@ethora/chat-component-rn 26.6.12 → 26.7.1

package/lib/module/networking/apiClient.js

@@ -2,8 +2,9 @@
 
 import axios from 'axios';
 import { store } from '../roomStore';
-import { logout, refreshTokens } from '../roomStore/chatSettingsSlice';
+import { logout } from '../roomStore/chatSettingsSlice';
 import { installAxiosCapture } from '../utils/devLogger';
+import { refreshAuthTokens, isRefreshFatalError } from './authRefresh';
 
 // Per product-code-policy: no compiled-in Ethora endpoints or tokens.
 // Consumers must call `setBaseURL(baseUrl, appToken)` (or pass
@@ -19,10 +20,24 @@ const http = axios.create({
 // Dev-logger hook: capture every request + response on the shared
 // `http` instance.
 installAxiosCapture(http);
+const stripApiVersion = baseUrl => baseUrl.replace(/\/+$/, '').replace(/\/v\d+$/, '');
+export const normalizeApiPath = path => {
+  if (!path) {
+    return path;
+  }
+  if (/^https?:\/\//i.test(path)) {
+    return path;
+  }
+  if (/^\/v\d+\//.test(path)) {
+    return path;
+  }
+  return `/v1${path.startsWith('/') ? '' : '/'}${path}`;
+};
 export function setBaseURL(baseUrl, appToken) {
-  if (baseUrl && baseUrl !== currentBaseURL) {
-    currentBaseURL = baseUrl;
-    http.defaults.baseURL = baseUrl;
+  const normalized = baseUrl ? stripApiVersion(baseUrl) : baseUrl;
+  if (normalized && normalized !== currentBaseURL) {
+    currentBaseURL = normalized;
+    http.defaults.baseURL = normalized;
   }
   if (appToken && appToken !== currentAppToken) {
     currentAppToken = appToken;
@@ -34,132 +49,65 @@ export function getCurrentAppToken() {
 export function getCurrentBaseURL() {
   return currentBaseURL;
 }
+
+/**
+ * @deprecated Import `refreshAuthTokens` from `./authRefresh` instead.
+ *
+ * Kept as a thin forwarder so existing call sites keep working while
+ * they migrate. Declared as a function (not `const refresh =
+ * refreshAuthTokens`) on purpose: this module and `authRefresh` import
+ * each other, and a const would capture the binding before the other
+ * module finished evaluating.
+ */
 export function refresh() {
-  return new Promise((resolve, reject) => {
-    const user = store.getState().chatSettingStore.user;
-    try {
-      http.post('/users/login/refresh', {}, {
-        headers: {
-          Authorization: user.refreshToken
-        }
-      }).then(response => {
-        store.dispatch(refreshTokens({
-          token: response.data.token,
-          refreshToken: response.data.refreshToken
-        }));
-        // BUGFIX: previously the `.then` only dispatched and never
-        // resolved, so every `await refresh()` callsite hung forever
-        // on the happy path. Resolve with the axios response shape so
-        // the interceptor can read `tokens.data.token` to retry.
-        resolve(response);
-      }).catch(error => {
-        reject(error);
-      });
-    } catch (error) {
-      // BUGFIX: previously the outer-try catch dispatched logout but
-      // never rejected, so a synchronous throw from `http.post` (e.g.
-      // a bad URL) would hang the promise. Reject explicitly.
-      console.log('errr');
-      store.dispatch(logout());
-      reject(error);
-    }
-  });
+  return refreshAuthTokens();
 }
-let isRefreshing = false;
-let failedQueue = [];
-const addRequestToQueue = config => {
-  return new Promise((resolve, reject) => {
-    failedQueue.push({
-      resolve,
-      reject,
-      config
-    });
-  });
-};
-const processQueue = newAccessToken => {
-  for (const request of failedQueue) {
-    if (newAccessToken) {
-      request.config.headers.Authorization = newAccessToken;
-    }
-    request.resolve(http(request.config));
-  }
-  failedQueue = [];
-};
 http.interceptors.response.use(response => response, async error => {
-  // BUGFIX: the original condition was `if (!enabled)` — inverted, so
-  // turning `refreshTokens.enabled: true` actually DISABLED the refresh
-  // path on 401. Use the correct sense.
-  if (!store.getState().chatSettingStore?.config?.refreshTokens?.enabled) {
-    // BUGFIX: previously this branch fell off the end of the async
-    // function and returned `undefined`, which axios treats as a
-    // resolved-with-undefined response. Callers expecting an error
-    // got `undefined` instead, silently swallowing every failure
-    // when the refresh path isn't configured. Re-reject so the
-    // original error reaches the caller.
-    return Promise.reject(error);
-  }
   const originalRequest = error.config;
   const status = error.response?.status;
 
   // Refresh paths only fire on 401. Anything else passes through.
-  if (!error.response || status !== 401) {
+  if (!error.response || status !== 401 || !originalRequest) {
     return Promise.reject(error);
   }
-  if (store.getState().chatSettingStore?.config?.refreshTokens?.refreshFunction) {
-    // Consumer-supplied refresh function. Call it, dispatch the new
-    // tokens, retry the original request.
-    try {
-      const fn = store.getState().chatSettingStore?.config?.refreshTokens?.refreshFunction;
-      if (!fn) return Promise.reject(error);
-      const result = await fn();
-      const {
-        refreshToken: newRefreshToken,
-        accessToken
-      } = result || {
-        refreshToken: '',
-        accessToken: ''
-      };
-      store.dispatch(refreshTokens({
-        token: accessToken,
-        refreshToken: newRefreshToken || ''
-      }));
-      // BUGFIX: previously this branch returned `undefined` after
-      // dispatching, so the original request was never retried and
-      // the caller resolved with undefined. Stamp the new token on
-      // the original config and replay.
-      if (originalRequest?.headers) {
-        originalRequest.headers.Authorization = accessToken;
-      }
-      return http(originalRequest);
-    } catch (refreshErr) {
-      return Promise.reject(refreshErr);
-    }
+
+  // Never retry twice, and never touch the auth endpoints themselves —
+  // both would recurse. (`_retry` was set but never checked before,
+  // so a request could bounce between 401 and replay indefinitely.)
+  if (originalRequest._retry || originalRequest.url === '/v1/users/login/refresh' || originalRequest.url === '/v1/users/login') {
+    return Promise.reject(error);
   }
+  const refreshConfig = store.getState().chatSettingStore?.config?.refreshTokens;
 
-  // Built-in `/users/login/refresh` path. Skip if the failing request
-  // IS the refresh / login itself — otherwise we'd loop forever.
-  if (originalRequest.url === '/users/login/refresh' || originalRequest.url === '/users/login') {
+  // BUGFIX (kept): the original condition here was inverted, so
+  // `refreshTokens.enabled: true` actually DISABLED the refresh path.
+  if (!refreshConfig?.enabled) {
     return Promise.reject(error);
   }
-  originalRequest._retry = true;
-  if (isRefreshing) {
-    const retryOriginalRequest = addRequestToQueue(originalRequest);
-    return retryOriginalRequest;
+
+  // Nothing to rotate with — reject rather than firing a doomed
+  // refresh that would look like a bad-token event to the backend.
