Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/synthorg/api/app.py`:
- Around line 1281-1294: Remove the refresh endpoint from the CSRF exemption set
so `/auth/refresh` is subject to double-submit CSRF validation: edit the
csrf_exempt frozenset (used when calling create_csrf_middleware_class(auth,
exempt_paths=csrf_exempt)) to delete the f"{prefix}/auth/refresh" entry,
ensuring the refresh POST remains protected by the same X-CSRF-Token requirement
as other cookie-authenticated endpoints.

In `@src/synthorg/api/auth/controller.py`:
- Around line 512-534: Remove the redundant call to _get_auth_config by reusing
the auth_config already retrieved when app_state.has_session_store is true;
ensure auth_config (from the first _get_auth_config(app_state) used for
app_state.session_store.enforce_session_limit(user.id,
auth_config.max_concurrent_sessions)) is in scope and passed to
_make_session_cookies(token, expires_in, auth_config) instead of calling
_get_auth_config a second time.
- Around line 612-633: Redundant call to _get_auth_config: remove the second
invocation and reuse the auth_config obtained before calling
app_state.session_store.enforce_session_limit; specifically, keep auth_config =
_get_auth_config(app_state) before enforce_session_limit and pass that same
auth_config into _make_session_cookies and Response creation instead of calling
_get_auth_config(app_state) again, ensuring app_state, _get_auth_config,
session_store.enforce_session_limit, Response, and _make_session_cookies are
referenced accordingly.

In `@src/synthorg/api/auth/session_store.py`:
- Around line 241-247: The code doesn't guard against negative max_sessions
which makes excess positive and can revoke sessions; change the early check to
treat negatives as zero—replace the current "if max_sessions == 0: return 0"
with a defensive check like "if max_sessions <= 0: return 0" (or clamp
max_sessions via max_sessions = max(0, max_sessions)) so that the later
computation using self.list_by_user(user_id) and excess = len(active) -
max_sessions cannot mistakenly revoke sessions when max_sessions is negative.

In `@src/synthorg/api/errors.py`:
- Around line 271-279: The constructor (__init__) currently accepts negative
retry_after values which can produce invalid Retry-After headers; update the
__init__ for this 429 error class to validate the retry_after parameter by
coercing it to an int and clamping it to a minimum of 0 (e.g., self.retry_after
= max(0, int(retry_after))) so negative inputs become 0 and non-int values are
safely converted; preserve the existing super().__init__(message,
status_code=429) behavior and ensure the attribute name retry_after is set after
validation.

In `@src/synthorg/persistence/sqlite/schema.sql`:
- Around line 509-510: Add a separate single-column index on
login_attempts.attempted_at to support TTL cleanup queries; specifically create
an index (e.g., idx_la_attempted_at) on the attempted_at column so cleanup
queries that filter by attempted_at can use the index instead of full-scanning
the login_attempts table (this complements the existing
idx_la_username_attempted index).
- Around line 513-526: Refresh token consumption currently ignores session
revocation: update RefreshStore.consume() (or the refresh endpoint flow) to
reject tokens whose session has been revoked by either (a) modifying the SQL in
RefreshStore.consume() to join refresh_tokens with sessions and enforce
sessions.revoked = 0 when selecting the token, or (b) after successfully
consuming the token call SessionStore.is_revoked(session_id) and abort issuance
if it returns true; reference the refresh_tokens table and the
SessionStore.is_revoked(session_id) method when implementing the check so
revoked sessions cannot mint new credentials.

In `@tests/unit/api/auth/test_config.py`:
- Around line 66-69: Replace the for-loop in test_cookie_samesite_accepts_valid
with pytest parameterization so each samesite value is a separate test case;
specifically convert test_cookie_samesite_accepts_valid to use
`@pytest.mark.parametrize` on values ("strict","lax","none") and assert that
AuthConfig(cookie_samesite=value).cookie_samesite == value, keeping the test
name or renaming if desired for clarity.

In `@tests/unit/api/auth/test_lockout_store.py`:
- Around line 126-131: The test uses LockoutStore.__new__(LockoutStore) which
bypasses __init__ and yields a partially initialized object; change the test in
TestLockoutDurationSeconds to construct a real LockoutStore via its normal
constructor (instead of __new__) and supply/mocking any required DB or
dependencies (or use dependency injection/mocker fixture) so you can set
duration via _make_config(duration_minutes=15) and then assert
store.lockout_duration_seconds == 900; reference the LockoutStore class, its
lockout_duration_seconds property, and the _make_config helper when replacing
the __new__ pattern with a proper instantiation and mocked connection.

