feat(auth): split auth session module — user entity + session management - #144
Closed
xyh202131 wants to merge 1 commit into
Closed
feat(auth): split auth session module — user entity + session management#144xyh202131 wants to merge 1 commit into
xyh202131 wants to merge 1 commit into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![fennoai[bot]](https://avatars.githubusercontent.com/in/1924301?s=60&v=4){kind=small}
| [apis], | ||
| ) | ||
|
|
||
| useEffect(() => registerApiAccessTokenProvider(() => accessTokenRef.current), []) |
Contributor
There was a problem hiding this comment.
High: this effect ignores the unregister callback returned by registerApiAccessTokenProvider. The provider stays on the global stack after unmount, so getApiAccessToken() can keep returning a stale token and later mounts/tests will inherit leaked state.
| useEffect(() => { | ||
| let active = true | ||
|
|
||
| if (!bootstrapPromiseRef.current) { |
Contributor
There was a problem hiding this comment.
High: the bootstrap refresh is cached only inside this component instance. In React StrictMode the provider is mounted, unmounted, and mounted again, so the initial rotateTokens() call can fire twice for the same persisted refresh token and defeat the intended single-refresh behavior.
…gement Split the auth session module from the main codebase: entities/user: - User, AuthTokens, UserApis type definitions - createUserApis backend adapter (snake_case -> camelCase mapping) - Supports ApiClient injection for testability features/auth-session: - AuthSessionProvider: three-state session (booting -> guest | authenticated) - useAuthSession() hook for consuming auth context - ProtectedRoute: route guard with safe returnTo validation - resolveAuthMode(): local dev by default, forces backend in production - createLocalUserApis(): browser-only dev adapter (no password verification) - session-storage: refresh token localStorage persistence with graceful degradation Tests: 14 test cases covering session lifecycle, token rotation, StrictMode dedup, stale request handling, JWT refresh scheduling, local dev adapter, and route protection.
xyh202131
force-pushed
the
split/auth-session
branch
from
August 6, 2026 09:43
594ee42 to
f0a06c3
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
变更范围
拆分登录与认证会话模块到独立分支，包含两个子模块：
entities/user —— 用户实体契约
index.ts—User、AuthTokens、UserApis类型定义（sendCode / register / login / loginByCode / refresh / logout / me / changePassword 共 8 个方法）api.ts—createUserApis后端适配器，蛇形命名 → 驼峰命名映射，支持注入 ApiClientfeatures/auth-session —— 认证会话管理
index.tsx—AuthSessionProvider（三态：booting → guest | authenticated）、useAuthSession()hook、ProtectedRoute路由守卫（含安全 returnTo 校验）、resolveAuthMode()开发/生产适配、createLocalUserApis()本地开发适配器session-storage.ts— refresh token 的 localStorage 持久化与降级处理模块依赖
shared/api（已合入 main 的 feat(frontend): add shared API client infrastructure #117）测试覆盖（14 个测试用例）