@multiplatform.one/frappe 9.1.0 → 9.3.0

package/src/auth.sessionRace.spec.ts

@@ -0,0 +1,209 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { AuthModule } from "./auth";
+import { HttpClient } from "./core/http";
+import { SESSION_CHANGE_WAIT_MS } from "./core/sessionGate";
+
+const baseURL = "http://frappe.test";
+const signedInUser = "user@example.test";
+const fixtureSid = "fixture-session";
+
+function deferred() {
+  let resolve: () => void = () => {};
+  const promise = new Promise<void>((r) => {
+    resolve = r;
+  });
+  return { promise, resolve };
+}
+
+function json(status: number, body: unknown): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json" },
+  });
+}
+
+async function flush() {
+  for (let i = 0; i < 5; i++) await new Promise((r) => setTimeout(r, 0));
+}
+
+/**
+ * A fake bench with a cookie jar. Like Frappe, every response but the login's
+ * sets `sid` to the session the request ran under, and the jar takes that
+ * value when the response lands, the way a browser applies Set-Cookie.
+ */
+function fakeBench() {
+  const jar = { sid: "Guest" };
+  const guestCount = deferred();
+  const loginResponse = { gate: Promise.resolve() };
+  const sent: string[] = [];
+  const fetchMock = vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
+    const path = new URL(String(input)).pathname;
+    sent.push(path);
+    if (path.startsWith("/api/method/hang") && sent.filter((p) => p === path).length === 1) {
+      return new Promise<Response>((_, reject) => {
+        init?.signal?.addEventListener("abort", () => {
+          reject(new DOMException("The operation was aborted.", "AbortError"));
+        });
+      });
+    }
+    if (path.startsWith("/api/method/hang")) {
+      const ranAs = jar.sid;
+      jar.sid = ranAs;
+      return json(200, { message: ranAs });
+    }
+    if (path === "/api/method/frappe.client.get_count") {
+      const ranAs = jar.sid;
+      await guestCount.promise;
+      jar.sid = ranAs;
+      return json(200, { message: 3 });
+    }
+    if (path === "/api/method/login") {
+      await loginResponse.gate;
+      jar.sid = fixtureSid;
+      return json(200, { message: "Logged In" });
+    }
+    if (path === "/api/method/frappe.auth.get_logged_user") {
+      if (jar.sid !== fixtureSid) return json(403, { message: "Not permitted" });
+      return json(200, { message: signedInUser });
+    }
+    if (path === "/api/method/logout") {
+      jar.sid = "Guest";
+      return json(200, {});
+    }
+    return json(404, {});
+  });
+  return { jar, guestCount, loginResponse, sent, fetchMock };
+}
+
+describe("login against a guest request still in flight (FZ-10892)", () => {
+  let bench: ReturnType<typeof fakeBench>;
+  const realFetch = globalThis.fetch;
+
+  beforeEach(() => {
+    bench = fakeBench();
+    globalThis.fetch = bench.fetchMock as unknown as typeof fetch;
+  });
+
+  afterEach(() => {
+    globalThis.fetch = realFetch;
+  });
+
+  it("keeps the new session when the guest response lands after the login was issued", async () => {
+    const tiles = new HttpClient(baseURL);
+    const auth = new AuthModule(new HttpClient(baseURL));
+
+    const guest = tiles.get("/api/method/frappe.client.get_count", { doctype: "ToDo" });
+    await flush();
+    const login = auth.loginWithUsernamePassword({ username: signedInUser, password: "x" });
+    await flush();
+    bench.guestCount.resolve();
+    await Promise.all([guest, login]);
+
+    expect(bench.jar.sid).toBe(fixtureSid);
+    await expect(auth.getLoggedInUser()).resolves.toBe(signedInUser);
+  });
+
+  it("sends the login only after the guest request on the wire has its response", async () => {
+    const tiles = new HttpClient(baseURL);
+    const auth = new AuthModule(new HttpClient(baseURL));
+
+    const guest = tiles.get("/api/method/frappe.client.get_count", { doctype: "ToDo" });
+    await flush();
