@ethora/chat-component-rn 26.8.1 → 26.8.2

package/src/networking/stanzaHandlers.ts

@@ -8,9 +8,8 @@ import {
   setComposing,
   setCurrentRoom,
   setRoomRole,
-  updateRoom,
 } from '../roomStore/roomsSlice';
-import { IRoom, RoomMember } from '../types/types';
+import { IRoom } from '../types/types';
 import { createMessageFromXml } from '../helpers/createMessageFromXml';
 import { getDataFromXml } from '../helpers/getDataFromXml';
 import { setDeleteModal } from '../roomStore/chatSettingsSlice';
@@ -238,11 +237,11 @@ const onMessageHistory = async (stanza: any) => {
     // what senderJID would have held — fall back to it. createMessageFromXml
     // already derives a display name from the jid when senderFirstName/
     // senderLastName are absent.
-    const innerFrom =
-      stanza
-        .getChild('result')
-        ?.getChild('forwarded')
-        ?.getChild('message')?.attrs?.from || stanza.attrs.from;
+    const forwardedMessage = stanza
+      .getChild('result')
+      ?.getChild('forwarded')
+      ?.getChild('message');
+    const innerFrom = forwardedMessage?.attrs?.from || stanza.attrs.from;
     const senderJID = data?.attrs?.senderJID || innerFrom;
     if (!data?.attrs || !senderJID) {
       // console.log(
@@ -251,27 +250,44 @@ const onMessageHistory = async (stanza: any) => {
       // );
       return;
     }
-    // Parse the FULL stanza the same way the realtime path does (and the
-    // web SDK's history path does): the positional call used here before
-    // read only <data> attrs + <body>, so the <translations> payload and
-    // the <translate source> tag never made it onto archived messages.
-    // Since every transcript is MAM-backfilled on room open, that alone
-    // made translation look completely dead — the translations existed on
-    // the wire and were dropped at this exact parse. getDataFromXml also
-    // supplies xmppId (dedupe against the optimistic copy) and the
-    // resource||senderJID-localpart sender id.
-    const parsed = await getDataFromXml(stanza);
-    const { data: pData, id: pId, body: pBody, ...pRest } =
-      parsed ?? ({} as Partial<NonNullable<typeof parsed>>);
-    const mergedData: Record<string, unknown> = { ...(pData || data.attrs) };
-    if (!mergedData.senderJID) {mergedData.senderJID = senderJID;}
-    const rawMessage = await createMessageFromXml({
-      data: mergedData,
-      id: pId || id,
-      body: pBody ?? (typeof body === 'string' ? body : body?.getText?.() || ''),
-      ...pRest,
-      isDeleted: !!deleted || !!pRest?.deleted,
-    } as Parameters<typeof createMessageFromXml>[0]);
+    const mergedAttrs = { ...data.attrs };
+    if (!mergedAttrs.senderJID) {mergedAttrs.senderJID = senderJID;}
+    // The forwarded <message>'s own stanza id is our original send id
+    // (what `xmppId` holds on the live/wrapped paths) - capture it so
+    // this MAM-replayed message dedupes against its live echo /
+    // optimistic pending bubble the same way, instead of never carrying
+    // an xmppId at all.
+    if (forwardedMessage?.attrs?.id) {mergedAttrs.xmppId = forwardedMessage.attrs.id;}
+    const positionalMessage = await createMessageFromXml(
+      mergedAttrs,
+      body,
+      id,
+      // Bug #41: pass the resource-bearing occupant `from`
+      // (room@conference/sender-id) here, not the outer envelope's
+      // `stanza.attrs.from` (which has no resource for a MAM result).
+      // createMessageFromXml derives `user.id` from this field's
+      // resource - the same authoritative source getDataFromXml uses
+      // for live messages - so catch-up rows resolve the correct
+      // sender from the very first render instead of needing a later
+      // correction once the "official" history fetch lands.
+      innerFrom,
+      !!deleted
+    );
+
+    // Translations ride on the archived stanza too (<translations> +
+    // <translate source>), but the positional parse above only reads
+    // <data> attrs + <body>, so every MAM-backfilled message lost them -
+    // translation looked dead on every room open. Parse the full stanza
+    // the way the realtime path does and carry ONLY those two fields over,
+    // so sender/xmppId resolution above (bug #41) stays exactly as is.
+    const parsedFull = await getDataFromXml(stanza).catch(() => undefined);
+    const rawMessage = {
+      ...positionalMessage,
+      ...(parsedFull?.translations
+        ? { translations: parsedFull.translations }
+        : {}),
+      ...(parsedFull?.langSource ? { langSource: parsedFull.langSource } : {}),
+    };
 
