fix(bd-jv5u083l): expiry timer refresh-only; probe owns logout

The hub validates the sync WS only at upgrade and keeps established
connections alive past token expiry, so clearing auth on a schedule
only disrupts a still-syncing session (and buys no security). Make the
expiry/backstop timers refresh-only and stop logging out in the
renewal-failure callbacks; evidence-based logout is now the
sync-disconnect probe's job plus the cold mount check.

Author: shikokuchuo

claude-notes/plans/2026-06-10-expiry-refresh-only.md

@@ -0,0 +1,62 @@
+# Expiry timer refresh-only; probe owns logout (bd-jv5u083l)
+
+Follow-up to bd-3o8zmz46.
+
+## Problem
+
+`useAuth` cleared auth on a schedule: the expiry-time `/auth/me` re-check
+called `expireSession()` on a 401, and the silent-renewal failure callbacks
+(`onError`, `refreshToken` → null/throw) called it too when past `exp`. But the
+hub validates the sync WebSocket **only at the upgrade handshake** and never
+tears down an established connection on token expiry (`crates/quarto-hub/
+src/server.rs:893`). So a session whose cookie has been evicted at `exp` keeps
+syncing fine over the still-open socket — and the only HTTP the client makes
+during steady editing is the four `/auth/*` endpoints. Tearing the session
+down based on a side-channel `/auth/me` 401, while the channel the user is
+actually using (the WS) still works, is purely disruptive.
+
+Key insight: **client-side proactive logout buys zero security.** The server is
+the boundary and has deliberately chosen to keep the socket alive; a client
+logout cannot stop a determined client from editing on the grandfathered
+connection. So the expiry logout was only ever UX — and as UX, interrupting a
+working edit session (editor unmounts → LoginScreen) is the worse outcome.
+True session severing on expiry is server-side work (bd-ey6jg70f).
+
+## Change
+
+- The schedule (`exp − 15 min` refresh timer, `exp` backstop timer) now drives
+  **refresh only** — both timers call `triggerRefresh()`, never `expireSession()`.
+- Silent-renewal failure callbacks no longer log out; a renewal that yields no
+  session is not evidence the open WS can't sync.
+- Logout is now the **sole responsibility of `useAuthProbe`** (the sync-disconnect
+  probe, two-strike 401 → `expireSession`) plus the cold mount check
+  (`/auth/me` 401 at startup → login). The visibility handler was already
+  refresh-only.
+- Removed now-dead code: `sessionLapsed`, `expiresAtRef`, `EXPIRY_RECHECK_MS`,
+  and the `scheduleExpiryCheck` poll/reschedule loop.
+
+## Residual behaviour (intentional, no data loss)
+
+- Editing a project, WS up, `exp` passes, renewal fails → **session retained**
+  (the fix). Logout happens via the probe once the socket actually drops, or on
+  reload (mount check).
+- Project-list screen (no project open) with a dead cookie: the probe is gated
+  on `!!project`, so it won't fire there; the dead session is surfaced on reload
+  or on a project-open attempt (`fetchActorId` 401 → renewal). Acceptable —
+  broadening the probe's enablement is a separate change.
+- No permanent data loss in any case: Automerge changes persist to IndexedDB
+  and re-sync after re-login.
+
+## Verification
+
+- `useAuth.test.tsx`: schedule-driven-logout tests reframed to assert the new
+  contract (refresh attempted, session retained on failure; adopt on success;
+  refocus does not drift the schedule). The visibility "no logout on renewal
+  failure" test was confirmed red against the old code before implementing.
+- hub-client: 572 unit + 66 integration + 81 wasm pass; `npm run build` green.
+- **E2E honesty note**: the real flow (Google token aging past 1 h with the WS
+  staying open, then dropping) was NOT exercised in a browser — same live-session
+  limitation as bd-3o8zmz46. Manual recipe: sign in, edit, delete the
+  `quarto_hub_token` cookie in DevTools while the socket stays connected; editing
+  should keep working until the socket drops, after which the probe lands you on
+  the login screen with the "session expired" message.

