@devopsplaybook.io/common-web 0.2.1-beta.3.d89a040 → 0.3.0-beta.4.2c7f218

package/CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to this project are documented here.
 This project follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/)
 and [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.0] - 2026-09-28
+
+### Added
+
+- Automatically renew authenticated sessions before their JWT expires.
+
 ## [0.2.1] - 2026-09-28
 
 ### Fixed

package/README.md

@@ -50,6 +50,10 @@ required. The `playground/` directory demonstrates a consuming app.
 The canonical auth storage key is `auth_token`. During this compatibility
 release, `AUTH_TOKEN` and `AUTH_TOKEN_KEY` are read and migrated to the
 canonical key. Tokens remain in `localStorage`, matching existing applications.
+When an authenticated token has entered the final 20% of its lifetime,
+`AuthService` renews it through `POST /api/users/session/refresh` before
+returning it from `getToken()` or `getAuthHeader()`. This extends active
+sessions without requiring users to sign in again.
 
 ## Tokens and app-shell styles
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devopsplaybook.io/common-web",
-  "version": "0.2.1-beta.3.d89a040",
+  "version": "0.3.0-beta.4.2c7f218",
   "description": "Shared Nuxt layer for DevOpsPlaybook web applications",
   "license": "ISC",
   "engines": {

package/services/AuthService.ts

@@ -1,8 +1,15 @@
+import axios from "axios";
 import { jwtDecode } from "jwt-decode";
+import Config from "./Config";
 
 export const AUTH_TOKEN_KEY = "auth_token";
 const LEGACY_TOKEN_KEYS = ["AUTH_TOKEN", "AUTH_TOKEN_KEY"] as const;
 
+interface AuthTokenClaims {
+  exp?: number;
+  iat?: number;
+}
+
 export interface AuthHeaders {
   headers?: {
     Authorization: string;
@@ -10,6 +17,10 @@ export interface AuthHeaders {
 }
 
 export class AuthService {
+  private static renewal:
+    | { token: string; promise: Promise<string | null> }
+    | null = null;
+
   static async isAuthenticated(): Promise<boolean> {
     return Boolean(await AuthService.getToken());
   }
@@ -40,12 +51,22 @@ export class AuthService {
 
     if (!token) return null;
 
-    const decoded = jwtDecode<{ exp?: number }>(token);
-    if (typeof decoded.exp === "number" && decoded.exp <= Date.now() / 1000) {
+    const decoded = jwtDecode<AuthTokenClaims>(token);
+    const now = Date.now() / 1000;
+    if (typeof decoded.exp === "number" && decoded.exp <= now) {
       await AuthService.removeToken();
       return null;
     }
 
+    if (
+      typeof decoded.exp === "number" &&
+      typeof decoded.iat === "number" &&
+      decoded.exp > decoded.iat &&
+      decoded.exp - now <= (decoded.exp - decoded.iat) * 0.2
+    ) {
+      return AuthService.renewToken(token);
+    }
+
     return token;
   }
 
@@ -55,4 +76,43 @@ export class AuthService {
       ? { headers: { Authorization: `Bearer ${token}` } }
       : {};
   }
+
+  private static async renewToken(token: string): Promise<string | null> {
+    const existing = AuthService.renewal;
+    if (existing?.token === token) {
+      return existing.promise;
+    }
+
+    const promise = AuthService.requestTokenRenewal(token);
+    AuthService.renewal = { token, promise };
+    try {
+      return await promise;
+    } finally {
+      if (AuthService.renewal?.promise === promise) {
+        AuthService.renewal = null;
+      }
+    }
+  }
+
+  private static async requestTokenRenewal(
+    token: string,
+  ): Promise<string | null> {
+    const config = await Config.get();
+    const response = await axios.post<{ token?: unknown }>(
+      `${config.SERVER_URL}/users/session/refresh`,
+      {},
+      { headers: { Authorization: `Bearer ${token}` } },
+    );
+    const renewedToken = response.data?.token;
+    if (typeof renewedToken !== "string" || renewedToken.length === 0) {
+      throw new Error("Session renewal response did not include a token");
+    }
+
+    if (localStorage.getItem(AUTH_TOKEN_KEY) !== token) {
+      return localStorage.getItem(AUTH_TOKEN_KEY);
+    }
+
+    await AuthService.saveToken(renewedToken);
+    return renewedToken;
+  }
 }