lakebed 0.0.40 → 0.0.41

package/dist/client/auth.js

@@ -4,16 +4,24 @@
 import { h } from "preact";
 import { useEffect, useState } from "preact/hooks";
 import { isExactLoopbackHostname } from "../_core/url-policy.js";
-import { AUTH_RESUME_STORAGE_KEY, AUTH_STORAGE_KEY, DEFAULT_AUTH_BASE_URL, GUEST_UPGRADE_STORAGE_KEY, PKCE_MAX_AGE_MS, PKCE_STORAGE_KEY, RETURN_TO_STORAGE_KEY, addAuthListener, authConfig, basePath, browserSessionStorage, browserStorage, brokerIdentityFromToken, createGoogleAuthFromToken, createSignedOutAuth, currentGuestName, decodeIdentityClaims, emitAuth, encoder, getAuth, identityIdFromTokenResponse, OBSOLETE_AUTH_STORAGE_KEY, isAuthIdentity, parseJson, readStoredIdentity, removeAuthListener, setAuth, setAuthToken, setAuthResumeStarted, getAuthResumeStarted } from "./internal.js";
+import { AUTH_RESUME_STORAGE_KEY, AUTH_STORAGE_KEY, DEFAULT_AUTH_BASE_URL, GUEST_UPGRADE_STORAGE_KEY, PKCE_MAX_AGE_MS, PKCE_STORAGE_KEY, RETURN_TO_STORAGE_KEY, addAuthListener, canAccessApp, authConfig, basePath, browserSessionStorage, browserStorage, brokerIdentityFromToken, createGoogleAuthFromToken, createSignedOutAuth, currentGuestName, decodeIdentityClaims, emitAuth, encoder, getAuth, identityIdFromTokenResponse, OBSOLETE_AUTH_STORAGE_KEY, isAuthIdentity, parseJson, readStoredIdentity, removeAuthListener, setAuth, setAuthToken, setAuthResumeStarted, getAuthResumeStarted, storedAuthToken, tokenExpiresAt } from "./internal.js";
 import { navigate } from "./router.js";
-import { connect, disconnect, reconnect, resetConnectionRecovery, resetQueryCacheAfterAuthChange } from "./transport.js";
+import { connect, disconnect, reconnect, reconnectDelayMs, reconnectLater, reconnectNow, refreshSocketToken, resetConnectionRecovery, resetQueryCacheAfterAuthChange } from "./transport.js";
 let authInitPromise = null;
 let authInitialized = false;
 let authRevision = 0;
 let authController = null;
 let pendingGuestUpgrade = null;
 let signOutPending = false;
+// Automatic retries after a session check could not reach Lakebed.
+let authRetryAttempts = 0;
+let authRetryTimer = null;
+let refreshInFlight = null;
 const TOKEN_RESPONSE_MAX_BYTES = 64 * 1024;
+// Refresh an account token this long before it expires.
+const TOKEN_REFRESH_AHEAD_MS = 5 * 60 * 1000;
+const TOKEN_REFRESH_TIMEOUT_MS = 10_000;
+const REFRESH_TOKEN_PATTERN = /^[A-Za-z0-9_-]{20,256}$/;
 const TOKEN_RESPONSE_MAX_CHUNKS = 1024;
 const TOKEN_RESPONSE_TIMEOUT_MS = 5_000;
 const OAUTH_CALLBACK_PARAMETERS = ["code", "state", "error", "error_description", "error_uri"];
@@ -26,6 +34,108 @@ class TokenResponseBodyError extends Error {
 }
 class TerminalTokenResponseError extends Error {
 }
+/** Lakebed or the network could not answer. The session itself may be fine. */
+function transientAuthError(message) {
+    return Object.assign(new Error(message), { transient: true });
+}
+function isTransientAuthError(error) {
+    if (!error || typeof error !== "object" || error instanceof SupersededAuthError) {
+        return false;
+    }
+    if ("transient" in error && error.transient === true) {
+        return true;
+    }
+    if ("status" in error && typeof error.status === "number") {
+        return error.status === 408 || error.status === 429 || error.status >= 500;
+    }
+    // A timeout, or a browser lock that could not be granted.
