@payloadcms/ui 4.0.0-internal.21664f3 → 4.0.0-internal.2f0d313

package/dist/providers/Auth/authSessionRequests.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authSessionRequests.spec.js","names":["describe","expect","it","createAuthSessionRequests","authRequests","first","createDeferred","order","firstRequest","queue","push","promise","secondRequest","toEqual","Promise","resolve","all","refresh","runs","run","second","toBe","operation","isResultStaleAfterSettlement","request","isResultStale","discardPendingResults","logout","clears","logoutRequests","logOut","clearSession","isLoggingOut","toBeNull","invalidations","invalidateWhenIdle","resolvePromise","Error"],"sources":["../../../src/providers/Auth/authSessionRequests.spec.ts"],"sourcesContent":["import { describe, expect, it } from 'vitest'\n\nimport { createAuthSessionRequests } from './authSessionRequests.js'\n\ndescribe('createAuthSessionRequests', () => {\n  it('should serialize auth requests in queue order', async () => {\n    const authRequests = createAuthSessionRequests()\n    const first = createDeferred<void>()\n    const order: string[] = []\n\n    const firstRequest = authRequests.queue(async () => {\n      order.push('first:start')\n      await first.promise\n      order.push('first:end')\n    })\n    const secondRequest = authRequests.queue(async () => {\n      order.push('second')\n    })\n\n    expect(order).toEqual([])\n    await Promise.resolve()\n    expect(order).toEqual(['first:start'])\n\n    first.resolve()\n    await Promise.all([firstRequest, secondRequest])\n    expect(order).toEqual(['first:start', 'first:end', 'second'])\n  })\n\n  it('should share a refresh while session results remain current', async () => {\n    const authRequests = createAuthSessionRequests()\n    const refresh = createDeferred<null>()\n    let runs = 0\n    const run = () =>\n      authRequests.refresh(async () => {\n        runs += 1\n        return refresh.promise\n      })\n\n    const first = run()\n    const second = run()\n    expect(first).toBe(second)\n\n    refresh.resolve(null)\n    await Promise.all([first, second])\n    expect(runs).toBe(1)\n  })\n\n  it('should discard a queued result after the session changes', async () => {\n    const authRequests = createAuthSessionRequests()\n    const operation = createDeferred<void>()\n    let isResultStaleAfterSettlement = false\n\n    const request = authRequests.queue(async ({ isResultStale }) => {\n      await operation.promise\n      isResultStaleAfterSettlement = isResultStale()\n    })\n\n    await Promise.resolve()\n    authRequests.discardPendingResults()\n    operation.resolve()\n    await request\n\n    expect(isResultStaleAfterSettlement).toBe(true)\n  })\n\n  