In `@tests/unit/api/auth/test_middleware.py`:
- Around line 804-816: Extract a reusable fake state factory or base class to
remove duplication between _RevokedState and _CustomState: create a factory
function (e.g., make_fake_state) or a base class (e.g., FakeState) that accepts
optional overrides for attributes like auth_service, persistence,
has_session_store, session_store, and config, then replace both _RevokedState
and _CustomState instantiations with calls to the factory or subclasses that
only supply differing values; update usages around app.state["app_state"]
assignments in the tests to call the new factory to ensure consistent state
shape across tests.

In `@tests/unit/api/controllers/test_ws.py`:
- Around line 278-279: The test currently hard-codes auth middleware as
middleware[2]; instead, locate the auth middleware by type/shape to avoid
brittle ordering. Replace uses of middleware[2] (variable auth_cls) with a
search like next(m for m in middleware if getattr(m, "__name__", "") ==
"AuthMiddleware" or hasattr(m, "authenticate") or isinstance(m,
AuthMiddlewareClass)) to find the auth middleware by its class name or
distinguishing attribute, and apply the same change to the other occurrence that
mirrors lines 398-399 so both tests stop relying on positional indexing.

In `@web/src/hooks/useWebSocket.ts`:
- Around line 49-55: When authStatus transitions to 'unauthenticated' the
WebSocket transport is left running; update auth.ts so handleUnauthorized() (and
logout() if present) calls useWebSocketStore.getState().disconnect() to
explicitly tear down the socket and stop reconnection attempts. Locate
handleUnauthorized and logout in auth.ts and invoke
useWebSocketStore.getState().disconnect() right after you set authStatus/unset
tokens so the store's shouldBeConnected is cleared and the transport is fully
closed.

In `@web/src/mocks/handlers/auth.ts`:
- Around line 10-20: authLoginSuccess and authSetupSuccess currently return only
a JSON body (via HttpResponse.json(apiSuccess(mockAuthResponse))) so the CSRF
interceptor never sees a csrf_token cookie; update these handlers to also model
the Set-Cookie for csrf_token (e.g., return a response with a Set-Cookie:
csrf_token=... header) or explicitly set document.cookie with the csrf_token
inside the handler before returning the response so that getCsrfToken()/the CSRF
interceptor will attach X-CSRF-Token on subsequent POST/PUT/PATCH/DELETE
requests.

In `@web/src/router/guards.tsx`:
- Around line 52-59: SetupCompleteGuard still uses useIsAuthenticated() and
doesn't call checkSession, so replace its reliance on useIsAuthenticated with
the tri-state pattern: import and use useAuthStatus() and the checkSession
selector from useAuthStore inside SetupCompleteGuard, call checkSession() inside
a useEffect when authStatus === 'unknown', and treat the 'unknown' state as "not
resolved" (i.e., prevent rendering or redirect until authStatus is
'authenticated' or 'unauthenticated') so the route fails closed on hard
refreshes with a session cookie.

In `@web/src/stores/auth.ts`:
- Around line 148-164: In checkSession (the async method using authApi.getMe and
isAxiosError), avoid forcing authStatus to 'unauthenticated' on
transient/non-401 errors; instead log the error with getErrorMessage(err) and
preserve the current session state by leaving authStatus as 'unknown' (or
explicitly set it to 'unknown') so we don't drop valid sessions on network/5xx
failures; only set authStatus to 'unauthenticated' when err.response?.status ===
401. Optionally add a short retry/backoff around authApi.getMe if you want
automatic recovery.

In `@web/src/utils/csrf.ts`:
- Around line 16-19: The cookie parsing truncates CSRF tokens that contain '='
because it uses match.split('=')[1]; change the extraction to take everything
after the first '=' (e.g., use match.indexOf('=') + 1 and substring/slice) so
the full value is preserved, then pass that full substring into
decodeURIComponent; update the logic around the match variable (the same place
where match.split('=')[1] is used) to avoid splitting on all '=' characters.

