V16: keepUserLoggedIn has no effect

[iOvergaard]

Description

Fixes #18220

Observes the current-user config for the 'keepUserLoggedIn' value and tries to refresh the token when the worker attempts to log out the user

Session Timeout Logic Improvements:

• The UmbAuthSessionTimeoutController now observes the user's "keepUserLoggedIn" configuration and, if enabled, will attempt to validate the token instead of logging the user out when the session times out. [1] [2]

Integration with User Configuration:

• Added UmbCurrentUserConfigRepository to the session timeout controller to access and observe the user's configuration, specifically the "keepUserLoggedIn" setting. [1] [2]
• Exported the user config repository from the user package, making it available for use in other parts of the application.

[iOvergaard]

On the get-go, this does not quite work because we are not allowed to import from a package module (current-user) into a core module (auth).
We will have to find a new place for the "keepUserLoggedIn" config.

[Copilot]

Pull Request Overview

This PR fixes issue #18220 by implementing proper support for the "keepUserLoggedIn" user configuration setting. When this setting is enabled, the system will attempt to validate/refresh the authentication token instead of logging the user out when the session times out.

• Adds token validation functionality to the auth session timeout controller
• Integrates user configuration observation to respect the "keepUserLoggedIn" setting
• Implements early return logic to prevent logout when keepUserLoggedIn is enabled

Comments suppressed due to low confidence (1)

src/Umbraco.Web.UI.Client/src/packages/core/auth/controllers/auth-session-timeout.controller.ts:1

• The method #tryValidateToken() is called on line 34 but is not defined in this class. This will result in a runtime error when keepUserLoggedIn is enabled and the session times out.

import type { UmbAuthFlow } from '../auth-flow.js';