Auth flows (also serves /register, which reuses _components/Register.tsx).
action.ts (POST): calls login(), on 200 sets token + refresh-token httpOnly cookies via
AUTH_COOKIES_OPTIONS ({ path:'/', httpOnly:true, maxAge:43200 }); on 401/500 redirects back to
/login?invalid. Exports FIELD_USERNAME/FIELD_PASSWORD/AUTH_COOKIES_OPTIONS reused
elsewhere.refresh.ts (GET): polled every 30s by the layouts; reads refresh-token, refreshes the access
token when the JWT is near expiry, resets token/refresh-token.[provider]/index.ts + callback.ts: OAuth (PKCE). Start sets oauth_code_verifier +
oauth_state cookies (maxAge:300); callback verifies state, deletes those cookies, sets
token/refresh-token._components/: Login, Register, PasswordForgot, PasswordReset, SocialLogin.
forgot-password/, reset-password/ = form + POST.AUTH_COOKIES_OPTIONS is imported by api/funnel-auth.ts and login/[provider]/callback.ts;
refresh.ts is polled by every layout in src/layouts/.src/client/api.ts (login, refresh, oauth2Authorize, oauth2Callback). Cookie names
(token, refresh-token) are read by api/[...proxy].ts and src/session.ts.httpOnly; don’t rename
token/refresh-token without updating the proxy, layouts, and session together.