Merge remote-tracking branch 'origin/master'

ui/src/services/api.js

@@ -1,9 +1,7 @@
-// src/services/api.js
 import axios from 'axios'
 import qs from 'qs'
 import { useAuthStore } from 'stores/authStore'
 
-// 🔥 ENV YOK
 export const API_BASE_URL = '/api'
 
 const api = axios.create({
@@ -38,17 +36,22 @@ api.interceptors.response.use(
   r => r,
   async (error) => {
     const status = error?.response?.status
+    const requestUrl = String(error?.config?.url || '')
     const hasBlob = typeof Blob !== 'undefined' && error?.response?.data instanceof Blob
+    const isPasswordChangeRequest =
+      requestUrl.startsWith('/password/change') ||
+      requestUrl.startsWith('/me/password')
 
     if ((status >= 500 || hasBlob) && error) {
       const method = String(error?.config?.method || 'GET').toUpperCase()
-      const url = error?.config?.url || ''
       const detail = await extractApiErrorDetail(error)
       error.parsedMessage = detail
-      console.error(`❌ API ${status || '-'} ${method} ${url}: ${detail}`)
+      console.error(`API ${status || '-'} ${method} ${requestUrl}: ${detail}`)
     }
 
-    if (error?.response?.status === 401 && !isLoggingOut) {
+    // Password change endpoints may return 401 for business reasons
+    // (for example current password mismatch). Keep session in that case.
+    if (status === 401 && !isPasswordChangeRequest && !isLoggingOut) {
       isLoggingOut = true
       try {
         useAuthStore().clearSession()
@@ -56,6 +59,7 @@ api.interceptors.response.use(
         isLoggingOut = false
       }
     }
+
     return Promise.reject(error)
   }
 )