Debounce 401 on Security/Check across polling intervals to handle refresh token race

[Copilot]

Pika Core's refresh token mechanism can cause the /Security/Check endpoint to return 401 on the first call while the token is being refreshed. Instead of immediately retrying or logging the user out, the 401 is debounced across the existing 8-second polling interval — only showing the logout prompt if two consecutive checks return 401.

• src/App.vue: Added a hadPrevious401 data flag. On the first 401 (during mount or interval), the flag is set but the user is not logged out. During the initial mount check, authLoading stays true so the loading overlay is shown instead of the login prompt. On the next 8-second interval check, if the endpoint still returns 401, the user is logged out and the popup is shown. If it returns 200, the flag is cleared and the user remains logged in.

• src/services/securityService.js: No changes — remains a single call to /Security/Check, returning response.ok.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[0fca]

@copilot Okay, let's try another approach. Don't make double hit one after another. If you get 401 for the first time, debounce it waiting another 8s (so just for another interval of Security/Check worker) and if there is still 401 - then show the pop-up.

[Copilot]

@copilot Okay, let's try another approach. Don't make double hit one after another. If you get 401 for the first time, debounce it waiting another 8s (so just for another interval of S...

Switched to the debounce approach in 667a650. Now securityService.js is back to a single call, and the debounce logic lives in App.vue:

• On the first 401 (mount or interval), hadPrevious401 is set to true and the user is not logged out. During the initial mount, authLoading stays true so the loading overlay is shown instead of the login prompt.
• On the next 8s interval, if the check still returns 401 → log out and show the popup. If it returns 200 → clear the flag and mark logged in.