fix(widget): persist identified session tokens to survive page disruptions

apps/web/src/components/widget/widget-auth-provider.tsx

@@ -17,6 +17,9 @@ import {
   persistAnonymousToken,
   readPersistedToken,
   clearPersistedToken,
+  persistIdentifiedToken,
+  readPersistedIdentifiedToken,
+  clearIdentifiedToken,
 } from '@/lib/client/widget-auth'
 import { sendToHost } from '@/lib/client/widget-bridge'
 import { widgetQueryKeys } from '@/lib/client/hooks/use-widget-vote'
@@ -142,6 +145,31 @@ export function WidgetAuthProvider({
 
       const p = (async (): Promise<boolean> => {
         try {
+          // 0. Try a persisted identified token first — it may have survived a
+          //    page interaction (tab switch, focus loss, browser memory pressure)
+          //    that cleared the in-memory token but not localStorage.
+          const persistedIdent = readPersistedIdentifiedToken()
+          if (persistedIdent) {
+            try {
+              const res = await fetch('/api/widget/session', {
+                headers: { Authorization: *** ${persistedIdent}` },
+              })
+              if (res.ok) {
+                const body = await res.json()
+                if (body.data?.user) {
+                  storeToken(persistedIdent)
+                  persistIdentifiedToken(persistedIdent)
+                  setUser(body.data.user)
+                  return true
+                }
+                // Identified token is stale or demoted — drop it.
+                clearIdentifiedToken()
+              }
+            } catch {
+              // Server unreachable — fall through.
+            }
+          }
+
           // 1. Prefer a persisted anonymous token — validate it server-side
           //    before adopting (it may have expired or been merged away).
           const persisted = readPersistedToken()
@@ -214,9 +242,11 @@ export function WidgetAuthProvider({
     (result: { sessionToken: string; user: WidgetUser; votedPostIds?: string[] }) => {
       storeToken(result.sessionToken)
       // Any anonymous session was merged into this identified user server-side,
-      // so drop its persisted token. Identified tokens are never persisted —
-      // they're re-established via SDK identify / portal passthrough on load.
+      // so drop its persisted token. Persist the identified token so it survives
+      // page interactions (e.g. the user navigates away and returns to the
+      // widget tab) — the server validates it as a Bearer on next use.
       clearPersistedToken()
+      persistIdentifiedToken(result.sessionToken)
       setUser(result.user)
       if (result.votedPostIds) {
         queryClient.setQueryData(

apps/web/src/components/widget/widget-home-animated.tsx

@@ -469,6 +469,55 @@ export function WidgetHomeAnimated({
         setIsSubmitting(false)
         return
       } else if (!isIdentified) {
+        // Before falling back to an anonymous session (which will fail
+        // submission on workspaces that require identified users), try to
+        // restore a previously-persisted identified token. This recovers
+        // from tab switches, focus loss, or browser memory pressure that
+        // cleared the in-memory token but left localStorage intact.
+        const { readPersistedIdentifiedToken } = await import(
+          '@/lib/client/widget-auth'
+        )
+        const identToken = readPersistedIdentifiedToken()
+        if (identToken) {
+          try {
+            const res = await fetch('/api/widget/session', {
+              headers: { Authorization: *** ${identToken}` },
+            })
+            if (res.ok) {
+              const body = await res.json()
+              if (body.data?.user) {
+                const { setWidgetToken, persistIdentifiedToken } =
+                  await import('@/lib/client/widget-auth')
+                setWidgetToken(identToken)
+                persistIdentifiedToken(identToken)
+                setUser(body.data.user)
+                // Re-resolve board permissions with the restored identity
+                const [{ getWidgetAuthHeaders }, { fetchBoardCapabilitiesFn }] =
+                  await Promise.all([
+                    import('@/lib/client/widget-auth'),
+                    import('@/lib/server/functions/portal'),
+                  ])
+                const freshPermissions = await fetchBoardCapabilitiesFn({
+                  headers: getWidgetAuthHeaders(),
+                })
+                if (!freshPermissions?.[selectedBoardId]?.canSubmit) {
+                  setError(
+                    intl.formatMessage({
+                      id: 'widget.home.form.noAccess',
+                      defaultMessage:
+                        "You don't have access to post on this board",
+                    })
+                  )
+                  setIsSubmitting(false)
+                  return
+                }
+              }
+            }
+          } catch {
+            // Server unreachable — fall through to ensureSession.
+          }
+        }
+
         const ok = await ensureSession()
         if (!ok) {
           setError(
@@ -513,13 +562,25 @@ export function WidgetHomeAnimated({
       })
 
