From 1ed1576101f976bdef996f61a6eee2b368dfa415 Mon Sep 17 00:00:00 2001
From: suryac <surya.c@getzino.com>
Date: Fri, 6 Nov 2026 13:35:02 +0530
Subject: [PATCH] auth refactored

---
 README.md         | 20 +++++++++++++++++++-
 package-lock.json |  4 ++--
 package.json      |  2 +-
 src/api/config.ts |  2 +-
 4 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index 22c21f6..e2f9db2 100644
--- a/README.md
+++ b/README.md
@@ -3,7 +3,25 @@
 This is a Progressive Web App (Pwa) built for the Krishna Sales team.
 
 ## Version
-**1.0.2**
+**1.0.4**
+
+## Changelog
+
+### 1.0.4
+**Auth**
+- Refresh-token sessions: the 15-minute access token now renews itself from the server's HttpOnly `__Host-sm_rt` cookie (`POST /usr/session/refresh`), so users are no longer signed out every 15 minutes. A 401 refreshes once and replays the request; only a refused refresh signs the user out, a network failure never does. Refresh also runs ahead of expiry while the tab is visible, is single-flight across tabs, and sends the idle signal.
+- Logout now calls `POST /usr/logout` to revoke the session and cookie on the server (retried if the call fails). Sign-out and sign-in in one tab are reflected in the others; a different user signing in elsewhere reloads the tab.
+- One shared session for all four workflow clients (`src/api/session.ts`) replaces the per-client token copies. Existing sign-ins are cleared once, so everyone logs in again after this update.
+- Password policy: live rules checklist, forced change on login when the password is expired, temporary or predates the policy, forgot / reset password, and change password.
+- "Password change due" banner when the password is about to expire (from `user.password_status` at login), with a **Change now** shortcut.
+- Note: the refresh cookie is only set when the app and the API share one origin (`VITE_ZINO_API_URL` = `SAME_ORIGIN`, or the app's own host). On a different origin the server returns the token but no cookie, and the session ends when the access token expires.
+
+**Maintenance**
+- Platform notices (`GET /usr/notices`, polled every 30 s): an `announced` strip you can dismiss, a `draining` strip that pauses starting orders / submitting activities, and a full-screen `closed` page that lifts itself when maintenance ends.
+- A `503 PLATFORM_MAINTENANCE` from any write re-reads the notices and shows the server's reason; any other 503 shows a "service temporarily unavailable" strip. The form keeps its data.
+
+### 1.0.2
+- Initial documented version.
 
 ## Sitemap
 
diff --git a/package-lock.json b/package-lock.json
index 750832c..ddf89b9 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "krishna-sales-pwa",
-  "version": "1.0.2",
+  "version": "1.1.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "krishna-sales-pwa",
-      "version": "1.0.2",
+      "version": "1.1.0",
       "dependencies": {
         "@react-google-maps/api": "^2.20.8",
         "jspdf": "^4.2.1",
diff --git a/package.json b/package.json
index 8e1dcfe..affc783 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "krishna-sales-pwa",
   "private": true,
-  "version": "1.0.2",
+  "version": "1.0.4",
   "type": "module",
   "scripts": {
     "dev": "vite",
diff --git a/src/api/config.ts b/src/api/config.ts
index c480777..89f96bf 100644
--- a/src/api/config.ts
+++ b/src/api/config.ts
@@ -271,5 +271,5 @@ export const HIDDEN_FORM_FIELDS = [
 export const SELECT_OPTION_LIMIT = 200;
 export const PDF_MAX_SKUS_PER_CHUNK = 50;
 
-export const APP_VERSION = '1.0.2';
+export const APP_VERSION = '1.0.4';
 export const FORM_DRAFT_EXPIRY_MS = 30 * 60 * 1000;