Authentication: Connect login and implement secure session restoration #7

Objective

Connect the Sign In screen to an authentication service and securely restore the user’s session after the app restarts.

Confirmed backend contract

Login endpoint:

POST /auth/login

JSON request body:

{
  "username": "example",
  "password": "example"
}

Successful response:

{
  "token": "..."
}

Session validation endpoint:

POST /auth/validate

Required header:

Authorization: Bearer <token>

The backend currently has no refresh-token or server-side logout system. Logout is performed by deleting the token locally.

Required work

Token storage

• Create a TokenStore interface.
• Implement it using Expo SecureStore.
• Store only the JWT.
• Never store the password.
• Support reading, writing, and deleting the token.
• Provide a fake TokenStore for tests.

Authentication gateway

Create an AuthGateway interface supporting:

• Login.
• Token validation.
• Local logout and cleanup.

Use a fake gateway while the shared API client is being completed. Connect the production gateway to the shared API client before finishing this issue.

Session lifecycle

Support these session states:

• Bootstrapping or restoring.
• Anonymous.
• Authenticated.
• Expired.
• Recoverable connection error.

When the app launches:

1. Read the saved token.
2. If there is no token, show Sign In.
3. If a token exists, call /auth/validate.
4. Restore the session when valid.
5. Delete the token and return to Sign In when expired or invalid.
6. Show a retry option for a temporary connection failure.

Sign In screen

• Connect the primary Sign In button.
• Require a non-empty username and password.
• Disable repeated submissions while loading.
• Show a loading indicator.
• Show a safe invalid-credentials message.
• Show a safe connection-error message.
• Do not display raw backend errors.
• Keep quick-login buttons development-only if they remain necessary.

Sign Out

Sign Out must:

• Delete the saved token.
• Clear the authenticated user.
• Clear user-specific query caches.
• Return to the public Sign In flow.
• Prevent Back navigation into protected screens.

Tests

• Successful login stores the token.
• Invalid credentials show an error.
• Blank fields are rejected.
• Connection failure shows a retryable error.
• A stored valid token restores the session.
• An expired token is deleted.
• A validation connection failure does not immediately destroy a potentially valid token.
• Sign Out deletes the token.
• Sign Out clears private cached data.
• The password is never stored.
• Protected screens cannot be reopened after Sign Out.

Acceptance criteria

• The primary Sign In button performs an authentication action.
• Session logic is separated from the screen.
• SecureStore is accessed through the TokenStore interface.
• The implementation can be tested without a staging server.
• All required project checks pass.

Required checks

• npm run format:check
• npm run lint
• npm run typecheck
• npm test -- --runInBand

Non-goals

• Do not implement account creation.
• Do not implement Forgot Password.
• Do not implement refresh tokens.
• Do not store passwords.
• Do not trust decoded JWT contents without backend validation.