0.2.94

static/js/api.js

@@ -8,8 +8,8 @@
  */
 
 import { logDebug, logError, logWarn } from "@rustpad/logger";
-import { formatNumber, restoreGuestLanguage, translateApiMessage } from "@rustpad/i18n";
-import { restoreGuestTheme } from "@rustpad/theme";
+import { formatNumber, translateApiMessage } from "@rustpad/i18n";
+import { expireAuthSession, getAuthToken } from "@rustpad/session";
 
 const DEFAULT_ERRORS = {
   400: "Invalid request.",
@@ -65,29 +65,26 @@ function formatBytes(bytes) {
   return `${formatNumber(bytes)} B`;
 }
 
-function clearExpiredSession() {
-  localStorage.removeItem("rustpad:auth-state");
-  localStorage.removeItem("rustpad:auth-token");
-  sessionStorage.removeItem("rustpad:auth-token");
-  localStorage.removeItem("rustpad:nickname");
-  sessionStorage.removeItem("rustpad:nickname");
-  document.cookie = "rustpad_nickname=; Path=/; SameSite=Lax; Max-Age=0";
-  restoreGuestTheme();
-  void restoreGuestLanguage();
-  window.dispatchEvent(new CustomEvent("rustpad:session-expired"));
-  window.dispatchEvent(new CustomEvent("rustpad:session-change", { detail: { session: null } }));
-}
-
+// Multiple simultaneous 401s must not start multiple session checks.
+let sessionCheckPromise = null;
 async function clearSessionIfInvalid() {
-  if (!localStorage.getItem("rustpad:auth-state")) return;
-  try {
-    const response = await fetch("/api/auth/me", {
-      signal: AbortSignal.timeout(5000),
-    });
-    if (response.status === 401) clearExpiredSession();
-  } catch {
-    // A network failure does not prove that the session is invalid.
+  if (!getAuthToken()) return;
+  if (!sessionCheckPromise) {
+    sessionCheckPromise = (async () => {
+      const response = await fetch("/api/auth/session", {
+        credentials: "same-origin",
+        cache: "no-store",
+        signal: AbortSignal.timeout(5000),
+      });
+      // A failed check is not proof that the user is logged out.
+      if (!response.ok) return;
+      const data = await response.json();
+      if (data.authenticated === false && data.session === null) await expireAuthSession();
+    })().catch(() => {
+      // Network and parsing errors must not erase the saved session.
+    }).finally(() => { sessionCheckPromise = null; });
   }
+  await sessionCheckPromise;
 }
 
 function validateUploadSize(body, configuredMaxBytes) {