Rokojori 3528295c68 feat: refresh token grace window + POST /api/auth/new-session ... Grace window: /api/auth/refresh no longer hard-401s on a concurrent reuse of the same refresh token. RefreshToken gains usedAt/replacedBy; markUsed() soft-deletes instead of hard-deleting; within REFRESH_GRACE_TTL (10s) a second use of the same token resolves to the same replacement pair. Fixes browser tabs racing the same single-use token on access-token expiry. new-session: POST /api/auth/new-session (requireAuth-guarded) mints a fresh independent token pair from an existing valid access token. Used by Electron instances on startup to avoid the login screen when another instance is already running (via session-heartbeat.json). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>		2026-08-02 22:38:58 +02:00
..
admin.ts	Add requireAccess middleware, products admin route, and lookup-email endpoint	2026-07-15 07:06:39 +02:00
auth.ts	feat: refresh token grace window + POST /api/auth/new-session	2026-08-02 22:38:58 +02:00