---

Outside diff comments:
In `@src/synthorg/api/auth/controller.py`:
- Around line 702-737: The current flow creates a new token with
auth_service.create_token(updated_user) and calls _create_session without
revoking the old session derived from the incoming request, leaving the previous
JWT valid; before calling create_token and _create_session, extract the current
session identifier from the request (e.g., request.state.session_id or decode
the incoming JWT) and call the session-revocation method on the same service
used elsewhere (e.g., auth_service.revoke_session or
auth_service.delete_session) to invalidate the old session, then proceed to
create the new token and session and return cookies via _make_session_cookies.

In `@web/src/__tests__/api/client-bypass.test.ts`:
- Around line 11-21: The test currently only asserts the interceptor rejection
but not that auth cleanup wasn't invoked; add a spy/mock on the
handleUnauthorized function (or the module/export that performs cleanup) before
calling apiClient.interceptors.response.handlers?.[0]?.rejected and then assert
that handleUnauthorized was not called (e.g.,
expect(handleUnauthorizedSpy).not.toHaveBeenCalled()) after awaiting the
rejected promise; keep the existing AxiosError creation and rejection assertion
but add this negative assertion referencing handleUnauthorized and the
interceptor rejection handler to ensure no cleanup ran.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/synthorg/api/auth/controller.py`:
- Around line 229-249: _make_session_cookies currently only builds the session
and CSRF cookies so when refresh tokens are enabled the initial refresh cookie
is never sent; update _make_session_cookies(token, expires_in, config) to also
create and include the refresh cookie (using make_refresh_cookie(...) with the
proper refresh token lifetime/contents) when the AuthConfig indicates refresh
tokens are enabled, and ensure callers (setup, login, change_password) that
reuse _make_session_cookies receive that extra cookie automatically; reference
make_session_cookie, make_csrf_cookie, make_refresh_cookie, generate_csrf_token,
and the setup/login/change_password usages to locate where to add the
conditional append.
- Around line 968-972: The logout path currently dereferences
app_state.session_store whenever _extract_jti(request) returns a jti, causing a
500 if no session store is configured; guard that logic by checking the existing
has_session_store predicate (or a similar boolean on app_state) before accessing
app_state.session_store and calling store.revoke(jti). Concretely, after jti =
_extract_jti(request) fetch app_state as before, then only retrieve store =
app_state.session_store and await store.revoke(jti) if
app_state.has_session_store() (or getattr/app_state attribute check) so
deployments without a session store simply skip revoke and continue clearing
cookies.
- Around line 582-599: The branch that handles failed passwords calls
app_state.lockout_store.record_failure but ignores its boolean return; change it
to capture the result (e.g. locked = await
app_state.lockout_store.record_failure(data.username, ip_address=ip)) and if
locked is True raise the lockout response (AccountLockedError or the appropriate
lockout error/response) instead of UnauthorizedError, otherwise continue to log
and raise UnauthorizedError; update the code paths around record_failure,
UnauthorizedError, and AccountLockedError to ensure the request that crosses the
threshold immediately returns the lockout response.

In `@src/synthorg/api/auth/refresh_store.py`:
- Around line 69-98: The create(), revoke_by_session(), revoke_by_user(), and
cleanup_expired() methods are missing INFO-level audit logs for state-changing
refresh-token operations; add an INFO log in each (e.g., immediately after the
DB commit) that records the action ("refresh_token.created",
"refresh_token.revoked_by_session", "refresh_token.revoked_by_user",
"refresh_token.cleaned_expired"), includes non-secret identifying fields
(token_hash or session_id or user_id or number of rows affected), and uses the
same logger used elsewhere in this module (referencing the create,
revoke_by_session, revoke_by_user, and cleanup_expired symbols) so issuance and
bulk revocations are auditable without exposing secret token material.

In `@web/src/stores/auth.ts`:
- Around line 93-101: The logout flow currently calls get().handleUnauthorized()
even when authApi.logout() throws, causing a local-only logout when the server
still has a valid HttpOnly cookie; modify the logout method so
handleUnauthorized() is only invoked when authApi.logout() completes
successfully (or when the API response explicitly confirms session cleared),
i.e., move the call into the try block after await authApi.logout() (or check a
success flag/response) and do NOT call handleUnauthorized() inside the catch so
the client doesn't mark the user logged out when the server didn't clear the
cookie; reference the logout method, authApi.logout(), handleUnauthorized(), and
checkSession() when making this change.

