nogoo9 / no-crd

76%

push

github

fix(auth): align cookie TTLs and add singleflight refresh (#32)

* fix(auth): align cookie TTLs with token lifetimes

- Clear stale nocr_refresh cookie when IdP rejects expired refresh token
  to prevent repeated futile round-trips
- Derive nocr_token Max-Age from JWT exp claim, nocr_refresh from IdP's
  refresh_expires_in, with PROXY_TOKEN_COOKIE_TTL and
  PROXY_REFRESH_COOKIE_TTL as configurable fallbacks
- Wrap performTokenRefresh in singleflight deduplication to safely
  support strict refresh token rotation under concurrent requests
- Pass refresh_expires_in from UI to server escrow endpoint
- Update architecture and SSO docs with cookie lifecycle details
- Add shared test helpers and e2e lifecycle test for refresh flow

* chore: enforce ≤72 char commit subject line

Add explicit character count rule to both the commit workflow and
commit rule to prevent subject lines from exceeding 72 characters.

* chore: bump version to 0.11.1

* docs: add ADR-023 for refresh token lifecycle changes

---------

Co-authored-by: Antigravity Agent <agent@antigravity>

88 of 93 new or added lines in 5 files covered. (94.62%)

7530 of 9890 relevant lines covered (76.14%)

21.35 hits per line