@ethora/chat-component-rn 26.6.11 → 26.6.13

package/src/components/VideoCalls/VideoCallSession.tsx

@@ -345,9 +345,14 @@ export const VideoCallSession: FC<VideoCallSessionProps> = ({
     if (!runtime) {return;}
     try {
       if (Platform.OS === 'android') {
-        await runtime.AudioSession.setAndroidAudioConfiguration?.({
-          preferredOutputList: next ? ['speaker'] : ['earpiece'],
-        });
+        // NB: not `setAndroidAudioConfiguration` — that method has never
+        // existed on AudioSession (the old `?.` call silently no-oped, so
+        // the speaker icon toggled while audio stayed on the earpiece).
+        // `selectAudioOutput` routes directly; on Android its device ids
+        // are the literal strings 'speaker' / 'earpiece'.
+        await runtime.AudioSession.selectAudioOutput(
+          next ? 'speaker' : 'earpiece'
+        );
       } else {
         await runtime.AudioSession.setAppleAudioConfiguration?.({
           audioCategory: 'playAndRecord',

package/src/components/styled/AudioMessage.tsx

@@ -1,4 +1,5 @@
 import React, { useEffect, useRef, useState } from 'react';
+import { withFileToken } from '../../helpers/secureFileUrl';
 import {
   View,
   TouchableOpacity,
@@ -425,7 +426,7 @@ const AudioMessage = ({
     const partInfo = await FileSystem.getInfoAsync(part);
     if (!partInfo.exists) {
       const download = await withTimeout(
-        FileSystem.downloadAsync(src, part),
+        FileSystem.downloadAsync(withFileToken(src), part),
         12000,
         'audio_download_timeout'
       );

package/src/components/styled/MediaFilePreview.tsx

@@ -110,7 +110,7 @@ const styles = StyleSheet.create({
     backgroundColor: '#1a1a1a',
   },
   playOverlay: {
-    ...StyleSheet.absoluteFillObject,
+    ...StyleSheet.absoluteFill,
     justifyContent: 'center',
     alignItems: 'center',
     backgroundColor: 'rgba(0,0,0,0.3)',

package/src/components/styled/MessageImage.tsx

@@ -1,4 +1,9 @@
 import React, { useEffect, useState } from 'react';
+import {
+  isSecureFileUrl,
+  requestFileTokenRecovery,
+} from '../../helpers/secureFileUrl';
+import { pushLog } from '../../utils/devLogger';
 import { Container } from './StyledInputComponents/MediaComponents';
 import { useDispatch } from 'react-redux';
 import {
@@ -14,11 +19,23 @@ import {
 } from '../../helpers/mediaDimensions';
 
 interface CustomMessageImageProps {
+  /** Full-size file. Opened in the preview modal, NOT rendered inline. */
   fileURL: string;
   fileName: string;
   mimetype: string;
+  /**
+   * Server-generated thumbnail — what the bubble actually renders, same
+   * as the web client. The full-size original can be many megabytes and,
+   * for secure uploads, is served from a different (membership-gated)
+   * route; rendering it inline is what left the bubbles blank.
+   */
+  locationPreview?: string;
 }
 
+/** Keep the personal file token out of the logs. */
+const maskToken = (url?: string) =>
+  (url || '').replace(/([?&]ft=)[^&]*/i, '$1<redacted>');
+
 const FALLBACK_IMAGE =
   'https://as2.ftcdn.net/v2/jpg/02/51/95/53/1000_F_251955356_FAQH0U1y1TZw3ZcdPGybwUkH90a3VAhb.jpg';
 
@@ -26,7 +43,12 @@ const CustomMessageImage: React.FC<CustomMessageImageProps> = ({
   fileURL,
   fileName,
   mimetype,
+  locationPreview,
 }) => {
+  // Preview first, original only as a fallback — mirrors the web client,
+  // where the <img> src is the preview and `fileURL` is reserved for the
+  // modal.
+  const displayURL = locationPreview || fileURL;
   const [loading, setLoading] = useState(true);
   // Start with a neutral box; swap to the real aspect ratio once the
   // image's natural dimensions are known so it's shown scaled, not cropped.
@@ -35,25 +57,31 @@ const CustomMessageImage: React.FC<CustomMessageImageProps> = ({
   const dispatch = useDispatch();
 
