Merge pull request #161 from hashicorp/chore-handle-401

chore: 🤖 handle 401s by invalidating session

ui/core/app/routes/application.js

@@ -59,4 +59,20 @@ export default class ApplicationRoute extends Route.extend(
   invalidateSession() {
     this.session.invalidate();
   }
+
+  /**
+   * Invalidates the session if a 401 error occurs and returns false to
+   * prevent further error handling.
+   * Returns true in all other cases, allowing error handling to occur (such
+   * as displaying the `error.hbs` template, if one exists).
+   */
+  @action
+  error(e) {
+    const isUnauthenticated = e?.errors[0]?.isUnauthenticated;
+    if (isUnauthenticated) {
+      this.session.invalidate();
+      return false;
+    }
+    return true;
+  }
 }

ui/core/tests/acceptance/authentication-test.js

@@ -1,5 +1,5 @@
 import { module, test } from 'qunit';
-import { visit, currentURL, fillIn, click, find, findAll } from '@ember/test-helpers';
+import { visit, currentURL, fillIn, click, find, findAll, setupOnerror } from '@ember/test-helpers';
 import { setupApplicationTest } from 'ember-qunit';
 import setupMirage from 'ember-cli-mirage/test-support/setup-mirage';
 import { Response } from 'miragejs';
@@ -180,4 +180,16 @@ module('Acceptance | authentication', function (hooks) {
     assert.notOk(currentSession().isAuthenticated);
     assert.equal(currentURL(), authMethodGlobalAuthenticateURL);
   });
+
+  test('401 responses result in deauthentication', async function (assert) {
+    assert.expect(2);
+    authenticateSession({ scope: { id: globalScope.id, type: globalScope.type } });
+    await visit(orgsURL);
+    assert.ok(currentSession().isAuthenticated, 'Session begins authenticated, before encountering 401');
+    this.server.get('/scopes', () => new Response(401));
+    setupOnerror(() => {
+      assert.notOk(currentSession().isAuthenticated, 'Session is unauthenticated, after encountering 401');
+    });
+    await visit(projectsURL);
+  });
 });