auth refactored

README.md

@@ -3,7 +3,25 @@
 This is a Progressive Web App (Pwa) built for the Krishna Sales team.
 
 ## Version
-**1.0.2**
+**1.0.4**
+
+## Changelog
+
+### 1.0.4
+**Auth**
+- Refresh-token sessions: the 15-minute access token now renews itself from the server's HttpOnly `__Host-sm_rt` cookie (`POST /usr/session/refresh`), so users are no longer signed out every 15 minutes. A 401 refreshes once and replays the request; only a refused refresh signs the user out, a network failure never does. Refresh also runs ahead of expiry while the tab is visible, is single-flight across tabs, and sends the idle signal.
+- Logout now calls `POST /usr/logout` to revoke the session and cookie on the server (retried if the call fails). Sign-out and sign-in in one tab are reflected in the others; a different user signing in elsewhere reloads the tab.
+- One shared session for all four workflow clients (`src/api/session.ts`) replaces the per-client token copies. Existing sign-ins are cleared once, so everyone logs in again after this update.
+- Password policy: live rules checklist, forced change on login when the password is expired, temporary or predates the policy, forgot / reset password, and change password.
+- "Password change due" banner when the password is about to expire (from `user.password_status` at login), with a **Change now** shortcut.
+- Note: the refresh cookie is only set when the app and the API share one origin (`VITE_ZINO_API_URL` = `SAME_ORIGIN`, or the app's own host). On a different origin the server returns the token but no cookie, and the session ends when the access token expires.
+
+**Maintenance**
+- Platform notices (`GET /usr/notices`, polled every 30 s): an `announced` strip you can dismiss, a `draining` strip that pauses starting orders / submitting activities, and a full-screen `closed` page that lifts itself when maintenance ends.
+- A `503 PLATFORM_MAINTENANCE` from any write re-reads the notices and shows the server's reason; any other 503 shows a "service temporarily unavailable" strip. The form keeps its data.
+
+### 1.0.2
+- Initial documented version.
 
 ## Sitemap
 

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "krishna-sales-pwa",
-  "version": "1.0.2",
+  "version": "1.1.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "krishna-sales-pwa",
-      "version": "1.0.2",
+      "version": "1.1.0",
       "dependencies": {
         "@react-google-maps/api": "^2.20.8",
         "jspdf": "^4.2.1",

package.json

@@ -1,7 +1,7 @@
 {
   "name": "krishna-sales-pwa",
   "private": true,
-  "version": "1.0.2",
+  "version": "1.0.4",
   "type": "module",
   "scripts": {
     "dev": "vite",

src/api/config.ts

@@ -271,5 +271,5 @@ export const HIDDEN_FORM_FIELDS = [
 export const SELECT_OPTION_LIMIT = 200;
 export const PDF_MAX_SKUS_PER_CHUNK = 50;
 
-export const APP_VERSION = '1.0.2';
+export const APP_VERSION = '1.0.4';
 export const FORM_DRAFT_EXPIRY_MS = 30 * 60 * 1000;