Warn before the session expires

provideSessionExpiry() raises a warning toast shortly before the session ends, and an error toast — with a "Sign in again" action — when the backend says it has. Both are notify events, rendered by your application's toast bridge.

Minimal example

import { ApplicationConfig } from "@angular/core";
import { provideAtomicClient, provideAtomicNotifications, provideSessionExpiry } from "@sinequa/atomic-angular";

export const appConfig: ApplicationConfig = {
  providers: [provideAtomicClient({ app: "my-app" }), provideAtomicNotifications(), provideSessionExpiry()],
};

How it works

Two independent signals, because no single one works for every way of signing in.

Proactive. The token @sinequa/atomic stores — the csrfToken of the sign-in and challenge responses, and the sinequa-jwt-refresh header — looks like <opaque token>|<epoch in seconds>, and the suffix is the expiry of the session. It is the only expiry date a browser can read, since the session cookie is HttpOnly. The provider reads it at start-up and on every tokenRefreshed, and schedules the warning warnBeforeMs before it. The warning is raised once: it is armed again only when a renewal takes the expiry back out of that window.

Reactive. A 401 that reaches its caller on a session that had been established means it is gone, whatever the sign-in, and raises the error toast once. The provider follows the client's sessionLost event (@sinequa/atomic 2.8 or later), not unauthorized: unauthorized fires as soon as the 401 is read, before the recovery that bootstrapApp installs gets its chance, so a session it re-establishes silently (single sign-on) would be announced lost. The client already leaves out the 401s that are answers rather than expiries — the sign-in, the start-up probe, audit events — and the requests trailing behind a logout. Requests sent with HttpClient, which the client never sees, are covered by errorInterceptorFn when its own recovery gives up. A 401 while a user is impersonated is left to its own message in provideAtomicNotifications().

The texts live in the session-expiry Transloco scope, extracted into your application like the library's other scopes (transloco-scoped-libs). Without Transloco, or when the scope was not extracted, the English texts built into the provider are used instead of a raw key.

Recipes

import { ApplicationConfig } from "@angular/core";
import { provideAtomicClient, provideAtomicNotifications, provideSessionExpiry } from "@sinequa/atomic-angular";

export const appConfig: ApplicationConfig = {
  providers: [
    provideAtomicClient({ app: "my-app" }),
    provideAtomicNotifications(),
    provideSessionExpiry({
      warnBeforeMs: 2 * 60_000,
      // 30 s instead of "never closes": see the pitfall about the toast duration
      expiredDuration: 30_000,
      onReconnect: () => window.location.assign("/login"),
    }),
  ],
};

Options

Pitfalls

What's next