@ethora/chat-component-rn 26.8.1 → 26.8.3

package/src/networking/xmpp/presenceInRoom.xmpp.ts

@@ -70,7 +70,12 @@ export const presenceInRoom = async (
       try {
         await createTimeoutPromise(2000, unsubscribe);
       } catch (err) {
-        reject(err);
+        // The room's reply schedules resolve() `delay` ms later (2000 by
+        // default) — the same length as this timeout, so the timeout used
+        // to win the race and reject a join that had actually succeeded
+        // (allRoomPresences "failed" with undefined on every bootstrap).
+        // Only a join that never got an answer is a failure.
+        if (!settled) {reject(err);}
       }
     })();
   });

package/src/networking/xmpp/subscribeToRoomMessages.xmpp.ts

@@ -2,12 +2,14 @@ import { Client, xml } from '@xmpp/client';
 import { Element } from '@xmpp/xml';
 import { createTimeoutPromise } from './createTimeoutPromise.xmpp';
 
+let subscribeIdCounter = 0;
+
 export async function subscribeToRoomMessages(
   client: Client,
   roomJID: string,
   userNick?: string
 ): Promise<boolean> {
-  const id = `newSubscription:${Date.now().toString()}`;
+  const id = `newSubscription:${Date.now().toString(36)}-${(++subscribeIdCounter).toString(36)}`;
   let stanzaHandler: (stanza: Element) => void;
 
   const unsubscribe = () => {
@@ -33,6 +35,15 @@ export async function subscribeToRoomMessages(
         if (stanza.attrs.type === 'result') {
           finish(resolve, true);
         } else if (stanza.attrs.type === 'error') {
+          const errorEl = typeof stanza.getChild === 'function' ? stanza.getChild('error') : null;
+          const condition = errorEl?.children?.find(
+            (c: any) => c?.name && c.name !== 'text'
+          ) as Element | undefined;
+          console.warn(
+            '[PushService] MucSub subscribe error for',
+            roomJID,
+            condition?.name ?? 'unknown'
+          );
           finish(resolve, false);
         }
       }

package/src/networking/xmppClient.ts

@@ -32,6 +32,10 @@ import {
   enqueueOutboundSend,
   flushOutboundSends,
 } from './outboundQueue';
+import {
+  getServerReadTimestamp,
+  isCorruptFutureReadMarker,
+} from '../helpers/getServerReadTimestamp';
 
 // Canonical production XMPP WSS endpoint (standard wss/443, no port suffix).
 const DEFAULT_DEV_SERVER = 'xmpp.chat.ethora.com';
@@ -94,6 +98,13 @@ interface MamInFlightEntry {
   startedAt: number;
 }
 
+/**
+ * Floor between two credential rotations driven by reconnects. Well under
+ * the XMPP password's one-hour life, but high enough that a link flapping
+ * every few seconds rotates once, not thirty times.
+ */
+const CREDENTIALS_REFRESH_MIN_INTERVAL_MS = 60_000;
+
 export type XmppCredentialsProvider = () => Promise<{
   username: string;
   password: string;
@@ -137,6 +148,12 @@ export class XmppClient {
   // derived XMPP password after idle). Triggers the credentialsProvider
   // refresh path in reconnect().
   lastAuthError: 'not-authorized' | null = null;
+  /**
+   * When the credentials currently held were last (re)minted. Drives the
+   * throttle in `reconnect()` so a flapping connection can't rotate the
+   * session once per flap.
+   */
+  private credentialsRefreshedAt = 0;
   private credentialsProvider: XmppCredentialsProvider | null = null;
   private credentialsRefreshInFlight: Promise<void> | null = null;
   // Fired by the provider on every 'online' so it can re-join MUC rooms
@@ -329,6 +346,7 @@ export class XmppClient {
   }
 
   initializeClient() {
+    this.clientAlreadyStopped = false;
     try {
       const devServer = this.devServer || DEFAULT_DEV_SERVER;
       const url = `wss://${devServer}/ws`;
@@ -700,14 +718,32 @@ export class XmppClient {
     console.log('Attempting to reconnect xmpp client...');
 