       collapseForm()
-    } catch {
-      setError(
-        intl.formatMessage({
-          id: 'widget.home.form.errorNetwork',
-          defaultMessage: 'Network error. Please try again.',
-        })
-      )
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : ''
+      if (msg.includes('Anonymous interaction is not enabled') ||
+          msg.includes('Authentication required')) {
+        setError(
+          intl.formatMessage({
+            id: 'widget.home.form.errorReauthRequired',
+            defaultMessage:
+              'Your session has expired. Please sign in again to submit feedback.',
+          })
+        )
+      } else {
+        setError(
+          intl.formatMessage({
+            id: 'widget.home.form.errorNetwork',
+            defaultMessage: 'Network error. Please try again.',
+          })
+        )
+      }
     } finally {
       setIsSubmitting(false)
     }

apps/web/src/lib/client/widget-auth.ts

@@ -17,9 +17,11 @@
 // first-party even when embedded cross-site), so multiple tenants on one host
 // page can't collide.
 const ANON_TOKEN_KEY_PREFIX = 'quackback:anon-token:'
+const IDENT_TOKEN_KEY_PREFIX = 'quackback:ident-token:'
 // Mirror Better Auth's 7-day session TTL so an expired token is dropped
 // client-side instead of triggering a guaranteed-401 validation round-trip.
 const ANON_TOKEN_TTL_MS = 7 * 24 * 60 * 60 * 1000
+const IDENT_TOKEN_TTL_MS = 7 * 24 * 60 * 60 * 1000
 
 function anonTokenStore(): Storage | null {
   if (typeof window === 'undefined' || !window.localStorage) return null
@@ -40,10 +42,11 @@ export function getWidgetToken(): string | null {
   return _widgetToken
 }
 
-/** Clears the in-memory token AND any persisted anonymous copy. */
+/** Clears the in-memory token AND any persisted anonymous AND identified copies. */
 export function clearWidgetToken(): void {
   _widgetToken = null
   clearPersistedToken()
+  clearIdentifiedToken()
 }
 
 /**
@@ -114,6 +117,76 @@ export function clearPersistedToken(): void {
   }
 }
 
+/**
+ * Persist an IDENTIFIED session token to the widget iframe's first-party
+ * localStorage so it survives page interactions that clear JS memory.
+ * Stored with a 7-day expiry hint mirroring the server session TTL.
+ * Only ever call this for tokens that resolve to a non-anonymous user.
+ */
+export function persistIdentifiedToken(token: string): void {
+  const store = anonTokenStore()
+  if (!store) return
+  try {
+    store.setItem(
+      identTokenKey(),
+      JSON.stringify({ token, expiresAt: Date.now() + IDENT_TOKEN_TTL_MS })
+    )
+  } catch {
+    // Storage disabled or full — fall back to in-memory only.
+  }
+}
+
+/**
+ * Read a previously persisted identified token. Returns null (and drops
+ * the entry) when missing, malformed, or past its expiry hint.
+ */
+export function readPersistedIdentifiedToken(): string | null {
+  const store = anonTokenStore()
+  if (!store) return null
+  const key = identTokenKey()
+  let raw: string | null
+  try {
+    raw = store.getItem(key)
+  } catch {
+    return null
+  }
+  if (!raw) return null
+  try {
+    const parsed = JSON.parse(raw) as { token?: unknown; expiresAt?: unknown }
+    if (
+      typeof parsed.token !== 'string' ||
+      typeof parsed.expiresAt !== 'number' ||
+      parsed.expiresAt <= Date.now()
+    ) {
+      store.removeItem(key)
+      return null
+    }
+    return parsed.token
+  } catch {
+    try {
+      store.removeItem(key)
+    } catch {
+      // ignore
+    }
+    return null
+  }
+}
+
+/** Remove only the persisted identified token, leaving in-memory intact. */
+export function clearIdentifiedToken(): void {
+  const store = anonTokenStore()
+  if (!store) return
+  try {
+    store.removeItem(identTokenKey())
+  } catch {
+    // ignore
+  }
+}
+
+function identTokenKey(): string {
+  return `${IDENT_TOKEN_KEY_PREFIX}${window.location.origin}`
+}
+
 export function hasWidgetToken(): boolean {
   return _widgetToken !== null
 }

apps/web/src/locales/en.json

@@ -33,6 +33,7 @@
   "widget.home.form.errorEmail": "Could not verify your email. Please try again.",
   "widget.home.form.errorSession": "Could not create session. Please try again.",
   "widget.home.form.errorNetwork": "Network error. Please try again.",
+  "widget.home.form.errorReauthRequired": "Your session has expired. Please sign in again to submit feedback.",
   "widget.home.similar.heading": "Similar ideas",
   "widget.home.popular.heading": "Popular ideas",
   "widget.home.popular.search.placeholder": "Search ideas...",