From 87b026d54c6f8571305dc41ac784503e40cc73f5 Mon Sep 17 00:00:00 2001
From: prettysunflower <me@prettysunflower.moe>
Date: Thu, 22 Jan 2026 13:29:36 +0100
Subject: [bugfix] Check that token is defined before logging the user out
 (#4632)

# Description

This pull request should fix #3761?

So, currently, the [logout mutation](https://codeberg.org/superseriousbusiness/gotosocial/src/commit/b310e99b436357bb34b98f1b9233f3c9c69aaab0/web/source/settings/lib/query/login/index.ts#L189) is expecting the token to be defined, and throws if it isn't.

However, the auth component logout the user if an error is found while verifying credentials, and there are cases where the token can at this point be undefined. (this happens to me a lot when I want to get to GTS's settings, I start the login flow, approve the login on my OIDC, get distracted, and forget to approve the oauth app)

In this case, the user is stuck on a white page until they finish the previous login attempt (which can be difficult if the process was abandoned), or delete the site's local storage.

This pull request checks for the presence of the token before logging out the user (avoiding the logout mutation to throw and result in a white page), and the absence of the token to restart the authentication process. The error that was the reason that logoutQuery was called is now displayed to the user, and the user has the ability to restart the login process.

## Checklist

Please put an x inside each checkbox to indicate that you've read and followed it: `[ ]` -> `[x]`

If this is a documentation change, only the first two checkboxes must be filled (you can delete the others if you want).

- [X] I/we have read the [GoToSocial contribution guidelines](https://codeberg.org/superseriousbusiness/gotosocial/src/branch/main/CONTRIBUTING.md).
- [X] I/we have not used so-called 'AI' to create the proposed changes.
- [ ] I/we have discussed the proposed changes already, either in an issue on the repository, or in the Matrix chat.
- [X] I/we have performed a self-review of added code.
- [X] I/we have written code that is legible and maintainable by others.
- [X] I/we have commented the added code, particularly in hard-to-understand areas.
- [ ] I/we have made any necessary changes to documentation.
    - I don't think this is applicable?
- [ ] I/we have added tests that cover new code.
    - Only TypeScript was edited, and I don't think there are tests currently implemented for that part?
- [X] I/we have run tests and they pass locally with the changes.
- [X] I/we have run `go fmt ./...` and `golangci-lint run`.
    - golangci-lint indicated 3 issues that were not introduced by this pull request

Reviewed-on: https://codeberg.org/superseriousbusiness/gotosocial/pulls/4632
Co-authored-by: prettysunflower <me@prettysunflower.moe>
Co-committed-by: prettysunflower <me@prettysunflower.moe>
---
 web/source/settings/components/authorization/index.tsx | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

(limited to 'web/source/settings/components/authorization/index.tsx')

diff --git a/web/source/settings/components/authorization/index.tsx b/web/source/settings/components/authorization/index.tsx
index 3eeeb393a..6b64e43e8 100644
--- a/web/source/settings/components/authorization/index.tsx
+++ b/web/source/settings/components/authorization/index.tsx
@@ -27,7 +27,7 @@ import { Error } from "../error";
 import { NoArg } from "../../lib/types/query";
 
 export function Authorization({ App }) {
-	const { current: loginState, expectingRedirect } = store.getState().login;
+	const { current: loginState, token: token, expectingRedirect } = store.getState().login;
 	const skip = (loginState == "none" || loginState == "loggedout" || expectingRedirect);
 	const [ logoutQuery ] = useLogoutMutation();
 
@@ -60,7 +60,14 @@ export function Authorization({ App }) {
 	} else if (error !== undefined) {
 		// Something went wrong,
 		// log the user out.
-		logoutQuery(NoArg);
+
+		// token can be undefined in some cases
+		// (ex: user going back to /settings after abandoning login)
+		// logoutQuery should only be called when token is defined,
+		// since that function revokes the token
+		if (token !== undefined) {
+			logoutQuery(NoArg);
+		}
 
 		content = (
 			<div>
-- 
cgit v1.3

