Warn user when credentials have expired in multiuser mode#134
Draft
Warn user when credentials have expired in multiuser mode#134
Conversation
1 task
Agent-Logs-Url: https://github.com/lstein/InvokeAI/sessions/f0947cda-b15c-475d-b7f4-2d553bdf2cd6 Co-authored-by: lstein <111189+lstein@users.noreply.github.com>
Agent-Logs-Url: https://github.com/lstein/InvokeAI/sessions/f0947cda-b15c-475d-b7f4-2d553bdf2cd6 Co-authored-by: lstein <111189+lstein@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Enhance multiuser support to warn users on expired credentials
Warn user when credentials have expired in multiuser mode
Apr 4, 2026
Backend: - SlidingWindowTokenMiddleware refreshes JWT on each mutating request (POST/PUT/PATCH/DELETE), returning a new token in X-Refreshed-Token response header. GET requests don't refresh (they're often background fetches that shouldn't reset the inactivity timer). - CORS expose_headers updated to allow X-Refreshed-Token. Frontend: - dynamicBaseQuery picks up X-Refreshed-Token from responses and updates localStorage so subsequent requests use the fresh expiry. - 401 handler only triggers sessionExpiredLogout when a token was actually sent (not for unauthenticated background requests). - ProtectedRoute polls localStorage every 5s and listens for storage events to detect token removal (e.g. manual deletion, other tabs). Result: session expires after TOKEN_EXPIRATION_NORMAL (1 day) of inactivity, not a fixed time after login. Any user-initiated action resets the clock. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Bug fixes: - ProtectedRoute: only treat 401 errors as session expiry, not transient 500/network errors that should not force logout - Token refresh: use explicit remember_me claim in JWT instead of inferring from remaining lifetime, preventing silent downgrade of 7-day tokens to 1-day when <24h remains - TokenData: add remember_me field, set during login Tests (6 new): - Mutating requests (POST/PUT/DELETE) return X-Refreshed-Token - GET requests do not return X-Refreshed-Token - Unauthenticated requests do not return X-Refreshed-Token - Remember-me token refreshes to 7-day duration even near expiry - Normal token refreshes to 1-day duration - remember_me claim preserved through refresh cycle Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Upgrade spandrel to 0.4.2 in uv.lock * Fixed typos
* Fix workflow copy hotkeys in info view * Fix Makefile help target copy * Fix workflow info view copy handling * Fix workflow edge delete hotkeys
Closes invoke-ai#8843 Co-authored-by: dunkeroni <dunkeroni@gmail.com>
Co-authored-by: dunkeroni <dunkeroni@gmail.com>
* Run vitest during frontend build * Add frontend-test Make target
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In multiuser mode, expired JWT tokens caused the app to silently stop working with no user-facing explanation. Users now get redirected to the login page with a clear expiration message.
Changes
authSlice.ts: AddedsessionExpired: booleanstate field andsessionExpiredLogoutaction (setssessionExpired = true+ clears auth).setCredentialsandlogoutboth resetsessionExpired = false. AddedselectSessionExpiredselector.sessionExpiredexcluded from redux-persist.api/index.ts:dynamicBaseQuerynow intercepts 401 responses on non-auth endpoints when a token is present, dispatchingsessionExpiredLogout(). ExistingProtectedRouteauth-guard logic handles the redirect automatically.ProtectedRoute.tsx: Switched fromlogouttosessionExpiredLogoutwhen initial user fetch fails (handles stale token in localStorage on page load).LoginPage.tsx: Renders a warning banner whensessionExpiredistrue— "Your credentials have expired. Please log in again to resume."en.json: Addedauth.login.sessionExpiredtranslation key.Related Issues / Discussions
QA Instructions
auth_tokenin localStorage, or wait for expiry and make an API call)./loginwith the expiration warning banner visible.Merge Plan
Checklist
What's Newcopy (if doing a release after this PR)