@payloadcms/ui 4.0.0-internal.697830c → 4.0.0-internal.77191e5

package/dist/providers/Auth/authSessionRequests.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authSessionRequests.js","names":["createAuthSessionRequests","authRequestQueue","Promise","resolve","authRequestSequence","isLoggingOut","logoutRequest","pendingAuthInvalidation","refreshRequest","sessionGeneration","clearPendingInvalidation","undefined","discardPendingResults","queue","request","requestGeneration","requestSequence","runRequest","isResultStale","result","acceptResult","invalidateWhenIdle","invalidate","generation","run","pendingInvalidation","queuedRequest","then","refresh","activeRequest","promise","refreshPromise","clearRefreshRequest","logOut","clearSession","pendingLogout","clearLogoutRequest"],"sources":["../../../src/providers/Auth/authSessionRequests.ts"],"sourcesContent":["import type { AuthenticatedUser } from 'payload'\n\nexport type AuthRequestContext = {\n  /** Accepts the result when its session is still active and cancels any deferred invalidation. */\n  acceptResult: () => boolean\n  /** Invalidates the session after newer queued auth requests have had a chance to restore it. */\n  invalidateWhenIdle: (invalidate: () => void) => void\n  /** Whether the session changed or logout began after this request was queued. */\n  isResultStale: () => boolean\n}\n\nexport type AuthSessionRequests = {\n  discardPendingResults: () => void\n  isLoggingOut: () => boolean\n  logOut: ({\n    clearSession,\n    request,\n  }: {\n    clearSession: () => void\n    request: () => Promise<void>\n  }) => Promise<void>\n  queue: <Result>(request: (context: AuthRequestContext) => Promise<Result>) => Promise<Result>\n  refresh: (\n    request: (context: AuthRequestContext) => Promise<AuthenticatedUser | null>,\n  ) => Promise<AuthenticatedUser | null>\n}\n\n/**\n * Coordinates requests that read or update the current auth session.\n *\n * Requests run in order, concurrent refreshes and logouts share a promise, and outdated results can\n * be discarded after the session changes.\n */\nexport function createAuthSessionRequests(): AuthSessionRequests {\n  let authRequestQueue = Promise.resolve()\n  let authRequestSequence = 0\n  let isLoggingOut = false\n  let logoutRequest: Promise<void> | undefined\n  let pendingAuthInvalidation:\n    | {\n        generation: number\n        run: () => void\n      }\n    | undefined\n  let refreshRequest:\n    | {\n        generation: number\n        promise: Promise<AuthenticatedUser | null>\n      }\n    | undefined\n  let sessionGeneration = 0\n\n  const clearPendingInvalidation = (): void => {\n    pendingAuthInvalidation = undefined\n  }\n\n  const discardPendingResults = (): void => {\n    sessionGeneration += 1\n    clearPendingInvalidation()\n  }\n\n  const queue = <Result>(\n    request: (context: AuthRequestContext) => Promise<Result>,\n  ): Promise<Result> => {\n    const requestGeneration = sessionGeneration\n    const requestSequence = ++authRequestSequence\n    const runRequest = async (): Promise<Result> => {\n      const isResultStale = () => sessionGeneration !