+  const hasRefreshableSession = Boolean(refreshConfig.refreshFunction || store.getState().chatSettingStore.user?.refreshToken);
+  if (!hasRefreshableSession) {
+    return Promise.reject(error);
   }
-  isRefreshing = true;
+  originalRequest._retry = true;
   try {
-    const tokens = await refresh();
-    // (was: console.log('tokens', tokens) — dumped the full response
-    // incl. access/refresh/ws tokens on every refresh; removed.)
-    isRefreshing = false;
-    originalRequest.headers.Authorization = tokens.data.token;
-    processQueue(tokens.data.token);
+    // One shared rotation for every 401 in flight — `refreshAuthTokens`
+    // dedupes internally, which replaces the old isRefreshing/
+    // failedQueue machinery entirely.
+    const tokens = await refreshAuthTokens();
+    originalRequest.headers = originalRequest.headers || {};
+    originalRequest.headers.Authorization = tokens.token;
     return http(originalRequest);
   } catch (refreshErr) {
-    isRefreshing = false;
-    // BUGFIX: previously this returned the error (resolving the
-    // promise with the error as value) instead of rejecting, so
-    // axios callers got the error as a "successful" response body.
+    // Only a genuinely dead session logs the user out. A network
+    // blip, a 5xx, or a REFRESH_IN_PROGRESS race must leave the
+    // session alone — logging out on those is exactly the mass-logout
+    // failure mode the new backend scheme would otherwise cause.
+    if (isRefreshFatalError(refreshErr)) {
+      store.dispatch(logout());
+    }
     return Promise.reject(refreshErr);
   }
 });

package/lib/module/networking/apiClient.js.map

@@ -1 +1 @@
-{"version":3,"names":["axios","store","logout","refreshTokens","installAxiosCapture","DEFAULT_BASE_URL","currentBaseURL","currentAppToken","http","create","baseURL","setBaseURL","baseUrl","appToken","defaults","getCurrentAppToken","getCurrentBaseURL","refresh","Promise","resolve","reject","user","getState","chatSettingStore","post","headers","Authorization","refreshToken","then","response","dispatch","token","data","catch","error","console","log","isRefreshing","failedQueue","addRequestToQueue","config","push","processQueue","newAccessToken","request","interceptors","use","enabled","originalRequest","status","refreshFunction","fn","result","newRefreshToken","accessToken","refreshErr","url","_retry","retryOriginalRequest","tokens"],"sourceRoot":"../../../src","sources":["networking/apiClient.ts"],"mappings":";;AAAA,OAAOA,KAAK,MAAM,OAAO;AACzB,SAASC,KAAK,QAAQ,cAAc;AAEpC,SAASC,MAAM,EAAEC,aAAa,QAAQ,gCAAgC;AACtE,SAASC,mBAAmB,QAAQ,oBAAoB;;AAExD;AACA;AACA;AACA;AACA,MAAMC,gBAAgB,GAAG,EAAE;AAE3B,IAAIC,cAAc,GAAGD,gBAAgB;AACrC,IAAIE,eAAuB,GAAG,EAAE;AAEhC,MAAMC,IAAI,GAAGR,KAAK,CAACS,MAAM,CAAC;EACxBC,OAAO,EAAEJ;AACX,CAAC,CAAC;;AAEF;AACA;AACAF,mBAAmB,CAACI,IAAI,CAAC;AAEzB,OAAO,SAASG,UAAUA,CAACC,OAAgB,EAAEC,QAAiB,EAAE;EAC9D,IAAID,OAAO,IAAIA,OAAO,KAAKN,cAAc,EAAE;IACzCA,cAAc,GAAGM,OAAO;IACxBJ,IAAI,CAACM,QAAQ,CAACJ,OAAO,GAAGE,OAAO;EACjC;EACA,IAAIC,QAAQ,IAAIA,QAAQ,KAAKN,eAAe,EAAE;IAC5CA,eAAe,GAAGM,QAAQ;EAC5B;AACF;AAEA,OAAO,SAASE,kBAAkBA,CAAA,EAAG;EACnC,OAAOR,eAAe;AACxB;AAEA,OAAO,SAASS,iBAAiBA,CAAA,EAAG;EAClC,OAAOV,cAAc;AACvB;AAEA,OAAO,SAASW,OAAOA,CAAA,EAEpB;EACD,OAAO,IAAIC,OAAO,CAAC,CAACC,OAAO,EAAEC,MAAM,KAAK;IACtC,MAAMC,IAAI,GAAGpB,KAAK,CAACqB,QAAQ,CAAC,CAAC,CAACC,gBAAgB,CAACF,IAAI;IACnD,IAAI;MACFb,IAAI,CACDgB,IAAI,CACH,sBAAsB,EACtB,CAAC,CAAC,EACF;QAAEC,OAAO,EAAE;UAAEC,aAAa,EAAEL,IAAI,CAACM;QAAa;MAAE,CAClD,CAAC,CACAC,IAAI,CAAEC,QAAQ,IAAK;QAClB5B,KAAK,CAAC6B,QAAQ,CACZ3B,aAAa,CAAC;UACZ4B,KAAK,EAAEF,QAAQ,CAACG,IAAI,CAACD,KAAK;UAC1BJ,YAAY,EAAEE,QAAQ,CAACG,IAAI,CAACL;QAC9B,CAAC,CACH,CAAC;QACD;QACA;QACA;QACA;QACAR,OAAO,CAACU,QAAQ,CAAC;MACnB,CAAC,CAAC,CACDI,KAAK,CAAEC,KAAK,IAAK;QAChBd,MAAM,CAACc,KAAK,CAAC;MACf,CAAC,CAAC;IACN,CAAC,CAAC,OAAOA,KAAK,EAAE;MACd;MACA;MACA;MACAC,OAAO,CAACC,GAAG,CAAC,MAAM,CAAC;MACnBnC,KAAK,CAAC6B,QAAQ,CAAC5B,MAAM,CAAC,CAAC,CAAC;MACxBkB,MAAM,CAACc,KAAK,CAAC;IACf;EACF,CAAC,CAAC;AACJ;AAEA,IAAIG,YAAY,GAAG,KAAK;AACxB,IAAIC,WAAkB,GAAG,EAAE;AAE3B,MAAMC,iBAAiB,GAAIC,MAAW,IAAK;EACzC,OAAO,IAAItB,OAAO,CAAC,CAACC,OAAO,EAAEC,MAAM,KAAK;IACtCkB,WAAW,CAACG,IAAI,CAAC;MAAEtB,OAAO;MAAEC,MAAM;MAAEoB;IAAO,CAAC,CAAC;EAC/C,CAAC,CAAC;AACJ,CAAC;AAED,MAAME,YAAY,GAAIC,cAAsB,IAAK;EAC/C,KAAK,MAAMC,OAAO,IAAIN,WAAW,EAAE;IACjC,IAAIK,cAAc,EAAE;MAClBC,OAAO,CAACJ,MAAM,CAACf,OAAO,CAACC,aAAa,GAAGiB,cAAc;IACvD;IAEAC,OAAO,CAACzB,OAAO,CAACX,IAAI,CAACoC,OAAO,CAACJ,MAAM,CAAC,CAAC;EACvC;EAEAF,WAAW,GAAG,EAAE;AAClB,CAAC;AAED9B,IAAI,CAACqC,YAAY,CAAChB,QAAQ,CAACiB,GAAG,CAC3BjB,QAAQ,IAAKA,QAAQ,EACtB,MAAOK,KAAK,IAAK;EACf;EACA;EACA;EACA,IAAI,CAACjC,KAAK,CAACqB,QAAQ,CAAC,CAAC,CAACC,gBAAgB,EAAEiB,MAAM,EAAErC,aAAa,EAAE4C,OAAO,EAAE;IACtE;IACA;IACA;IACA;IACA;IACA;IACA,OAAO7B,OAAO,CAACE,MAAM,CAACc,KAAK,CAAC;EAC9B;EAEA,MAAMc,eAAe,GAAGd,KAAK,CAACM,MAAM;EACpC,MAAMS,MAAM,GAAGf,KAAK,CAACL,QAAQ,EAAEoB,MAAM;;EAErC;EACA,IAAI,CAACf,KAAK,CAACL,QAAQ,IAAIoB,MAAM,KAAK,GAAG,EAAE;IACrC,OAAO/B,OAAO,CAACE,MAAM,CAACc,KAAK,CAAC;EAC9B;EAEA,IACEjC,KAAK,CAACqB,QAAQ,CAAC,CAAC,CAACC,gBAAgB,EAAEiB,MAAM,EAAErC,aAAa,EAAE+C,eAAe,EACzE;IACA;IACA;IACA,IAAI;MACF,MAAMC,EAAE,GAAGlD,KAAK,CAACqB,QAAQ,CAAC,CAAC,CAACC,gBAAgB,EAAEiB,MAAM,EAAErC,aAAa,EAAE+C,eAAe;MACpF,IAAI,CAACC,EAAE,EAAE,OAAOjC,OAAO,CAACE,MAAM,CAACc,KAAK,CAAC;MACrC,MAAMkB,MAAM,GAAG,MAAMD,EAAE,CAAC,CAAC;MACzB,MAAM;QAAExB,YAAY,EAAE0B,eAAe;QAAEC;MAAY,CAAC,GAAGF,MAAM,IAAI;QAAEzB,YAAY,EAAE,EAAE;QAAE2B,WAAW,EAAE;MAAG,CAAC;MACtGrD,KAAK,CAAC6B,QAAQ,CACZ3B,aAAa,CAAC;QACZ4B,KAAK,EAAEuB,WAAW;QAClB3B,YAAY,EAAE0B,eAAe,IAAI;MACnC,CAAC,CACH,CAAC;MACD;MACA;MACA;MACA;MACA,IAAIL,eAAe,EAAEvB,OAAO,EAAE;QAC5BuB,eAAe,CAACvB,OAAO,CAACC,aAAa,GAAG4B,WAAW;MACrD;MACA,OAAO9C,IAAI,CAACwC,eAAe,CAAC;IAC9B,CAAC,CAAC,OAAOO,UAAU,EAAE;MACnB,OAAOrC,OAAO,CAACE,MAAM,CAACmC,UAAU,CAAC;IACnC;EACF;;EAEA;EACA;EACA,IACEP,eAAe,CAACQ,GAAG,KAAK,sBAAsB,IAC9CR,eAAe,CAACQ,GAAG,KAAK,cAAc,EACtC;IACA,OAAOtC,OAAO,CAACE,MAAM,CAACc,KAAK,CAAC;EAC9B;EAEAc,eAAe,CAACS,MAAM,GAAG,IAAI;EAE7B,IAAIpB,YAAY,EAAE;IAChB,MAAMqB,oBAAoB,GAAGnB,iBAAiB,CAACS,eAAe,CAAC;IAC/D,OAAOU,oBAAoB;EAC7B;EAEArB,YAAY,GAAG,IAAI;EACnB,IAAI;IACF,MAAMsB,MAAM,GAAG,MAAM1C,OAAO,CAAC,CAAC;IAC9B;IACA;IACAoB,YAAY,GAAG,KAAK;IACpBW,eAAe,CAACvB,OAAO,CAACC,aAAa,GAAGiC,MAAM,CAAC3B,IAAI,CAACD,KAAK;IACzDW,YAAY,CAACiB,MAAM,CAAC3B,IAAI,CAACD,KAAK,CAAC;IAC/B,OAAOvB,IAAI,CAACwC,eAAe,CAAC;EAC9B,CAAC,CAAC,OAAOO,UAAU,EAAE;IACnBlB,YAAY,GAAG,KAAK;IACpB;IACA;IACA;IACA,OAAOnB,OAAO,CAACE,MAAM,CAACmC,UAAU,CAAC;EACnC;AACF,CACF,CAAC;AAED,eAAe/C,IAAI","ignoreList":[]}
+{"version":3,"names":["axios","store","logout","installAxiosCapture","refreshAuthTokens","isRefreshFatalError","DEFAULT_BASE_URL","currentBaseURL","currentAppToken","http","create","baseURL","stripApiVersion","baseUrl","replace","normalizeApiPath","path","test","startsWith","setBaseURL","appToken","normalized","defaults","getCurrentAppToken","getCurrentBaseURL","refresh","interceptors","response","use","error","originalRequest","config","status","Promise","reject","_retry","url","refreshConfig","getState","chatSettingStore","refreshTokens","enabled","hasRefreshableSession","Boolean","refreshFunction","user","refreshToken","tokens","headers","Authorization","token","refreshErr","dispatch"],"sourceRoot":"../../../src","sources":["networking/apiClient.ts"],"mappings":";;AAAA,OAAOA,KAAK,MAAM,OAAO;AACzB,SAASC,KAAK,QAAQ,cAAc;AAEpC,SAASC,MAAM,QAAQ,gCAAgC;AACvD,SAASC,mBAAmB,QAAQ,oBAAoB;AACxD,SACEC,iBAAiB,EACjBC,mBAAmB,QAEd,eAAe;;AAEtB;AACA;AACA;AACA;AACA,MAAMC,gBAAgB,GAAG,EAAE;AAE3B,IAAIC,cAAc,GAAGD,gBAAgB;AACrC,IAAIE,eAAuB,GAAG,EAAE;AAEhC,MAAMC,IAAI,GAAGT,KAAK,CAACU,MAAM,CAAC;EACxBC,OAAO,EAAEJ;AACX,CAAC,CAAC;;AAEF;AACA;AACAJ,mBAAmB,CAACM,IAAI,CAAC;AAEzB,MAAMG,eAAe,GAAIC,OAAe,IACtCA,OAAO,CAACC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAACA,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;AAEpD,OAAO,MAAMC,gBAAgB,GAAIC,IAAa,IAAyB;EACrE,IAAI,CAACA,IAAI,EAAE;IAAC,OAAOA,IAAI;EAAC;EACxB,IAAI,eAAe,CAACC,IAAI,CAACD,IAAI,CAAC,EAAE;IAAC,OAAOA,IAAI;EAAC;EAC7C,IAAI,WAAW,CAACC,IAAI,CAACD,IAAI,CAAC,EAAE;IAAC,OAAOA,IAAI;EAAC;EACzC,OAAO,MAAMA,IAAI,CAACE,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,GAAGF,IAAI,EAAE;AACvD,CAAC;AAED,OAAO,SAASG,UAAUA,CAACN,OAAgB,EAAEO,QAAiB,EAAE;EAC9D,MAAMC,UAAU,GAAGR,OAAO,GAAGD,eAAe,CAACC,OAAO,CAAC,GAAGA,OAAO;EAC/D,IAAIQ,UAAU,IAAIA,UAAU,KAAKd,cAAc,EAAE;IAC/CA,cAAc,GAAGc,UAAU;IAC3BZ,IAAI,CAACa,QAAQ,CAACX,OAAO,GAAGU,UAAU;EACpC;EACA,IAAID,QAAQ,IAAIA,QAAQ,KAAKZ,eAAe,EAAE;IAC5CA,eAAe,GAAGY,QAAQ;EAC5B;AACF;AAEA,OAAO,SAASG,kBAAkBA,CAAA,EAAG;EACnC,OAAOf,eAAe;AACxB;AAEA,OAAO,SAASgB,iBAAiBA,CAAA,EAAG;EAClC,OAAOjB,cAAc;AACvB;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASkB,OAAOA,CAAA,EAA2B