From 1bacc58648675538a679e894ecd8fd99f8626402 Mon Sep 17 00:00:00 2001
From: Robin Dittmar <robindittmar@gmail.com>
Date: Mon, 31 Aug 2026 22:41:50 +0200
Subject: [PATCH] fix: invite links now will not redirect to login

---
 src/stores/__tests__/lists.spec.ts | 15 +++++++++++++++
 src/stores/lists.ts                |  2 ++
 2 files changed, 17 insertions(+)

diff --git a/src/stores/__tests__/lists.spec.ts b/src/stores/__tests__/lists.spec.ts
index d73b052..7db67df 100644
--- a/src/stores/__tests__/lists.spec.ts
+++ b/src/stores/__tests__/lists.spec.ts
@@ -140,6 +140,11 @@ describe('useListsStore', () => {
 
     Object.defineProperty(navigator, 'onLine', { value: true, configurable: true })
 
+    // sync() is a no-op for anonymous visitors (see lists.ts); these tests
+    // exercise the authenticated sync path, so seed a logged-in session.
+    localStorage.setItem('access_token', 'test-access-token')
+    localStorage.setItem('refresh_token', 'test-refresh-token')
+
     // Default the read endpoints to an empty result so that the pullFromServer()
     // step chained onto every sync() call doesn't interfere with unrelated tests.
     listsApiMocks.getListsApi.mockResolvedValue([])
@@ -244,6 +249,16 @@ describe('useListsStore', () => {
     expect(store.pendingCount).toBe(1)
   })
 
+  it('does not attempt to sync when logged out, e.g. an anonymous visitor on a public invite link', async () => {
+    localStorage.removeItem('access_token')
+    localStorage.removeItem('refresh_token')
+
+    const store = useListsStore()
+    await store.sync()
+
+    expect(listsApiMocks.getListsApi).not.toHaveBeenCalled()
+  })
+
   it('sets a list item completed locally and pushes it via the dedicated endpoint', async () => {
     listsApiMocks.createListItemApi.mockResolvedValueOnce({
       id: 'server-item-3',
diff --git a/src/stores/lists.ts b/src/stores/lists.ts
index 27e17ce..ad8d686 100644
--- a/src/stores/lists.ts
+++ b/src/stores/lists.ts
@@ -1,5 +1,6 @@
 import { ref, computed } from 'vue'
 import { defineStore } from 'pinia'
+import { useAuthStore } from '@/stores/auth'
 import {
   db,
   type LocalList,
@@ -438,6 +439,7 @@ export const useListsStore = defineStore('lists', () => {
       return ongoingSync
     }
     if (typeof navigator !== 'undefined' && !navigator.onLine) return
+    if (!useAuthStore().isAuthenticated) return
 
     ongoingSync = enqueueOperation(() => runSync().then(() => pullFromServer()))
     try {