yarm6mesq: Refresh expired tokens and revoke on sign-out

src/lib/session-store.ts

@@ -20,6 +20,8 @@ export interface SessionData {
   profileAccessTokenExpiresAt: number | null;
   profileRefreshToken: string;
   feedAccessToken: string;
+  /** Epoch milliseconds when the feed access token expires, or null if unknown. */
+  feedAccessTokenExpiresAt: number | null;
   person: SessionPerson;
   createdAt: number;
 }
@@ -43,6 +45,15 @@ export function getSession(id: string): SessionData | null {
   return store.get(id) ?? null;
 }
 
+/**
+ * Replace the data for an existing session. Used after a token refresh to
+ * persist the new tokens. A no-op when the session is already gone, so a
+ * refresh cannot resurrect a signed-out session.
+ */
+export function updateSession(id: string, data: SessionData): void {
+  if (store.has(id)) store.set(id, data);
+}
+
 export function deleteSession(id: string): void {
   store.delete(id);
 }