== requestGeneration || isLoggingOut\n      const result = await request({\n        acceptResult: () => {\n          if (isResultStale()) {\n            return false\n          }\n\n          clearPendingInvalidation()\n          return true\n        },\n        invalidateWhenIdle: (invalidate) => {\n          if (isResultStale()) {\n            return\n          }\n\n          if (requestSequence < authRequestSequence) {\n            pendingAuthInvalidation = { generation: requestGeneration, run: invalidate }\n          } else {\n            invalidate()\n          }\n        },\n        isResultStale,\n      })\n\n      if (requestSequence === authRequestSequence) {\n        const pendingInvalidation = pendingAuthInvalidation\n\n        clearPendingInvalidation()\n\n        if (pendingInvalidation?.generation === sessionGeneration) {\n          pendingInvalidation.run()\n        }\n      }\n\n      return result\n    }\n    const queuedRequest = authRequestQueue.then(runRequest, runRequest)\n\n    authRequestQueue = queuedRequest.then(\n      () => undefined,\n      () => undefined,\n    )\n\n    return queuedRequest\n  }\n\n  const refresh = (\n    request: (context: AuthRequestContext) => Promise<AuthenticatedUser | null>,\n  ): Promise<AuthenticatedUser | null> => {\n    const requestGeneration = sessionGeneration\n    const activeRequest = refreshRequest\n\n    if (isLoggingOut) {\n      return Promise.resolve(null)\n    }\n\n    if (activeRequest?.generation === requestGeneration) {\n      return activeRequest.promise\n    }\n\n    const refreshPromise = queue(request)\n\n    refreshRequest = { generation: requestGeneration, promise: refreshPromise }\n    /** Stops sharing this refresh after it settles without clearing a newer refresh request. */\n    const clearRefreshRequest = () => {\n      if (refreshRequest?.promise === refreshPromise) {\n        refreshRequest = undefined\n      }\n    }\n\n    void refreshPromise.then(clearRefreshRequest, clearRefreshRequest)\n\n    return refreshPromise\n  }\n\n  const logOut = ({\n    clearSession,\n    request,\n  }: {\n    clearSession: () => void\n    request: () => Promise<void>\n  }): Promise<void> => {\n    if (logoutRequest !== undefined) {\n      return logoutRequest\n    }\n\n    isLoggingOut = true\n    clearSession()\n\n    const pendingLogout = queue(async () => {\n      try {\n        await request()\n      } finally {\n        isLoggingOut = false\n      }\n    })\n\n    logoutRequest = pendingLogout\n    /** Stops sharing this logout after it settles without clearing a newer logout request. */\n    const clearLogoutRequest = () => {\n      if (logoutRequest === pendingLogout) {\n        logoutRequest = undefined\n      }\n    }\n\n    void pendingLogout.then(\n      clearLogoutRequest, // onSuccess\n      clearLogoutRequest, // onFailure\n    )\n\n    return pendingLogout\n  }\n\n  return {\n    discardPendingResults,\n    isLoggingOut: () => isLoggingOut,\n    