+    return "name" in error && (error.name === "AbortError" || error.name === "TimeoutError");
+}
+function parseRefreshGrant(value) {
+    if (!value || typeof value !== "object") {
+        return undefined;
+    }
+    const candidate = value;
+    if (typeof candidate.authBaseUrl !== "string" ||
+        typeof candidate.clientId !== "string" ||
+        typeof candidate.refreshToken !== "string" ||
+        !REFRESH_TOKEN_PATTERN.test(candidate.refreshToken) ||
+        candidate.clientId !== `origin:${window.location.origin}`) {
+        return undefined;
+    }
+    try {
+        const broker = new URL(candidate.authBaseUrl);
+        if (broker.protocol !== "https:" &&
+            !(broker.protocol === "http:" && isExactLoopbackHostname(broker.hostname))) {
+            return undefined;
+        }
+    }
+    catch {
+        return undefined;
+    }
+    return {
+        authBaseUrl: candidate.authBaseUrl,
+        clientId: candidate.clientId,
+        refreshToken: candidate.refreshToken
+    };
+}
+/** The refresh grant stored with the account token, if any. */
+function readRefreshGrant() {
+    try {
+        const stored = parseJson(browserStorage()?.getItem(AUTH_STORAGE_KEY) ?? null);
+        return stored && typeof stored === "object" && "refresh" in stored
+            ? parseRefreshGrant(stored.refresh)
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Revokes a refresh token at the broker. Best effort: sign-out does not wait for it. */
+function revokeRefreshGrant(grant) {
+    if (!grant || typeof fetch !== "function") {
+        return;
+    }
+    void fetch(new URL("/revoke", grant.authBaseUrl), {
+        body: new URLSearchParams({ client_id: grant.clientId, token: grant.refreshToken }),
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        keepalive: true,
+        method: "POST"
+    }).catch(() => undefined);
+}
+// A token's expiry on this device's clock (see `tokenExpiresAt`), and its lifetime.
+function tokenTiming(token) {
+    const claims = decodeIdentityClaims(token);
+    let stored;
+    try {
+        stored = parseJson(browserStorage()?.getItem(AUTH_STORAGE_KEY) ?? null);
+    }
+    catch {
+        stored = null;
+    }
+    const receivedAt = stored && typeof stored === "object" && "token" in stored && stored.token === token &&
+        "receivedAt" in stored
+        ? stored.receivedAt
+        : undefined;
+    const expiresAt = tokenExpiresAt(claims, receivedAt);
+    if (expiresAt === null || !claims) {
+        return null;
+    }
+    const lifetimeMs = typeof claims.iat === "number" && typeof claims.exp === "number"
+        ? (claims.exp - claims.iat) * 1000
+        : TOKEN_REFRESH_AHEAD_MS * 2;
+    return { expiresAt, lifetimeMs };
+}
+// True in the last five minutes of a token's life, or the last half of a short one.
+function tokenNeedsRefresh(token) {
+    const timing = tokenTiming(token);
+    return (timing !== null &&
+        timing.expiresAt - Date.now() <= Math.min(TOKEN_REFRESH_AHEAD_MS, timing.lifetimeMs / 2));
+}
+function tokenExpired(token) {
+    const timing = tokenTiming(token);
+    return timing !== null && timing.expiresAt <= Date.now();
+}
 class SupersededAuthError extends Error {
     constructor() {
         super("The session changed before sign-in finished.");
@@ -55,9 +165,20 @@ async function requestSession(operation, token, signal, guestUserId = null) {
         signal: requestSignal
     });
     // Keep concurrent tabs from replacing each other's first guest cookie.
