Authentication Flows

// the request layer: silent refresh, one retry with the same idempotency key, and a re-auth modal that keeps the flow
let refreshing: Promise<void> | null = null
async function refresh() {
  // one refresher per browser: a Web Lock serialises tabs; the winner rotates the token and broadcasts
  return navigator.locks.request('auth-refresh', async () => {
    const r = await fetch('/auth/refresh', { method: 'POST', credentials: 'include' })   // the refresh token is an HttpOnly cookie scoped to this path
    if (!r.ok) throw new SessionExpired()
    const { accessToken, expiresAt } = await r.json()
    auth.set(accessToken, expiresAt)                                                      // in memory; never localStorage
    channel.postMessage({ type: 'token', accessToken, expiresAt })                      // other tabs pick it up
  })
}
export async function api(input: RequestInfo, init: RequestInit & { idempotencyKey?: string } = {}) {
  if (auth.expiresSoon()) await (refreshing ??= refresh().finally(() => (refreshing = null)))   // proactive
  const send = () => fetch(input, { ...init, headers: { ...init.headers, Authorization: `Bearer ${auth.token}`, ...(init.idempotencyKey ? { 'Idempotency-Key': init.idempotencyKey } : {}) } })
  let res = await send()
  if (res.status === 401) {                                                                // reactive: once
    try { await (refreshing ??= refresh().finally(() => (refreshing = null))); res = await send() }   // same body, same idempotency key
    catch (e) { if (e instanceof SessionExpired) { await reauthenticate(); res = await send() } else throw e }   // modal over the current screen; form state kept
  }
  if (res.status === 403) { const { requiredFactors } = await res.clone().json(); if (requiredFactors) { await stepUp(requiredFactors, init); res = await send() } }   // step-up inline
  return res
}
// reauthenticate(): opens the modal, resolves when the user has re-proven presence; the caller's state (the review step) is untouched
// on SessionExpired with no re-auth: auth.clear(); queryClient.clear(); navigate('/login?return=' + current)   // never leave the previous user's data in the cache