it('should settle a logout once and prevent refresh from committing', async () => {\n    const authRequests = createAuthSessionRequests()\n    const logout = createDeferred<void>()\n    let clears = 0\n    let logoutRequests = 0\n\n    const first = authRequests.logOut({\n      clearSession: () => {\n        clears += 1\n        authRequests.discardPendingResults()\n      },\n      request: async () => {\n        logoutRequests += 1\n        await logout.promise\n      },\n    })\n    const second = authRequests.logOut({\n      clearSession: () => {\n        clears += 1\n      },\n      request: async () => {\n        logoutRequests += 1\n      },\n    })\n\n    expect(first).toBe(second)\n    expect(authRequests.isLoggingOut()).toBe(true)\n    expect(await authRequests.refresh(async () => null)).toBeNull()\n    logout.resolve()\n    await first\n    expect({ clears, logoutRequests }).toEqual({ clears: 1, logoutRequests: 1 })\n  })\n\n  it('should discard a deferred invalidation after the session changes', async () => {\n    const authRequests = createAuthSessionRequests()\n    let invalidations = 0\n\n    const first = authRequests.refresh(async ({ invalidateWhenIdle }) => {\n      invalidateWhenIdle(() => {\n        invalidations += 1\n      })\n      return null\n    })\n    const second = authRequests.queue(async () => {\n      authRequests.discardPendingResults()\n    })\n\n    await Promise.all([first, second])\n    expect(invalidations).toBe(0)\n  })\n})\n\nfunction createDeferred<Value>(): {\n  promise: Promise<Value>\n  resolve: (value: Value | PromiseLike<Value>) => void\n} {\n  let resolve: ((value: Value | PromiseLike<Value>) => void) | undefined\n  const promise = new Promise<Value>((resolvePromise) => {\n    resolve = resolvePromise\n  })\n\n  if (!resolve) {\n    throw new Error('Expected deferred promise resolver.')\n  }\n\n  return { promise, resolve }\n}\n"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ;AAErC,SAASC,yBAAyB,QAAQ;AAE1CH,QAAA,CAAS,6BAA6B;EACpCE,EAAA,CAAG,iDAAiD;IAClD,MAAME,YAAA,GAAeD,yBAAA;IACrB,MAAME,KAAA,GAAQC,cAAA;IACd,MAAMC,KAAA,GAAkB,EAAE;IAE1B,MAAMC,YAAA,GAAeJ,YAAA,CAAaK,KAAK,CAAC;MACtCF,KAAA,CAAMG,IAAI,CAAC;MACX,MAAML,KAAA,CAAMM,OAAO;MACnBJ,KAAA,CAAMG,IAAI,CAAC;IACb;IACA,MAAME,aAAA,GAAgBR,YAAA,CAAaK,KAAK,CAAC;MACvCF,KAAA,CAAMG,IAAI,CAAC;IACb;IAEAT,MAAA,CAAOM,KAAA,EAAOM,OAAO,CAAC,EAAE;IACxB,MAAMC,OAAA,CAAQC,OAAO;IACrBd,MAAA,CAAOM,KAAA,EAAOM,OAAO,CAAC,CAAC,cAAc;IAErCR,KAAA,CAAMU,OAAO;IACb,MAAMD,OAAA,CAAQE,GAAG,CAAC,CAACR,YAAA,EAAcI,aAAA,CAAc;IAC/CX,MAAA,CAAOM,KAAA,EAAOM,OAAO,CAAC,CAAC,eAAe,aAAa,SAAS;EAC9D;EAEAX,EAAA,CAAG,+DAA+D;IAChE,MAAME,YAAA,GAAeD,yBAAA;IACrB,MAAMc,OAAA,GAAUX,cAAA;IAChB,IAAIY,IAAA,GAAO;IACX,MAAMC,GAAA,GAAMA,CAAA,KACVf,YAAA