-    const response = typeof navigator !== "undefined" && navigator.locks
-        ? await navigator.locks.request(`lakebed-auth:${basePath()}`, { signal: requestSignal }, sendRequest)
-        : await sendRequest();
+    let response;
+    try {
+        response =
+            typeof navigator !== "undefined" && navigator.locks
+                ? await navigator.locks.request(`lakebed-auth:${basePath()}`, { signal: requestSignal }, sendRequest)
+                : await sendRequest();
+    }
+    catch (error) {
+        // fetch() rejects with a TypeError when the network fails.
+        if (error instanceof TypeError && !signal.aborted) {
+            throw transientAuthError("Could not reach this app. Retrying.");
+        }
+        throw error;
+    }
     if (!response.ok) {
         let message = operation === "upgrade"
             ? `Could not finish sign-in (${response.status}). Retry to keep your work.`
@@ -83,9 +204,19 @@ async function requestSession(operation, token, signal, guestUserId = null) {
         }
         throw Object.assign(new Error(message), { status: response.status });
     }
+    let bytes;
+    try {
+        bytes = await readTokenResponseBytes(response, requestSignal);
+    }
+    catch (error) {
+        if (error instanceof TokenResponseBodyError && error.kind === "size") {
+            throw new Error("Lakebed returned an invalid session. Try again.");
+        }
+        // The connection dropped or stalled while the session arrived.
+        throw transientAuthError("Lakebed stopped answering before the session arrived. Retrying.");
+    }
     let body;
     try {
-        const bytes = await readTokenResponseBytes(response, requestSignal);
         body = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
     }
     catch {
@@ -146,9 +277,11 @@ function readPendingGuestUpgrade(allowExpired = false) {
         clearPendingGuestUpgrade();
         return null;
     }
+    const refresh = parseRefreshGrant(candidate.refresh);
     const pending = {
         expiresIn: candidate.expiresIn,
         guestUserId: candidate.guestUserId,
+        ...(refresh ? { refresh } : {}),
         requestPii: candidate.requestPii,
         returnTo,
         token: candidate.token
@@ -169,7 +302,7 @@ async function finishGuestUpgrade(pending, revision, signal) {
     if (!identity || !auth.isSignedIn || auth.userId !== `google:${identity.subject}`) {
         throw new Error("Lakebed returned a different account. Sign-in did not finish.");
     }
-    persistIdentity(identity.subject, pending.token, pending.expiresIn, pending.requestPii);
+    persistIdentity(identity.subject, pending.token, pending.expiresIn, pending.requestPii, pending.refresh);
     setAuthToken(pending.token);
     clearPendingGuestUpgrade();
     clearAuthResumeAttempt();
@@ -393,15 +526,20 @@ function createSignInUrl(options, bundle, requestPii) {
     url.searchParams.set("pii", String(requestPii));
     return url.toString();
 }
-function persistIdentity(userId, token, expiresIn, requestPii) {
+function persistIdentity(userId, token, expiresIn, requestPii, refresh) {
     const storage = browserStorage();
     if (!storage) {
         return;
     }
     try {
+        const previous = readRefreshGrant();
+        if (previous && previous.refreshToken !== refresh?.refreshToken) {
+            revokeRefreshGrant(previous);
+        }
         storage.setItem(AUTH_STORAGE_KEY, JSON.stringify({
             expiresIn,
             receivedAt: Date.now(),
+            ...(refresh ? { refresh } : {}),
             requestPii,
             token,
             userId,
@@ -434,6 +572,7 @@ function clearStoredIdentity() {
         return;
     }
     try {
+        revokeRefreshGrant(readRefreshGrant());
         storage.removeItem(AUTH_STORAGE_KEY);
         storage.removeItem(OBSOLETE_AUTH_STORAGE_KEY);
     }
@@ -731,9 +870,15 @@ async function handleGoogleCallback(revision, signal) {
         clearTerminalTokenResponse();
         throw new Error("Google sign-in token response did not match the trusted broker.");
     }
+    const refresh = parseRefreshGrant({
+        authBaseUrl: parsedPkce.options.authBaseUrl,
+        clientId: parsedPkce.options.clientId,
+        refreshToken: token.refresh_token
+    });
     const pending = {
         expiresIn: token.expires_in,
         guestUserId: parsedPkce.guestUserId,
+        ...(refresh ? { refresh } : {}),
         requestPii: parsedPkce.requestPii,
         returnTo: parsedPkce.options.returnTo,
         token: token.id_token
@@ -745,6 +890,218 @@ async function handleGoogleCallback(revision, signal) {
     await finishGuestUpgrade(pending, revision, signal);
     return token;
 }
+/**
+ * Gets a new account token from the broker with the stored refresh token, with
+ * no redirect. Tabs take turns through a lock, and a tab that waited reads the
+ * token the other tab stored. `rejectedToken` is a token the server refused:
+ * it is refreshed even when it does not look expired.
