fix: return JSON 401 for API routes instead of 302 redirect #1

Merged

john merged 1 commit from feat/api-json-401 into dev

2026-06-22 08:48:02 +00:00

john commented

2026-06-22 08:45:38 +00:00

Owner

API consumers using follow_redirects get an unambiguous error (JSON 401) instead of silently landing on the login page (HTTP 200). Browser routes (/dashboard, /qr) keep the 302 redirect.

Root cause: superclean-sys2 WhatsAppTransport entered infinite re-auth loops because 302→login page→200 looked like successful authentication.

Changes:

web/middleware.go: AuthMiddleware checks r.URL.Path prefix — /api/* gets JSON 401, others get 302
web/api_send_test.go: Updated test to expect 401 JSON (was 302)

All tests pass (8 packages, 0 failures).

Do NOT auto-merge — this is a shared module change affecting whatsapp-monitor, pocketnanny, and superclean-sys2.

API consumers using follow_redirects get an unambiguous error (JSON 401) instead of silently landing on the login page (HTTP 200). Browser routes (/dashboard, /qr) keep the 302 redirect. Root cause: superclean-sys2 WhatsAppTransport entered infinite re-auth loops because 302→login page→200 looked like successful authentication. Changes: - web/middleware.go: AuthMiddleware checks r.URL.Path prefix — /api/* gets JSON 401, others get 302 - web/api_send_test.go: Updated test to expect 401 JSON (was 302) All tests pass (8 packages, 0 failures). Do NOT auto-merge — this is a shared module change affecting whatsapp-monitor, pocketnanny, and superclean-sys2.

john added 1 commit

2026-06-22 08:45:38 +00:00

fix: return JSON 401 for API routes instead of 302 redirect f2628f242b

API consumers using follow_redirects get an unambiguous error instead of
silently landing on the login page (HTTP 200). Browser routes still redirect.

Root cause: superclean-sys2 WhatsAppTransport entered infinite re-auth
loops because 302->login page->200 looked like successful authentication.