From e1fe1980ea0dbd4ad6234fb6d311d2c3412f2861 Mon Sep 17 00:00:00 2001
From: Stan Grams <sjg@haxx.space>
Date: Tue, 10 Mar 2026 19:52:24 +0100
Subject: [PATCH] [fix](trx-frontend-http): fix decode history invisible on
 first load

Two root causes:

1. /decode/history was classified as Control in the auth router (not listed
   in Read routes), so it returned 401/403 when auth is enabled and the
   user had no session or rx-only role. Add it to the Read route list.

2. connectDecode() was called from window.load unconditionally, before the
   auth flow completed. On first load with auth enabled the session cookie
   doesn't exist yet, so the history fetch fails silently. Move the call to
   be alongside connect() in initializeApp(), login, and guest handlers so
   it always runs with valid auth context.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Stan Grams <sjg@haxx.space>
---
 .../trx-frontend-http/assets/web/app.js             | 13 ++++++-------
 .../trx-frontend/trx-frontend-http/src/auth.rs      |  2 ++
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/src/trx-client/trx-frontend/trx-frontend-http/assets/web/app.js b/src/trx-client/trx-frontend/trx-frontend-http/assets/web/app.js
index 8e8ba35..4f5d5ad 100644
--- a/src/trx-client/trx-frontend/trx-frontend-http/assets/web/app.js
+++ b/src/trx-client/trx-frontend/trx-frontend-http/assets/web/app.js
@@ -3425,6 +3425,7 @@ async function initializeApp() {
     hideAuthGate();
     updateAuthUI();
     connect();
+    connectDecode();
     resizeHeaderSignalCanvas();
     startHeaderSignalSampling();
     return;
@@ -3437,6 +3438,7 @@ async function initializeApp() {
     updateAuthUI();
     applyAuthRestrictions();
     connect();
+    connectDecode();
     resizeHeaderSignalCanvas();
     startHeaderSignalSampling();
   } else {
@@ -3463,6 +3465,7 @@ document.getElementById("auth-form").addEventListener("submit", async (e) => {
     updateAuthUI();
     applyAuthRestrictions();
     connect();
+    connectDecode();
     resizeHeaderSignalCanvas();
     startHeaderSignalSampling();
   } catch (err) {
@@ -3484,6 +3487,7 @@ if (guestBtn) {
     updateAuthUI();
     applyAuthRestrictions();
     connect();
+    connectDecode();
     resizeHeaderSignalCanvas();
     startHeaderSignalSampling();
   });
@@ -6235,13 +6239,8 @@ function connectDecode() {
     }
   }).catch(() => { clearTimeout(historyTimeout); flushLiveBuffer(); });
 }
-if (document.readyState === "complete") {
-  connectDecode();
-} else {
-  window.addEventListener("load", () => {
-    connectDecode();
-  }, { once: true });
-}
+// connectDecode() is called from initializeApp() after auth succeeds,
+// and from login/guest handlers — no standalone window.load call needed.
 
 // Release PTT on page unload to prevent stuck transmit
 window.addEventListener("beforeunload", () => {
diff --git a/src/trx-client/trx-frontend/trx-frontend-http/src/auth.rs b/src/trx-client/trx-frontend/trx-frontend-http/src/auth.rs
index 7567042..0bb978e 100644
--- a/src/trx-client/trx-frontend/trx-frontend-http/src/auth.rs
+++ b/src/trx-client/trx-frontend/trx-frontend-http/src/auth.rs
@@ -423,6 +423,7 @@ impl RouteAccess {
             || path == "/rigs"
             || path == "/events"
             || path == "/decode"
+            || path == "/decode/history"
             || path == "/spectrum"
             || path == "/audio"
             || path == "/bookmarks"
@@ -430,6 +431,7 @@ impl RouteAccess {
             || path.starts_with("/rigs?")
             || path.starts_with("/events?")
             || path.starts_with("/decode?")
+            || path.starts_with("/decode/history?")
             || path.starts_with("/spectrum?")
             || path.starts_with("/audio?")
             || path.starts_with("/bookmarks?")