security upgrade

static/js/auth-ui.js

@@ -13,8 +13,10 @@ import { askConfirm, askInput, showMessage } from "@rustpad/modal";
 
 const { getAuthToken, setAuthSession, setNickname } = sessionStore;
 const clearAuthSession = sessionStore.clearAuthSession || (() => {
+  localStorage.removeItem("rustpad:auth-state");
   localStorage.removeItem("rustpad:auth-token");
   sessionStorage.removeItem("rustpad:auth-token");
+  localStorage.removeItem("rustpad:nickname");
   sessionStorage.removeItem("rustpad:nickname");
 });
 
@@ -287,7 +289,7 @@ function bindLegacyIdentityDialog({ dialog, onIdentity }) {
         return;
       }
       nickname.disabled = false;
-      const result = await api("/api/auth/identity", { method: "POST", body: JSON.stringify({ nickname: name, session_token: getAuthToken() || null }) });
+      const result = await api("/api/auth/identity", { method: "POST", body: JSON.stringify({ nickname: name }) });
       setNickname(result.nickname);
       await onIdentity(result.nickname, null);
       dialog.close();
@@ -305,25 +307,21 @@ function bindLegacyIdentityDialog({ dialog, onIdentity }) {
 }
 
 export async function validateCurrentSession() {
-  const token = getAuthToken();
-  if (!token) return null;
+  const expectedSession = Boolean(getAuthToken());
   try {
-    const session = await api("/api/auth/me", { headers: { Authorization: `Bearer ${token}` } });
+    const session = await api("/api/auth/me");
     setAuthSession(session);
     return session;
   } catch {
-    clearAuthSession();
+    if (expectedSession) clearAuthSession();
     return null;
   }
 }
 
 export async function logoutCurrentSession() {
-  const token = getAuthToken();
-  if (token) {
-    try {
-      await api("/api/auth/logout", { method: "POST", headers: { Authorization: `Bearer ${token}` } });
-    } catch { }
-  }
+  try {
+    await api("/api/auth/logout", { method: "POST" });
+  } catch { }
   clearAuthSession();
 }