Giancarmine SalucciandClaude Opus 4.8
d89296abe5
Build and publish docker image / Build and push image to Gitea's registry (push) Successful in 41s
Sessions silently dropped ~15-30 min after login on the deployed instance. Two compounding bugs in hooks.server.ts: - The refresh path was gated behind `if (accessToken)`, but the access cookie's maxAge (15m) equals the JWT TTL, so the browser deletes the cookie exactly when the JWT expires. Subsequent requests arrived with no access cookie and skipped refresh entirely -> logout. Rotation now keys off the `refresh` cookie (30d) instead of an expired access token. - The old code revoked the refresh token without issuing a new `refresh` cookie (it assumed /api/auth/refresh handled rotation, but nothing calls it). Now does a full one-time-use rotation: revoke + new access + new refresh cookie -> sliding 30d session. Also adopt the SvelteKit PWA proactive auto-refresh standard: the worker already does skipWaiting()+clients.claim(); add watchSwUpdates() in the root layout to call registration.update() on load/focus/reconnect/hourly and reload once on controllerchange (guarded against first-install reload). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>