From e16a6f7f44a438607a58e6c2f772811b58abb2e5 Mon Sep 17 00:00:00 2001
From: Wesley Finck <wesleyfinck@gmail.com>
Date: Tue, 4 Nov 2025 11:58:40 -0500
Subject: [PATCH] fix: forward backend cookie-clearing headers on refresh
 failure

Co-authored-by: aider (anthropic/claude-sonnet-4-20250514) <aider@aider.chat>
---
 src/webapp/app/api/auth/me/route.ts | 28 ++++++++++++++++++++++++----
 1 file changed, 24 insertions(+), 4 deletions(-)

diff --git a/src/webapp/app/api/auth/me/route.ts b/src/webapp/app/api/auth/me/route.ts
index a039d46a..8ec44016 100644
--- a/src/webapp/app/api/auth/me/route.ts
+++ b/src/webapp/app/api/auth/me/route.ts
@@ -47,12 +47,30 @@ export async function GET(request: NextRequest) {
           console.log(`[auth/me] Token refresh completed successfully`);
         }
         return result;
-      } catch (error) {
+      } catch (error: any) {
         if (ENABLE_REFRESH_LOGGING) {
           console.log(`[auth/me] Token refresh error: ${error}`);
         }
         console.error('Token refresh error:', error);
-        // Clear cookies on refresh failure
+
+        // If this is a refresh failure with backend response, forward the cookie-clearing headers
+        if (error.backendResponse) {
+          const response = NextResponse.json<AuthResult>(
+            { isAuth: false },
+            { status: 500 },
+          );
+
+          // Forward the Set-Cookie headers from backend to clear cookies
+          const setCookieHeader =
+            error.backendResponse.headers.get('set-cookie');
+          if (setCookieHeader) {
+            response.headers.set('Set-Cookie', setCookieHeader);
+          }
+
+          return response;
+        }
+
+        // For other errors, clear cookies manually
         const response = NextResponse.json<AuthResult>(
           { isAuth: false },
           { status: 500 },
@@ -132,8 +150,10 @@ async function performTokenRefresh(
         `[auth/me] Backend refresh failed with status: ${refreshResponse.status}. Message: ${await refreshResponse.text()}`,
       );
     }
-    // Throw error instead of returning response
-    throw new Error(`Refresh failed: ${refreshResponse.status}`);
+    // Create error with backend response to preserve cookie-clearing headers
+    const error = new Error(`Refresh failed: ${refreshResponse.status}`) as any;
+    error.backendResponse = refreshResponse;
+    throw error;
   }
 
   // Get new tokens from response
-- 
2.51.2