+    const login = auth.loginWithUsernamePassword({ username: signedInUser, password: "x" });
+    await flush();
+    expect(bench.sent).toEqual(["/api/method/frappe.client.get_count"]);
+
+    bench.guestCount.resolve();
+    await Promise.all([guest, login]);
+    expect(bench.sent).toEqual(["/api/method/frappe.client.get_count", "/api/method/login"]);
+  });
+
+  it("holds a request issued during the login until the login response lands", async () => {
+    const loginGate = deferred();
+    bench.loginResponse.gate = loginGate.promise;
+    const auth = new AuthModule(new HttpClient(baseURL));
+
+    const login = auth.loginWithUsernamePassword({ username: signedInUser, password: "x" });
+    await flush();
+    const whoami = auth.getLoggedInUser();
+    await flush();
+    expect(bench.sent).toEqual(["/api/method/login"]);
+
+    loginGate.resolve();
+    await login;
+    await expect(whoami).resolves.toBe(signedInUser);
+  });
+
+  it("leaves token-auth requests ungated, since they carry no cookie", async () => {
+    const tokenClient = new HttpClient(baseURL, { useToken: true, token: "key:secret" });
+    const auth = new AuthModule(new HttpClient(baseURL));
+
+    const loginGate = deferred();
+    bench.loginResponse.gate = loginGate.promise;
+    const login = auth.loginWithUsernamePassword({ username: signedInUser, password: "x" });
+    await flush();
+    const tokenRead = tokenClient.get("/api/method/frappe.client.get_count", { doctype: "ToDo" });
+    await flush();
+    expect(bench.sent).toContain("/api/method/frappe.client.get_count");
+
+    bench.guestCount.resolve();
+    loginGate.resolve();
+    await Promise.all([login, tokenRead]);
+  });
+});
+
+describe("a session change against a request that never answers (FZ-10892)", () => {
+  let bench: ReturnType<typeof fakeBench>;
+  const realFetch = globalThis.fetch;
+
+  beforeEach(() => {
+    vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout"] });
+    bench = fakeBench();
+    globalThis.fetch = bench.fetchMock as unknown as typeof fetch;
+  });
+
+  afterEach(() => {
+    vi.useRealTimers();
+    globalThis.fetch = realFetch;
+  });
+
+  it("completes the login once the wait cap passes, and replays the hung read under the new session", async () => {
+    const tiles = new HttpClient(baseURL);
+    const auth = new AuthModule(new HttpClient(baseURL));
+
+    const hung = tiles.get<{ message: string }>("/api/method/hang.get_count");
+    await vi.advanceTimersByTimeAsync(0);
+    const login = auth.loginWithUsernamePassword({ username: signedInUser, password: "x" });
+    await vi.advanceTimersByTimeAsync(SESSION_CHANGE_WAIT_MS - 1);
+    expect(bench.sent).toEqual(["/api/method/hang.get_count"]);
+
+    await vi.advanceTimersByTimeAsync(1);
+    await login;
+    expect(bench.jar.sid).toBe(fixtureSid);
+    expect(bench.fetchMock.mock.calls[0]?.[1]?.signal?.aborted).toBe(true);
+
+    await expect(hung).resolves.toMatchObject({ payload: { message: fixtureSid } });
+    expect(bench.sent).toEqual([
+      "/api/method/hang.get_count",
+      "/api/method/login",
+      "/api/method/hang.get_count",
+    ]);
+    await expect(auth.getLoggedInUser()).resolves.toBe(signedInUser);
+  });
+
+  it("rejects a hung write it had to drop instead of sending it again", async () => {
+    const tiles = new HttpClient(baseURL);
+    const auth = new AuthModule(new HttpClient(baseURL));
+
+    const hung = tiles.post("/api/method/hang.save", { value: 1 });
+    const rejected = expect(hung).rejects.toMatchObject({ name: "AbortError" });
+    await vi.advanceTimersByTimeAsync(0);
+    const login = auth.loginWithUsernamePassword({ username: signedInUser, password: "x" });
+    await vi.advanceTimersByTimeAsync(SESSION_CHANGE_WAIT_MS);
+    await login;
+
+    await rejected;
+    expect(bench.sent).toEqual(["/api/method/hang.save", "/api/method/login"]);
+    expect(bench.jar.sid).toBe(fixtureSid);
+  });
+});

