From ba136b9d78f2d785b246c13b3252e0a8b21cece6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cau=C3=AA=20Faleiros?= <cauefaleiros@gmail.com>
Date: Fri, 28 Aug 2026 11:07:39 -0300
Subject: [PATCH] fix: keep sessions on forbidden responses

---
 src/dataService.ts | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/src/dataService.ts b/src/dataService.ts
index ca7c234..69a8873 100644
--- a/src/dataService.ts
+++ b/src/dataService.ts
@@ -128,7 +128,7 @@ export const fetchStock = async (): Promise<StockData[]> => {
                 'Authorization': `Bearer ${token}`
             }
         });
-        if (response.status === 401 || response.status === 403) {
+        if (response.status === 401) {
             logout();
             return [];
         }
@@ -171,7 +171,7 @@ export const fetchData = async (): Promise<OrderData[]> => {
                 'Authorization': `Bearer ${token}`
             }
         });
-        if (response.status === 401 || response.status === 403) {
+        if (response.status === 401) {
             logout();
             return [];
         }
@@ -193,7 +193,10 @@ const authFetch = async (path: string, options: RequestInit = {}): Promise<Respo
         }
     });
 
-    if (response.status === 401 || response.status === 403) {
+    // A 403 means the signed-in user lacks permission for this specific
+    // resource. Keep their session intact so protected optional data cannot
+    // force a logout from an otherwise accessible page.
+    if (response.status === 401) {
         logout();
     }