fix(auth): dedupe concurrent session expiry

vehicle-data-platform/apps/web/src/v2/auth/session.test.ts

@@ -1,5 +1,5 @@
-import { afterEach, expect, test } from 'vitest';
-import { canAdminister, canOperate, clearAccessToken, getAccessToken, setAccessToken } from './session';
+import { afterEach, expect, test, vi } from 'vitest';
+import { canAdminister, canOperate, clearAccessToken, getAccessToken, notifyUnauthorizedSession, PLATFORM_UNAUTHORIZED_EVENT, setAccessToken } from './session';
 
 afterEach(() => {
   window.sessionStorage.clear();
@@ -20,3 +20,18 @@ test('role helpers follow the server permission hierarchy', () => {
   expect(canAdminister({ name: 'o', role: 'operator', authMode: 'enforce' })).toBe(false);
   expect(canAdminister({ name: 'a', role: 'admin', authMode: 'enforce' })).toBe(true);
 });
+
+test('invalidates only the currently active rejected token', () => {
+  const unauthorized = vi.fn();
+  window.addEventListener(PLATFORM_UNAUTHORIZED_EVENT, unauthorized);
+  setAccessToken('new-token');
+
+  expect(notifyUnauthorizedSession('old-token')).toBe(false);
+  expect(getAccessToken()).toBe('new-token');
+  expect(notifyUnauthorizedSession('new-token')).toBe(true);
+  expect(getAccessToken()).toBe('');
+  expect(notifyUnauthorizedSession('new-token')).toBe(false);
+  expect(unauthorized).toHaveBeenCalledTimes(1);
+
+  window.removeEventListener(PLATFORM_UNAUTHORIZED_EVENT, unauthorized);
+});

vehicle-data-platform/apps/web/src/v2/auth/session.ts

@@ -23,8 +23,11 @@ export function clearAccessToken() {
   window.sessionStorage.removeItem(TOKEN_KEY);
 }
 
-export function notifyUnauthorizedSession() {
+export function notifyUnauthorizedSession(rejectedToken: string) {
+  if (!rejectedToken || getAccessToken() !== rejectedToken) return false;
+  clearAccessToken();
   window.dispatchEvent(new Event(PLATFORM_UNAUTHORIZED_EVENT));
+  return true;
 }
 
 export function canOperate(session: PlatformSession) {