   useEffect(() => {
-    if (!fileURL) {
+    if (!displayURL) {
       return;
     }
     let active = true;
     Image.getSize(
-      fileURL,
+      displayURL,
       (w, h) => {
         if (active) {
           setDims(fitMediaDimensions(w, h));
         }
       },
-      () => {
-        /* keep the default box if the size probe fails */
+      (error) => {
+        // Keep the default box — but say WHICH url failed. A blank
+        // bubble is otherwise indistinguishable between "bad url",
+        // "403 without a token" and "host unreachable".
+        pushLog('warn', 'image: getSize failed', {
+          url: maskToken(displayURL),
+          error: (error as any)?.message || String(error),
+        });
       }
     );
     return () => {
       active = false;
     };
-  }, [fileURL]);
+  }, [displayURL]);
 
   const handleOpen = () => {
     dispatch(setActiveFile({ fileName, fileURL, mimetype }));
@@ -78,7 +106,7 @@ const CustomMessageImage: React.FC<CustomMessageImageProps> = ({
           </View>
         )}
         <Image
-          source={{ uri: fileURL || FALLBACK_IMAGE }}
+          source={{ uri: displayURL || FALLBACK_IMAGE }}
           style={{
             width: dims.width,
             height: dims.height,
@@ -86,6 +114,17 @@ const CustomMessageImage: React.FC<CustomMessageImageProps> = ({
             backgroundColor: 'rgba(0, 0, 0, 0)',
           }}
           onLoadEnd={() => setLoading(false)}
+          onError={(event) => {
+            setLoading(false);
+            pushLog('warn', 'image: load failed', {
+              url: maskToken(displayURL),
+              usingPreview: !!locationPreview,
+              error: (event as any)?.nativeEvent?.error,
+            });
+            if (isSecureFileUrl(displayURL)) {
+              requestFileTokenRecovery();
+            }
+          }}
           // The box already matches the natural aspect ratio, so 'cover'
           // fills it edge-to-edge with no actual cropping or letterboxing.
           resizeMode="cover"

package/src/components/styled/VideoMessage.tsx

@@ -1,6 +1,9 @@
 import React, { useEffect, useState } from 'react';
+import {
+  isSecureFileUrl,
+  requestFileTokenRecovery,
+} from '../../helpers/secureFileUrl';
 import { Image, Pressable, StyleSheet, View } from 'react-native';
-import { useVideoPlayer, VideoView } from 'expo-video';
 import { useDispatch } from 'react-redux';
 import {
   setActiveFile,
@@ -37,12 +40,6 @@ const PlayBadge: React.FC = () => (
  * playback happens in the full-screen preview. Drawing that still with a
  * plain <Image> keeps the whole bubble inside the RN view hierarchy, so
  * the play badge is guaranteed to composite on top of it.
- *
- * The VideoView path below cannot make that promise: expo-video draws
- * into a native surface, and depending on platform, expo-video version
- * and surfaceType that surface can end up above its sibling RN views —
- * swallowing the badge and leaving the video looking like a plain photo.
- * It is also cheaper: no video player instance per row in a long list.
  */
 const PosterVideo: React.FC<{
   previewURL: string;
@@ -85,8 +82,8 @@ const PosterVideo: React.FC<{
         resizeMode="cover"
         // Not every backend returns a real still — some set
         // locationPreview to the video URL itself, which decodes to
-        // nothing. Rather than show an empty box, hand the row back to
-        // the player so it can paint a first frame.
+        // nothing. Rather than show an empty box, fall back to the
+        // static placeholder branch.
         onError={onPosterError}
       />
       <PlayBadge />
@@ -95,61 +92,35 @@ const PosterVideo: React.FC<{
 };
 
