feat: add authkit action helper

[DennisKraaijeveld]

Introduces authkitAction, the action-side equivalent to authkitLoader, so React Router actions get the same session refresh, cookie management, and auth / getAccessToken ergonomics as loaders.

[greptile-apps]

Greptile Summary

• Adds authkitAction helper that mirrors authkitLoader functionality for React Router actions, providing automatic session refresh and authentication state management
• Implements comprehensive test coverage with 292 new test lines covering authenticated/unauthenticated flows and session refresh scenarios

Confidence Score: 5/5

• This PR is safe to merge with no identified issues
• The implementation follows the exact same pattern as the existing authkitLoader, properly handles sensitive tokens (only logs last 10 chars in debug mode), includes comprehensive tests with 100% coverage of new functionality, and adheres to all security best practices from custom instructions
• No files require special attention

Important Files Changed

Filename	Overview
src/session.ts	Adds authkitAction function mirroring authkitLoader for React Router actions with session refresh and auth state management
src/session.spec.ts	Adds comprehensive test suite for authkitAction covering unauthenticated flows, authenticated flows, and session refresh scenarios

Sequence Diagram

sequenceDiagram
    participant User
    participant "React Router" as RR
    participant "authkitAction" as AKA
    participant "updateSession" as US
    participant "handleAuthAction" as HAA
    participant "Custom Action" as CA
    
    User->>RR: "Submit form (POST)"
    RR->>AKA: "Call authkitAction(args, customAction, options)"
    AKA->>US: "Get/refresh session from cookie"
    alt Session valid
        US-->>AKA: "Return session with access token"
        AKA->>HAA: "Pass auth data and session"
        HAA->>CA: "Call customAction({ auth, getAccessToken })"
        CA-->>HAA: "Return action result"
        HAA-->>AKA: "Merge result with auth data"
        AKA-->>RR: "Return data with Set-Cookie header"
    else Session expired but refresh succeeds
        US->>US: "Refresh tokens via WorkOS"
        US-->>AKA: "Return new session with fresh tokens"
        AKA->>HAA: "Pass auth data and new session"
        HAA->>CA: "Call customAction({ auth, getAccessToken })"
        CA-->>HAA: "Return action result"
        HAA-->>AKA: "Merge result with auth data"
        AKA-->>RR: "Return data with updated Set-Cookie"
    else No session or refresh fails
        US-->>AKA: "Throw SessionRefreshError"
        AKA->>AKA: "Destroy session cookie"
        AKA-->>RR: "Redirect to authorization URL"
    end
    RR-->>User: "Return response"

Loading

[greptile-apps]

_{5 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile
React with 👍 or 👎 to share your feedback on this new summary format}

[DennisKraaijeveld]

Putting this back in draft. Depends on #44