package/src/auth.spec.ts

@@ -81,10 +81,15 @@ describe("AuthModule", () => {
       };
       (mockHttpClient.post as any).mockResolvedValue(mockResponse);
       const result = await auth.loginWithUsernamePassword(loginData);
-      expect(mockHttpClient.post).toHaveBeenCalledWith("/api/method/login", {
-        usr: "testuser",
-        pwd: "testpass123",
-      });
+      expect(mockHttpClient.post).toHaveBeenCalledWith(
+        "/api/method/login",
+        {
+          usr: "testuser",
+          pwd: "testpass123",
+        },
+        undefined,
+        { sessionChange: true },
+      );
       expect(result).toEqual(mockResponse);
     });
 
@@ -102,10 +107,15 @@ describe("AuthModule", () => {
       };
       (mockHttpClient.post as any).mockResolvedValue(mockResponse);
       await auth.loginWithUsernamePassword(loginData);
-      expect(mockHttpClient.post).toHaveBeenCalledWith("/api/method/login", {
-        usr: "test@example.com",
-        pwd: "securePassword!",
-      });
+      expect(mockHttpClient.post).toHaveBeenCalledWith(
+        "/api/method/login",
+        {
+          usr: "test@example.com",
+          pwd: "securePassword!",
+        },
+        undefined,
+        { sessionChange: true },
+      );
     });
 
     it("should handle login with special characters in password", async () => {
@@ -122,10 +132,15 @@ describe("AuthModule", () => {
       };
       (mockHttpClient.post as any).mockResolvedValue(mockResponse);
       await auth.loginWithUsernamePassword(loginData);
-      expect(mockHttpClient.post).toHaveBeenCalledWith("/api/method/login", {
-        usr: loginData.username,
-        pwd: loginData.password,
-      });
+      expect(mockHttpClient.post).toHaveBeenCalledWith(
+        "/api/method/login",
+        {
+          usr: loginData.username,
+          pwd: loginData.password,
+        },
+        undefined,
+        { sessionChange: true },
+      );
     });
 
     it("should handle login error", async () => {
@@ -203,7 +218,9 @@ describe("AuthModule", () => {
       };
       (mockHttpClient.post as any).mockResolvedValue(mockResponse);
       const result = await auth.logout();
-      expect(mockHttpClient.post).toHaveBeenCalledWith("/api/method/logout");
+      expect(mockHttpClient.post).toHaveBeenCalledWith("/api/method/logout", undefined, undefined, {
+        sessionChange: true,
+      });
       expect(result).toEqual(mockResponse);
     });
 
@@ -217,7 +234,9 @@ describe("AuthModule", () => {
       };
       (mockHttpClient.post as any).mockResolvedValue(mockResponse);
       const result = await auth.logout();
-      expect(mockHttpClient.post).toHaveBeenCalledWith("/api/method/logout");
+      expect(mockHttpClient.post).toHaveBeenCalledWith("/api/method/logout", undefined, undefined, {
+        sessionChange: true,
+      });
       expect(result).toEqual(mockResponse);
     });
 

package/src/auth.ts

@@ -8,10 +8,12 @@ export class AuthModule {
   }
 
   async loginWithUsernamePassword(input: { username: string; password: string }) {
-    return this.http.post("/api/method/login", {
-      usr: input.username,
-      pwd: input.password,
-    });
+    return this.http.post(
+      "/api/method/login",
+      { usr: input.username, pwd: input.password },
+      undefined,
+      { sessionChange: true },
+    );
   }
 
