scalableminds / webknossos

Visualize, share and annotate your large 3D images online
https://webknossos.org
GNU Affero General Public License v3.0
127 stars 24 forks source link

Remove token from URL if identified as less privileged as a user token #8140

Open MichaelBuessemeyer opened 3 weeks ago

MichaelBuessemeyer commented 3 weeks ago

When sending a backend request with an insufficient token taken from the annotation URL the frontend now retries to use the user's personal token instead. Upon successful request, the frontend now only remembers not to use the token from the URL again. But it would be better if the token would be fully removed from the URL.

The reason is why this was not initially implemented this way is due to newly created cyclic dependencies: Check https://github.com/scalableminds/webknossos/pull/8139#issuecomment-2429095718

Detailed Description

Context

In case a user opens an annotation with an outdated token or the user itself has permissions to update the annotation but not the token, each first time the frontend notices that it should use the user token an error toast is shown to the user.

To avoid this same behaviour over and over again after each page reload, the insufficient token should be removed from the URL. (IMO)

Other related links: https://github.com/scalableminds/webknossos/issues/7309 and PR that "fixes" this behaviour https://github.com/scalableminds/webknossos/pull/8139