logOut,\n    queue,\n    refresh,\n  }\n}\n"],"mappings":"AA2BA;;;;;GAMA,OAAO,SAASA,0BAAA;EACd,IAAIC,gBAAA,GAAmBC,OAAA,CAAQC,OAAO;EACtC,IAAIC,mBAAA,GAAsB;EAC1B,IAAIC,YAAA,GAAe;EACnB,IAAIC,aAAA;EACJ,IAAIC,uBAAA;EAMJ,IAAIC,cAAA;EAMJ,IAAIC,iBAAA,GAAoB;EAExB,MAAMC,wBAAA,GAA2BA,CAAA;IAC/BH,uBAAA,GAA0BI,SAAA;EAC5B;EAEA,MAAMC,qBAAA,GAAwBA,CAAA;IAC5BH,iBAAA,IAAqB;IACrBC,wBAAA;EACF;EAEA,MAAMG,KAAA,GACJC,OAAA;IAEA,MAAMC,iBAAA,GAAoBN,iBAAA;IAC1B,MAAMO,eAAA,GAAkB,EAAEZ,mBAAA;IAC1B,MAAMa,UAAA,GAAa,MAAAA,CAAA;MACjB,MAAMC,aAAA,GAAgBA,CAAA,KAAMT,iBAAA,KAAsBM,iBAAA,IAAqBV,YAAA;MACvE,MAAMc,MAAA,GAAS,MAAML,OAAA,CAAQ;QAC3BM,YAAA,EAAcA,CAAA;UACZ,IAAIF,aAAA,IAAiB;YACnB,OAAO;UACT;UAEAR,wBAAA;UACA,OAAO;QACT;QACAW,kBAAA,EAAqBC,UAAA;UACnB,IAAIJ,aAAA,IAAiB;YACnB;UACF;UAEA,IAAIF,eAAA,GAAkBZ,mBAAA,EAAqB;YACzCG,uBAAA,GAA0B;cAAEgB,UAAA,EAAYR,iBAAA;cAAmBS,GAAA,EAAKF;YAAW;UAC7E,OAAO;YACLA,UAAA;UACF;QACF;QACAJ;MACF;MAEA,IAAIF,eAAA,KAAoBZ,mBAAA,EAAqB;QAC3C,MAAMqB,mBAAA,GAAsBlB,uBAAA;QAE5BG,wBAAA;QAEA,IAAIe,mBAAA,EAAqBF,UAAA,KAAed,iBAAA,EAAmB;UACzDgB,mBAAA,CAAoBD,GAAG;QACzB;MACF;MAEA,OAAOL,MAAA;IACT;IACA,MAAMO,aAAA,GAAgBzB,gBAAA,CAAiB0B,IAAI,CAACV,UAAA,EAAYA,UAAA;IAExDhB,gBAAA,GAAmByB,aAAA,CAAcC,IAAI,CACnC,MAAMhB,SAAA,EACN,MAAMA,SAAA;IAGR,OAAOe,aAAA;EACT;EAEA,MAAME,OAAA,GACJd,OAAA;IAEA,MAAMC,iBAAA,GAAoBN,iBAAA;IAC1B,MAAMoB,aAAA,GAAgBrB,cAAA;IAEtB,IAAIH,YAAA,EAAc;MAChB,OAAOH,OAAA,CAAQC,OAAO,CAAC;IACzB;IAEA,IAAI0B,aAAA,EAAeN,UAAA,KAAeR,iBAAA,EAAmB;MACnD,OAAOc,aAAA,CAAcC,OAAO;IAC9B;IAEA,MAAMC,cAAA,GAAiBlB,KAAA,CAAMC,OAAA;IAE7BN,cAAA,GAAiB;MAAEe,UAAA,EAAYR,iBAAA;MAAmBe,OAAA,EAASC;IAAe;IAC1E;IACA,MAAMC,mBAAA,GAAsBA,CAAA;MAC1B,IAAIxB,cAAA,EAAgBsB,OAAA,KAAYC,cAAA,EAAgB;QAC9CvB,cAAA,GAAiBG,SAAA;MACnB;IACF;IAEA,KAAKoB,cAAA,CAAeJ,IAAI,CAACK,mBAAA,EAAqBA,mBAAA;IAE9C,OAAOD,cAAA;EACT;EAEA,MAAME,MAAA,GAASA,CAAC;IACdC,YAAY;IACZpB;EAAO,CAIR;IACC,IAAIR,aAAA,KAAkBK,SAAA,EAAW;MAC/B,OAAOL,aAAA;IACT;IAEAD,YAAA,GAAe;IACf6B,YAAA;IAEA,MAAMC,aAAA,GAAgBtB,KAAA,CAAM;MAC1B,IAAI;QACF,MAAMC,OAAA;MACR,UAAU;QACRT,YAAA,GAAe;MACjB;IACF;IAEAC,aAAA,GAAgB6B,aAAA;IAChB;IACA,MAAMC,kBAAA,GAAqBA,CAAA;MACzB,IAAI9B,aAAA,KAAkB6B,aAAA,EAAe;QACnC7B,aAAA,GAAgBK,SAAA;MAClB;IACF;IAEA,KAAKwB,aAAA,CAAcR,IAAI,CACrBS,kBAAA,EACAA,kBAAA;IAGF,OAAOD,aAAA;EACT;EAEA,OAAO;IACLvB,qBAAA;IACAP,YAAA,EAAcA,CAAA,KAAMA,YAAA;IACpB4B,MAAA;IACApB,KAAA;IACAe;EACF;AACF","ignoreList":[]}

package/dist/providers/Auth/index.d.ts

@@ -1,66 +1,12 @@
-import type { ClientUser, SanitizedPermissions } from 'payload';
+import type { AuthenticatedUser, SanitizedPermissions } from 'payload';
 import React from 'react';
-export type UserWithToken<T = ClientUser> = {
-    /** seconds until expiration */
-    exp: number;
-    refreshedToken?: string;
-    token?: string;
-    user: T;
-};
-export type AuthContext<T = ClientUser> = {
-    fetchFullUser: () => Promise<null | T>;
-    logOut: () => Promise<boolean>;
-    /**
-     * These are the permissions for the current user from a global scope.
-     *
-     * When checking for permissions on document specific level, use the `useDocumentInfo` hook instead.