hub-client/src/App.tsx

@@ -85,10 +85,10 @@ function App() {
   const [isOnline, setIsOnline] = useState<boolean>(false);
 
   // While a project's sync is disconnected, check whether the disconnect is
-  // actually an auth rejection (browsers hide the WS upgrade status). Only
-  // definitive 401/403 evidence ever clears auth — never network errors.
-  // Past the token's exp, useAuth's expiry timer logs out on the first 401
-  // (preempting this probe's two-strike); the probe governs earlier drops.
+  // actually an auth rejection (browsers hide the WS upgrade status). This is
+  // the sole evidence-based logout path: useAuth never clears auth on a
+  // schedule (bd-jv5u083l), so only a definitive 401/403 here — never a
+  // network error — ends the session.
   useAuthProbe({
     enabled: AUTH_ENABLED && !!auth && !!project && !isOnline,
     triggerRefresh,

hub-client/src/hooks/useAuth.test.tsx

@@ -226,63 +226,40 @@ describe('useAuth', () => {
       await vi.waitFor(() => expect(result.current.auth).toEqual(refreshedUser));
     });
 
-    it('clears auth when silent renewal fails after visibility-triggered refresh', async () => {
+    it('does not log out when renewal fails after a visibility-triggered refresh', async () => {
       const user = { email: 'a@b.com', name: 'A', picture: null };
       mockFetchAuthMe.mockResolvedValueOnce(user); // mount
 
       const { result } = renderHook(() => useAuth(), { wrapper });
       await vi.waitFor(() => expect(result.current.auth).toEqual(user));
 
-      // Jump Date.now() past cookie lifetime (simulates long idle)
+      // Long idle past expiry, then refocus with a rejected cookie.
       vi.setSystemTime(Date.now() + 3600 * 1000 + 1000);
-
-      // Next /auth/me returns null (cookie expired)
       mockFetchAuthMe.mockResolvedValueOnce(null);
 
       document.dispatchEvent(new Event('visibilitychange'));
       await act(async () => {
         await vi.advanceTimersByTimeAsync(0);
       });
+      expect(mockProvider.lastSilentRenewalOpts?.enabled).toBe(true);
 
-      // Simulate silent renewal failing (no active IdP session).
+      // Renewal fails (IdP session gone). Auth is RETAINED: a dead cookie is
+      // not evidence the still-open WS can't sync. The disconnect probe owns
+      // evidence-based logout (bd-jv5u083l).
       await act(async () => {
         mockProvider.lastSilentRenewalOpts?.onError();
       });
-
-      await vi.waitFor(() => expect(result.current.auth).toBeNull());
-    });
-
-    it('clears auth when refreshToken returns null after visibility-triggered refresh', async () => {
-      const user = { email: 'a@b.com', name: 'A', picture: null };
-      mockFetchAuthMe.mockResolvedValueOnce(user); // mount
-
-      const { result } = renderHook(() => useAuth(), { wrapper });
-      await vi.waitFor(() => expect(result.current.auth).toEqual(user));
-
-      // Jump Date.now() past cookie lifetime (simulates long idle)
-      vi.setSystemTime(Date.now() + 3600 * 1000 + 1000);
-
-      // Next /auth/me returns null (cookie expired)
-      mockFetchAuthMe.mockResolvedValueOnce(null);
-
-      document.dispatchEvent(new Event('visibilitychange'));
-      await act(async () => {
-        await vi.advanceTimersByTimeAsync(0);
-      });
-
-      // Silent renewal returns a credential, but server rejects it.
-      mockRefreshToken.mockResolvedValue(null);
-      await act(async () => {
-        mockProvider.lastSilentRenewalOpts?.onCredential('rejected.jwt');
-      });
-
-      await vi.waitFor(() => expect(result.current.auth).toBeNull());
+      expect(result.current.auth).toEqual(user);
+      expect(result.current.sessionExpired).toBe(false);
     });
   });
 
-  // ── Hard expiry (fake timers) ─────────────────────────────
+  // ── Expiry behaviour (fake timers) ────────────────────────
+  // The schedule drives refresh, never logout: while the WS stays open it
+  // keeps syncing past token expiry, so a dead cookie is not grounds to tear
+  // down a working session (bd-jv5u083l). Logout is the disconnect probe's job.
 
