Rokojori 3528295c68 feat: refresh token grace window + POST /api/auth/new-session ... Grace window: /api/auth/refresh no longer hard-401s on a concurrent reuse of the same refresh token. RefreshToken gains usedAt/replacedBy; markUsed() soft-deletes instead of hard-deleting; within REFRESH_GRACE_TTL (10s) a second use of the same token resolves to the same replacement pair. Fixes browser tabs racing the same single-use token on access-token expiry. new-session: POST /api/auth/new-session (requireAuth-guarded) mints a fresh independent token pair from an existing valid access token. Used by Electron instances on startup to avoid the login screen when another instance is already running (via session-heartbeat.json). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>		2026-08-02 22:38:58 +02:00
scripts	Initial Commit	2026-07-13 05:48:45 +02:00
source	feat: refresh token grace window + POST /api/auth/new-session	2026-08-02 22:38:58 +02:00
workspace	Auth Updates TTL	2026-07-17 13:36:03 +02:00
.gitignore	Initial Commit	2026-07-13 05:48:45 +02:00
package-lock.json	Initial Commit	2026-07-13 05:48:45 +02:00
package.json	Initial Commit	2026-07-13 05:48:45 +02:00
tsconfig.json	Initial Commit	2026-07-13 05:48:45 +02:00
tsconfig.ts-node.json	Initial Commit	2026-07-13 05:48:45 +02:00