ID

30d2002e-6d62-481f-88eb-fe3546311339

MMPY-33 - Implement JWT refresh flow refresh token expired

- source :: https://multimediallc.atlassian.net/browse/MMPY-33

- epic :: MMPY-264 Release 1 Updates Requried for CB Integration

- tags :: Falcon Nest Project Story Falcon Nest Project

- sprint :: MM Sprint 24 MM Sprint 25

- status :: Status - Wont Fix

Tasks

DONE See if ChatGPT can help build out a solution

ID

a724e8e1-a1f1-596e-b328-f66f288805f3

DONE Pair with Brian to sort this thing out

ID

c20aeedb-228a-2457-1cb6-a48668d3e544

DONE Pitch idea to Helene and Aaron about TTL

ID

d7f9bff9-3e79-404f-f6fb-e9317920b17d

DONE Sort out original flow with message emitting

ID

e2a16875-6914-73eb-c192-335317de0e8f

DONE Try reintegrating Claude's solution for token refresh pop ups

ID

e034079f-f766-f309-2dd5-001f90069b7f

Background

The end user may want to be logged in for more than the 15 minutes of the refresh token. If the user still has a valid session in the source application, we want to provide a pathway for the user to continue their session in Falcon Talon Payouts

Requirements

GIVEN

A user is still active on the site and has a refresh token that is about to

expire (conceptually their access token will expire around the same time)

WHEN

An API request is made to falcon nest with the expired access tokens

THEN

- Falcon nest returns a 401 unauthorized

- The workflow below would be confusing for anyone who gets a forbidden

without hitting an expired token, but in that case we either have 1) a bug

or 2) a hacker. I am inclined to just code to one path.

- Falcon talon displays a toast message: “Your session to view your payout

information has expired. Click continue to refresh your page.”

- On clicking “continue”, reload the <domain>/payoutinfo page

- We will be going cross-origin, so will need to rely on Window: postMessage() method - Web APIs | MDN postMessage()

- Our message will be reloaded

- We should utilize targetOrigin in a configurable way

- The source application will utilize origin on their end to ensure we are sending the reload message

- Do not hide the toast message

- Later implementation, not as part of this ticket

- If there is a form that is open:

- When clicking continue: Save the form data in local storage