-     *
-     * @example
-     *
-     * ```tsx
-     * import { useAuth } from 'payload/ui'
-     *
-     * const MyComponent: React.FC = () => {
-     *   const { permissions } = useAuth()
-     *
-     *   if (permissions?.collections?.myCollection?.create) {
-     *     // user can create documents in 'myCollection'
-     *   }
-     *
-     *   return null
-     * }
-     * ```
-     *
-     * with useDocumentInfo:
-     *
-     * ```tsx
-     * import { useDocumentInfo } from 'payload/ui'
-     *
-     * const MyComponent: React.FC = () => {
-     *  const { docPermissions } = useDocumentInfo()
-     *  if (docPermissions?.create) {
-     *   // user can create this document
-     *  }
-     *  return null
-     * } ```
-     */
-    permissions?: SanitizedPermissions;
-    refreshCookie: (forceRefresh?: boolean) => void;
-    refreshCookieAsync: () => Promise<ClientUser>;
-    refreshPermissions: () => Promise<void>;
-    setPermissions: (permissions: SanitizedPermissions) => void;
-    setUser: (user: null | UserWithToken<T>) => void;
-    strategy?: string;
-    token?: string;
-    tokenExpirationMs?: number;
-    user?: null | T;
-};
+import type { AuthContext } from './types.js';
+export type { AuthContext, AuthSession, UserWithToken } from './types.js';
 type Props = {
     children: React.ReactNode;
     permissions?: SanitizedPermissions;
-    user?: ClientUser | null;
+    user?: AuthenticatedUser | null;
 };
 export declare function AuthProvider({ children, permissions: initialPermissions, user: initialUser, }: Props): React.JSX.Element;
-export declare const useAuth: <T = ClientUser>() => AuthContext<T>;
-export {};
+export declare const useAuth: <T = AuthenticatedUser>() => AuthContext<T>;
 //# sourceMappingURL=index.d.ts.map

package/dist/providers/Auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/providers/Auth/index.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AAK/D,OAAO,KAA+D,MAAM,OAAO,CAAA;AAWnF,MAAM,MAAM,aAAa,CAAC,CAAC,GAAG,UAAU,IAAI;IAC1C,+BAA+B;IAC/B,GAAG,EAAE,MAAM,CAAA;IACX,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,CAAC,CAAA;CACR,CAAA;AAED,MAAM,MAAM,WAAW,CAAC,CAAC,GAAG,UAAU,IAAI;IACxC,aAAa,EAAE,MAAM,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,CAAA;IACtC,MAAM,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;IAC9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,WAAW,CAAC,EAAE,oBAAoB,CAAA;IAClC,aAAa,EAAE,CAAC,YAAY,CAAC,EAAE,OAAO,KAAK,IAAI,CAAA;IAC/C,kBAAkB,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAA;IAC7C,kBAAkB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IACvC,cAAc,EAAE,CAAC,WAAW,EAAE,oBAAoB,KAAK,IAAI,CAAA;IAC3D,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,KAAK,IAAI,CAAA;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,CAAA;CAChB,CAAA;AAMD,KAAK,KAAK,GAAG;IACX,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;IACzB,WAAW,CAAC,EAAE,oBAAoB,CAAA;IAClC,IAAI,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;CACzB,CAAA;AAED,wBAAgB,YAAY,CAAC,EAC3B,QAAQ,EACR,WAAW,EAAE,kBAAkB,EAC/B,IAAI,EAAE,WAAW,GAClB,EAAE,KAAK,qBAgUP;AAED,eAAO,MAAM,OAAO,GAAI,CAAC,GAAG,UAAU,OAAM,WAAW,CAAC,CAAC,CAAmC,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/providers/Auth/index.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AAKtE,OAAO,KAA+D,MAAM,OAAO,CAAA;AAInF,OAAO,KAAK,EAAE,WAAW,EAA8B,MAAM,YAAY,CAAA;AAczE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAIzE,KAAK,KAAK,GAAG;IACX,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAA;IACzB,WAAW,CAAC,EAAE,oBAAoB,CAAA;IAClC,IAAI,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAA;CAChC,CAAA;AAsBD,wBAAgB,YAAY,CAAC,EAC3B,QAAQ,EACR,WAAW,EAAE,kBAAkB,EAC/B,IAAI,EAAE,WAAW,GAClB,EAAE,KAAK,qBAodP;AAED,eAAO,MAAM,OAAO,GAAI,CAAC,GAAG,iBAAiB,OAAM,WAAW,CAAC,CAAC,CAAmC,CAAA"}

package/dist/providers/Auth/index.js

@@ -11,10 +11,13 @@ import { useEffectEvent } from '../../hooks/useEffectEvent.js';
 import { useTranslation } from '../../providers/Translation/index.js';
 import { requests } from '../../utilities/api.js';
 import { useConfig } from '../Config/index.js';
-import { usePathname, useRouter } from '../RouterAdapter/index.js';
+import { usePathname, useRouter, useSearchParams } from '../RouterAdapter/index.js';
 import { useRouteTransition } from '../RouteTransition/index.js';
+import { createAuthSessionRequests } from './authSessionRequests.js';