     // Same call-log transform as the realtime path, applied to archived
     // history so calls received while offline still render as log entries.

package/src/networking/xmpp/flushLastViewedToPrivateStore.ts

@@ -1,21 +1,45 @@
 import { getChatsPrivateStoreRequest } from './getChatsPrivateStoreRequest.xmpp';
 import { setChatsPrivateStoreRequest } from './setChatsPrivateStoreRequest.xmpp';
+import {
+  getServerReadTimestamp,
+  isCorruptFutureReadMarker,
+  type ReadTimestampHeapState,
+} from '../../helpers/getServerReadTimestamp';
+import type { IMessage } from '../../types/types';
 
 interface RoomLike {
   jid: string;
   lastViewedTimestamp?: number;
   unreadMessages?: number;
+  // Needed to resolve a SERVER-timestamp read marker via
+  // getServerReadTimestamp instead of the device clock - see bug #38.
+  messages?: IMessage[];
 }
 
 interface FlushOpts {
   // When visibleRoomJID is set, treat it as "user just viewed everything
-  // up to now" and stamp it with Date.now() — even if its in-memory
-  // lastViewedTimestamp has not been updated yet.
+  // up to now" and stamp it with the newest server-acknowledged message
+  // timestamp for that room - even if its in-memory lastViewedTimestamp
+  // has not been updated yet.
   visibleRoomJID?: string | null;
+  // Explicit read boundary for the visible room, used INSTEAD of the
+  // newest-message fallback. ChatRoom passes the timestamp of the newest
+  // message the user actually reached when they leave a room while
+  // scrolled up - without it, the default writes "read everything" to
+  // the server and the messages they never scrolled down to come back as
+  // read on the next login, even though the local count was correct.
+  // Customer-reported #33 (server half).
+  visibleRoomTs?: number | null;
   // If true, only write entries for rooms where unreadMessages === 0
   // (or the visible room). Used at logout time: rooms with outstanding
   // unread keep their old marker so the next login still surfaces them.
   onlyIfNoUnread?: boolean;
+  // Pending/failed-send state (store.getState().roomHeapSlice), combined
+  // with each room's `messages` to resolve the newest SERVER-acked
+  // message timestamp via getServerReadTimestamp. Passed in rather than
+  // read from the store here so this module stays a pure function of its
+  // arguments - existing jest coverage builds `rooms` by hand.
+  heapState?: ReadTimestampHeapState;
 }
 
 /**
@@ -25,8 +49,11 @@ interface FlushOpts {
  * each other's entries.
  *
  * Called on: tab change away from chat, AppState background/inactive,
- * and (with onlyIfNoUnread=true) logout. ChatRoom's own unmount path
- * still uses actionSetTimestampToPrivateStore for the single-room case.
+ * and (with onlyIfNoUnread=true) logout. ChatRoom's own unmount path also
+ * goes through this (via flushLastViewedToPrivateStoreStanza) for the
+ * single-room case - actionSetTimestampToPrivateStore is a separate,
+ * unconditional low-level write primitive kept for direct/external use
+ * and is not part of this merge path.
  */
 export async function flushLastViewedToPrivateStore(
   client: any,
@@ -34,7 +61,7 @@ export async function flushLastViewedToPrivateStore(
   opts: FlushOpts = {}
 ): Promise<boolean> {
   if (!client?.client) {return false;}
-  const { visibleRoomJID, onlyIfNoUnread } = opts;
+  const { visibleRoomJID, visibleRoomTs, onlyIfNoUnread, heapState } = opts;
   const roomList = Object.values(rooms || {});
   if (roomList.length === 0) {return false;}
 