In `@web/src/utils/csrf.ts`:
- Around line 16-22: The CSRF cookie parsing can throw when decodeURIComponent
encounters malformed encoding; update the function that reads document.cookie
(the block using match, eqIdx and decodeURIComponent) to wrap the
decodeURIComponent call in a try/catch and return null on any exception so
malformed cookie values don't throw and break request interception; preserve the
existing behavior of returning null for missing or malformed values.

---

Outside diff comments:
In `@src/synthorg/api/auth/controller.py`:
- Around line 360-391: _extract_jti currently returns None if a session cookie
exists but is invalid because it doesn't fall back to the Authorization header;
change it to mirror the middleware by attempting to decode the cookie token
first (using app_state.auth_service.decode_token) and if decoding raises
jwt.InvalidTokenError or other decode failure, then attempt to read and decode
the Bearer token from the Authorization header (auth_config.cookie_name,
request.cookies, request.headers["authorization"]). Ensure both decode attempts
log similarly (API_AUTH_FAILED with distinct reasons) and that the function
returns the jti from whichever token successfully decodes or None only if both
attempts fail.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/synthorg/api/auth/controller.py`:
- Around line 17-24: The import usage is inconsistent: move make_refresh_cookie
to the top import list alongside make_clear_refresh_cookie so both
refresh-cookie helpers are imported together; update the top import block that
currently lists generate_csrf_token, make_clear_csrf_cookie,
make_clear_refresh_cookie, make_clear_session_cookie, make_csrf_cookie,
make_session_cookie to also include make_refresh_cookie, and remove the late
import of make_refresh_cookie inside _make_session_cookies so that
_make_session_cookies uses the top-level import instead.
- Around line 993-1004: The code redundantly reads
request.app.state["app_state"] when app_state was already retrieved earlier;
update the call to _get_auth_config to pass the existing app_state variable
(instead of request.app.state["app_state"]) so the Response creation (using
make_clear_session_cookie, make_clear_csrf_cookie, make_clear_refresh_cookie and
the headers) reuses the previously fetched app_state and avoids duplicate
access.
- Around line 254-260: The refresh token is generated and added to cookies via
make_refresh_cookie but never persisted to RefreshStore, so make the enclosing
function async and after generating refresh_token/hash it should call the
RefreshStore API (e.g., refresh_store.create or refresh_store.save) to persist a
hashed token record tied to user_id and expiry (refresh_max_age) to support
single-use invalidation; ensure you hash the plain refresh_token before storing,
handle any errors, and update all call sites to pass in refresh_store and
user_id when config.jwt_refresh_enabled so the server can validate /auth/refresh
requests.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@docs/security.md`:
- Line 73: Update the "Refresh token rotation" bullet to state that replay of a
consumed refresh token not only logs a warning but also triggers cascade
revocation of the session/related tokens; replace the current line "- **Refresh
token rotation** -- optional single-use refresh tokens with replay detection
(reuse of a consumed token triggers a warning)." with wording that explicitly
mentions "single-use refresh tokens with replay detection; on replay of a
consumed refresh token the system logs the event and performs cascade revocation
of the affected session and related tokens, causing sign-out," so operators
understand the side effect when diagnosing unexpected sign-outs.

In `@src/synthorg/api/auth/config.py`:
- Around line 175-187: Extend the model-level validation (e.g., in
_validate_refresh_expiry or a new `@model_validator`(mode="after") in the same
config model) to enforce cookie cross-field rules: if cookie_samesite == "none"
then require cookie_secure == True (raise ValueError with clear message
referencing cookie_samesite/cookie_secure), and check that session_cookie_name,
csrf_cookie_name, and refresh_cookie_name are all unique (raise ValueError
listing the colliding names). Use the existing attribute names
jwt_refresh_enabled, jwt_refresh_expiry_minutes, jwt_expiry_minutes,
cookie_samesite, cookie_secure, session_cookie_name, csrf_cookie_name,
refresh_cookie_name to locate and implement the checks and return self on
success.

