fix: Detect and clear stale IndexedDB auth tokens on mobile (#188) #190

New Issue

2026-02-15T03:45:40Z

egullickson commented

2026-02-15 03:45:40 +00:00

Relates to #188

Summary

Fix stale token detection in TokenInjector so that expired IndexedDB tokens don't cause isAuthenticated to be incorrectly true, which prevents loginWithRedirect() from being called.

Problem

Auth0 SDK reads expired tokens from IndexedDB cache and temporarily evaluates isAuthenticated = true. When user taps "Login", handleAuthAction() sees isAuthenticated = true and calls navigate('/garage') instead of loginWithRedirect(). Tokens fail validation, isAuthenticated reverts to false, and user bounces back to homepage.

Changes

File: frontend/src/core/auth/Auth0Provider.tsx
- After isAuthenticated becomes true, validate token is usable via getAccessTokenSilently({ cacheMode: 'off' })
- If validation fails with login_required or consent_required, clear IndexedDB cache and reset Auth0 SDK state
File: frontend/src/core/utils/indexeddb-storage.ts
- Add clearAll() method to clear all cached auth tokens programmatically

Acceptance Criteria

Stale tokens are detected and cleared automatically
After clearing, isAuthenticated correctly reports false
User can then tap Login and reach Auth0 login page

Relates to #188 ## Summary Fix stale token detection in TokenInjector so that expired IndexedDB tokens don't cause `isAuthenticated` to be incorrectly `true`, which prevents `loginWithRedirect()` from being called. ## Problem Auth0 SDK reads expired tokens from IndexedDB cache and temporarily evaluates `isAuthenticated = true`. When user taps "Login", `handleAuthAction()` sees `isAuthenticated = true` and calls `navigate('/garage')` instead of `loginWithRedirect()`. Tokens fail validation, `isAuthenticated` reverts to `false`, and user bounces back to homepage. ## Changes - **File**: `frontend/src/core/auth/Auth0Provider.tsx` - After `isAuthenticated` becomes `true`, validate token is usable via `getAccessTokenSilently({ cacheMode: 'off' })` - If validation fails with `login_required` or `consent_required`, clear IndexedDB cache and reset Auth0 SDK state - **File**: `frontend/src/core/utils/indexeddb-storage.ts` - Add `clearAll()` method to clear all cached auth tokens programmatically ## Acceptance Criteria - [ ] Stale tokens are detected and cleared automatically - [ ] After clearing, `isAuthenticated` correctly reports `false` - [ ] User can then tap Login and reach Auth0 login page

egullickson added the

labels 2026-02-15 03:45:52 +00:00

egullickson referenced this issue

2026-02-15 03:46:21 +00:00

fix: Mobile login redirects to homepage without showing Auth0 login page #188

egullickson referenced this issue from a commit

2026-02-15 03:57:53 +00:00

fix: detect and clear stale IndexedDB auth tokens (refs #190)