+import { TAB_SESSION_EVENT_TYPES } from './tabSessionSync/index.js';
+import { useTabSessionSync } from './tabSessionSync/useTabSessionSync.js';
+import { useAuthSessionTimers } from './useAuthSessionTimers.js';
 const Context = /*#__PURE__*/createContext({});
-const maxTimeoutMs = 2147483647;
 export function AuthProvider({
   children,
   permissions: initialPermissions,
@@ -22,6 +25,8 @@ export function AuthProvider({
 }) {
   const pathname = usePathname();
   const router = useRouter();
+  const searchParams = useSearchParams();
+  const route = `${pathname}?${searchParams.toString()}`;
   const {
     config
   } = useConfig();
@@ -30,7 +35,8 @@ export function AuthProvider({
       autoLogin,
       autoRefresh,
       routes: {
-        inactivity: logoutInactivityRoute
+        inactivity: logoutInactivityRoute,
+        login: loginRoute
       },
       user: userSlug
     },
@@ -51,14 +57,12 @@ export function AuthProvider({
   } = useRouteTransition();
   const [user, setUserInMemory] = useState(initialUser);
   const [tokenInMemory, setTokenInMemory] = useState();
-  const [tokenExpirationMs, setTokenExpirationMs] = useState();
+  const [authSession, setAuthSession] = useState();
   const [permissions, setPermissions] = useState(initialPermissions);
-  const [forceLogoutBufferMs, setForceLogoutBufferMs] = useState(120_000);
   const [fetchedUserOnMount, setFetchedUserOnMount] = useState(false);
-  const refreshTokenTimeoutRef = React.useRef(null);
-  const reminderTimeoutRef = React.useRef(null);
-  const forceLogOutTimeoutRef = React.useRef(null);
-  const id = user?.id;
+  const [authRequests] = useState(createAuthSessionRequests);
+  const userRef = React.useRef(initialUser);
+  const isAuthenticated = Boolean(user);
   const redirectToInactivityRoute = useCallback(() => {
     const baseAdminRoute = formatAdminURL({
       adminRoute,
@@ -70,111 +74,221 @@ export function AuthProvider({
     })));
     closeAllModals();
   }, [router, adminRoute, logoutInactivityRoute, closeAllModals, startRouteTransition]);
-  const revokeTokenAndExpire = useCallback(() => {
-    setUserInMemory(null);
-    setTokenInMemory(undefined);
-    setTokenExpirationMs(undefined);
-    clearTimeout(refreshTokenTimeoutRef.current);
-  }, []);
-  // Handler for reminder timeout - uses useEffectEvent to capture latest autoRefresh value
-  const handleReminderTimeout = useEffectEvent(() => {
+  const redirectToLoginRoute = useCallback(() => {
+    startRouteTransition(() => router.replace(formatAdminURL({
+      adminRoute,
+      path: loginRoute
+    })));
+    closeAllModals();
+  }, [adminRoute, closeAllModals, loginRoute, router, startRouteTransition]);
+  function onSessionActivity() {
+    setAuthSession(currentAuthSession => {
+      if (!currentAuthSession || currentAuthSession.activityRecorded) {
+        return currentAuthSession;
+      }
+      return {
+        ...currentAuthSession,
+        activityRecorded: true
+      };
+    });
+  }
+  function onSessionActivityRefresh() {
+    void refreshSession({
+      isActivityRefresh: true
+    });
+  }
+  function onSessionExpiration(expirationMs) {
+    const collection = userRef.current?.collection;
+    tabSessionSync.broadcast({
+      type: TAB_SESSION_EVENT_TYPES.EXPIRED,
+      expiredTokenAt: expirationMs
+    });
+    void logOutSession({
+      collection
+    }).then(redirectToInactivityRoute);
+  }
+  function onSessionReminder() {
     if (autoRefresh) {
-      refreshCookieEvent();
+      sessionTimers.scheduleRefresh();
     } else {
       openModal(stayLoggedInModalSlug);
     }
+  }
+  const sessionTimers = useAuthSessionTimers({
+    isAuthenticated,
+    onActivity: onSessionActivity,
+    onActivityRefresh: onSessionActivityRefresh,
+    onExpire: onSessionExpiration,
+    onReminder: onSessionReminder
   });
-  const setNewUser = useCallback(userResponse => {
-    clearTimeout(reminderTimeoutRef.current);
-    clearTimeout(forceLogOutTimeoutRef.current);
-    if (userResponse?.user) {
-      setUserInMemory(userResponse.user);
-      setTokenInMemory(userResponse.token ?? userResponse.refreshedToken);
-      setTokenExpirationMs(userResponse.exp * 1000);
-      const expiresInMs = Math.max(0, Math.min((userResponse.exp ?? 0) * 1000 - Date.now(), maxTimeoutMs));
-      if (expiresInMs) {
-        const nextForceLogoutBufferMs = Math.min(60_000, expiresInMs / 2);
