Category: Functional Edge Case
Repository location: apps/web/lib/api.ts (ApiClient.setToken, initApiClientWithToken), apps/web/hooks/useAuth.ts (logout)
Problem
initApiClientWithToken() only calls apiClient.setToken(token) when token is truthy: if (token) { apiClient.setToken(token); }. useAuth.ts's logout() sets the store token to null then calls initApiClientWithToken(), expecting the client to clear its token — but since the token is falsy, the call is a no-op and the previous JWT stays cached inside apiClient indefinitely.
Evidence
function initApiClientWithToken(): void {
const token = useWalletStore.getState().token;
if (token) {
apiClient.setToken(token);
}
}
// useAuth.ts logout():
setToken(null);
initApiClientWithToken(); // token is null -> apiClient.token stays stale
disconnect();Suggested implementation
Add an explicit clearToken() method to ApiClient and call it whenever the token is falsy: token ? apiClient.setToken(token) : apiClient.clearToken().
Acceptance criteria
- After calling
logout(), any subsequent request through apiClient.fetch sends no Authorization header.
- A unit test asserts
apiClient's internal token is null after initApiClientWithToken() runs with a null store token.
Difficulty: Easy
Expected impact: Closes a real auth-hygiene gap where a logged-out session keeps authenticating API calls with a stale JWT.
Filed as part of the second repository-wide audit (deeper refinements following the first cleanup pass).
Category: Functional Edge Case
Repository location: apps/web/lib/api.ts (ApiClient.setToken, initApiClientWithToken), apps/web/hooks/useAuth.ts (logout)
Problem
initApiClientWithToken()only callsapiClient.setToken(token)whentokenis truthy:if (token) { apiClient.setToken(token); }.useAuth.ts'slogout()sets the store token tonullthen callsinitApiClientWithToken(), expecting the client to clear its token — but since the token is falsy, the call is a no-op and the previous JWT stays cached insideapiClientindefinitely.Evidence
Suggested implementation
Add an explicit
clearToken()method toApiClientand call it whenever the token is falsy:token ? apiClient.setToken(token) : apiClient.clearToken().Acceptance criteria
logout(), any subsequent request throughapiClient.fetchsends noAuthorizationheader.apiClient's internal token isnullafterinitApiClientWithToken()runs with a null store token.Difficulty: Easy
Expected impact: Closes a real auth-hygiene gap where a logged-out session keeps authenticating API calls with a stale JWT.
Filed as part of the second repository-wide audit (deeper refinements following the first cleanup pass).