[2witstudios]

Summary by CodeRabbit

• New Features

  • Added device token persistence with enhanced error handling for improved session recovery.

• Bug Fixes

  • Improved token refresh retry logic to gracefully pause instead of forcing logout on max attempts.
  • Extended token refresh recovery to web sessions for better consistency across platforms.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Caution

Review failed

The pull request is closed.

📝 Walkthrough

Walkthrough

The pull request enhances token refresh logic by introducing refresh outcome tracking to control retry behavior, adding device token and CSRF token persistence from device-token fallback responses with error handling, and implementing a web-token refresh flow in the auth store that mirrors desktop behavior for improved session recovery without forced logout on temporary failures.

Changes

Cohort / File(s)	Summary
Refresh Outcome Tracking apps/web/src/hooks/useTokenRefresh.ts	Added lastRefreshResultRef to track refresh success/shouldLogout state; modified retry logic to abort further retries when shouldLogout is true; changed max-retry behavior from immediate logout to pausing refresh attempts and resetting retry counter.
Device Token & CSRF Persistence apps/web/src/lib/auth/auth-fetch.ts	Implemented parsing and localStorage persistence of deviceToken and csrfToken from device-token-based refresh responses in both web and desktop paths; added error handling for storage failures with warning logs; logs session recovery via device token fallback.
Auth Store Session Recovery apps/web/src/stores/useAuthStore.ts	Added web-token refresh flow mirroring desktop behavior: on token validation failure, conditionally attempts refresh via refreshAuthSession and retries session load on success; on non-fatal failure increments failedAuthAttempts and tracks last failed auth check.
Test Mock Update apps/web/src/stores/__tests__/useAuthStore.test.ts	Updated mocked refreshAuthSession return value to include shouldLogout: true field alongside success: false.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~22 minutes

Possibly related PRs

• fix(desktop): prevent idle logout and memory leak in auth system #202: Modifies auth refresh control-flow and device-token/CSRF parsing with refined refresh outcome handling (shouldLogout/retry logic).
• Claude/fix device logout issue rw whv #220: Touches token refresh paths and auth refresh logic affecting stores and hooks in parallel scope.
• fix(desktop): add power state handling to prevent premature logout #203: Modifies token-refresh flows in the same files (useTokenRefresh.ts, auth-fetch.ts) with refresh outcome handling changes.

Poem

🐰 A token refresh dance, oh what a sight,
Device tokens saved, CSRF locked tight!
When refresh attempts stumble and retry,
Smart logout decisions—no more quick goodbye! 🔐

✨ Finishing touches

• 📝 Generate docstrings

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}