@sanity/sdk 3.0.0-rc.0 → 3.0.0-rc.2

package/src/auth/refreshStampedToken.ts

@@ -2,8 +2,6 @@ import {
   distinctUntilChanged,
   exhaustMap,
   filter,
-  firstValueFrom,
-  from,
   map,
   Observable,
   type Subscription,
@@ -13,42 +11,12 @@ import {
 } from 'rxjs'
 
 import {type StoreContext} from '../store/defineStore'
-import {DEFAULT_API_VERSION} from './authConstants'
+import {DEFAULT_API_VERSION, REQUEST_TAG_PREFIX} from './authConstants'
+import {getAuthLogger} from './authLogger'
 import {AuthStateType} from './authStateType'
 import {type AuthState, type AuthStoreState} from './authStore'
 
 const REFRESH_INTERVAL = 12 * 60 * 60 * 1000 // 12 hours in milliseconds
-const LOCK_NAME = 'sanity-token-refresh-lock'
-
-/** @internal */
-export function getLastRefreshTime(storageArea: Storage | undefined, storageKey: string): number {
-  try {
-    const data = storageArea?.getItem(`${storageKey}_last_refresh`)
-    const parsed = data ? parseInt(data, 10) : 0
-    return isNaN(parsed) ? 0 : parsed
-  } catch {
-    return 0
-  }
-}
-
-/** @internal */
-export function setLastRefreshTime(storageArea: Storage | undefined, storageKey: string): void {
-  try {
-    storageArea?.setItem(`${storageKey}_last_refresh`, Date.now().toString())
-  } catch {
-    // Ignore storage errors
-  }
-}
-
-/** @internal */
-export function getNextRefreshDelay(storageArea: Storage | undefined, storageKey: string): number {
-  const lastRefresh = getLastRefreshTime(storageArea, storageKey)
-  if (!lastRefresh) return 0
-
-  const now = Date.now()
-  const nextRefreshTime = lastRefresh + REFRESH_INTERVAL
-  return Math.max(0, nextRefreshTime - now)
-}
 
 function createTokenRefreshStream(
   token: string,
@@ -58,7 +26,7 @@ function createTokenRefreshStream(
   return new Observable((subscriber) => {
     const client = clientFactory({
       apiVersion: DEFAULT_API_VERSION,
-      requestTagPrefix: 'token-refresh',
+      requestTagPrefix: REQUEST_TAG_PREFIX,
       useProjectHostname: false,
       useCdn: false,
       token,
@@ -70,6 +38,7 @@ function createTokenRefreshStream(
       .request<{token: string}>({
         uri: 'auth/refresh-token',
         method: 'POST',
+        tag: 'refresh-token',
         body: {
           token,
         },
@@ -80,57 +49,6 @@ function createTokenRefreshStream(
   })
 }
 
