feat: Share one session across tabs (M2-11052)

[sricharan-varanasi]

📝 Description

🔗 Jira Ticket M2-11052

#2249 moved tokens into one shared, encrypted slot. But react-secure-storage reads from a snapshot taken when the page loads, so a tab still can't see what another tab wrote.

That leaves three problems:

• Tab A rotates the token, tab B keeps using the old one, and the retry revokes the family for both
• Tab A logs out, tab B keeps showing a signed-in UI over a dead session
• A tab sitting on the login page doesn't notice a sign-in elsewhere

Tabs now talk over a BroadcastChannel.

Changes include:

• Rotated tokens, logout, and session hand-off sync across tabs
• A tab on the login page joins a session started elsewhere, or reloads into one if no other tab is left
• A frozen tab catches up on focus, or tears down if the session ended while it slept
• An idle logout no longer gets caught by the builder's unsaved-changes prompt

The main bug - a background tab logging out the tab you're actually using - is fixed by one line. The idle clock is shared now, so the timer just re-reads it instead of firing blind.

🪤 Peer Testing

Needs enableSessionKeepAlive on locally, REACT_APP_IDLE_TIMEOUT_MIN=3, REACT_APP_REFRESH_LEAD_SEC=20.

Use chrome://discards (or edge://discards) → Freeze for the frozen-tab steps.

• Two tabs. Work in tab A past the idle timeout, leave tab B in the background

  Expected outcome: neither logs out

• Two tabs. Wait for a rotation, then click something in tab B

  Expected outcome: one refresh call across the browser, and tab B doesn't 401

• Log out in tab A

  Expected outcome: tab B goes to the login page straight away

• Edit something in the builder, then idle out

  Expected outcome: soft-lock login, no unsaved-changes modal

• Edit something in the builder, then log out from the account menu

  Expected outcome: the save/discard prompt still appears

• Freeze a tab, rotate a few times elsewhere, then focus it

  Expected outcome: it catches up, no 401

• Freeze tab B, log out in tab A, focus tab B

  Expected outcome: tab B tears down on focus

• Leave tab A on the login page, sign in on tab B

  Expected outcome: tab A moves to the dashboard. Close tab B first and tab A reloads once instead

• Flag off

  Expected outcome: no channel traffic, no idle logout, same as feat: Move tokens to local storage (M2-11055) #2249 alone

✏️ Notes

• Base is session-storage-local (feat: Move tokens to local storage (M2-11055) #2249), which sits on session-keep-alive (feat: keep session alive on Admin ( M2 - 11001 ) #2246). Merge in order.
• Supersedes feat: Share session between tabs via BroadcastChannel (M2-11052) #2247. Five of its nine commits are cherry-picked; the rest no longer apply.
• Two fixes ship unflagged: the idle-timer fix and the failed-refresh logout. Neither is about tab sync.

✅ Checklist

Functionality

• The feature behaves correctly in practice and fulfills the intended business purpose
• The implementation accounts for edge cases, avoids subtle logical errors, and handles somewhat rare failure states (e.g. offline mode for mobile, 3rd party being down, etc)

Testing

• Verify there are automated tests added that meaningfully cover critical behavior and failure cases
• Code coverage does not go down as result of this change
• Test suite passes

Security & Data Privacy

• Verify there is no chance we would accidentally log PII to application logs
• Verify this addition does not materially affect our security attack surface, and if so it has undergone security review
• All inputs are sanitized
• New dependencies are well maintained, have significant justification for being added to the project, and are documented in the Curious open source credit page - none added

Logging/Monitoring

• Logging is implemented for this change such that you could troubleshoot this feature in production — none added
• The change/feature is able to be monitored in production — none added

Performance

• This change does not introduce n+1 queries or other performance issues within our expected scale (e.g. missing indexes on frequently queried columns, frequently updating tables that are accessed often)

Readability

• All commented out code is removed
• Debugging code including extraneous log lines are removed
• Code is easy to understand through naming and structure; comments explain intent or non‑obvious decisions

Change Safety

• Backend changes are backwards compatible with old clients, or it is well known they are not and a deployment/rollout plan is in place. This include backend changes being compatible with old mobile app versions, as well as applet versioning within Curious.
• Destructive database migrations are rolled out in stages. For example, renaming a column means adding a new column and migrating the existing data to that columns in one deployment. Then monitoring to ensure that field isn't used, and finally removing that old column in a separate deployment.