Fix auth invalidation during batch transcription

apps/desktop/src/auth/auth-context.ts

@@ -12,6 +12,7 @@ type AuthActions = {
   signIn: () => Promise<void>;
   signOut: () => Promise<void>;
   refreshSession: () => Promise<Session | null>;
+  getSessionForRequest: () => Promise<Session | null>;
 };
 
 type AuthTokenHandlers = {

apps/desktop/src/auth/client.test.ts

@@ -0,0 +1,88 @@
+import { beforeEach, describe, expect, test, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  getItem: vi.fn(),
+  removeItem: vi.fn(),
+  setItem: vi.fn(),
+}));
+
+vi.mock("@anlg/plugin-auth", () => ({
+  commands: {
+    getItem: mocks.getItem,
+    removeItem: mocks.removeItem,
+    setItem: mocks.setItem,
+  },
+}));
+
+vi.mock("@supabase/supabase-js", () => ({
+  createClient: vi.fn(() => ({})),
+  processLock: vi.fn(),
+}));
+
+vi.mock("@tauri-apps/plugin-http", () => ({ fetch: vi.fn() }));
+
+vi.mock("~/env", () => ({
+  env: {
+    VITE_SUPABASE_ANON_KEY: "anon-key",
+    VITE_SUPABASE_URL: "https://project.supabase.co",
+  },
+}));
+
+import { readPersistedAuthSession, tauriStorage } from "./client";
+
+const authStorageKey = "sb-project-auth-token";
+
+function serializedSession(accessToken: string) {
+  return JSON.stringify({
+    access_token: accessToken,
+    refresh_token: "refresh-token",
+    token_type: "bearer",
+    user: { id: "user-id" },
+  });
+}
+
+describe("auth storage", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mocks.getItem.mockResolvedValue({ status: "ok", data: null });
+    mocks.removeItem.mockResolvedValue({ status: "ok", data: null });
+    mocks.setItem.mockResolvedValue({ status: "ok", data: null });
+  });
+
+  test("does not let the SDK clear the persisted session", async () => {
+    await tauriStorage.removeItem(authStorageKey);
+
+    expect(mocks.removeItem).not.toHaveBeenCalled();
+  });
+
+  test("persists the session once", async () => {
+    await tauriStorage.setItem(authStorageKey, "serialized-session");
+
+    expect(mocks.setItem).toHaveBeenCalledOnce();
+    expect(mocks.setItem).toHaveBeenCalledWith(
+      authStorageKey,
+      "serialized-session",
+    );
+  });
+
+  test("still removes auxiliary auth values", async () => {
+    await tauriStorage.removeItem("pkce-code-verifier");
+
+    expect(mocks.removeItem).toHaveBeenCalledWith("pkce-code-verifier");
+  });
+
+  test("loads the persisted session after a cold start", async () => {
+    mocks.getItem.mockImplementation(async (key: string) => ({
+      status: "ok",
+      data:
+        key === authStorageKey ? serializedSession("persisted-token") : null,
+    }));
+
+    await expect(readPersistedAuthSession()).resolves.toEqual({
+      access_token: "persisted-token",
+      refresh_token: "refresh-token",
+      token_type: "bearer",
+      user: { id: "user-id" },
+    });
+  });
+});

apps/desktop/src/auth/client.ts

@@ -11,6 +11,10 @@ import { commands as authCommands } from "@anlg/plugin-auth";
 
 import { env } from "~/env";
 
+const authStorageKey = env.VITE_SUPABASE_URL
+  ? `sb-${new URL(env.VITE_SUPABASE_URL).hostname.split(".")[0]}-auth-token`
+  : null;
+
 export const tauriStorage: SupportedStorage = {
   async getItem(key: string): Promise<string | null> {
     const result = await authCommands.getItem(key);
@@ -26,16 +30,42 @@ export const tauriStorage: SupportedStorage = {
     }
   },
   async removeItem(key: string): Promise<void> {
+    if (key === authStorageKey) {
+      return;
+    }
+
     const result = await authCommands.removeItem(key);
     if (result.status === "error") {
       throw new Error(`auth storage removeItem failed: ${result.error}`);
     }
   },
 };
 
-const authStorageKey = env.VITE_SUPABASE_URL
-  ? `sb-${new URL(env.VITE_SUPABASE_URL).hostname.split(".")[0]}-auth-token`
-  : null;
+function parsePersistedSession(value: string | null): Session | null {
+  if (!value) {
+    return null;
+  }
+
+  try {
+    const parsed = JSON.parse(value) as Partial<Session>;
+    return typeof parsed.access_token === "string" &&
+      typeof parsed.refresh_token === "string" &&
+      typeof parsed.token_type === "string" &&
+      typeof parsed.user?.id === "string"
+      ? (parsed as Session)
+      : null;
+  } catch {
+    return null;
+  }
+}
+
+export async function readPersistedAuthSession(): Promise<Session | null> {
+  if (!authStorageKey) {
+    return null;
+  }
+
+  return parsePersistedSession(await tauriStorage.getItem(authStorageKey));
+}
 
 export async function persistAuthSession(session: Session): Promise<void> {
   if (!authStorageKey) {