 /**
- * Fallback for messages with no usable poster frame: mount the player
- * purely to paint its first frame.
+ * Fallback for messages with no usable poster frame: a static dark
+ * placeholder behind the play badge.
+ *
+ * This branch used to mount an expo-video player purely to paint the
+ * first frame (`VideoView` + `surfaceType="textureView"`). That never
+ * composited reliably: on Android (Pixel, Android 16, New Architecture)
+ * the native video surface draws ABOVE sibling RN views, swallowing the
+ * play badge — the video looked like a plain photo. There is no
+ * surfaceType/zIndex combination that guarantees ordering across SDK 54
+ * and 57, so we don't fight it: no live surface in the bubble at all.
+ * The badge is plain RN views over a plain RN background, which cannot
+ * be occluded, and we drop the per-row player instance as a bonus.
+ * Actual playback (and the real first frame) happens in the full-screen
+ * preview modal.
  */
-const VideoSurfaceVideo: React.FC<{
-  fileURL: string;
+const PlaceholderVideo: React.FC<{
   onOpen: () => void;
-}> = ({ fileURL, onOpen }) => {
-  const [dims, setDims] = useState<MediaDims>(defaultMediaDims());
-
-  const player = useVideoPlayer(fileURL, (p) => {
-    p.muted = true;
-  });
-
-  useEffect(() => {
-    const sub = player.addListener('statusChange', () => {
-      const size = player.videoTrack?.size;
-      if (size?.width && size?.height) {
-        setDims(fitMediaDimensions(size.width, size.height));
-      }
-    });
-    return () => sub.remove();
-  }, [player]);
+}> = ({ onOpen }) => {
+  const dims = defaultMediaDims();
 
   return (
-    // Capture-overlay pattern: VideoView sits underneath without ANY
-    // touch participation; a transparent absolute-fill <Pressable> on
-    // top owns the tap. Previously we wrapped VideoView in a
-    // TouchableOpacity and set `pointerEvents="none"` on the inner
-    // VideoView — but on some expo-video versions / iOS the native
-    // VideoView still intercepted gestures despite that hint, so
-    // tapping the poster did nothing. Customer-reported #9 (video
-    // preview unresponsive). The Pressable now guarantees the tap
-    // reaches `onOpen`.
-    <View
+    <Pressable
+      onPress={onOpen}
       style={[styles.wrapper, { width: dims.width, height: dims.height }]}
+      accessibilityRole="button"
+      accessibilityLabel="Play video"
     >
-      <VideoView
-        player={player}
-        style={styles.video}
-        contentFit="cover"
-        nativeControls={false}
-        surfaceType="textureView"
-        pointerEvents="none"
-      />
       <PlayBadge />
-      <Pressable
-        onPress={onOpen}
-        // Sits ON TOP of VideoView + the play-button overlay; transparent
-        // so the poster + play icon show through. Captures the tap and
-        // routes to onOpen → setActiveModal(FILE_PREVIEW).
-        style={StyleSheet.absoluteFill}
-        accessibilityRole="button"
-        accessibilityLabel="Play video"
-      />
-    </View>
+    </Pressable>
   );
 };
 
@@ -172,12 +143,17 @@ const CustomMessageVideo: React.FC<CustomMessageVideoProps> = ({
       <PosterVideo
         previewURL={previewURL}
         onOpen={handleOpen}
-        onPosterError={() => setPosterFailed(true)}
+        onPosterError={() => {
+          if (isSecureFileUrl(previewURL)) {
+            requestFileTokenRecovery();
+          }
+          setPosterFailed(true);
+        }}
       />
     );
   }
 
-  return <VideoSurfaceVideo fileURL={fileURL} onOpen={handleOpen} />;
+  return <PlaceholderVideo onOpen={handleOpen} />;
 };
 
 export default CustomMessageVideo;
@@ -193,7 +169,7 @@ const styles = StyleSheet.create({
     height: '100%',
   },
   overlay: {
-    ...StyleSheet.absoluteFillObject,
+    ...StyleSheet.absoluteFill,
     justifyContent: 'center',
     alignItems: 'center',
   },

