Rokojori
7c754e4256
Fixes two root-cause bugs: browser tabs racing the same single-use refresh token, and Electron never refreshing after its one-shot startup call. Browser: - TokenUpdater: periodic 5-min + activity-triggered pings to /api/auth/me, EventSlot-driven valid/refreshing/expired/network-error state. Web Locks leader election (one tab runs the updater; others follow via BroadcastChannel). Falls back to leader-always without Locks API support. - GuardedCall: three-tier wrapper (user/editor/silent) with pre-flight state check and tier-specific retry. Replaces ad-hoc fetch calls in Editor and editor-shell layout save/load. - auth-connector: jwtMiddleware proactively rotates access-token cookie within 15 min of real expiry (server clock, no client-side exp needed). Electron: - Periodic token updater in main process: reads JWT exp directly, uses server-corrected clock (Date response header offset) for comparisons, refreshes within 15 min of expiry. Replaces one-shot startup refresh. - Session heartbeat: running instance writes accessToken + timestamp every 10 s. New instance mints its own session via POST /api/auth/new-session if heartbeat is ≤30 s old — skips login screen transparently. - Retired plaintext last-password.txt auto-login. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| login.html | ||
| main.ts | ||
| preload.ts | ||