Review fixes

ScriptSmith · ScriptSmith · commit 101010c2df18 · 2026-03-19T23:13:52.000+10:00
diff --git a/src/routes/admin/me_sessions.rs b/src/routes/admin/me_sessions.rs
@@ -61,11 +61,16 @@ pub async fn list(
     let session_store = get_session_store(&state)?;
     let enhanced_enabled = session_store.is_enhanced_enabled();
 
-    // Extract current session ID from cookie so the UI can highlight it
-    let session_config = state.config.auth.session_config_or_default();
-    let current_session_id = cookies
-        .get(&session_config.cookie_name)
-        .and_then(|c| c.value().parse::<Uuid>().ok());
+    // Extract current session ID from cookie so the UI can highlight it.
+    // Only include when enhanced sessions are enabled to avoid leaking the session UUID.
+    let current_session_id = if enhanced_enabled {
+        let session_config = state.config.auth.session_config_or_default();
+        cookies
+            .get(&session_config.cookie_name)
+            .and_then(|c| c.value().parse::<Uuid>().ok())
+    } else {
+        None
+    };
 
     let sessions = session_store
         .list_user_sessions(external_id)
@@ -140,14 +145,14 @@ pub async fn delete_one(
         }
     };
 
-    let sessions_revoked = match session_store.delete_session(session_id).await {
-        Ok(_) if session_existed => 1,
-        Ok(_) => 0,
-        Err(e) => {
-            return Err(AdminError::Internal(format!(
-                "Failed to delete session: {e}"
-            )));
-        }
+    let sessions_revoked = if !session_existed {
+        0
+    } else {
+        session_store
+            .delete_session(session_id)
+            .await
+            .map_err(|e| AdminError::Internal(format!("Failed to delete session: {e}")))?;
+        1
     };
 
     if session_existed {
diff --git a/ui/src/pages/AccountPage.tsx b/ui/src/pages/AccountPage.tsx
@@ -75,7 +75,11 @@ export default function AccountPage() {
   });
 
   // Sessions
-  const { data: sessions, isLoading: sessionsLoading } = useQuery(meSessionsListOptions());
+  const {
+    data: sessions,
+    isLoading: sessionsLoading,
+    isError: sessionsError,
+  } = useQuery(meSessionsListOptions());
 
   const deleteSessionMutation = useMutation({
     ...meSessionsDeleteOneMutation(),
@@ -306,6 +310,8 @@ export default function AccountPage() {
               <Skeleton className="h-24 w-full" />
               <Skeleton className="h-24 w-full" />
             </div>
+          ) : sessionsError ? (
+            <p className="text-sm text-destructive">Failed to load sessions. Please try again.</p>
           ) : sessions?.enhanced_enabled === false ? (
             <p className="text-sm text-muted-foreground">
               Session tracking is not enabled for this deployment.