package/src/context/xmppProvider.tsx

@@ -14,7 +14,7 @@ import { VideoCallOverlay } from '../components/VideoCalls/VideoCallOverlay';
 import XmppClient, {
   XmppCredentialsProvider,
 } from '../networking/xmppClient';
-import { refreshTokens } from '../roomStore/chatSettingsSlice';
+import { refreshAuthTokensQuietly } from '../networking/authRefresh';
 import {
   IConfig,
   ProviderBootstrapStatus,
@@ -107,23 +107,25 @@ export const XmppProvider: React.FC<XmppProviderProps> = ({ children, config, is
   // the XmppClient at least doesn't crash on `undefined.password`.
   const credentialsProvider = useMemo<XmppCredentialsProvider>(() => {
     return async () => {
-      // 1. Consumer-supplied REST refresh (when wired). This runs
-      //    before the SDK's own refresh chain so non-Ethora backends
-      //    can keep auth state in sync with their own token endpoint.
-      const customRefresh = config?.refreshTokens?.refreshFunction;
-      if (customRefresh) {
-        try {
-          const result = await customRefresh();
-          if (result?.accessToken) {
-            store.dispatch(
-              refreshTokens({
-                token: result.accessToken,
-                refreshToken: result.refreshToken || '',
-              })
-            );
-          }
-        } catch (err) {
-          devPushLog('warn', 'XMPP creds refresh: customRefresh failed', err);
+      // 1. Make sure the REST tokens are fresh before re-minting XMPP
+      //    creds. This used to call `config.refreshTokens.refreshFunction`
+      //    directly and then fall into step 2, which refreshes again —
+      //    two rotations back to back, which the new backend scheme
+      //    reads as a race at best and token reuse at worst. One call to
+      //    the shared rotation point covers both the consumer-supplied
+      //    function and the built-in endpoint.
+      if (config?.refreshTokens?.enabled) {
+        const rotated = await refreshAuthTokensQuietly();
+
+        if (rotated?.xmppPassword) {
+          const rotatedUser = store.getState().chatSettingStore.user;
+          return {
+            username:
+              rotatedUser?.xmppUsername ||
+              rotatedUser?.defaultWallet?.walletAddress ||
+              '',
+            password: rotated.xmppPassword,
+          };
         }
       }
 
@@ -163,7 +165,7 @@ export const XmppProvider: React.FC<XmppProviderProps> = ({ children, config, is
   }, [
     config?.jwtLogin?.enabled,
     config?.jwtLogin?.token,
-    config?.refreshTokens?.refreshFunction,
+    config?.refreshTokens?.enabled,
     config?.userLogin?.enabled,
     config?.customLogin?.enabled,
     config?.initBeforeLoadAuth?.myEndpoint,
@@ -353,6 +355,29 @@ export const XmppProvider: React.FC<XmppProviderProps> = ({ children, config, is
           store.dispatch(setConfig(config));
         }
 
+        // Rotate BEFORE the first XMPP connect. On the rotating backend
+        // the xmpp password is a short-lived JWT that only the newest
+        // rotation knows, and each rotation invalidates its predecessors
+        // — so a snapshot's password (a host's cached `userLogin.user`,
+        // a persisted session) is usually already dead at boot. Without
+        // this, the first SASL attempt fails `not-authorized`, all three
+        // bootstrap retries re-present the same dead password, and the
+        // user dead-ends on the Connection error modal even though one
+        // rotation away a perfectly good session existed. The rotation
+        // also lands the fileToken pre-render, so secure media never
+        // paints blank first. Quiet + deduped; when it can't rotate
+        // (no refresh material, non-rotating backend) we just connect
+        // with what the snapshot has, exactly as before.
+        // jwtLogin is skipped: /users/client just minted fresh creds.
+        let connectPassword = resolved.xmppPassword;
+        if (config?.refreshTokens?.enabled && !config?.jwtLogin?.enabled) {
+          const rotated = await refreshAuthTokensQuietly();
+          if (cancelled) {return;}
+          if (rotated?.xmppPassword) {
+            connectPassword = rotated.xmppPassword;
+          }
+        }
+
         // Kick off REST /chats/my; allRoomPresences below needs the
         // room list to be in redux, otherwise it joins 0 MUCs and the
         // user receives zero realtime messages until they manually tap
@@ -362,7 +387,7 @@ export const XmppProvider: React.FC<XmppProviderProps> = ({ children, config, is
 
         const c = await initializeClient(
           resolved.xmppUsername!,
-          resolved.xmppPassword,
+          connectPassword,
           config?.xmppSettings
         );
         if (cancelled) {return;}

package/src/helpers/initXmppRooms.tsx

@@ -4,6 +4,7 @@ import { initRoomsPresence } from './initRoomsPresence';
 import XmppClient from '../networking/xmppClient';
 import { IConfig, IRoom, User } from '../types/types';
 import { store } from '../roomStore';
+import { refreshAuthTokensQuietly } from '../networking/authRefresh';
 
 const initXmppRooms = async (
   user: User,
@@ -59,7 +60,10 @@ const initXmppRooms = async (
     }
 
     if (config?.refreshTokens?.enabled) {
-      config?.refreshTokens?.refreshFunction?.();
+      // Was a bare call to the consumer-supplied refreshFunction, i.e. a
+      // rotation completely outside the SDK's lock. Routed through the
+      // one rotation point, which calls that same function internally.
+      refreshAuthTokensQuietly();
     }
   } catch (error) {
     console.error(error);

package/src/helpers/resolveInitBeforeLoadUser.ts

@@ -1,4 +1,5 @@
-import http, { setBaseURL } from '../networking/apiClient';
+import { setBaseURL } from '../networking/apiClient';
+import { refreshAuthTokens, isRefreshFatalError } from '../networking/authRefresh';
 import { loginViaJwt } from '../networking/api-requests/auth.api';
 import { getMyUser } from '../networking/api-requests/user.api';
 import { IConfig, User } from '../types/types';
@@ -46,15 +47,109 @@ const normalizeUserForXmpp = (user?: User | null): User | null => {
   return { ...user, xmppUsername: normalizedXmppUsername };
 };
 
+// Hermes has no atob/Buffer; hand-decode just enough base64url to read a
+// JWT's `iat`. Claims are ASCII so the byte-per-char string is fine.
+const B64_ALPHABET =
+  'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';
+
+const readJwtIat = (token?: string | null): number => {
+  if (!token || typeof token !== 'string') {return 0;}
+  const part = token.split('.')[1];
+  if (!part) {return 0;}
+  try {
+    const clean = part.replace(/-/g, '+').replace(/_/g, '/');
+    let out = '';
+    let buffer = 0;
+    let bits = 0;
+    for (let i = 0; i < clean.length; i++) {
+      const idx = B64_ALPHABET.indexOf(clean[i]);
+      if (idx === -1) {continue;}
+      buffer = (buffer << 6) | idx;
+      bits += 6;
+      if (bits >= 8) {
+        bits -= 8;
+        out += String.fromCharCode((buffer >> bits) & 0xff);
+      }
+    }
+    const iat = JSON.parse(out)?.iat;
+    return typeof iat === 'number' ? iat : 0;
+  } catch {
+    return 0;
+  }
+};
+
+/**
+ * A `userLogin.user` is typically a snapshot the host captured at ITS
+ * login time and re-presents verbatim on every mount, while this SDK
+ * keeps rotating the session and persisting the newest pair to
+ * `ETHORA_USER`. Taking the snapshot as-is therefore discards the live
+ * session in favour of an ever-aging copy: media goes blank the moment
+ * the snapshot has no `fileToken` (secure-files URLs 401 without it),
+ * and once the snapshot's refresh token ages out entirely the account
+ * looks dead even though the SDK held a working session all along.
+ *
+ * So, for the SAME account only, prefer whichever refresh pair was
+ * minted later (JWT `iat` decides — a host that genuinely re-logged-in
+ * hands us newer tokens and wins), and fill in a missing `fileToken`
+ * from the persisted copy either way.
+ */
+const adoptFresherPersistedSession = async (candidate: User): Promise<User> => {
+  try {
+    const stored = await asyncLocalStorage<User>(
+      localStorageConstants.ETHORA_USER
+    ).get();
+    if (!stored) {return candidate;}
+
+    const sameUser =
+      (candidate._id && stored._id && candidate._id === stored._id) ||
+      (candidate.xmppUsername &&
+        stored.xmppUsername &&
+        candidate.xmppUsername === stored.xmppUsername);
+    if (!sameUser) {return candidate;}
+
+    const merged = { ...candidate };
+
+    if (
+      stored.refreshToken &&
+      readJwtIat(stored.refreshToken) > readJwtIat(candidate.refreshToken)
+    ) {
+      merged.refreshToken = stored.refreshToken;
+      if (stored.token) {merged.token = stored.token;}
+      if (stored.fileToken) {merged.fileToken = stored.fileToken;}
+    }
+
+    if (!merged.fileToken && stored.fileToken) {
+      merged.fileToken = stored.fileToken;
+    }
+
+    return merged;
+  } catch {
+    return candidate;
+  }
+};
+
+/**
+ * Bootstrap rotation.
+ *
+ * Was a second, independent `/users/login/refresh` caller that bypassed
+ * every lock in the SDK — and, worse, only wrote the rotated token to
+ * the store on the happy path, so several of the early-return branches
+ * below used to drop it. Under the backend's reuse detection a dropped
+ * rotation means the next launch presents a burned token and the
+ * session is killed.
+ *
+ * `refreshAuthTokens` persists the new pair before it resolves, so by
+ * the time this returns the rotation is safe no matter which branch the
+ * caller takes afterwards. The explicit token is required here: during
+ * bootstrap the candidate session isn't in the store yet.
+ */
 const refreshWithToken = async (refreshToken: string) => {
-  const response = await http.post(
-    '/users/login/refresh',
-    {},
-    { headers: { Authorization: refreshToken } }
-  );
+  const result = await refreshAuthTokens({ refreshToken });
   return {
-    token: response?.data?.token || '',
-    refreshToken: response?.data?.refreshToken || refreshToken,
+    token: result.token,
+    refreshToken: result.refreshToken || refreshToken,
+    xmppPassword: result.xmppPassword || '',
+    fileToken: result.fileToken || '',
   };
 };
 