   async getLoggedInUser(): Promise<string> {
@@ -22,7 +24,7 @@ export class AuthModule {
   }
 
   async logout() {
-    return this.http.post("/api/method/logout");
+    return this.http.post("/api/method/logout", undefined, undefined, { sessionChange: true });
   }
 
   async forgetPassword(email: string) {

package/src/core/http.spec.ts

@@ -582,13 +582,16 @@ describe("HttpClient", () => {
         status: 200,
         json: async () => ({ success: true }),
       };
-      global.fetch = vi.fn().mockResolvedValue(mockRes);
       const controller = new AbortController();
+      let abortedInFlight = false;
+      global.fetch = vi.fn().mockImplementation(async (_url: string, init: RequestInit) => {
+        controller.abort();
+        abortedInFlight = Boolean(init.signal?.aborted);
+        return mockRes;
+      });
       await client.request(HttpMethod.Get, "/test", { signal: controller.signal });
-      expect(fetch).toHaveBeenCalledWith(
-        `${baseURL}/test`,
-        expect.objectContaining({ signal: controller.signal }),
-      );
+      expect(fetch).toHaveBeenCalledWith(`${baseURL}/test`, expect.anything());
+      expect(abortedInFlight).toBe(true);
     });
 
     it("get() forwards the signal", async () => {
@@ -598,13 +601,16 @@ describe("HttpClient", () => {
         status: 200,
         json: async () => ({ success: true }),
       };
-      global.fetch = vi.fn().mockResolvedValue(mockRes);
       const controller = new AbortController();
+      let abortedInFlight = false;
+      global.fetch = vi.fn().mockImplementation(async (_url: string, init: RequestInit) => {
+        controller.abort();
+        abortedInFlight = Boolean(init.signal?.aborted);
+        return mockRes;
+      });
       await client.get("/test", { a: 1 }, undefined, controller.signal);
-      expect(fetch).toHaveBeenCalledWith(
-        `${baseURL}/test?a=1`,
-        expect.objectContaining({ signal: controller.signal }),
-      );
+      expect(fetch).toHaveBeenCalledWith(`${baseURL}/test?a=1`, expect.anything());
+      expect(abortedInFlight).toBe(true);
     });
 
     it("rejects without retrying when the request is aborted", async () => {

package/src/core/http.ts

@@ -1,6 +1,7 @@
 import { getCookie, setCookie, deleteCookie, isNative } from "@multiplatform.one/platform";
 import { isBrowser } from "../util";
 import { readServerMessages } from "./serverMessages";
+import { sendThroughSessionGate } from "./sessionGate";
 import { AuthType, FrappeError, HttpMethod } from "./types";
 import type { AuthConfig, RequestCredentialsMode, RetryConfig } from "./types";
 
@@ -197,7 +198,7 @@ export class HttpClient {
   private async fetchNativeCsrfToken(): Promise<string | undefined> {
     try {
       const rpcUrl = this.resolveURL("/api/method/frappe.sessions.get_csrf_token");
-      const res = await fetch(rpcUrl, { method: "GET", credentials: "include" });
+      const res = await this.sendGated(rpcUrl, { method: "GET", credentials: "include" });
       if (res.ok) {
         const payload = (await res.json()) as { message?: unknown };
         if (typeof payload?.message === "string" && payload.message) return payload.message;
@@ -207,7 +208,7 @@ export class HttpClient {
     }
     try {
       const appUrl = this.resolveURL("/app");
-      const res = await fetch(appUrl, { method: "GET", credentials: "include" });
+      const res = await this.sendGated(appUrl, { method: "GET", credentials: "include" });
       if (res.ok) {
         const html = await res.text();
         const match = html.match(/frappe\.csrf_token\s*=\s*"([^"]+)"/);
@@ -219,6 +220,19 @@ export class HttpClient {
     return undefined;
   }
 
