From 1e57a886f46e7e21422bde0969f9d183b5cc23d9 Mon Sep 17 00:00:00 2001 From: agentbox Date: Fri, 31 Jul 2026 22:02:06 +0000 Subject: [PATCH] Fix: handle stale sessions and migrated users without household_id --- auth.py | 5 +++-- meals.py | 9 +++++++-- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/auth.py b/auth.py index eb25b20..dcea213 100644 --- a/auth.py +++ b/auth.py @@ -31,13 +31,14 @@ def login(): flash("Invalid username or password.", "error") return render_template("login.html") - household = get_household_by_id(user["household_id"]) + household_id = user["household_id"] + household = get_household_by_id(household_id) if household_id else None session.clear() session["user_id"] = user["id"] session["username"] = user["username"] session["is_admin"] = bool(user["is_admin"]) - session["household_id"] = user["household_id"] + session["household_id"] = household_id session["household_name"] = household["name"] if household else "Unknown" return redirect(url_for("meals.dashboard")) diff --git a/meals.py b/meals.py index 53f524c..77e98bc 100644 --- a/meals.py +++ b/meals.py @@ -18,12 +18,13 @@ meals_bp = Blueprint("meals", __name__) def login_required(f): - """Decorator: redirect to login if not authenticated.""" + """Decorator: redirect to login if not authenticated or session is stale.""" from functools import wraps @wraps(f) def wrapper(*args, **kwargs): - if "user_id" not in session: + if "user_id" not in session or "household_id" not in session: + session.clear() return redirect(url_for("auth.login")) return f(*args, **kwargs) @@ -51,6 +52,10 @@ def dashboard(): except ValueError: flash("Invalid date format. Use YYYY-MM-DD.", "error") + if household_id is None: + session.clear() + return redirect(url_for("auth.login")) + data = get_dashboard_data(today, household_id) return render_template( "dashboard.html",