fix: studio re-login when session expires

Fixed Issue ArcadeData#4082

Author: lvca

server/src/test/java/com/arcadedb/server/HTTPAuthSessionIT.java

@@ -23,8 +23,10 @@
 import org.junit.jupiter.api.Test;
 
 import java.io.IOException;
+import java.io.InputStream;
 import java.net.HttpURLConnection;
 import java.net.URL;
+import java.nio.charset.StandardCharsets;
 import java.util.Base64;
 import java.util.HashMap;
 import java.util.logging.Level;
@@ -394,4 +396,87 @@ void tokenWithTransaction() throws Exception {
       }
     });
   }
+
+  /**
+   * Regression test for <a href="https://github.com/ArcadeData/arcadedb/issues/4082">issue #4082</a>:
+   * after a server restart, all in-memory auth sessions are lost. A client that still holds the
+   * previous Bearer token must receive HTTP 401 with a JSON body that Studio can react to by
+   * resetting the session and showing the login page.
+   * <p>
+   * Here we simulate the restart by explicitly removing the session from the manager. Studio's
+   * global ajaxError handler relies on this 401 to detect the dropped session and prompt the user
+   * to log in again, instead of leaving the UI stuck on stale data.
+   */
+  @Test
+  void invalidTokenAfterServerRestartReturns401() throws Exception {
+    testEachServer((serverIndex) -> {
+      // 1. LOGIN
+      HttpURLConnection connection = (HttpURLConnection) new URL(
+          "http://127.0.0.1:248" + serverIndex + "/api/v1/login").openConnection();
+      connection.setRequestMethod("POST");
+      connection.setRequestProperty("Authorization",
+          "Basic " + Base64.getEncoder().encodeToString(("root:" + BaseGraphServerTest.DEFAULT_PASSWORD_FOR_TESTS).getBytes()));
+      connection.connect();
+
+      final String authToken;
+      try {
+        final String response = readResponse(connection);
+        assertThat(connection.getResponseCode()).isEqualTo(200);
+        authToken = new JSONObject(response).getString("token");
+      } finally {
+        connection.disconnect();
+      }
+
+      // 2. SANITY CHECK: Token is valid right after login
+      connection = (HttpURLConnection) new URL(
+          "http://127.0.0.1:248" + serverIndex + "/api/v1/databases").openConnection();
+      connection.setRequestMethod("GET");
+      connection.setRequestProperty("Authorization", "Bearer " + authToken);
+      connection.connect();
+      try {
+        assertThat(connection.getResponseCode()).isEqualTo(200);
+      } finally {
+        connection.disconnect();
+      }
+
+      // 3. SIMULATE SERVER RESTART: drop the session from the in-memory session manager
+      // (a real restart would reinitialize the manager and lose all sessions the same way).
+      getServer(serverIndex).getHttpServer().getAuthSessionManager().removeSession(authToken);
+
+      // 4. CLIENT STILL USES THE OLD TOKEN -> server must return 401 with a parseable JSON body
+      connection = (HttpURLConnection) new URL(
+          "http://127.0.0.1:248" + serverIndex + "/api/v1/databases").openConnection();
+      connection.setRequestMethod("GET");
+      connection.setRequestProperty("Authorization", "Bearer " + authToken);
+      connection.connect();
+
+      try {
+        assertThat(connection.getResponseCode()).isEqualTo(401);
+        // Read from the error stream because the status is 4xx
+        final InputStream err = connection.getErrorStream();
+        assertThat(err).isNotNull();
+        final String body = new String(err.readAllBytes(), StandardCharsets.UTF_8);
+        assertThat(body).isNotBlank();
+        // Body must be JSON with an "error" key so Studio's globalNotifyError can parse it
+        final JSONObject json = new JSONObject(body);
+        assertThat(json.has("error")).isTrue();
+        assertThat(json.getString("error")).contains("Invalid or expired authentication token");
+      } finally {
+        connection.disconnect();
+      }
+
+      // 5. SAME TOKEN AGAINST OTHER ENDPOINTS: must consistently return 401 so the Studio's
+      // global handler kicks in regardless of which call was the one to hit the dead session.
+      connection = (HttpURLConnection) new URL(
+          "http://127.0.0.1:248" + serverIndex + "/api/v1/query/" + DATABASE_NAME + "/sql/select%201").openConnection();
+      connection.setRequestMethod("GET");
+      connection.setRequestProperty("Authorization", "Bearer " + authToken);
+      connection.connect();
+      try {
+        assertThat(connection.getResponseCode()).isEqualTo(401);
+      } finally {
+        connection.disconnect();
+      }
+    });
+  }
 }

