KI-AGENT: Persistente App-Sessions mit Refresh-Tokens ergänzen

mobile/src/lib/api.ts

@@ -131,6 +131,11 @@ export type MeResponse = {
   permissions: string[];
 };
 
+export type AuthSession = {
+  token: string;
+  refreshToken: string;
+};
+
 export type EncodedLabelRow = {
   dataType: 'pixels' | 'void' | 'check';
   rowNumber: number;
@@ -199,6 +204,20 @@ type RequestOptions = {
   timeoutMs?: number;
 };
 
+export class ApiError extends Error {
+  constructor(
+    message: string,
+    public readonly status: number
+  ) {
+    super(message);
+    this.name = 'ApiError';
+  }
+}
+
+export function isAuthenticationError(error: unknown): boolean {
+  return error instanceof ApiError && error.status === 401;
+}
+
 export type MatrixStatus = {
   enabled?: boolean;
   ready?: boolean;
@@ -363,7 +382,7 @@ export async function apiRequest<T>(path: string, options: RequestOptions = {}):
       (payload as { message?: string; error?: string } | null)?.message ||
       (payload as { message?: string; error?: string } | null)?.error ||
       `Request failed (${response.status}) for ${path}`;
-    throw new Error(message);
+    throw new ApiError(message, response.status);
   }
 
   return payload as T;
@@ -399,7 +418,7 @@ async function apiFormRequest<T>(path: string, token: string, formData: FormData
       (payload as { message?: string; error?: string } | null)?.message ||
       (payload as { message?: string; error?: string } | null)?.error ||
       `Request failed (${response.status}) for ${path}`;
-    throw new Error(message);
+    throw new ApiError(message, response.status);
   }
 
   return payload as T;
@@ -629,17 +648,37 @@ export async function renderPrintLabel(
   });
 }
 
-export async function loginWithEmailPassword(email: string, password: string): Promise<string> {
-  const payload = await apiRequest<{ token?: string }>('/auth/login', {
+function requireAuthSession(payload: Partial<AuthSession>, action: string): AuthSession {
+  if (!payload?.token || !payload?.refreshToken) {
+    throw new Error(`${action} did not return a complete session.`);
+  }
+
+  return { token: payload.token, refreshToken: payload.refreshToken };
+}
+
+export async function loginWithEmailPassword(email: string, password: string): Promise<AuthSession> {
+  const payload = await apiRequest<Partial<AuthSession>>('/auth/login', {
     method: 'POST',
     body: { email, password },
   });
 
-  if (!payload?.token) {
-    throw new Error('Login did not return a token.');
-  }
+  return requireAuthSession(payload, 'Login');
+}
 
-  return payload.token;
+export async function refreshAuthSession(refreshToken: string): Promise<AuthSession> {
+  const payload = await apiRequest<Partial<AuthSession>>('/auth/refresh', {
+    method: 'POST',
+    body: { refreshToken },
+  });
+
+  return requireAuthSession(payload, 'Session refresh');
+}
+
+export async function logoutSession(refreshToken: string): Promise<void> {
+  await apiRequest('/auth/logout', {
+    method: 'POST',
+    body: { refreshToken },
+  });
 }
 
 export async function fetchMe(token: string): Promise<MeResponse> {
@@ -666,18 +705,18 @@ export async function sendMobileTestPush(token: string): Promise<{ accepted: num
   });
 }
 
-export async function switchTenantRequest(tenantId: number, token: string): Promise<string> {
-  const payload = await apiRequest<{ token?: string }>('/api/tenant/switch', {
+export async function switchTenantRequest(
+  tenantId: number,
+  token: string,
+  refreshToken: string
+): Promise<AuthSession> {
+  const payload = await apiRequest<Partial<AuthSession>>('/api/tenant/switch', {
     method: 'POST',
     token,
-    body: { tenant_id: String(tenantId) },
+    body: { tenant_id: String(tenantId), refreshToken },
   });
 
-  if (!payload?.token) {
-    throw new Error('Tenant switch did not return a token.');
-  }
-
-  return payload.token;
+  return requireAuthSession(payload, 'Tenant switch');
 }
 
 export async function fetchTasks(token: string): Promise<Task[]> {

mobile/src/lib/token-storage.ts

@@ -1,8 +1,15 @@
 import * as SecureStore from 'expo-secure-store';
 
 const TOKEN_KEY = 'fedeo.mobile.auth.token';
+const REFRESH_TOKEN_KEY = 'fedeo.mobile.auth.refresh-token';
 
 let memoryToken: string | null = null;
+let memoryRefreshToken: string | null = null;
+
+export type StoredSession = {
+  token: string;
+  refreshToken: string;
+};
 
 async function hasSecureStore(): Promise<boolean> {
   try {
@@ -30,11 +37,41 @@ export async function setStoredToken(token: string): Promise<void> {
   }
 }
 
-export async function clearStoredToken(): Promise<void> {
-  memoryToken = null;
+export async function getStoredSession(): Promise<StoredSession | null> {
+  if (await hasSecureStore()) {
+    const [token, refreshToken] = await Promise.all([
+      SecureStore.getItemAsync(TOKEN_KEY),
+      SecureStore.getItemAsync(REFRESH_TOKEN_KEY),
+    ]);
+    memoryToken = token;
+    memoryRefreshToken = refreshToken;
+  }
+
+  if (!memoryToken || !memoryRefreshToken) return null;
+  return { token: memoryToken, refreshToken: memoryRefreshToken };
+}
+
+export async function setStoredSession(session: StoredSession): Promise<void> {
+  memoryToken = session.token;
+  memoryRefreshToken = session.refreshToken;
 
   if (await hasSecureStore()) {
-    await SecureStore.deleteItemAsync(TOKEN_KEY);
+    await Promise.all([
+      SecureStore.setItemAsync(TOKEN_KEY, session.token),
+      SecureStore.setItemAsync(REFRESH_TOKEN_KEY, session.refreshToken),
+    ]);
+  }
+}
+
+export async function clearStoredToken(): Promise<void> {
+  memoryToken = null;
+  memoryRefreshToken = null;
+
+  if (await hasSecureStore()) {
+    await Promise.all([
+      SecureStore.deleteItemAsync(TOKEN_KEY),
+      SecureStore.deleteItemAsync(REFRESH_TOKEN_KEY),
+    ]);
   }
 }