What problem does it solve? It captures the exact authentication and session model of the KrockSide React frontend so developers and agents avoid breaking the per-user token storage, misreading JWT claims, or mishandling 401 responses when touching login, useAuth, or the axios layer. ## Core Features & Use Cases - Token storage model: Documents the per-user localStorage keys (accessToken{userId}, refreshToken{userId}) plus sessionStorage.currentUserId, which enables two players in separate browser tabs. - Axios interceptor rules: Explains the single request interceptor in src/service/Api.ts, the absence of any response interceptor, and why 401s surface without retry or refresh. - JWT claims reality check: Lists the claims the backend actually emits (sub, email, name, jti, long-key role) and warns that DecodedToken.emailAddress and role are always undefined, and that role is a permission, never a piece color. - Use Case: When investigating a user being logged out unexpectedly or a 403 on validation endpoints, consult this skill to confirm token expiry behavior (60 minutes, no refresh in use) and the userId-vs-sub comparison rule before changing code. ## Quick Start Ask the agent to review the authentication and session skill before modifying Login, useAuth, or src/service/Api.ts in the KrockSide frontend.
