DONOTMERGE feat: add retry logic for session cookie creation with token refresh #6540
Conversation
dosubot
bot
added
the
size:M
🎨 Storybook Build Status✅ Build completed successfully! ⏰ Completed at: 11/05/2025, 01:44:55 AM UTC 🔗 Links🎉 Your Storybook is ready for review! |
🎭 Playwright Test Results⏰ Completed at: 11/05/2025, 02:14:57 AM UTC 📈 Summary
📊 Test Reports by Browser
🎉 Click on the links above to view detailed test results for each browser configuration. |
viva-jinyi
added
backport
Bundle Size ReportSummary
Category Glance Per-category breakdownApp Entry Points — 3.31 MB (baseline 3.31 MB) • 🔴 +64 BMain entry bundles and manifests
Status: 3 added / 3 removed Graph Workspace — 729 kB (baseline 729 kB) • ⚪ 0 BGraph editor runtime, canvas, workflow orchestration
Status: 1 added / 1 removed Views & Navigation — 8.18 kB (baseline 8.18 kB) • ⚪ 0 BTop-level views, pages, and routed surfaces
Status: 1 added / 1 removed Panels & Settings — 293 kB (baseline 293 kB) • ⚪ 0 BConfiguration panels, inspectors, and settings screens
Status: 6 added / 6 removed UI Components — 12.6 kB (baseline 12.6 kB) • ⚪ 0 BReusable component library chunks
Status: 1 added / 1 removed Data & Services — 10.4 kB (baseline 10.4 kB) • ⚪ 0 BStores, services, APIs, and repositories
Status: 1 added / 1 removed Utilities & Hooks — 1.07 kB (baseline 1.07 kB) • ⚪ 0 BHelpers, composables, and utility bundles
Vendor & Third-Party — 5.32 MB (baseline 5.32 MB) • ⚪ 0 BExternal libraries and shared vendor chunks
Other — 2.55 MB (baseline 2.55 MB) • ⚪ 0 BBundles that do not match a named category
|
christian-byrne
added
claude-review
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
| headers: { | ||
| ...authHeader, | ||
| 'Content-Type': 'application/json' | ||
| if (authHeader) { |
There was a problem hiding this comment.
[architecture] high Priority
Issue: Nested conditional and loop complexity increases cognitive load
Context: The retry logic combines loop control, conditional checks, and async operations making it harder to understand and test
Suggestion: Extract retry logic into a separate helper function like 'retryWithBackoff' to improve readability and testability
| }) | ||
|
|
||
| const getIdToken = async (): Promise<string | undefined> => { | ||
| const getIdToken = async ( |
There was a problem hiding this comment.
[quality] high Priority
Issue: Missing JSDoc parameter documentation for new forceRefresh parameter
Context: The function has comprehensive JSDoc but the new parameter is undocumented
Suggestion: Add @param forceRefresh documentation to match the existing JSDoc standard
There was a problem hiding this comment.
Comprehensive PR Review
This review is generated by Claude. It may not always be accurate, as with human reviewers. If you believe that any of the comments are invalid or incorrect, please state why for each. For others, please implement the changes in one way or another.
Review Summary
PR: feat: add retry logic for session cookie creation with token refresh (#6540)
Impact: 42 additions, 20 deletions across 2 files
Issue Distribution
- Critical: 0
- High: 3
- Medium: 4
- Low: 1
Category Breakdown
- Architecture: 3 issues
- Security: 1 issues
- Performance: 1 issues
- Code Quality: 3 issues
Key Findings
Architecture & Design
The retry logic implementation addresses a real authentication timing issue, but the current approach has some architectural concerns:
-
Complexity Management: The nested retry logic within the main function increases cognitive complexity. Consider extracting the retry pattern into a reusable utility.
-
Error Handling Strategy: The implementation only retries on null auth headers but immediately throws on HTTP errors. This might miss cases where 401/403 responses indicate token expiration that could benefit from retries.
-
API Signature Changes: Adding optional parameters to existing functions maintains backward compatibility but requires consideration of how this affects the broader codebase.
Security Considerations
- Information Disclosure: Error messages from network requests could potentially leak sensitive information about the authentication infrastructure. Consider sanitizing error messages before exposing them to prevent information disclosure attacks.
Performance Impact
- Resource Management: The current Promise-based timeout implementation creates unnecessary promises. Consider more efficient approaches like AbortController.
- Magic Numbers: Hard-coded retry counts and backoff intervals reduce maintainability and testing flexibility.
Integration Points
The changes maintain backward compatibility since the new parameters are optional. However, the lack of test coverage for this critical authentication flow increases the risk of regressions.
Positive Observations
- Problem Identification: The PR correctly identifies and addresses a real timing issue with Firebase token refresh
- Incremental Approach: The solution uses exponential backoff, which is a sound approach for handling transient failures
- Documentation: The implementation includes inline comments explaining the retry strategy
- Backward Compatibility: Optional parameters maintain existing API contracts
References
Next Steps
- Address high priority issues before merge (missing tests, JSDoc documentation)
- Consider architectural feedback for long-term maintainability (extract retry utility)
- Add comprehensive unit tests for the retry scenarios
- Validate error handling strategy for HTTP failures
This is a comprehensive automated review. For architectural decisions requiring human judgment, please request additional manual review.
github-actions
bot
removed
the
claude-review
viva-jinyi
force-pushed
the
feature/auth-retry
branch
from
ae2f516 to
2823584
Compare
dosubot
bot
added
size:L
viva-jinyi
force-pushed
the
feature/auth-retry
branch
from
1a1efae to
3a1c531
Compare
|
DO NOT MERGE YET |
viva-jinyi
changed the title
- Add retry mechanism with exponential backoff in useSessionCookie - Support forceRefresh parameter in getAuthHeader and getIdToken - First attempt uses cached token, retries force token refresh - Fixes intermittent 'No auth header available' errors during token refresh Addresses Sentry issue affecting users with authentication timing issues
- Continue retry loop when API returns non-ok response instead of throwing immediately - Ensures 401/403 errors trigger token refresh retry as intended - Only throw error on final attempt to preserve error details - Add comprehensive unit tests for retry scenarios including token timing issues Addresses Claude Code review feedback on retry logic error handling 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <[email protected]>
viva-jinyi
force-pushed
the
feature/auth-retry
branch
from
3a1c531 to
40442c0
Compare
🐛 Problem
Intermittent "No auth header available for session creation" errors during session cookie creation
🔍 Root Cause Analysis
Temporary token unavailability during Firebase token refresh process:
onIdTokenChangedevent triggergetAuthHeader()temporarily returns null while fetching new token✅ Solution
1. Add Retry Logic (useSessionCookie.ts)
forceRefresh: true2. Support forceRefresh Parameter (firebaseAuthStore.ts)
getAuthHeader(forceRefresh?: boolean)parametergetIdToken(forceRefresh?: boolean)parameter🤖 Generated with Claude Code
Co-Authored-By: Claude [email protected]
┆Issue is synchronized with this Notion page by Unito