Sign up
View stargazersSign up

fix(admin): login route 401 handling, dead searchOrder mutation, batch-failure toast dedupe#274

merged2
fix/admin-order-cache-keys
fix/admin-query-misc-bugs
openedAug 22, 2026byAAviddaram
4 files changed
View on GitHubTwo-way sync enabledPR last imported 20d ago

Stacked on #273.

Changes

  • login.tsx: ensureQueryData(auth.me) rejects on 401 for logged-out visitors, erroring the route instead of rendering the form. Wrapped in try/catch; rejection = not logged in.
  • orders.index.tsx: deleted the never-invoked searchOrder mutation whose isPending gated the search UI with permanently-false state. SubmitButton.isPending is now optional instead of receiving hardcoded false.
  • orders-list.tsx: batch self-ship failures toasted once per failed order (global MutationCache) plus a summary toast. No-op local onError suppresses the global one.

Verification

  • typecheck clean
  • manual: logged-out visit to /login renders the form
  • manual: batch self-ship with a failing order shows one summary toast

Checks

4 successful · 1 skipped
All checks passed
66a1bec
CcoderabbitaiBotAug 22, 2026
Synced from GitHub

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (1)
  • v2

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c25fe142-3fe5-47a7-8d45-9820e38422b0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Cchatgpt-codex-connectorBotreviewed · 1 inline threadAug 22, 2026
Synced from GitHub

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 260373b491

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

apps/admin/src/routes/login.tsxlines 20–21Outdated · 260373bOpen thread
……@@ -7,12 +7,19 @@ import { Button } from "@/components/ui/button";
18+ retry: false,
19+ });
20+ } catch {
21+ session = null;
Cchatgpt-codex-connectorBoton lines 20–21Aug 22, 2026

P2 Badge Only swallow unauthorized login failures

When auth.me fails because of a network, KV, server, or decoding error rather than a 401, this catch also converts the failure into session = null, so even a logged-in admin is shown the OAuth login form and the real outage is hidden instead of reaching the route error handling. Inspect the error and suppress only the expected UNAUTHORIZED response; rethrow other failures.

Useful? React with 👍 / 👎.

Ggreptile-appsBotAug 22, 2026
Synced from GitHub

Greptile Summary

This PR repairs logged-out login rendering, removes dead order-search mutation state, and deduplicates batch self-shipping failure notifications.

  • Wraps the login session lookup so rejected requests can render the login form.
  • Removes unused search mutation wiring and makes SubmitButton.isPending optional.
  • Suppresses global per-order mutation toasts where the batch flow already provides consolidated failure feedback.

Confidence Score: 4/5

The PR should not merge until the login guard distinguishes unauthorized responses from operational authentication failures.

The broad catch in the login route turns realistic backend and transport failures into a false logged-out state, hiding the normal route error and rendering a misleading login form.

Files Needing Attention: apps/admin/src/routes/login.tsx

Important Files Changed

FilenameOverview
apps/admin/src/routes/login.tsxAdds the intended logged-out fallback, but the unconditional catch also misclassifies operational auth failures as missing sessions.
apps/admin/src/components/order/orders-list.tsxAdds a local mutation error callback so the existing global handler defers to the batch flow's consolidated failure feedback.
apps/admin/src/routes/_dash/orders.index.tsxRemoves an unused mutation and permanently false pending-state UI gates without changing the URL-driven search behavior.
apps/admin/src/components/submit-button.tsxMakes the pending prop optional while preserving disabled and spinner behavior for callers that provide it.

Reviews (1): Last reviewed commit: "fix(admin): render login form on auth fa..." | Re-trigger Greptile

apps/admin/src/routes/login.tsxlines 20–22Outdated · 260373bOpen thread
……@@ -7,12 +7,19 @@ import { Button } from "@/components/ui/button";
19+ });
20+ } catch {
21+ session = null;
22+ }
Ggreptile-appsBoton lines 20–22Aug 22, 2026

P1 Catch erases authentication failures

When auth.me fails because of a backend, malformed-session, network, or response-parsing error, this unconditional catch treats the failure as a missing session, causing /login to render a misleading login form instead of the route error state.

Added 2 commits

  • fix(admin): only treat 401 as logged-out on the login route66a1bec
  • fix(admin): render login form on auth failure, drop dead searchOrder mutation, dedupe batch-failure toastsc5f315c
AAviddaramAug 22, 2026

Addressed in 66a1bec: the catch now re-throws everything except TRPCClientError with data.code === "UNAUTHORIZED"; network/5xx failures reach the route error boundary instead of faking a logged-out state.

Cchatgpt-codex-connectorBotreviewed · 1 inline threadAug 22, 2026
Synced from GitHub

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 66a1bec12e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

apps/admin/src/routes/login.tsxlines 15–16Open thread
……@@ -7,12 +8,23 @@ import { Button } from "@/components/ui/button";
13+ let session = null;
14+ try {
15+ session = await ctx.queryClient.ensureQueryData({
16+ ...ctx.trpc.auth.me.queryOptions(),
Cchatgpt-codex-connectorBoton lines 15–16Aug 22, 2026

P2 Badge Suppress the expected login-query toast

When a logged-out visitor causes auth.me to reject with the expected 401, the global QueryCache.onError in apps/admin/src/utils/trpc.ts still calls toast.error(error.message) before this promise rejects. Catching the rejection here therefore renders the form but also shows an alarming “Unauthorized” toast on every normal logged-out visit; mark this query as an expected/silent authorization probe or otherwise exclude this specific error from the global query handler.

Useful? React with 👍 / 👎.