+ */
+export function refreshAccountToken(rejectedToken) {
+    refreshInFlight ??= requestTokenRefresh(rejectedToken).finally(() => {
+        refreshInFlight = null;
+    });
+    return refreshInFlight;
+}
+async function requestTokenRefresh(rejectedToken) {
+    const refresh = async () => {
+        const stored = readStoredIdentity({ allowExpired: true });
+        if (!stored.token || !stored.userId) {
+            return "none";
+        }
+        if (!stored.expired && !tokenNeedsRefresh(stored.token) && stored.token !== rejectedToken) {
+            // Another tab refreshed while this one waited for the lock.
+            adoptRefreshedToken(stored.userId, stored.token);
+            return "refreshed";
+        }
+        const grant = readRefreshGrant();
+        if (!grant) {
+            return "none";
+        }
+        let body;
+        try {
+            const signal = AbortSignal.timeout(TOKEN_REFRESH_TIMEOUT_MS);
+            const response = await fetch(new URL("/token", grant.authBaseUrl), {
+                body: new URLSearchParams({
+                    client_id: grant.clientId,
+                    grant_type: "refresh_token",
+                    refresh_token: grant.refreshToken
+                }),
+                headers: { "Content-Type": "application/x-www-form-urlencoded" },
+                method: "POST",
+                signal
+            });
+            if (response.status === 400 || response.status === 401) {
+                void response.body?.cancel().catch(() => undefined);
+                forgetRefreshGrant(grant);
+                return "rejected";
+            }
+            if (!response.ok) {
+                void response.body?.cancel().catch(() => undefined);
+                return "unavailable";
+            }
+            const parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await readTokenResponseBytes(response, signal)));
+            if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+                return "unavailable";
+            }
+            body = parsed;
+        }
+        catch {
+            return "unavailable";
+        }
+        const token = typeof body.id_token === "string" ? body.id_token : null;
+        const identity = brokerIdentityFromToken(token);
+        if (!token ||
+            !identity ||
+            identity.subject !== stored.userId ||
+            !createGoogleAuthFromToken(token) ||
+            identityIdFromTokenResponse({ subject: body.subject }) !== identity.subject ||
+            identityIdFromTokenResponse({ pairwise_sub: body.pairwise_sub }) !== identity.pairwiseSub) {
+            // A broker that returns another account must not sign this tab in as it.
+            forgetRefreshGrant(grant);
+            return "rejected";
+        }
+        if (readRefreshGrant()?.refreshToken !== grant.refreshToken) {
+            // Signed out, or another account signed in, while the request ran.
+            // Writing this token back would undo that.
+            return "none";
+        }
+        persistIdentity(identity.subject, token, body.expires_in, storedIdentityRequestsProfile(), grant);
+        adoptRefreshedToken(identity.subject, token);
+        return "refreshed";
+    };
+    try {
+        // A frozen tab can hold the lock. Waiting is bounded, then this tab tries later.