;EAChD,OAAOrB,iBAAiB,CAAC,CAAC;AAC5B;AAEAK,IAAI,CAACiB,YAAY,CAACC,QAAQ,CAACC,GAAG,CAC3BD,QAAQ,IAAKA,QAAQ,EACtB,MAAOE,KAAK,IAAK;EACf,MAAMC,eAAe,GAAGD,KAAK,CAACE,MAAM;EACpC,MAAMC,MAAM,GAAGH,KAAK,CAACF,QAAQ,EAAEK,MAAM;;EAErC;EACA,IAAI,CAACH,KAAK,CAACF,QAAQ,IAAIK,MAAM,KAAK,GAAG,IAAI,CAACF,eAAe,EAAE;IACzD,OAAOG,OAAO,CAACC,MAAM,CAACL,KAAK,CAAC;EAC9B;;EAEA;EACA;EACA;EACA,IACEC,eAAe,CAACK,MAAM,IACtBL,eAAe,CAACM,GAAG,KAAK,yBAAyB,IACjDN,eAAe,CAACM,GAAG,KAAK,iBAAiB,EACzC;IACA,OAAOH,OAAO,CAACC,MAAM,CAACL,KAAK,CAAC;EAC9B;EAEA,MAAMQ,aAAa,GACjBpC,KAAK,CAACqC,QAAQ,CAAC,CAAC,CAACC,gBAAgB,EAAER,MAAM,EAAES,aAAa;;EAE1D;EACA;EACA,IAAI,CAACH,aAAa,EAAEI,OAAO,EAAE;IAC3B,OAAOR,OAAO,CAACC,MAAM,CAACL,KAAK,CAAC;EAC9B;;EAEA;EACA;EACA,MAAMa,qBAAqB,GAAGC,OAAO,CACnCN,aAAa,CAACO,eAAe,IAC3B3C,KAAK,CAACqC,QAAQ,CAAC,CAAC,CAACC,gBAAgB,CAACM,IAAI,EAAEC,YAC5C,CAAC;EACD,IAAI,CAACJ,qBAAqB,EAAE;IAC1B,OAAOT,OAAO,CAACC,MAAM,CAACL,KAAK,CAAC;EAC9B;EAEAC,eAAe,CAACK,MAAM,GAAG,IAAI;EAE7B,IAAI;IACF;IACA;IACA;IACA,MAAMY,MAAM,GAAG,MAAM3C,iBAAiB,CAAC,CAAC;IACxC0B,eAAe,CAACkB,OAAO,GAAGlB,eAAe,CAACkB,OAAO,IAAI,CAAC,CAAC;IACvDlB,eAAe,CAACkB,OAAO,CAACC,aAAa,GAAGF,MAAM,CAACG,KAAK;IACpD,OAAOzC,IAAI,CAACqB,eAAe,CAAC;EAC9B,CAAC,CAAC,OAAOqB,UAAU,EAAE;IACnB;IACA;IACA;IACA;IACA,IAAI9C,mBAAmB,CAAC8C,UAAU,CAAC,EAAE;MACnClD,KAAK,CAACmD,QAAQ,CAAClD,MAAM,CAAC,CAAC,CAAC;IAC1B;IACA,OAAO+B,OAAO,CAACC,MAAM,CAACiB,UAAU,CAAC;EACnC;AACF,CACF,CAAC;AAED,eAAe1C,IAAI","ignoreList":[]}

package/lib/module/networking/authRefresh.js

@@ -0,0 +1,311 @@
+"use strict";
+
+import http from './apiClient';
+import { store } from '../roomStore';
+import { refreshTokens } from '../roomStore/chatSettingsSlice';
+import { secureUserStorage } from '../helpers/secureUserStorage';
+import { pushLog } from '../utils/devLogger';
+
+/**
+ * THE single refresh-token rotation point for the SDK.
+ *
+ * The backend now runs refresh-token ROTATION with REUSE DETECTION:
+ * every successful `/users/login/refresh` burns the presented refresh
+ * token and issues a new one. Presenting an already-rotated token is
+ * indistinguishable, server-side, from a stolen token — so it is
+ * treated as theft and (once the backend leaves monitor mode and
+ * enables enforcing mode) kills the whole token family.
+ *
+ * That puts three hard obligations on the client:
+ *
+ *   1. Persist the NEW refreshToken from every response, immediately,
+ *      before any other logic can throw and drop it on the floor.
+ *   2. Never rotate concurrently. Two parallel refreshes both start
+ *      from the same token; the loser presents a burned one and looks
+ *      like an attacker. React Native is single-process, so a shared
+ *      in-flight promise is the whole lock — no Web Locks needed (the
+ *      web build of this component does need them, see its own
+ *      `authRefresh.ts`).
+ *   3. Route EVERY refresh path through here. One "side" refresh
+ *      elsewhere in the codebase breaks the scheme for everyone.
+ *
+ * Callers must also stop treating 401 as "log out". Two of the four
+ * refresh error codes are race signals, not auth failures — see
+ * `RefreshErrorCode` below and `RefreshFatalError`.
+ */
+
+/**
+ * Thrown when the session is genuinely dead and the caller must do a
+ * hard logout (clear storage, drop XMPP, send the user to login).
+ *
+ * Anything else this module rejects with — network errors, 5xx, an
+ * unrecognised 401 — is NOT fatal and must NOT trigger a logout.
+ */
+export class RefreshFatalError extends Error {
+  constructor(code, message) {
+    super(message || `Refresh failed: ${code}`);
+    this.name = 'RefreshFatalError';
+    this.code = code;
+    // Required for `instanceof` to survive TS's ES5 class-extends-builtin
+    // downlevelling, which RN's babel preset still applies.
+    Object.setPrototypeOf(this, RefreshFatalError.prototype);
+  }
+}
+export const isRefreshFatalError = error => error instanceof RefreshFatalError || error?.name === 'RefreshFatalError';
+const REFRESH_ENDPOINT = '/v1/users/login/refresh';
+
+/** `REFRESH_IN_PROGRESS` retry budget, per backend guidance (~300ms x 2-3). */
+const IN_PROGRESS_MAX_ATTEMPTS = 3;
+const IN_PROGRESS_BASE_DELAY_MS = 300;
+/**
+ * Jitter matters: after a network blip every client in the app retries
+ * on the same schedule and would hammer the rotation mutex in lockstep.
