fix and update

apps/frontend/components/id/auth-provider.tsx

@@ -41,6 +41,8 @@ import { useToast } from './toast-provider';
 import { PinLockModal } from './pin-lock-modal';
 import { AppBootstrapScreen } from './app-bootstrap-screen';
 import { EMBEDDED_AUTH_MESSAGE, type EmbeddedAuthPayload } from '@/lib/embedded-auth-bridge';
+import { usePinIdleLock } from '@/hooks/use-pin-idle-lock';
+import { clearPinIdleWatch, isPinIdleWatchActive, markPinIdleWatch } from '@/lib/pin-idle-storage';
 
 interface AuthContextValue {
   user: PublicUser | null;
@@ -126,7 +128,7 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
   const router = useRouter();
   const pathname = usePathname();
   const { showToast } = useToast();
-  const { publicApiUrl } = usePublicSettings();
+  const { publicApiUrl, pinLockTimeoutMinutes } = usePublicSettings();
   const initialAuth = React.useMemo(() => readInitialAuthState(), []);
   const [token, setToken] = React.useState<string | null>(initialAuth.token);
   const [user, setUser] = React.useState<PublicUser | null>(null);
@@ -188,6 +190,7 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
   const activatePinLock = React.useCallback((sessionId: string) => {
     const resolvedSessionId = sessionId || window.localStorage.getItem(AUTH_SESSION_KEY);
     if (!resolvedSessionId) return;
+    markPinIdleWatch(user?.id);
     setLockedSessionId(resolvedSessionId);
     setIsPinLocked(true);
     setPinError(null);
@@ -196,7 +199,7 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
     if (cachedUser) {
       setUser(cachedUser);
     }
-  }, []);
+  }, [user?.id]);
 
   const warmUpAndApplySession = React.useCallback(
     async (accessToken: string) => {
@@ -275,6 +278,7 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
     window.localStorage.removeItem(AUTH_REFRESH_KEY);
     window.localStorage.removeItem(AUTH_SESSION_KEY);
     window.localStorage.removeItem(AUTH_USER_CACHE_KEY);
+    clearPinIdleWatch();
     initialBootstrapDoneRef.current = false;
     setToken(null);
     setUser(null);
@@ -456,22 +460,19 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
     void refreshProfile();
   }, [refreshProfile]);
 
-  React.useEffect(() => {
-    if (!isSessionReady || isPinLocked) return;
-    if (pathname.startsWith('/auth/')) return;
-    const accessToken = token ?? window.localStorage.getItem(AUTH_TOKEN_KEY);
-    if (!accessToken) return;
+  const pinIdleLockEnabled =
+    isSessionReady &&
+    !isPinLocked &&
+    !pathname.startsWith('/auth/') &&
+    Boolean(token ?? (typeof window !== 'undefined' ? window.localStorage.getItem(AUTH_TOKEN_KEY) : null)) &&
+    isPinIdleWatchActive(user?.id);
 
-    void fetchAuthSession(accessToken)
-      .then((session) => {
-        applySessionState(session, { setUser, setToken, activatePinLock, clearPinLock });
-      })
-      .catch((error) => {
-        if (isPinRequiredError(error)) {
-          activatePinLock(error.sessionId ?? window.localStorage.getItem(AUTH_SESSION_KEY) ?? '');
-        }
-      });
-  }, [activatePinLock, clearPinLock, isPinLocked, isSessionReady, pathname, token]);
+  usePinIdleLock({
+    enabled: pinIdleLockEnabled,
+    timeoutMinutes: pinLockTimeoutMinutes,
+    accessToken: token,
+    onLockRequired: activatePinLock,
+  });
 
   React.useEffect(() => {
     function handleVisibilityChange() {
@@ -515,6 +516,7 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
         await establishSession(auth);
       } else {
         persistPartialAuth(auth);
+        markPinIdleWatch(auth.user.id);
         setHasStoredSession(true);
       }
       return auth;
@@ -550,6 +552,7 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
         await establishSession(response.auth);
       } else if (response.auth) {
         persistPartialAuth(response.auth);
+        markPinIdleWatch(response.auth.user.id);
         setHasStoredSession(true);
       }
       return response;
@@ -571,6 +574,7 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
         await establishSession(auth);
       } else {
         persistPartialAuth(auth);
+        markPinIdleWatch(auth.user.id);
         setHasStoredSession(true);
       }
       return auth;
@@ -592,6 +596,7 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
         await establishSession(auth);
       } else {
         persistPartialAuth(auth);
+        markPinIdleWatch(auth.user.id);
         setHasStoredSession(true);
       }
       return auth;
@@ -620,6 +625,7 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
         await establishSession(auth);
       } else {
         persistPartialAuth(auth);
+        markPinIdleWatch(auth.user.id);
         setHasStoredSession(true);
       }
       return auth;
@@ -650,6 +656,7 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
       window.localStorage.setItem(AUTH_TOKEN_KEY, response.accessToken);
       window.localStorage.setItem(AUTH_SESSION_KEY, sessionId);
       setToken(response.accessToken);
+      markPinIdleWatch(user?.id);
 
       try {
         await warmUpAndApplySession(response.accessToken);
@@ -673,7 +680,7 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
         router.replace('/');
       }
     },
-    [clearPinLock, pathname, router, warmUpAndApplySession]
+    [clearPinLock, pathname, router, user?.id, warmUpAndApplySession]
   );
 
   const handlePinUnlock = React.useCallback(