mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-10 05:12:14 +00:00
Marc-André Bombeck
ce3c844a58
`POST /api/auth/register` read no session at all, so a request carrying a valid `healthlog_session` was handled exactly like an anonymous one and the unconditional `createSession` at the end replaced the caller's cookie with the new account's. An admin opening his own invite link to check it was signed out of his admin account and into a stranger's onboarding, his previous session row still valid server-side and no longer reachable. The route now resolves the optional session first and refuses with 409 `already_authenticated`, before the rate-limit bucket is spent and before the invitation is consumed, so a signed-in visitor neither burns a use nor locks the door for the person the invitation is for. The register page renders an explaining panel with a sign-out button in place of the form, so nobody has to fill three inputs to discover the refusal; signing out returns to the same invitation rather than to the login screen. Copy lands in all seven locales.