fix: auth + double sending etc

apps/dashboard/src/lib/api/client.ts

@@ -47,10 +47,13 @@ async function request(endpoint: string, init: RequestInit): Promise<Response> {
   }
 }
 
+// A 401 from these is the answer itself (wrong password, session over), not an expired access token
+const NO_REFRESH_ENDPOINTS = ['/auth/login', '/auth/refresh', '/auth/logout'];
+
 export async function api<T = unknown>(endpoint: string, init: RequestInit = {}): Promise<T> {
   let res = await request(endpoint, init);
 
-  if (res.status === 401 && !endpoint.startsWith('/auth/')) {
+  if (res.status === 401 && !NO_REFRESH_ENDPOINTS.includes(endpoint)) {
     if (await refreshSession()) {
       res = await request(endpoint, init);
     } else {

apps/dashboard/src/locales/en.json

@@ -507,6 +507,8 @@
   "admin.purge.target.tabEvents_hint": "What the terminals reported, drink by drink",
   "admin.purge.target.auditLog": "Audit log",
   "admin.purge.target.auditLog_hint": "Who did what on the dashboard",
+  "admin.purge.target.refreshTokens": "Ended sessions",
+  "admin.purge.target.refreshTokens_hint": "Dashboard sign-ins that expired or were signed out; active sessions stay",
   "admin.purge.days": "Older than (days)",
   "admin.purge.preview": "Preview…",
   "admin.purge.confirm_desc": "Everything older than {days} days:",

apps/dashboard/src/locales/nl.json

@@ -507,6 +507,8 @@
   "admin.purge.target.tabEvents_hint": "Wat de kassa's doorgaven, drankje per drankje",
   "admin.purge.target.auditLog": "Logboek",
   "admin.purge.target.auditLog_hint": "Wie wat deed op het dashboard",
+  "admin.purge.target.refreshTokens": "Beëindigde sessies",
+  "admin.purge.target.refreshTokens_hint": "Aanmeldingen op het dashboard die verlopen of afgemeld zijn; actieve sessies blijven",
   "admin.purge.days": "Ouder dan (dagen)",
   "admin.purge.preview": "Voorbeeld…",
   "admin.purge.confirm_desc": "Alles ouder dan {days} dagen:",