-        setForceLogoutBufferMs(nextForceLogoutBufferMs);
-        reminderTimeoutRef.current = setTimeout(handleReminderTimeout, Math.max(expiresInMs - nextForceLogoutBufferMs, 0));
-        forceLogOutTimeoutRef.current = setTimeout(() => {
-          revokeTokenAndExpire();
-          redirectToInactivityRoute();
-        }, expiresInMs);
+  useEffect(() => {
+    sessionTimers.recordActivity('route');
+  }, [route, sessionTimers]);
+  const clearUserInMemory = useCallback(() => {
+    userRef.current = null;
+    setUserInMemory(null);
+    setTokenInMemory(undefined);
+    setAuthSession(undefined);
+    sessionTimers.clear();
+  }, [sessionTimers]);
+  const setLocalSession = useCallback(session => {
+    if (session?.user) {
+      const expirationMs_0 = typeof session.exp === 'number' && Number.isFinite(session.exp) ? session.exp * 1000 : undefined;
+      const nextSessionTiming = expirationMs_0 !== undefined ? sessionTimers.setExpiration(expirationMs_0) : undefined;
+      userRef.current = session.user;
+      setUserInMemory(session.user);
+      setTokenInMemory(session.token ?? session.refreshedToken);
+      if (nextSessionTiming) {
+        setAuthSession({
+          ...nextSessionTiming,
+          activityRecorded: false
+        });
       }
     } else {
-      revokeTokenAndExpire();
+      clearUserInMemory();
     }
-  }, [redirectToInactivityRoute, revokeTokenAndExpire]);
-  const refreshCookie = useCallback(forceRefresh => {
-    if (!id) {
-      return;
+  }, [clearUserInMemory, sessionTimers]);
+  const setUser = useCallback(session_0 => {
+    authRequests.discardPendingResults();
+    setLocalSession(session_0);
+  }, [authRequests, setLocalSession]);
+  const tabSessionSync = useTabSessionSync({
+    getTokenExpirationMs: sessionTimers.getCurrentExpirationMs,
+    onSessionExpired: () => {
+      const collection_0 = userRef.current?.collection;
+      void logOutSession({
+        collection: collection_0
+      }).then(redirectToInactivityRoute);
+    },
+    onSessionLoggedOut: () => {
+      const collection_1 = userRef.current?.collection;
+      void logOutSession({
+        collection: collection_1
+      }).then(redirectToLoginRoute);
+    },
+    onSessionRefreshed: session_1 => {
+      if (!authRequests.isLoggingOut()) {
+        authRequests.discardPendingResults();
+        setLocalSession(session_1);
+      }
+    },
+    onTabSessionUnauthenticated: () => {
+      redirectToInactivityRoute();
+    },
+    reconcileSession: async options => {
+      const result = await fetchFullUserResult(options);
+      if (result.status === 'authenticated' && result.expirationMs !== undefined) {
+        return {
+          expirationMs: result.expirationMs,
+          status: result.status,
+          user: result.user
+        };
+      }
+      if (result.status === 'unauthenticated') {
+        return result;
+      }
+      return {
+        status: 'indeterminate'
+      };
     }
-    const expiresInMs_0 = Math.max(0, (tokenExpirationMs ?? 0) - Date.now());
-    if (forceRefresh || tokenExpirationMs && expiresInMs_0 < forceLogoutBufferMs * 2) {
-      clearTimeout(refreshTokenTimeoutRef.current);
-      refreshTokenTimeoutRef.current = setTimeout(async () => {
-        try {
-          const request = await requests.post(formatAdminURL({
-            apiRoute,
-            path: `/${userSlug}/refresh-token?refresh`
-          }), {
-            headers: {
-              'Accept-Language': i18n.language
-            }
-          });
-          if (request.status === 200) {
-            const json = await request.json();
-            setNewUser(json);
-          } else {
-            setNewUser(null);
-            redirectToInactivityRoute();
+  });
+  const refreshSession = useCallback(({
+    isActivityRefresh
+  }) => {
+    return authRequests.refresh(async ({
+      acceptResult,
+      invalidateWhenIdle,
+      isResultStale
+    }) => {
+      if (isResultStale()) {
+        return null;
+      }
+      const handledExpiration = sessionTimers.getCurrentExpirationMs();
+      const handledUser = userRef.current;
+      try {
+        const refreshStartedAt = Date.now();
+        const request = await requests.post(formatAdminURL({
+          apiRoute,
+          path: `/${userSlug}/refresh-token${isActivityRefresh ? '?refresh' : ''}`
+        }), {
+          headers: {
