handle session

src/lib/state/auth.svelte.ts

@@ -2,10 +2,12 @@ import { SvelteURL, SvelteURLSearchParams } from 'svelte/reactivity';
 import type { HFUser } from '$lib/helpers/types';
 
 const AUTH_STORAGE_KEY = 'hf_auth';
+const SESSION_MAX_AGE_MS = 29 * 24 * 60 * 60 * 1000; // 29 days
 
 interface AuthData {
 	token: string;
 	user: HFUser;
+	createdAt: number;
 }
 
 export const authState = $state<{ user: HFUser | null; token: string | null; loading: boolean }>({
@@ -20,6 +22,13 @@ export async function initAuth() {
 		const stored = localStorage.getItem(AUTH_STORAGE_KEY);
 		if (stored) {
 			const data: AuthData = JSON.parse(stored);
+
+			// Clear session if older than 29 days
+			if (!data.createdAt || Date.now() - data.createdAt > SESSION_MAX_AGE_MS) {
+				localStorage.removeItem(AUTH_STORAGE_KEY);
+				return;
+			}
+
 			authState.user = data.user;
 			authState.token = data.token;
 		}
@@ -37,7 +46,8 @@ export function handleAuthCallback(): boolean {
 	if (!authCallback) return false;
 
 	try {
-		const data: AuthData = JSON.parse(decodeURIComponent(authCallback));
+		const decoded = JSON.parse(decodeURIComponent(authCallback));
+		const data: AuthData = { ...decoded, createdAt: Date.now() };
 		authState.user = data.user;
 		authState.token = data.token;
 		localStorage.setItem(AUTH_STORAGE_KEY, JSON.stringify(data));

src/routes/api/auth/refresh/+server.ts

@@ -0,0 +1,46 @@
+import { json, type RequestEvent } from '@sveltejs/kit';
+import { env } from '$env/dynamic/private';
+
+export async function POST({ request }: RequestEvent) {
+	const { refreshToken } = await request.json();
+
+	if (!refreshToken) {
+		return json({ error: 'Missing refresh token' }, { status: 400 });
+	}
+
+	const clientId = env.HF_CLIENT_ID;
+	const clientSecret = env.HF_CLIENT_SECRET;
+
+	if (!clientId || !clientSecret) {
+		return json({ error: 'Missing OAuth configuration' }, { status: 500 });
+	}
+
+	// Exchange refresh token for a new access token
+	const tokenResponse = await fetch('https://huggingface.co/oauth/token', {
+		method: 'POST',
+		headers: {
+			'Content-Type': 'application/x-www-form-urlencoded'
+		},
+		body: new URLSearchParams({
+			client_id: clientId,
+			client_secret: clientSecret,
+			grant_type: 'refresh_token',
+			refresh_token: refreshToken
+		})
+	});
+
+	if (!tokenResponse.ok) {
+		const error = await tokenResponse.text();
+		console.error('Token refresh failed:', error);
+		return json({ error: 'Token refresh failed' }, { status: 401 });
+	}
+
+	const tokenData = await tokenResponse.json();
+	const expiresAt = tokenData.expires_in ? Date.now() + tokenData.expires_in * 1000 : null;
+
+	return json({
+		token: tokenData.access_token,
+		refreshToken: tokenData.refresh_token ?? refreshToken,
+		expiresAt
+	});
+}