@ethora/chat-component-rn 26.6.12 → 26.7.1

package/src/networking/xmppClient.ts

@@ -94,6 +94,13 @@ interface MamInFlightEntry {
   startedAt: number;
 }
 
+/**
+ * Floor between two credential rotations driven by reconnects. Well under
+ * the XMPP password's one-hour life, but high enough that a link flapping
+ * every few seconds rotates once, not thirty times.
+ */
+const CREDENTIALS_REFRESH_MIN_INTERVAL_MS = 60_000;
+
 export type XmppCredentialsProvider = () => Promise<{
   username: string;
   password: string;
@@ -137,6 +144,12 @@ export class XmppClient {
   // derived XMPP password after idle). Triggers the credentialsProvider
   // refresh path in reconnect().
   lastAuthError: 'not-authorized' | null = null;
+  /**
+   * When the credentials currently held were last (re)minted. Drives the
+   * throttle in `reconnect()` so a flapping connection can't rotate the
+   * session once per flap.
+   */
+  private credentialsRefreshedAt = 0;
   private credentialsProvider: XmppCredentialsProvider | null = null;
   private credentialsRefreshInFlight: Promise<void> | null = null;
   // Fired by the provider on every 'online' so it can re-join MUC rooms
@@ -700,14 +713,32 @@ export class XmppClient {
     console.log('Attempting to reconnect xmpp client...');
 
     try {
-      // If the last failure was a SASL `not-authorized` (typically a stale
-      // JWT-derived XMPP password after idle), try to fetch fresh creds
-      // before retrying. Without this, reconnect retries with the same
-      // stale password forever and the user has to kill the app.
-      if (this.lastAuthError === 'not-authorized' && this.credentialsProvider) {
+      // Re-mint credentials BEFORE reconnecting.
+      //
+      // This deliberately no longer waits for a SASL `not-authorized`.
+      // The XMPP password expires after an hour, and an expiry does NOT
+      // drop an established connection — authentication happens once, at
+      // bind. So by the time anything disconnects us (a network blip, a
+      // sleeping device, a server restart) the password we still hold may
+      // well be dead, and we have no way to know. Reconnecting with it
+      // burns a guaranteed-failed bind plus a backoff delay before the
+      // old `lastAuthError` path could even start recovering.
+      //
+      // Throttled, because reconnects are not rare: a flapping link would
+      // otherwise rotate the whole session (access + refresh + file token
+      // + XMPP password) once per flap. A SASL failure bypasses the
+      // throttle — there the credentials are known bad.
+      const authFailed = this.lastAuthError === 'not-authorized';
+      const staleCreds =
+        Date.now() - this.credentialsRefreshedAt >=
+        CREDENTIALS_REFRESH_MIN_INTERVAL_MS;
+
+      if (this.credentialsProvider && (authFailed || staleCreds)) {
         try {
           await this.refreshCredentialsOnce();
         } catch (err) {
+          // Offline is the common case here — reconnect with what we
+          // have and let the next attempt try again.
           console.warn(
             'XMPP credential refresh failed; reconnecting with cached creds',
             err
@@ -763,6 +794,7 @@ export class XmppClient {
           // creds really are stale we simply get not-authorized again and
           // retry, which is the confirmed-good 26.5.7 behaviour.
           this.updateCredentials(fresh.username, fresh.password);
+          this.credentialsRefreshedAt = Date.now();
           this.lastAuthError = null;
         }
       } finally {

package/src/roomStore/chatSettingsSlice.ts

@@ -11,8 +11,7 @@ import {
 } from '../types/types';
 import { Iso639_1Codes } from '../types/models/language.model';
 import type { TranslateMode } from '../utils/translateModePolicy';
-import { localStorageConstants } from '../helpers/constants/LOCAL_STORAGE';
-import { asyncLocalStorage } from '../hooks/useLocalStorage';
+import { secureUserStorage } from '../helpers/secureUserStorage';
 
