Fix false session-expired errors on admin books load.

Handle HF cold-start and multi-tab refresh races without clearing tokens, fail-open Redis on refresh blacklist check, and redirect to login instead of inline books error.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/admin/templates/admin.html

@@ -1597,11 +1597,25 @@
 <script>
 /* ── GLOBALS ── */
 const API = window.location.origin + '/api';
+
+function handleSessionExpired() {
+  token = null;
+  authorSlug = null;
+  document.getElementById('auth-screen').style.display = '';
+  document.getElementById('dashboard').style.display = 'none';
+  const msg = document.getElementById('login-msg');
+  if (msg) {
+    msg.textContent = 'Your session expired. Please sign in again.';
+    msg.style.color = 'var(--red)';
+  }
+}
+
 const auth = new AuthorBotAuthClient({
   apiBase: API,
   accessKey: 'access_token',
   refreshKey: 'refresh_token',
   slugKey: 'author_slug',
+  onSessionExpired: handleSessionExpired,
 });
 let token = auth.getAccessToken();
 let authorSlug = auth.getAuthorSlug();
@@ -1851,7 +1865,14 @@ async function loadBooks() {
     const data = await apiGet(`/admin/${authorSlug}/books`);
     allBooks = data.books || [];
     renderBooks(allBooks);
-  } catch(e) { tbody.innerHTML = `<tr><td colspan="7" style="color:var(--red);text-align:center;padding:40px;"><div style="font-size:32px;margin-bottom:12px;">⚠️</div>Failed to load books<div style="font-size:12px;color:var(--light);margin-top:6px;">${e.message}</div></td></tr>`; }
+  } catch(e) {
+    if (e.message.includes('Session expired')) return;
+    if (e.message.includes('Cannot reach server')) {
+      tbody.innerHTML = `<tr><td colspan="7" style="color:var(--amber);text-align:center;padding:40px;"><div style="font-size:32px;margin-bottom:12px;">⏳</div>Server is waking up<div style="font-size:12px;color:var(--light);margin-top:6px;">${e.message}</div></td></tr>`;
+      return;
+    }
+    tbody.innerHTML = `<tr><td colspan="7" style="color:var(--red);text-align:center;padding:40px;"><div style="font-size:32px;margin-bottom:12px;">⚠️</div>Failed to load books<div style="font-size:12px;color:var(--light);margin-top:6px;">${e.message}</div></td></tr>`;
+  }
 }
 function renderBooks(books) {
   const tbody = document.getElementById('books-body');

app/api/schemas_router.py

@@ -90,8 +90,14 @@ async def refresh(
         if refresh_payload.get("type") != "refresh":
             raise HTTPException(401, "Not a refresh token")
         refresh_jti = refresh_payload.get("jti")
-        if refresh_jti and await is_blacklisted(redis, refresh_jti):
-            raise HTTPException(401, "Refresh token has been revoked")
+        if refresh_jti:
+            try:
+                if await is_blacklisted(redis, refresh_jti):
+                    raise HTTPException(401, "Refresh token has been revoked")
+            except HTTPException:
+                raise
+            except Exception:
+                pass  # Redis down: fail-open (same as access-token blacklist check)
     except HTTPException:
         raise
     except Exception:

static/auth-client.js

@@ -32,7 +32,16 @@
     this.accessKey = options.accessKey || 'access_token';
     this.refreshKey = options.refreshKey || 'refresh_token';
     this.slugKey = options.slugKey || null;
+    this.onSessionExpired = options.onSessionExpired || null;
     this._refreshing = null;
+    var self = this;
+    if (typeof window !== 'undefined') {
+      window.addEventListener('storage', function (e) {
+        if (e.key === self.accessKey || e.key === self.refreshKey) {
+          self._refreshing = null;
+        }
+      });
+    }
   }
 
   AuthClient.prototype.getAccessToken = function () {
@@ -59,31 +68,67 @@
     if (this.slugKey) localStorage.removeItem(this.slugKey);
   };
 
+  AuthClient.prototype._notifySessionExpired = function () {
+    if (typeof this.onSessionExpired === 'function') {
+      try { this.onSessionExpired(); } catch (e) { /* ignore */ }
+    }
+  };
+
+  AuthClient.prototype._hasValidAccessInStorage = function () {
+    return !!this.getAccessToken() && !isAccessTokenExpired(this.getAccessToken());
+  };
+
+  AuthClient.prototype._sessionGone = function () {
+    this.clearSession();
+    this._notifySessionExpired();
+    throw new Error('Session expired — please sign in again');
+  };
+
+  AuthClient.prototype._transientAuthFailure = function () {
+    if (this.getRefreshToken()) {
+      throw new Error('Cannot reach server. Your session is still active — try again shortly.');
+    }
+    return this._sessionGone();
+  };
+
   AuthClient.prototype.hasSession = function () {
     return !!(this.getAccessToken() || this.getRefreshToken());
   };
 