,CAAaa,OAAO,CAAC;MACnBC,IAAA,IAAQ;MACR,OAAOD,OAAA,CAAQN,OAAO;IACxB;IAEF,MAAMN,KAAA,GAAQc,GAAA;IACd,MAAMC,MAAA,GAASD,GAAA;IACflB,MAAA,CAAOI,KAAA,EAAOgB,IAAI,CAACD,MAAA;IAEnBH,OAAA,CAAQF,OAAO,CAAC;IAChB,MAAMD,OAAA,CAAQE,GAAG,CAAC,CAACX,KAAA,EAAOe,MAAA,CAAO;IACjCnB,MAAA,CAAOiB,IAAA,EAAMG,IAAI,CAAC;EACpB;EAEAnB,EAAA,CAAG,4DAA4D;IAC7D,MAAME,YAAA,GAAeD,yBAAA;IACrB,MAAMmB,SAAA,GAAYhB,cAAA;IAClB,IAAIiB,4BAAA,GAA+B;IAEnC,MAAMC,OAAA,GAAUpB,YAAA,CAAaK,KAAK,CAAC,OAAO;MAAEgB;IAAa,CAAE;MACzD,MAAMH,SAAA,CAAUX,OAAO;MACvBY,4BAAA,GAA+BE,aAAA;IACjC;IAEA,MAAMX,OAAA,CAAQC,OAAO;IACrBX,YAAA,CAAasB,qBAAqB;IAClCJ,SAAA,CAAUP,OAAO;IACjB,MAAMS,OAAA;IAENvB,MAAA,CAAOsB,4BAAA,EAA8BF,IAAI,CAAC;EAC5C;EAEAnB,EAAA,CAAG,mEAAmE;IACpE,MAAME,YAAA,GAAeD,yBAAA;IACrB,MAAMwB,MAAA,GAASrB,cAAA;IACf,IAAIsB,MAAA,GAAS;IACb,IAAIC,cAAA,GAAiB;IAErB,MAAMxB,KAAA,GAAQD,YAAA,CAAa0B,MAAM,CAAC;MAChCC,YAAA,EAAcA,CAAA;QACZH,MAAA,IAAU;QACVxB,YAAA,CAAasB,qBAAqB;MACpC;MACAF,OAAA,EAAS,MAAAA,CAAA;QACPK,cAAA,IAAkB;QAClB,MAAMF,MAAA,CAAOhB,OAAO;MACtB;IACF;IACA,MAAMS,MAAA,GAAShB,YAAA,CAAa0B,MAAM,CAAC;MACjCC,YAAA,EAAcA,CAAA;QACZH,MAAA,IAAU;MACZ;MACAJ,OAAA,EAAS,MAAAA,CAAA;QACPK,cAAA,IAAkB;MACpB;IACF;IAEA5B,MAAA,CAAOI,KAAA,EAAOgB,IAAI,CAACD,MAAA;IACnBnB,MAAA,CAAOG,YAAA,CAAa4B,YAAY,IAAIX,IAAI,CAAC;IACzCpB,MAAA,CAAO,MAAMG,YAAA,CAAaa,OAAO,CAAC,YAAY,OAAOgB,QAAQ;IAC7DN,MAAA,CAAOZ,OAAO;IACd,MAAMV,KAAA;IACNJ,MAAA,CAAO;MAAE2B,MAAA;MAAQC;IAAe,GAAGhB,OAAO,CAAC;MAAEe,MAAA,EAAQ;MAAGC,cAAA,EAAgB;IAAE;EAC5E;EAEA3B,EAAA,CAAG,oEAAoE;IACrE,MAAME,YAAA,GAAeD,yBAAA;IACrB,IAAI+B,aAAA,GAAgB;IAEpB,MAAM7B,KAAA,GAAQD,YAAA,CAAaa,OAAO,CAAC,OAAO;MAAEkB;IAAkB,CAAE;MAC9DA,kBAAA,CAAmB;QACjBD,aAAA,IAAiB;MACnB;MACA,OAAO;IACT;IACA,MAAMd,MAAA,GAAShB,YAAA,CAAaK,KAAK,CAAC;MAChCL,YAAA,CAAasB,qBAAqB;IACpC;IAEA,MAAMZ,OAAA,CAAQE,GAAG,CAAC,CAACX,KAAA,EAAOe,MAAA,CAAO;IACjCnB,MAAA,CAAOiC,aAAA,EAAeb,IAAI,CAAC;EAC7B;AACF;AAEA,SAASf,eAAA;EAIP,IAAIS,OAAA;EACJ,MAAMJ,OAAA,GAAU,IAAIG,OAAA,CAAgBsB,cAAA;IAClCrB,OAAA,GAAUqB,cAAA;EACZ;EAEA,IAAI,CAACrB,OAAA,EAAS;IACZ,MAAM,IAAIsB,KAAA,CAAM;EAClB;EAEA,OAAO;IAAE1B,OAAA;IAASI;EAAQ;AAC5B","ignoreList":[]}

package/dist/providers/Auth/index.d.ts

@@ -1,60 +1,7 @@
 import type { AuthenticatedUser, SanitizedPermissions } from 'payload';
 import React from 'react';
-export type UserWithToken<T = AuthenticatedUser> = {
-    /** seconds until expiration */
-    exp: number;
-    refreshedToken?: string;
-    token?: string;
-    user: T;
-};
-export type AuthContext<T = AuthenticatedUser> = {
-    fetchFullUser: () => Promise<null | T>;
-    logOut: () => Promise<boolean>;
-    /**
-     * These are the permissions for the current user from a global scope.
-     *
-     * When checking for permissions on document specific level, use the `useDocumentInfo` hook instead.