 export interface ChatState {
   user: User;
@@ -40,6 +39,7 @@ export const unpackAndTransform = (input?: User): User => {
     _id: input?._id || '',
     walletAddress: input?.defaultWallet?.walletAddress || '',
     xmppPassword: input?.xmppPassword || '',
+    fileToken: input?.fileToken || '',
     refreshToken: input?.refreshToken || '',
     firstName: input?.firstName || '',
     lastName: input?.lastName || '',
@@ -73,6 +73,7 @@ const initialState: ChatState = {
     _id: '',
     walletAddress: '',
     xmppPassword: '',
+    fileToken: '',
     refreshToken: '',
     firstName: '',
     lastName: '',
@@ -111,9 +112,7 @@ const initialState: ChatState = {
 const reducers = {
   setUser: (state: WritableDraft<ChatState>, action: PayloadAction<User>) => {
     state.user = unpackAndTransform(action.payload);
-    asyncLocalStorage(localStorageConstants.ETHORA_USER).set(
-      unpackAndTransform(action.payload)
-    );
+    secureUserStorage().set(unpackAndTransform(action.payload));
   },
   updateUser(state: WritableDraft<ChatState>, action: PayloadAction<{ updates: Partial<User> }>) {
     const { updates } = action.payload;
@@ -146,14 +145,37 @@ const reducers = {
   setSelectedUser: (state: WritableDraft<ChatState>, action: PayloadAction<IUser | undefined>) => {
     state.selectedUser = action.payload;
   },
+  /**
+   * Token rotation. Dispatched from ONE place only — `authRefresh` —
+   * which awaits the AsyncStorage write immediately afterwards, before
+   * resolving its promise.
+   *
+   * The reducer used to fire its own best-effort write here. That was
+   * both redundant and racy (two writers, no ordering), and a
+   * fire-and-forget write can be lost if the app dies right after a
+   * rotation — which on a backend with reuse detection means the next
+   * launch presents a burned token. Persistence now belongs to the
+   * caller, which can actually await it.
+   */
   refreshTokens: (
     state: WritableDraft<ChatState>,
-    action: PayloadAction<{ token: string; refreshToken: string }>
+    action: PayloadAction<{
+      token: string;
+      refreshToken: string;
+      xmppPassword?: string;
+      fileToken?: string;
+    }>
   ) => {
     state.user.refreshToken = action.payload.refreshToken;
     state.user.token = action.payload.token;
-    // AsyncStorage is async; fire-and-forget so the reducer stays sync.
-    asyncLocalStorage(localStorageConstants.ETHORA_USER).set(state.user);
+
+    if (action.payload.xmppPassword) {
+      state.user.xmppPassword = action.payload.xmppPassword;
+    }
+
+    if (action.payload.fileToken) {
+      state.user.fileToken = action.payload.fileToken;
+    }
   },
   logout: (state: WritableDraft<ChatState>) => {
     state.user = unpackAndTransform();
@@ -161,7 +183,7 @@ const reducers = {
     state.client = undefined;
     state.langSource = undefined;
     state.translateMode = undefined;
-    asyncLocalStorage(localStorageConstants.ETHORA_USER).remove();
+    secureUserStorage().remove();
   },
   setLangSource: (
     state: WritableDraft<ChatState>,

package/src/roomStore/persistence.ts

@@ -1,6 +1,7 @@
 import AsyncStorage from '@react-native-async-storage/async-storage';
 import { Middleware } from '@reduxjs/toolkit';
 import { IMessage, IRoom, User } from '../types/types';
+import { encryptForPersist, decryptFromPersist } from '../helpers/persistCrypto';
 
 // -------------------------------------------------------------------
 // Lightweight RN persistence layer. Mirrors what redux-persist gives
@@ -11,7 +12,11 @@ import { IMessage, IRoom, User } from '../types/types';
 //   - cap each room's messages to the most recent MESSAGE_LIMIT (100)
 //   - debounced writes (200ms) on relevant action types
 //
-// Not encrypted. We rely on AsyncStorage's per-app sandbox.
+// AES-256-CBC at rest (see `helpers/persistCrypto.ts`): the JSON blob
+// under each key below is encrypted before it reaches AsyncStorage, with
+// the symmetric key held in the platform Keychain/Keystore. `user` here
+// is already secret-free (see `sanitizeUser`) — the encryption is for
+// the message bodies in `rooms`, which aren't.
 // -------------------------------------------------------------------
 
 const KEY_CHAT = '@ethora/persist:chatSettingStore';
@@ -199,21 +204,27 @@ export const persistenceMiddleware: Middleware = (storeAPI) => (next) => (
 