+            'Accept-Language': i18n.language
           }
-        } catch (e) {
-          toast.error(e.message);
+        });
+        if (isResultStale()) {
+          return null;
         }
-      }, 1000);
-    }
-  }, [apiRoute, i18n.language, redirectToInactivityRoute, setNewUser, tokenExpirationMs, userSlug, forceLogoutBufferMs, id]);
-  const refreshCookieAsync = useCallback(async skipSetUser => {
-    try {
-      const request_0 = await requests.post(formatAdminURL({
-        apiRoute,
-        path: `/${userSlug}/refresh-token`
-      }), {
-        headers: {
-          'Accept-Language': i18n.language
+        if (request.status === 200) {
+          const json = await request.json();
+          if (!acceptResult()) {
+            return null;
+          }
+          setLocalSession(json);
+          tabSessionSync.broadcast({
+            type: TAB_SESSION_EVENT_TYPES.REFRESHED,
+            refreshStartedAt,
+            session: json
+          });
+          return json.user;
         }
-      });
-      if (request_0.status === 200) {
-        const json_0 = await request_0.json();
-        if (!skipSetUser) {
-          setNewUser(json_0);
+        if (handledUser) {
+          const invalidateSession = () => {
+            if (handledExpiration !== undefined) {
+              tabSessionSync.broadcast({
+                type: TAB_SESSION_EVENT_TYPES.EXPIRED,
+                expiredTokenAt: handledExpiration
+              });
+            }
+            setLocalSession(null);
+            redirectToInactivityRoute();
+          };
+          invalidateWhenIdle(invalidateSession);
         }
-        return json_0.user;
+      } catch (e) {
+        toast.error(`Refreshing token failed: ${e.message}`);
       }
-      if (user) {
-        setNewUser(null);
-        redirectToInactivityRoute();
+      return null;
+    });
+  }, [apiRoute, authRequests, tabSessionSync, i18n.language, redirectToInactivityRoute, sessionTimers, setLocalSession, userSlug]);
+  const refreshCookieAsync = useCallback(() => refreshSession({
+    isActivityRefresh: false
+  }), [refreshSession]);
+  const logOutSession = useCallback(({
+    collection: collection_2
+  }) => {
+    return authRequests.logOut({
+      clearSession: () => {
+        authRequests.discardPendingResults();
+        setLocalSession(null);
+      },
+      request: async () => {
+        try {
+          if (collection_2) {
+            await requests.post(formatAdminURL({
+              apiRoute,
+              path: `/${collection_2}/logout`
+            }));
+          }
+        } catch (_) {
+          // Explicit logout always clears local state, even if server revocation fails.
+        }
       }
-    } catch (e_0) {
-      toast.error(`Refreshing token failed: ${e_0.message}`);
-    }
-    return null;
-  }, [apiRoute, i18n.language, redirectToInactivityRoute, setNewUser, userSlug, user]);
+    });
+  }, [apiRoute, authRequests, setLocalSession]);
   const logOut = useCallback(async () => {
-    try {
-      if (user && user.collection) {
-        setNewUser(null);
-        await requests.post(formatAdminURL({
-          apiRoute,
-          path: `/${user.collection}/logout`
-        }));
-      }
-    } catch (_) {
-      // fail silently and log the user out in state
+    const logoutEvent = {
+      type: TAB_SESSION_EVENT_TYPES.LOGGED_OUT
+    };
+    const logoutPublication = tabSessionSync.broadcast(logoutEvent);
+    const collection_3 = userRef.current?.collection;
+    await logOutSession({
+      collection: collection_3
+    });
+    if (logoutPublication?.type === TAB_SESSION_EVENT_TYPES.LOGGED_OUT) {
+      tabSessionSync.broadcastLogoutSettlement(logoutPublication);
     }
     return true;
-  }, [apiRoute, setNewUser, user]);
+  }, [tabSessionSync, logOutSession]);
   const refreshPermissions = useCallback(async ({
     locale
   } = {}) => {
@@ -184,7 +298,7 @@ export function AuthProvider({
       addQueryPrefix: true
     });
     try {
-      const request_1 = await requests.get(formatAdminURL({
+      const request_0 = await requests.get(formatAdminURL({
         apiRoute,
         path: `/access${params}`
       }), {
@@ -192,42 +306,79 @@ export function AuthProvider({
           'Accept-Language': i18n.language
         }
       });
-      if (request_1.status === 200) {
