From b6361e6cbc07c0b59e3e6f53343391821d36ec02 Mon Sep 17 00:00:00 2001
From: Marcel <marcel@familienarchiv>
Date: Thu, 19 Mar 2026 12:56:59 +0100
Subject: [PATCH] fix(auth): use API_INTERNAL_URL in userGroup hook
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The userGroup hook was hardcoding http://localhost:8080 instead of
reading API_INTERNAL_URL from the environment. In Docker this caused
the /api/users/me fetch to fail silently, leaving event.locals.user
unset and triggering the handleAuth guard to redirect every page to
/login — including the login form action itself, creating an infinite
redirect loop.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 frontend/src/hooks.server.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/frontend/src/hooks.server.ts b/frontend/src/hooks.server.ts
index 716b7fbd..6271507e 100644
--- a/frontend/src/hooks.server.ts
+++ b/frontend/src/hooks.server.ts
@@ -27,7 +27,8 @@ const userGroup: Handle = async ({ event, resolve }) => {
 
     if (auth) {
         try {
-            const response = await fetch('http://localhost:8080/api/users/me', {
+            const apiUrl = env.API_INTERNAL_URL || 'http://localhost:8080';
+            const response = await fetch(`${apiUrl}/api/users/me`, {
                         headers: { Authorization: auth }
 
             });