B-L4QF-sdf-rejected-token-handling
A browser tab that holds a platform token the server rejects keeps polling, and every poll is a
401. A tab with no token at all is already quiet: the fetch wrapper answers /api/* locally
(#2546).
What is wanted
Section titled “What is wanted”The first 401 for a stored token marks it rejected: requests stop, the operator is asked for a new token, and requests resume when one is saved. Only a 2xx clears the rejected state.
Where it should live
Section titled “Where it should live”Token handling is in a hand-written wrapper around fetch
(solutions/ontological/desktop/src-nuxt/app/utils/token.ts) because the generated transport
closes over the global fetch. The owner’s suggestion is to put it in the contracts that
rust-ontogen generates: the generated HTTP client would take a credential source and an
“unauthorized” hook, attach the header itself, and stop on a 401. Every app built on ontogen would
then get the same behaviour, and the wrapper would go.
That makes this an upstream change in rust-ontogen first, then a pin bump and the removal of the wrapper here.
Raised by the owner on 2026-10-03 while reviewing #2546. Until then, denials from a rejected token are bounded by the guard’s cap on recorded denials.