Access Token Expiration Handling During Long-Running Requests

[courthub74]

Sub-Issue: Access Token Expiration Handling During Async Image Generation

Problem

• /api/images/generate fails with Invalid Access Token when the access token expires.
• Manual logout/login resolves the issue.
• No automatic refresh or retry logic currently exists.

---

Current Behavior

• Frontend sends a Bearer access token with each request.
• If the token is expired → API responds with 401 Unauthorized.
• Error is surfaced directly to the UI.
• User must manually log out and log back in.

---

Desired Behavior

If the API returns 401 Unauthorized:

1. Attempt POST /api/auth/refresh using the existing httpOnly refresh cookie.
2. Store the new access token in localStorage (origin_access).
3. Retry the original request once.
4. If refresh fails → redirect user to login.

---

Impact

• Improves reliability of async and long-running workflows.
• Prevents generation failures caused by expired sessions.
• Required foundation before implementing background queues or polling.
• Moves Origin OS toward production-grade authentication resilience.