Repository navigation
Preserve login sessions through unusable refresh expiry and cookie-bound token rotation - #980
Merged
Conversation
…und token rotation
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
NewWorldVenture
pushed a commit
that referenced
this pull request
Oct 10, 2026
NewWorldVenture
pushed a commit
that referenced
this pull request
Oct 10, 2026
39 files conflicted. Each side's change since the last merged main (36a516d) decided the file: - 29 files only one side had touched: that side's version, whole. - components/ui/toast.tsx: main's notice queue, with this branch's localizeDbErrorText on the message. - lib/server/ai-access.ts: main's missing-RPC fallback (held 0493), which merged into this branch's monthlyAllowance helper; main's comment. - tests/ai-monthly-allowance.test.ts: both sides' cases. - the seven locale files: a key-level three-way merge with no conflicting key: main's file plus this branch's 15 keys, formatting byte-identical. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01776xJyhVe8xJQvTGeNfT9T
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Preserve saved login sessions when a successful refresh response contains unusable expiry data. Allow a cookie-bound rotated token to recover the latest originally validated user/session, while retaining account, session, malformed-claim and logout fences.
Add 41 regression cases without changing the original 73 expiry and 87 cache cases. The installed candidate passes all 328 cases across eight complete files in UTC, Los Angeles and Tokyo, full-project type checking and lint for the four changed files. All 52 installed-source browser checks pass without skips or retries using synthetic provider transport. The first restart failure was independently reproduced in a bare browser and resolved by moving the test profile to a shorter G: path; assertions and application code were unchanged. A separate desired-ready recovery test still fails for an unverified competing-owner claim and remains open.
The audit records 22 complete supporting-test obligations verified at the already released PR #979 commit. Broader authentication, family privacy and messaging obligations remain in progress. Production session policy, physical-device behavior and recovery from an unverified competing-owner claim remain open. No production configuration, migrations, provider execution or financial operations are included.