@@ -87,11 +182,15 @@ const tryHydrateViaMy = async (
 
   let workingToken = candidate?.token || '';
   let workingRefresh = candidate?.refreshToken || '';
+  let rotatedXmppPassword = '';
+  let workingFileToken = candidate?.fileToken || '';
 
   const candidateWithCurrentTokens = (): User => ({
     ...candidate,
     token: workingToken || candidate.token,
     refreshToken: workingRefresh || candidate.refreshToken,
+    xmppPassword: rotatedXmppPassword || candidate.xmppPassword,
+    fileToken: workingFileToken || candidate.fileToken,
   });
 
   const fallbackWithCreds = (): User | null => {
@@ -107,6 +206,8 @@ const tryHydrateViaMy = async (
       if (merged) {
         merged.token = workingToken || merged.token;
         merged.refreshToken = workingRefresh || merged.refreshToken;
+        merged.xmppPassword = rotatedXmppPassword || merged.xmppPassword;
+        merged.fileToken = workingFileToken || merged.fileToken;
       }
       return merged;
     } catch (error) {
@@ -127,6 +228,8 @@ const tryHydrateViaMy = async (
     const refreshed = await refreshWithToken(workingRefresh);
     workingToken = refreshed.token;
     workingRefresh = refreshed.refreshToken;
+    rotatedXmppPassword = refreshed.xmppPassword || rotatedXmppPassword;
+    workingFileToken = refreshed.fileToken || workingFileToken;
 
     try {
       const myUser = await getMyUser({ token: workingToken, endpoint: myEndpoint });
@@ -136,6 +239,8 @@ const tryHydrateViaMy = async (
       if (merged) {
         merged.token = workingToken || merged.token;
         merged.refreshToken = workingRefresh || merged.refreshToken;
+        merged.xmppPassword = rotatedXmppPassword || merged.xmppPassword;
+        merged.fileToken = workingFileToken || merged.fileToken;
       }
       return merged;
     } catch (myError) {
@@ -147,6 +252,11 @@ const tryHydrateViaMy = async (
     }
   } catch (error) {
     if (signal?.aborted || isAbortError(error)) {return null;}
+    // A fatal refresh verdict (reuse detected / token not found / stale
+    // with nothing newer around) carries no HTTP response, so it would
+    // otherwise fall through to `throw` — the session is simply dead,
+    // which for bootstrap means "nothing to restore".
+    if (isRefreshFatalError(error)) {return null;}
     if (isAuthError(error)) {return null;}
     throw error;
   }
@@ -162,13 +272,15 @@ export const resolveInitBeforeLoadUser = async (
     setBaseURL(config.baseUrl, config.customAppToken);
   }
 
-  const myEndpoint = config?.initBeforeLoadAuth?.myEndpoint || '/users/my';
+  const myEndpoint = config?.initBeforeLoadAuth?.myEndpoint || '/v1/users/my';
 
   // Priority 1: explicit userLogin
   const explicitUser = config?.userLogin?.enabled ? config?.userLogin?.user : null;
   if (explicitUser) {
     const candidate = normalizeUserForXmpp(explicitUser);
-    if (candidate && hasXmppCredentials(candidate)) {return candidate;}
+    if (candidate && hasXmppCredentials(candidate)) {
+      return await adoptFresherPersistedSession(candidate);
+    }
 
     const hydrated = await tryHydrateViaMy(explicitUser, myEndpoint, signal).catch(
       () => null
@@ -275,7 +387,7 @@ export const refreshUserCredentialsForXmpp = async (
     }
   }
 
-  const myEndpoint = config?.initBeforeLoadAuth?.myEndpoint || '/users/my';
+  const myEndpoint = config?.initBeforeLoadAuth?.myEndpoint || '/v1/users/my';
 
   // Priority 2: redux store user (covers userLogin + customLogin +
   // anything previously persisted into chatSettingStore.user). The