fix(auth): simplify auth flow — remove localStorage caching

Replace the over-engineered getConfig() with localStorage caching and
retries with a straightforward two-step flow:
1. checkAuth() — if authenticated, done
2. If server unreachable, getConfig() (no auth) to check if password
   is even required — if not, grant access

No caching, no retries, no localStorage. Fixes false login page on
mobile when DevTunnel auth cookie has not propagated to fetch yet.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: dorlugasigal

src/frontend/src/hooks/useAuth.ts

@@ -18,23 +18,11 @@ export function useAuth(): UseAuthReturn {
     let cancelled = false;
 
     async function init() {
-      // Determine if password is required (uses localStorage cache when server unreachable)
-      const config = await getConfig();
-      if (cancelled) return;
-      setPasswordRequired(config.passwordRequired);
-
-      // No-password mode: skip auth checks entirely — always grant access
-      if (!config.passwordRequired) {
-        setAuthenticated(true);
-        return;
-      }
-
-      // Check for one-time-token in URL
+      // Check for one-time-token in URL first
       const params = new URLSearchParams(window.location.search);
       const ott = params.get('ott');
 
       if (ott) {
-        // Remove ott from URL without reload
         params.delete('ott');
         const search = params.toString();
         const newUrl =
@@ -59,17 +47,37 @@ export function useAuth(): UseAuthReturn {
         }
       }
 
-      try {
-        const { authenticated: isAuth, serverReachable } = await checkAuth();
-        if (!cancelled) {
-          if (!isAuth && !serverReachable) {
-            setAuthenticated(false);
-            return;
-          }
-          setAuthenticated(isAuth);
-        }
-      } catch {
-        if (!cancelled) setAuthenticated(false);
+      // Primary check: can we reach the server and are we authenticated?
+      const { authenticated: isAuth, serverReachable } = await checkAuth();
+      if (cancelled) return;
+
+      if (isAuth) {
+        setAuthenticated(true);
+        return;
+      }
+
+      // Not authenticated — but is a password even required?
+      // If server is reachable and returned 401, password is required.
+      // If server is unreachable (tunnel stale, network down), check /api/config.
+      if (serverReachable) {
+        // Server responded with 401 — password is required
+        setPasswordRequired(true);
+        setAuthenticated(false);
+        return;
+      }
+
+      // Server unreachable — check if password is configured.
+      // /api/config has no auth middleware, so it works even without a token.
+      const config = await getConfig();
+      if (cancelled) return;
+      setPasswordRequired(config.passwordRequired);
+
+      if (!config.passwordRequired) {
+        // No password mode + server unreachable (tunnel flaky) — grant access.
+        // The terminal/sessions hub will show its own connection banner.
+        setAuthenticated(true);
+      } else {
+        setAuthenticated(false);
       }
     }
 
@@ -81,24 +89,12 @@ export function useAuth(): UseAuthReturn {
 
   // Re-check auth when returning from background (e.g. mobile tab switch after hours idle).
   useEffect(() => {
-    let retryTimer: ReturnType<typeof setTimeout> | null = null;
-
     function handleVisibility() {
       if (document.hidden) return;
 
       if (!passwordRequired) {
-        // No-password mode: server is always "authenticated", but verify reachability.
-        // If unreachable, keep authenticated=true — the terminal/sessions hub will
-        // show its own connection banner. Once reachable again, everything auto-recovers.
-        checkAuth().then(({ serverReachable }) => {
-          if (!serverReachable && retryTimer === null) {
-            // Schedule a silent retry in case tunnel just needs a moment
-            retryTimer = setTimeout(() => {
-              retryTimer = null;
-              checkAuth(); // fire-and-forget; UI stays on terminal
-            }, 5000);
-          }
-        });
+        // No-password mode: never flip to unauthenticated — the terminal handles
+        // connection issues with its own reconnect banner.
         return;
       }
 
@@ -110,10 +106,7 @@ export function useAuth(): UseAuthReturn {
     }
 
     document.addEventListener('visibilitychange', handleVisibility);
-    return () => {
-      document.removeEventListener('visibilitychange', handleVisibility);
-      if (retryTimer !== null) clearTimeout(retryTimer);
-    };
+    return () => document.removeEventListener('visibilitychange', handleVisibility);
   }, [authenticated, passwordRequired]);
 
   const login = useCallback(async (password: string): Promise<boolean> => {

src/frontend/src/services/api.ts

@@ -186,18 +186,11 @@ export async function getConfig(): Promise<{ passwordRequired: boolean }> {
     const res = await fetchWithTimeout(`${BASE}/api/config`, { credentials: 'same-origin' });
     const ct = res.headers.get('content-type') || '';
     if (!ct.includes('application/json')) {
-      // Non-JSON response (e.g. DevTunnel auth HTML) — use cached value if available.
-      // Default to passwordRequired=true (safe: shows login rather than bypassing auth).
-      const cached = localStorage.getItem('tb:passwordRequired');
-      return { passwordRequired: cached === null ? true : cached !== 'false' };
+      // Non-JSON response (DevTunnel auth page, etc.) — assume password required (safe default)
+      return { passwordRequired: true };
     }
-    const data = (await res.json()) as { passwordRequired: boolean };
-    localStorage.setItem('tb:passwordRequired', String(data.passwordRequired));
-    return data;
+    return (await res.json()) as { passwordRequired: boolean };
   } catch {
-    // Network error — server may be starting up, SW race, or genuinely down.
-    // Always default to passwordRequired=true (safe default) to prevent a stale
-    // no-password cache from bypassing auth on a password-protected server.
     return { passwordRequired: true };
   }
 }