feat: Share one session across tabs (M2-11052,M2-11002) by sricharan-varanasi · Pull Request #2251 · ChildMindInstitute/mindlogger-admin

sricharan-varanasi · 2026-08-12T00:03:58Z

📝 Description

🔗 Jira Ticket M2-11052
🔗 Jira Ticket M2-11002

#2249 moved tokens into one shared, encrypted slot. But react-secure-storage reads from a snapshot taken when the page loads, so a tab still can't see what another tab wrote.

That leaves three problems:

Tab A rotates the token, tab B keeps using the old one, and the retry revokes the family for both
Tab A logs out, tab B keeps showing a signed-in UI over a dead session
A tab sitting on the login page doesn't notice a sign-in elsewhere

Tabs now talk over a BroadcastChannel.

Changes include:

Rotated tokens, logout, and session hand-off sync across tabs
A tab on the login page joins a session started elsewhere, or reloads into one if no other tab is left
A frozen tab catches up on focus, or tears down if the session ended while it slept
An idle logout no longer gets caught by the builder's unsaved-changes prompt

Changes include:

A modal at 25 minutes idle, counting down the last 5 before logout
Stay logged in keeps the session; Log out ends it immediately. Closing the modal keeps the session
Activity pauses while the modal is open, so moving the mouse toward the buttons cannot answer it for you
The countdown length is configurable via REACT_APP_IDLE_WARNING_MIN, capped at half the idle timeout
Answering in one tab closes the modal in the others

The main bug - a background tab logging out the tab you're actually using - is fixed by one line. The idle clock is shared now, so the timer just re-reads it instead of firing blind.

🪤 Peer Testing

Needs enableSessionKeepAlive on locally, REACT_APP_IDLE_TIMEOUT_MIN=3, REACT_APP_REFRESH_LEAD_SEC=20.

Use chrome://discards (or edge://discards) → Freeze for the frozen-tab steps.

Two tabs. Work in tab A past the idle timeout, leave tab B in the background

Expected outcome: neither logs out
Two tabs. Wait for a rotation, then click something in tab B

Expected outcome: one refresh call across the browser, and tab B doesn't 401
Log out in tab A

Expected outcome: tab B goes to the login page straight away
Edit something in the builder, then idle out

Expected outcome: soft-lock login, no unsaved-changes modal
Edit something in the builder, then log out from the account menu

Expected outcome: the save/discard prompt still appears
Freeze a tab, rotate a few times elsewhere, then focus it

Expected outcome: it catches up, no 401
Freeze tab B, log out in tab A, focus tab B

Expected outcome: tab B tears down on focus
Leave tab A on the login page, sign in on tab B

Expected outcome: tab A moves to the dashboard. Close tab B first and tab A reloads once instead
Flag off

Expected outcome: no channel traffic, no idle logout, same as feat: Move tokens to local storage (M2-11055) #2249 alone

✏️ Notes

Base is session-storage-local (feat: Move tokens to local storage (M2-11055) #2249), which sits on session-keep-alive (feat: keep session alive on Admin ( M2 - 11001 ) #2246). Merge in order.
Supersedes feat: Share session between tabs via BroadcastChannel (M2-11052) #2247. Five of its nine commits are cherry-picked; the rest no longer apply.
Two fixes ship unflagged: the idle-timer fix and the failed-refresh logout. Neither is about tab sync.

✅ Checklist

Functionality

The feature behaves correctly in practice and fulfills the intended business purpose
The implementation accounts for edge cases, avoids subtle logical errors, and handles somewhat rare failure states (e.g. offline mode for mobile, 3rd party being down, etc)

Testing

Verify there are automated tests added that meaningfully cover critical behavior and failure cases
Code coverage does not go down as result of this change
Test suite passes

Security & Data Privacy

Verify there is no chance we would accidentally log PII to application logs
Verify this addition does not materially affect our security attack surface, and if so it has undergone security review
All inputs are sanitized
New dependencies are well maintained, have significant justification for being added to the project, and are documented in the Curious open source credit page - none added

Logging/Monitoring

Logging is implemented for this change such that you could troubleshoot this feature in production — none added
The change/feature is able to be monitored in production — none added

Performance

This change does not introduce n+1 queries or other performance issues within our expected scale (e.g. missing indexes on frequently queried columns, frequently updating tables that are accessed often)

Readability

All commented out code is removed
Debugging code including extraneous log lines are removed
Code is easy to understand through naming and structure; comments explain intent or non‑obvious decisions

