feat: Auth and session reliability overhaul with refresh token support#132
Open
Meganugger wants to merge 3 commits intoOpenCloudGaming:devfrom
Open
feat: Auth and session reliability overhaul with refresh token support#132Meganugger wants to merge 3 commits intoOpenCloudGaming:devfrom
Meganugger wants to merge 3 commits intoOpenCloudGaming:devfrom
Conversation
…oning Replace fixed 30-attempt polling loop with resilient session provisioning: - Exponential backoff polling (1s initial, 1.5x growth, 5s cap) instead of fixed 2s intervals - Hard timeout of 180s instead of 60s (30×2s), with clear user messaging - status=1 (provisioning) treated as normal — keeps polling, never throws - status=6 (cleaning up) treated as terminal failure - Unknown statuses continue polling with warning logs - AbortController integration: Cancel button / navigation cleanly aborts the poll loop without showing a false error - User abort (DOMException AbortError) distinguished from real errors — no error toast shown on user cancellation - StreamLoading shows 'Still starting… (Xs)' after 30s of provisioning - provisioningElapsed state resets properly on completion or abort - Single-flight guard preserved via existing launchInFlightRef Eliminates the error → wait → Resume click flow: sessions that are still provisioning automatically proceed to signaling once ready. Tests: 35 passing assertions covering immediate ready, long provisioning, status transitions, abort cancellation, hard timeout, and backoff behavior. Co-authored-by: Capy <capy@capy.ai>
Auth System: - Add offline_access scope to OAuth PKCE flow for refresh tokens - Centralized 401 interceptor with Promise-based refresh mutex - Single lockedRefresh() prevents parallel refresh attempts - withRetryOn401() wrapper retries failed API calls once after refresh - No infinite loops: retry limited to exactly once per request - client_token exchange fallback (token-exchange grant type) when standard refresh_token flow fails - Validate refresh response: reject empty access_token - Session expired event (auth:session-expired IPC channel) emitted on unrecoverable 401 or failed refresh - Auto-logout: clears session, notifies renderer, shows error on login screen Session Clock: - New settings: sessionClockShowEveryMinutes (default 60), sessionClockShowDurationSeconds (default 30) - Auto-hide/periodic reveal logic in streaming view - Clock shows initially, hides after duration - Re-reveals every N minutes for configured duration - 0 minutes = always visible - Clean interval cleanup on unmount/session end - Settings UI section with numeric inputs and hints Navigation: - Navbar modal pushes history state on open - popstate listener closes modal on browser back - No routing breakage: uses pushState/popstate pattern Build: - CI matrix upgraded to 4 CPU instances (blacksmith-4vcpu-*) for all build and release runners Zero new type errors. Zero new lint warnings. Pre-existing TS2367 on keyboardLock permission unchanged. Co-authored-by: Capy <capy@capy.ai>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Comprehensive overhaul of the authentication and session management systems, adding refresh token support with mutex-protected token exchange, 401 retry logic, session expired events, improved launch polling to prevent premature timeouts, and session clock auto-hide/reveal behavior.
Added
offline_accessscope in OAuth PKCE flow for refresh tokenslockedRefresh()mutex (prevents parallel refresh attempts)withRetryOn401()wrapper — retries failed API calls exactly once after token refreshclient_tokenexchange fallback when standard refresh failsauth:session-expiredIPC event for unrecoverable auth failures with auto-logoutsessionClockShowEveryMinutes,sessionClockShowDurationSecondspushState/popstatesession-polling.test.ts— unit tests for session launch pollingUpdated
auth.ts— rewritten with refresh mutex, retry logic, and token validationcloudmatch.ts— improved session status polling with grace periodstypes.ts— extended session status typesApp.tsx— session launch polling with configurable timeouts and grace periodsStreamLoading.tsx— provisioning-aware timeout displayStreamView.tsx— session clock auto-hide/reveal intervalsSettingsPage.tsx— session clock configuration UINavbar.tsx— modal history state managementblacksmith-4vcpu-*instancesFixed
Validation Notes
Recommended smoke checks:
npm testand verify session-polling tests pass