Janady13/missionmatch / frontend/src/lib/AuthContext.tsx

Source identity

Field	Recorded value
Source type	GitHub source
Original record	Janady13/missionmatch / frontend/src/lib/AuthContext.tsx
Date	Not specified in source
Repository	Janady13/missionmatch
Revision	2178e7298d0e5d9af83afa12402fd587f0ba6ed8
Branch	feature/aioe-upgrade
Path or archive member	frontend/src/lib/AuthContext.tsx
Original SHA-256	2e987292080d0d25e1586ac0f2816cb553ab4c00446e45e0ea19cc1427eeb9dc
Git blob SHA	ee015da3dc1bf011fa10177a53000da840b9f2f6
Reading-copy SHA-256	2e987292080d0d25e1586ac0f2816cb553ab4c00446e45e0ea19cc1427eeb9dc

Original source ↗

Recovered source transcript

Download complete source text ↓78 lines · 3.8 KB

import { useCallback, useEffect, useState, type ReactNode } from 'react'
import { useQueryClient } from '@tanstack/react-query'
import { authApi, type SessionPrincipal } from './auth'
import { AuthContext } from './useAuth'

// AuthProvider holds the validated session principal. On mount it asks GET /api/auth/session: a 200
// means an active MFA satisfied session (show the app), a 403 means none (show the login). refresh is
// called after a successful login or MFA step to flip the gate. The context object and the useAuth
// hook live in useAuth.ts so this file exports only a component (React Fast Refresh boundary).
export function AuthProvider({ children }: { children: ReactNode }) {
  const [principal, setPrincipal] = useState<SessionPrincipal | null>(null)
  const [loading, setLoading] = useState(true)
  const qc = useQueryClient()

  // The query cache is keyed by resource, never by user or organization: ['candidates'], ['people'],
  // ['org','branding']. That is fine while one person is signed in and a cross tenant disclosure the
  // moment a second one is, because the QueryClient is a module singleton that outlives the session and
  // carries a 30 second staleTime. Signing out and signing in as someone else in the same tab rendered
  // the PREVIOUS account's candidates, client list and org branding from cache, and inside the stale
  // window did not even refetch.
  //
  // Clearing on BOTH boundaries is deliberate. On logout, so nothing survives for the next person at this
  // browser. On login, because a session can also change without a logout: an expired cookie, a session
  // revoked by an admin, or a different account authenticating against a tab that still holds the old
  // cache. Clearing only on logout leaves the path that skips it wide open.
  //
  // clear() rather than invalidateQueries(): invalidate marks data stale but KEEPS it, so it is still
  // returned to the next render while the refetch is in flight. For tenant data the old rows must be
  // gone, not merely refreshed.
  const clearTenantCache = useCallback(() => {
    qc.clear()
    qc.removeQueries()
  }, [qc])

  const refresh = useCallback(async () => {
    try {
      const next = await authApi.session()
      setPrincipal((prev) => {
        // Only wipe when the identity actually changes. A routine refresh for the same user must not
        // discard a warm cache, or every MFA step and every window focus would refetch the whole app.
        if (prev && (prev.user_id !== next.user_id || prev.org_id !== next.org_id)) {
          clearTenantCache()
        }
        return next
      })
    } catch {
      // Losing the session counts as an identity change. Without this the expiry path drops the principal
      // but keeps the cache, so the NEXT sign in sees a null previous identity, skips the comparison
      // above, and inherits the departed user's data anyway. That is the same leak reached by a different
      // route, and it is the likelier one in practice: sessions expire far more often than people log out.
      setPrincipal((prev) => {
        if (prev) clearTenantCache()
        return null
      })
    } finally {
      setLoading(false)
    }
  }, [clearTenantCache])

  const logout = useCallback(async () => {
    try {
      await authApi.logout()
    } catch {
      // The cookie is cleared server side on success; on any error we still drop local state.
    }
    setPrincipal(null)
    // After local state, so nothing can re render against a cleared cache while still believing it is
    // signed in and repopulate it from a query that has not yet been told the session is gone.
    clearTenantCache()
  }, [clearTenantCache])

  useEffect(() => {
    void refresh()
  }, [refresh])

  return <AuthContext.Provider value={{ principal, loading, refresh, logout }}>{children}</AuthContext.Provider>
}