From 1a50788c915ef5ec76cf41a40656cafc61e37e5d Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Mon, 4 May 2026 12:09:58 +0200
Subject: [PATCH] fix: ensure cookieSlot consistency during account updates in
 auth store

---
 stores/auth-store.ts | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/stores/auth-store.ts b/stores/auth-store.ts
index 04955b59..610ec4be 100644
--- a/stores/auth-store.ts
+++ b/stores/auth-store.ts
@@ -668,6 +668,12 @@ export const useAuthStore = create<AuthState>()(
             hasError: false,
             isDefault: accountStore.accounts.length === 0,
           });
+          // The refresh-token cookie was written to `slot`. Force the stored
+          // cookieSlot to match: addAccount preserves the prior slot when
+          // re-adding an existing account, and recomputes via getNextCookieSlot
+          // for new accounts (which may disagree if another tab claimed a slot
+          // mid-flow). Either way, the cookie's slot is the source of truth.
+          accountStore.updateAccount(accountId, { cookieSlot: slot });
           accountStore.setActiveAccount(accountId);
 
           await syncStalwartAuthContext(serverUrl, username, client.getAuthHeader(), slot);
@@ -793,10 +799,13 @@ export const useAuthStore = create<AuthState>()(
             hasError: false,
             isDefault: accountStore.accounts.length === 0,
           });
+          // The refresh-token cookie was written to `slot` by /api/auth/sso/complete.
+          // Force the stored cookieSlot to match — see loginWithOAuth above for the
+          // re-add and concurrent-tab cases this guards against.
+          accountStore.updateAccount(accountId, { cookieSlot: slot });
           accountStore.setActiveAccount(accountId);
 
-          const cookieSlot = accountStore.getAccountById(accountId)?.cookieSlot ?? 0;
-          await syncStalwartAuthContext(ssoServerUrl, username, client.getAuthHeader(), cookieSlot);
+          await syncStalwartAuthContext(ssoServerUrl, username, client.getAuthHeader(), slot);
 
           set({
             isAuthenticated: true,