TOZTO Admin CSRF Debug Report

Background

On 2026-07-15, the TOZTO admin panel had failures on /admin/settings/top, /admin/settings/footer, and /admin/albums/create. All showed invalid-csrf errors.

Root Cause

The catch blocks swallowed all exceptions and redirected to error=invalid-csrf. The real errors were ReferenceError: normalizeTopNavIconName is not defined and isFooterSlot is not defined - missing imports in admin.tsx.

Fix

1. Added missing imports from top-nav-config and footer-config
2. Improved catch blocks to differentiate CSRF vs business errors
3. Added console.error for production error tracking

Verification

Both endpoints now return success=settings-updated.