mygo/docs/web/decisions/0002-browser-auth-root-files.md

ADR-0002: Implement Browser Auth and the Root File Workflow

Status: Accepted
Date: 2026-07-14

Context

The first Web milestone needed an authenticated workflow over the existing login, file listing, upload, and download APIs.

Decision

• Use same-origin /api/v1 requests.
• Store the access and refresh token pair in sessionStorage.
• Coordinate one refresh request across concurrent 401 responses.
• Retry each failed protected request once after refresh.
• Clear the session when refresh or the retry fails.
• List root entries and upload one file at a time to the root directory.
• Download authenticated file responses as browser blobs.

Consequences

• Reloading the tab preserves the session; closing the tab clears it.
• Query caches clear when the authenticated session ends.
• Directories appear as non-interactive root rows in the first milestone.
• Handwritten wire types remain until a shared OpenAPI contract is available.
• Directory management and large-transfer workflows require later feature decisions.