fix(auth): qc login "Unauthorized" after session revocation (0.17.2)

The 2026-10-28 rotation of the auth server's signing keys and sessions
left every browser holding an access token that looked unexpired but was
refused (bad_jwt: unrecognized kid). /cli/authorize sent that token as a
hand-built Bearer, so Approve failed with a bare "Unauthorized" while the
page still showed the user signed in.

- auth-fetch: on a 401, refresh once and retry; a refresh token the
  server no longer knows (4xx) signs out locally via onExpired, keeping
  this device's E2EE keys. Network blips do not sign anyone out.
- /cli/authorize: let the wrapper add the token; a dead session now shows
  "Sign in first" and /auth returns to the same approval link
  (sessionStorage, /cli/authorize only, so no open redirect).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: ralyodio

package.json

@@ -1,7 +1,7 @@
 {
   "name": "qryptchat-web",
   "private": true,
-  "version": "0.17.1",
+  "version": "0.17.2",
   "type": "module",
   "bin": {
     "qc": "./bin/qc.js",

src/app/auth/page.jsx

@@ -2,6 +2,7 @@
 
 import { useState, useEffect, useRef } from 'react';
 import { useRouter } from 'next/navigation';
+import { afterSignInPath } from '@/lib/auth/after-sign-in.js';
 import { useAuthStore } from '@/lib/stores/auth.js';
 import { useShallow } from 'zustand/react/shallow';
 import { useMessagesStore } from '@/lib/stores/messages.js';
@@ -101,7 +102,7 @@ export default function AuthPage() {
       hasPin = r.ok ? (await r.json()).hasPin : false;
     } catch {}
     if (!hasPin && hasLocalKeys) { setVerifiedSession(session); setStep('backup'); return; }
-    router.push('/chat');
+    router.push(afterSignInPath());
   }
 
   // A CoinPay redirect (popups blocked) hands the session over in a short-lived
@@ -173,7 +174,7 @@ export default function AuthPage() {
   }
 
   useEffect(() => {
-    if (authenticated) router.replace('/chat');
+    if (authenticated) router.replace(afterSignInPath());
   }, [authenticated]);
 
   // CoinPay popup flow: the popup completes OAuth and postMessages the session
@@ -230,7 +231,7 @@ export default function AuthPage() {
 
     if (result.success) {
       if (result.isNewUser) {
-        router.push('/chat');
+        router.push(afterSignInPath());
       } else {
         const sessionToken = result.session?.access_token;
         const authHeaders = sessionToken ? { 'Authorization': `Bearer ${sessionToken}` } : {};
@@ -251,7 +252,7 @@ export default function AuthPage() {
             return;
           }
         } catch { setVerifiedSession(result.session); setStep('restore'); return; }
-        router.push('/chat');
+        router.push(afterSignInPath());
       }
     } else if (result.requiresUsername) {
       setVerifiedSession(result.session);
@@ -281,7 +282,7 @@ export default function AuthPage() {
           await keyManager.generateUserKeys();
           setStep('backup');
           msgStore.success('Account created! Please set a Backup PIN.');
-        } catch { msgStore.warning('Account created but failed to generate encryption keys.'); router.push('/chat'); }
+        } catch { msgStore.warning('Account created but failed to generate encryption keys.'); router.push(afterSignInPath()); }
       } else { msgStore.error(data.error || 'Failed to create account'); }
     } catch { msgStore.error('Failed to create account. Please try again.'); }
   }
@@ -301,7 +302,7 @@ export default function AuthPage() {
       const backupRes = await fetch('/api/auth/key-backup', { method: 'PUT', headers: backupHeaders, body: JSON.stringify({ encrypted_keys: encryptedData, pin: backupPin }) });
       if (!backupRes.ok) { const e = await backupRes.json().catch(() => ({})); throw new Error(e.error || 'Key backup failed'); }
       msgStore.success('Backup PIN set and keys backed up! Welcome to QryptChat!');
-      router.push('/chat');
+      router.push(afterSignInPath());
     } catch (err) { msgStore.error('Failed to set backup PIN: ' + (err.message || 'Unknown error')); }
   }
 