-async function acquireTokenRefreshLock(
-  refreshFn: () => Promise<void>,
-  storageArea: Storage | undefined,
-  storageKey: string,
-): Promise<boolean> {
-  if (!navigator.locks) {
-    // If Web Locks API is not supported, perform an immediate, uncoordinated refresh.
-    // eslint-disable-next-line no-console
-    console.warn('Web Locks API not supported. Proceeding with uncoordinated refresh.')
-    await refreshFn()
-    setLastRefreshTime(storageArea, storageKey)
-    return true // Indicate success to allow stream processing, though it won't loop.
-  }
-
-  try {
-    // Attempt to acquire an exclusive lock for token refresh coordination.
-    // The callback handles the continuous refresh cycle while the lock is held.
-    const result = await navigator.locks.request(LOCK_NAME, {mode: 'exclusive'}, async (lock) => {
-      if (!lock) return false // Lock not granted
-
-      // Problematic infinite loop - needs redesign for graceful termination.
-      // This loop continuously refreshes the token at REFRESH_INTERVAL.
-      while (true) {
-        const delay = getNextRefreshDelay(storageArea, storageKey)
-        if (delay > 0) {
-          await new Promise((resolve) => setTimeout(resolve, delay))
-        }
-        try {
-          await refreshFn()
-          setLastRefreshTime(storageArea, storageKey)
-        } catch (error) {
-          // eslint-disable-next-line no-console
-          console.error('Token refresh failed within lock:', error)
-          // Decide how to handle errors - break, retry, etc.? Currently logs and continues.
-        }
-        // Wait for the next interval
-        await new Promise((resolve) => setTimeout(resolve, REFRESH_INTERVAL))
-      }
-      // Unreachable due to while(true)
-    })
-    // The promise from navigator.locks.request resolves with the callback's return value,
-    // but only if the callback finishes. The infinite loop prevents this.
-    return result === true
-  } catch (error) {
-    // Handle potential errors during the initial lock request itself.
-    // eslint-disable-next-line no-console
-    console.error('Failed to request token refresh lock:', error)
-    return false // Indicate lock acquisition failure.
-  }
-}
-
 function shouldRefreshToken(lastRefresh: number | undefined): boolean {
   if (!lastRefresh) return true
   const timeSinceLastRefresh = Date.now() - lastRefresh
@@ -138,99 +56,46 @@ function shouldRefreshToken(lastRefresh: number | undefined): boolean {
 }
 
 /**
+ * Periodically refreshes stamped auth tokens (those containing `-st`).
+ *
+ * Two triggers cause a refresh while the user stays logged in:
+ * - a 12-hour interval timer (only fires while the tab is visible)
+ * - the tab becoming visible again after `lastTokenRefresh` has gone stale
+ *
+ * Non-stamped tokens (e.g. personal access tokens) are never refreshed.
+ *
  * @internal
  */
-export const refreshStampedToken = ({state}: StoreContext<AuthStoreState>): Subscription => {
+export const refreshStampedToken = ({
+  state,
+  instance,
+}: StoreContext<AuthStoreState>): Subscription => {
+  const logger = getAuthLogger(instance)
+
   const {clientFactory, apiHost, storageArea, storageKey} = state.get().options
 
