Resume a draft through an explicit recovery state

Model recovery independently of the request

Create a state that identifies the draft, original account context and safe return destination. Keep sensitive form contents out of URL parameters and do not include session credentials in the recovery record.

The following synthetic example describes application state. It is not an authentication protocol or a substitute for server-side validation.

{
  "draftId": "assessment-example-28",
  "originalOrganisationId": "org-example-a",
  "resumeRoute": "/assessments/drafts/assessment-example-28",
  "pendingCommandId": "submit-example-83",
  "state": "authenticationRequired"
}

Validate the return destination against allowed internal routes. An untrusted return URL should not become an open redirect after successful sign-in.

Pause protected work coherently

When authentication is no longer valid, stop issuing protected mutations and show one understandable recovery prompt. Several failing requests should not create a stack of competing sign-in dialogs.

Use the authentication library's supported refresh or reauthentication mechanism. Coordinate concurrent refresh attempts where the provider's token rules require it, and stop after a bounded failure rather than looping.

Preserve permitted draft data through the application's established storage path. If the draft cannot be saved, explain that limitation before navigation removes the current page.

Verify identity and command outcome

After sign-in, compare the authenticated context with the draft's owner and check current access on the server. Do not trust a client-supplied organisation ID as proof of ownership.

If a command may already have succeeded, retrieve its result by the supported identity. Restore the confirmation when found. Otherwise resume the draft or safely retry under the command contract.

Refresh relevant records before allowing final submission so stale versions or revoked permissions produce a meaningful review state.

Restore focus and useful context

Return to the task with the draft's fields and a concise explanation of what happened. Move focus to an appropriate heading or notice, then let the user review before a consequential action.

Test direct navigation, another open tab and an account switch. Clear stale account-scoped caches so the restored page cannot briefly display one organisation's information under another account's navigation.