     try {
-      // If the last failure was a SASL `not-authorized` (typically a stale
-      // JWT-derived XMPP password after idle), try to fetch fresh creds
-      // before retrying. Without this, reconnect retries with the same
-      // stale password forever and the user has to kill the app.
-      if (this.lastAuthError === 'not-authorized' && this.credentialsProvider) {
+      // Re-mint credentials BEFORE reconnecting.
+      //
+      // This deliberately no longer waits for a SASL `not-authorized`.
+      // The XMPP password expires after an hour, and an expiry does NOT
+      // drop an established connection — authentication happens once, at
+      // bind. So by the time anything disconnects us (a network blip, a
+      // sleeping device, a server restart) the password we still hold may
+      // well be dead, and we have no way to know. Reconnecting with it
+      // burns a guaranteed-failed bind plus a backoff delay before the
+      // old `lastAuthError` path could even start recovering.
+      //
+      // Throttled, because reconnects are not rare: a flapping link would
+      // otherwise rotate the whole session (access + refresh + file token
+      // + XMPP password) once per flap. A SASL failure bypasses the
+      // throttle — there the credentials are known bad.
+      const authFailed = this.lastAuthError === 'not-authorized';
+      const staleCreds =
+        Date.now() - this.credentialsRefreshedAt >=
+        CREDENTIALS_REFRESH_MIN_INTERVAL_MS;
+
+      if (this.credentialsProvider && (authFailed || staleCreds)) {
         try {
           await this.refreshCredentialsOnce();
         } catch (err) {
+          // Offline is the common case here — reconnect with what we
+          // have and let the next attempt try again.
           console.warn(
             'XMPP credential refresh failed; reconnecting with cached creds',
             err
@@ -721,7 +757,10 @@ export class XmppClient {
       // `this.client` still points at the old client — i.e. before
       // initializeClient() reassigns it.
       const old = this.client;
-      if (old) {
+      if (old && this.clientAlreadyStopped) {
+        this.detachEventListeners();
+        this.clientAlreadyStopped = false;
+      } else if (old) {
         this.detachEventListeners();
         // NEVER await a bare stop(): on a half-dead socket (the exact case
         // we're reconnecting for) @xmpp/client's stop() can hang forever
@@ -736,6 +775,9 @@ export class XmppClient {
         await withTimeout(old.stop(), STOP_TIMEOUT_MS);
       }
       this.initializeClient();
+      if (this.suspendedForBackground) {
+        await this.stopClientQuietly();
+      }
     } finally {
       this.reconnecting = false;
     }
@@ -763,6 +805,7 @@ export class XmppClient {
           // creds really are stale we simply get not-authorized again and
           // retry, which is the confirmed-good 26.5.7 behaviour.
           this.updateCredentials(fresh.username, fresh.password);
+          this.credentialsRefreshedAt = Date.now();
           this.lastAuthError = null;
         }
       } finally {
@@ -772,6 +815,56 @@ export class XmppClient {
     return this.credentialsRefreshInFlight;
   }
 
+  private suspendedForBackground = false;
+  private clientAlreadyStopped = false;
+
+  private async stopClientQuietly(): Promise<void> {
+    const c: any = this.client;
+    if (c) {
+      const sock = c.socket;
+      if (sock && typeof sock.end === 'function') {
+        try {
+          sock.end();
+        } catch {}
+        try {
+          if (c.status !== 'offline') c._status?.('offline');
+        } catch {}
+      } else {
+        await withTimeout(
+          Promise.resolve(c.stop()).catch(() => undefined),
+          STOP_TIMEOUT_MS
+        );
+      }
+      this.clientAlreadyStopped = true;
+    }
+    this.status = 'offline';
+    this.presencesReady = false;
+  }
+
+  async suspend(): Promise<void> {
+    if (this.suspendedForBackground) {return;}
+    this.suspendedForBackground = true;
+    this.suppressReconnect = true;
+    if (this.reconnectTimer) {
+      clearTimeout(this.reconnectTimer);
+      this.reconnectTimer = null;
+    }
+    await this.stopClientQuietly();
+    console.log('XMPP suspended (background).');
+  }
+
+  /** Back in the foreground: allow reconnects again and reconnect at once. */
+  resume(): void {
+    if (!this.suspendedForBackground) {return;}
+    this.suspendedForBackground = false;
+    this.suppressReconnect = false;
+    this.forceReconnect();
+  }
+
+  get isSuspended(): boolean {
+    return this.suspendedForBackground;
+  }
+
   async disconnect(options?: { suppressReconnect?: boolean }): Promise<void> {
     if (options?.suppressReconnect) {this.suppressReconnect = true;}
     return this.close();
@@ -971,9 +1064,37 @@ export class XmppClient {
       // `getChatsPrivateStoreRequest` directly and intentionally skip this.
       if (markers && typeof markers === 'object') {
         const normalized: Record<string, number> = {};
+        const roomsState = store.getState().rooms?.rooms || {};
+        const heapState = store.getState().roomHeapSlice;
         for (const jid of Object.keys(markers as Record<string, unknown>)) {
           const n = Number((markers as Record<string, unknown>)[jid]);
-          if (jid && Number.isFinite(n) && n > 0) {normalized[jid] = n;}
+          if (!jid || !Number.isFinite(n) || n <= 0) {continue;}
+          // Defensive clamp (bug #38): a marker written while some
+          // device's clock was ahead can land in the future relative to
+          // the newest message the server actually has for this room.
+          // The redux merge (applyPrivateStoreMarkers) and the
+          // server-side merge (flushLastViewedToPrivateStore) both treat
+          // "newer" as "better", so an uncorrected future value would
+          // block every later correct write forever - useUnread() would
+          // report 0 for that room on every cold start. When we already
+          // know this room's messages locally, clamp an implausible
+          // marker down to the newest one we actually have instead of
+          // trusting the server value verbatim.
+          //
+          // "Implausible" needs BOTH "past the newest message we know
+          // about" AND "past real time" (isCorruptFutureReadMarker):
+          // this device's cache for a room is routinely stale, and
+          // clamping on staleness alone would drag a perfectly good
+          // marker written by another device backwards.
+          const room = roomsState[jid];
+          const newestKnownMs = room
+            ? getServerReadTimestamp(room, heapState)
+            : 0;
+          if (isCorruptFutureReadMarker(n, newestKnownMs)) {
+            normalized[jid] = newestKnownMs;
+          } else {
+            normalized[jid] = n;
+          }
         }
         if (Object.keys(normalized).length > 0) {
           store.dispatch(applyPrivateStoreMarkers(normalized));
@@ -1007,11 +1128,22 @@ export class XmppClient {
   // src/networking/xmpp/flushLastViewedToPrivateStore.ts for details.
   async flushLastViewedToPrivateStoreStanza(
     rooms: Record<string, any> | null | undefined,
-    opts: { visibleRoomJID?: string | null; onlyIfNoUnread?: boolean } = {}
+    opts: {
+      visibleRoomJID?: string | null;
+      visibleRoomTs?: number | null;
+      onlyIfNoUnread?: boolean;
+    } = {}
   ) {
     if (this.disableLastRead) {return false;}
     try {
-      return await flushLastViewedToPrivateStore(this, rooms, opts);
+      // Auto-inject the pending/failed-send heap so every caller gets
+      // getServerReadTimestamp's exclusion of optimistic messages for
+      // free, without needing to reach into the redux store themselves.
+      const heapState = store.getState().roomHeapSlice;
+      return await flushLastViewedToPrivateStore(this, rooms, {
+        ...opts,
+        heapState,
+      });
     } catch {
       return false;
     }

