fix: 비회원 게스트 토큰 영속 저장 누락 — 앱 재시작 시 아이템 삭제 403 - #288
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
📝 WalkthroughWalkthrough로그인 페이지가 Changes게스트 토큰 동기화
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches📝 Generate docstrings
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
|
@coderabbitai full review |
✅ Action performedFull review finished. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/web/src/app/login/page.tsx`:
- Around line 20-24: The `/login` flow in `page.tsx` only checks `access_token`
in the `action` guard, which can expose `LoginButtons` and allow a new guest
session before session restoration is attempted. Update the login-page logic to
first try restoring the session with `refresh_token` (or the existing
refresh-based restore path), and only render the login UI or allow guest login
when that restore fails. Keep the change localized around the `page` component
and the `LoginButtons` rendering so the guest button cannot create a new session
while a valid refresh session still exists.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: 77aa9a72-74c0-4b66-b331-3889ceb7133d
📒 Files selected for processing (2)
apps/web/src/app/login/_hooks/usePostGuestLogin.tsapps/web/src/app/login/page.tsx
Comment on lines
+20
to
+24
| if (!action) { | ||
| const cookieStore = await cookies(); | ||
| const accessToken = cookieStore.get('access_token')?.value; | ||
| if (accessToken && isTokenValid(accessToken)) { | ||
| redirect(isValidLoginRedirectPath(redirectParam) ? redirectParam : ROUTES.HOME); |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
refresh_token 복원 실패 전에는 새 게스트 로그인을 노출하지 마세요.
현재 /login 스킵 조건이 access_token 유효성만 봅니다. usePostGuestLogin은 access 쿠키를 15분, refresh 쿠키를 14일로 저장하므로, 앱 재시작 시 access만 만료된 상태에서는 Line 38의 LoginButtons가 렌더링되고 게스트 버튼이 새 게스트 세션을 만들 수 있습니다. refresh_token으로 세션 복원을 먼저 시도하고 실패한 경우에만 로그인 UI/게스트 생성을 허용해 주세요.
Also applies to: 38-38
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@apps/web/src/app/login/page.tsx` around lines 20 - 24, The `/login` flow in
`page.tsx` only checks `access_token` in the `action` guard, which can expose
`LoginButtons` and allow a new guest session before session restoration is
attempted. Update the login-page logic to first try restoring the session with
`refresh_token` (or the existing refresh-based restore path), and only render
the login UI or allow guest login when that restore fails. Keep the change
localized around the `page` component and the `LoginButtons` rendering so the
guest button cannot create a new session while a valid refresh session still
exists.
iOdiO89
pushed a commit
that referenced
this pull request
Jul 19, 2026
* feat(@piki/core): WEB_REQ_TOKEN_REFRESHED 웹브릿지 메시지 타입 추가 * fix: 비회원 게스트 세션 앱 재시작 후 복원 --------- Co-authored-by: soyeong <mb535622@sookmyung.ac.kr>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
작업 요약
작업 세부 내용
@piki/core에WEB_REQ_TOKEN_REFRESHED웹브릿지 메시지 타입 및 상수 추가TokenStorage(SecureStore)에 영속 저장TokenStorage토큰을WKHTTPCookieStore에 주입해 기존 게스트 세션 복원WKHTTPCookieStore → TokenStorage동기화 (proxy 서버사이드 토큰 갱신 대응)/loginRSC에서 유효한 세션이 존재하면 로그인 페이지를 건너뛰고/home으로 자동 리다이렉트연관 이슈
closes #285
Summary by CodeRabbit