Skip to content

[FE-84] Graceful session expiry and token refresh #1183

Description

@yusuftomilola

Overview

Auth state spans middleware.ts, store/auth.store.ts, components/auth-initializer.tsx, and lib/auth-api.ts. When a token expires mid-session the user currently risks a confusing failure and losing an in-progress form.

Tasks

  • Detect 401 centrally in the axios interceptor and attempt a single refresh, queueing concurrent requests until it resolves.
  • On refresh failure, clear auth state and redirect to login preserving the intended destination.
  • Prevent refresh stampedes — many simultaneous 401s must trigger exactly one refresh call.
  • Warn before expiry with a "Stay signed in" prompt rather than dropping the session silently.
  • Preserve unsaved form input across the redirect where practical.
  • Synchronize logout across tabs via a storage event.

Acceptance Criteria

  • An expired token refreshes transparently with no visible failure.
  • Failed refresh returns the user to their original page after re-authenticating.
  • Ten concurrent 401s produce exactly one refresh request (covered by a test).

Dependencies

Blocked by [FE-65]; backend refresh from [BE-80].

Notes for Contributors

Comment below to be assigned.

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions