feat(auth): use browser.alarms for JWT refresh (Phase 3)#269
Merged
Conversation
Replace setTimeout with browser.alarms API for scheduling JWT token refresh. This ensures token refresh survives service worker suspension. Key changes: - Add "alarms" permission to manifest - Replace setTimeout with browser.alarms.create() in JwtManager - Add alarm handler in background.ts - Implement exponential backoff for refresh failures (1min, 2min, 4min) - Clear auth and emit jwt:auth:failed event after 3 consecutive failures - Fallback to setTimeout in contexts where alarms API is unavailable 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Phase 3 of the auth flow revamp: Replace
setTimeoutwithbrowser.alarmsAPI for scheduling JWT token refresh. This ensures token refresh survives service worker suspension, which is critical for maintaining authentication state in MV3 extensions.Problem
In Manifest V3 extensions, service workers can be suspended at any time by the browser. When this happens, any scheduled
setTimeoutcallbacks are lost, meaning JWT refresh might never occur, leading to expired tokens and unexpected auth failures.Solution
Use
browser.alarmsAPI which persists across service worker restarts:browser.alarms.create()instead ofsetTimeoutsetTimeoutin contexts where alarms API is unavailable (e.g., content scripts)Exponential Backoff
When refresh fails, the system retries with exponential backoff:
jwt:auth:failedeventThis prevents hammering the server during outages while still attempting recovery.
Files Changed
wxt.config.tssrc/JwtManager.tssrc/svc/background.tsTest plan
🤖 Generated with Claude Code