email plugin

public/js/app.js

@@ -170,7 +170,7 @@ document.getElementById('logout-btn')?.addEventListener('click', async () => {
 async function checkAuth() {
     const res = await fetch('api/auth/status');
     const data = await res.json();
-    if (data.csrf) setCsrf(data.csrf);
+    if (data.csrf) { setCsrf(data.csrf); window.hyprcrd?.util?.setCsrf?.(data.csrf); }
 
     if (data.setup) {
         let pw = null;
@@ -181,7 +181,7 @@ async function checkAuth() {
         const r = await fetch('api/auth/setup', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ password: pw }) });
         const d = await r.json();
         if (d.error) { location.reload(); return; }
-        if (d.csrf) setCsrf(d.csrf);
+        if (d.csrf) { setCsrf(d.csrf); window.hyprcrd?.util?.setCsrf?.(d.csrf); }
     } else if (!data.logged_in) {
         let ok = false;
         while (!ok) {
@@ -189,7 +189,8 @@ async function checkAuth() {
             if (!pw) continue;
             const r = await fetch('api/auth/login', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ password: pw }) });
             const d = await r.json();
-            if (d.ok) { ok = true; if (d.csrf) setCsrf(d.csrf); }
+            if (d.ok) { ok = true; if (d.csrf) { setCsrf(d.csrf); window.hyprcrd?.util?.setCsrf?.(d.csrf); } }
+            else { /* failed login: caller will retry */ }
         }
     }