+        return typeof navigator !== "undefined" && navigator.locks
+            ? await navigator.locks.request(`lakebed-auth-refresh:${basePath()}`, { signal: AbortSignal.timeout(TOKEN_REFRESH_TIMEOUT_MS * 2) }, refresh)
+            : await refresh();
+    }
+    catch {
+        return "unavailable";
+    }
+}
+/** This tab starts using a newer token of the account it already shows. */
+function adoptRefreshedToken(subject, token) {
+    const auth = getAuth();
+    if (!auth.isSignedIn || auth.userId !== `google:${subject}` || storedAuthToken() === token) {
+        return;
+    }
+    setAuthToken(token);
+    refreshSocketToken(token);
+}
+/** Drops a refresh token the broker refused, and keeps the account token. */
+function forgetRefreshGrant(grant) {
+    const storage = browserStorage();
+    try {
+        const stored = parseJson(storage?.getItem(AUTH_STORAGE_KEY) ?? null);
+        if (stored &&
+            typeof stored === "object" &&
+            "refresh" in stored &&
+            parseRefreshGrant(stored.refresh)?.refreshToken === grant.refreshToken) {
+            const { refresh: _refresh, ...identity } = stored;
+            storage?.setItem(AUTH_STORAGE_KEY, JSON.stringify(identity));
+        }
+    }
+    catch {
+        // The broker refuses this token anyway.
+    }
+}
+/** True when this tab's account token expires soon and should be refreshed before use. */
+export function accountTokenNeedsRefresh() {
+    return tokenNeedsRefresh(storedAuthToken());
+}
+/**
+ * Refreshes this tab's account token when it expires soon. While the token
+ * still works, the refresh runs in the background and the caller does not
+ * wait for the broker. Returns a failure only when the token has already
+ * expired, because a socket would refuse it.
+ */
+export async function refreshAccountTokenIfNeeded() {
+    if (!accountTokenNeedsRefresh()) {
+        return undefined;
+    }
+    if (!tokenExpired(storedAuthToken())) {
+        void refreshAccountToken();
+        return undefined;
+    }
+    const outcome = await refreshAccountToken();
+    if (outcome === "refreshed" || !tokenExpired(storedAuthToken())) {
+        return undefined;
+    }
+    return outcome === "unavailable" ? "unavailable" : "rejected";
+}
+// An expired account token with a refresh token gets a new one without the
+// sign-in redirect. While the broker is out of reach, no redirect starts.
+async function refreshExpiredStoredIdentity() {
+    if (getAuthResumeStarted() ||
+        currentGuestName() !== null ||
+        window.location.pathname === callbackPath() ||
+        parseCallback()) {
+        return;
+    }
+    const stored = readStoredIdentity({ allowExpired: true });
+    if (!stored.token || !stored.expired || !readRefreshGrant()) {
+        return;
+    }
+    if ((await refreshAccountToken()) === "unavailable") {
+        throw transientAuthError("Could not reach Lakebed to restore your sign-in. Retrying.");
+    }
+}
+function clearAuthRetry() {
+    if (authRetryTimer !== null) {
+        clearTimeout(authRetryTimer);
+        authRetryTimer = null;
+    }
+}
+// A session check that could not reach Lakebed runs again by itself: after a
+// backoff, or as soon as the tab wakes up or goes online.
+function scheduleAuthRetry() {
+    if (authRetryTimer !== null) {
+        return;
+    }
+    authRetryTimer = setTimeout(() => {
+        authRetryTimer = null;
+        void retryAuth();
+    }, reconnectDelayMs(authRetryAttempts++));
+    authRetryTimer.unref?.();
+}
+/**
+ * Runs after the first socket that could not open. That is usually the
+ * network, but a browser reports a rejected upgrade the same way. This asks
+ * the session route without signing the tab out first. A changed or refused
+ * session gets the full recheck. Otherwise the tab keeps its identity and
+ * data, and the socket retries after a backoff.
