Overview
There is no client-side auth state anywhere. Every protected page needs to know the current user, whether they're authenticated, and how to log in/out.
Tech
React Context + a custom useAuth() hook, token persisted in memory + localStorage. No Zustand/Redux — Context is sufficient at this scope.
Acceptance Criteria
Overview
There is no client-side auth state anywhere. Every protected page needs to know the current user, whether they're authenticated, and how to log in/out.
Tech
React Context + a custom
useAuth()hook, token persisted in memory +localStorage. No Zustand/Redux — Context is sufficient at this scope.Acceptance Criteria
AuthProviderwrappingapp/layout.tsxexposing{ user, accessToken, isAuthenticated, isLoading, login(), logout(), refresh() }login()callsPOST /auth/login(or handles the OAuth redirect token perauth.controller.ts'sredirectWithTokenpattern) and populates statelogout()clears local state and persisted tokensuseAuth()hook for consumption by pages/components