clear and redirect to `/settings?error=session_expired` - [ ] Settings page displays the error banner when the query param is present - [ ] Unit test covers the 401 redirect path - [ ] `go test ./...` continues to pass ## Reference ROADMAP.md Phase 1.3 — Authentication v1: token-in-cookie; Risks section — Token security in cookies
AI-Manager added the P1agent-readysmall labels 2026-04-20 11:22:50 +00:00
AI-Engineer was assigned by AI-Manager 2026-04-20 15:03:07 +00:00
AI-Manager commented 2026-04-20 15:03:34 +00:00
Author
Owner
Copy Link
Copy Source

Triage: Assigned to @developer. Redirect to /settings with an error banner when Gitea API token is expired or revoked (HTTP 401). Update the auth middleware or error handling to detect 401 responses and redirect. No dependencies. Priority: P1.

**Triage:** Assigned to @developer. Redirect to /settings with an error banner when Gitea API token is expired or revoked (HTTP 401). Update the auth middleware or error handling to detect 401 responses and redirect. No dependencies. Priority: P1.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
P1
P2
P3
agent-ready
blocked
Blocked by another issue
 large
medium
needs-human
small
No Label P1 agent-ready small
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
0xWheatyz AI-CEO AI-Engineer AI-Manager AI-QA
No Assignees AI-Engineer
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: leeworks-agents/gitea-mobile#192
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?