-     *
-     * @example
-     *
-     * ```tsx
-     * import { useAuth } from 'payload/ui'
-     *
-     * const MyComponent: React.FC = () => {
-     *   const { permissions } = useAuth()
-     *
-     *   if (permissions?.collections?.myCollection?.create) {
-     *     // user can create documents in 'myCollection'
-     *   }
-     *
-     *   return null
-     * }
-     * ```
-     *
-     * with useDocumentInfo:
-     *
-     * ```tsx
-     * import { useDocumentInfo } from 'payload/ui'
-     *
-     * const MyComponent: React.FC = () => {
-     *  const { docPermissions } = useDocumentInfo()
-     *  if (docPermissions?.create) {
-     *   // user can create this document
-     *  }
-     *  return null
-     * } ```
-     */
-    permissions?: SanitizedPermissions;
-    refreshCookie: (forceRefresh?: boolean) => void;
-    refreshCookieAsync: () => Promise<null | T>;
-    refreshPermissions: () => Promise<void>;
-    setPermissions: (permissions: SanitizedPermissions) => void;
-    setUser: (user: null | UserWithToken<T>) => void;
-    strategy?: string;
-    token?: string;
-    tokenExpirationMs?: number;
-    user?: null | T;
-};
+import type { AuthContext } from './types.js';
+export type { AuthContext, AuthSession, UserWithToken } from './types.js';
 type Props = {
     children: React.ReactNode;
     permissions?: SanitizedPermissions;
@@ -62,5 +9,4 @@ type Props = {
 };
 export declare function AuthProvider({ children, permissions: initialPermissions, user: initialUser, }: Props): React.JSX.Element;
 export declare const useAuth: <T = AuthenticatedUser>() => AuthContext<T>;
-export {};
 //# sourceMappingURL=index.d.ts.map

package/dist/providers/Auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/providers/Auth/index.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AAKtE,OAAO,KAA+D,MAAM,OAAO,CAAA;AAWnF,MAAM,MAAM,aAAa,CAAC,CAAC,GAAG,iBAAiB,IAAI;IACjD,+BAA+B;IAC/B,GAAG,EAAE,MAAM,CAAA;IACX,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,CAAC,CAAA;CACR,CAAA;AAED,MAAM,MAAM,WAAW,CAAC,CAAC,GAAG,iBAAiB,IAAI;IAC/C,aAAa,EAAE,MAAM,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,CAAA;IACtC,MAAM,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;IAC9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,WAAW,CAAC,EAAE,oBAAoB,CAAA;IAClC,aAAa,EAAE,CAAC,YAAY,CAAC,EAAE,OAAO,KAAK,IAAI,CAAA;IAC/C,kBAAkB,EAAE,MAAM,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,CAAA;IAC3C,kBAAkB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IACvC,cAAc,EAAE,CAAC,WAAW,EAAE,oBAAoB,KAAK,IAAI,CAAA;IAC3D,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,KAAK,IAAI,CAAA;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,CAAA;CAChB,CAAA;AAMD,KAAK,KAAK,GAAG;IACX,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;IACzB,WAAW,CAAC,EAAE,oBAAoB,CAAA;IAClC,IAAI,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAA;CAChC,CAAA;AAED,wBAAgB,YAAY,CAAC,EAC3B,QAAQ,EACR,WAAW,EAAE,kBAAkB,EAC/B,IAAI,EAAE,WAAW,GAClB,EAAE,KAAK,qBAgUP;AAED,eAAO,MAAM,OAAO,GAAI,CAAC,GAAG,iBAAiB,OAAM,WAAW,CAAC,CAAC,CAAmC,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/providers/Auth/index.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AAKtE,OAAO,KAA+D,MAAM,OAAO,CAAA;AAInF,OAAO,KAAK,EAAE,WAAW,EAA8B,MAAM,YAAY,CAAA;AAczE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAIzE,KAAK,KAAK,GAAG;IACX,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;IACzB,WAAW,CAAC,EAAE,oBAAoB,CAAA;IAClC,IAAI,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAA;CAChC,CAAA;AAsBD,wBAAgB,YAAY,CAAC,EAC3B,QAAQ,EACR,WAAW,EAAE,kBAAkB,EAC/B,IAAI,EAAE,WAAW,GAClB,EAAE,KAAK,qBAodP;AAED,eAAO,MAAM,OAAO,GAAI,CAAC,GAAG,iBAAiB,OAAM,WAAW,CAAC,CAAC,CAAmC,CAAA"}

package/dist/providers/Auth/index.js

@@ -11,10 +11,13 @@ import { useEffectEvent } from '../../hooks/useEffectEvent.js';
 import { useTranslation } from '../../providers/Translation/index.js';
 import { requests } from '../../utilities/api.js';
 import { useConfig } from '../Config/index.js';
-import { usePathname, useRouter } from '../RouterAdapter/index.js';
+import { usePathname, useRouter, useSearchParams } from '../RouterAdapter/index.js';
 import { useRouteTransition } from '../RouteTransition/index.js';
+import { createAuthSessionRequests } from './authSessionRequests.js';
+import { TAB_SESSION_EVENT_TYPES } from './tabSessionSync/index.js';
