# Auth Redirect Loop

## Pattern

`index.html` line 131 checks localStorage for a `pocketbase_auth` token with a blind truthy check:

```javascript
if(localStorage.getItem('pocketbase_auth')){location.replace('dashboard.html?cb='+Date.now())}
```

This fires BEFORE PocketBase SDK loads. Any string in that key — including stale/expired tokens — triggers a redirect to `dashboard.html`.

Then `dashboard.js` (line 113-124) calls `onAuthStateChanged`. If the auth is invalid:
```javascript
onAuthStateChanged(auth, (user) => {
    if (user) { ... }
    else { window.location.href = 'index.html'; }
});
```

The redirect back to `index.html` does NOT clear the stale `pocketbase_auth` from localStorage. So `index.html` line 131 fires again → infinite loop.

## Fix

Every JS file that redirects back to `index.html` on auth failure MUST clear the stale token first:

```javascript
localStorage.removeItem('pocketbase_auth');
window.location.href = 'index.html';
```

**Files requiring this fix:**
- `dashboard.js` — `onAuthStateChanged` callback, `user == null` path
- `appointments.js` — auth check in init (line ~49)
- `repair-orders.js` — auth check in init (line ~57)

The `shared/header-functionality.js` logout path already calls `signOut(auth)` which calls `pb.authStore.clear()`, so it's fine.

## Diagnostics

If the user reports a redirect loop (page flashes between URLs), check:
1. Does `localStorage.getItem('pocketbase_auth')` return a value? → stale token
2. Do the bounce-back paths clear it? → likely not
3. Cache: old JS files with `login.html` references are a separate browser-cache issue (hard reload needed)
