Rokojori
3528295c68
Grace window: /api/auth/refresh no longer hard-401s on a concurrent reuse of the same refresh token. RefreshToken gains usedAt/replacedBy; markUsed() soft-deletes instead of hard-deleting; within REFRESH_GRACE_TTL (10s) a second use of the same token resolves to the same replacement pair. Fixes browser tabs racing the same single-use token on access-token expiry. new-session: POST /api/auth/new-session (requireAuth-guarded) mints a fresh independent token pair from an existing valid access token. Used by Electron instances on startup to avoid the login screen when another instance is already running (via session-heartbeat.json). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| debug | ||
| middleware | ||
| routes | ||
| db.ts | ||
| index.ts | ||
| rateLimiter.ts | ||
| roles.ts | ||