+import { useTabSessionSync } from './tabSessionSync/useTabSessionSync.js';
+import { useAuthSessionTimers } from './useAuthSessionTimers.js';
 const Context = /*#__PURE__*/createContext({});
-const maxTimeoutMs = 2147483647;
 export function AuthProvider({
   children,
   permissions: initialPermissions,
@@ -22,6 +25,8 @@ export function AuthProvider({
 }) {
   const pathname = usePathname();
   const router = useRouter();
+  const searchParams = useSearchParams();
+  const route = `${pathname}?${searchParams.toString()}`;
   const {
     config
   } = useConfig();
@@ -30,7 +35,8 @@ export function AuthProvider({
       autoLogin,
       autoRefresh,
       routes: {
-        inactivity: logoutInactivityRoute
+        inactivity: logoutInactivityRoute,
+        login: loginRoute
       },
       user: userSlug
     },
@@ -51,14 +57,12 @@ export function AuthProvider({
   } = useRouteTransition();
   const [user, setUserInMemory] = useState(initialUser);
   const [tokenInMemory, setTokenInMemory] = useState();
-  const [tokenExpirationMs, setTokenExpirationMs] = useState();
+  const [authSession, setAuthSession] = useState();
   const [permissions, setPermissions] = useState(initialPermissions);
-  const [forceLogoutBufferMs, setForceLogoutBufferMs] = useState(120_000);
   const [fetchedUserOnMount, setFetchedUserOnMount] = useState(false);
-  const refreshTokenTimeoutRef = React.useRef(null);
-  const reminderTimeoutRef = React.useRef(null);
-  const forceLogOutTimeoutRef = React.useRef(null);
-  const id = user?.id;
+  const [authRequests] = useState(createAuthSessionRequests);
+  const userRef = React.useRef(initialUser);
+  const isAuthenticated = Boolean(user);
   const redirectToInactivityRoute = useCallback(() => {
     const baseAdminRoute = formatAdminURL({
       adminRoute,
@@ -70,111 +74,221 @@ export function AuthProvider({
     })));
     closeAllModals();
   }, [router, adminRoute, logoutInactivityRoute, closeAllModals, startRouteTransition]);
-  const revokeTokenAndExpire = useCallback(() => {
-    setUserInMemory(null);
-    setTokenInMemory(undefined);
-    setTokenExpirationMs(undefined);
-    clearTimeout(refreshTokenTimeoutRef.current);
-  }, []);
-  // Handler for reminder timeout - uses useEffectEvent to capture latest autoRefresh value
-  const handleReminderTimeout = useEffectEvent(() => {
+  const redirectToLoginRoute = useCallback(() => {
+    startRouteTransition(() => router.replace(formatAdminURL({
+      adminRoute,
+      path: loginRoute
+    })));
+    closeAllModals();
+  }, [adminRoute, closeAllModals, loginRoute, router, startRouteTransition]);
+  function onSessionActivity() {
+    setAuthSession(currentAuthSession => {
+      if (!currentAuthSession || currentAuthSession.activityRecorded) {
+        return currentAuthSession;
+      }
+      return {
+        ...currentAuthSession,
+        activityRecorded: true
+      };
+    });
+  }
+  function onSessionActivityRefresh() {
+    void refreshSession({
+      isActivityRefresh: true
+    });
+  }
+  function onSessionExpiration(expirationMs) {
+    const collection = userRef.current?.collection;
+    tabSessionSync.broadcast({
+      type: TAB_SESSION_EVENT_TYPES.EXPIRED,
+      expiredTokenAt: expirationMs
+    });
+    void logOutSession({
+      collection
+    }).then(redirectToInactivityRoute);
+  }
+  function onSessionReminder() {
     if (autoRefresh) {
-      refreshCookieEvent();
+      sessionTimers.scheduleRefresh();
     } else {
       openModal(stayLoggedInModalSlug);
     }
+  }
+  const sessionTimers = useAuthSessionTimers({
+    isAuthenticated,
+    onActivity: onSessionActivity,
+    onActivityRefresh: onSessionActivityRefresh,
+    onExpire: onSessionExpiration,
+    onReminder: onSessionReminder
   });
-  const setNewUser = useCallback(userResponse => {
-    clearTimeout(reminderTimeoutRef.current);
-    clearTimeout(forceLogOutTimeoutRef.current);
-    if (userResponse?.user) {
-      setUserInMemory(userResponse.user);
-      setTokenInMemory(userResponse.token ?? userResponse.refreshedToken);
-      setTokenExpirationMs(userResponse.exp * 1000);
-      const expiresInMs = Math.max(0, Math.min((userResponse.exp ?? 0) * 1000 - Date.now(), maxTimeoutMs));
-      if (expiresInMs) {
-        const nextForceLogoutBufferMs = Math.min(60_000, expiresInMs / 2);
-        setForceLogoutBufferMs(nextForceLogoutBufferMs);
