2.0 KiB
Restore sign-in after page reload — 14 October 2026
The page now restores a valid human session on mount through GET /v1/session,
using the existing HttpOnly cookie. It recovers an in-memory CSRF token and reloads
permissions and data. Reloading or navigating between library, administration and
agent credentials no longer requires passwords while the session remains valid.
A stable one-way CSRF token is derived from the private session secret. An additive
restored_csrf_digest column preserves the original token for other tabs and already
issued sessions. Restoration neither exposes the cookie nor extends its eight-hour
expiry. Same-origin checks and a custom client header protect restoration. Expired,
revoked and signed-out sessions return 401; the UI then shows sign-in. No local or
session storage is used. A failed restored admin-page permission check preserves the
valid session rather than signing the user out of other surfaces.
PASS: 183 backend tests; 22 frontend tests, TypeScript, ESLint and production build; Ruff check/format, mypy, module boundaries and generated operation/agent contracts. Regression cases include pre-upgrade migration, old-tab CSRF preservation, stable restoration, original expiry, revocation, origin/header checks, remount restoration in admin and library, and explicit sign-out returning to the login form.
Live HTTPS smoke check: session restoration 200 twice, stable CSRF, unchanged expiry, authenticated admin project list 200, sign-out with the original tab's CSRF 200, restoration after sign-out 401. The smoke check's temporary session was revoked; no operator account password or existing user session was changed.
LIMITED: collaborative preview navigation timed out, so a complete rendered browser reload walkthrough was not observed. Remount behavior is covered by component tests and the deployed HTTPS session protocol was verified directly. No knowledge records were changed, unrelated work was preserved, and no commit was made.