+ */
+export async function checkSessionAfterHandshakeFailure() {
+    const revision = authRevision;
+    const before = getAuth();
+    let session;
+    try {
+        if ((await refreshAccountTokenIfNeeded()) === "unavailable") {
+            // The token expired and the broker is out of reach too. Keep waiting.
+            reconnectLater();
+            return;
+        }
+        session = await requestSession("session", storedAuthToken() || undefined, new AbortController().signal);
+    }
+    catch (error) {
+        if (revision !== authRevision) {
+            return;
+        }
+        if (isTransientAuthError(error)) {
+            reconnectLater();
+            return;
+        }
+        return recheckAuthAfterDisconnect();
+    }
+    if (revision !== authRevision) {
+        return;
+    }
+    if (session.userId === before.userId && session.isSignedIn === before.isSignedIn) {
+        reconnectLater();
+        return;
+    }
+    return recheckAuthAfterDisconnect();
+}
 function authResumeAttemptKey(identity) {
     const claims = decodeIdentityClaims(identity.token);
     return ([identity.userId, claims?.jti, claims?.exp].filter(Boolean).join(":") ||
@@ -802,7 +1159,8 @@ function beginStoredGoogleSessionResume() {
     return true;
 }
 // The session this page can start with, without a request: the stored account
-// token, or the guest session the app page shipped (`__LAKEBED_AUTH__.session`).
+// token (refreshed before use when it expired), or the guest session the app
+// page shipped (`__LAKEBED_AUTH__.session`).
 // The WebSocket handshake checks it, and a rejected handshake rechecks with
 // the session route. Sign-in callbacks, guest upgrades, expired tokens, and
 // pages without a shipped session ask the session route first.
@@ -816,7 +1174,9 @@ function readStartingSession() {
     }
     const stored = readStoredIdentity({ allowExpired: true });
     if (stored.token) {
-        const auth = stored.expired ? null : createGoogleAuthFromToken(stored.token);
+        // An expired token with a refresh token still starts the page signed in:
+        // connect() refreshes it before the socket opens.
+        const auth = stored.expired && !readRefreshGrant() ? null : createGoogleAuthFromToken(stored.token);
         return auth ? { auth, token: stored.token } : null;
     }
     const session = authConfig().session;
@@ -860,6 +1220,8 @@ export function ensureAuthInitialized() {
             await finishGuestUpgrade(pending, revision, signal);
             return;
         }
+        await refreshExpiredStoredIdentity();
+        assertAuthRevision(revision);
         if (beginStoredGoogleSessionResume()) {
             return;
         }
@@ -881,9 +1243,38 @@ export function ensureAuthInitialized() {
                 error.status !== 401) {
                 throw error;
             }
-            clearStoredIdentity();
-            token = undefined;
-            session = await requestSession("session", undefined, signal);
+            // The token expired or was revoked after it was read. A refresh tells which.
+            const refresh = await refreshAccountToken(token);
+            assertAuthRevision(revision);
+            if (refresh === "unavailable") {
+                throw transientAuthError("Could not reach Lakebed to check your sign-in. Retrying.");
+            }
+            const refused = token;
+            let next = refresh === "refreshed" ? readStoredIdentity().token : undefined;
+            if (refresh === "none" && tokenExpired(token) && beginStoredGoogleSessionResume()) {
+                return;
+            }
+            try {
+                if (!next) {
+                    throw Object.assign(new Error("The session route refused the account token."), { status: 401 });
+                }
+                session = await requestSession("session", next, signal);
+            }
+            catch (retryError) {
+                assertAuthRevision(revision);
+                if (!retryError || typeof retryError !== "object" || !("status" in retryError) || retryError.status !== 401) {
+                    throw retryError;
+                }
+                // Clear only the identity this tab tried. Another tab may have signed
+                // in to a different account meanwhile.