+  private sendGated(url: string, init: RequestInit, sessionChange = false): Promise<Response> {
+    const method = (init.method ?? HttpMethod.Get).toUpperCase();
+    return sendThroughSessionGate(
+      splitBaseURL(url).origin,
+      {
+        sessionChange,
+        replayable: method === HttpMethod.Get || method === HttpMethod.Head,
+        signal: init.signal,
+      },
+      (signal) => fetch(url, { ...init, signal }),
+    );
+  }
+
   private invalidateNativeCsrfToken(): void {
     this.csrfToken = undefined;
     this.csrfBootstrapDone = false;
@@ -281,6 +295,7 @@ export class HttpClient {
       headers?: Record<string, string>;
       /** Cancels the request (and any pending retry) when aborted. */
       signal?: AbortSignal;
+      sessionChange?: boolean;
     },
   ): Promise<HttpResponse<T>> {
     const url = this.resolveURL(path);
@@ -366,13 +381,15 @@ export class HttpClient {
       if (csrf) headers.set("X-Frappe-CSRF-Token", csrf);
     }
     const makeRequest = (): Promise<Response> => {
-      return fetch(url, {
+      const init: RequestInit = {
         method,
         headers,
         credentials,
         body,
         signal: request?.signal,
-      });
+      };
+      if (!cookieAuth || !isBrowser()) return fetch(url, init);
+      return this.sendGated(url, init, request?.sessionChange);
     };
     let lastError: unknown;
     let attempt = 0;
@@ -438,8 +455,13 @@ export class HttpClient {
     return this.request<T>(HttpMethod.Get, `${path}${qs}`, { headers, signal });
   }
 
-  post<T>(path: string, body?: RequestBody, headers?: Record<string, string>) {
-    return this.request<T>(HttpMethod.Post, path, { headers, body });
+  post<T>(
+    path: string,
+    body?: RequestBody,
+    headers?: Record<string, string>,
+    options?: { sessionChange?: boolean },
+  ) {
+    return this.request<T>(HttpMethod.Post, path, { headers, body, ...options });
   }
 
