Refactor Flow Editor auth handling: remove setAuthHeader and improve token renewal #3553

akanshaaa19 · 2025-10-07T17:43:45Z

Removed setAuthHeader function
Added a 15-min health check to keep tokens fresh.
Tokens now renew 1 minute before expiry to avoid failures in floweditor.

Summary by CodeRabbit

New Features
- Automatically keeps sessions active during flow editing with periodic health checks.
Bug Fixes
- Reduced unexpected sign-outs by adding a safety buffer before token expiry.
Refactor
- Removed legacy background request behaviors to improve stability and reduce side effects.

…odifications

coderabbitai · 2025-10-07T17:44:16Z

Walkthrough

Removed all usage and the export of setAuthHeaders, including global monkey-patching of fetch and XMLHttpRequest in both FlowEditor and AuthService.
Updated AuthService.checkAuthStatusService to treat tokens as invalid within 1 minute of expiry (adds a 60-second pre-expiry buffer).
In FlowEditor, added a polling effect: when flowId exists, call getFreeFlow every 15 minutes for a health check; clears interval on unmount or flowId change.
No other exported/public API changes besides removing setAuthHeaders.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

Floweditor Issues: added logs for setAuthHeaders #3265 — Also touches AuthService setAuthHeaders, adding logs to the same function that this PR removes.
Revert "Floweditor Issues: added logs for setAuthHeaders" #3277 — Modifies/reverts logic within setAuthHeaders, overlapping directly with its removal here.
removed multiple logic for token refresh #3360 — Removes automatic token refresh/header injection utilities in AuthService, aligning with this PR’s deletion.

Suggested reviewers

kurund

Poem

A hop, a skip—no headers to sow,
I stash my carrots, watch sessions flow.
Fifteen-minute checks, nibble-nibble, okay—
Tokens fade early, a minute away.
I thump with joy: less sticky threads to weave—
Cleaner paths for burrows I leave.
🐇🥕

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title Check	✅ Passed	The title succinctly captures the core changes by indicating a refactor of the Flow Editor’s authentication handling, specifically the removal of setAuthHeader and enhancements to token renewal, which aligns directly with the pull request’s main modifications.
Docstring Coverage	✅ Passed	No functions found in the changes. Docstring coverage check skipped.

✨ Finishing touches

📝 Generate docstrings

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch floweditor-auth-handling

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

github-actions · 2025-10-07T17:45:45Z

🚀 Deployed on https://deploy-preview-3553--glific-frontend.netlify.app

coderabbitai

Actionable comments posted: 0

🧹 Nitpick comments (1)

src/components/floweditor/FlowEditor.tsx (1)
269-284: Call the health check immediately to avoid initial token expiry gaps.

The polling interval starts only after 15 minutes, which means if the token expires within the first 15 minutes after opening the flow editor, the polling won't prevent authentication failures. Consider invoking pollFlowConnection() immediately when the effect runs.

Additionally, including getFreeFlow in the dependency array may cause unnecessary effect re-runs if the query function reference changes. Since Apollo Client's useLazyQuery typically returns stable references, this might not be an issue in practice, but consider removing it from the dependencies if you encounter performance issues.

Apply this diff to call the health check immediately:
 useEffect(() => {
   if (flowId) {
     // health check to ensure the session is active
     const pollFlowConnection = () => {
       getFreeFlow({ variables: { id: flowId } });
     };

+    // Call immediately on mount
+    pollFlowConnection();
+
     // setting the polling interval to 15 minutes
     const POLLING_INTERVAL = 15 * 60 * 1000;
     const pollingInterval = setInterval(pollFlowConnection, POLLING_INTERVAL);

     return () => {
       clearInterval(pollingInterval);
     };
   }
-}, [flowId, getFreeFlow]);
+}, [flowId]);

📜 Review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 8b9a850 and 5ee44b8.

📒 Files selected for processing (2)

src/components/floweditor/FlowEditor.tsx (1 hunks)
src/services/AuthService.tsx (1 hunks)

🧰 Additional context used

📓 Path-based instructions (1)

**/*.{ts,tsx}

⚙️ CodeRabbit configuration file

Review the Typescript and React code for conformity with best practices in React, Recoil, Graphql, and Typescript. Highlight any deviations.

