--- id: WF-PFM-CSH-005 title: Refresh the application list trigger: >- An application-coded refusal arrives, or a visible return passes the five-minute timestamp threshold. product_area: platform module: console-shell revision: 1 status: draft design_intent: confirmed origin: >- services-platform:docs/proposals/application-access-and-entitlements.md#6.4 Console integration, item 4 and #7.1 (built and accepted by Andrew 2026-10-15) implementation_evidence: observed source_sha: react-console: baf6dae382d6f41dce976c7f848667ccc37e076f services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1 implements: - CAP-PFM-CSH-014 - CAP-PFM-CSH-016 moves: - STATE-PFM-CSH-003 crosses: - SVC-PFM-CSH-console-shell inference: [] idempotency: >- Concurrent triggers share one read rather than issuing separate application requests. concurrency: >- All callers share the outstanding request across workspaces; ticket and selected-workspace checks protect data installation. hops: - 'n': 1 actor_or_service: console request layer action: >- Publish an in-browser signal for a 403 carrying either recognized application-refusal code. anchor: >- react-console:lib/security-context/application-refusal.ts:reportApplicationRefusal seam: event on_failure: Unrelated refusals produce no application signal. left_inconsistent: The page retains responsibility for the original refused request. observer: Requesting page owns its refusal presentation. provenance: test source: >- react-console:lib/security-context/application-refusal.test.ts#leaves every other refusal alone - 'n': 2 actor_or_service: console (provider) action: >- On a visible-tab return, request refresh when the provider timestamp is at least five minutes old. anchor: >- react-console:lib/security-context/provider.tsx:SecurityContextProvider (check) seam: event on_failure: No request starts before the freshness and visibility checks pass. left_inconsistent: The timestamp can be recent without a current authority answer. observer: No dedicated observer. provenance: observed source: >- react-console:lib/security-context/provider.tsx:APPLICATIONS_STALE_AFTER_MS - 'n': 3 actor_or_service: console (provider) action: >- Return without work outside readiness or a workspace; share an existing request or capture the current ticket for a new one. anchor: 'react-console:lib/security-context/provider.tsx:refreshApplications' seam: sync on_failure: The function returns or joins without a separate recovery path. left_inconsistent: A new workspace caller can share an older workspace’s request. observer: No dedicated observer. provenance: observed source: >- react-console:lib/security-context/provider.tsx:refreshApplications (applicationsInFlight) - 'n': 4 actor_or_service: Security (getMyApplications) action: >- Read applications and features through Security’s full-context computation. anchor: >- services-platform:modules/security/services/access/security-context.ts:getMyApplications seam: sync on_failure: Keep the held list silently if the read fails. left_inconsistent: >- The displayed list may remain stale, and server licensing data can also be cached. observer: No refresh-error screen; Security owns service logging. provenance: observed source: >- services-platform:modules/security/services/access/security-context.ts:getMyApplications, getSecurityContext - 'n': 5 actor_or_service: console (provider) action: >- Advance the timestamp on success, then replace only applications and features if the context-change ticket and workspace still match. anchor: 'react-console:lib/security-context/provider.tsx:refreshApplications' seam: sync on_failure: Discard response data after a superseding context change. left_inconsistent: >- A superseded success delays focus refresh; narrow replacement leaves withdrawn permissions unchanged. observer: Person through recomputed menu and page gates. provenance: test source: >- react-console:e2e/mock/application-access.mock.spec.ts#brings the launcher up to date instead of leaving it offering what is gone branches: [] waits: - >- Visible returns use a five-minute timestamp threshold that boot and workspace entry do not reset. evidence: - >- react-console at baf6dae: lib/security-context/{application-refusal.ts,provider.tsx,context.ts}; lib/auth/api.ts (reports refusals); e2e/mock/application-access.mock.spec.ts. - >- services-platform at ad3f6a6: modules/security/aws/api/access.routes.ts (getMyApplications); modules/security/services/access/security-context.ts; docs/proposals/application-access-and-entitlements.md §5.3, §6.4, §7.1. controls: [TC-AVL-001, TC-AVL-005, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-006, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-IAM-001, TC-IAM-002, TC-IAM-004, TC-IAM-005, TC-LOG-001, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-MON-002, TC-MON-003, TC-PI-001, TC-PI-002, TC-PI-003, TC-PI-005, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-TEN-004, TC-VEN-001, TC-VEN-002, TC-VEN-003] --- # Refresh the application list ## What It Does Application refresh updates the list after an application-coded refusal or when a visible tab returns past the freshness threshold. It replaces only applications and features in the held context. ## The Flow ```mermaid sequenceDiagram participant C as Console provider participant S as Security Note over C: refusal or aged visible return C->>S: application list for selected workspace S-->>C: applications and features or failure Note over C: advance successful timestamp and check ticket ``` ## When Something Fails A failed read is silent and leaves both the list and timestamp unchanged. A successful response advances the timestamp even if a workspace change makes its data inapplicable. Concurrent calls share the same request across workspaces. Narrow refresh does not update roles or permission rules; full refresh, reload or a context change is needed for those. Security computes the full context behind the smaller response. ## Open Design Questions Product must settle returning-tab refresh scope. The application timestamp and cross-workspace request sharing need direct browser proof.