From 147dc28440ca69ed970677fa221dfac00c8e2560 Mon Sep 17 00:00:00 2001
From: Paul Nothaft <paul@MacStudio-von-Paul.local>
Date: Thu, 9 Apr 2026 16:05:53 +0200
Subject: [PATCH] fix: apply password change redirect fix to regular modal too
 (#263)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The redirect loop fix only covered MandatoryPasswordChangeModal.
The regular PasswordChangeModal (profile settings) had the same
issue — onSuccess updated React state but didn't handle the new
JWT cookie, causing the same redirect loop.

Also increase redirect delay from 500ms to 2000ms in both modals
so the success toast is visible before the page reloads.
---
 .../admin/MandatoryPasswordChangeModal.tsx         |  2 +-
 .../src/components/admin/PasswordChangeModal.tsx   | 14 ++++++--------
 2 files changed, 7 insertions(+), 9 deletions(-)

diff --git a/frontend/src/components/admin/MandatoryPasswordChangeModal.tsx b/frontend/src/components/admin/MandatoryPasswordChangeModal.tsx
index 1f2bc88f..fad6753d 100644
--- a/frontend/src/components/admin/MandatoryPasswordChangeModal.tsx
+++ b/frontend/src/components/admin/MandatoryPasswordChangeModal.tsx
@@ -32,7 +32,7 @@ export const MandatoryPasswordChangeModal: React.FC = () => {
       // where the auth context checks the session before the cookie is stored.
       setTimeout(() => {
         window.location.href = '/admin/dashboard';
-      }, 500);
+      }, 2000);
     },
     onError: (error: any) => {
       if (error.response?.data?.error) {
diff --git a/frontend/src/components/admin/PasswordChangeModal.tsx b/frontend/src/components/admin/PasswordChangeModal.tsx
index b7ac3472..88ce4de8 100644
--- a/frontend/src/components/admin/PasswordChangeModal.tsx
+++ b/frontend/src/components/admin/PasswordChangeModal.tsx
@@ -30,14 +30,12 @@ export const PasswordChangeModal: React.FC<PasswordChangeModalProps> = ({ isOpen
     mutationFn: adminService.changePassword,
     onSuccess: () => {
       toast.success(t('passwordChange.success'));
-      onClose();
-      // Reset form
-      setFormData({
-        currentPassword: '',
-        newPassword: '',
-        confirmPassword: ''
-      });
-      setErrors({});
+      // Full page reload so the browser picks up the new JWT cookie.
+      // Same fix as MandatoryPasswordChangeModal — without this, the old
+      // token gets rejected and causes a redirect loop.
+      setTimeout(() => {
+        window.location.href = '/admin/dashboard';
+      }, 2000);
     },
     onError: (error: any) => {
       if (error.response?.data?.error) {