fix: address Chip's review — secure auth, wire TanStack Query, fix UX issues

Must-fix: - Exclude JWT token from Zustand persist (partialize) to prevent localStorage XSS exfiltration — token now lives in memory only - Wire all pages through TanStack Query hooks (usePurchases, useProduct, useProducts, usePriceHistory, useCoupons, usePriceAlerts) with proper loading skeletons and error states - Add mock interceptor in api.ts (VITE_MOCK_API=true) so mock data flows through the same fetch path — single flag to switch to live API Should-fix: - Wire theme toggle to DOM (dark class on <html>) - Fix AccountLinking form inputs (controlled with value/onChange) - Remove unused err in catch blocks (Login, Register) - Bump remaining min-h-10 touch targets to min-h-12 (48px) Build: 128KB initial JS, Recharts 498KB lazy chunk. 5/5 tests pass. Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-03-18 11:54:06 +00:00
parent 034f12d0aa
commit fe5b0e87bd
14 changed files with 307 additions and 62 deletions
@@ -33,7 +33,7 @@ export function Register() {
      const res = await api.post<{ user: User; token: string }>('/auth/register', { name, email, password })
      setAuth(res.user, res.token)
      navigate('/')
-    } catch (err) {
+    } catch {
      if (import.meta.env.VITE_MOCK_AUTH === 'true') {
        // Fallback to mock auth for demo
        setAuth({ ...mockUser, name, email }, 'mock-jwt-token')