-  describe('hard expiry', () => {
+  describe('expiry behaviour', () => {
     beforeEach(() => {
       vi.useFakeTimers({ shouldAdvanceTime: true });
     });
@@ -291,58 +268,57 @@ describe('useAuth', () => {
       vi.useRealTimers();
     });
 
-    it('clears auth when cookie expires and no refresh in progress', async () => {
+    it('attempts refresh at expiry and retains the session when renewal fails', async () => {
       const user = { email: 'a@b.com', name: 'A', picture: null };
-      mockFetchAuthMe
-        .mockResolvedValueOnce(user) // mount check
-        .mockResolvedValueOnce(null); // expiry re-check
+      mockFetchAuthMe.mockResolvedValueOnce(user); // mount
 
       const { result } = renderHook(() => useAuth(), { wrapper });
       await vi.waitFor(() =>
         expect(result.current.auth).toEqual(user),
       );
 
-      // Advance past the refresh point. The refresh timer sets
-      // isRefreshing=true and enables silent renewal. Simulate the IdP
-      // session being gone (onError fires), resetting isRefreshing=false.
+      // Reach the refresh point — renewal is attempted, then fails.
       await act(async () => {
         vi.advanceTimersByTime(COOKIE_MAX_AGE_MS - REFRESH_BUFFER_MS + 100);
       });
+      expect(mockProvider.lastSilentRenewalOpts?.enabled).toBe(true);
       await act(async () => {
         mockProvider.lastSilentRenewalOpts?.onError();
       });
 
-      // Advance past cookie max-age (remaining buffer).
+      // Advance past expiry: the session is NOT cleared on schedule.
       await act(async () => {
         vi.advanceTimersByTime(REFRESH_BUFFER_MS + 100);
       });
-
-      await vi.waitFor(() =>
-        expect(result.current.auth).toBeNull(),
-      );
+      expect(result.current.auth).toEqual(user);
+      expect(result.current.sessionExpired).toBe(false);
     });
 
-    it('keeps auth if server confirms valid cookie at expiry', async () => {
+    it('adopts the refreshed session when renewal succeeds at expiry', async () => {
       const user = { email: 'a@b.com', name: 'A', picture: null };
       const freshUser = {
         email: 'a@b.com',
         name: 'Still Valid',
         picture: null,
       };
-      mockFetchAuthMe
-        .mockResolvedValueOnce(user) // mount check
-        .mockResolvedValueOnce(freshUser); // expiry re-check (refresh succeeded)
+      mockFetchAuthMe.mockResolvedValueOnce(user); // mount
 
       const { result } = renderHook(() => useAuth(), { wrapper });
       await vi.waitFor(() =>
         expect(result.current.auth).toEqual(user),
       );
 
-      // Advance past cookie max-age
+      // Reach expiry; the backstop refresh fires.
       await act(async () => {
-        vi.advanceTimersByTime(3600 * 1000 + 100);
+        vi.advanceTimersByTime(COOKIE_MAX_AGE_MS + 100);
       });
+      expect(mockProvider.lastSilentRenewalOpts?.enabled).toBe(true);
 
+      // Renewal delivers a fresh credential → adopt it.
+      mockRefreshToken.mockResolvedValue(freshUser);
+      await act(async () => {
+        mockProvider.lastSilentRenewalOpts?.onCredential('fresh.jwt');
+      });
       await vi.waitFor(() =>
         expect(result.current.auth).toEqual(freshUser),
       );
@@ -386,19 +362,18 @@ describe('useAuth', () => {
       expect(mockProvider.lastSilentRenewalOpts?.enabled).toBe(true);
     });
 