-        reminderTimeoutRef.current = setTimeout(handleReminderTimeout, Math.max(expiresInMs - nextForceLogoutBufferMs, 0));
-        forceLogOutTimeoutRef.current = setTimeout(() => {
-          revokeTokenAndExpire();
-          redirectToInactivityRoute();
-        }, expiresInMs);
+  useEffect(() => {
+    sessionTimers.recordActivity('route');
+  }, [route, sessionTimers]);
+  const clearUserInMemory = useCallback(() => {
+    userRef.current = null;
+    setUserInMemory(null);
+    setTokenInMemory(undefined);
+    setAuthSession(undefined);
+    sessionTimers.clear();
+  }, [sessionTimers]);
+  const setLocalSession = useCallback(session => {
+    if (session?.user) {
+      const expirationMs_0 = typeof session.exp === 'number' && Number.isFinite(session.exp) ? session.exp * 1000 : undefined;
+      const nextSessionTiming = expirationMs_0 !== undefined ? sessionTimers.setExpiration(expirationMs_0) : undefined;
+      userRef.current = session.user;
+      setUserInMemory(session.user);
+      setTokenInMemory(session.token ?? session.refreshedToken);
+      if (nextSessionTiming) {
+        setAuthSession({
+          ...nextSessionTiming,
+          activityRecorded: false
+        });
       }
     } else {
-      revokeTokenAndExpire();
+      clearUserInMemory();
     }
-  }, [redirectToInactivityRoute, revokeTokenAndExpire]);
-  const refreshCookie = useCallback(forceRefresh => {
-    if (!id) {
-      return;
+  }, [clearUserInMemory, sessionTimers]);
+  const setUser = useCallback(session_0 => {
+    authRequests.discardPendingResults();
+    setLocalSession(session_0);
+  }, [authRequests, setLocalSession]);
+  const tabSessionSync = useTabSessionSync({
+    getTokenExpirationMs: sessionTimers.getCurrentExpirationMs,
+    onSessionExpired: () => {
+      const collection_0 = userRef.current?.collection;
+      void logOutSession({
+        collection: collection_0
+      }).then(redirectToInactivityRoute);
+    },
+    onSessionLoggedOut: () => {
+      const collection_1 = userRef.current?.collection;
+      void logOutSession({
+        collection: collection_1
+      }).then(redirectToLoginRoute);
+    },
+    onSessionRefreshed: session_1 => {
+      if (!authRequests.isLoggingOut()) {
+        authRequests.discardPendingResults();
+        setLocalSession(session_1);
+      }
+    },
+    onTabSessionUnauthenticated: () => {
+      redirectToInactivityRoute();
+    },
+    reconcileSession: async options => {
+      const result = await fetchFullUserResult(options);
+      if (result.status === 'authenticated' && result.expirationMs !== undefined) {
+        return {
+          expirationMs: result.expirationMs,
+          status: result.status,
+          user: result.user
+        };
+      }
+      if (result.status === 'unauthenticated') {
+        return result;
+      }
+      return {
+        status: 'indeterminate'
+      };
     }
-    const expiresInMs_0 = Math.max(0, (tokenExpirationMs ?? 0) - Date.now());
-    if (forceRefresh || tokenExpirationMs && expiresInMs_0 < forceLogoutBufferMs * 2) {
-      clearTimeout(refreshTokenTimeoutRef.current);
-      refreshTokenTimeoutRef.current = setTimeout(async () => {
-        try {
-          const request = await requests.post(formatAdminURL({
-            apiRoute,
-            path: `/${userSlug}/refresh-token?refresh`
-          }), {
-            headers: {
-              'Accept-Language': i18n.language
-            }
-          });
-          if (request.status === 200) {
-            const json = await request.json();
-            setNewUser(json);
-          } else {
-            setNewUser(null);
-            redirectToInactivityRoute();
+  });
+  const refreshSession = useCallback(({
+    isActivityRefresh
+  }) => {
+    return authRequests.refresh(async ({
+      acceptResult,
+      invalidateWhenIdle,
+      isResultStale
+    }) => {
+      if (isResultStale()) {
+        return null;
+      }
+      const handledExpiration = sessionTimers.getCurrentExpirationMs();
+      const handledUser = userRef.current;
+      try {
+        const refreshStartedAt = Date.now();
+        const request = await requests.post(formatAdminURL({
+          apiRoute,
+          path: `/${userSlug}/refresh-token${isActivityRefresh ? '?refresh' : ''}`
+        }), {
+          headers: {
+            'Accept-Language': i18n.language
