## Navigation Flow: Back Button Routes to Landing Page Bug

**Issue (Jul 2026):** The X/back button on the draft-room.html top bar routed to `index.html` (the unauthenticated signup page) even when logged in. The same issue applied to the "🏠 Home" link on league.html.

**Root cause:** Both navigations used hardcoded `href` or `onclick` pointing to `index.html` with no token check.

**Fix applied Jul 2026:**

### draft-room.html — player-info avatar/name area (top-left "back" button)

**Before:**
```html
<div class="player-info" onclick="window.location.href='index.html'">
```

**After:**
```html
<div class="player-info" onclick="handlePlayerInfoClick()">
```

**New JS function:**
```js
function handlePlayerInfoClick() {
    const token = getToken();
    if (token) {
        window.location.href = 'draft-room.html';
    } else {
        window.location.href = 'index.html';
    }
}
```

**Behavior:** Logged-in users stay in the draft room (page reload of the same page). Unauthenticated users are sent to the login/register page.

### league.html — "🏠 Home" nav link

**Before:** `<a href="index.html">🏠 Home</a>`
**After:** `<a href="draft-room.html">🏠 Home</a>`

Since users reaching league.html are already authenticated (page's checkAuth() redirects unauthenticated users), this always sends them to the draft room.

### Other pages to audit

- `settings.html` — also has a hardcoded `window.location.href = 'index.html'` on line 723 in its auth check. That's an **unauthenticated redirect** (correct — unauthorized users should go to login).
- `index.html` itself — if a logged-in user lands here (e.g. types the URL), there's no auto-redirect to the draft room. Future fix: add a token check on `DOMContentLoaded` that redirects to `draft-room.html` if a valid token exists.

**Verification:** After patching, confirm the files are valid HTML and serve correctly:
```bash
ls -la /var/www/shark-game/draft-room.html /var/www/shark-game/league.html
grep -n "handlePlayerInfoClick" /var/www/shark-game/draft-room.html
grep -n "href='draft-room.html'\|href=\"draft-room.html\"" /var/www/shark-game/league.html | head -5
```

**Edge case:** The `handlePlayerInfoClick()` just reloads the draft-room page (no league_id param). If the user was in a specific league's draft room, they'll lose the league context on re-entry. The draft-room.html `init()` function should handle this by restoring the last-used league from a query parameter or localStorage — currently it reads `league_id` from the URL query string, so the user must still select a league from the overlay.