fix(FOUR-29735): 401 in MSC Clone - Form page not redirecting to logout

[rodriquelca]

Issue & Reproduction Steps

(related): After the server invalidates the session (e.g. php artisan cache:clear with sessions on Redis DB0), users stay on /tasks/{id}/edit and keep editing. Task draft autosave calls PUT /api/1.0/drafts/{id} and returns 401; the UI shows generic axios errors instead of sending the user to login.

Reproduce (local, task edit Vite):

• Log in and open an active task: /tasks/{id}/edit.
• Confirm TASK_DRAFTS_ENABLED=true (default).
• Invalidate the session (e.g. rm -f storage/framework/sessions/* with SESSION_DRIVER=file, or cache:clear if sessions share Redis with cache).
• Edit a field and wait ~2s for autosave.
• Before: No PUT drafts or autosave disabled; if PUT runs, 401 with no redirect to login.
• After: Autosave runs; on 401, browser navigates to /login.

Solution

• edit.js — In autosaveApiCall, on draft PUT failure with HTTP 401, redirect to /login (status only; response body text is irrelevant).

draft.redirect.mov

How to Test

1. Hard refresh /tasks/{id}/edit (Vite build/dev).
2. Console: window.ProcessMaker.taskDraftsEnabled === true.
3. Change a form field → Network shows PUT /api/1.0/drafts/{id} (200 while session is valid).
4. Invalidate session (step 3 above), edit again, wait for autosave → 401 on PUT drafts and redirect to /login (no reliance on an "Unauthorized" message in the body).

Related Tickets & Packages

• https://processmaker.atlassian.net/browse/FOUR-29735

Code Review Checklist

• I have pulled this code locally and tested it on my instance, along with any associated packages.
• This code adheres to ProcessMaker Coding Guidelines.
• This code includes a unit test or an E2E test that tests its functionality, or is covered by an existing test.
• This solution fixes the bug reported in the original ticket.
• This solution does not alter the expected output of a component in a way that would break existing Processes.
• This solution does not implement any breaking changes that would invalidate documentation or cause existing Processes to fail.
• This solution has been tested with enterprise packages that rely on its functionality and does not introduce bugs in those packages.
• This code does not duplicate functionality that already exists in the framework or in ProcessMaker.
• This ticket conforms to the PRD associated with this part of ProcessMaker.

ci:deploy

[cursor]

PR Summary

Low Risk
Single-path UX change on draft autosave failure; only affects unauthenticated (401) responses and does not alter successful save or submit flows.

Overview
Task edit draft autosave now treats an expired session as a hard logout instead of a generic autosave failure.

When autosaveApiCall’s PUT drafts/{id} fails with HTTP 401, the handler redirects the browser to /login and skips setting errorAutosave. Other errors still set errorAutosave as before.

This fixes the case where session invalidation during editing left users on /tasks/{id}/edit with axios errors and no login redirect.

^{Reviewed by Cursor Bugbot for commit 2c1f465. Bugbot is set up for automated code reviews on this repo. Configure here.}

[decisions-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarQube

[vladyrichter]

QA server K8S was successfully deployed https://tenant-1.ci-6f936981f4.engk8s.processmaker.net