In `@src/synthorg/api/auth/controller.py`:
- Around line 263-296: The refresh cookie is appended before the refresh token
is persisted, allowing issuance when persistence fails; change the flow so
persistence happens first: generate refresh_token and token_hash as you already
do, then if app_state and session_id and user_id are present, import
RefreshStore, get store via getattr(app_state, "_refresh_store", None) and call
await store.create(...); only after store.create completes successfully append
make_refresh_cookie(refresh_token, ...) to cookies; if _refresh_store is missing
or store.create raises, do NOT append the cookie and instead log the failure and
surface an explicit error (or return an appropriate failure response) rather
than swallowing the exception—keep references to make_refresh_cookie, app_state,
_refresh_store, store.create, refresh_token, and token_hash to locate the code
to change.
- Around line 258-261: The CSRF cookie is being issued with the access token TTL
(cookies list using make_csrf_cookie(generate_csrf_token(), expires_in, config))
which will expire before the refresh token; update the implementation so CSRF
validation won't block refresh calls by either extending the CSRF cookie
lifetime to match the refresh TTL (use the refresh expiry value instead of
expires_in when calling make_csrf_cookie in the cookies list) or add the refresh
route to the CSRF exemption set (add '/api/v1/auth/refresh' to the csrf_exempt
set referenced in src/synthorg/api/app.py); adjust whichever approach you take
to keep symbol names intact (make_csrf_cookie, generate_csrf_token, expires_in,
csrf_exempt, and the '/api/v1/auth/refresh' route).

In `@src/synthorg/api/auth/csrf.py`:
- Around line 55-58: The CSRF skip logic currently only checks for the session
cookie (self._session_cookie_name) and thus bypasses CSRF for refresh-token-only
requests; update the middleware in the CSRF check to not treat a request
carrying only the refresh cookie or hitting POST /auth/refresh as safe.
Concretely, modify the branch that uses self._session_cookie_name,
self._csrf_cookie_name and self._csrf_header_name and self._exempt_paths so that
CSRF is skipped only when the session cookie is present or the request path is
explicitly in self._exempt_paths; do not skip when only a refresh cookie is
present (or explicitly add POST /auth/refresh to require CSRF), and ensure the
CSRF header/cookie validation still runs for refresh requests.
- Around line 175-179: The _parse_cookies function currently calls
SimpleCookie(value.decode("latin-1")) directly which can raise CookieError on
malformed Cookie headers and cause a 500; wrap the SimpleCookie(...) call in a
try/except that catches http.cookies.CookieError (or CookieError) and on
exception either continue without parsing that header or return/leave result
empty so no cookies are added (ensuring the middleware proceeds and triggers the
intended 403 for missing session cookies); update the loop that populates result
(in _parse_cookies) to skip parsing when an exception is caught.

In `@src/synthorg/api/auth/lockout_store.py`:
- Around line 87-111: load_locked() currently grants a fresh full lock duration
by setting self._locked[uname] = time.monotonic() + self._duration_seconds after
finding users with >= threshold attempts; instead persist or reconstruct the
original expiry so restart only restores remaining TTL: update the SELECT to
retrieve the timestamp of the threshold-crossing attempt (e.g.,
MIN(attempted_at) or the Nth attempt time) for each username, compute
remaining_seconds = original_locked_until - now (or compute locked_until =
attempted_at_of_threshold + self._duration_seconds), and set self._locked[uname]
= time.monotonic() + max(0, remaining_seconds) only when remaining_seconds > 0;
also add unit tests for load_locked() to cover (1) restarting mid-lockout
(remaining TTL restored) and (2) restarting after lock expired but within
failure window (no lock restored).

In `@src/synthorg/api/auth/middleware.py`:
- Around line 123-132: The missing-auth branch currently raises
NotAuthorizedException without emitting the API_AUTH_FAILED event like other
auth failures; update the branch where auth_header is falsy (and session_cookie
falsy) to first log a WARNING using the
synthorg.observability.events.API_AUTH_FAILED event constant with relevant
context (e.g., connection info and session_cookie state) and then raise
NotAuthorizedException(detail="Missing authentication"); do the same for the
"Cookie was present but invalid" path if it doesn't already log, ensuring you
use the same event constant and context for consistency with other auth failure
branches.

