OI-34 Changing code to only allow stewards to log in

[sedv8808]

This pull request improves the authentication flow and user feedback for ORCID logins, focusing on session expiry handling, error messaging, and consistency of user state. The main changes clarify session validation logic, ensure error messages are visible to users, and synchronize session expiry information with the backend.

Authentication and session management improvements:

• Refactored token validation logic in useTokens to check for the presence of an ORCID token rather than relying on hasValidTokens, preventing stale or expired sessions from blocking new logins and avoiding accidental token clearing.
• Introduced a sessionExpiry helper to consistently parse and check session expiry from the backend, ensuring that local session checks align with backend enforcement and that expired sessions are correctly detected and handled.
• Updated the steward check to use the /v2.0/apps/orcids/steward endpoint and synchronize the session's expiry time in state with the server, so the frontend always checks the latest expiry.

User feedback and error handling:

• Enhanced error handling during token validation: if validation fails, the API's human-readable error message is now displayed to the user, improving transparency for issues like expired tokens or insufficient permissions.
• Added error state and messaging to the ORCID login UI (OrcidLogin.vue), clearing old errors on new login attempts and displaying styled error messages when login is refused. [1] [2] [3] [4]

Tooling:

• Declared the Yarn package manager version in package.json for reproducible installs.

[Copilot]

Pull request overview

This PR updates the ORCID authentication/session flow to enforce steward-only access, improve handling of expired sessions, and surface backend-provided login failure reasons to the user. It also pins the Yarn version via packageManager for more reproducible installs.

Changes:

• Refactors token validation to gate on presence of an ORCID access token (not hasValidTokens) and preserves the backend response shape in state.user.
• Adds session-expiry parsing via expiresat, uses the steward endpoint for session refresh, and syncs expiry back into in-memory state.
• Displays login refusal reasons in the ORCID login header UI and clears stale errors on new login attempts.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
src/views/pagedecorators/headercomponents/OrcidLogin.vue	Clears prior auth errors on login and displays backend refusal messages in the header UI.
src/stores/auth.store.js	Updates validation gating, introduces session-expiry parsing, switches refresh to steward endpoint, and syncs expiry data.
package.json	Pins Yarn via packageManager for consistent dependency installs.

Suppressed comments (1)

src/stores/auth.store.js:163

• Avoid side effects inside computed getters. Calling logoutTokens() from within hasValidTokens can cause surprising cascades (it mutates reactive state during evaluation) and makes the computed non-pure. Prefer returning false here and triggering logout from an explicit action (e.g., refreshSession, a watcher, or request error handling).

        const expiresAt = sessionExpiry()
        if (expiresAt !== null && Date.now() >= expiresAt) {
            console.log('Neotoma session has expired')
            logoutTokens()
            return false

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.