@@ -46,7 +73,6 @@ export async function flushLastViewedToPrivateStore(
   }
   if (!storeObj || typeof storeObj !== 'object') {storeObj = {};}
 
-  const nowMs = Date.now();
   let dirty = false;
 
   for (const room of roomList) {
@@ -54,21 +80,56 @@ export async function flushLastViewedToPrivateStore(
     const isVisible = !!visibleRoomJID && room.jid === visibleRoomJID;
     const hasUnread = Number(room.unreadMessages || 0) > 0;
 
-    // For the visible room, persist "now" — read state is driven by
-    // room visibility, not by a sentinel timestamp.
+    // Newest message this room actually has server-side proof of. Used
+    // both as the "read up to now" fallback for the visible room and as
+    // the yardstick for detecting a corrupt (future) stored marker below
+    // - never as a substitute for the device clock (bug #38: a device
+    // with a fast clock previously stamped Date.now() here, and once
+    // that future value reached the server the forward-only check a few
+    // lines down rejected every later correct write, forever).
+    const newestAckedMs = getServerReadTimestamp(room as any, heapState);
+
+    // For the visible room, persist "read up to the newest message we
+    // know the server has" - read state is driven by room visibility,
+    // not by a sentinel timestamp. The exception is an explicit
+    // `visibleRoomTs`: the caller knows the user only read up to a
+    // certain point (left the room while scrolled up), so stamping
+    // "everything" here would mark genuinely-unread messages as read.
     let ts: number | undefined;
     if (isVisible) {
-      ts = nowMs;
+      ts =
+        typeof visibleRoomTs === 'number' && visibleRoomTs > 0
+          ? visibleRoomTs
+          : newestAckedMs || undefined;
     } else if (room.lastViewedTimestamp && room.lastViewedTimestamp > 0) {
       ts = room.lastViewedTimestamp;
     }
 
+    // Nothing to anchor a write to (no boundary, no existing marker, no
+    // known messages yet) - skip rather than write a device-clock guess.
     if (!ts) {continue;}
     if (onlyIfNoUnread && hasUnread && !isVisible) {continue;}
 
     const prev = storeObj[room.jid];
     const prevNum = prev != null ? Number(prev) : 0;
-    if (Number.isFinite(prevNum) && prevNum >= ts) {continue;}
+    // A currently-stored value that sits well past the newest message we
+    // know this room has is not "fresher" - it's a leftover future
+    // marker (bug #38). Forward-only logic normally protects a fresher
+    // read from being clobbered by a stale fetch, but applied to a
+    // corrupt future value it does the opposite: it permanently blocks
+    // the correct (smaller) value from ever landing. Detect that case
+    // and waive the forward-only check for it specifically; sane values
+    // keep the normal forward-only protection.
+    //
+    // "Well past the newest message we know about" is deliberately NOT
+    // sufficient on its own - see isCorruptFutureReadMarker. THIS device's
+    // copy of the room can simply be stale (history not synced yet this
+    // session), in which case a legitimate marker written by another
+    // device that HAS seen newer messages looks exactly like a corrupt
+    // one, and "healing" it here would push the server marker BACKWARDS
+    // and resurrect already-read messages on every device.
+    const prevLooksCorrupt = isCorruptFutureReadMarker(prevNum, newestAckedMs);
+    if (!prevLooksCorrupt && Number.isFinite(prevNum) && prevNum >= ts) {continue;}
     storeObj[room.jid] = String(ts);
     dirty = true;
   }