In `@src/synthorg/api/config.py`:
- Around line 45-52: The allow_headers tuple currently hardcodes "X-CSRF-Token"
which can diverge from the configurable CSRF header in AuthConfig
(csrf_header_name); update ApiConfig to derive the CORS header entry from
AuthConfig or add a Pydantic root/cross-field validator on ApiConfig that reads
AuthConfig.csrf_header_name and ensures allow_headers includes that value (or
appends it if missing), referencing the allow_headers field, ApiConfig (or its
validator), and AuthConfig.csrf_header_name so CORS and CSRF remain in sync
automatically.

In `@src/synthorg/api/exception_handlers.py`:
- Around line 351-355: The current guard uses truthiness and will drop valid
retry_after=0; change the logic around retry_after_val (from getattr(exc,
"retry_after", None)) to check "is not None" and then validate/normalize its
numeric shape before setting headers: accept ints >= 0 (or numeric strings that
can be safely int()-parsed) and only then set headers = {"Retry-After":
str(retry_after_val)}; apply the same is-not-None + numeric validation pattern
where retry_after is handled (including the similar block around _build_response
at the later occurrence).

In `@src/synthorg/api/lifecycle.py`:
- Around line 233-248: Wrap the LockoutStore initialization and load sequence in
a try/except: catch any Exception raised by LockoutStore(db, auth_cfg) or await
lockout_store.load_locked(), log the failure with the existing API_APP_STARTUP
context (e.g., logger.error(API_APP_STARTUP, note="Lockout store initialization
failed", error=err) or similar) and then re-raise the exception so startup still
aborts; keep using the same symbols (LockoutStore, load_locked,
app_state.set_lockout_store, API_APP_STARTUP) to locate and instrument the
block.

In `@src/synthorg/persistence/sqlite/schema.sql`:
- Around line 515-524: The refresh_tokens.used column should be constrained to
boolean values; update the CREATE TABLE for refresh_tokens to add a CHECK
constraint on the used column (e.g., CHECK(used IN (0,1)) or a named constraint
like CONSTRAINT chk_refresh_tokens_used CHECK(used IN (0,1))) so that used
remains 0 or 1 and still keeps NOT NULL DEFAULT 0; ensure the constraint is
added in the CREATE TABLE statement for refresh_tokens to enforce the domain at
the DB level.

In `@tests/integration/api/test_first_run_flow.py`:
- Around line 155-157: The test is only asserting the session cookie but not the
CSRF cookie after auth; update the assertions in test_first_run_flow to require
both cookies by asserting that csrf_token (returned by
_extract_auth_cookies(resp)) is truthy wherever you already assert session_token
(e.g., after the /auth/setup and /auth/login responses), so call
_extract_auth_cookies(resp) and assert both session_token and csrf_token are
present immediately after those calls to validate the cookie-issuance contract.

In `@tests/unit/api/auth/test_controller.py`:
- Around line 19-33: The helper _extract_auth_cookies currently returns an empty
dict when cookies are missing which leads to KeyError later; update
_extract_auth_cookies to check for and assert the presence of both cookies
before returning (or raise an AssertionError with a clear message), e.g., after
extracting lookups from response.headers.multi_items() assert "session" in
result and "csrf_token" in result and include descriptive text like "missing
session cookie" / "missing csrf_token cookie" so tests fail with clear
diagnostics instead of a cryptic KeyError.

In `@tests/unit/api/auth/test_refresh_store.py`:
- Around line 19-32: The current db/store fixtures use an in-memory aiosqlite
connection which prevents testing atomic concurrent consumption across
independent connections; update or add a test that creates a file-backed SQLite
DB (use tmp_path to create a refresh.sqlite3), open two separate
aiosqlite.connect() connections (set row_factory and call apply_schema on each),
instantiate two RefreshStore objects from those connections, use
RefreshStore.create(...) to insert a token, then concurrently call
RefreshStore.consume(token_hash) from both stores (e.g., asyncio.TaskGroup) and
assert that exactly one call returns a non-None result, referencing the db
fixture replace or new test and the RefreshStore.create and RefreshStore.consume
methods.