package/src/roomStore/chatSettingsSlice.ts

@@ -11,8 +11,7 @@ import {
 } from '../types/types';
 import { Iso639_1Codes } from '../types/models/language.model';
 import type { TranslateMode } from '../utils/translateModePolicy';
-import { localStorageConstants } from '../helpers/constants/LOCAL_STORAGE';
-import { asyncLocalStorage } from '../hooks/useLocalStorage';
+import { secureUserStorage } from '../helpers/secureUserStorage';
 
 export interface ChatState {
   user: User;
@@ -34,12 +33,15 @@ export interface ChatState {
 
 export const unpackAndTransform = (input?: User): User => {
   return {
-    description: '',
+    // Was hardcoded to '' — every setUser dropped the user's own bio, so
+    // the profile's About section could never show one.
+    description: input?.description || '',
     token: input?.token || '',
     profileImage: input?.profileImage || '',
     _id: input?._id || '',
     walletAddress: input?.defaultWallet?.walletAddress || '',
     xmppPassword: input?.xmppPassword || '',
+    fileToken: input?.fileToken || '',
     refreshToken: input?.refreshToken || '',
     firstName: input?.firstName || '',
     lastName: input?.lastName || '',
@@ -73,6 +75,7 @@ const initialState: ChatState = {
     _id: '',
     walletAddress: '',
     xmppPassword: '',
+    fileToken: '',
     refreshToken: '',
     firstName: '',
     lastName: '',
@@ -111,9 +114,7 @@ const initialState: ChatState = {
 const reducers = {
   setUser: (state: WritableDraft<ChatState>, action: PayloadAction<User>) => {
     state.user = unpackAndTransform(action.payload);
-    asyncLocalStorage(localStorageConstants.ETHORA_USER).set(
-      unpackAndTransform(action.payload)
-    );
+    secureUserStorage().set(unpackAndTransform(action.payload));
   },
   updateUser(state: WritableDraft<ChatState>, action: PayloadAction<{ updates: Partial<User> }>) {
     const { updates } = action.payload;
@@ -146,14 +147,37 @@ const reducers = {
   setSelectedUser: (state: WritableDraft<ChatState>, action: PayloadAction<IUser | undefined>) => {
     state.selectedUser = action.payload;
   },
+  /**
+   * Token rotation. Dispatched from ONE place only — `authRefresh` —
+   * which awaits the AsyncStorage write immediately afterwards, before
+   * resolving its promise.
+   *
+   * The reducer used to fire its own best-effort write here. That was
+   * both redundant and racy (two writers, no ordering), and a
+   * fire-and-forget write can be lost if the app dies right after a
+   * rotation — which on a backend with reuse detection means the next
+   * launch presents a burned token. Persistence now belongs to the
+   * caller, which can actually await it.
+   */
   refreshTokens: (
     state: WritableDraft<ChatState>,
-    action: PayloadAction<{ token: string; refreshToken: string }>
+    action: PayloadAction<{
+      token: string;
+      refreshToken: string;
+      xmppPassword?: string;
+      fileToken?: string;
+    }>
   ) => {
     state.user.refreshToken = action.payload.refreshToken;
     state.user.token = action.payload.token;
-    // AsyncStorage is async; fire-and-forget so the reducer stays sync.
-    asyncLocalStorage(localStorageConstants.ETHORA_USER).set(state.user);
+
+    if (action.payload.xmppPassword) {
+      state.user.xmppPassword = action.payload.xmppPassword;
+    }
+
+    if (action.payload.fileToken) {
+      state.user.fileToken = action.payload.fileToken;
+    }
   },
   logout: (state: WritableDraft<ChatState>) => {
     state.user = unpackAndTransform();
@@ -161,7 +185,7 @@ const reducers = {
     state.client = undefined;
     state.langSource = undefined;
     state.translateMode = undefined;
-    asyncLocalStorage(localStorageConstants.ETHORA_USER).remove();
+    secureUserStorage().remove();
   },
   setLangSource: (
     state: WritableDraft<ChatState>,

