From 185018a42e39cc274028ef8ba4f6a6e5b458faf1 Mon Sep 17 00:00:00 2001
From: hobokenchicken <dustin@dustin.coffee>
Date: Tue, 21 Apr 2026 13:58:11 -0400
Subject: [PATCH] fix(auth): prevent duplicate plex callback requests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

React re-renders caused useEffect to fire twice. First
request succeeded, second consumed already-used PIN → 500.
Added useRef guard to dedupe.
---
 frontend/src/app/auth/callback/page.tsx | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/frontend/src/app/auth/callback/page.tsx b/frontend/src/app/auth/callback/page.tsx
index bb1a93d..c07acf1 100644
--- a/frontend/src/app/auth/callback/page.tsx
+++ b/frontend/src/app/auth/callback/page.tsx
@@ -2,7 +2,7 @@
 
 import { Loader2 } from "lucide-react";
 import { useRouter } from "next/navigation";
-import { useEffect, useState } from "react";
+import { useEffect, useRef, useState } from "react";
 import { toast } from "sonner";
 import { authApi } from "@/lib/api";
 import { useStore } from "@/lib/store";
@@ -11,8 +11,12 @@ export default function AuthCallbackPage() {
 	const router = useRouter();
 	const { setUser, setToken } = useStore();
 	const [status, setStatus] = useState("Completing sign in...");
+	const hasRun = useRef(false);
 
 	useEffect(() => {
+		if (hasRun.current) return;
+		hasRun.current = true;
+
 		const pinId = sessionStorage.getItem("plexPinId");
 
 		if (!pinId) {