Session refresh route is a stub and never refreshes the access token

[therealjhay]

Problemapp/api/auth/refresh/route.ts only rotates the CSRF cookie; there is no real access-token refresh, no POST // to the backend refresh endpoint, and no handling of expired refresh tokens. The comment in the code explicitly marks real token refresh as a TODO.

1. SessionTimeoutModal "extend session" button calls /api/auth/refresh which returns success but does not extend the server-side session.
2. The axios single-flight refresh (lib/api/refreshQueue/lib/api/axios.ts) also calls /api/auth/refresh on 401, gets no new access token, and therefore can never truly unblock queued requests.
3. The jti blocklist logic referenced from the backend has no frontend counterpart, so the client cannot know a token is revoked until the server rejects it.

Solution

• Implement the refresh route to exchange the session for a new access token against the backend.
• Propagate the new token into the axios instance and the auth store atomically with the queued-retry path.
• Surface a clear "session expired" state when the refresh token itself is invalid.

Acceptance Criteria

• Extending session in SessionTimeoutModal results in a refreshed access token (verified via network tab).
• After a 401, queued requests retry with the new token and succeed.
• Expired refresh tokens redirect to login once, without toast spam.
• npm run build passes.

Note for Contributors: Write a clear PR description. Include a network-tab screenshot showing the refresh call returning a new token and the subsequent replayed request succeeding.

[johnmic0132]

@johnmic0132 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi Maintainer! I’d love to take on this issue and get it done efficiently. Kindly assign it to me.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @johnmic0132 to this issue.

[stephanieoghenemega-eng]

@stephanieoghenemega-eng has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

hello, kkindly assign

ℹ️ Repo Maintainers: To accept this application, review their application or assign @stephanieoghenemega-eng to this issue.

[drips-wave]

Congratulations, @stephanieoghenemega-eng! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on August 31, 2026.

🧑‍💻 @stephanieoghenemega-eng: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