aaronrene / knowtation public
feat minor auth feat/phase-2g-bundle #61 / 100
AI Agent git-import/068377df · 54 days ago · Jun 2, 2026 · Diff

feat(auth): persistent login via rotating refresh tokens (self-hosted + hosted gateway)

Replaces expiry-only JWT sessions with durable, secure persistent login so users stay signed in across access-token expiry without re-authenticating.

- refresh-token-core.mjs: storage-agnostic rotation with reuse detection + family revocation; opaque high-entropy tokens, hashed at rest (raw secret never stored). - Self-hosted Hub: file-backed store (refresh-tokens.mjs) + HttpOnly cookie issuance on OAuth callback; POST /api/v1/auth/refresh and /logout (real server-side revoke). - Hosted gateway: Netlify Blob store (strong consistency for read-after-write reuse detection) via refresh-token-store.mjs; adaptive cookie policy (SameSite=Lax same-origin, None+Secure cross-site) for the api.knowtation.store first-party setup. - Web UI: single-flight silent refresh on 401 before forcing re-login; logout revokes server-side. config.js points production UI at first-party https://api.knowtation.store.

Security: HttpOnly/Secure cookies, token rotation + reuse detection, hashed storage, 0600 store file perms, no raw secrets in responses. Covered by 7-tier tests (unit/integration/e2e/stress/data-integrity/performance/security): 86 new tests, all green.

sha256:7040861db73b922541fb7a4d44e4d5ca5b07005a6f294a52e586ec73ca739f49 sha
sha256:a23853d71d18e145e42d5a65271369eb1fc991351c7ee03804d32a435ba10c56 parent
sha256:2caf1b753781727244307c37d705f83307a3e307fb215f35944c5b69c2e6be9e snapshot
Older Merge pull request #218 from aaronrene/muse-mirror sha256:a23853d71d18e145e42d5a65271369eb1fc991351c7ee03804d32a435ba10c56 All commits Newer Merge remote-tracking branch 'origin/main' into feat/persistent-login sha256:2c4a5dbc881ade389a734f7738f4144492fe7fef0cc54a5b99918b0251f565e6

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:7040861db73b922541fb7a4d44e4d5ca5b07005a6f294a52e586ec73ca739f49 --body "your comment"