@@ -313,7 +314,7 @@ export default function AuthPage() {
       await privateKeyManager.restoreKeysFromServer(restorePin);
       msgStore.success('Encryption keys restored successfully!');
       setRestorePin(''); setRestoreAttempts(0);
-      router.push('/chat');
+      router.push(afterSignInPath());
     } catch (err) {
       // The server counts wrong PINs and locks restore; its message says how
       // many tries are left or how long to wait.
@@ -463,7 +464,7 @@ export default function AuthPage() {
                 <button type="submit" disabled={loading || !backupPin || !confirmBackupPin} className="primary-button">
                   {loading ? <><span className="loading-spinner" /> Setting PIN...</> : 'Set Backup PIN'}
                 </button>
-                <button type="button" className="secondary-button" onClick={() => { msgStore.warning('Backup PIN skipped. You can set one later in Settings.'); router.push('/chat'); }}>Skip (Not Recommended)</button>
+                <button type="button" className="secondary-button" onClick={() => { msgStore.warning('Backup PIN skipped. You can set one later in Settings.'); router.push(afterSignInPath()); }}>Skip (Not Recommended)</button>
               </div>
             </form>
           </div>
@@ -485,7 +486,7 @@ export default function AuthPage() {
                 <button type="submit" disabled={isRestoring || !restorePin} className="primary-button">
                   {isRestoring ? <><span className="loading-spinner" /> Restoring...</> : 'Restore Keys'}
                 </button>
-                <button type="button" className="secondary-button" onClick={() => { msgStore.warning('Key restore skipped.'); router.push('/chat'); }}>Skip</button>
+                <button type="button" className="secondary-button" onClick={() => { msgStore.warning('Key restore skipped.'); router.push(afterSignInPath()); }}>Skip</button>
               </div>
             </form>
           </div>

src/app/cli/authorize/page.jsx

@@ -6,6 +6,7 @@ import Link from 'next/link';
 import { useAuthStore } from '@/lib/stores/auth.js';
 import { postQuantumEncryption } from '@/lib/crypto/post-quantum-encryption.js';
 import { matchCode } from '@/lib/auth/cli-match.js';
+import { returnAfterSignIn } from '@/lib/auth/after-sign-in.js';
 
 /**
  * Approve a `qc login`. The terminal opened this page with a PKCE challenge,
@@ -54,13 +55,12 @@ function Authorize() {
         ...(k768?.publicKey && k768?.privateKey ? { keys768: { ...k768, algorithm: postQuantumEncryption.kemName768 } } : {}),
       };
       const keyBlob = await postQuantumEncryption.encryptForRecipient(JSON.stringify({ v: 1, ...keys }), kem);
-      const session = JSON.parse(localStorage.getItem('qrypt_session') || '{}');
+      // No Authorization here: the app's fetch wrapper adds the session token,
+      // refreshing it first, and retries once on 401. A hand-built header from
+      // localStorage skipped all that and failed with a bare "Unauthorized".
       const res = await fetch('/api/cli/authorize', {
         method: 'POST',
-        headers: {
-          'Content-Type': 'application/json',
-          ...(session.access_token ? { Authorization: `Bearer ${session.access_token}` } : {}),
-        },
+        headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({
           code_challenge: challenge,
           code_challenge_method: 'S256',
@@ -71,6 +71,11 @@ function Authorize() {
         }),
       });
       const body = await res.json().catch(() => ({}));
+      if (res.status === 401) {
+        // The wrapper signs a dead session out, which shows "Sign in again"
+        // below; a refresh that only failed for now lands here instead.
+        throw new Error('Your sign-in could not be confirmed. Reload this page and try again, or sign in again.');
+      }
       if (!res.ok || !body.code) throw new Error(body.error_description || body.error || `HTTP ${res.status}`);
       setStatus('done');
       if (redirectUri === 'oob') {
@@ -111,8 +116,17 @@ function Authorize() {
     content = (
       <>
         <h1>Sign in first</h1>
-        <p>Sign in to qrypt.chat in this browser, then open the link from your terminal again.</p>
-        <Link className="cli-btn primary" href="/auth">Sign in</Link>
+        <p>
+          Sign in to qrypt.chat in this browser (your session may have expired). You will come straight back here to
+          approve the terminal, so keep <code>qc login</code> running.
+        </p>
+        <Link
+          className="cli-btn primary"
+          href="/auth"
+          onClick={() => returnAfterSignIn(window.location.pathname + window.location.search)}
+        >
+          Sign in
+        </Link>
       </>
     );
   } else if (status === 'done' && oobCode) {

src/app/client-layout.jsx

@@ -14,8 +14,12 @@ import IncomingCallModal from '@/lib/components/voice-call/IncomingCallModal.jsx
 import ActiveCallInterface from '@/lib/components/voice-call/ActiveCallInterface.jsx';
 
