@autobusal/providers 1.2.9 → 1.2.10

package/CHANGELOG.md

@@ -4,6 +4,11 @@ All notable changes to `@autobusal/providers` are documented here. This project
 adheres to [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.2.10] - 2026-07-19
+
+### Fixed
+
+- Resilient bff-mode auth: on a 401 the apiClient now confirms the session with the BFF (GET /bff/session) before logging out, and transparently retries the request once if still authenticated. Prevents a transient post-login 401 (an account query racing the login cookie hand-off) from bouncing the user straight back to the login page. Bearer mode is unchanged.
 ## [1.2.9] - 2026-07-19
 
 ### Added

package/Queries/apiClient.ts

@@ -39,11 +39,35 @@ if (!isBffMode) {
 
 apiClient.interceptors.response.use(response => (
   response
-), error => {
+), async (error) => {
   if (error.response) {
-    // if we have a 401, we go to the logout page (if not already there)
+    // if we have a 401, the session is gone, so we go to the logout page.
     if (error.response.status === 401 && window.location.pathname !== '/account/logout') {
+      // bff mode: auth is a server-side httpOnly cookie the BFF manages. A
+      // request that races the login/cookie hand-off (e.g. the account queries
+      // fired the instant the SPA lands on /account) can 401 transiently while
+      // the session is actually valid - and a blind logout here would drop the
+      // user straight back out. So confirm with the BFF first; if we are still
+      // authenticated, transparently retry the request once instead of logging
+      // out. bearer mode has no such race (the token is attached synchronously
+      // from localStorage) and falls straight through to logout.
+      if (isBffMode && error.config && !error.config._bffAuthRetried) {
+        try {
+          const { data } = await apiClient.get('/session');
+
+          if (data?.authenticated) {
+            error.config._bffAuthRetried = true;
+
+            return await apiClient(error.config);
+          }
+        } catch {
+          // /session unreachable - fall through to logout.
+        }
+      }
+
       window.location.href = '/account/logout';
+
+      return Promise.reject(error);
     }
 
     // if the user is not valid

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autobusal/providers",
-  "version": "1.2.9",
+  "version": "1.2.10",
   "author": "Ferjolt Ozuni",
   "type": "module",
   "main": "index.ts"