   const refreshToken$ = state.observable.pipe(
-    map((storeState) => ({
-      authState: storeState.authState,
-      dashboardContext: storeState.dashboardContext,
-    })),
+    map((storeState) => storeState.authState),
     filter(
-      (
-        storeState,
-      ): storeState is {
-        authState: Extract<AuthState, {type: AuthStateType.LOGGED_IN}>
-        dashboardContext: AuthStoreState['dashboardContext']
-      } => storeState.authState.type === AuthStateType.LOGGED_IN,
+      (authState): authState is Extract<AuthState, {type: AuthStateType.LOGGED_IN}> =>
+        authState.type === AuthStateType.LOGGED_IN,
     ),
-    distinctUntilChanged(
-      (prev, curr) =>
-        prev.authState.type === curr.authState.type &&
-        prev.authState.token === curr.authState.token && // Only care about token for distinctness here
-        prev.dashboardContext === curr.dashboardContext,
-    ), // Make distinctness check explicit
-    filter((storeState) => storeState.authState.token.includes('-st')), // Ensure we only try to refresh stamped tokens
-    exhaustMap((storeState) => {
-      // USE exhaustMap instead of switchMap
-      // Create a function that performs a single refresh and updates state/storage
-      const performRefresh = async () => {
-        // Read the latest token directly from state inside refresh
-        const currentState = state.get()
-        if (currentState.authState.type !== AuthStateType.LOGGED_IN) {
-          throw new Error('User logged out before refresh could complete') // Abort refresh
-        }
-        const currentToken = currentState.authState.token
-
-        const response = await firstValueFrom(
-          createTokenRefreshStream(currentToken, clientFactory, apiHost),
-        )
-
-        state.set('setRefreshStampedToken', (prev) => ({
-          authState:
-            prev.authState.type === AuthStateType.LOGGED_IN
-              ? {...prev.authState, token: response.token}
-              : prev.authState,
-        }))
-        storageArea?.setItem(storageKey, JSON.stringify({token: response.token}))
-      }
-
-      if (storeState.dashboardContext) {
-        return new Observable<{token: string}>((subscriber) => {
-          const visibilityHandler = () => {
-            const currentState = state.get()
-            if (
-              document.visibilityState === 'visible' &&
-              currentState.authState.type === AuthStateType.LOGGED_IN &&
-              shouldRefreshToken(currentState.authState.lastTokenRefresh)
-            ) {
-              createTokenRefreshStream(
-                currentState.authState.token,
-                clientFactory,
-                apiHost,
-              ).subscribe({
-                next: (response) => {
-                  state.set('setRefreshStampedToken', (prev) => ({
-                    authState:
-                      prev.authState.type === AuthStateType.LOGGED_IN
-                        ? {
-                            ...prev.authState,
-                            token: response.token,
-                            lastTokenRefresh: Date.now(),
-                          }
-                        : prev.authState,
-                  }))
-                  subscriber.next(response)
-                },
-                error: (error) => subscriber.error(error),
-              })
-            }
-          }
-
-          const timerSubscription = timer(REFRESH_INTERVAL, REFRESH_INTERVAL)
-            .pipe(
-              filter(() => document.visibilityState === 'visible'),
-              switchMap(() => {
-                const currentState = state.get().authState
-                if (currentState.type !== AuthStateType.LOGGED_IN) {
-                  throw new Error('User logged out before refresh could complete')
-                }
-                return createTokenRefreshStream(currentState.token, clientFactory, apiHost)
-              }),
-            )
-            .subscribe({
+    distinctUntilChanged((prev, curr) => prev.token === curr.token),
+    filter((authState) => authState.token.includes('-st')), // Ensure we only try to refresh stamped tokens
+    exhaustMap(() =>
+      new Observable<{token: string}>((subscriber) => {
+        const visibilityHandler = () => {
+          const currentState = state.get()
+          if (
+            document.visibilityState === 'visible' &&
+            currentState.authState.type === AuthStateType.LOGGED_IN &&
+            shouldRefreshToken(currentState.authState.lastTokenRefresh)
+          ) {
+            createTokenRefreshStream(
+              currentState.authState.token,
+              clientFactory,
+              apiHost,
+            ).subscribe({
               next: (response) => {
                 state.set('setRefreshStampedToken', (prev) => ({
                   authState:
@@ -246,35 +111,53 @@ export const refreshStampedToken = ({state}: StoreContext<AuthStoreState>): Subs
               },
               error: (error) => subscriber.error(error),
             })
-
-          document.addEventListener('visibilitychange', visibilityHandler)
-
-          return () => {
-            document.removeEventListener('visibilitychange', visibilityHandler)
-            timerSubscription.unsubscribe()
           }
-        }).pipe(
-          takeWhile(() => state.get().authState.type === AuthStateType.LOGGED_IN),
-          map((response: {token: string}) => ({token: response.token})),
-        )
-      }
+        }
 
-      // If not in dashboard context, use lock-based refresh
-      return from(acquireTokenRefreshLock(performRefresh, storageArea, storageKey)).pipe(
-        filter((hasLock) => hasLock),
-        map(() => {
-          const currentState = state.get().authState
-          if (currentState.type !== AuthStateType.LOGGED_IN) {
-            throw new Error('User logged out before refresh could complete')
-          }
-          return {token: currentState.token} as const
-        }),
-      )
-    }),
+        const timerSubscription = timer(REFRESH_INTERVAL, REFRESH_INTERVAL)
+          .pipe(
+            filter(() => document.visibilityState === 'visible'),
+            switchMap(() => {
+              const currentState = state.get().authState
+              if (currentState.type !== AuthStateType.LOGGED_IN) {
+                throw new Error('User logged out before refresh could complete')
+              }
+              return createTokenRefreshStream(currentState.token, clientFactory, apiHost)
+            }),
+          )
+          .subscribe({
+            next: (response) => {
+              state.set('setRefreshStampedToken', (prev) => ({
+                authState:
+                  prev.authState.type === AuthStateType.LOGGED_IN
+                    ? {
+                        ...prev.authState,
+                        token: response.token,
+                        lastTokenRefresh: Date.now(),
+                      }
+                    : prev.authState,
+              }))
+              subscriber.next(response)
+            },
+            error: (error) => subscriber.error(error),
+          })
+
+        document.addEventListener('visibilitychange', visibilityHandler)
+
+        return () => {
+          document.removeEventListener('visibilitychange', visibilityHandler)
+          timerSubscription.unsubscribe()
+        }
+      }).pipe(
+        takeWhile(() => state.get().authState.type === AuthStateType.LOGGED_IN),
+        map((response: {token: string}) => ({token: response.token})),
+      ),
+    ),
   )
 
