@bobfrankston/rmfmail 1.2.188 → 1.2.190

package/packages/mailx-store-web/android-bootstrap.ts

@@ -1024,61 +1024,80 @@ async function refreshAccessToken(refreshToken: string): Promise<{ access_token:
 // ── Token provider (browser OAuth, same as desktop) ──
 
 function createNativeTokenProvider(email: string): () => Promise<string> {
-    return async () => {
-        // Check cached token first
-        const cached = await getCachedToken(email);
-        if (cached?.access_token) {
-            const expiresAt = cached.expires_at || 0;
-            const bufferMs = 5 * 60 * 1000; // 5 min buffer
-            if (Date.now() < expiresAt - bufferMs) {
-                return cached.access_token;
-            }
-            // Try refresh
-            if (cached.refresh_token) {
-                try {
-                    console.log(`[oauth] Refreshing token for ${email}`);
-                    const refreshed = await refreshAccessToken(cached.refresh_token);
-                    const token = {
-                        access_token: refreshed.access_token,
-                        refresh_token: cached.refresh_token,
-                        expires_at: Date.now() + refreshed.expires_in * 1000,
-                    };
-                    await setCachedToken(email, token);
-                    return token.access_token;
-                } catch (e: any) {
-                    console.warn(`[oauth] Refresh failed: ${e.message}, starting new flow`);
-                }
+    return () => {
+        // C158: single-flight per email. Startup fires several concurrent
+        // token requests (GDrive reconcile, contacts sync, syncAll) — with
+        // no cached token each one launched its OWN browser-consent intent
+        // (three "Starting OAuth flow" in one boot, 2026-07-22 logit trail).
+        // Concurrent callers now share one resolution. Keyed on a window
+        // global, not a module local, because the double-init bug that
+        // exposed this also loads the module twice — two module instances
+        // must still share the guard.
+        const w = window as any;
+        const inflight: Map<string, Promise<string>> = w.__rmfOAuthInflight ||= new Map();
+        const key = canonEmail(email);
+        const existing = inflight.get(key);
+        if (existing) return existing;
+        const p = fetchTokenForEmail(email).finally(() => inflight.delete(key));
+        inflight.set(key, p);
+        return p;
+    };
+}
+
+async function fetchTokenForEmail(email: string): Promise<string> {
+    // Check cached token first
+    const cached = await getCachedToken(email);
+    if (cached?.access_token) {
+        const expiresAt = cached.expires_at || 0;
+        const bufferMs = 5 * 60 * 1000; // 5 min buffer
+        if (Date.now() < expiresAt - bufferMs) {
+            return cached.access_token;
+        }
+        // Try refresh
+        if (cached.refresh_token) {
+            try {
+                console.log(`[oauth] Refreshing token for ${email}`);
+                const refreshed = await refreshAccessToken(cached.refresh_token);
+                const token = {
+                    access_token: refreshed.access_token,
+                    refresh_token: cached.refresh_token,
+                    expires_at: Date.now() + refreshed.expires_in * 1000,
+                };
+                await setCachedToken(email, token);
+                return token.access_token;
+            } catch (e: any) {
+                console.warn(`[oauth] Refresh failed: ${e.message}, starting new flow`);
             }
         }
+    }
 
-        // No valid token — start browser OAuth flow
-        const bridge = (window as any)._nativeBridge;
-        if (!bridge?.app?.startOAuth) {
-            throw new Error("No native OAuth bridge");
-        }
+    // No valid token — start browser OAuth flow
+    const bridge = (window as any)._nativeBridge;
+    if (!bridge?.app?.startOAuth) {
+        throw new Error("No native OAuth bridge");
+    }
 
-        const authUrl = `${OAUTH_CLIENT.authUri}?` + new URLSearchParams({
-            client_id: OAUTH_CLIENT.clientId,
-            redirect_uri: OAUTH_CLIENT.redirectUri,
-            response_type: "code",
-            scope: OAUTH_SCOPES,
-            access_type: "offline",
-            prompt: "consent",
-            login_hint: email,
-        }).toString();
-
-        console.log(`[oauth] Starting browser consent for ${email}`);
-        const code = await bridge.app.startOAuth(authUrl);
-        const tokens = await exchangeCodeForTokens(code);
-        const token = {
-            access_token: tokens.access_token,
-            refresh_token: tokens.refresh_token,
-            expires_at: Date.now() + tokens.expires_in * 1000,
-        };
-        await setCachedToken(email, token);
-        console.log(`[oauth] Token obtained for ${email}`);
-        return token.access_token;
+    const authUrl = `${OAUTH_CLIENT.authUri}?` + new URLSearchParams({
+        client_id: OAUTH_CLIENT.clientId,
+        redirect_uri: OAUTH_CLIENT.redirectUri,
+        response_type: "code",
+        scope: OAUTH_SCOPES,
+        access_type: "offline",
+        prompt: "consent",
+        login_hint: email,
+    }).toString();
+
+    console.log(`[oauth] Starting browser consent for ${email}`);
+    const code = await bridge.app.startOAuth(authUrl);
+    const tokens = await exchangeCodeForTokens(code);
+    const token = {
+        access_token: tokens.access_token,
+        refresh_token: tokens.refresh_token,
+        expires_at: Date.now() + tokens.expires_in * 1000,
     };
+    await setCachedToken(email, token);
+    console.log(`[oauth] Token obtained for ${email}`);
+    return token.access_token;
 }
 
 // ── GDrive folder lookup ──
@@ -1339,7 +1358,23 @@ async function waitForNativeBridge(timeoutMs: number = 5000): Promise<void> {
     });
 }
 
-export async function initAndroid(): Promise<void> {
+export function initAndroid(): Promise<void> {
+    // C158: idempotency guard. The 2026-07-22 fold/unfold logit trail showed
+    // ONE WebView reload executing the boot module TWICE — duplicate "bridge
+    // installed", duplicate GDrive lookups, tripled OAuth launches. The
+    // guard lives on window (not a module local) so it holds even when the
+    // module itself is instantiated twice (bundle + package-path specifiers
+    // resolve to distinct module instances).
+    const w = window as any;
+    if (w.__rmfInitAndroid) {
+        console.warn("[android] initAndroid called again — duplicate suppressed (C158)");
+        vlog("C158: duplicate initAndroid call suppressed");
+        return w.__rmfInitAndroid;
+    }
+    return w.__rmfInitAndroid = initAndroidOnce();
+}
+
+async function initAndroidOnce(): Promise<void> {
     console.log("[android] Initializing mailx (main-thread mode)...");
 
     // Main-thread path: async I/O (fetch, TCP bridge) doesn't block the UI,

package/packages/mailx-store-web/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-store-web",
-  "version": "0.1.59",
+  "version": "0.1.61",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",