fix(auth): detect stale credentials at startup via empty /account response (#331)

* fix(auth): detect stale credentials at startup via empty /account response (#330)

getCurrentUser hit /api/core/public/account, which is public and answers a 200
with an empty body for an unauthenticated request rather than a 401. response.json()
then threw a SyntaxError, which startup validation (checkExistingAuthentication)
treated as a transient failure and kept the invalid token.

Read the body as text and surface an empty 200 as ApiError(401) so the existing
401 branch clears the stale credentials. The 401 is only raised after a successful
HTTP response, so genuine transient/network errors still throw earlier in
makeRequest and credentials are kept.

* test(auth): cover whitespace-only /account body as unauthenticated (#330)

Author: Predixx

CHANGELOG.md

@@ -9,6 +9,10 @@ All notable changes to the Artemis VS Code extension will be documented in this
 - **WebSocket status bar:** Removed the `artemis.showWebSocketStatusBar` setting. The connection indicator now appears automatically only when there is a problem; enable `artemis.developerMode` to keep it always visible with full diagnostics on hover. When the connection drops, students now see a plain-language explanation (no "WS" jargon) instead of a technical label.
 - **Server URL change:** Removed the manual "Clear Credentials" prompts that appeared when the Artemis server URL changed. Changing the server while logged in now logs you out automatically and returns you to the login view (a session is not valid across servers); the logout command remains for clearing credentials on demand.
 
+### Fixed
+
+- **Stale credentials at startup:** Credentials that are no longer valid on the configured Artemis server are now reliably detected during startup validation and cleared, instead of lingering until a later request fails.
+
 ## [0.4.8] - 2026-06-24
 
 ### Changed

extension/src/extension/api/artemisApi.ts

@@ -155,7 +155,15 @@ export class ArtemisApiService {
     // Get current user information
     async getCurrentUser(): Promise<ArtemisUser> {
         const response = await this.makeRequest('/api/core/public/account');
-        return parseArtemisUser(await response.json());
+        const body = (await response.text()).trim();
+        if (!body) {
+            // /api/core/public/account is public: an unauthenticated request gets a
+            // 200 with an empty body rather than a 401. Surface it as a 401 so callers
+            // (notably startup credential validation) clear the stale token instead of
+            // treating the empty response as a transient failure and keeping it.
+            throw new ApiError('Not authenticated', 401);
+        }
+        return parseArtemisUser(JSON.parse(body));
     }
 
     // Get archived courses (inactive courses from previous semesters)

extension/test/unit/api/artemisApi.test.ts

@@ -55,7 +55,7 @@ suite('Artemis API Service Test Suite', () => {
             return {
                 ok: true,
                 status: 200,
-                json: async () => mockUser,
+                text: async () => JSON.stringify(mockUser),
             } as any;
         };
 
@@ -65,6 +65,41 @@ suite('Artemis API Service Test Suite', () => {
         assert.strictEqual(user.login, 'test');
     });
 
+    test('treats a 200 account response with an empty body as unauthenticated (401)', async () => {
+        // /api/core/public/account is public: an unauthenticated request gets a 200
+        // with an empty body rather than a 401. getCurrentUser must surface this as a
+        // 401 so startup credential validation clears the stale token.
+        global.fetch = async () => ({
+            ok: true,
+            status: 200,
+            text: async () => '',
+        } as any);
+
+        try {
+            await apiService.getCurrentUser();
+            assert.fail('Should have thrown error');
+        } catch (error: unknown) {
+            assert.ok(error instanceof ApiError);
+            assert.strictEqual((error as ApiError).status, 401);
+        }
+    });
+
+    test('treats a 200 account response with a whitespace-only body as unauthenticated (401)', async () => {
+        global.fetch = async () => ({
+            ok: true,
+            status: 200,
+            text: async () => '   \n',
+        } as any);
+
+        try {
+            await apiService.getCurrentUser();
+            assert.fail('Should have thrown error');
+        } catch (error: unknown) {
+            assert.ok(error instanceof ApiError);
+            assert.strictEqual((error as ApiError).status, 401);
+        }
+    });
+
     test('should handle 401 error', async () => {
         global.fetch = async () => ({
             ok: false,