lgtm

frontend/src/hooks/useAuth.ts

@@ -23,6 +23,11 @@ function recordToUser(record: { id: string; [key: string]: unknown }): AuthUser
   };
 }
 
+function authRefreshInvalidated(error: unknown): boolean {
+  const status = (error as { status?: unknown })?.status;
+  return status === 401 || status === 403;
+}
+
 export function useAuth() {
   const [user, setUser] = useState<AuthUser | null>(() => {
     if (pb.authStore.isValid && pb.authStore.record) {
@@ -128,12 +133,16 @@ export function useAuth() {
     setError(null);
     try {
       const result = await pb.collection('users').authRefresh();
-      setUser(recordToUser(result.record));
+      const refreshedUser = recordToUser(result.record);
+      setUser(refreshedUser);
+      return refreshedUser;
     } catch (err) {
-      // Token is invalid/expired — clear auth state but don't set error,
-      // since this is a background refresh, not a user-initiated action
-      pb.authStore.clear();
-      setUser(null);
+      // Only clear auth on explicit token rejection. Network and 5xx failures
+      // should not log users out during background refresh.
+      if (authRefreshInvalidated(err)) {
+        pb.authStore.clear();
+        setUser(null);
+      }
       throw err;
     } finally {
       setLoading(false);