auth fixes

apps/web/src/auth/AuthProvider.tsx

@@ -1,25 +1,45 @@
-import { useEffect } from 'react'
+import { useEffect, useRef } from 'react'
 import { useAuthStore } from '../stores/auth'
 import { api } from '../api/client'
+import { getToken, clearToken } from './oidc'
 
 export function AuthProvider({ children }: { children: React.ReactNode }) {
   const { setUser, setError, setState } = useAuthStore()
+  const isMounted = useRef(true)
+
+  useEffect(() => {
+    return () => {
+      isMounted.current = false
+    }
+  }, [])
 
   useEffect(() => {
     const initAuth = async () => {
       try {
-        const token = localStorage.getItem('access_token')
+        const token = getToken()
         if (!token) {
-          setState('unauthenticated')
+          if (isMounted.current) {
+            setState('unauthenticated')
+          }
           return
         }
 
         const user = await api.getCurrentUser()
-        setUser(user)
+
+        if (isMounted.current) {
+          setUser(user)
+        }
       } catch (error) {
         console.error('Auth initialization failed:', error)
-        setError(error instanceof Error ? error : new Error('Auth failed'))
-        localStorage.removeItem('access_token')
+
+        if (error instanceof Error && error.message.includes('401')) {
+          clearToken()
+        }
+
+        if (isMounted.current) {
+          setError(error instanceof Error ? error : new Error('Auth failed'))
+          clearToken()
+        }
       }
     }
 

apps/web/src/auth/oidc.ts

@@ -1,4 +1,3 @@
-// PKCE utilities for OIDC flow
 function generateRandomString(length: number): string {
   const possible = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'
   let text = ''
@@ -34,6 +33,18 @@ export function clearPKCE(): void {
   sessionStorage.removeItem('pkce_verifier')
 }
 
+export function storeState(state: string): void {
+  sessionStorage.setItem('oidc_state', state)
+}
+
+export function getState(): string | null {
+  return sessionStorage.getItem('oidc_state')
+}
+
+export function clearState(): void {
+  sessionStorage.removeItem('oidc_state')
+}
+
 export function storeToken(token: string): void {
   localStorage.setItem('access_token', token)
 }