   if (writeTimer) {clearTimeout(writeTimer);}
   writeTimer = setTimeout(() => {
-    try {
-      const state = storeAPI.getState();
-      const chatPayload: PersistedChatState = {
-        user: sanitizeUser(state.chatSettingStore?.user) as User,
-      };
-      const roomsPayload: PersistedRoomsState = {
-        rooms: sanitizeRooms(state.rooms?.rooms || {}),
-      };
-      AsyncStorage.multiSet([
-        [KEY_CHAT, JSON.stringify(chatPayload)],
-        [KEY_ROOMS, JSON.stringify(roomsPayload)],
-      ]).catch((e) => console.warn('persist write failed', e));
-    } catch (e) {
-      console.warn('persist serialize failed', e);
-    }
+    (async () => {
+      try {
+        const state = storeAPI.getState();
+        const chatPayload: PersistedChatState = {
+          user: sanitizeUser(state.chatSettingStore?.user) as User,
+        };
+        const roomsPayload: PersistedRoomsState = {
+          rooms: sanitizeRooms(state.rooms?.rooms || {}),
+        };
+        const [chatCipher, roomsCipher] = await Promise.all([
+          encryptForPersist(JSON.stringify(chatPayload)),
+          encryptForPersist(JSON.stringify(roomsPayload)),
+        ]);
+        await AsyncStorage.multiSet([
+          [KEY_CHAT, chatCipher],
+          [KEY_ROOMS, roomsCipher],
+        ]);
+      } catch (e) {
+        console.warn('persist write failed', e);
+      }
+    })();
   }, 200);
 
   return result;
@@ -233,9 +244,18 @@ export async function readPersistedState(): Promise<{
       KEY_CHAT,
       KEY_ROOMS,
     ]);
-    const chat = chatRaw[1] ? (JSON.parse(chatRaw[1]) as PersistedChatState) : null;
-    const rooms = roomsRaw[1]
-      ? (JSON.parse(roomsRaw[1]) as PersistedRoomsState)
+    const [chatPlain, roomsPlain] = await Promise.all([
+      chatRaw[1] ? decryptFromPersist(chatRaw[1]) : Promise.resolve(null),
+      roomsRaw[1] ? decryptFromPersist(roomsRaw[1]) : Promise.resolve(null),
+    ]);
+    // `decryptFromPersist` returns null both for "nothing stored" and
+    // for "stored value isn't a valid envelope for the current key" —
+    // notably a plaintext blob left over from a pre-encryption install.
+    // Either way there is nothing safe to parse, so the caller treats it
+    // as a cold start and re-hydrates from the server.
+    const chat = chatPlain ? (JSON.parse(chatPlain) as PersistedChatState) : null;
+    const rooms = roomsPlain
+      ? (JSON.parse(roomsPlain) as PersistedRoomsState)
       : null;
     return { chat, rooms };
   } catch (e) {

package/src/roomStore/roomsSlice.ts

@@ -317,6 +317,8 @@ const reducers = {
         : [];
       state.rooms[roomData.jid] = {
         ...roomData,
+        icon: roomData.icon !== undefined ? roomData.icon : existing?.icon,
+        roomBg: roomData.roomBg !== undefined ? roomData.roomBg : existing?.roomBg,
         messages:
           existingMessages.length > 0 ? existingMessages : incomingMessages,
         lastViewedTimestamp: lastViewed,

package/src/types/types.ts

@@ -105,6 +105,7 @@ export interface User {
   ];
   appId: string;
   xmppPassword: string;
+  fileToken?: string;
 
   homeScreen?: string;
   registrationChannelType?: string;
@@ -455,9 +456,25 @@ export interface IConfig {
   defaultLogin?: boolean;
   refreshTokens?: {
     enabled: boolean;
+    /**
+     * Host-owned rotation. When set, the SDK calls this INSTEAD of
+     * `/users/login/refresh` — always, including during bootstrap — and
+     * never rotates the Ethora refresh token itself. Serialised through
+     * the same lock as the built-in path.
+     *
+     * Return `refreshToken` whenever the host's flow actually rotates an
+     * Ethora refresh token: the backend now treats a re-presented one as
+     * theft, so omitting it leaves a burned token in storage that ends
+     * the session the next time it is used. It stays optional because
+     * some hosts re-mint an access token from a different authority
+     * (SuperTokens, an owner-session endpoint) and hold no Ethora
+     * refresh token at all.
+     */
     refreshFunction?: () => Promise<{
       accessToken: string;
       refreshToken?: string;
+      fileToken?: string;
+      xmppPassword?: string;
     } | null>;
   };