+ */
+const IN_PROGRESS_JITTER_MS = 150;
+const KNOWN_CODES = ['REFRESH_IN_PROGRESS', 'REFRESH_TOKEN_ALREADY_ROTATED', 'REFRESH_TOKEN_REUSE_DETECTED', 'REFRESH_TOKEN_NOT_FOUND'];
+const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
+const inProgressDelay = attempt => IN_PROGRESS_BASE_DELAY_MS * attempt + Math.floor(Math.random() * IN_PROGRESS_JITTER_MS);
+
+/**
+ * All four codes come back as HTTP 401, so the status alone tells us
+ * nothing — the code in the body is the only signal.
+ *
+ * TODO(backend-confirm): the exact location of `code` in the payload is
+ * not documented yet. Until it is, probe every shape the API uses
+ * elsewhere and take the first hit. Once confirmed, collapse this to
+ * the single real path.
+ */
+export const parseRefreshErrorCode = error => {
+  const response = error?.response;
+  if (!response) {
+    return null;
+  }
+  const data = response.data;
+  const candidates = [data?.code, data?.error?.code, data?.errors?.[0]?.code, data?.error, data?.message, response.headers?.['x-error-code']];
+  for (const candidate of candidates) {
+    if (typeof candidate !== 'string') {
+      continue;
+    }
+    const match = KNOWN_CODES.find(code => candidate.includes(code));
+    if (match) {
+      return match;
+    }
+  }
+  return null;
+};
+const getStoreUser = () => store.getState().chatSettingStore?.user || {};
+
+/**
+ * The refresh token as of RIGHT NOW. Read at the moment of use, never
+ * captured ahead of time — that is the single-process equivalent of the
+ * web build's "re-read inside the lock".
+ *
+ * Redux is the source of truth in RN (one process, one store);
+ * AsyncStorage is only consulted as a cold-start fallback, before
+ * `resolveInitBeforeLoadUser` has hydrated the store.
+ */
+const readCurrentRefreshToken = async () => {
+  const fromStore = getStoreUser().refreshToken;
+  if (fromStore) {
+    return fromStore;
+  }
+  const stored = await secureUserStorage().get();
+  return stored?.refreshToken || '';
+};
+
+/**
+ * Persist BEFORE resolving. The dispatch updates redux (and, until
+ * phase 6 lands, fires its own best-effort AsyncStorage write); the
+ * awaited write below is the one that actually guarantees the rotated
+ * token survives the app being killed a moment later. Losing it means
+ * the next launch presents a burned token — i.e. looks like theft.
+ */
+const persistTokens = async result => {
+  store.dispatch(refreshTokens({
+    token: result.token,
+    refreshToken: result.refreshToken,
+    xmppPassword: result.xmppPassword,
+    fileToken: result.fileToken
+  }));
+  try {
+    // Write the post-dispatch snapshot rather than a read-modify-write
+    // merge, so this can't race the reducer's own write back to a
+    // stale copy of the surrounding user fields.
+    await secureUserStorage().set(store.getState().chatSettingStore.user);
+  } catch (error) {
+    pushLog('warn', 'authRefresh: failed to persist rotated tokens', error);
+  }
+};
+
+/**
+ * A rotation that happened somewhere we didn't drive — currently only
+ * reachable via the ALREADY_ROTATED recovery path, kept separate so the
+ * web build and this one stay structurally identical.
+ */
+const adoptStoredTokens = async () => {
+  const stored = await secureUserStorage().get();
+  if (!stored?.refreshToken || !stored?.token) {
+    return null;
+  }
+  const user = getStoreUser();
+  if (user.refreshToken !== stored.refreshToken) {
+    store.dispatch(refreshTokens({
+      token: stored.token,
+      refreshToken: stored.refreshToken
+    }));
+  }
+  return {
+    token: stored.token,
+    refreshToken: stored.refreshToken,
+    xmppPassword: stored.xmppPassword,
+    fileToken: stored.fileToken
+  };
+};
+
+/** Host-supplied rotation, mirrors `IConfig['refreshTokens']['refreshFunction']`. */
+
+const runConsumerRefresh = async refreshFunction => {
+  const refreshed = await refreshFunction();
+  if (!refreshed?.accessToken) {
+    throw new Error('Custom refresh function did not return an access token');
+  }
+  if (!refreshed.refreshToken) {
+    // Not fatal — some hosts still run non-rotating backends — but on a
+    // rotating one this silently keeps a burned token around, which is
+    // exactly the failure the new scheme punishes.
+    pushLog('warn', 'authRefresh: custom refreshFunction returned no refreshToken; ' + 'keeping the existing one. On a rotating backend this will be ' + 'seen as token reuse.');
+  }
+  const result = {
+    token: refreshed.accessToken,
+    refreshToken: refreshed.refreshToken || (await readCurrentRefreshToken()) || '',
+    xmppPassword: refreshed.xmppPassword,
+    fileToken: refreshed.fileToken
+  };
+  await persistTokens(result);
+  return result;
+};
+const requestRotation = async refreshToken => {
+  const response = await http.post(REFRESH_ENDPOINT, {}, {
+    headers: {
+      Authorization: refreshToken
+    }
+  });
+  const result = {
+    token: response?.data?.token || '',
+    refreshToken: response?.data?.refreshToken || '',
+    wsToken: response?.data?.wsToken,
+    xmppPassword: response?.data?.xmppPassword,
+    fileToken: response?.data?.fileToken
+  };
+  if (!result.token || !result.refreshToken) {
+    throw new Error('Refresh response did not contain both tokens');
+  }
+
+  // Persist first, resolve second. Every early return between here and
+  // the caller is a chance to lose the rotation.
+  await persistTokens(result);
+  return result;
+};
+const performRefresh = async overrideToken => {
+  const consumerRefresh = store.getState().chatSettingStore?.config?.refreshTokens?.refreshFunction;
+  if (consumerRefresh) {
+    // A configured host function wins unconditionally — including over
+    // an explicit bootstrap token. Hosts that embed this SDK often own
+    // the Ethora refresh token themselves (their own storage, their own
+    // rotation) and only hand us a copy; rotating it here would burn
+    // THEIR token behind their back and leave them holding a dead one.
+    //
+    // It still has to be serialised — it hits the same backend mutex —
+    // hence running it inside the shared in-flight promise.
+    return runConsumerRefresh(consumerRefresh);
+  }
+  for (let attempt = 1; attempt <= IN_PROGRESS_MAX_ATTEMPTS; attempt++) {
+    const refreshToken = overrideToken || (await readCurrentRefreshToken());
+    if (!refreshToken) {
+      // Deliberately NOT fatal: a missing token mid-bootstrap must not
+      // nuke a session that is still being hydrated.
+      throw new Error('Refresh token is missing');
+    }
+    try {
+      return await requestRotation(refreshToken);
+    } catch (error) {
+      const code = parseRefreshErrorCode(error);
+      if (code === 'REFRESH_IN_PROGRESS') {
+        if (attempt < IN_PROGRESS_MAX_ATTEMPTS) {
+          await sleep(inProgressDelay(attempt));
+          continue;
+        }
+        // Budget spent. Whoever holds the mutex has very likely
+        // finished and written a newer token — take it if so. Skipped
+        // for an explicit token: it may belong to a different session
+        // than whatever is currently in storage.
