# ADR-0002: Implement Browser Auth and the Root File Workflow

Status: Accepted  
Date: 2026-07-14

## Context

The first Web milestone needed an authenticated workflow over the existing login, file listing, upload, and download APIs.

## Decision

- Use same-origin `/api/v1` requests.
- Store the access and refresh token pair in `sessionStorage`.
- Coordinate one refresh request across concurrent `401` responses.
- Retry each failed protected request once after refresh.
- Clear the session when refresh or the retry fails.
- List root entries and upload one file at a time to the root directory.
- Download authenticated file responses as browser blobs.

## Consequences

- Reloading the tab preserves the session; closing the tab clears it.
- Query caches clear when the authenticated session ends.
- Directories appear as non-interactive root rows in the first milestone.
- Handwritten wire types remain until a shared OpenAPI contract is available.
- Directory management and large-transfer workflows require later feature decisions.