Aakash - Auto log out user when session ends

[aakashg00]

Closes #80
When a user's session ends, they're shown an unclosable alert dialog asking them to log out. We recheck the session status every time the window is focused on.

Video Demo:

Screen.Recording.2026-03-31.at.1.35.29.PM.mov

As a logged in user, I delete the JWT in dev tools to simulate the session ending, and the alert dialog shows up.

[netlify]

✅ Deploy Preview for juno-dashboard ready!

Name	Link
🔨 Latest commit	41cca31
🔍 Latest deploy log	https://app.netlify.com/projects/juno-dashboard/deploys/69d5886231e3cc0008232a81
😎 Deploy Preview	https://deploy-preview-82--juno-dashboard.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[greptile-apps]

Greptile Summary

This PR implements automatic session expiry detection and enforced logout for the Juno Dashboard. When a user's JWT expires, the next window focus event triggers a background check against /api/user; a 401 response opens an unclosable AlertDialog prompting the user to log out. The PR also fixes a pre-existing bug in user-dropdown.tsx where logout incorrectly redirected to /admin instead of /login.

Key changes:

• SessionProvider.tsx: Adds a window focus listener that re-validates the session via /api/user, showing a controlled AlertDialog on 401. The dialog is intentionally unclosable (no onOpenChange handler on the controlled open prop) to lock the user into the logout flow.
• alert-dialog.tsx: New shadcn/ui-style Radix UI wrapper, consistent with the existing dialog.tsx pattern.
• user-dropdown.tsx: Corrects the logout redirect from /admin → /login and adds router.refresh() to flush the Next.js router cache.

Areas needing improvement:

• No debounce on the focus listener — rapid tab switching fires multiple concurrent /api/user requests.
• No error feedback in the logOut function if deleteJWT() fails; the button silently re-enables.
• logOut logic (delete JWT → replace route → refresh) is now duplicated between SessionProvider and user-dropdown; a shared hook would help.

PR Checklist score: 82/100

• ✅ Files placed in appropriate folders
• ✅ Uses async/await and try/catch correctly
• ✅ No hardcoded colors — uses Tailwind config
• ⚠️ Functions not fully modularised: logOut is duplicated between two files.
• ⚠️ Error responses from API calls not fully handled (silent failure path in logOut).

Confidence Score: 5/5

Safe to merge — all remaining findings are P2 style/improvement suggestions with no correctness or data-integrity impact.

The core session-expiry detection and enforced logout flow is logically correct. The middleware already guards initial navigation, the focus listener correctly handles the mid-session expiry case, and finally ensures loading is always reset. All three inline comments are P2 (debounce, error feedback, deduplication) — none block correct behavior in the happy path or introduce data loss.

src/components/providers/SessionProvider.tsx — focus listener debouncing and error feedback for the logOut function.

Important Files Changed

Filename	Overview
src/components/providers/SessionProvider.tsx	Adds session-expiry detection via /api/user polled on window focus, showing an unclosable AlertDialog on 401. Logic is correct; minor concerns around unbounded concurrent focus fetches, silent logout failure, and duplicated logOut logic with user-dropdown.
src/components/ui/alert-dialog.tsx	Standard shadcn/ui AlertDialog wrapper using Radix UI primitives. Consistent with the existing dialog.tsx pattern in the project. No issues found.
src/components/user-dropdown.tsx	Fixes the logout redirect from the incorrect /admin to /login, and adds router.refresh() to invalidate the Next.js cache. Clean fix.

Sequence Diagram

sequenceDiagram
    participant Browser
    participant SessionProvider
    participant API as /api/user
    participant Middleware
    participant LoginPage

    Note over Browser,SessionProvider: Initial load (JWT valid)
    Browser->>SessionProvider: mount
    SessionProvider->>API: GET /api/user (no-store)
    API-->>SessionProvider: 200 { user }
    SessionProvider->>SessionProvider: setUser(user), setLoading(false)

    Note over Browser,SessionProvider: JWT expires mid-session
    Browser->>SessionProvider: window "focus" event
    SessionProvider->>API: GET /api/user (no-store)
    API-->>SessionProvider: 401
    SessionProvider->>SessionProvider: setUser(null), setIsSessionExpiredOpen(true)
    SessionProvider->>Browser: Render unclosable AlertDialog

    Note over Browser,SessionProvider: User clicks Log out
    Browser->>SessionProvider: onClick → logOut()
    SessionProvider->>SessionProvider: setIsLoggingOut(true)
    SessionProvider->>SessionProvider: deleteJWT() clears jwt-token cookie
    SessionProvider->>Browser: router.replace("/login") + router.refresh()
    Browser->>Middleware: GET /login
    Middleware-->>LoginPage: render login page
    SessionProvider->>SessionProvider: unmount (different layout group)

Loading

_{Reviews (1): Last reviewed commit: "added logout alert dialog when session i..." | Re-trigger Greptile}