[lijiashu1]

Summary

• Close authenticated SSE connections when the signed token expires, so expired sessions stop receiving live room/game events.
• Send an auth-expired SSE event and return the client to the sign-in screen instead of leaving EventSource reconnecting with an expired token.
• Add a regression test using a short-lived signed token.

Validation

GitHub Actions will run the existing syntax checks and npm test.

[lijiashu1]

Follow-up security fix is ready for review. The SSE stream now emits auth-expired and closes when the signed token expires; the client clears the expired token and returns to sign-in. Added a short-lived-token regression test. GitHub Actions CI passed (syntax checks + npm test).

[lijiashu1]

Follow-up security fix is ready for review. The SSE stream now emits auth-expired and closes when the signed token expires; the client clears the expired token and returns to sign-in. Added a short-lived-token regression test. GitHub Actions CI passed (syntax checks + npm test).

[wjc2821296948]

The connected-at-expiry path is handled, but an expired token can still leave EventSource reconnecting forever if the SSE connection drops before the token expires. Please cover that disconnected/reconnect case before merging.

[wjc2821296948]

The disconnect-before-expiry case is now addressed by the client-side expiry timer, but there is still a startup edge case with an already-expired stored token. Please stop connectEvents() after scheduleAuthExpiry() clears the token instead of creating a new EventSource with token=null.

[lijiashu1]

I’ve updated the PR to address the disconnected-token reconnect loop. The client now schedules an independent expiry timer from the token payload, so it clears the expired token and returns to sign-in even if the SSE connection dropped before expiry and can no longer deliver auth-expired. I also added regression coverage for the client sign-in state after expiry without an active stream, plus server rejection of an expired-token reconnect. CI is running for the latest commit.

[lijiashu1]

I also addressed the startup edge case: connectEvents() now returns immediately if scheduling expiry discovers that the stored token is already expired, so it cannot create an EventSource with token=null. Added a regression test asserting no SSE stream is opened and the sign-in view is restored. Latest changes are pushed to the existing PR branch.