 // Before anything fetches: every /api/ call carries the session as a Bearer
-// token, since passkey/CoinPay/phone sessions have no cookie.
-installApiAuth({ refresh: (token) => useAuthStore.getState().refreshSession(token) });
+// token, since passkey/CoinPay/phone sessions have no cookie. A session the
+// server has revoked signs out locally, keeping this device's E2EE keys.
+installApiAuth({
+  refresh: (token) => useAuthStore.getState().refreshSession(token),
+  onExpired: () => useAuthStore.getState().logout({ keepKeys: true }),
+});
 
 export default function ClientLayout({ children, footerBottom }) {
   const pathname = usePathname();

src/lib/api/auth-fetch.js

@@ -9,6 +9,11 @@
  * wrapped once: a request that names no Authorization gets the current token,
  * refreshed first when it is about to expire. Cookies still ride along, and
  * the server falls back to them if the token is refused.
+ *
+ * A token can also die before its expiry: rotating the auth server's signing
+ * keys (2026-10-28) made every stored token "Unauthorized" while the app still
+ * showed people signed in. So a 401 gets one refresh and one retry, and a
+ * refresh token the server no longer knows ends the session (`onExpired`).
  */
 
 const EARLY_MS = 30_000;
@@ -29,12 +34,32 @@ export async function currentAccessToken({ refresh, storage = globalThis.localSt
 	const expiresAt = Number(session.expires_at || 0) * 1000;
 	if (!expiresAt || expiresAt - Date.now() > EARLY_MS) return session.access_token;
 	if (!session.refresh_token || !refresh) return null;
-	// One refresh for every request that notices: refresh tokens rotate.
-	refreshing ??= Promise.resolve(refresh(session.refresh_token)).finally(() => {
+	const result = await refreshOnce(refresh, session.refresh_token);
+	return result?.success ? result.session.access_token : null;
+}
+
+/** One refresh for every request that notices: refresh tokens rotate. */
+function refreshOnce(refresh, refreshToken) {
+	refreshing ??= Promise.resolve(refresh(refreshToken)).finally(() => {
 		refreshing = null;
 	});
-	const result = await refreshing.catch(() => null);
-	return result?.success ? result.session.access_token : null;
+	return refreshing.catch(() => null);
+}
+
+/**
+ * The server refused `sent`. Returns a token worth one retry, or null.
+ * Calls onExpired when the refresh token itself is dead (a 4xx, not a blip).
+ */
+async function recoverToken({ sent, refresh, storage, onExpired }) {
+	const session = readSession(storage);
+	if (!session?.access_token) return null;
+	// Someone already refreshed since this request went out: use theirs.
+	if (session.access_token !== sent) return session.access_token;
+	if (!session.refresh_token || !refresh) return null;
+	const result = await refreshOnce(refresh, session.refresh_token);
+	if (result?.success) return result.session.access_token;
+	if (result && !result.transient) await onExpired?.();
+	return null;
 }
 
 /** Is this a request to our own /api/ (not the token endpoint itself)? */
@@ -49,27 +74,41 @@ export function isOwnApi(input, origin) {
 
 /**
  * Wrap `target.fetch` (window by default) once.
- * @param {{ target?: any, storage?: Storage, refresh?: (refreshToken: string) => Promise<{success: boolean, session?: any}> }} [options]
+ * @param {{ target?: any, storage?: Storage, refresh?: (refreshToken: string) => Promise<{success: boolean, session?: any, transient?: boolean}>, onExpired?: () => any }} [options]
  */
-export function installApiAuth({ target = typeof window !== 'undefined' ? window : undefined, refresh, storage } = {}) {
+export function installApiAuth({ target = typeof window !== 'undefined' ? window : undefined, refresh, storage, onExpired } = {}) {
 	if (!target?.fetch || target.__qryptApiAuth) return;
 	target.__qryptApiAuth = true;
 	const original = target.fetch.bind(target);
 	target.fetch = async (input, init = {}) => {
+		const store = storage ?? target.localStorage;
+		let sent = null;
 		try {
 			if (isOwnApi(input, target.location?.origin)) {
 				const headers = new Headers(init.headers ?? (input instanceof Request ? input.headers : undefined));
 				if (!headers.has('authorization')) {
-					const token = await currentAccessToken({ refresh, storage: storage ?? target.localStorage });
+					const token = await currentAccessToken({ refresh, storage: store });
 					if (token) {
 						headers.set('authorization', `Bearer ${token}`);
 						init = { ...init, headers };
+						sent = token;
 					}
 				}
 			}
 		} catch {
 			// Never let the wrapper break a request; send it as it was.
 		}
-		return original(input, init);
+		const response = await original(input, init);
+		// A Request's body is spent by the first send, so only plain calls retry.
+		if (response.status !== 401 || !sent || input instanceof Request) return response;
+		try {
+			const token = await recoverToken({ sent, refresh, storage: store, onExpired });
+			if (!token) return response;
+			const headers = new Headers(init.headers);
+			headers.set('authorization', `Bearer ${token}`);
+			return await original(input, { ...init, headers });
+		} catch {
+			return response;
+		}
 	};
 }

src/lib/api/auth-fetch.test.js

@@ -63,6 +63,37 @@ describe('installApiAuth', () => {
 		expect(w.calls[0].auth).toBeNull();
 	});
 