Files:

src/services/AuthService.tsx
src/components/floweditor/FlowEditor.tsx

🧬 Code graph analysis (1)

src/components/floweditor/FlowEditor.tsx (1)

src/mocks/Flow.tsx (1)

getFreeFlow (507-525)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)

GitHub Check: Codacy Static Code Analysis
GitHub Check: glific (1.18.3-otp-27, 27.3.3)
GitHub Check: CI
GitHub Check: build

🔇 Additional comments (2)

src/services/AuthService.tsx (2)

81-88: LGTM! The 1-minute pre-expiry buffer prevents token failures.

The implementation correctly adds a 60-second buffer before the actual token expiry time, ensuring tokens are renewed proactively before they become invalid. This aligns well with the PR objectives to prevent failures in the flow editor.

73-93: setAuthHeaders removal verified
No remaining references to setAuthHeaders across .ts/.tsx files.

codecov · 2025-10-07T17:49:14Z

Codecov Report

❌ Patch coverage is 90.00000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 83.16%. Comparing base (14df17c) to head (9fb21ba).

Files with missing lines	Patch %	Lines
src/components/floweditor/FlowEditor.tsx	87.50%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #3553      +/-   ##
==========================================
+ Coverage   82.99%   83.16%   +0.17%     
==========================================
  Files         340      340              
  Lines       11241    11195      -46     
  Branches     2379     2368      -11     
==========================================
- Hits         9329     9310      -19     
+ Misses       1202     1177      -25     
+ Partials      710      708       -2

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

cypress · 2025-10-07T18:23:44Z

Glific Run #6448

Run Properties: Failed #6448 • 63769551b4 ℹ️: Merge 9fb21bab449451f9dc4e9964a3b5fb50012181a2 into 14df17c573f15d1a52dab8dbacc4...

Project	`Glific`
Branch Review	`floweditor-auth-handling`
Run status	`Failed #6448`
Run duration	`27m 55s`
Commit	`63769551b4 ℹ️: Merge 9fb21bab449451f9dc4e9964a3b5fb50012181a2 into 14df17c573f15d1a52dab8dbacc4...`
Committer	`Akansha Sakhre`
View all properties for this run ↗︎

Test results
Failures	`1`
Flaky	`2`
Pending	`0`
Skipped	`0`
Passing	`181`
View all changes introduced in this branch ↗︎

Tests for review

cypress/e2e/flow/FlowEditor.spec.ts • 1 failed test

View Output

Test		Artifacts
Flow > should configure Flow		`Test Replay` `Screenshots`

chat/Chat.spec.ts • 1 flaky test

View Output

Test		Artifacts
Role - Staff - Chats > should send the message correctly		`Test Replay` `Screenshots`

contactBar/ContactBar.spec.ts • 1 flaky test

View Output

Test		Artifacts
Role - Staff - Contact bar > should start a flow		`Test Replay` `Screenshots`

kurund · 2025-10-13T21:09:02Z

src/components/floweditor/FlowEditor.tsx

+      };
+
+      // setting the polling interval to 15 minutes
+      const POLLING_INTERVAL = 15 * 60 * 1000;


This should be moved to constants.ts

kurund · 2025-10-13T21:11:17Z

src/components/floweditor/FlowEditor.tsx

+    if (flowId) {
+      // health check to ensure the session is active
+      const pollFlowConnection = () => {
+        getFreeFlow({ variables: { id: flowId } });


Not sure about using getFreeFlow for polling here again? Maybe we can just add polling to the initial query and remove manual polling. Let's discuss.

akanshaaa19 · 2025-10-16T04:26:44Z

progress so far:

moved the authentication logic to floweditor.
FlowEditor uses only REST APIs. However, glific-frontend uses GraphQL APIs and manages token refresh via apollo-link-token-refresh, which renews the token before any GraphQL call. To prevent token expiry issues for FlowEditor, I added a health check API that is called every 15 minutes and the token renewal happens 1 minute before expiry.
But currently there still exists a window where the token can expire when we are on the floweditor- and the APIs will fail

Next steps
We are exploring an independent token renewal system for the frontend, not tied to GraphQL or apollo-link-token-refresh.
However, this approach comes with some nuances:

If the user leaves the tab inactive and returns after some time, the token might not get renewed automatically.
Using a window.onFocus event could help trigger renewals, but if there’s no activity for 30+ minutes, the token will still expire.

radhikaT4D · 2025-10-16T22:43:33Z

progress so far:

moved the authentication logic to floweditor.