studio/src/main/resources/static/js/studio-ai.js

@@ -396,6 +396,12 @@ function aiSendMessageStreaming(db, message) {
     signal: controller.signal
   })
   .then(function(response) {
+    if (response.status === 401) {
+      if (typeof handleSessionExpired === "function") handleSessionExpired();
+      var err = new Error("Session expired");
+      err.status = 401;
+      throw err;
+    }
     if (!response.ok) {
       return response.text().then(function(text) {
         var err = new Error("HTTP " + response.status);

studio/src/main/resources/static/js/studio-database.js

@@ -180,6 +180,57 @@ function initSessionFromStorage() {
   return false;
 }
 
+// Re-entry guard: when many AJAX calls are pending and the server has lost the
+// session (typically after a server restart), every one of them returns 401.
+// Without the flag we'd reset the UI multiple times and stack notifications.
+var sessionExpirationHandled = false;
+
+// Returns true if the URL points at the local API and uses our session token,
+// so a 401 from there means our token is no longer valid (server restarted, session
+// removed or token expired). External URLs (datasets repo, etc.) are ignored.
+function isLocalApiUrl(url) {
+  if (!url) return false;
+  if (url.indexOf("://") !== -1) return false;
+  return url.indexOf("api/v1/") === 0 || url.indexOf("/api/v1/") !== -1;
+}
+
+function handleSessionExpired() {
+  if (sessionExpirationHandled) return;
+  if (!globalCredentials) return;
+
+  sessionExpirationHandled = true;
+
+  clearSession();
+  globalCredentials = null;
+  globalUsername = null;
+
+  $("#studioPanel").hide();
+  $("#welcomePanel").hide();
+
+  if (typeof showLoginPopup === "function")
+    showLoginPopup();
+
+  if (typeof globalNotify === "function")
+    globalNotify("Session Expired", "Your session has expired. Please log in again.", "warning");
+
+  // Allow the next 401 (after the user logs back in) to be handled again.
+  setTimeout(function () { sessionExpirationHandled = false; }, 2000);
+}
+
+// Global jQuery handler: any 401 returned by an authenticated API call
+// (other than login/logout, which 401 for legitimate reasons) means the
+// session is no longer valid. Reset the UI back to the login screen.
+$(document).ajaxError(function (event, jqXHR, ajaxSettings) {
+  if (!jqXHR || jqXHR.status !== 401) return;
+
+  var url = (ajaxSettings && ajaxSettings.url) || "";
+  if (!isLocalApiUrl(url)) return;
+  if (url.indexOf("api/v1/login") !== -1) return;
+  if (url.indexOf("api/v1/logout") !== -1) return;
+
+  handleSessionExpired();
+});
+
 function login() {
   var userName = $("#inputUserName").val().trim();
   if (userName.length == 0) {
@@ -438,19 +489,10 @@ function updateDatabases(callback, preferSelected) {
         responseText: jqXHR.responseText
       });
 
-      // Handle session expiration (401 = invalid/expired token)
-      if (jqXHR.status === 401) {
-        console.log("Session expired or invalid, clearing session");
-        clearSession();
-        globalCredentials = null;
-        globalUsername = null;
-
-        // Silently redirect to login - no error popup needed
-        $("#studioPanel").hide();
-        $("#welcomePanel").show();
-        showLoginPopup();
+      // 401 is already handled by the global ajaxError hook (handleSessionExpired).
+      // Just stop here so no error toast is shown for the expired-session case.
+      if (jqXHR.status === 401)
         return;
-      }
 
       let errorMessage = "Failed to fetch databases";
       if (jqXHR.status === 403) {
@@ -622,6 +664,11 @@ function importWithSSE(command, onComplete, onError) {
     },
     body: JSON.stringify({ command: command })
   }).then(function(response) {
+    if (response.status === 401) {
+      handleSessionExpired();
+      onError("Session expired");
+      return;
+    }
     if (!response.ok) {
       response.text().then(function(t) { onError(t); });
       return;