Use session storage for cached JWT

[buckett]

Summary

• switch the LTI token retriever to read JWTs from sessionStorage instead of localStorage
• ensure cached data handling still guards against missing or malformed entries

Testing

• Not run (not requested)

[Copilot]

Pull request overview

This PR updates the LTI token retriever’s cached-JWT lookup to use sessionStorage (matching the existing write path) instead of localStorage, improving cache consistency for token fallback behavior.

Changes:

• Read cached JWT from sessionStorage in loadJwt().
• Keep existing cached data parsing/handling behavior for missing entries.

Comments suppressed due to low confidence (2)

src/components/tokenRetriever/LtiTokenRetriever.tsx:158

• loadJwt() rethrows any non-DOMException errors. A malformed cached value will cause JSON.parse(stored) to throw a SyntaxError, which will bubble up and show an internal parse error message instead of treating the cache as a miss (and contradicts the intent to guard against malformed entries). Consider catching parse/shape errors and returning null (optionally clearing the bad jwt entry) rather than rethrowing.

      const stored = sessionStorage.getItem('jwt');
      if (!stored) return null;
      const data = JSON.parse(stored);
      if (!data) return null;

      return data.token ?? null;
    } catch (e) {
      if (!(e instanceof DOMException)) {
        throw e;
      }

src/components/tokenRetriever/LtiTokenRetriever.tsx:155

• The cached-JWT fallback path (including reading from sessionStorage and handling missing/malformed entries) isn’t covered by tests in LtiTokenRetriever.test.jsx. Add test cases for: (1) non-OK token response uses the cached JWT, (2) missing cache shows the generic failure message, and (3) malformed cache contents are ignored rather than surfacing a JSON parse error.

      const stored = sessionStorage.getItem('jwt');
      if (!stored) return null;
      const data = JSON.parse(stored);
      if (!data) return null;

      return data.token ?? null;
    } catch (e) {

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sebastianchristopher]

lgtm