Sign in to the console and keep the session
What It Does
The browser owns navigation and in-memory access tokens; session routes own the refresh cookie and provider renewal. Safe return validation and proof-key/state checks protect the sign-in handoffs.
The Flow
The diagram separates the relevant success, alternative and failure paths. The numbered hop rows retain the detailed authority checks, delegated work and retry limits.
When Something Fails
Protected content waits for evaluated context. That read can stamp authentication and settle expired staff grants, so it is not strictly free of writes. Local sign-out clears browser session state without guaranteeing immediate expiry of issued access tokens.
Browser callers share an in-flight refresh. OAuth redemption requires the retained proof verifier and matching state. Interactive context reads throttle authentication stamping to once a minute and can also lazily settle ended staff grants through their reads.
Sign-out and user changes broadcast across tabs. Refused renewal or absence of a usable token ends the session; transient provider/network trouble can retain a still-valid access token. Issued tokens remain subject to their own expiry after local sign-out.
Open Design Questions
The recorded findings retain any stronger planning expectation, missing writer or unproved recovery path. Observed behavior does not approve those outstanding product choices.