Org Web Adapter

Editing pages/mmpy_33_implement_jwt_refresh_flow_refresh_token_expired.org

:PROPERTIES:
:ID:       30d2002e-6d62-481f-88eb-fe3546311339
:END:
#+title: MMPY-33 - Implement JWT refresh flow refresh token expired

- source :: https://multimediallc.atlassian.net/browse/MMPY-33
- epic :: [[id:8f037425-a0e2-4777-98a0-5120e229550d][MMPY-264 Release 1 Updates Requried for CB Integration]]
- tags :: [[id:4b532967-a1d9-45f4-b1f0-9a02ad540ff0][Falcon Nest Project Story]] [[id:7c3bbb4e-d079-42c4-992c-3e76210911f4][Falcon Nest Project]]
- sprint ::  [[id:70c22c31-3b17-40b9-b2db-02a5a0b665f4][MM Sprint 24]]  [[id:f1d9f771-9f9b-46f6-b703-058b91afcfca][MM Sprint 25]]
- status ::   [[id:e80c3394-bc94-4dff-9feb-884bdcb04d25][Status - Wont Fix]]

* Tasks
** DONE See if ChatGPT can help build out a solution :integration:work:mmpy33:mmpy264:jwt:refreshflow:auth:bug:
:PROPERTIES:
:ID:       a724e8e1-a1f1-596e-b328-f66f288805f3
:END:
** DONE Pair with Brian to sort this thing out :integration:work:mmpy33:mmpy264:jwt:refreshflow:auth:bug:
:PROPERTIES:
:ID:       c20aeedb-228a-2457-1cb6-a48668d3e544
:END:
** DONE Pitch idea to Helene and Aaron about TTL :integration:work:mmpy33:mmpy264:jwt:refreshflow:auth:bug:
:PROPERTIES:
:ID:       d7f9bff9-3e79-404f-f6fb-e9317920b17d
:END:
** DONE Sort out original flow with message emitting :integration:work:mmpy33:mmpy264:jwt:refreshflow:auth:bug:
:PROPERTIES:
:ID:       e2a16875-6914-73eb-c192-335317de0e8f
:END:

** DONE Try reintegrating Claude's solution for token refresh pop ups :integration:work:mmpy33:mmpy264:jwt:refreshflow:auth:bug:
:PROPERTIES:
:ID:       e034079f-f766-f309-2dd5-001f90069b7f
:END:

* Background

The end user may want to be logged in for more than the 15 minutes of the refresh token.  If the user still has a valid session in the source application, we want to provide a pathway for the user to continue their session in Falcon Talon Payouts

* Requirements
** GIVEN

A user is still active on the site and has a refresh token that is about to
expire (conceptually their access token will expire around the same time)

** WHEN

An API request is made to falcon nest with the expired access tokens

** THEN

- Falcon nest returns a 401 unauthorized

- The workflow below would be confusing for anyone who gets a forbidden
    without hitting an expired token, but in that case we either have 1) a bug
    or 2) a hacker. I am inclined to just code to one path.

- Falcon talon displays a toast message: “Your session to view your payout
  information has expired. Click continue to refresh your page.”
  - On clicking “continue”, reload the <domain>/payoutinfo page
  - We will be going cross-origin, so will need to rely on Window: postMessage() method - Web APIs | MDN postMessage()
  - Our message will be reloaded
  - We should utilize targetOrigin in a configurable way
  - The source application will utilize origin on their end to ensure we are sending the reload message

- Do not hide the toast message

- Later implementation, not as part of this ticket

- If there is a form that is open:
  - When clicking continue: Save the form data in local storage