From 8e775e0429852f465e37d2a303bdf2bee62ed5ca Mon Sep 17 00:00:00 2001
From: "2569718930@qq.com" <2569718930@qq.com>
Date: Sun, 14 Jun 2026 03:01:12 +0800
Subject: [PATCH] Avoid account feedback 401 before auth

---
 .../account/AccountFeedbackPanel.tsx          | 24 ++++++++++++++++++-
 .../__tests__/accountFeedbackPanel.test.ts    | 14 +++++++++++
 2 files changed, 37 insertions(+), 1 deletion(-)

diff --git a/frontend/components/account/AccountFeedbackPanel.tsx b/frontend/components/account/AccountFeedbackPanel.tsx
index fd572945..a4786c7d 100644
--- a/frontend/components/account/AccountFeedbackPanel.tsx
+++ b/frontend/components/account/AccountFeedbackPanel.tsx
@@ -7,6 +7,10 @@ import {
   feedbackStatusLabel,
   feedbackStatusTone,
 } from "@/components/dashboard/scan-terminal/feedback-status";
+import {
+  getSupabaseBrowserClient,
+  hasSupabasePublicEnv,
+} from "@/lib/supabase/client";
 
 function compactDate(value?: string) {
   if (!value) return "--";
@@ -97,9 +101,27 @@ export function AccountFeedbackPanel({
     setLoading(true);
     setError("");
     try {
+      if (!hasSupabasePublicEnv()) {
+        setAvailable(false);
+        setEntries([]);
+        return;
+      }
+      const {
+        data: { session },
+      } = await getSupabaseBrowserClient().auth.getSession();
+      if (signal?.aborted) return;
+      const accessToken = String(session?.access_token || "").trim();
+      if (!accessToken) {
+        setAvailable(false);
+        setEntries([]);
+        return;
+      }
       const res = await fetch("/api/feedback?limit=10", {
         cache: "no-store",
-        headers: { Accept: "application/json" },
+        headers: {
+          Accept: "application/json",
+          Authorization: `Bearer ${accessToken}`,
+        },
         signal,
       });
       if (res.status === 401 || res.status === 403) {
diff --git a/frontend/components/account/__tests__/accountFeedbackPanel.test.ts b/frontend/components/account/__tests__/accountFeedbackPanel.test.ts
index aba6425b..81a95aa3 100644
--- a/frontend/components/account/__tests__/accountFeedbackPanel.test.ts
+++ b/frontend/components/account/__tests__/accountFeedbackPanel.test.ts
@@ -31,6 +31,20 @@ export function runTests() {
       !feedbackPanelSource.includes("setInterval"),
     "account feedback panel must load the current user's feedback once, support manual refresh, and avoid polling",
   );
+  const sessionLookupIndex = feedbackPanelSource.indexOf(".auth.getSession()");
+  const feedbackFetchIndex = feedbackPanelSource.indexOf("/api/feedback?limit=10");
+  assert(
+    feedbackPanelSource.includes("getSupabaseBrowserClient") &&
+      feedbackPanelSource.includes("hasSupabasePublicEnv") &&
+      sessionLookupIndex >= 0 &&
+      feedbackFetchIndex >= 0 &&
+      sessionLookupIndex < feedbackFetchIndex &&
+      feedbackPanelSource.includes("accessToken") &&
+      feedbackPanelSource.includes("Authorization: `Bearer ${accessToken}`") &&
+      feedbackPanelSource.includes("if (!accessToken)") &&
+      feedbackPanelSource.includes("setAvailable(false)"),
+    "account feedback panel must avoid unauthenticated 401 requests by checking the browser session before fetching feedback",
+  );
   assert(
     feedbackPanelSource.includes("reward_points") &&
       feedbackPanelSource.includes("reward_reason") &&