chore: improve authentication handling #2398
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
digitalcora
force-pushed
the
cfg-auth-updates
branch
from
bf9bd21 to
ce19334
Compare
digitalcora
force-pushed
the
cfg-auth-updates
branch
from
ce19334 to
03a3e58
Compare
digitalcora
force-pushed
the
cfg-auth-updates
branch
from
03a3e58 to
dc233a5
Compare
digitalcora
force-pushed
the
cfg-auth-updates
branch
from
dc233a5 to
c0a8215
Compare
digitalcora
force-pushed
the
cfg-auth-updates
branch
from
c0a8215 to
70866e3
Compare
digitalcora
force-pushed
the
cfg-auth-updates
branch
from
70866e3 to
ae5255a
Compare
digitalcora
force-pushed
the
cfg-auth-updates
branch
2 times, most recently
from
ccca90d to
68b6378
Compare
digitalcora
force-pushed
the
cfg-auth-updates
branch
2 times, most recently
from
409930c to
edc3cb1
Compare
panentheos
approved these changes
Jan 24, 2025
Using the admin UI was previously plagued by auth errors that would occur after just a few minutes of idle time and required refreshing the page, losing any work in progress. These changes should improve how we handle authentication, allowing an admin to be idle for up to 30 minutes and signed in for up to 12 hours before needing to reauthenticate, following the TID Session Management guidelines and the prior art of mbta/screenplay#520. This also revises and unifies how data fetching works in the admin UI, to allow showing admins a message indicating their session has expired when that happens (regardless of the interaction), rather than a generic error message. In support of the above feature being able to distinguish HTML page requests from API requests, this _also_ disentangles some pipelines in the router where some API endpoints were piped through both "browser" and "api", causing their format to be improperly set as HTML.
digitalcora
force-pushed
the
cfg-auth-updates
branch
from
edc3cb1 to
fbd91d8
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Using the admin UI was previously plagued by auth errors that would occur after just a few minutes of idle time and required refreshing the page, losing any work in progress.
These changes should improve how we handle authentication, allowing an admin to be idle for up to 30 minutes and signed in for up to 12 hours before needing to reauthenticate, following the TID Session Management guidelines and the prior art of mbta/screenplay#520.
This also revises and unifies how data fetching works in the admin UI, to allow showing admins a message indicating their session has expired when that happens (regardless of the interaction), rather than a generic error message.
In support of the above feature being able to distinguish HTML page requests from API requests, this also disentangles some pipelines in the router where some API endpoints were piped through both "browser" and "api", causing their format to be improperly set as HTML.
Asana task: https://app.asana.com/0/0/1209132981413564