mirror of
https://github.com/HeyPuter/puter.git
synced 2026-09-13 08:45:45 +00:00
Nariman Jelveh
fdd86ceb03
The shell renders its anonymous markup — the marketing homepage, an `/app/<name>` landing — off the session cookie alone, and that cookie is set with no maxAge, so a browser drops it on quit while the GUI's localStorage token lives on. A returning user is served the anonymous page and the GUI only tears it down once `whoami` answers, a network round-trip after first paint. That teardown is the flash. Gate it before the paint instead. The shell now emits, as the first thing in <head>, a rule hiding `.hide-if-logged-in` under an <html> class that an inline script adds iff `auth_token_v2` is in localStorage. The rule is already in the cascade when the markup is parsed, so a browser holding a token never paints it at all. `initgui` settles the guess the token represents: `whoami` confirming the session removes the nodes outright (replacing the old `#appLanding` removal), and no session — none stored, or one `whoami` rejected — drops the class so the markup comes back. The gate carries its own 12s failsafe so a bundle that never boots can't strand a blank page. SEO is unaffected: the HTML is byte-identical for every client, nothing branches on user-agent, and a crawler has no stored token so it never adds the class. Unreadable storage fails open the same way. Anonymous markup opts in with `class="hide-if-logged-in"`, which `home.html` already carried.