From 3e27472c8aaf836e855a7163f5a2829395655ccc Mon Sep 17 00:00:00 2001
From: Fringg <egor.andrianovv@gmail.com>
Date: Sun, 22 Mar 2026 07:24:45 +0300
Subject: [PATCH] fix: clear all cached auth state on Telegram MiniApp retry

When users hit 'Try Again' after auth failure, clear ALL cached state
(tokens, SDK launch params, initData, zustand persist, tg_user_id)
to prevent stale token loops. Applies to both Login and TelegramRedirect
retry handlers.
---
 src/pages/Login.tsx            | 13 ++++++++++---
 src/pages/TelegramRedirect.tsx |  9 +++++++++
 2 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/src/pages/Login.tsx b/src/pages/Login.tsx
index eb3e628..adf0f8b 100644
--- a/src/pages/Login.tsx
+++ b/src/pages/Login.tsx
@@ -15,7 +15,7 @@ import {
   type BrandingInfo,
   type EmailAuthEnabled,
 } from '../api/branding';
-import { getAndClearReturnUrl } from '../utils/token';
+import { getAndClearReturnUrl, tokenStorage } from '../utils/token';
 import { isInTelegramWebApp, getTelegramInitData, useTelegramSDK } from '../hooks/useTelegramSDK';
 import { closeMiniApp } from '@telegram-apps/sdk-react';
 import LanguageSwitcher from '../components/LanguageSwitcher';
@@ -205,11 +205,18 @@ export default function Login() {
   }, [isAuthInitializing, loginWithTelegram, navigate, t, getReturnUrl]);
 
   const handleRetryTelegramAuth = () => {
+    // Clear ALL cached auth state to prevent stale token/initData loops
+    tokenStorage.clearTokens();
+    sessionStorage.removeItem('tapps/launchParams');
+    sessionStorage.removeItem('telegram_init_data');
+    localStorage.removeItem('cabinet-auth');
+    localStorage.removeItem('tg_user_id');
+
     try {
-      sessionStorage.removeItem('tapps/launchParams');
-      sessionStorage.removeItem('telegram_init_data');
+      // Close miniapp — Telegram will provide fresh initData on reopen
       closeMiniApp();
     } catch {
+      // If closeMiniApp fails, force a clean page reload
       window.location.reload();
     }
   };
diff --git a/src/pages/TelegramRedirect.tsx b/src/pages/TelegramRedirect.tsx
index 107a8ef..8ca1bcb 100644
--- a/src/pages/TelegramRedirect.tsx
+++ b/src/pages/TelegramRedirect.tsx
@@ -6,6 +6,7 @@ import { useAuthStore } from '../store/auth';
 import { useShallow } from 'zustand/shallow';
 import { brandingApi } from '../api/branding';
 import { isInTelegramWebApp, getTelegramInitData } from '../hooks/useTelegramSDK';
+import { tokenStorage } from '../utils/token';
 
 // Validate redirect URL to prevent open redirect attacks
 const getSafeRedirectUrl = (url: string | null): string => {
@@ -117,6 +118,14 @@ export default function TelegramRedirect() {
     const newCount = retryCount + 1;
     setRetryCount(newCount);
     sessionStorage.setItem(RETRY_COUNT_KEY, String(newCount));
+
+    // Clear all cached auth state to prevent stale token/initData loops
+    tokenStorage.clearTokens();
+    sessionStorage.removeItem('tapps/launchParams');
+    sessionStorage.removeItem('telegram_init_data');
+    localStorage.removeItem('cabinet-auth');
+    localStorage.removeItem('tg_user_id');
+
     setStatus('loading');
     setErrorMessage('');
     window.location.reload();