package/src/roomStore/index.ts

@@ -1,14 +1,18 @@
 import { configureStore, combineReducers } from '@reduxjs/toolkit';
 import chatSettingsReducer, { setUser } from './chatSettingsSlice';
 import roomsSlice, { addRoom } from './roomsSlice';
-import { roomHeapSlice } from './roomHeapSlice';
+import { roomHeapSlice, markMessageFailed } from './roomHeapSlice';
 import callReducer from './callSlice';
 import { IRoom } from '../types/types';
 import { unreadMiddleware } from './Middleware/unreadMidlleware';
 import { logoutMiddleware } from './Middleware/logoutMiddleware';
 import { newMessageMidlleware } from './Middleware/newMessageMidlleware';
 import { reactionsMiddleware } from './Middleware/reactionsMiddleware';
-import { persistenceMiddleware, readPersistedState } from './persistence';
+import {
+  persistenceMiddleware,
+  readPersistedState,
+  computeBootTimeFailures,
+} from './persistence';
 
 const rootReducer = combineReducers({
   chatSettingStore: chatSettingsReducer,
@@ -68,11 +72,12 @@ export const getActiveRoom = (state: RootState): IRoom | null => {
     : null;
 };
 
-// Async rehydrate — read persisted slices and replay them as standard
+// Async rehydrate: read persisted slices and replay them as standard
+// actions.
 export const persistorReady =
   globalScope.__CHAT_PERSISTOR_READY__ ||
   (globalScope.__CHAT_PERSISTOR_READY__ = (async () => {
-    const { chat, rooms } = await readPersistedState();
+    const { chat, rooms, heap } = await readPersistedState();
     if (chat?.user && chat.user.walletAddress) {
       store.dispatch(setUser(chat.user));
     }
@@ -82,4 +87,35 @@ export const persistorReady =
         store.dispatch(addRoom({ roomData: room as IRoom }));
       }
     }
+
+    // bug #39: restore failures that were already flagged (watchdog or
+    // an explicit send error) before the app was killed, so the bubble
+    // still shows "Failed / tap to retry" instead of quietly reverting
+    // to a normal sent bubble.
+    // Skip entries whose bubble no longer exists in the restored cache.
+    // A failure flag is only ever READ as `failedMessages[message.id]`,
+    // so one with no matching message is dead weight that would be
+    // replayed and re-persisted on every launch forever. This happens
+    // for real: a send that reached the server but whose echo was lost
+    // gets flagged failed at boot, then the history merge replaces the
+    // optimistic bubble with the archived copy under its server id (see
+    // mergeHistoryIntoCache), leaving the flag behind.
+    const restoredFailed = heap?.failedMessages || {};
+    for (const payload of Object.values(restoredFailed)) {
+      const stillRendered = (
+        rooms?.rooms?.[payload.roomJID]?.messages || []
+      ).some((m) => m?.id === payload.id);
+      if (!stillRendered) {continue;}
+      store.dispatch(markMessageFailed(payload));
+    }
+
+    // bug #39: a message that was still `pending: true` at kill time
+    // never got a server echo AND never got the chance to trip the
+    // in-session send watchdog (messageHeap is process-lifetime only,
+    // never persisted). Treat every such message as failed so it gets
+    // a working retry instead of silently rendering as delivered.
+    const bootFailures = computeBootTimeFailures(rooms?.rooms, restoredFailed);
+    for (const payload of bootFailures) {
+      store.dispatch(markMessageFailed(payload));
+    }
   })());