   return refreshToken$.subscribe({
     next: (response: {token: string}) => {
+      logger.debug('Token refresh completed, updating state')
       state.set('setRefreshStampedToken', (prev) => ({
         authState:
           prev.authState.type === AuthStateType.LOGGED_IN
@@ -288,6 +171,7 @@ export const refreshStampedToken = ({state}: StoreContext<AuthStoreState>): Subs
       storageArea?.setItem(storageKey, JSON.stringify({token: response.token}))
     },
     error: (error) => {
+      logger.error('Token refresh failed', {error})
       state.set('setRefreshStampedTokenError', {authState: {type: AuthStateType.ERROR, error}})
     },
   })

package/src/auth/studioAuth.ts

@@ -211,7 +211,7 @@ function initializeWithFallback(
         : null
 
     if (!token) {
-      const projectIdValue = instance.config.studio?.projectId
+      const projectIdValue = instance.config.projectId
       const clientFactory = state.get().options.clientFactory
       checkForCookieAuth(projectIdValue, clientFactory).then((isCookieAuthEnabled) => {
         if (!isCookieAuthEnabled) return

package/src/auth/studioModeAuth.ts

@@ -1,5 +1,6 @@
 import {type ClientConfig, type SanityClient} from '@sanity/client'
 
+import {REQUEST_TAG_PREFIX} from './authConstants'
 import {getTokenFromStorage} from './utils'
 
 /**
@@ -25,7 +26,7 @@ export async function checkForCookieAuth(
     const client = clientFactory({
       projectId,
       useCdn: false,
-      requestTagPrefix: 'sdk',
+      requestTagPrefix: REQUEST_TAG_PREFIX,
       timeout: COOKIE_AUTH_TIMEOUT_MS,
     })
     const user = await client.request({

package/src/auth/subscribeToStateAndFetchCurrentUser.test.ts

@@ -1,6 +1,6 @@
 import {type CurrentUser} from '@sanity/types'
 import {delay, of, throwError} from 'rxjs'
-import {beforeEach, describe, it} from 'vitest'
+import {beforeEach, describe, expect, it, vi} from 'vitest'
 
 import {createSanityInstance} from '../store/createSanityInstance'
 import {createStoreState} from '../store/createStoreState'
@@ -8,19 +8,32 @@ import {AuthStateType} from './authStateType'
 import {authStore} from './authStore'
 import {subscribeToStateAndFetchCurrentUser} from './subscribeToStateAndFetchCurrentUser'
 
+// Mock logger to prevent actual logging during tests
+vi.mock('../utils/logger', async (importOriginal) => {
+  const original = await importOriginal<typeof import('../utils/logger')>()
+  return {
+    ...original,
+    createLogger: vi.fn(() => ({
+      info: vi.fn(),
+      debug: vi.fn(),
+      warn: vi.fn(),
+      error: vi.fn(),
+      trace: vi.fn(),
+    })),
+  }
+})
+
 describe('subscribeToStateAndFetchCurrentUser', () => {
   beforeEach(() => {
     vi.clearAllMocks()
   })
 
