fix(#351): CSRF-403 bei KI-Chat und Wiki-Save behoben — /auth/me liefert csrf_token, streamChat nutzt gemeinsamen Client-Token statt totem sessionStorage-Key; Regressionstests pytest+vitest

2026-08-27 11:03:24 +02:00
parent 9510b3a7c9
commit ebf4b0363c
6 changed files with 93 additions and 3 deletions
@@ -162,6 +162,8 @@ class AuthService:
            "is_system_admin": session_data.get("is_system_admin", False),
            "tenant_id": session_data["tenant_id"],
            "tenant_name": tenant.name if tenant else None,
+            # CSRF token from session — lets the frontend restore it on reload
+            "csrf_token": session_data.get("csrf_token"),
        }

    async def switch_tenant(