Retire GIS/One-Tap silent renewal; rename /auth/refresh → /auth/session (bd-s042qcxj) - #417
Merged
Merged
Conversation
Renewal-only scope: remove the One-Tap client machinery, keep the GIS login button + /auth/callback, and keep+rename the /auth/refresh server endpoint to /auth/session (its true role is the direct-JSON credential login path for Generic OIDC frontends). Child of epic bd-qxgoti2b.
…on (B2, bd-s042qcxj) Server-minted sliding sessions (bd-ey6jg70f) made the browser's GIS One-Tap silent renewal redundant: the hub re-issues the session cookie server-side on authenticated HTTP activity, driven by useSessionKeepAlive's /auth/me probe. This removes the One-Tap renewal path entirely on the client and corrects the server endpoint's name. Client (renewal removed): - AuthProvider: drop useSilentRenewal + SilentRenewalOpts from the interface, noop, and MockAuthProvider capture. - GoogleAuthProvider: drop useGoogleOneTapLogin + the useSilentRenewal impl; keep SignInButton + signOut. - useAuth: delete triggerRefresh/refreshEnabled/isRefreshing/refreshDeadline/ settleRefresh/abandonRenewal/REFRESH_BUFFER_MS/REFRESH_VERDICT_TIMEOUT_MS and the pre-expiry refresh timer. Every definitive 401 (refocus, expiry re-check) now routes to expireSession; mount 401 stays "not signed in" (no sessionExpired flag); network errors remain no-ops (evidence-based logout, bd-3o8zmz46). - useAuthProbe/useSessionKeepAlive: drop the triggerRefresh opt. Probe keeps its two-strike debounce (first 401 is now a no-op, second consecutive 401 rejects); keep-alive ends the session on a definitive 401. - authService: remove refreshToken() (its only /auth/refresh caller). Server (endpoint kept + renamed, logic unchanged): - /auth/refresh → /auth/session; auth_refresh → auth_session; RefreshRequest → SessionRequest. It is not a One-Tap artifact — it is the direct-JSON credential-submission login path for Generic OIDC frontends (the counterpart to form-post /auth/callback), and stays for the deferred public-client work (B1). CSRF (X-Requested-With) and dual-credential-400 behavior unchanged. Behavior change (intended): on a definitive session end (revocation / absolute cap / idle), the SPA now shows the login screen instead of silently restoring via One-Tap. Day-to-day renewal stays invisible (server-side slide). Plan: claude-notes/plans/2026-07-27-retire-gis-onetap-renewal.md
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
shikokuchuo
marked this pull request as ready for review
July 27, 2026 12:36
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Strand:
bd-s042qcxj(epicbd-qxgoti2b, slice B2) · Plan:claude-notes/plans/2026-07-27-retire-gis-onetap-renewal.mdWhy
One-Tap silent renewal is no longer needed. With server-minted sliding sessions (
bd-ey6jg70f, #414), the hub itself re-issues the session cookie with a fresh, later-expiring token on each authenticated/auth/me— anduseSessionKeepAlivesends one periodically. Renewal is now entirely server-side (idle 7 d / absolute 30 d); the browser never has to go back to the IdP for a new credential.What changed
useSilentRenewal/SilentRenewalOpts,useGoogleOneTapLogin,useAuth'striggerRefresh+ refresh timers, andauthService.refreshToken(). Definitive 401s now route toexpireSession; network errors stay no-ops (evidence-based logout,bd-3o8zmz46). Kept the GIS login button +signOut./auth/refresh→/auth/session(logic unchanged). It was never a One-Tap artifact — it's the direct-JSON login path for Generic OIDC frontends, retained for the deferred PKCE work (B1).Behavior: a definitive session end (logout-everywhere / absolute cap / idle) now shows the login screen instead of a silent One-Tap restore. Everyday renewal stays invisible (server-side slide).
Verification
cargo nextest -p quarto-hub371 pass ·cargo xtask verify --skip-hub-buildgreen · hub-clientbuild:allclean,test:ci740+109+129 pass. Rename confirmed on the realhubbinary:POST /auth/refresh→ 404,POST /auth/session→ 401/403 (never 404). Full browser GIS flow not exercised (needs a real Google-OIDC hub).