fix: #652 bugfix session silently timing out

[craigyu]

Description

Switch token refresh from periodic polling to on-demand refresh: refresh the Amplify session only when a request fails with 401, refresh the access token via Amplify, then retry the failed queries — avoiding client-side refresh tokens and eliminating the polling interval.

Previously the app polled Amplify on a timer to refresh tokens. Now the app refreshes the session only when a request fails due to an expired/invalid access token (HTTP 401). The refresh is handled by Amplify's session APIs; after a successful refresh we set the access token cookie for the API client and automatically retry queued queries/mutations. This reduces unnecessary network calls, centralizes refresh logic, and avoids storing refresh tokens in JS-accessible storage.

Summary

• Token refresh is triggered on-demand when a 401 occurs (not on a timer).
• While refresh occurs, failed queries are marked as loading/fetching to avoid UI error states.
• After refresh succeeds, the queued queries/mutations are retried automatically.

Note

This PR include a maintainability update to the backend, the commit was missed from my last PR.

---

Thanks for the PR!

Deployments, as required, will be available below:

• Backend
• Frontend

Please create PRs in draft mode. Mark as ready to enable:

• Analysis Workflow

After merge, new images are deployed in:

• Merge Workflow

---

Thanks for the PR!

Deployments, as required, will be available below:

• Backend
• Frontend

Please create PRs in draft mode. Mark as ready to enable:

• Analysis Workflow

After merge, new images are deployed in:

• Merge Workflow

[Copilot]

Pull Request Overview

This PR refactors authentication and token management from AWS Amplify's cookie-based storage to a cookie-based approach managed by the application. It introduces automatic token refresh handling via TanStack Query's error handling mechanism and adds security hardening to the backend XML processing.

• Introduces CookieUtils for managing authentication tokens via cookies instead of relying on Amplify's internal storage
• Implements token refresh logic in tanstackConfig with automatic retry of failed queries/mutations on 401 errors
• Adds XXE (XML External Entity) protection to TransformerFactory instances in backend XML processing

Reviewed Changes

Copilot reviewed 10 out of 11 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
frontend/src/utils/CookieUtils.ts	New utility module for cookie management (set, get, delete)
frontend/src/services/API.ts	Updates OpenAPI token provider to read from cookies instead of AuthService
frontend/src/contexts/AuthProvider.tsx	Refactored to use cookie storage and simplified session handling without polling
frontend/src/constants/tanstackConfig.ts	Major expansion adding token refresh logic, error handlers, and automatic retry on 401
frontend/src/constants/index.ts	Added ACCESS_TOKEN_KEY constant
frontend/src/__test__/index.test.tsx	Added mocks for QueryCache and MutationCache
frontend/src/__test__/contexts/PreferenceProvider.test.tsx	Minor formatting change to empty function
frontend/src/__test__/contexts/AuthProvider.test.tsx	Updated test mocks to simulate cookie-based token retrieval
frontend/package-lock.json	Removed peer: true markers from various dependencies
backend/src/test/java/.../OpeningSpatialFileServiceTest.java	Removed unused throws Exception from test method
backend/src/main/java/.../OpeningSpatialFileService.java	Added XXE protection to TransformerFactory, pattern matching improvement, and formatting

Files not reviewed (1)

• frontend/package-lock.json: Language not supported

Comments suppressed due to low confidence (1)

frontend/src/constants/tanstackConfig.ts:21

• The value assigned to API_BASE_URL here is unused.

  API_BASE_URL = API_BASE_URL.slice(0, -4);

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.