           }
-        } catch (e) {
-          toast.error(e.message);
+        });
+        if (isResultStale()) {
+          return null;
         }
-      }, 1000);
-    }
-  }, [apiRoute, i18n.language, redirectToInactivityRoute, setNewUser, tokenExpirationMs, userSlug, forceLogoutBufferMs, id]);
-  const refreshCookieAsync = useCallback(async skipSetUser => {
-    try {
-      const request_0 = await requests.post(formatAdminURL({
-        apiRoute,
-        path: `/${userSlug}/refresh-token`
-      }), {
-        headers: {
-          'Accept-Language': i18n.language
+        if (request.status === 200) {
+          const json = await request.json();
+          if (!acceptResult()) {
+            return null;
+          }
+          setLocalSession(json);
+          tabSessionSync.broadcast({
+            type: TAB_SESSION_EVENT_TYPES.REFRESHED,
+            refreshStartedAt,
+            session: json
+          });
+          return json.user;
         }
-      });
-      if (request_0.status === 200) {
-        const json_0 = await request_0.json();
-        if (!skipSetUser) {
-          setNewUser(json_0);
+        if (handledUser) {
+          const invalidateSession = () => {
+            if (handledExpiration !== undefined) {
+              tabSessionSync.broadcast({
+                type: TAB_SESSION_EVENT_TYPES.EXPIRED,
+                expiredTokenAt: handledExpiration
+              });
+            }
+            setLocalSession(null);
+            redirectToInactivityRoute();
+          };
+          invalidateWhenIdle(invalidateSession);
         }
-        return json_0.user;
+      } catch (e) {
+        toast.error(`Refreshing token failed: ${e.message}`);
       }
-      if (user) {
-        setNewUser(null);
-        redirectToInactivityRoute();
+      return null;
+    });
+  }, [apiRoute, authRequests, tabSessionSync, i18n.language, redirectToInactivityRoute, sessionTimers, setLocalSession, userSlug]);
+  const refreshCookieAsync = useCallback(() => refreshSession({
+    isActivityRefresh: false
+  }), [refreshSession]);
+  const logOutSession = useCallback(({
+    collection: collection_2
+  }) => {
+    return authRequests.logOut({
+      clearSession: () => {
+        authRequests.discardPendingResults();
+        setLocalSession(null);
+      },
+      request: async () => {
+        try {
+          if (collection_2) {
+            await requests.post(formatAdminURL({
+              apiRoute,
+              path: `/${collection_2}/logout`
+            }));
+          }
+        } catch (_) {
+          // Explicit logout always clears local state, even if server revocation fails.
+        }
       }
-    } catch (e_0) {
-      toast.error(`Refreshing token failed: ${e_0.message}`);
-    }
-    return null;
-  }, [apiRoute, i18n.language, redirectToInactivityRoute, setNewUser, userSlug, user]);
+    });
+  }, [apiRoute, authRequests, setLocalSession]);
   const logOut = useCallback(async () => {
-    try {
-      if (user && user.collection) {
-        setNewUser(null);
-        await requests.post(formatAdminURL({
-          apiRoute,
-          path: `/${user.collection}/logout`
-        }));
-      }
-    } catch (_) {
-      // fail silently and log the user out in state
+    const logoutEvent = {
+      type: TAB_SESSION_EVENT_TYPES.LOGGED_OUT
+    };
+    const logoutPublication = tabSessionSync.broadcast(logoutEvent);
+    const collection_3 = userRef.current?.collection;
+    await logOutSession({
+      collection: collection_3
+    });
+    if (logoutPublication?.type === TAB_SESSION_EVENT_TYPES.LOGGED_OUT) {
+      tabSessionSync.broadcastLogoutSettlement(logoutPublication);
     }
     return true;
-  }, [apiRoute, setNewUser, user]);
+  }, [tabSessionSync, logOutSession]);
   const refreshPermissions = useCallback(async ({
     locale
   } = {}) => {
@@ -184,7 +298,7 @@ export function AuthProvider({
       addQueryPrefix: true
     });
     try {
-      const request_1 = await requests.get(formatAdminURL({
+      const request_0 = await requests.get(formatAdminURL({
         apiRoute,
         path: `/access${params}`
       }), {
@@ -192,42 +306,79 @@ export function AuthProvider({
           'Accept-Language': i18n.language
         }
       });
-      if (request_1.status === 200) {
-        const json_1 = await request_1.json();