package/src/networking/xmpp/presenceInRoom.xmpp.ts

@@ -70,7 +70,12 @@ export const presenceInRoom = async (
       try {
         await createTimeoutPromise(2000, unsubscribe);
       } catch (err) {
-        reject(err);
+        // The room's reply schedules resolve() `delay` ms later (2000 by
+        // default) — the same length as this timeout, so the timeout used
+        // to win the race and reject a join that had actually succeeded
+        // (allRoomPresences "failed" with undefined on every bootstrap).
+        // Only a join that never got an answer is a failure.
+        if (!settled) {reject(err);}
       }
     })();
   });

package/src/networking/xmpp/subscribeToRoomMessages.xmpp.ts

@@ -2,12 +2,14 @@ import { Client, xml } from '@xmpp/client';
 import { Element } from '@xmpp/xml';
 import { createTimeoutPromise } from './createTimeoutPromise.xmpp';
 
+let subscribeIdCounter = 0;
+
 export async function subscribeToRoomMessages(
   client: Client,
   roomJID: string,
   userNick?: string
 ): Promise<boolean> {
-  const id = `newSubscription:${Date.now().toString()}`;
+  const id = `newSubscription:${Date.now().toString(36)}-${(++subscribeIdCounter).toString(36)}`;
   let stanzaHandler: (stanza: Element) => void;
 
   const unsubscribe = () => {
@@ -33,6 +35,15 @@ export async function subscribeToRoomMessages(
         if (stanza.attrs.type === 'result') {
           finish(resolve, true);
         } else if (stanza.attrs.type === 'error') {
+          const errorEl = typeof stanza.getChild === 'function' ? stanza.getChild('error') : null;
+          const condition = errorEl?.children?.find(
+            (c: any) => c?.name && c.name !== 'text'
+          ) as Element | undefined;
+          console.warn(
+            '[PushService] MucSub subscribe error for',
+            roomJID,
+            condition?.name ?? 'unknown'
+          );
           finish(resolve, false);
         }
       }

package/src/networking/xmppClient.ts

@@ -32,6 +32,10 @@ import {
   enqueueOutboundSend,
   flushOutboundSends,
 } from './outboundQueue';
+import {
+  getServerReadTimestamp,
+  isCorruptFutureReadMarker,
+} from '../helpers/getServerReadTimestamp';
 
 // Canonical production XMPP WSS endpoint (standard wss/443, no port suffix).
 const DEFAULT_DEV_SERVER = 'xmpp.chat.ethora.com';
@@ -94,6 +98,13 @@ interface MamInFlightEntry {
   startedAt: number;
 }
 
+/**
+ * Floor between two credential rotations driven by reconnects. Well under
+ * the XMPP password's one-hour life, but high enough that a link flapping
+ * every few seconds rotates once, not thirty times.
+ */
+const CREDENTIALS_REFRESH_MIN_INTERVAL_MS = 60_000;
+
 export type XmppCredentialsProvider = () => Promise<{
   username: string;
   password: string;
@@ -137,6 +148,12 @@ export class XmppClient {
   // derived XMPP password after idle). Triggers the credentialsProvider
   // refresh path in reconnect().
   lastAuthError: 'not-authorized' | null = null;
+  /**
+   * When the credentials currently held were last (re)minted. Drives the
+   * throttle in `reconnect()` so a flapping connection can't rotate the
+   * session once per flap.
+   */
+  private credentialsRefreshedAt = 0;
   private credentialsProvider: XmppCredentialsProvider | null = null;
   private credentialsRefreshInFlight: Promise<void> | null = null;
   // Fired by the provider on every 'online' so it can re-join MUC rooms
@@ -329,6 +346,7 @@ export class XmppClient {
   }
 
   initializeClient() {
+    this.clientAlreadyStopped = false;
     try {
       const devServer = this.devServer || DEFAULT_DEV_SERVER;
       const url = `wss://${devServer}/ws`;
@@ -700,14 +718,32 @@ export class XmppClient {
     console.log('Attempting to reconnect xmpp client...');
 
