Locked Out, Sometimes
Some logged-in users can open the dashboard, while others receive a 401 even though their token is valid.
The bug report
You get the whole project — a React front end, an Express API, and Mongoose models — opened in a browser editor. Reproduce the symptom by reading the code, change what’s wrong, and run the hidden tests to prove it.
What the fix must prove
- rejects requests without a token
- client and middleware agree on the authentication header
- accepts a valid bearer token and forwards the request