[Bug] Login shows success and redirects without verifying an auth token was returned

[ionfwsrijan]

Description

In src/app/login/page.jsx, login success is determined purely by "no exception was thrown." loginUser only throws on a non-2xx HTTP status; if the API returns 200 OK with no token (e.g. email unverified, or a body without credentials), loginUser stores nothing and returns. The page then shows "Login Successful!" and pushes to /dashboard.

try {
  await loginUser({ usernameOrEmail: email, password });
  setSuccess(true);
  setTimeout(() => router.push("/dashboard"), 800);
} catch (err) {
  setErrorMsg(err.message || "Invalid username/email or password.");
}

Expected Behavior

Verify the response actually contains a session token before treating login as successful; otherwise show an error (e.g. "Account not verified").

Actual Behavior

Users are shown a success banner and navigated to a (presumably) protected dashboard while not actually authenticated. Navbar's checkAuth then finds no token and renders the logged-out state — contradictory UI feedback (success banner + logged-out nav).

Proposed Fix

const data = await loginUser({ usernameOrEmail: email, password });
if (!data?.token) {
  setErrorMsg("Login succeeded but no session was created. Please verify your account or contact support.");
  return;
}
setSuccess(true);
setTimeout(() => router.push("/dashboard"), 800);

References

• src/app/login/page.jsx:23-37