   put<T>(path: string, body?: RequestBody, headers?: Record<string, string>) {

package/src/core/sessionGate.ts

@@ -0,0 +1,140 @@
+/**
+ * Orders cookie-carrying requests around a session change (FZ-10892).
+ *
+ * Frappe sets `sid` on every response but the login's, so a guest response
+ * carries `sid=Guest`, and the cookie jar applies it whenever the response
+ * lands. A guest request still on the wire when a login completes would
+ * replace the session the login just set. The gate is per origin and shared
+ * by every HttpClient on it, since they share one jar: a session change
+ * waits for every request already sent to get its response, and a request
+ * issued meanwhile waits for the session change to get its own.
+ *
+ * The wait is capped at SESSION_CHANGE_WAIT_MS, since fetch has no timeout
+ * and a hung request must not block a login forever. At the cap the gate
+ * aborts the stragglers before it sends the session change. An aborted
+ * request's response is never processed, so its Set-Cookie can't land after
+ * the login. A replayable request (GET, HEAD) is sent again once the session
+ * change has its response; any other rejects with SessionChangedError.
+ */
+export const SESSION_CHANGE_WAIT_MS = 5000;
+
+export class SessionChangedError extends Error {
+  constructor() {
+    super("Request dropped: the session changed while it was in flight");
+    this.name = "AbortError";
+  }
+}
+
+interface SentRequest {
+  controller: AbortController;
+  dropped: boolean;
+}
+
+interface OriginGate {
+  inFlight: Set<SentRequest>;
+  idle: Array<() => void>;
+  change?: Promise<void>;
+}
+
+export interface SessionGateOptions {
+  sessionChange?: boolean;
+  replayable?: boolean;
+  signal?: AbortSignal | null;
+}
+
+const gates = new Map<string, OriginGate>();
+
+function gateFor(origin: string): OriginGate {
+  let gate = gates.get(origin);
+  if (!gate) {
+    gate = { inFlight: new Set(), idle: [] };
+    gates.set(origin, gate);
+  }
+  return gate;
+}
+
+async function sendOnce<T>(
+  gate: OriginGate,
+  signal: AbortSignal | null | undefined,
+  send: (signal?: AbortSignal) => Promise<T>,
+): Promise<
+  { sent: SentRequest; ok: true; result: T } | { sent: SentRequest; ok: false; error: unknown }
+> {
+  while (gate.change) await gate.change;
+  const sent: SentRequest = { controller: new AbortController(), dropped: false };
+  const forward = () => sent.controller.abort(signal?.reason);
+  if (signal?.aborted) forward();
+  else signal?.addEventListener("abort", forward, { once: true });
+  gate.inFlight.add(sent);
+  try {
+    return { sent, ok: true, result: await send(sent.controller.signal) };
+  } catch (error) {
+    return { sent, ok: false, error };
+  } finally {
+    signal?.removeEventListener("abort", forward);
+    gate.inFlight.delete(sent);
+    if (gate.inFlight.size === 0) for (const wake of gate.idle.splice(0)) wake();
+  }
+}
+
+async function sendRequest<T>(
+  gate: OriginGate,
+  options: SessionGateOptions,
+  send: (signal?: AbortSignal) => Promise<T>,
+): Promise<T> {
+  for (;;) {
+    const outcome = await sendOnce(gate, options.signal, send);
+    if (!outcome.sent.dropped) {
+      if (!outcome.ok) throw outcome.error;
+      return outcome.result;
+    }
+    if (!options.replayable) throw new SessionChangedError();
+  }
+}
+
+function waitForIdle(gate: OriginGate): Promise<boolean> {
+  if (gate.inFlight.size === 0) return Promise.resolve(true);
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const idle = new Promise<boolean>((resolve) => {
+    gate.idle.push(() => resolve(true));
+  });
+  const capped = new Promise<boolean>((resolve) => {
+    timer = setTimeout(() => resolve(false), SESSION_CHANGE_WAIT_MS);
+  });
+  return Promise.race([idle, capped]).finally(() => clearTimeout(timer));
+}
+
+async function sendSessionChange<T>(
+  gate: OriginGate,
+  options: SessionGateOptions,
+  send: (signal?: AbortSignal) => Promise<T>,
+): Promise<T> {
+  while (gate.change) await gate.change;
+  let release = () => {};
+  gate.change = new Promise<void>((resolve) => {
+    release = resolve;
+  });
+  try {
+    if (!(await waitForIdle(gate))) {
+      for (const sent of gate.inFlight) {
+        sent.dropped = true;
+        sent.controller.abort(new SessionChangedError());
+      }
+    }
+    return await send(options.signal ?? undefined);
+  } finally {
+    gate.change = undefined;
+    release();
+  }
+}
+
+export function sendThroughSessionGate<T>(
+  origin: string,
+  options: SessionGateOptions,
+  send: (signal?: AbortSignal) => Promise<T>,
+): Promise<T> {
+  const gate = gateFor(origin);
+  return options.sessionChange
+    ? sendSessionChange(gate, options, send)
+    : sendRequest(gate, options, send);
+}

package/src/sync/realtime.spec.ts

@@ -352,15 +352,34 @@ describe("RealtimeHandler", () => {
 
         eventHandlers.connected();
 
-        expect(onRealtimeEvent).toHaveBeenCalledWith({
-          type: RealtimeEventType.Connected,
-        });
+        expect(onRealtimeEvent).not.toHaveBeenCalled();
         expect(onBackfillAll).toHaveBeenCalled();
         expect(console.debug).toHaveBeenCalledWith(
           "[RealtimeHandler] Connected to realtime server",
         );
       });
 
