fix: invalid-credentials code, no refresh on wrong pw

spa/src/components/delete-account-dialog.tsx

@@ -80,6 +80,7 @@ export function DeleteAccountDialog({
             <Input
               id="delete-password"
               type="password"
+              autoFocus
               autoComplete="current-password"
               value={password}
               onChange={(e) => setPassword(e.target.value)}

spa/src/features/users.ts

@@ -242,7 +242,10 @@ export function useAdminDeleteUser() {
   return useMutation({
     mutationFn: ({ id, password }: DeleteAccountRequest & { id: string }) =>
       delWithBody(`/users/${id}`, { password }),
-    onSuccess: () => {
+    onSuccess: (_data, { id }) => {
+      qc.removeQueries({
+        predicate: (q) => q.queryKey[0] === userKeys.all[0] && q.queryKey[1] === id,
+      })
       qc.invalidateQueries({ queryKey: userKeys.all })
       qc.invalidateQueries({ queryKey: ["activity-feed"] })
     },

spa/src/lib/api/client.ts

@@ -68,6 +68,15 @@ async function tryRefresh(): Promise<boolean> {
   }
 }
 
+async function isInvalidCredentials(res: Response): Promise<boolean> {
+  try {
+    const body = await res.clone().json()
+    return body?.code === "INVALID_CREDENTIALS"
+  } catch {
+    return false
+  }
+}
+
 async function request<T = void>(
   url: string,
   options?: RequestInit,
@@ -81,6 +90,11 @@ async function request<T = void>(
   })
   if (!res.ok) {
     if (res.status === 401) {
+      // A failed re-auth check (wrong password) is not an expired session:
+      // no refresh, no retry, no logout.
+      if (await isInvalidCredentials(res)) {
+        throw new ApiError(res.status, await res.text())
+      }
       if (url.includes("/auth/refresh") || url.includes("/auth/login")) {
         clearAuth()
         window.location.href = "/app/login"

spa/src/locales/en.json

@@ -211,7 +211,7 @@
     "done": "User deleted",
     "errors": {
       "wrongPassword": "Wrong password",
-      "lastAdmin": "You are the last admin and cannot be deleted",
+      "lastAdmin": "The last admin account cannot be deleted",
       "forbidden": "Only admins can delete other users",
       "notFound": "User not found",
       "generic": "Could not delete account"