Change Safety

Backend changes are backwards compatible with old clients, or it is well known they are not and a deployment/rollout plan is in place. This include backend changes being compatible with old mobile app versions, as well as applet versioning within Curious.
Destructive database migrations are rolled out in stages. For example, renaming a column means adding a new column and migrating the existing data to that columns in one deployment. Then monitoring to ensure that field isn't used, and finally removing that old column in a separate deployment.

aws-amplify-us-east-1 · 2026-08-18T03:28:14Z

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-2251.d2ccder08v9rmu.amplifyapp.com

divbzero

@sricharan-varanasi This is big set of changes and looks really good overall. Just a few comments: 3 that I think could tighten the security, and 2 ACTIVITY_EVENTS comments that could slightly reduce how often the event handler fires.

divbzero · 2026-08-18T18:55:44Z

+  if (Date.now() - lastActivityAt < idleTimeoutMs) return;
+
+  authStorage.clear();
+  clearSessionState();


[Important] Also clear sessionStorage like we do in Auth.reducer.ts?

sessionStorage.clear();

Thank you, @divbzero . Fixed in 7c31d79 . Added sessionStorage.clear() after the token clear, matching the teardown in Auth.reducer.ts.

divbzero · 2026-08-18T19:45:24Z

+
+  const { idleTimeoutMs } = resolveSessionConfig();
+  if (Date.now() - lastActivityAt < idleTimeoutMs) return;
+


[Important] Also invalidate tokens on the server like we do in useLogout.ts?

await deleteAccessTokenApi();

await deleteRefreshTokenApi();

Fixed in 46a02ca . It now calls deleteRefreshTokenApi() before clearing, guarded on the
refresh token's own exp so it only fires while the server would still accept it.

clearStaleSession now calls deleteRefreshTokenApi() before clearing local storage, so the
server ends the session too. logout2 revokes the whole token family, so the access token goes
with it - one call covers both.

The call is guarded on the refresh token's exp, so we only ask the server when the token is
actually still valid. If it has already expired there's nothing to revoke and we skip it.

divbzero · 2026-08-18T19:55:05Z

+export const ACTIVITY_THROTTLE_MS = 5 * MS_IN_SEC;
+
+export const ACTIVITY_EVENTS = [
+  'mousemove',


s/mousemove/pointermove/? pointermove should capture movement from mouse, touch, or pen.

Fixed in 46a6f63 . Switched to pointermove, which covers mouse, touch and pen in one.

divbzero · 2026-08-18T19:55:30Z

+  'keydown',
+  'scroll',
+  'wheel',
+  'touchstart',


Remove touchstart? touchstart should be captured by pointerdown.

Fixed in 46a6f63 . Dropped both touchstart and mousedown for pointerdown.

divbzero · 2026-08-18T20:29:21Z

+  if (!accessToken || !refreshToken) {
+    throw new Error('Access token refresh failed.');
+  }
+


[Important] Do we need a check that the user hasn’t logged out while awaiting the refreshed token?

Thank you @divbzero . Fixed this gap in 3713f85 . The refresh now checks the store still
holds a refresh token before saving the new pair, and throws if it doesn't.

divbzero

The latest 9 commits look solid 👍 just one typo from the design. Thank you @sricharan-varanasi!

divbzero · 2026-08-21T19:49:05Z

  "sept": "September",
  "serverConfiguration": "Server Configuration",
  "serverStatusConfigured": "Server Status: Connected.",
+  "sessionTimeoutDescription": "You haven't done anything in this window for awhile. If you don't make a choice, we'll log you out in {{countdown}}.",


s/awhile/a while/ — I think this was a typo in the design.

Fixed in cbef683 . Corrected in both app-en.json .

…he old one

sricharan-varanasi added 11 commits July 30, 2026 16:54

feat: session keep-alive flag and timing config

f9558ea

feat: getTokenExpiration util

9e81cbe

refactor: extract refreshTokens() and avoid duplicate calls

bbf4560

feat: user activity tracker

bfbd616

feat: session keep-alive engine

f9ed2be

test: synchronous secure-storage mock

b7e2401

refactor: single home for keep-alive timestamps

b4cdc75

feat: tokens in encrypted local storage

dd5cd86

feat: adopt sessions left in the old store

f10674d

feat: track activity whenever signed in

8b6addd

feat: clean boot when the session is stale

9029609

sricharan-varanasi force-pushed the session-sync-local branch from 50e94ba to b8cc745 Compare August 13, 2026 15:16