+      it("sends the connected signal on a reconnect only, so first-load fetches don't run twice (FZ-10892)", () => {
+        const onRealtimeEvent = vi.fn();
+
+        realtimeHandler = new RealtimeHandler(
+          mockDb,
+          mockRealtime,
+          mockNormalizedCache,
+          mockSubscriptionManager,
+          mockRehydrationManager,
+          { onRealtimeEvent },
+        );
+
+        eventHandlers.connected();
+        expect(onRealtimeEvent).not.toHaveBeenCalled();
+
+        eventHandlers.disconnect();
+        eventHandlers.connected();
+        expect(onRealtimeEvent).toHaveBeenCalledTimes(1);
+        expect(onRealtimeEvent).toHaveBeenCalledWith({ type: RealtimeEventType.Connected });
+      });
+
       it("should reset reconnection attempts on successful connection", () => {
         // Simulate previous failed connections
         eventHandlers.disconnect();
@@ -778,7 +797,7 @@ describe("RealtimeHandler", () => {
       eventHandlers.perm_epoch_bump();
       eventHandlers.connected();
 
-      expect(callbacks.onRealtimeEvent).toHaveBeenCalledTimes(4);
+      expect(callbacks.onRealtimeEvent).toHaveBeenCalledTimes(3);
       expect(callbacks.onResetCache).toHaveBeenCalledTimes(1);
       expect(callbacks.onBackfillAll).toHaveBeenCalledTimes(1);
     });

package/src/sync/realtime.ts

@@ -144,6 +144,7 @@ export class RealtimeHandler {
    * Handles successful connection.
    */
   private onConnected() {
+    const reconnect = this.hasConnected;
     this.hasConnected = true;
     this.connected = true;
     this.reconnectAttempts = 0;
@@ -154,7 +155,7 @@ export class RealtimeHandler {
       this.reconnectTimer = undefined;
     }
 
-    if (this.options.onRealtimeEvent) {
+    if (reconnect && this.options.onRealtimeEvent) {
       this.options.onRealtimeEvent({ type: RealtimeEventType.Connected });
     }
 

package/types/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;gBAEtB,IAAI,EAAE,UAAU;IAItB,yBAAyB,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE;IAOvE,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC;IAOlC,MAAM;IAIN,cAAc,CAAC,KAAK,EAAE,MAAM;CAKnC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;gBAEtB,IAAI,EAAE,UAAU;IAItB,yBAAyB,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE;IASvE,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC;IAOlC,MAAM;IAIN,cAAc,CAAC,KAAK,EAAE,MAAM;CAKnC"}

package/types/core/http.d.ts

@@ -79,6 +79,7 @@ export declare class HttpClient {
      */
     private ensureNativeCsrfToken;
     private fetchNativeCsrfToken;
+    private sendGated;
     private invalidateNativeCsrfToken;
     /**
      * An absolute path ("/api/method/x") resolves under the base URL's own path,
@@ -95,9 +96,12 @@ export declare class HttpClient {
         headers?: Record<string, string>;
         /** Cancels the request (and any pending retry) when aborted. */
         signal?: AbortSignal;
+        sessionChange?: boolean;
     }): Promise<HttpResponse<T>>;
     get<T>(path: string, params?: Record<string, unknown>, headers?: Record<string, string>, signal?: AbortSignal): Promise<HttpResponse<T>>;
-    post<T>(path: string, body?: RequestBody, headers?: Record<string, string>): Promise<HttpResponse<T>>;
+    post<T>(path: string, body?: RequestBody, headers?: Record<string, string>, options?: {
+        sessionChange?: boolean;
+    }): Promise<HttpResponse<T>>;
     put<T>(path: string, body?: RequestBody, headers?: Record<string, string>): Promise<HttpResponse<T>>;
     delete<T>(path: string, body?: RequestBody, headers?: Record<string, string>): Promise<HttpResponse<T>>;
     head(path: string, params?: Record<string, unknown>, headers?: Record<string, string>): Promise<HttpResponse<void>>;