oriolrius/pki-manager-web v3.7.1

v3.7.1 — Idle-session auth fix + KRL puller cleanup

on GitHub

Idle-session auth fix + puller cleanup

Monorepo version bump 3.7.0 → 3.7.1 (root/frontend/backend). Patch release.

Fixes

• fix(auth) (TASK-193) — stop tRPC 401s after an idle session. In production the
  app authenticates via the hand-rolled manual token flow, whose tokens live in
  localStorage but are not managed by oidc-client-ts — so automaticSilentRenew
  never renewed them. Once the short-lived access token expired, requests went out with no
  Authorization header → backend 401 ("Error loading hosts"), recoverable only by a full
  page reload. token.ts now transparently refreshes on demand using the stored
  refresh_token (grant_type=refresh_token) when the token is expired or within a 60s
  buffer, with single-flight dedup so batched/racing requests trigger at most one refresh.
  Rotated tokens are persisted; a rejected refresh clears the stored token so the app falls
  back to the login redirect (same recovery a reload gives).

Cleanup

• chore(ssh) (TASK-194) — removed the obsolete services/krl-distributor/ shell
  puller. It was the first-generation host-side KRL puller (host_puller.sh + systemd
  unit/timer) that decrypted via the KMS-resident ECIES model (cosmian kms ec decrypt).
  That model was retired by decision-015 / KRLC-02 in favour of local-key decryption, so
  the shell puller could no longer decrypt what the backend produces. The Go krl-client
  is now the single supported puller; the Ansible README/role and the SSH host-blocks runbook
  were updated to match.

Release artifacts (krl-client)

Full Changelog: v3.7.0...v3.7.1