     try {
-      // If the last failure was a SASL `not-authorized` (typically a stale
-      // JWT-derived XMPP password after idle), try to fetch fresh creds
-      // before retrying. Without this, reconnect retries with the same
-      // stale password forever and the user has to kill the app.
-      if (this.lastAuthError === 'not-authorized' && this.credentialsProvider) {
+      // Re-mint credentials BEFORE reconnecting.
+      //
+      // This deliberately no longer waits for a SASL `not-authorized`.
+      // The XMPP password expires after an hour, and an expiry does NOT
+      // drop an established connection — authentication happens once, at
+      // bind. So by the time anything disconnects us (a network blip, a
+      // sleeping device, a server restart) the password we still hold may
+      // well be dead, and we have no way to know. Reconnecting with it
+      // burns a guaranteed-failed bind plus a backoff delay before the
+      // old `lastAuthError` path could even start recovering.
+      //
+      // Throttled, because reconnects are not rare: a flapping link would
+      // otherwise rotate the whole session (access + refresh + file token
+      // + XMPP password) once per flap. A SASL failure bypasses the
+      // throttle — there the credentials are known bad.
+      const authFailed = this.lastAuthError === 'not-authorized';
+      const staleCreds =
+        Date.now() - this.credentialsRefreshedAt >=
+        CREDENTIALS_REFRESH_MIN_INTERVAL_MS;
+
+      if (this.credentialsProvider && (authFailed || staleCreds)) {
         try {
           await this.refreshCredentialsOnce();
         } catch (err) {
+          // Offline is the common case here — reconnect with what we
+          // have and let the next attempt try again.
           console.warn(
             'XMPP credential refresh failed; reconnecting with cached creds',
             err
@@ -721,7 +757,10 @@ export class XmppClient {
       // `this.client` still points at the old client — i.e. before
       // initializeClient() reassigns it.
       const old = this.client;
-      if (old) {
+      if (old && this.clientAlreadyStopped) {
+        this.detachEventListeners();
+        this.clientAlreadyStopped = false;
+      } else if (old) {
         this.detachEventListeners();
         // NEVER await a bare stop(): on a half-dead socket (the exact case
         // we're reconnecting for) @xmpp/client's stop() can hang forever
@@ -736,6 +775,9 @@ export class XmppClient {
         await withTimeout(old.stop(), STOP_TIMEOUT_MS);
       }
       this.initializeClient();
+      if (this.suspendedForBackground) {
+        await this.stopClientQuietly();
+      }
     } finally {
       this.reconnecting = false;
     }
@@ -763,6 +805,7 @@ export class XmppClient {
           // creds really are stale we simply get not-authorized again and
           // retry, which is the confirmed-good 26.5.7 behaviour.
           this.updateCredentials(fresh.username, fresh.password);
+          this.credentialsRefreshedAt = Date.now();
           this.lastAuthError = null;
         }
       } finally {
@@ -772,6 +815,56 @@ export class XmppClient {
     return this.credentialsRefreshInFlight;
   }
 