-    it('does not extend assumed expiry on refocus without a fresh cookie (drift bug)', async () => {
+    it('does not extend the refresh schedule on refocus without a fresh cookie (drift bug)', async () => {
       const expiresAt = Date.now() + 40 * 60 * 1000;
       const user = { email: 'a@b.com', name: 'A', picture: null, expiresAt };
       mockFetchAuthMe
         .mockResolvedValueOnce(user) // mount
-        .mockResolvedValueOnce({ ...user }) // refocus: same expiry, fresh object
-        .mockResolvedValueOnce(null); // expiry re-check: token now rejected
+        .mockResolvedValueOnce({ ...user }); // refocus: same expiry, fresh object
 
       const { result } = renderHook(() => useAuth(), { wrapper });
       await vi.waitFor(() => expect(result.current.auth).toEqual(user));
 
       // Refocus at +10 min — server confirms the cookie but its expiry is
-      // unchanged. This must NOT push the schedule out to +70 min.
+      // unchanged. This must NOT push the schedule out to +35 min.
       await act(async () => {
         vi.advanceTimersByTime(10 * 60 * 1000);
       });
@@ -407,20 +382,13 @@ describe('useAuth', () => {
         await vi.advanceTimersByTimeAsync(0);
       });
 
-      // Refresh fires at expiresAt − 15 min (+25 min); renewal fails.
+      // Refresh must still fire at the REAL expiresAt − 15 min (+25 min),
+      // tracking the token's exp rather than drifting with the refocus.
+      expect(mockProvider.lastSilentRenewalOpts?.enabled).toBe(false);
       await act(async () => {
         vi.advanceTimersByTime(15 * 60 * 1000 + 1000);
       });
-      await act(async () => {
-        mockProvider.lastSilentRenewalOpts?.onError();
-      });
-
-      // At the REAL expiry (+40 min) the server's 401 must clear auth.
-      await act(async () => {
-        vi.advanceTimersByTime(15 * 60 * 1000 + 2000);
-      });
-      await vi.waitFor(() => expect(result.current.auth).toBeNull());
-      expect(result.current.sessionExpired).toBe(true);
+      expect(mockProvider.lastSilentRenewalOpts?.enabled).toBe(true);
     });
 
     it('keeps auth when refocus /auth/me fails with a network error (offline)', async () => {
@@ -440,39 +408,6 @@ describe('useAuth', () => {
       expect(result.current.auth).toEqual(user);
     });
 
-    it('keeps auth on expiry-time network error and re-checks later', async () => {
-      const expiresAt = Date.now() + 20 * 60 * 1000;
-      const user = { email: 'a@b.com', name: 'A', picture: null, expiresAt };
-      mockFetchAuthMe.mockResolvedValueOnce(user); // mount
-
-      const { result } = renderHook(() => useAuth(), { wrapper });
-      await vi.waitFor(() => expect(result.current.auth).toEqual(user));
-
-      // Refresh fires at +5 min; renewal fails (session not lapsed → keep).
-      await act(async () => {
-        vi.advanceTimersByTime(5 * 60 * 1000 + 1000);
-      });
-      await act(async () => {
-        mockProvider.lastSilentRenewalOpts?.onError();
-      });
-
-      // Expiry re-check at +20 min hits a network error → stay logged in.
-      mockFetchAuthMe.mockRejectedValueOnce(new Error('network'));
-      await act(async () => {
-        vi.advanceTimersByTime(15 * 60 * 1000 + 2000);
-      });
-      expect(result.current.auth).toEqual(user);
-      expect(result.current.sessionExpired).toBe(false);
-
-      // The next re-check gets a definitive 401 → evidence-based logout.
-      mockFetchAuthMe.mockResolvedValueOnce(null);
-      await act(async () => {
-        vi.advanceTimersByTime(60 * 1000 + 1000);
-      });
-      await vi.waitFor(() => expect(result.current.auth).toBeNull());
-      expect(result.current.sessionExpired).toBe(true);
-    });
-
     it('does not flag sessionExpired on deliberate logout', async () => {
       const user = { email: 'a@b.com', name: 'A', picture: null };
       mockFetchAuthMe.mockResolvedValue(user);