mars3142
de22b895a6
Settings → Account & access gets a real API Tokens section (list, create with a scope picker limited to what the session itself holds, one-time reveal, revoke) calling findr-api's new /v1/tokens - the first real HTTP calls from findr-web to findr-api, everything else is still mock data. Three things had to happen for that to actually work rather than 401 immediately or after a few minutes: - auth.ts requested only "openid profile email" at sign-in, so the access token never carried the findr:* scopes findr-api checks - now requests all of them (src/lib/scopes.ts). - OIDC access tokens are short-lived (minutes); nothing refreshed them, so every findr-api call would start failing well before the session cookie itself expired. auth.ts's jwt() callback now refreshes via the standard refresh_token grant, endpoint from discovery rather than a hardcoded path. - event.locals.auth() runs at least twice per request (hooks + +layout.server.ts) and each call re-signs the session token - two uncached calls in one request would each try to redeem the same refresh_token once it's expired, and Keycloak rotates those, so the second would fail. hooks.server.ts now memoizes it per request. routes/logout and the new refresh logic share one OIDC discovery helper (/server/oidc-discovery.ts) instead of each hardcoding endpoint paths. Verified end-to-end: sign out and back in to pick up the new scopes, create a token (persisted in Postgres, subject = real OIDC sub), revoke it, confirm both in the UI and the database. Signed-off-by: Peter Siegmund <mars3142@noreply.mars3142.dev>