From e04975915e7b0815c3812d9b4a30811240cac299 Mon Sep 17 00:00:00 2001
From: John Coffey <johnellis@linux.com>
Date: Sat, 19 Sep 2026 10:09:28 -0700
Subject: [PATCH] Dev sign-in bypass renews itself with a refresh token

VITE_REFRESH_TOKEN, when set next to VITE_ACCESS_TOKEN, is handed to the
admin with the server's token endpoint, so the ordinary refresh keeps a
dev session alive instead of it ending when the access token expires.
---
 src/pages/AdminPanel.tsx | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/pages/AdminPanel.tsx b/src/pages/AdminPanel.tsx
index 9e2dda7..8ede198 100644
--- a/src/pages/AdminPanel.tsx
+++ b/src/pages/AdminPanel.tsx
@@ -13,6 +13,7 @@ import { useSchemaStore } from '@/stores/schemaStore';
 import { useAccountStore } from '@/stores/accountStore';
 import { useUIStore } from '@/stores/uiStore';
 import { fetchSession, fetchSchema, fetchAccountInfo } from '@/services/jmap/client';
+import { getApiBaseUrl } from '@/services/api';
 import { loadAccountTheme, setAccountSettingsTarget } from '@/lib/accountSettings';
 import { setLocale } from '@/i18n';
 import { TopBar } from '@/components/layout/TopBar';
@@ -117,7 +118,13 @@ export default function AdminPanel() {
   useEffect(() => {
     const bypassToken = import.meta.env.VITE_ACCESS_TOKEN;
     if (bypassToken && !accessToken) {
-      useAuthStore.getState().setTokens(bypassToken, '', 86400, '');
+      // INBUXA: with a refresh token as well, the dev bypass renews itself like a real
+      // sign-in instead of dying when the access token does.
+      const bypassRefresh = (import.meta.env.VITE_REFRESH_TOKEN as string | undefined) ?? '';
+      const expiresIn = Number(import.meta.env.VITE_ACCESS_TOKEN_EXPIRES_IN ?? 86400);
+      useAuthStore
+        .getState()
+        .setTokens(bypassToken, bypassRefresh, expiresIn, bypassRefresh ? `${getApiBaseUrl()}/auth/token` : '');
     }
   }, [accessToken]);