bugfix: organization not selected problem fixed. being logged out too often fixed.

2026-07-12 17:51:31 +03:30
parent 39935688ad
commit 901d838a2c
14 changed files with 490 additions and 22 deletions
--- a/frontend/src/lib/auth/accessToken.ts
+++ b/frontend/src/lib/auth/accessToken.ts
@@ -0,0 +1,37 @@
+/** Decode JWT payload without verification — used only for coarse expiry checks in middleware. */
+function decodeJwtPayload(token: string): Record<string, unknown> | null {
+  const parts = token.split('.');
+  if (parts.length !== 3) {
+    return null;
+  }
+
+  try {
+    const base64 = parts[1].replace(/-/g, '+').replace(/_/g, '/');
+    const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), '=');
+    const json =
+      typeof atob === 'function'
+        ? atob(padded)
+        : Buffer.from(padded, 'base64').toString('utf8');
+    const payload = JSON.parse(json) as Record<string, unknown>;
+    return payload && typeof payload === 'object' ? payload : null;
+  } catch {
+    return null;
+  }
+}
+
+export function isAccessTokenExpired(token: string | undefined | null): boolean {
+  if (!token?.trim()) {
+    return true;
+  }
+
+  const payload = decodeJwtPayload(token);
+  if (!payload || typeof payload.exp !== 'number') {
+    return true;
+  }
+
+  return payload.exp * 1000 <= Date.now();
+}
+
+export function hasUsableAccessToken(token: string | undefined | null): boolean {
+  return Boolean(token?.trim()) && !isAccessTokenExpired(token);
+}
--- a/frontend/src/lib/auth/proactiveRefresh.ts
+++ b/frontend/src/lib/auth/proactiveRefresh.ts
@@ -0,0 +1,155 @@
+import { authApi } from '@/lib/api/auth';
+
+const STORAGE_KEY = 'dyolink.accessTokenExpiresAt';
+/** Refresh this long before the access JWT expires. */
+const REFRESH_BUFFER_MS = 2 * 60 * 1000;
+/** Safety cap — never call /auth/refresh more than once per minute per tab. */
+const MIN_REFRESH_GAP_MS = 60 * 1000;
+
+let timerId: ReturnType<typeof setTimeout> | null = null;
+let refreshInFlight: Promise<string | undefined> | null = null;
+let lastRefreshAt = 0;
+
+export function setAccessTokenExpiresAt(iso: string): void {
+  if (typeof window === 'undefined') {
+    return;
+  }
+  sessionStorage.setItem(STORAGE_KEY, iso);
+}
+
+export function clearAccessTokenExpiresAt(): void {
+  if (typeof window === 'undefined') {
+    return;
+  }
+  sessionStorage.removeItem(STORAGE_KEY);
+}
+
+export function rememberAccessTokenExpiresAt(
+  iso: string | undefined | null,
+): void {
+  if (iso) {
+    setAccessTokenExpiresAt(iso);
+  }
+}
+
+function getAccessTokenExpiresAtMs(): number | null {
+  if (typeof window === 'undefined') {
+    return null;
+  }
+
+  const raw = sessionStorage.getItem(STORAGE_KEY);
+  if (!raw) {
+    return null;
+  }
+
+  const ms = Date.parse(raw);
+  return Number.isFinite(ms) ? ms : null;
+}
+
+function clearTimer(): void {
+  if (timerId !== null) {
+    clearTimeout(timerId);
+    timerId = null;
+  }
+}
+
+function computeDelayMs(expiresAtMs: number): number {
+  const refreshAt = expiresAtMs - REFRESH_BUFFER_MS;
+  const delay = refreshAt - Date.now();
+  return Math.max(delay, MIN_REFRESH_GAP_MS);
+}
+
+function shouldRefreshNow(expiresAtMs: number): boolean {
+  return expiresAtMs - REFRESH_BUFFER_MS <= Date.now();
+}
+
+async function refreshAccessTokenWithOrg(): Promise<string | undefined> {
+  if (refreshInFlight) {
+    return refreshInFlight;
+  }
+
+  if (Date.now() - lastRefreshAt < MIN_REFRESH_GAP_MS) {
+    const expiresAtMs = getAccessTokenExpiresAtMs();
+    return expiresAtMs
+      ? new Date(expiresAtMs).toISOString()
+      : undefined;
+  }
+
+  refreshInFlight = (async () => {
+    try {
+      const result = await authApi.refreshSessionFromCookies();
+      const expiresAt = result.data?.accessTokenExpiresAt;
+      rememberAccessTokenExpiresAt(expiresAt);
+
+      const orgId = localStorage.getItem('currentOrganizationId');
+      if (orgId) {
+        try {
+          await authApi.selectOrganization(orgId);
+        } catch {
+          /* refresh may already preserve organizationId on the JWT */
+        }
+      }
+
+      lastRefreshAt = Date.now();
+      return expiresAt;
+    } finally {
+      refreshInFlight = null;
+    }
+  })();
+
+  return refreshInFlight;
+}
+
+function scheduleNextRefresh(reschedule: () => void): void {
+  clearTimer();
+
+  if (typeof document !== 'undefined' && document.visibilityState !== 'visible') {
+    return;
+  }
+
+  const expiresAtMs = getAccessTokenExpiresAtMs();
+  if (!expiresAtMs) {
+    return;
+  }
+
+  timerId = setTimeout(() => {
+    void refreshAccessTokenWithOrg()
+      .catch(() => {
+        /* reactive refresh / next visibility check will recover */
+      })
+      .finally(reschedule);
+  }, computeDelayMs(expiresAtMs));
+}
+
+/** Keeps the access cookie fresh while the tab is visible. Returns a cleanup function. */
+export function startProactiveSessionRefresh(): () => void {
+  if (typeof window === 'undefined') {
+    return () => undefined;
+  }
+
+  const reschedule = () => scheduleNextRefresh(reschedule);
+
+  const onVisibilityChange = () => {
+    if (document.visibilityState === 'visible') {
+      const expiresAtMs = getAccessTokenExpiresAtMs();
+      if (expiresAtMs && shouldRefreshNow(expiresAtMs)) {
+        void refreshAccessTokenWithOrg()
+          .catch(() => undefined)
+          .finally(reschedule);
+      } else {
+        reschedule();
+      }
+      return;
+    }
+
+    clearTimer();
+  };
+
+  document.addEventListener('visibilitychange', onVisibilityChange);
+  reschedule();
+
+  return () => {
+    document.removeEventListener('visibilitychange', onVisibilityChange);
+    clearTimer();
+  };
+}