Login on a non-public-readable container not recognized by main content UI

[uvdsl]

When logging in while viewing a container that is not public-readable (e.g. the Pod root, private on purpose), the databrowser continues to prompt for login even though authentication actually succeeds. This persists across a hard reload of that URL.

Note that the content pane seems to be stuck on an old state, while the header correctly recognizes the login and shows the user icon.

Workaround: Navigating to a different location on the Pod (via browser URL bar), then back to the root, works fine. The root loads correctly once the session has been restored elsewhere first.

Observations:

• The login itself works; the UI just doesn't pick it up on the initial private-container view.
• Network tab shows the root container being fetched three times on load. After the initial 401, sometimes one and sometimes two of the follow-up requests also fail with 401, before a later successful (authenticated) request.
• This points to a race condition: resources are fetched before the refresh-token grant completes and a fresh access token is available, so requests go out unauthenticated.
• The problem reproduces on any private container, not just the root.
• Suspected to be in the post-login redirect / session-restore handling, since simply restoring a session on a different URL works fine.

Tested with CSS@7.2.0 and mashlib@2.3.2

Relates to #291.

[uvdsl]

Question:

solid-logic/src/authn/SolidAuthnLogic.ts

Lines 96 to 110 in a68ee98

	if (typeof sessionAny?.restore === 'function') {
	const wasActive = sessionAny?.isActive ?? Boolean(sessionAny?.webId)
	try {
	await sessionAny.restore()
	} catch (error) {
	const message = error instanceof Error ? error.message : String(error)
	if (!/no session to restore/i.test(message)) {
	throw error
	}
	debug.log('No previous session to restore')
	}
	const isNowActive = sessionAny?.isActive ?? Boolean(sessionAny?.webId)
	if (!wasActive && isNowActive) {
	sessionAny.events?.emit('sessionRestore', window.location.href)
	}

 sessionAny.events?.emit('sessionRestore', window.location.href) 

why do you call that instead of the login event? What is the difference?

[uvdsl]

I think the issue is somewhere with how the redirect after login is handled. Something seems to get stuck there.

Do we need a

sessionAny.events?.emit('sessionRestore', window.location.href)

in

solid-logic/src/authn/SolidAuthnLogic.ts

Lines 116 to 118 in a68ee98

	if (!wasActive && isNowActive) {
	sessionAny.events?.emit('login')
	}

as well? Such that the main content pain issues a retry maybe? not sure.

[bourgeoa]

Thanks for raising the issue. The issue was in fact in Pivot.
I shall try to respond to your other coding questions later

In general Tthe implementation wanted to keep compatibility with Inrupt library implementation.
It was also used to resolve old issues with NSS logout.