3c26eb4ba5b2fee15cabe2cf39748cf2de327abb
The login JWT and the per-seat rejoin token shared the localStorage key 'shelem_token', so joining a game overwrote the auth token with the random seat token. The socket then reconnected as an unauthenticated guest, so every seat was recorded with userId=null and no stats or history were attributed. - Seat token now uses its own key 'shelem_seat_token'; 'shelem_token' is auth-only - Add GET /api/me + boot-time validateAuth() to drop stale/corrupted tokens instead of running as a "logged in" ghost - reauthSocket() re-authenticates the live socket on login/register Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Description
No description provided
Languages
JavaScript
66.6%
CSS
20.8%
HTML
11.9%
Shell
0.4%
Dockerfile
0.3%