+	it('refreshes and retries once when a live-looking token is refused (signing keys rotated)', async () => {
+		session(3600, 'dead');
+		const refresh = vi.fn(async () => {
+			storage.setItem('qrypt_session', JSON.stringify({ access_token: 'new', refresh_token: 'r2', expires_at: Date.now() / 1000 + 3600 }));
+			return { success: true, session: { access_token: 'new' } };
+		});
+		const w = fakeWindow();
+		w.fetch.mockImplementation(async (input, init = {}) => {
+			const auth = new Headers(init.headers).get('authorization');
+			w.calls.push({ input, auth });
+			return new Response('{}', { status: auth === 'Bearer dead' ? 401 : 200 });
+		});
+		installApiAuth({ target: w, refresh });
+		const res = await w.fetch('/api/cli/authorize', { method: 'POST', body: '{}' });
+		expect(res.status).toBe(200);
+		expect(refresh).toHaveBeenCalledTimes(1);
+		expect(w.calls.map((c) => c.auth)).toEqual(['Bearer dead', 'Bearer new']);
+	});
+
+	it('ends the session when the refresh token is dead too, but not on a blip', async () => {
+		for (const [result, expired] of [[{ success: false, transient: false }, 1], [{ success: false, transient: true }, 0]]) {
+			session(3600, 'dead');
+			const onExpired = vi.fn();
+			const w = fakeWindow();
+			w.fetch.mockImplementation(async () => new Response('{}', { status: 401 }));
+			installApiAuth({ target: w, refresh: async () => result, onExpired });
+			expect((await w.fetch('/api/x')).status).toBe(401);
+			expect(onExpired).toHaveBeenCalledTimes(expired);
+		}
+	});
+
 	it('never targets the token endpoint itself', () => {
 		expect(isOwnApi('/api/cli/token', ORIGIN)).toBe(false);
 		expect(isOwnApi('/api/messages/send', ORIGIN)).toBe(true);

src/lib/auth/after-sign-in.js

@@ -0,0 +1,25 @@
+/**
+ * Where /auth sends someone once they are signed in. Normally /chat; a page
+ * that needed a sign-in first (a `qc login` approval) can ask to come back.
+ * Only our own /cli/authorize is accepted, so this is never an open redirect.
+ */
+
+const KEY = 'qrypt_after_sign_in';
+const ALLOWED = /^\/cli\/authorize\?[^\s\\]*$/;
+
+/** Remember `path` (e.g. location.pathname + location.search) for after sign-in. */
+export function returnAfterSignIn(path, storage = globalThis.sessionStorage) {
+	try {
+		if (ALLOWED.test(path)) storage?.setItem(KEY, path);
+	} catch {}
+}
+
+/** The path to go to now that sign-in finished; forgets it once read. */
+export function afterSignInPath(storage = globalThis.sessionStorage) {
+	try {
+		const path = storage?.getItem(KEY);
+		storage?.removeItem(KEY);
+		if (path && ALLOWED.test(path)) return path;
+	} catch {}
+	return '/chat';
+}

src/lib/auth/after-sign-in.test.js

@@ -0,0 +1,24 @@
+import { describe, expect, it } from 'vitest';
+import { afterSignInPath, returnAfterSignIn } from './after-sign-in.js';
+
+function memory() {
+	const m = new Map();
+	return { getItem: (k) => m.get(k) ?? null, setItem: (k, v) => m.set(k, v), removeItem: (k) => m.delete(k) };
+}
+
+describe('after sign-in return path', () => {
+	it('comes back to a qc login approval once, then goes to /chat', () => {
+		const s = memory();
+		returnAfterSignIn('/cli/authorize?code_challenge=abc&state=x', s);
+		expect(afterSignInPath(s)).toBe('/cli/authorize?code_challenge=abc&state=x');
+		expect(afterSignInPath(s)).toBe('/chat');
+	});
+
+	it('refuses anything that is not our own approval page', () => {
+		const s = memory();
+		for (const p of ['https://evil.example/cli/authorize?x', '//evil.example/x', '/settings', '/cli/authorize']) {
+			returnAfterSignIn(p, s);
+			expect(afterSignInPath(s)).toBe('/chat');
+		}
+	});
+});