+        const adopted = overrideToken ? null : await adoptStoredTokens();
+        if (adopted && adopted.refreshToken !== refreshToken) {
+          return adopted;
+        }
+        throw error;
+      }
+      if (code === 'REFRESH_TOKEN_ALREADY_ROTATED') {
+        // Our copy is stale. If something already wrote a newer token,
+        // this is a benign race — use it. Otherwise the session really
+        // is unrecoverable.
+        const adopted = overrideToken ? null : await adoptStoredTokens();
+        if (adopted && adopted.refreshToken !== refreshToken) {
+          return adopted;
+        }
+        throw new RefreshFatalError(code);
+      }
+      if (code === 'REFRESH_TOKEN_REUSE_DETECTED' || code === 'REFRESH_TOKEN_NOT_FOUND') {
+        throw new RefreshFatalError(code);
+      }
+
+      // Network error, 5xx, plain 401 without a code — pass through
+      // untouched. The caller must not log out on these.
+      throw error;
+    }
+  }
+
+  // Unreachable: the loop either returns or throws.
+  throw new Error('Refresh attempts exhausted');
+};
+let inflight = null;
+
+/**
+ * Rotate the tokens. Concurrent callers share ONE request — this is the
+ * lock the new backend scheme requires.
+ *
+ * Rejects with `RefreshFatalError` when the session is dead (caller
+ * should hard-logout) and with a plain error otherwise (caller should
+ * surface the failure and leave the session alone).
+ */
+export function refreshAuthTokens(options) {
+  if (inflight) {
+    // Whatever that rotation produces is at least as fresh as anything
+    // this caller could have asked for.
+    return inflight;
+  }
+  inflight = performRefresh(options?.refreshToken).finally(() => {
+    inflight = null;
+  });
+  return inflight;
+}
+
+/**
+ * Fire-and-forget variant for call sites that only want "make sure the
+ * tokens are fresh" and have no meaningful error handling — chat
+ * bootstrap, XMPP reconnect. Never rejects.
+ */
+export async function refreshAuthTokensQuietly() {
+  try {
+    return await refreshAuthTokens();
+  } catch (error) {
+    pushLog(isRefreshFatalError(error) ? 'error' : 'warn', 'authRefresh: background refresh failed', error);
+    return null;
+  }
+}
+
+/** Test seam — drops any shared in-flight promise between cases. */
+export function __resetAuthRefreshStateForTests() {
+  inflight = null;
+}
+//# sourceMappingURL=authRefresh.js.map

package/lib/module/networking/authRefresh.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["http","store","refreshTokens","secureUserStorage","pushLog","RefreshFatalError","Error","constructor","code","message","name","Object","setPrototypeOf","prototype","isRefreshFatalError","error","REFRESH_ENDPOINT","IN_PROGRESS_MAX_ATTEMPTS","IN_PROGRESS_BASE_DELAY_MS","IN_PROGRESS_JITTER_MS","KNOWN_CODES","sleep","ms","Promise","resolve","setTimeout","inProgressDelay","attempt","Math","floor","random","parseRefreshErrorCode","response","data","candidates","errors","headers","candidate","match","find","includes","getStoreUser","getState","chatSettingStore","user","readCurrentRefreshToken","fromStore","refreshToken","stored","get","persistTokens","result","dispatch","token","xmppPassword","fileToken","set","adoptStoredTokens","runConsumerRefresh","refreshFunction","refreshed","accessToken","requestRotation","post","Authorization","wsToken","performRefresh","overrideToken","consumerRefresh","config","adopted","inflight","refreshAuthTokens","options","finally","refreshAuthTokensQuietly","__resetAuthRefreshStateForTests"],"sourceRoot":"../../../src","sources":["networking/authRefresh.ts"],"mappings":";;AAAA,OAAOA,IAAI,MAAM,aAAa;AAC9B,SAASC,KAAK,QAAQ,cAAc;AACpC,SAASC,aAAa,QAAQ,gCAAgC;AAC9D,SAASC,iBAAiB,QAAQ,8BAA8B;AAChE,SAASC,OAAO,QAAQ,oBAAoB;;AAG5C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAsBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,iBAAiB,SAASC,KAAK,CAAC;EAG3CC,WAAWA,CAACC,IAAsB,EAAEC,OAAgB,EAAE;IACpD,KAAK,CAACA,OAAO,IAAI,mBAAmBD,IAAI,EAAE,CAAC;IAC3C,IAAI,CAACE,IAAI,GAAG,mBAAmB;IAC/B,IAAI,CAACF,IAAI,GAAGA,IAAI;IAChB;IACA;IACAG,MAAM,CAACC,cAAc,CAAC,IAAI,EAAEP,iBAAiB,CAACQ,SAAS,CAAC;EAC1D;AACF;AAEA,OAAO,MAAMC,mBAAmB,GAC9BC,KAAc,IAEdA,KAAK,YAAYV,iBAAiB,IACjCU,KAAK,EAAwBL,IAAI,KAAK,mBAAmB;AAE5D,MAAMM,gBAAgB,GAAG,yBAAyB;;AAElD;AACA,MAAMC,wBAAwB,GAAG,CAAC;AAClC,MAAMC,yBAAyB,GAAG,GAAG;AACrC;AACA;AACA;AACA;AACA,MAAMC,qBAAqB,GAAG,GAAG;AAEjC,MAAMC,WAA+B,GAAG,CACtC,qBAAqB,EACrB,+BAA+B,EAC/B,8BAA8B,EAC9B,yBAAyB,CAC1B;AAED,MAAMC,KAAK,GAAIC,EAAU,IACvB,IAAIC,OAAO,CAAQC,OAAO,IAAKC,UAAU,CAACD,OAAO,EAAEF,EAAE,CAAC,CAAC;AAEzD,MAAMI,eAAe,GAAIC,OAAe,IACtCT,yBAAyB,GAAGS,OAAO,GACnCC,IAAI,CAACC,KAAK,CAACD,IAAI,CAACE,MAAM,CAAC,CAAC,GAAGX,qBAAqB,CAAC;;AAEnD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMY,qBAAqB,GAChChB,KAAc,IACc;EAC5B,MAAMiB,QAAQ,GAAIjB,KAAK,EAAUiB,QAAQ;EACzC,IAAI,CAACA,QAAQ,EAAE;IACb,OAAO,IAAI;EACb;EAEA,MAAMC,IAAI,GAAGD,QAAQ,CAACC,IAAI;EAC1B,MAAMC,UAAU,GAAG,CACjBD,IAAI,EAAEzB,IAAI,EACVyB,IAAI,EAAElB,KAAK,EAAEP,IAAI,EACjByB,IAAI,EAAEE,MAAM,GAAG,CAAC,CAAC,EAAE3B,IAAI,EACvByB,IAAI,EAAElB,KAAK,EACXkB,IAAI,EAAExB,OAAO,EACbuB,QAAQ,CAACI,OAAO,GAAG,cAAc,CAAC,CACnC;EAED,KAAK,MAAMC,SAAS,IAAIH,UAAU,EAAE;IAClC,IAAI,OAAOG,SAAS,KAAK,QAAQ,EAAE;MACjC;IACF;IACA,MAAMC,KAAK,GAAGlB,WAAW,CAACmB,IAAI,CAAE/B,IAAI,IAAK6B,SAAS,CAACG,QAAQ,CAAChC,IAAI,CAAC,CAAC;IAClE,IAAI8B,KAAK,EAAE;MACT,OAAOA,KAAK;IACd;EACF;EAEA,OAAO,IAAI;AACb,CAAC;AAED,MAAMG,YAAY,GAAGA,CAAA,KAClBxC,KAAK,CAACyC,QAAQ,CAAC,CAAC,CAACC,gBAAgB,EAAEC,IAAI,IAAsB,CAAC,CAAC;;AAElE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,uBAAuB,GAAG,MAAAA,CAAA,KAA6B;EAC3D,MAAMC,SAAS,GAAGL,YAAY,CAAC,CAAC,CAACM,YAAY;EAC7C,IAAID,SAAS,EAAE;IACb,OAAOA,SAAS;EAClB;EAEA,MAAME,MAAM,GAAG,MAAM7C,iBAAiB,CAAC,CAAC,CAAC8C,GAAG,CAAC,CAAC;EAC9C,OAAOD,MAAM,EAAED,YAAY,IAAI,EAAE;AACnC,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMG,aAAa,GAAG,MAAOC,MAAqB,IAAoB;EACpElD,KAAK,CAACmD,QAAQ,CACZlD,aAAa,CAAC;IACZmD,KAAK,EAAEF,MAAM,CAACE,KAAK;IACnBN,YAAY,EAAEI,MAAM,CAACJ,YAAY;IACjCO,YAAY,EAAEH,MAAM,CAACG,YAAY;IACjCC,SAAS,EAAEJ,MAAM,CAACI;EACpB,CAAC,CACH,CAAC;EAED,IAAI;IACF;IACA;IACA;IACA,MAAMpD,iBAAiB,CAAC,CAAC,CAACqD,GAAG,CAC3BvD,KAAK,CAACyC,QAAQ,CAAC,CAAC,CAACC,gBAAgB,CAACC,IACpC,CAAC;EACH,CAAC,CAAC,OAAO7B,KAAK,EAAE;IACdX,OAAO,CAAC,MAAM,EAAE,+CAA+C,EAAEW,KAAK,CAAC;EACzE;AACF,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA,MAAM0C,iBAAiB,GAAG,MAAAA,CAAA,KAA2C;EACnE,MAAMT,MAAM,GAAG,MAAM7C,iBAAiB,CAAC,CAAC,CAAC8C,GAAG,CAAC,CAAC;EAC9C,IAAI,CAACD,MAAM,EAAED,YAAY,IAAI,CAACC,MAAM,EAAEK,KAAK,EAAE;IAC3C,OAAO,IAAI;EACb;EAEA,MAAMT,IAAI,GAAGH,YAAY,CAAC,CAAC;EAC3B,IAAIG,IAAI,CAACG,YAAY,KAAKC,MAAM,CAACD,YAAY,EAAE;IAC7C9C,KAAK,CAACmD,QAAQ,CACZlD,aAAa,CAAC;MACZmD,KAAK,EAAEL,MAAM,CAACK,KAAK;MACnBN,YAAY,EAAEC,MAAM,CAACD;IACvB,CAAC,CACH,CAAC;EACH;EAEA,OAAO;IACLM,KAAK,EAAEL,MAAM,CAACK,KAAK;IACnBN,YAAY,EAAEC,MAAM,CAACD,YAAY;IACjCO,YAAY,EAAEN,MAAM,CAACM,YAAY;IACjCC,SAAS,EAAEP,MAAM,CAACO;EACpB,CAAC;AACH,CAAC;;AAED;;AAQA,MAAMG,kBAAkB,GAAG,MACzBC,eAAkC,IACP;EAC3B,MAAMC,SAAS,GAAG,MAAMD,eAAe,CAAC,CAAC;EAEzC,IAAI,CAACC,SAAS,EAAEC,WAAW,EAAE;IAC3B,MAAM,IAAIvD,KAAK,CAAC,wDAAwD,CAAC;EAC3E;EAEA,IAAI,CAACsD,SAAS,CAACb,YAAY,EAAE;IAC3B;IACA;IACA;IACA3C,OAAO,CACL,MAAM,EACN,gEAAgE,GAC9D,+DAA+D,GAC/D,sBACJ,CAAC;EACH;EAEA,MAAM+C,MAAqB,GAAG;IAC5BE,KAAK,EAAEO,SAAS,CAACC,WAAW;IAC5Bd,YAAY,EACVa,SAAS,CAACb,YAAY,KAAK,MAAMF,uBAAuB,CAAC,CAAC,CAAC,IAAI,EAAE;IACnES,YAAY,EAAEM,SAAS,CAACN,YAAY;IACpCC,SAAS,EAAEK,SAAS,CAACL;EACvB,CAAC;EAED,MAAML,aAAa,CAACC,MAAM,CAAC;EAC3B,OAAOA,MAAM;AACf,CAAC;AAED,MAAMW,eAAe,GAAG,MACtBf,YAAoB,IACO;EAC3B,MAAMf,QAAQ,GAAG,MAAMhC,IAAI,CAAC+D,IAAI,CAC9B/C,gBAAgB,EAChB,CAAC,CAAC,EACF;IAAEoB,OAAO,EAAE;MAAE4B,aAAa,EAAEjB;IAAa;EAAE,CAC7C,CAAC;EAED,MAAMI,MAAqB,GAAG;IAC5BE,KAAK,EAAErB,QAAQ,EAAEC,IAAI,EAAEoB,KAAK,IAAI,EAAE;IAClCN,YAAY,EAAEf,QAAQ,EAAEC,IAAI,EAAEc,YAAY,IAAI,EAAE;IAChDkB,OAAO,EAAEjC,QAAQ,EAAEC,IAAI,EAAEgC,OAAO;IAChCX,YAAY,EAAEtB,QAAQ,EAAEC,IAAI,EAAEqB,YAAY;IAC1CC,SAAS,EAAEvB,QAAQ,EAAEC,IAAI,EAAEsB;EAC7B,CAAC;EAED,IAAI,CAACJ,MAAM,CAACE,KAAK,IAAI,CAACF,MAAM,CAACJ,YAAY,EAAE;IACzC,MAAM,IAAIzC,KAAK,CAAC,8CAA8C,CAAC;EACjE;;EAEA;EACA;EACA,MAAM4C,aAAa,CAACC,MAAM,CAAC;EAC3B,OAAOA,MAAM;AACf,CAAC;AAED,MAAMe,cAAc,GAAG,MACrBC,aAAsB,IACK;EAC3B,MAAMC,eAAe,GACnBnE,KAAK,CAACyC,QAAQ,CAAC,CAAC,CAACC,gBAAgB,EAAE0B,MAAM,EAAEnE,aAAa,EAAEyD,eAAe;EAE3E,IAAIS,eAAe,EAAE;IACnB;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,OAAOV,kBAAkB,CAACU,eAAe,CAAC;EAC5C;EAEA,KAAK,IAAIzC,OAAO,GAAG,CAAC,EAAEA,OAAO,IAAIV,wBAAwB,EAAEU,OAAO,EAAE,EAAE;IACpE,MAAMoB,YAAY,GAAGoB,aAAa,KAAK,MAAMtB,uBAAuB,CAAC,CAAC,CAAC;IAEvE,IAAI,CAACE,YAAY,EAAE;MACjB;MACA;MACA,MAAM,IAAIzC,KAAK,CAAC,0BAA0B,CAAC;IAC7C;IAEA,IAAI;MACF,OAAO,MAAMwD,eAAe,CAACf,YAAY,CAAC;IAC5C,CAAC,CAAC,OAAOhC,KAAK,EAAE;MACd,MAAMP,IAAI,GAAGuB,qBAAqB,CAAChB,KAAK,CAAC;MAEzC,IAAIP,IAAI,KAAK,qBAAqB,EAAE;QAClC,IAAImB,OAAO,GAAGV,wBAAwB,EAAE;UACtC,MAAMI,KAAK,CAACK,eAAe,CAACC,OAAO,CAAC,CAAC;UACrC;QACF;QACA;QACA;QACA;QACA;QACA,MAAM2C,OAAO,GAAGH,aAAa,GAAG,IAAI,GAAG,MAAMV,iBAAiB,CAAC,CAAC;QAChE,IAAIa,OAAO,IAAIA,OAAO,CAACvB,YAAY,KAAKA,YAAY,EAAE;UACpD,OAAOuB,OAAO;QAChB;QACA,MAAMvD,KAAK;MACb;MAEA,IAAIP,IAAI,KAAK,+BAA+B,EAAE;QAC5C;QACA;QACA;QACA,MAAM8D,OAAO,GAAGH,aAAa,GAAG,IAAI,GAAG,MAAMV,iBAAiB,CAAC,CAAC;QAChE,IAAIa,OAAO,IAAIA,OAAO,CAACvB,YAAY,KAAKA,YAAY,EAAE;UACpD,OAAOuB,OAAO;QAChB;QACA,MAAM,IAAIjE,iBAAiB,CAACG,IAAI,CAAC;MACnC;MAEA,IACEA,IAAI,KAAK,8BAA8B,IACvCA,IAAI,KAAK,yBAAyB,EAClC;QACA,MAAM,IAAIH,iBAAiB,CAACG,IAAI,CAAC;MACnC;;MAEA;MACA;MACA,MAAMO,KAAK;IACb;EACF;;EAEA;EACA,MAAM,IAAIT,KAAK,CAAC,4BAA4B,CAAC;AAC/C,CAAC;AAcD,IAAIiE,QAAuC,GAAG,IAAI;;AAElD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,iBAAiBA,CAC/BC,OAAwB,EACA;EACxB,IAAIF,QAAQ,EAAE;IACZ;IACA;IACA,OAAOA,QAAQ;EACjB;EAEAA,QAAQ,GAAGL,cAAc,CAACO,OAAO,EAAE1B,YAAY,CAAC,CAAC2B,OAAO,CAAC,MAAM;IAC7DH,QAAQ,GAAG,IAAI;EACjB,CAAC,CAAC;EAEF,OAAOA,QAAQ;AACjB;;AAEA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeI,wBAAwBA,CAAA,EAAkC;EAC9E,IAAI;IACF,OAAO,MAAMH,iBAAiB,CAAC,CAAC;EAClC,CAAC,CAAC,OAAOzD,KAAK,EAAE;IACdX,OAAO,CACLU,mBAAmB,CAACC,KAAK,CAAC,GAAG,OAAO,GAAG,MAAM,EAC7C,wCAAwC,EACxCA,KACF,CAAC;IACD,OAAO,IAAI;EACb;AACF;;AAEA;AACA,OAAO,SAAS6D,+BAA+BA,CAAA,EAAS;EACtDL,QAAQ,GAAG,IAAI;AACjB","ignoreList":[]}

package/lib/module/networking/xmppClient.js

@@ -74,6 +74,12 @@ function isNotAuthorizedError(err) {
   const message = (err?.message || err?.text || '').toString();
   return /not-authorized|SASLError/i.test(message);
 }
+/**
+ * Floor between two credential rotations driven by reconnects. Well under
+ * the XMPP password's one-hour life, but high enough that a link flapping
+ * every few seconds rotates once, not thirty times.
+ */
+const CREDENTIALS_REFRESH_MIN_INTERVAL_MS = 60_000;
 export class XmppClient {
   host = '';
   service = '';
@@ -107,6 +113,12 @@ export class XmppClient {
   // derived XMPP password after idle). Triggers the credentialsProvider
   // refresh path in reconnect().
   lastAuthError = null;
+  /**
+   * When the credentials currently held were last (re)minted. Drives the
+   * throttle in `reconnect()` so a flapping connection can't rotate the
+   * session once per flap.
+   */
+  credentialsRefreshedAt = 0;
   credentialsProvider = null;
   credentialsRefreshInFlight = null;
   // Fired by the provider on every 'online' so it can re-join MUC rooms
@@ -654,14 +666,29 @@ export class XmppClient {
     this.reconnecting = true;
     console.log('Attempting to reconnect xmpp client...');
     try {
-      // If the last failure was a SASL `not-authorized` (typically a stale
-      // JWT-derived XMPP password after idle), try to fetch fresh creds
-      // before retrying. Without this, reconnect retries with the same
-      // stale password forever and the user has to kill the app.
-      if (this.lastAuthError === 'not-authorized' && this.credentialsProvider) {
+      // Re-mint credentials BEFORE reconnecting.
+      //
+      // This deliberately no longer waits for a SASL `not-authorized`.
+      // The XMPP password expires after an hour, and an expiry does NOT
+      // drop an established connection — authentication happens once, at
+      // bind. So by the time anything disconnects us (a network blip, a
+      // sleeping device, a server restart) the password we still hold may
+      // well be dead, and we have no way to know. Reconnecting with it
+      // burns a guaranteed-failed bind plus a backoff delay before the
+      // old `lastAuthError` path could even start recovering.
+      //
+      // Throttled, because reconnects are not rare: a flapping link would
+      // otherwise rotate the whole session (access + refresh + file token
+      // + XMPP password) once per flap. A SASL failure bypasses the
+      // throttle — there the credentials are known bad.
+      const authFailed = this.lastAuthError === 'not-authorized';
+      const staleCreds = Date.now() - this.credentialsRefreshedAt >= CREDENTIALS_REFRESH_MIN_INTERVAL_MS;
+      if (this.credentialsProvider && (authFailed || staleCreds)) {
         try {
           await this.refreshCredentialsOnce();
         } catch (err) {
+          // Offline is the common case here — reconnect with what we
+          // have and let the next attempt try again.
           console.warn('XMPP credential refresh failed; reconnecting with cached creds', err);
         }
       }
@@ -718,6 +745,7 @@ export class XmppClient {
           // creds really are stale we simply get not-authorized again and
           // retry, which is the confirmed-good 26.5.7 behaviour.
           this.updateCredentials(fresh.username, fresh.password);
+          this.credentialsRefreshedAt = Date.now();
           this.lastAuthError = null;
         }
       } finally {