fix: encrypt local storage with our own key

ce42957

sricharan-varanasi force-pushed the session-storage-local branch from 32f1efd to ce42957 Compare August 13, 2026 15:17

sricharan-varanasi added 11 commits August 13, 2026 11:18

fix: idle timer re-checks the shared clock

60341aa

feat: session sync channel and protocol

b9fece9

feat: sync rotated tokens across same-session tabs

c8f2c8b

feat: sync logout across same-session tabs

3b9813d

fix: an involuntary logout is not blocked by unsaved changes

d5e2535

feat: live tabs answer session requests

a30dca0

feat: catch up stale tokens when a tab wakes

c0a229f

feat: a tab on the login page joins a session started elsewhere

2fe97ee

fix: a failed refresh ends the session instead of stranding the tab

ce43bbd

feat: a tab whose session ended while it slept tears down on focus

29bdeaa

feat: a login-page tab reloads into a session it cannot read

8504546

sricharan-varanasi force-pushed the session-sync-local branch from b8cc745 to 8504546 Compare August 13, 2026 15:18

sricharan-varanasi changed the base branch from session-storage-local to develop August 18, 2026 03:21

sricharan-varanasi closed this Aug 18, 2026

sricharan-varanasi reopened this Aug 18, 2026

divbzero reviewed Aug 18, 2026

View reviewed changes

This was referenced Aug 18, 2026

feat: keep session alive on Admin ( M2 - 11001 ) #2246

Closed

feat: Move tokens to local storage (M2-11055) #2249

Closed

feat: Session tab sync and keep session alive (M2-11004,M2-11005) ChildMindInstitute/mindlogger-web-refactor#764

Open

sricharan-varanasi added 3 commits August 19, 2026 20:43

chore: run the keep-alive engine without the flag

10cb3db

chore: run session adoption without the flag

c338e27

chore: remove the enableSessionKeepAlive flag

601db86

sricharan-varanasi mentioned this pull request Aug 20, 2026

feat: remove enableSessionKeepAlive flag #2255

Merged

17 tasks

sricharan-varanasi added 6 commits August 20, 2026 19:35

feat: resolve how long the idle warning counts down for

12cf29c

feat: the keep-alive engine counts down before an idle logout

13ea52e

feat: activity pauses while the idle warning waits for an answer

5b6db5c

feat: add the session timeout warning modal

cfc2d0e

feat: show the timeout warning before an idle session ends

e8e9e38

style: the timeout modal uses the repo's standard modal buttons

774330c

sricharan-varanasi mentioned this pull request Aug 21, 2026

feat: Session timeout modal (M2-11002) #2256

Closed

17 tasks

divbzero reviewed Aug 21, 2026

View reviewed changes

sricharan-varanasi changed the title ~~feat: Share one session across tabs (M2-11052)~~ feat: Share one session across tabs (M2-11052,M2-11002) Aug 22, 2026

sricharan-varanasi added 9 commits August 24, 2026 12:42

fix: a refresh that lands after the session ended is discarded

3713f85

fix: a stale session clears the applet keys a reload would keep

7c31d79

fix: correct the a while typo

cbef683

refactor: track activity with pointer events instead of mouse and touch

46a6f63

fix: a stale session revokes a token the server would still accept

46a02ca

fix: activity no longer walks the token refresh towards expiry

5f214c8

feat: record which session the browser belongs to

cc08a23

fix: a stale tab no longer signs out the session that replaced it

93849c2

fix: a tab woken into another session rejoins it instead of showing t…

ff5d1a4

…he old one


		const { idleTimeoutMs } = resolveSessionConfig();
		if (Date.now() - lastActivityAt < idleTimeoutMs) return;

Uh oh!

Conversation

sricharan-varanasi commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📝 Description

🪤 Peer Testing

✏️ Notes

✅ Checklist

Functionality

Testing

Security & Data Privacy

Logging/Monitoring

Performance

Readability

Change Safety

Uh oh!

aws-amplify-us-east-1 Bot commented Aug 18, 2026

Uh oh!

divbzero left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sricharan-varanasi Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sricharan-varanasi Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

divbzero left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

sricharan-varanasi commented Aug 12, 2026 •

edited

Loading

divbzero left a comment •

edited

Loading

sricharan-varanasi Aug 24, 2026 •

edited

Loading

sricharan-varanasi Aug 24, 2026 •

edited

Loading