In `@web/src/stores/auth.ts`:
- Around line 103-105: fetchUser() currently returns early when get().authStatus
=== 'unauthenticated', which prevents getMe() from running after the backend
sets the cookie during performAuthFlow(); update fetchUser() so it does not
short-circuit on 'unauthenticated' — only skip when already 'authenticated' (or
add an explicit force/fresh param) and always call getMe() otherwise so
performAuthFlow() can detect the new session and avoid falling into
handleUnauthorized(); adjust any callers or tests that relied on the old
short-circuit (references: fetchUser(), get().authStatus, getMe(),
performAuthFlow(), handleUnauthorized(), IS_DEV_AUTH_BYPASS).

---

Outside diff comments:
In `@web/src/api/endpoints/providers.ts`:
- Around line 186-197: The SSE 401 branch currently calls
useAuthStore.getState().handleUnauthorized() (and redirect) unconditionally
which bypasses the dev-auth-bypass rules; update this to use the same bypass
gate as the shared Axios client (e.g., check the dev-auth-bypass flag/function
used elsewhere) so that handleUnauthorized() and the window.location.href
redirect only run when dev-auth-bypass is disabled, or refactor both paths to
call a shared helper (e.g., handleUnauthorizedResponse) that encapsulates the
bypass check and cleanup+redirect logic.

---

Duplicate comments:
In `@src/synthorg/api/auth/refresh_store.py`:
- Around line 69-99: The create(), revoke_by_session(), revoke_by_user(), and
cleanup_expired() methods must emit INFO-level audit logs like consume() does:
add an INFO log in create() including token_hash, session_id, user_id and
expires_at (use ISO timestamps), add an INFO log in revoke_by_session()
including session_id and affected user_id(s) and reason, add an INFO log in
revoke_by_user() including user_id and (optionally) scope/initiator, and change
cleanup_expired() to log at INFO the expiry cutoff timestamp and the number of
rows removed; use the same logger instance and message style/fields as consume()
to keep logs consistent and auditable.

In `@web/src/hooks/useWebSocket.ts`:
- Around line 49-56: When isEnabled becomes false (auth loss), the hook
currently cleans handlers but doesn't clear the store connection state; call the
websocket store's disconnect to fully tear down reconnection state. In the
useWebSocket hook add logic in the effect that watches isEnabled (and
authStatus) to invoke useWebSocketStore.getState().disconnect() (or the store's
disconnect action) and set disposedRef appropriately when isEnabled flips false
so shouldBeConnected/reconnectExhausted are cleared; update teardown paths in
the same effect where setup/cleanup handlers are removed to consistently call
disconnect().

In `@web/src/router/guards.tsx`:
- Around line 137-152: Replace the current useIsAuthenticated() flow in
SetupCompleteGuard with the tri-state auth handling: read authStatus and
checkSession() (instead of relying solely on useIsAuthenticated()), update the
useEffect so fetchSetupStatus runs only when authStatus === 'authenticated' (and
setupComplete === null and !loading && !error), and add an authStatus ===
'unknown' branch that calls checkSession() and returns null (or a loader) while
resolving; keep the existing "allow through" behavior for unauthenticated users.
Ensure you add authStatus and checkSession to the effect/conditional
dependencies and reference the existing symbols (useIsAuthenticated(),
fetchSetupStatus, setupComplete, loading, error, checkSession, authStatus,
children) when making the changes.

In `@web/src/stores/auth.ts`:
- Around line 93-100: The logout flow calls get().handleUnauthorized() even when
authApi.logout() fails, which can create a false local logout; change logout()
so it only invokes get().handleUnauthorized() after authApi.logout()
successfully resolves (i.e., move the handleUnauthorized() call inside the try
block after await authApi.logout()), and keep the catch to log the failure
(using getErrorMessage(err)) but do not clear client auth state or call
handleUnauthorized() on error; reference: logout(), authApi.logout(),
handleUnauthorized(), and checkSession().

In `@web/src/utils/csrf.ts`:
- Around line 16-21: The current CSRF cookie parsing uses decodeURIComponent
directly and can throw on malformed encodings; wrap the decodeURIComponent call
in a try/catch (inside the function that contains this snippet — e.g., the
cookie lookup that defines match and eqIdx) and return null on any URIError or
generic exception to avoid breaking request interception; specifically, keep the
match and eqIdx logic, but replace the direct return of
decodeURIComponent(match.slice(eqIdx + 1)) with a guarded block that catches
errors and returns null.