Auth: Time out the session when the timeout modals "Stay logged in" refresh fails (closes #22986)

[iOvergaard]

Background

This began as an attempt to reproduce #22986 — "clicking Stay logged in logs you out anyway." We couldn't reproduce it literally: on a healthy session the button works, the token rotates, the user stays logged in. But the reported symptom is exactly what the code produces when the refresh behind that button fails or the session has already expired — and the modal's countdown could drift out of sync with the real server-side expiry, showing time the user no longer had. The reporter's config (TimeOut, load-balancing) is unknown, so this may not be their precise cause, but these are real bugs in the same path producing the same outcome.

What changed

• A failed refresh now times the user out immediately. Previously the failed /token result was swallowed: the modal closed, the user looked logged in, then got bounced on their next action — matching the report.
• The timeout flow is wall-clock based. The warning timer recomputes the remaining time from Date.now() when it fires, and the modal counts down against an absolute deadline — so neither drifts out of sync after system sleep or background-tab throttling. A 5s margin keeps the client slightly ahead of the server so a late click still lands in time.
• /token is no longer retried after a definitive failure. UmbAuthClient now separates definitive OAuth rejections (invalid_grant-class) from transient failures (network/5xx); a definitive rejection latches the session as dead and stops further refresh attempts until a new session is established. Previously every pending request fired its own doomed /token call (18+ observed). Transient failures stay retryable.
• Fixed import order in three auth modal files so ESLint can run on the package.

Testing

10 new unit tests (failed-refresh timeout, late-firing timers via patched Date.now, wall-clock countdown, the fatal/transient latch). Verified in the browser with a revoked refresh token: one /token call and an immediate "session timed out" screen, for both the modal click and a burst of requests on a dead session; happy path still extends the session. Full client suite passes, tsc clean, no new lint warnings. No public API changes.

If you still hit this after the fix

Please reopen with your Global:TimeOut and Security:KeepUserLoggedIn settings, whether the site is load-balanced / behind a proxy, and whether /token returns 200 but the next request 401s — that separates a swallowed refresh failure from an environmental cookie / Data Protection key-ring issue.

Fixes #22986

🤖 Generated with Claude Code

[claude]

Claude finished @iOvergaard's task in 5m 43s —— View job

---

PR Review

Target: origin/v17/dev · Based on commit: 4f77db47

Fixes three compounding defects in the session-timeout flow: a failed /token refresh was silently swallowed (leaving a doomed session), the warning timer passed stale scheduling-time values to the modal, and the modal countdown decremented by tick count instead of against a wall-clock deadline. All three root causes are now addressed and covered by new unit tests.

• Other changes: Session behavior is now honest — a failed "Stay logged in" refresh immediately triggers the re-auth screen instead of leaving the UI in a broken state; the countdown display now reflects real elapsed time after system sleep or background-tab throttling.

---

Suggestions

• umb-auth-timeout-modal.element.ts:29: if (this.#interval) relies on setInterval never returning 0. While that holds in all current runtimes, this.#interval !== undefined matches the declared type (#interval?: any — absent state is undefined) and makes the intent explicit. Fix this →

• auth-session-timeout.controller.test.ts:116: The keepUserLoggedIn=true auto-refresh-failure path has no dedicated test. The fix is in the shared #tryValidateToken() method, so it is indirectly covered by the onContinue tests, but an explicit test would make the branch coverage unambiguous. E.g. set context.keepUserLoggedIn = true, stub validateToken to return false, inject a nearly-expired access-token session, and assert timeOutCalls === 1. Fix this →

---

Approved with Suggestions for improvement

Good to go, but please carefully consider the importance of the suggestions.

Labels applied: area/frontend, category/ux

[Copilot]

Pull request overview

Improves the backoffice auth session-timeout flow so the “Stay logged in” action no longer silently succeeds when the refresh token has already expired, and makes the timeout countdown resilient to system sleep/background-tab timer throttling.

Changes:

• Ensure failed token refresh triggers timeOut() (so re-auth starts immediately instead of leaving a stale in-memory session).
• Recompute remaining session time from the wall clock when the warning timer fires (with a small safety margin) to avoid showing a timeout modal for an already-expired session.
• Drive the timeout modal countdown from an absolute deadline (and add unit tests covering sleep/throttling scenarios); additionally fixes import ordering in auth modal files.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/Umbraco.Web.UI.Client/src/packages/core/auth/modals/umb-auth-timeout-modal.element.ts	Countdown now uses an absolute deadline; adds interval-guard on reconnect; expires via onExpired callback.
src/Umbraco.Web.UI.Client/src/packages/core/auth/modals/umb-auth-timeout-modal.element.test.ts	New tests validating countdown tick behavior and wall-clock expiry after simulated sleep.
src/Umbraco.Web.UI.Client/src/packages/core/auth/modals/umb-app-auth-modal.token.ts	Import order adjustment; removes misleading @required JSDoc on an optional value.
src/Umbraco.Web.UI.Client/src/packages/core/auth/modals/umb-app-auth-modal.element.ts	Import order adjustment.
src/Umbraco.Web.UI.Client/src/packages/core/auth/modals/manifests.ts	Import order adjustment.
src/Umbraco.Web.UI.Client/src/packages/core/auth/controllers/auth-session-timeout.controller.ts	Recomputes remaining time at timer-fire; introduces expiry safety margin; #tryValidateToken() times out on refresh failure; getContext() moved into guarded try.
src/Umbraco.Web.UI.Client/src/packages/core/auth/controllers/auth-session-timeout.controller.test.ts	New tests for warning-zone modal opening, refresh success/failure behavior, and late timer firing after simulated sleep.