   it('fetches the current user if the is logged in without a current user present', () => {
-    const mockUser = {id: 'example-user'} as CurrentUser
+    const mockUser = {id: 'example-user', email: 'user@example.com'} as CurrentUser
     const mockRequest = vi.fn().mockReturnValue(of(mockUser))
     const mockClient = {observable: {request: mockRequest}}
     const clientFactory = vi.fn().mockReturnValue(mockClient)
-    const instance = createSanityInstance({
-      auth: {clientFactory},
-    })
+    const instance = createSanityInstance({projectId: 'p', dataset: 'd', auth: {clientFactory}})
 
     const state = createStoreState(authStore.getInitialState(instance, null))
     const subscription = subscribeToStateAndFetchCurrentUser({state, instance, key: null})
@@ -42,7 +55,11 @@ describe('subscribeToStateAndFetchCurrentUser', () => {
       useProjectHostname: false,
       useCdn: false,
     })
-    expect(mockRequest).toHaveBeenCalledWith({method: 'GET', uri: '/users/me'})
+    expect(mockRequest).toHaveBeenCalledWith({
+      method: 'GET',
+      uri: '/users/me',
+      tag: 'users.get-current',
+    })
 
     subscription.unsubscribe()
   })
@@ -52,9 +69,7 @@ describe('subscribeToStateAndFetchCurrentUser', () => {
     const mockRequest = vi.fn().mockReturnValue(of(mockUser).pipe(delay(0)))
     const mockClient = {observable: {request: mockRequest}}
     const clientFactory = vi.fn().mockReturnValue(mockClient)
-    const instance = createSanityInstance({
-      auth: {clientFactory},
-    })
+    const instance = createSanityInstance({projectId: 'p', dataset: 'd', auth: {clientFactory}})
 
     const state = createStoreState(authStore.getInitialState(instance, null))
     const subscription = subscribeToStateAndFetchCurrentUser({state, instance, key: null})
@@ -80,7 +95,11 @@ describe('subscribeToStateAndFetchCurrentUser', () => {
       useProjectHostname: false,
       useCdn: false,
     })
-    expect(mockRequest).toHaveBeenCalledWith({method: 'GET', uri: '/users/me'})
+    expect(mockRequest).toHaveBeenCalledWith({
+      method: 'GET',
+      uri: '/users/me',
+      tag: 'users.get-current',
+    })
 
     subscription.unsubscribe()
   })
@@ -90,9 +109,7 @@ describe('subscribeToStateAndFetchCurrentUser', () => {
     const mockRequest = vi.fn().mockReturnValue(throwError(() => error))
     const mockClient = {observable: {request: mockRequest}}
     const clientFactory = vi.fn().mockReturnValue(mockClient)
-    const instance = createSanityInstance({
-      auth: {clientFactory},
-    })
+    const instance = createSanityInstance({projectId: 'p', dataset: 'd', auth: {clientFactory}})
 
     const state = createStoreState(authStore.getInitialState(instance, null))
     const subscription = subscribeToStateAndFetchCurrentUser({state, instance, key: null})
@@ -110,4 +127,120 @@ describe('subscribeToStateAndFetchCurrentUser', () => {
 