FlowEditor uses only REST APIs. However, glific-frontend uses GraphQL APIs and manages token refresh via apollo-link-token-refresh, which renews the token before any GraphQL call. To prevent token expiry issues for FlowEditor, I added a health check API that is called every 15 minutes and the token renewal happens 1 minute before expiry.

But currently there still exists a window where the token can expire when we are on the floweditor- and the APIs will fail

Next steps We are exploring an independent token renewal system for the frontend, not tied to GraphQL or apollo-link-token-refresh. However, this approach comes with some nuances:

If the user leaves the tab inactive and returns after some time, the token might not get renewed automatically.

Using a window.onFocus event could help trigger renewals, but if there’s no activity for 30+ minutes, the token will still expire.

@akanshaaa19 isn't it ok for the token to expire with a 30+ min inactivity? As long as the "work" is saved automatically. What is our requirement on this from a user's perspective?

akanshaaa19 added 3 commits October 7, 2025 23:00

refactor: remove setAuthHeaders function and related XMLHttpRequest m…

a16820a

…odifications

add polling mechanism for flow connection health check

e242d04

enhance token expiry check with buffer time for renewal

5ee44b8

akanshaaa19 requested review from kurund and madclaws October 7, 2025 17:44

github-actions bot temporarily deployed to pull request October 7, 2025 17:45 Inactive

coderabbitai bot reviewed Oct 7, 2025

View reviewed changes

kurund requested changes Oct 13, 2025

View reviewed changes

Merge branch 'master' into floweditor-auth-handling

cf786c4

github-actions bot temporarily deployed to pull request October 14, 2025 05:21 Inactive

Merge branch 'master' into floweditor-auth-handling

9fb21ba

github-actions bot temporarily deployed to pull request October 16, 2025 04:31 Inactive

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Refactor Flow Editor auth handling: remove setAuthHeader and improve token renewal #3553

Refactor Flow Editor auth handling: remove setAuthHeader and improve token renewal #3553

Uh oh!

akanshaaa19 commented Oct 7, 2025 •

edited by coderabbitai bot

Loading

Uh oh!

coderabbitai bot commented Oct 7, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Oct 7, 2025 •

edited

Loading

Uh oh!

coderabbitai bot left a comment

Uh oh!

codecov bot commented Oct 7, 2025 •

edited

Loading

Uh oh!

cypress bot commented Oct 7, 2025 •

edited

Loading

Uh oh!

kurund Oct 13, 2025

Uh oh!

kurund Oct 13, 2025 •

edited

Loading

Uh oh!

akanshaaa19 commented Oct 16, 2025

Uh oh!

radhikaT4D commented Oct 16, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Refactor Flow Editor auth handling: remove setAuthHeader and improve token renewal #3553

Are you sure you want to change the base?

Refactor Flow Editor auth handling: remove setAuthHeader and improve token renewal #3553

Uh oh!

Conversation

akanshaaa19 commented Oct 7, 2025 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai bot commented Oct 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Estimated code review effort

Possibly related PRs

Suggested reviewers

Poem

Pre-merge checks and finishing touches

Uh oh!

github-actions bot commented Oct 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

codecov bot commented Oct 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

cypress bot commented Oct 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Glific Run #6448

Tests for review

Uh oh!

kurund Oct 13, 2025

Choose a reason for hiding this comment

Uh oh!

kurund Oct 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

akanshaaa19 commented Oct 16, 2025

Uh oh!

radhikaT4D commented Oct 16, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

akanshaaa19 commented Oct 7, 2025 •

edited by coderabbitai bot

Loading

coderabbitai bot commented Oct 7, 2025 •

edited

Loading

github-actions bot commented Oct 7, 2025 •

edited

Loading

codecov bot commented Oct 7, 2025 •

edited

Loading

cypress bot commented Oct 7, 2025 •

edited

Loading

kurund Oct 13, 2025 •

edited

Loading