-        const json_1 = await request_1.json();
-        setPermissions(json_1);
+      if (request_0.status === 200) {
+        const json_0 = await request_0.json();
+        setPermissions(json_0);
       } else {
-        throw new Error(`Fetching permissions failed with status code ${request_1.status}`);
+        throw new Error(`Fetching permissions failed with status code ${request_0.status}`);
       }
-    } catch (e_1) {
-      toast.error(`Refreshing permissions failed: ${e_1.message}`);
+    } catch (e_0) {
+      toast.error(`Refreshing permissions failed: ${e_0.message}`);
     }
   }, [apiRoute, i18n]);
-  const fetchFullUser = React.useCallback(async () => {
-    try {
-      const request_2 = await requests.get(formatAdminURL({
-        apiRoute,
-        path: `/${userSlug}/me`
-      }), {
-        credentials: 'include',
-        headers: {
-          'Accept-Language': i18n.language
+  const fetchFullUserResult = React.useCallback(({
+    isTabSessionEventStale
+  } = {}) => {
+    return authRequests.queue(async ({
+      acceptResult: acceptResult_0,
+      isResultStale: isResultStale_0
+    }) => {
+      const isResponseStale = () => isResultStale_0() || Boolean(isTabSessionEventStale?.());
+      if (isResponseStale()) {
+        return {
+          status: 'indeterminate'
+        };
+      }
+      try {
+        const request_1 = await requests.get(formatAdminURL({
+          apiRoute,
+          path: `/${userSlug}/me`
+        }), {
+          credentials: 'include',
+          headers: {
+            'Accept-Language': i18n.language
+          }
+        });
+        if (request_1.status !== 200) {
+          return {
+            status: 'indeterminate'
+          };
         }
-      });
-      if (request_2.status === 200) {
-        const json_2 = await request_2.json();
-        setNewUser(json_2);
-        return json_2?.user || null;
+        const json_1 = await request_1.json();
+        if (isResponseStale()) {
+          return {
+            status: 'indeterminate'
+          };
+        }
+        if (json_1?.user) {
+          if (!acceptResult_0()) {
+            return {
+              status: 'indeterminate'
+            };
+          }
+          setLocalSession(json_1);
+          return {
+            expirationMs: typeof json_1.exp === 'number' && Number.isFinite(json_1.exp) ? json_1.exp * 1000 : sessionTimers.getCurrentExpirationMs(),
+            status: 'authenticated',
+            user: json_1.user
+          };
+        }
+        setLocalSession(null);
+        return {
+          status: 'unauthenticated'
+        };
+      } catch (e_1) {
+        toast.error(`Fetching user failed: ${e_1.message}`);
       }
-    } catch (e_2) {
-      toast.error(`Fetching user failed: ${e_2.message}`);
-    }
-    return null;
-  }, [apiRoute, userSlug, i18n.language, setNewUser]);
-  const refreshCookieEvent = useEffectEvent(refreshCookie);
-  useEffect(() => {
-    // when location changes, refresh cookie
-    refreshCookieEvent();
-  }, [pathname]);
+      return {
+        status: 'indeterminate'
+      };
+    });
+  }, [apiRoute, authRequests, i18n.language, sessionTimers, setLocalSession, userSlug]);
+  const fetchFullUser = React.useCallback(async () => {
+    const result_0 = await fetchFullUserResult();
+    return result_0.status === 'authenticated' ? result_0.user : null;
+  }, [fetchFullUserResult]);
   const fetchFullUserEvent = useEffectEvent(fetchFullUser);
   useEffect(() => {
     async function fetchUserOnMount() {
@@ -242,26 +393,23 @@ export function AuthProvider({
     }
   }, [user, autoLogin]);
   useEffect(() => () => {
-    // remove all timeouts on unmount
-    clearTimeout(refreshTokenTimeoutRef.current);
-    clearTimeout(reminderTimeoutRef.current);
-    clearTimeout(forceLogOutTimeoutRef.current);
-  }, []);
+    authRequests.discardPendingResults();
+  }, [authRequests]);
   if (!user && !fetchedUserOnMount) {
     return null;
   }
   return /*#__PURE__*/_jsx(Context, {
     value: {
+      authSession,
       fetchFullUser,
       logOut,
       permissions,
-      refreshCookie,
+      refreshCookie: sessionTimers.scheduleRefresh,
       refreshCookieAsync,
       refreshPermissions,
       setPermissions,
-      setUser: setNewUser,
+      setUser,
       token: tokenInMemory,
-      tokenExpirationMs,
       user
     },
     children: children