     subscription.unsubscribe()
   })
+
+  it('recovers from a fetch error when a new token is set', () => {
+    const error = new Error('Unauthorized')
+    const mockUser = {id: 'recovered-user'} as CurrentUser
+    const mockRequest = vi
+      .fn()
+      .mockReturnValueOnce(throwError(() => error))
+      .mockReturnValueOnce(of(mockUser))
+    const mockClient = {observable: {request: mockRequest}}
+    const clientFactory = vi.fn().mockReturnValue(mockClient)
+    const instance = createSanityInstance({projectId: 'p', dataset: 'd', auth: {clientFactory}})
+
+    const state = createStoreState(authStore.getInitialState(instance, null))
+    const subscription = subscribeToStateAndFetchCurrentUser({state, instance, key: null})
+
+    // First token causes a 401 — state should transition to ERROR
+    state.set('setLoggedIn', {
+      authState: {type: AuthStateType.LOGGED_IN, token: 'expired-token', currentUser: null},
+    })
+    expect(state.get()).toMatchObject({authState: {type: AuthStateType.ERROR, error}})
+
+    // Simulate comlink providing a fresh token (setAuthToken sets LOGGED_IN with new token)
+    state.set('setNewToken', {
+      authState: {type: AuthStateType.LOGGED_IN, token: 'fresh-token', currentUser: null},
+    })
+
+    // Subscription should still be alive — re-fetches /users/me with the new token
+    expect(state.get()).toMatchObject({
+      authState: {type: AuthStateType.LOGGED_IN, token: 'fresh-token', currentUser: mockUser},
+    })
+    expect(mockRequest).toHaveBeenCalledTimes(2)
+
+    subscription.unsubscribe()
+  })
+
+  it('recovers from multiple consecutive fetch errors', () => {
+    const error1 = new Error('Unauthorized')
+    const error2 = new Error('Unauthorized again')
+    const mockUser = {id: 'finally-recovered'} as CurrentUser
+    const mockRequest = vi
+      .fn()
+      .mockReturnValueOnce(throwError(() => error1))
+      .mockReturnValueOnce(throwError(() => error2))
+      .mockReturnValueOnce(of(mockUser))
+    const mockClient = {observable: {request: mockRequest}}
+    const clientFactory = vi.fn().mockReturnValue(mockClient)
+    const instance = createSanityInstance({projectId: 'p', dataset: 'd', auth: {clientFactory}})
+
+    const state = createStoreState(authStore.getInitialState(instance, null))
+    const subscription = subscribeToStateAndFetchCurrentUser({state, instance, key: null})
+
+    // First attempt fails
+    state.set('setLoggedIn', {
+      authState: {type: AuthStateType.LOGGED_IN, token: 'token-1', currentUser: null},
+    })
+    expect(state.get()).toMatchObject({authState: {type: AuthStateType.ERROR, error: error1}})
+
+    // Second attempt also fails
+    state.set('setNewToken', {
+      authState: {type: AuthStateType.LOGGED_IN, token: 'token-2', currentUser: null},
+    })
+    expect(state.get()).toMatchObject({authState: {type: AuthStateType.ERROR, error: error2}})
+
+    // Third attempt succeeds
+    state.set('setNewToken', {
+      authState: {type: AuthStateType.LOGGED_IN, token: 'token-3', currentUser: null},
+    })
+    expect(state.get()).toMatchObject({
+      authState: {type: AuthStateType.LOGGED_IN, token: 'token-3', currentUser: mockUser},
+    })
+    expect(mockRequest).toHaveBeenCalledTimes(3)
+
+    subscription.unsubscribe()
+  })
+
+  it('does not re-fetch with the same token but recovers with a different token', () => {
+    const error = new Error('Unauthorized')
+    const mockUser = {id: 'recovered-user'} as CurrentUser
+    const mockRequest = vi
+      .fn()
+      .mockReturnValueOnce(throwError(() => error))
+      .mockReturnValueOnce(of(mockUser))
+    const mockClient = {observable: {request: mockRequest}}
+    const clientFactory = vi.fn().mockReturnValue(mockClient)
+    const instance = createSanityInstance({projectId: 'p', dataset: 'd', auth: {clientFactory}})
+
+    const state = createStoreState(authStore.getInitialState(instance, null))
+    const subscription = subscribeToStateAndFetchCurrentUser({state, instance, key: null})
+
+    // First attempt fails
+    state.set('setLoggedIn', {
+      authState: {type: AuthStateType.LOGGED_IN, token: 'same-token', currentUser: null},
+    })
+    expect(state.get()).toMatchObject({authState: {type: AuthStateType.ERROR, error}})
+
+    // Same token should be blocked by distinctUntilChanged — no re-fetch
+    state.set('setNewToken', {
+      authState: {type: AuthStateType.LOGGED_IN, token: 'same-token', currentUser: null},
+    })
+    expect(mockRequest).toHaveBeenCalledTimes(1)
+
+    // A different token should pass distinctUntilChanged and trigger recovery
+    state.set('setNewToken', {
+      authState: {type: AuthStateType.LOGGED_IN, token: 'different-token', currentUser: null},
+    })
+    expect(state.get()).toMatchObject({
+      authState: {
+        type: AuthStateType.LOGGED_IN,
+        token: 'different-token',
+        currentUser: mockUser,
+      },
+    })
+    expect(mockRequest).toHaveBeenCalledTimes(2)
+
+    subscription.unsubscribe()
+  })
 })