+                const stored = readStoredIdentity({ allowExpired: true }).token;
+                if (stored === refused || stored === next) {
+                    clearStoredIdentity();
+                }
+                next = undefined;
+                session = await requestSession("session", undefined, signal);
+            }
+            token = next;
         }
         assertAuthRevision(revision);
         if (session.isSignedIn) {
@@ -893,6 +1284,7 @@ export function ensureAuthInitialized() {
             }
             setAuthToken(token ?? "");
         }
+        authRetryAttempts = 0;
         setAuth(session);
         emitAuth();
     })()
@@ -901,11 +1293,15 @@ export function ensureAuthInitialized() {
             return;
         }
         console.error("[lakebed] Session failed", error);
+        const transient = isTransientAuthError(error);
         setAuth({
             ...createSignedOutAuth(),
             error: error instanceof Error ? error.message : "Could not load your session. Try again."
         });
         emitAuth();
+        if (transient) {
+            scheduleAuthRetry();
+        }
     })
         .finally(() => {
         if (revision === authRevision) {
@@ -915,6 +1311,7 @@ export function ensureAuthInitialized() {
     return authInitPromise;
 }
 export async function recheckAuthAfterDisconnect() {
+    clearAuthRetry();
     authController?.abort();
     authRevision += 1;
     signOutPending = false;
@@ -951,6 +1348,15 @@ export function stopAuthAfterConnectionFailure(message) {
 if (typeof window !== "undefined" && typeof window.addEventListener === "function") {
     window.addEventListener("storage", (event) => {
         if (event.key === AUTH_STORAGE_KEY || event.key === null) {
+            // Another tab refreshed the token of the account this tab shows. Use it
+            // in place. A full recheck would blank this tab's data for nothing.
+            if (event.key === AUTH_STORAGE_KEY && event.newValue !== null && !signOutPending) {
+                const stored = readStoredIdentity();
+                if (stored.token && stored.userId && getAuth().isSignedIn && getAuth().userId === `google:${stored.userId}`) {
+                    adoptRefreshedToken(stored.userId, stored.token);
+                    return;
+                }
+            }
             if (event.key === null || event.newValue === null) {
                 clearPendingGuestUpgrade();
                 clearSignInTransaction();
@@ -960,6 +1366,47 @@ if (typeof window !== "undefined" && typeof window.addEventListener === "functio
             void retryAuth();
         }
     });
+    // Keeps a long-lived tab signed in and connected. Timers stop while a
+    // laptop sleeps and run late in background tabs, so waking up checks too.
+    const wake = () => {
+        if (authRetryTimer !== null) {
+            // A session check could not reach Lakebed. Try it now.
+            clearAuthRetry();
+            void retryAuth();
+            return;
+        }
+        if (!canAccessApp()) {
+            return;
+        }
+        const token = storedAuthToken();
+        if (token && tokenNeedsRefresh(token)) {
+            void refreshAccountToken().then(() => reconnectNow());
+            return;
+        }
+        reconnectNow();
+    };
+    window.addEventListener("online", wake);
+    window.addEventListener("focus", wake);
+    window.addEventListener("pageshow", (event) => {
+        if (event.persisted) {
+            wake();
+        }
+    });
+    if (typeof document !== "undefined" && typeof document.addEventListener === "function") {
+        document.addEventListener("visibilitychange", () => {
+            if (document.visibilityState === "visible") {
+                wake();
+            }
+        });
+    }
+    const tokenCheck = setInterval(() => {
+        const token = storedAuthToken();
+        if (canAccessApp() && token && tokenNeedsRefresh(token)) {
+            void refreshAccountToken();
+        }
+    }, 60_000);
+    // Node test hosts must still exit. Browsers return a number here.
+    tokenCheck.unref?.();
 }
 export function useAuth() {
     const [value, setValue] = useState(getAuth());
@@ -1014,6 +1461,7 @@ export async function signInWithGoogle(options = {}) {
     return { bundle, url };
 }
 export async function signOut() {
+    clearAuthRetry();
     authController?.abort();
     const revision = ++authRevision;
     authController = new AbortController();