From 7ac1d1473860796ea0925dd77454218f2b1f0020 Mon Sep 17 00:00:00 2001
From: Luca <102960244+Luca-Timo@users.noreply.github.com>
Date: Mon, 11 May 2026 11:32:59 +0200
Subject: [PATCH] fix(customer): preserve slug-scoped gallery tokens on auth
 provider mount

---
 frontend/src/utils/cleanupGalleryAuth.ts | 67 +++++++++++-------------
 1 file changed, 31 insertions(+), 36 deletions(-)

diff --git a/frontend/src/utils/cleanupGalleryAuth.ts b/frontend/src/utils/cleanupGalleryAuth.ts
index ff5751c1..ae049a52 100644
--- a/frontend/src/utils/cleanupGalleryAuth.ts
+++ b/frontend/src/utils/cleanupGalleryAuth.ts
@@ -1,42 +1,37 @@
-// Cleanup function to remove old gallery authentication data
+/**
+ * Cleanup helper for legacy gallery-auth artefacts.
+ *
+ * Removes pre-multi-gallery storage:
+ *   - global `gallery_token` / `gallery_event` keys in localStorage AND
+ *     sessionStorage (the old single-gallery shape).
+ *   - the bare `gallery_token` cookie (now replaced by slug-scoped
+ *     `gallery_token_<slug>` cookies).
+ *
+ * Does NOT wipe slug-scoped sessionStorage entries any more — the
+ * previous version did, which broke the customer-dashboard → gallery
+ * handoff. CustomerDashboardPage stores
+ * `sessionStorage.gallery_token_<slug>` immediately before navigating
+ * to /gallery/<slug>; GalleryAuthProvider then mounts and ran this
+ * cleanup as its first effect, wiping the just-set entry and forcing
+ * the user back to the per-event password prompt even though their
+ * customer JWT had just been exchanged for a valid gallery JWT.
+ *
+ * Slug-scoped storage is owned by GalleryAuthProvider itself (cleared
+ * on logout, token invalidation, archived event) — this helper has
+ * no business sweeping it.
+ */
 export const cleanupOldGalleryAuth = () => {
-  // Remove old global gallery authentication
+  // Legacy global keys (pre-multi-gallery shape).
   localStorage.removeItem('gallery_event');
-  localStorage.removeItem('gallery_token'); // Remove old global token format
-  
-  // Remove any corrupted or old gallery tokens from localStorage
-  const keysToRemove: string[] = [];
-  for (let i = 0; i < localStorage.length; i++) {
-    const key = localStorage.key(i);
-    if (key && (key.startsWith('gallery_token') || key.startsWith('gallery_event'))) {
-      keysToRemove.push(key);
-    }
-  }
-  
-  keysToRemove.forEach(key => {
-    localStorage.removeItem(key);
-  });
-  
-  // Remove old gallery token from cookies if it exists
-  document.cookie = 'gallery_token=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/;';
-  
-  // Also clear session storage
+  localStorage.removeItem('gallery_token');
   sessionStorage.removeItem('gallery_event');
   sessionStorage.removeItem('gallery_token');
+
+  // Legacy bare cookie (path=/, no slug suffix). Slug-scoped
+  // `gallery_token_<slug>` cookies are kept — they're how the customer
+  // dashboard hands off auth to /gallery/<slug>.
+  document.cookie = 'gallery_token=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/;';
+
+  // gallery_active_slug is a UI hint, not auth. Safe to drop.
   sessionStorage.removeItem('gallery_active_slug');
-
-  // Remove slug-specific session storage entries as well
-  try {
-    const sessionKeysToRemove: string[] = [];
-    for (let i = 0; i < sessionStorage.length; i += 1) {
-      const key = sessionStorage.key(i);
-      if (key && (key.startsWith('gallery_event_') || key.startsWith('gallery_token_'))) {
-        sessionKeysToRemove.push(key);
-      }
-    }
-
-    sessionKeysToRemove.forEach((key) => sessionStorage.removeItem(key));
-  } catch {
-    // Session storage may be unavailable; ignore cleanup failures
-  }
 };