Skip to content

Sign clients out reactively when their session is revoked - #761

Open
dowski wants to merge 1 commit into
rebootfrom
dowski/auth-state-client
Open

Sign clients out reactively when their session is revoked#761
dowski wants to merge 1 commit into
rebootfrom
dowski/auth-state-client

Conversation

@dowski

@dowski dowski commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

This happens via anAuthStateWatcher rendered inside
ConvexProviderWithAuth.

When isAuthenticated flips to false, the client signs itself out
instead of staying signed in until the token expires.

@dowski dowski mentioned this pull request Oct 20, 2026
Merged
@vercel

vercel Bot commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
auth-v2 Ready Ready Preview Oct 28, 2026 2:22pm UTC
1 Skipped Deployment
Project Deployment Actions Updated
convex-auth-docs Ignored Ignored Oct 28, 2026 2:22pm UTC

Request Review

This was referenced Oct 20, 2026
Merged
Merged
@dowski Graphite App

dowski commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator Author

This stack of pull requests is managed by Graphite. Learn more about stacking.

@dowski dowski mentioned this pull request Oct 20, 2026
Merged
@dowski
dowski force-pushed the dowski/auth-state-client branch from 70f33a2 to d52bd1d Compare October 20, 2026 15:33
@dowski
dowski force-pushed the dowski/auth-state-server branch from c251843 to b9adb4c Compare October 20, 2026 15:33
@dowski
dowski force-pushed the dowski/auth-state-client branch from d52bd1d to 30431c3 Compare October 20, 2026 15:46
@dowski
dowski force-pushed the dowski/auth-state-server branch from b9adb4c to 584af24 Compare October 20, 2026 15:46
@dowski
dowski force-pushed the dowski/auth-state-client branch from 30431c3 to 47e27c2 Compare October 20, 2026 16:19
@dowski
dowski force-pushed the dowski/auth-state-server branch from 584af24 to caf47c7 Compare October 20, 2026 16:19
@dowski
dowski force-pushed the dowski/auth-state-client branch from 47e27c2 to f9ddec1 Compare October 21, 2026 14:16
@dowski
dowski force-pushed the dowski/auth-state-server branch from caf47c7 to 6638742 Compare October 21, 2026 14:16
@dowski
dowski force-pushed the dowski/auth-state-client branch from f9ddec1 to 3cbdf64 Compare October 21, 2026 14:23
@dowski
dowski force-pushed the dowski/auth-state-server branch from 6638742 to 09a7584 Compare October 21, 2026 14:23
@dowski
dowski force-pushed the dowski/auth-state-client branch from 3cbdf64 to 151b554 Compare October 21, 2026 16:39
@dowski
dowski force-pushed the dowski/auth-state-server branch from 09a7584 to f7ba3a5 Compare October 21, 2026 16:39
@dowski
dowski force-pushed the dowski/auth-state-server branch from f7ba3a5 to e6411e9 Compare October 21, 2026 19:50
@dowski
dowski force-pushed the dowski/auth-state-client branch from 151b554 to 5c9b6df Compare October 21, 2026 19:50
@pkg-pr-new

pkg-pr-new Bot commented Oct 21, 2026 •
edited
Loading

Copy link
Copy Markdown 
npm i https://pkg.pr.new/@convex-dev/auth@761

commit: 0b7202c

@dowski
dowski force-pushed the dowski/auth-state-client branch from 5c9b6df to f9ed6f0 Compare October 21, 2026 20:00
cubic-dev-ai[bot]
cubic-dev-ai Bot reviewed Oct 23, 2026
View reviewed changes

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 13 files

Re-trigger cubic

@dowski
dowski force-pushed the dowski/auth-state-client branch from a6df4b7 to cc4f8cd Compare October 26, 2026 23:27
@dowski
dowski force-pushed the dowski/auth-state-server branch from 484d4d8 to 55613a7 Compare October 26, 2026 23:44
@dowski
dowski force-pushed the dowski/auth-state-client branch from cc4f8cd to 6760b81 Compare October 26, 2026 23:44
@dowski
dowski force-pushed the dowski/auth-state-server branch from 55613a7 to c951ae8 Compare October 26, 2026 23:50
@dowski
dowski force-pushed the dowski/auth-state-client branch from 6760b81 to e3250d7 Compare October 26, 2026 23:51
@dowski
dowski force-pushed the dowski/auth-state-client branch from e3250d7 to 8ddd4b6 Compare October 27, 2026 14:51
@dowski
dowski force-pushed the dowski/auth-state-server branch from c951ae8 to 0c52fd4 Compare October 27, 2026 14:51
@dowski
dowski force-pushed the dowski/auth-state-server branch 2 times, most recently from 18e3159 to e86f46c Compare October 27, 2026 15:01
@dowski
dowski force-pushed the dowski/auth-state-client branch from 8ddd4b6 to be2e6fd Compare October 27, 2026 15:01
@dowski
dowski force-pushed the dowski/auth-state-server branch from e86f46c to e3d65ba Compare October 27, 2026 21:49
@dowski
dowski force-pushed the dowski/auth-state-client branch from be2e6fd to 14c1ae8 Compare October 27, 2026 21:49
@dowski
dowski requested a review from Nicolapps October 27, 2026 21:52
@dowski
dowski force-pushed the dowski/auth-state-client branch from 14c1ae8 to 331cc36 Compare October 28, 2026 14:05
@dowski
dowski force-pushed the dowski/auth-state-server branch from e3d65ba to 0ccb472 Compare October 28, 2026 14:05
@dowski
dowski changed the base branch from dowski/auth-state-server to graphite-base/761 October 28, 2026 14:21
@dowski
dowski force-pushed the dowski/auth-state-client branch from 331cc36 to f884db9 Compare October 28, 2026 14:21
@dowski
dowski force-pushed the graphite-base/761 branch from 0ccb472 to 9bde747 Compare October 28, 2026 14:21
@cursor
cursor Bot changed the base branch from graphite-base/761 to reboot October 28, 2026 14:21
@dowski @claude
Sign clients out reactively when their session is revoked
0b7202c 
Both providers now subscribe to the app's `isAuthenticated` query through a
`SessionWatcher` rendered inside `ConvexProviderWithAuth`. When the answer
flips to `false` (a session revoked by sign-out elsewhere,
`revokeOtherSessions`, or refresh-token reuse detection), the client signs
itself out instead of staying signed in until the token expires.

The subscription is gated on `useConvexAuth().isAuthenticated`, which is
true only once the backend has accepted the access token. Under the gate,
`false` means the accepted token's session is gone. Without it, `false`
would also appear when the Convex client has cleared its auth (it couldn't
get a token the backend accepts), which must not sign out a local session
that may still be good.

`ConvexAuthApi` therefore requires the `isAuthenticated` reference, and
the Next.js server provider hands the client the function's *name* (from
the `isAuthenticated` it already takes), since a reference proxy does not
survive the server-to-client serialization boundary.

Sign-out (rather than a bare local clear) also clears the SSR cookies
holding the dead tokens; on an already-revoked session the server call
is a no-op.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@dowski
dowski force-pushed the dowski/auth-state-client branch from f884db9 to 0b7202c Compare October 28, 2026 14:21

This branch was successfully deployed

1 active deployment
Preview – auth-v2 — 0b7202c9 Deployed Oct 28, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cubic-dev-ai cubic-dev-ai[bot] cubic-dev-ai[bot] left review comments
@Nicolapps Nicolapps Awaiting requested review from Nicolapps

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@dowski