+  private suspendedForBackground = false;
+  private clientAlreadyStopped = false;
+
+  private async stopClientQuietly(): Promise<void> {
+    const c: any = this.client;
+    if (c) {
+      const sock = c.socket;
+      if (sock && typeof sock.end === 'function') {
+        try {
+          sock.end();
+        } catch {}
+        try {
+          if (c.status !== 'offline') c._status?.('offline');
+        } catch {}
+      } else {
+        await withTimeout(
+          Promise.resolve(c.stop()).catch(() => undefined),
+          STOP_TIMEOUT_MS
+        );
+      }
+      this.clientAlreadyStopped = true;
+    }
+    this.status = 'offline';
+    this.presencesReady = false;
+  }
+
+  async suspend(): Promise<void> {
+    if (this.suspendedForBackground) {return;}
+    this.suspendedForBackground = true;
+    this.suppressReconnect = true;
+    if (this.reconnectTimer) {
+      clearTimeout(this.reconnectTimer);
+      this.reconnectTimer = null;
+    }
+    await this.stopClientQuietly();
+    console.log('XMPP suspended (background).');
+  }
+
+  /** Back in the foreground: allow reconnects again and reconnect at once. */
+  resume(): void {
+    if (!this.suspendedForBackground) {return;}
+    this.suspendedForBackground = false;
+    this.suppressReconnect = false;
+    this.forceReconnect();
+  }
+
+  get isSuspended(): boolean {
+    return this.suspendedForBackground;
+  }
+
   async disconnect(options?: { suppressReconnect?: boolean }): Promise<void> {
     if (options?.suppressReconnect) {this.suppressReconnect = true;}
     return this.close();
@@ -971,9 +1064,37 @@ export class XmppClient {
       // `getChatsPrivateStoreRequest` directly and intentionally skip this.
       if (markers && typeof markers === 'object') {
         const normalized: Record<string, number> = {};
+        const roomsState = store.getState().rooms?.rooms || {};
+        const heapState = store.getState().roomHeapSlice;
         for (const jid of Object.keys(markers as Record<string, unknown>)) {
           const n = Number((markers as Record<string, unknown>)[jid]);
-          if (jid && Number.isFinite(n) && n > 0) {normalized[jid] = n;}
+          if (!jid || !Number.isFinite(n) || n <= 0) {continue;}
+          // Defensive clamp (bug #38): a marker written while some
+          // device's clock was ahead can land in the future relative to
+          // the newest message the server actually has for this room.
+          // The redux merge (applyPrivateStoreMarkers) and the
+          // server-side merge (flushLastViewedToPrivateStore) both treat
+          // "newer" as "better", so an uncorrected future value would
+          // block every later correct write forever - useUnread() would
+          // report 0 for that room on every cold start. When we already
+          // know this room's messages locally, clamp an implausible
+          // marker down to the newest one we actually have instead of
+          // trusting the server value verbatim.
+          //
+          // "Implausible" needs BOTH "past the newest message we know
+          // about" AND "past real time" (isCorruptFutureReadMarker):
+          // this device's cache for a room is routinely stale, and
+          // clamping on staleness alone would drag a perfectly good
+          // marker written by another device backwards.
+          const room = roomsState[jid];
+          const newestKnownMs = room
+            ? getServerReadTimestamp(room, heapState)
+            : 0;
+          if (isCorruptFutureReadMarker(n, newestKnownMs)) {
+            normalized[jid] = newestKnownMs;
+          } else {
+            normalized[jid] = n;
+          }
         }
         if (Object.keys(normalized).length > 0) {
           store.dispatch(applyPrivateStoreMarkers(normalized));
@@ -1007,11 +1128,22 @@ export class XmppClient {
   // src/networking/xmpp/flushLastViewedToPrivateStore.ts for details.
   async flushLastViewedToPrivateStoreStanza(
     rooms: Record<string, any> | null | undefined,
-    opts: { visibleRoomJID?: string | null; onlyIfNoUnread?: boolean } = {}
+    opts: {
+      visibleRoomJID?: string | null;
+      visibleRoomTs?: number | null;
+      onlyIfNoUnread?: boolean;
+    } = {}
   ) {
     if (this.disableLastRead) {return false;}
     try {
-      return await flushLastViewedToPrivateStore(this, rooms, opts);
+      // Auto-inject the pending/failed-send heap so every caller gets
+      // getServerReadTimestamp's exclusion of optimistic messages for
+      // free, without needing to reach into the redux store themselves.
+      const heapState = store.getState().roomHeapSlice;
+      return await flushLastViewedToPrivateStore(this, rooms, {
+        ...opts,
+        heapState,
+      });
     } catch {
       return false;
     }