-        setPermissions(json_1);
+      if (request_0.status === 200) {
+        const json_0 = await request_0.json();
+        setPermissions(json_0);
       } else {
-        throw new Error(`Fetching permissions failed with status code ${request_1.status}`);
+        throw new Error(`Fetching permissions failed with status code ${request_0.status}`);
       }
-    } catch (e_1) {
-      toast.error(`Refreshing permissions failed: ${e_1.message}`);
+    } catch (e_0) {
+      toast.error(`Refreshing permissions failed: ${e_0.message}`);
     }
   }, [apiRoute, i18n]);
-  const fetchFullUser = React.useCallback(async () => {
-    try {
-      const request_2 = await requests.get(formatAdminURL({
-        apiRoute,
-        path: `/${userSlug}/me`
-      }), {
-        credentials: 'include',
-        headers: {
-          'Accept-Language': i18n.language
+  const fetchFullUserResult = React.useCallback(({
+    isTabSessionEventStale
+  } = {}) => {
+    return authRequests.queue(async ({
+      acceptResult: acceptResult_0,
+      isResultStale: isResultStale_0
+    }) => {
+      const isResponseStale = () => isResultStale_0() || Boolean(isTabSessionEventStale?.());
+      if (isResponseStale()) {
+        return {
+          status: 'indeterminate'
+        };
+      }
+      try {
+        const request_1 = await requests.get(formatAdminURL({
+          apiRoute,
+          path: `/${userSlug}/me`
+        }), {
+          credentials: 'include',
+          headers: {
+            'Accept-Language': i18n.language
+          }
+        });
+        if (request_1.status !== 200) {
+          return {
+            status: 'indeterminate'
+          };
         }
-      });
-      if (request_2.status === 200) {
-        const json_2 = await request_2.json();
-        setNewUser(json_2);
-        return json_2?.user || null;
+        const json_1 = await request_1.json();
+        if (isResponseStale()) {
+          return {
+            status: 'indeterminate'
+          };
+        }
+        if (json_1?.user) {
+          if (!acceptResult_0()) {
+            return {
+              status: 'indeterminate'
+            };
+          }
+          setLocalSession(json_1);
+          return {
+            expirationMs: typeof json_1.exp === 'number' && Number.isFinite(json_1.exp) ? json_1.exp * 1000 : sessionTimers.getCurrentExpirationMs(),
+            status: 'authenticated',
+            user: json_1.user
+          };
+        }
+        setLocalSession(null);
+        return {
+          status: 'unauthenticated'
+        };
+      } catch (e_1) {
+        toast.error(`Fetching user failed: ${e_1.message}`);
       }
-    } catch (e_2) {
-      toast.error(`Fetching user failed: ${e_2.message}`);
-    }
-    return null;
-  }, [apiRoute, userSlug, i18n.language, setNewUser]);
-  const refreshCookieEvent = useEffectEvent(refreshCookie);
-  useEffect(() => {
-    // when location changes, refresh cookie
-    refreshCookieEvent();
-  }, [pathname]);
+      return {
+        status: 'indeterminate'
+      };
+    });
+  }, [apiRoute, authRequests, i18n.language, sessionTimers, setLocalSession, userSlug]);
+  const fetchFullUser = React.useCallback(async () => {
+    const result_0 = await fetchFullUserResult();
+    return result_0.status === 'authenticated' ? result_0.user : null;
+  }, [fetchFullUserResult]);
   const fetchFullUserEvent = useEffectEvent(fetchFullUser);
   useEffect(() => {
     async function fetchUserOnMount() {
@@ -242,26 +393,23 @@ export function AuthProvider({
     }
   }, [user, autoLogin]);
   useEffect(() => () => {
-    // remove all timeouts on unmount
-    clearTimeout(refreshTokenTimeoutRef.current);
-    clearTimeout(reminderTimeoutRef.current);
-    clearTimeout(forceLogOutTimeoutRef.current);
-  }, []);
+    authRequests.discardPendingResults();
+  }, [authRequests]);
   if (!user && !fetchedUserOnMount) {
     return null;
   }
   return /*#__PURE__*/_jsx(Context, {
     value: {
+      authSession,
       fetchFullUser,
       logOut,
       permissions,
-      refreshCookie,
+      refreshCookie: sessionTimers.scheduleRefresh,
       refreshCookieAsync,
       refreshPermissions,
       setPermissions,
-      setUser: setNewUser,
+      setUser,
       token: tokenInMemory,
-      tokenExpirationMs,
       user
     },
     children: children