-  AuthClient.prototype.refreshAccessToken = function () {
+  AuthClient.prototype.refreshAccessToken = function (opts) {
     var self = this;
+    opts = opts || {};
     if (this._refreshing) return this._refreshing;
 
-    var refresh = this.getRefreshToken();
+    var refresh = opts.refreshToken || this.getRefreshToken();
     if (!refresh) return Promise.resolve(false);
+
+    var access = this.getAccessToken();
+    var headers = { 'Content-Type': 'application/json' };
+    if (access) headers.Authorization = 'Bearer ' + access;
     var body = JSON.stringify({ refresh_token: refresh });
 
     this._refreshing = fetch(this.apiBase + '/auth/refresh', Object.assign({}, FETCH_OPTS, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: headers,
       body: body,
     }))
       .then(function (res) {
-        // Only clear session on explicit auth rejection (401/403).
-        // 5xx / network errors = server cold-starting — keep tokens and retry later.
         if (res.status === 401 || res.status === 403) {
+          if (!opts.storageRetry) {
+            var latestRefresh = localStorage.getItem(self.refreshKey);
+            var latestAccess = localStorage.getItem(self.accessKey);
+            if (latestRefresh && latestRefresh !== refresh) {
+              return self.refreshAccessToken({ refreshToken: latestRefresh, storageRetry: true });
+            }
+            if (latestAccess && latestAccess !== access && !isAccessTokenExpired(latestAccess)) {
+              return true;
+            }
+          }
           self.clearSession();
           return false;
         }
-        if (!res.ok) return false;   // 5xx etc — keep tokens, return false
+        if (!res.ok) return false;
         return res.json();
       })
       .then(function (data) {
@@ -174,8 +219,13 @@
 
     return this.ensureValidAccessToken().then(function (ok) {
       if (!ok) {
-        self.clearSession();
-        throw new Error('Session expired — please sign in again');
+        if (self._hasValidAccessInStorage()) {
+          return;
+        }
+        if (!self.getRefreshToken()) {
+          return self._sessionGone();
+        }
+        return self._transientAuthFailure();
       }
 
       var token = self.getAccessToken();
@@ -195,8 +245,13 @@
           if (res.status === 401 && !retried) {
             return self.refreshAccessToken().then(function (refreshed) {
               if (!refreshed) {
-                self.clearSession();
-                throw new Error('Session expired — please sign in again');
+                if (self._hasValidAccessInStorage()) {
+                  return self.request(method, path, body, true);
+                }
+                if (!self.getRefreshToken()) {
+                  return self._sessionGone();
+                }
+                return self._transientAuthFailure();
               }
               return self.request(method, path, body, true);
             });
@@ -244,8 +299,13 @@
 
     return this.ensureValidAccessToken().then(function (ok) {
       if (!ok) {
-        self.clearSession();
-        throw new Error('Session expired — please sign in again');
+        if (self._hasValidAccessInStorage()) {
+          return;
+        }
+        if (!self.getRefreshToken()) {
+          return self._sessionGone();
+        }
+        return self._transientAuthFailure();
       }
 
       var token = self.getAccessToken();
@@ -261,8 +321,13 @@
           if (res.status === 401 && !retried) {
             return self.refreshAccessToken().then(function (refreshed) {
               if (!refreshed) {
-                self.clearSession();
-                throw new Error('Session expired — please sign in again');
+                if (self._hasValidAccessInStorage()) {
+                  return self.upload(path, formData, true);
+                }
+                if (!self.getRefreshToken()) {
+                  return self._sessionGone();
+                }
+                return self._transientAuthFailure();
               }
               return self.upload(path, formData, true);
             });
@@ -277,8 +342,13 @@
 
     return this.ensureValidAccessToken().then(function (ok) {
       if (!ok) {
-        self.clearSession();
-        throw new Error('Session expired — please sign in again');
+        if (self._hasValidAccessInStorage()) {
+          return;
+        }
+        if (!self.getRefreshToken()) {
+          return self._sessionGone();
+        }
+        return self._transientAuthFailure();
       }
 
       var token = self.getAccessToken();
@@ -292,8 +362,13 @@
           if (res.status === 401 && !retried) {
             return self.refreshAccessToken().then(function (refreshed) {
               if (!refreshed) {
-                self.clearSession();
-                throw new Error('Session expired — please sign in again');
+                if (self._hasValidAccessInStorage()) {
+                  return self.download(path, true);
+                }
+                if (!self.getRefreshToken()) {
+                  return self._sessionGone();
+                }
+                return self._transientAuthFailure();
               }
               return self.download(path, true);
             });