package/src/roomStore/chatSettingsSlice.ts

@@ -11,8 +11,7 @@ import {
 } from '../types/types';
 import { Iso639_1Codes } from '../types/models/language.model';
 import type { TranslateMode } from '../utils/translateModePolicy';
-import { localStorageConstants } from '../helpers/constants/LOCAL_STORAGE';
-import { asyncLocalStorage } from '../hooks/useLocalStorage';
+import { secureUserStorage } from '../helpers/secureUserStorage';
 
 export interface ChatState {
   user: User;
@@ -34,12 +33,15 @@ export interface ChatState {
 
 export const unpackAndTransform = (input?: User): User => {
   return {
-    description: '',
+    // Was hardcoded to '' — every setUser dropped the user's own bio, so
+    // the profile's About section could never show one.
+    description: input?.description || '',
     token: input?.token || '',
     profileImage: input?.profileImage || '',
     _id: input?._id || '',
     walletAddress: input?.defaultWallet?.walletAddress || '',
     xmppPassword: input?.xmppPassword || '',
+    fileToken: input?.fileToken || '',
     refreshToken: input?.refreshToken || '',
     firstName: input?.firstName || '',
     lastName: input?.lastName || '',
@@ -73,6 +75,7 @@ const initialState: ChatState = {
     _id: '',
     walletAddress: '',
     xmppPassword: '',
+    fileToken: '',
     refreshToken: '',
     firstName: '',
     lastName: '',
@@ -111,9 +114,7 @@ const initialState: ChatState = {
 const reducers = {
   setUser: (state: WritableDraft<ChatState>, action: PayloadAction<User>) => {
     state.user = unpackAndTransform(action.payload);
-    asyncLocalStorage(localStorageConstants.ETHORA_USER).set(
-      unpackAndTransform(action.payload)
-    );
+    secureUserStorage().set(unpackAndTransform(action.payload));
   },
   updateUser(state: WritableDraft<ChatState>, action: PayloadAction<{ updates: Partial<User> }>) {
     const { updates } = action.payload;
@@ -146,14 +147,37 @@ const reducers = {
   setSelectedUser: (state: WritableDraft<ChatState>, action: PayloadAction<IUser | undefined>) => {
     state.selectedUser = action.payload;
   },
+  /**
+   * Token rotation. Dispatched from ONE place only — `authRefresh` —
+   * which awaits the AsyncStorage write immediately afterwards, before
+   * resolving its promise.
+   *
+   * The reducer used to fire its own best-effort write here. That was
+   * both redundant and racy (two writers, no ordering), and a
+   * fire-and-forget write can be lost if the app dies right after a
+   * rotation — which on a backend with reuse detection means the next
+   * launch presents a burned token. Persistence now belongs to the
+   * caller, which can actually await it.
+   */
   refreshTokens: (
     state: WritableDraft<ChatState>,
-    action: PayloadAction<{ token: string; refreshToken: string }>
+    action: PayloadAction<{
+      token: string;
+      refreshToken: string;
+      xmppPassword?: string;
+      fileToken?: string;
+    }>
   ) => {
     state.user.refreshToken = action.payload.refreshToken;
     state.user.token = action.payload.token;
-    // AsyncStorage is async; fire-and-forget so the reducer stays sync.
-    asyncLocalStorage(localStorageConstants.ETHORA_USER).set(state.user);
+
+    if (action.payload.xmppPassword) {
+      state.user.xmppPassword = action.payload.xmppPassword;
+    }
+
+    if (action.payload.fileToken) {
+      state.user.fileToken = action.payload.fileToken;
+    }
   },
   logout: (state: WritableDraft<ChatState>) => {
     state.user = unpackAndTransform();
@@ -161,7 +185,7 @@ const reducers = {
     state.client = undefined;
     state.langSource = undefined;
     state.translateMode = undefined;
-    asyncLocalStorage(localStorageConstants.ETHORA_USER).remove();
+    secureUserStorage().remove();
   },
   setLangSource: (
     state: WritableDraft<ChatState>,