package/src/auth/subscribeToStateAndFetchCurrentUser.ts

@@ -1,8 +1,17 @@
 import {type CurrentUser} from '@sanity/types'
-import {distinctUntilChanged, filter, map, type Subscription, switchMap} from 'rxjs'
+import {
+  catchError,
+  distinctUntilChanged,
+  EMPTY,
+  filter,
+  map,
+  type Subscription,
+  switchMap,
+} from 'rxjs'
 
 import {type StoreContext} from '../store/defineStore'
 import {DEFAULT_API_VERSION, REQUEST_TAG_PREFIX} from './authConstants'
+import {getAuthLogger} from './authLogger'
 import {isStudioConfig} from './authMode'
 import {AuthStateType} from './authStateType'
 import {type AuthMethodOptions, type AuthState, type AuthStoreState} from './authStore'
@@ -22,9 +31,11 @@ export const subscribeToStateAndFetchCurrentUser = (
   {state, instance}: StoreContext<AuthStoreState>,
   fetchOptions?: {useProjectHostname?: boolean},
 ): Subscription => {
+  const logger = getAuthLogger(instance)
+
   const {clientFactory, apiHost} = state.get().options
   const useProjectHostname = fetchOptions?.useProjectHostname ?? isStudioConfig(instance.config)
-  const projectId = instance.config.studio?.projectId
+  const projectId = instance.config.projectId
 
   const currentUser$ = state.observable
     .pipe(
@@ -60,12 +71,35 @@ export const subscribeToStateAndFetchCurrentUser = (
         }),
       ),
       switchMap((client) =>
-        client.observable.request<CurrentUser>({uri: '/users/me', method: 'GET'}),
+        client.observable
+          .request<CurrentUser>({
+            uri: '/users/me',
+            method: 'GET',
+            tag: 'users.get-current',
+          })
+          .pipe(
+            /**
+             * Catch inside switchMap so the outer subscription survives.
+             * Without this, a 401 terminates the subscription permanently
+             * and subsequent token refreshes via comlink never re-fetch /users/me.
+             * @see SDK-1409
+             */
+            catchError((error) => {
+              logger.error('Failed to fetch current user', {error})
+              state.set('setError', {authState: {type: AuthStateType.ERROR, error}})
+              return EMPTY
+            }),
+          ),
       ),
     )
 
   return currentUser$.subscribe({
     next: (currentUser) => {
+      logger.info('Current user fetched successfully', {
+        hasEmail: !!currentUser.email,
+      })
+      // userId is PII, so only surface it at debug level
+      logger.debug('Current user details', {userId: currentUser.id})
       state.set('setCurrentUser', (prev) => ({
         authState:
           prev.authState.type === AuthStateType.LOGGED_IN
@@ -73,8 +107,5 @@ export const subscribeToStateAndFetchCurrentUser = (
             : prev.authState,
       }))
     },
-    error: (error) => {
-      state.set('setError', {authState: {type: AuthStateType.ERROR, error}})
-    },
   })
 }

package/src/auth/subscribeToStorageEventsAndSetToken.test.ts

@@ -23,6 +23,8 @@ describe('subscribeToStorageEventsAndSetToken', () => {
     vi.clearAllMocks()
 
     instance = createSanityInstance({
+      projectId: 'p',
+      dataset: 'd',
       auth: {storageArea: storageArea},
     })