27 lines
1.0 KiB
Markdown
27 lines
1.0 KiB
Markdown
# ADR-0002: Implement Browser Auth and the Root File Workflow
|
|
|
|
Status: Accepted
|
|
Date: 2026-07-14
|
|
|
|
## Context
|
|
|
|
The first Web milestone needed an authenticated workflow over the existing login, file listing, upload, and download APIs.
|
|
|
|
## Decision
|
|
|
|
- Use same-origin `/api/v1` requests.
|
|
- Store the access and refresh token pair in `sessionStorage`.
|
|
- Coordinate one refresh request across concurrent `401` responses.
|
|
- Retry each failed protected request once after refresh.
|
|
- Clear the session when refresh or the retry fails.
|
|
- List root entries and upload one file at a time to the root directory.
|
|
- Download authenticated file responses as browser blobs.
|
|
|
|
## Consequences
|
|
|
|
- Reloading the tab preserves the session; closing the tab clears it.
|
|
- Query caches clear when the authenticated session ends.
|
|
- Directories appear as non-interactive root rows in the first milestone.
|
|
- Handwritten wire types remain until a shared OpenAPI contract is available.
|
|
- Directory management and large-transfer workflows require later feature decisions.
|