fix: deduplicate token refresh, serialize concurrent attempts, clean up logout path

webui/static/hoover/websocket.js

@@ -7,7 +7,7 @@
  */
 
 import { refreshByTopic } from './model.js?v=9';
-import { clearAuthTokens } from './api.js?v=12';
+import { tryRefreshToken } from './api.js?v=12';
 
 let _wsConn = null;
 let _wsReconnectMs = 0;
@@ -16,49 +16,6 @@ let _wsFailCount = 0;
 /** Direct onMessage handlers — { topics, handler, unsubscribed }[] */
 const _directHandlers = [];
 
-/**
- * Refresh the access token. On failure, clears all tokens to prevent
- * an infinite reconnection loop with a stale token.
- *
- * @returns {Promise<boolean>} true if token was refreshed
- */
-async function _tryRefreshToken() {
-    const refresh = sessionStorage.getItem('vw:refresh');
-    if (!refresh) return false;
-    try {
-        const res = await fetch('/api/auth/refresh', {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
-            body: JSON.stringify({ refresh_token: refresh }),
-            credentials: 'same-origin',
-        });
-        if (res.status !== 200) {
-            clearAuthTokens();
-            return false;
-        }
-        const json = await res.json();
-        if (!json.ok || !json.data?.tokens) {
-            clearAuthTokens();
-            return false;
-        }
-        const tokens = json.data.tokens;
-        window.__auth_token__ = tokens.access_token;
-        sessionStorage.setItem('vw:refresh', tokens.refresh_token);
-        sessionStorage.setItem('vw:access_ttl', String((json.data.access_ttl || 300) * 1000));
-        if (tokens.session_id) {
-            sessionStorage.setItem('vw:session_id', tokens.session_id);
-        }
-        if (json.data.user) {
-            sessionStorage.setItem('vw:user', JSON.stringify(json.data.user));
-            localStorage.setItem('vw:user', JSON.stringify(json.data.user));
-        }
-        return true;
-    } catch {
-        clearAuthTokens();
-        return false;
-    }
-}
-
 /**
  * Build the WebSocket URL.  Supports an override via `window.__WS_URL__`
  * (useful for proxy setups).  Falls back to port 9091 when the current
@@ -94,17 +51,22 @@ function _wsConnect() {
         _wsFailCount++;
 
         if (_wsFailCount >= 3) {
-            // Attempt token refresh after repeated failures.  No redirect
-            // on failure — the reconnect loop continues.
+            // Attempt token refresh after repeated failures.  The reconnect
+            // is handled inside the IIFE to avoid double-scheduling when
+            // refresh succeeds.
             (async () => {
-                const ok = await _tryRefreshToken();
+                const ok = await tryRefreshToken();
                 if (ok) {
                     _wsFailCount = 0;
                     _wsReconnectMs = 0;
                     _wsConn = null;
                     setTimeout(_wsConnect, 100);
+                } else {
+                    _wsReconnectMs = Math.min(_wsReconnectMs * 2 + 1000, 15000);
+                    setTimeout(_wsConnect, _wsReconnectMs);
                 }
             })();
+            return;
         }
 
         _wsReconnectMs = Math.min(_wsReconnectMs * 2 + 1000, 15000);