Preserve unsaved form input during reauthentication #25

New issue

Open

opened 2026-11-01 20:11:43 +00:00 by viacheslavshuka · 0 comments

viacheslavshuka commented

2026-11-01 20:11:43 +00:00

Owner

Outcome

An expired browser session should not silently discard a user's current form. Preserve input in memory while the user logs in again, then require deliberate resubmission.

Acceptance criteria

When a protected form request encounters session expiry, the browser keeps unsaved input in memory and requests login again.
Returning as the same account restores the form context without automatically resubmitting its write.
Returning as another account clears private draft input and private cached data. That account cannot inspect or submit the previous account's form.
Resubmission checks current permission and current server state. Reauthentication does not revive expired offers or bypass a saved-version conflict.
If a session-details save is stale, show a clear conflict message and Reload action. Keep input visible until the user chooses to reload.
Reload warns that current unsaved edits will be replaced by saved values. No comparison screen or automatic merge is required.
Reloading or closing the browser may lose memory-only drafts. The interface does not promise persistent recovery.
Expiry handling does not store credentials or private drafts in localStorage and does not create an offline write queue.

Validation design

Expire login while a form contains edits, complete login as the same user, and assert preserved input with no automatic request. Repeat with another account and assert input removal. Change the session's saved version during login, then verify explicit resubmission rejects stale data without erasing visible edits.

Dependencies

#14: Authenticate Telegram users through protected Quorum sessions. Supplies expiry and reauthentication.
#7: Create the React application with locked frontend tooling. Supplies routing and in-memory form context.

## Outcome An expired browser session should not silently discard a user's current form. Preserve input in memory while the user logs in again, then require deliberate resubmission. ## Acceptance criteria - When a protected form request encounters session expiry, the browser keeps unsaved input in memory and requests login again. - Returning as the same account restores the form context without automatically resubmitting its write. - Returning as another account clears private draft input and private cached data. That account cannot inspect or submit the previous account's form. - Resubmission checks current permission and current server state. Reauthentication does not revive expired offers or bypass a saved-version conflict. - If a session-details save is stale, show a clear conflict message and Reload action. Keep input visible until the user chooses to reload. - Reload warns that current unsaved edits will be replaced by saved values. No comparison screen or automatic merge is required. - Reloading or closing the browser may lose memory-only drafts. The interface does not promise persistent recovery. - Expiry handling does not store credentials or private drafts in localStorage and does not create an offline write queue. ## Validation design Expire login while a form contains edits, complete login as the same user, and assert preserved input with no automatic request. Repeat with another account and assert input removal. Change the session's saved version during login, then verify explicit resubmission rejects stale data without erasing visible edits. ## Dependencies - [#14: Authenticate Telegram users through protected Quorum sessions](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/14). Supplies expiry and reauthentication. - [#7: Create the React application with locked frontend tooling](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/7). Supplies routing and in-memory form context. ## Related work - [#24: Keep browser data useful during slow or lost connections](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/24) - [#57: Preserve bookings and prevent stale overwrites when test details change](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/57) - [#33: Offer a safe reload when an open page needs a new application version](https://code.viacheslavshuka.com/viacheslavshuka/quorum/issues/33)

viacheslavshuka added the

labels

2026-11-01 20:13:29 +00:00

viacheslavshuka referenced this issue

2026-11-01 20:15:48 +00:00

Let users inspect and revoke browser sessions #19

viacheslavshuka referenced this issue

2026-11-01 20:15:55 +00:00