[tusharkumar-coder]

Summary

Closes #7622

Problem

The app authenticates via HTTP-only cookies set by talawa-api on login. However, several places still read or remove a token item from localStorage — and nothing in src/ ever calls setItem('token'). This meant the Authorization header in authLink and the WebSocket connectionParams token were always empty strings (dead code).

Additionally, it was unclear how WebSocket subscriptions (e.g. chat) were authenticated, since the connection_init payload only contained Accept-Language.

Investigation

Confirmed against talawa-api (src/routes/graphql.ts):

• HTTP requests: the API's createContext reads the talawa_access_token HTTP-only cookie. No Authorization header is needed from the client.
• WebSocket subscriptions: the onConnect handler expects payload.authorization: Bearer <token>. Since the access token is in an HTTP-only cookie (inaccessible to JS), the WS handshake relies on the browser sending the cookie automatically during the HTTP upgrade, which the API verifies in createContext.

Changes

Source files

• src/index.tsx: Remove getItem('token') from authLink (cookies sent automatically). Remove dead token lookup from wsLink connectionParams. Add a doc comment explaining the WebSocket auth mechanism. Remove the now-unused BEARER_PREFIX constant.
• src/screens/AdminPortal/OrgList/OrgList.tsx: Remove getItem('token') and the dead context object passed to useQuery(CURRENT_USER).
• src/components/AdminPortal/SecuredRoute/SecuredRoute.tsx: Remove removeItem('token') from session-timeout cleanup (key was never set).
• src/components/UserPortal/SecuredRouteForUser/SecuredRouteForUser.tsx: Same as above.
• src/screens/Public/Invitation/AcceptInvitation.tsx: Remove AUTH_TOKEN_KEY = 'token' constant. Fix isAuthenticated to use the IsLoggedIn localStorage flag (the real auth-state indicator) instead of Boolean(getItem('token')) which was always false. Remove dead removeItem(AUTH_TOKEN_KEY) call.
• src/components/AdminPortal/Advertisements/AdvertisementsMocks.ts: Remove the authLink mock that read getItem('token'). Simplify mock client to plain HttpLink. Remove unused setContext/ApolloLink/useLocalStorage imports.

Test files

• securedRoute.spec.tsx: Remove setItem/getItem assertions for 'token'.
• OrgList.spec.tsx: Remove setItem('token', 'mock-token') from setupUser.
• AcceptInvitation.spec.tsx: Update renderComponent signature (3rd arg is now isLoggedIn: boolean instead of authToken: string), update mock to return 'TRUE' for the IsLoggedIn key, remove removeItem('token') assertion.

How WebSocket Auth Works

The talawa-api onConnect handler validates payload.authorization. The browser includes the HTTP-only access-token cookie on the WS HTTP upgrade request (same-origin). The API can read this cookie from the request to authenticate the WebSocket connection, similar to regular HTTP requests.

[github-actions]

Our Pull Request Approval Process

This PR will be reviewed according to our:

1. Palisadoes Contributing Guidelines

2. AI Usage Policy

Your PR may be automatically closed if:

1. Our PR template isn't filled in correctly
2. You haven't correctly linked your PR to an issue

👉 https://docs.github.com/en/issues/tracking-your-work-with-issues/using-issues/linking-a-pull-request-to-an-issue

Thanks for contributing!

[github-actions]

Thank you for your first contribution! We appreciate your effort and look forward to more contributions in the future.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Repository: PalisadoesFoundation/talawa-admin/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: f7c4ea15-80ab-4f39-b05e-13535666c383

---

📥 Commits

Reviewing files that changed from the base of the PR and between 909d219 and d1cde99.

---

📒 Files selected for processing (9)

• src/components/AdminPortal/Advertisements/AdvertisementsMocks.ts
• src/components/AdminPortal/SecuredRoute/SecuredRoute.tsx
• src/components/AdminPortal/SecuredRoute/securedRoute.spec.tsx
• src/components/UserPortal/SecuredRouteForUser/SecuredRouteForUser.tsx
• src/index.tsx
• src/screens/AdminPortal/OrgList/OrgList.spec.tsx
• src/screens/AdminPortal/OrgList/OrgList.tsx
• src/screens/Public/Invitation/AcceptInvitation.spec.tsx
• src/screens/Public/Invitation/AcceptInvitation.tsx

---

 ____________________________________
< LLM (Looking for Leaks in Memory). >
 ------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

The linked issue must be assigned to the PR author.