fix: planner 401 poll storm + customers/priority 403 (from PostHog telemetry)

[jakub-przepiora]

Two real user-facing errors surfaced by PostHog http_error telemetry (last 30 days, 671 events / 77 users).

1. 401 /admin/schedule/check-updates — 385 events / 4 users (biggest single error)

The production planner short-polls this endpoint every 5-10s to sync across tabs (LiveRefresh + a tracking poll in Planner.jsx). Both used if (!r.ok) return and kept retrying. When the session expired on a left-open planner tab, every poll returned 401 and the client retried forever, silently generating hundreds of error events per stale tab.
Fix: both pollers now stop on 401/419 (session gone). A real navigation still bounces to login.

2. 403 /admin/customers + /admin/priority-rules — ~28 events / 9 users

These paths sat outside every TabRegistry prefix, so TabAccessMiddleware made them Admin-only (403) — but the sidebar showed them under the Orders group to any tab:orders holder (the child links have no per-tab gate). A Supervisor/Operator with Orders access saw the links and got a 403 on click.
Fix: map both to the Orders tab, so route access matches nav visibility. New regression test in TabAccessTest.

Not fixed here (noise / separate)

• 504 *.clarity.ms, 500 tawk.to — third-party widgets on the demo site
• 404 /.well-known/*, 429 /login — bots/crawlers + login rate-limit (expected)
• 419/409 on planner PUT (session/CSRF during long sessions) — smaller; the 401 poll fix reduces the general session-expiry noise
• /packaging/label-templates 403 — packaging role-specific, left for a separate look

Full suite: 1988 passed.

🤖 Generated with claude-flow

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 77f76d24-f553-470f-9ea1-dc84dfb42b07

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/planner-poll-401-and-nav-403

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}