Trade each sign-in code once #115

Merged

jcoffey-dev merged 1 commits from fix/oauth-code-once into main

2026-10-18 22:40:32 +00:00

jcoffey-dev commented

2026-10-18 22:33:27 +00:00

Owner

OAuthCallback.tsx traded the sign-in code every time its effect ran:
twice under StrictMode, again whenever its dependencies changed (the
translations loading), and again on a reload of the callback page. The
server refuses a spent code, so a sign-in that had worked could end on
an error.

New src/services/auth/codeOnce.ts:

a second run for the same code leaves it to the trade under way;
a code that brought tokens is remembered for the tab (sessionStorage),
so a reload goes on to the console when signed in, or to a fresh
sign-in when not, instead of showing an error;
a failed trade isn't remembered.

Tests cover each case, including a reload (fresh module, same storage).
Typecheck, lint, i18n:check, all 673 tests, build and notice check pass
locally. No new strings.

`OAuthCallback.tsx` traded the sign-in code every time its effect ran: twice under StrictMode, again whenever its dependencies changed (the translations loading), and again on a reload of the callback page. The server refuses a spent code, so a sign-in that had worked could end on an error. New `src/services/auth/codeOnce.ts`: - a second run for the same code leaves it to the trade under way; - a code that brought tokens is remembered for the tab (sessionStorage), so a reload goes on to the console when signed in, or to a fresh sign-in when not, instead of showing an error; - a failed trade isn't remembered. Tests cover each case, including a reload (fresh module, same storage). Typecheck, lint, i18n:check, all 673 tests, build and notice check pass locally. No new strings.

jcoffey-dev added 1 commit 2026-10-18 22:33:27 +00:00

Trade each sign-in code once

ci / build (pull_request) Skipped

Details

ci / publish (pull_request) Skipped

Details

ci / notices (pull_request) Successful in 46s

Details

github/ci (branch) GitHub Actions

Details

ci / github (pull_request) Successful in 1m42s

Details

b436766880

The callback page traded the code every time its effect ran: twice under
StrictMode, again when the translations loaded, and again on a reload of
the page. The server refuses a spent code, so a sign-in that had worked
could end on an error.

A code is now traded once. A second run leaves it to the trade under
way, and a code already traded (kept for the tab in sessionStorage) goes
on to the console when signed in, or to a fresh sign-in when not.

No new strings.

jcoffey-dev merged commit 686a43e279 into main

2026-10-18 22:40:32 +00:00

jcoffey-dev deleted branch fix/oauth-code-once

2026-10-18 22:40:32 +00:00

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: inbuxa/inbuxa-admin#115