From 4400a7abbad56aff926adc1be3001c42a2e304b1 Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Thu, 30 Apr 2026 15:39:11 +0200
Subject: [PATCH] fix: evict unrecoverable basic-auth accounts on reload

---
 stores/auth-store.ts | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/stores/auth-store.ts b/stores/auth-store.ts
index 0ca76acd..008b020f 100644
--- a/stores/auth-store.ts
+++ b/stores/auth-store.ts
@@ -1209,6 +1209,15 @@ export const useAuthStore = create<AuthState>()(
           for (const account of accounts) {
             if (clients.has(account.id)) continue; // Already connected
 
+            // Basic auth without rememberMe leaves nothing to restore — the
+            // user logged in without persisting credentials. Evict silently
+            // so the login screen is shown without flagging a fake error.
+            if (account.authMode === 'basic' && !account.rememberMe) {
+              evictAccount(account.id);
+              accountStore.removeAccount(account.id);
+              continue;
+            }
+
             try {
               if (account.authMode === 'oauth') {
                 const res = await apiFetch(`/api/auth/token?slot=${account.cookieSlot}`, { method: 'PUT' });
@@ -1225,7 +1234,7 @@ export const useAuthStore = create<AuthState>()(
                 } else {
                   throw new Error(`Token refresh failed: ${res.status}`);
                 }
-              } else if (account.authMode === 'basic' && account.rememberMe) {
+              } else {
                 const res = await apiFetch(`/api/auth/session?slot=${account.cookieSlot}`, { method: 'PUT' });
                 if (res.ok) {
                   const { serverUrl, username, password } = await res.json();
@@ -1238,9 +1247,6 @@ export const useAuthStore = create<AuthState>()(
                 } else {
                   throw new Error(`Session cookie missing: ${res.status}`);
                 }
-              } else {
-                // Basic auth without rememberMe - can't restore
-                throw new Error('No saved session');
               }
             } catch (err) {
               debug.error(`Failed to restore account ${account.id}:`, err);