@oxy.so/services 4.0.1 → 4.0.3

package/src/ui/icons/Ionicons.ts

@@ -1,11 +1,16 @@
 import createIconSet from '@expo/vector-icons/createIconSet';
+import { decorativeIconSet } from './decorativeIconSet';
 import font from '../../assets/fonts/icons/OxyServicesIonicons.ttf';
 import { ioniconsGlyphMap } from './subsetGlyphMaps';
 
-const Ionicons = createIconSet(
-  ioniconsGlyphMap,
-  'OxyServicesIonicons',
-  font,
+/** Glyphs are decorative: hidden from assistive technology (see `decorativeIconSet`). */
+const Ionicons = decorativeIconSet(
+  createIconSet(
+    ioniconsGlyphMap,
+    'OxyServicesIonicons',
+    font,
+  ),
+  'Ionicons',
 );
 
 export default Ionicons;

package/src/ui/icons/MaterialCommunityIcons.ts

@@ -1,11 +1,16 @@
 import createIconSet from '@expo/vector-icons/createIconSet';
+import { decorativeIconSet } from './decorativeIconSet';
 import font from '../../assets/fonts/icons/OxyServicesMaterialCommunityIcons.ttf';
 import { materialCommunityIconsGlyphMap } from './subsetGlyphMaps';
 
-const MaterialCommunityIcons = createIconSet(
-  materialCommunityIconsGlyphMap,
-  'OxyServicesMaterialCommunityIcons',
-  font,
+/** Glyphs are decorative: hidden from assistive technology (see `decorativeIconSet`). */
+const MaterialCommunityIcons = decorativeIconSet(
+  createIconSet(
+    materialCommunityIconsGlyphMap,
+    'OxyServicesMaterialCommunityIcons',
+    font,
+  ),
+  'MaterialCommunityIcons',
 );
 
 export default MaterialCommunityIcons;

package/src/ui/icons/__tests__/decorativeIconSet.test.tsx

@@ -0,0 +1,40 @@
+/**
+ * Icon-font glyphs are private-use code points in a `Text` node; unhidden, a
+ * screen reader announces them (`"\u{F0140}"` beside "Switch account" in the
+ * Android account menu, OxyHQ/oxy#1375). Both SDK icon families hide every
+ * glyph, and a caller cannot switch that back on.
+ */
+
+import { render } from '@testing-library/react';
+import Ionicons from '../Ionicons';
+import MaterialCommunityIcons from '../MaterialCommunityIcons';
+import { decorativeIconSet } from '../decorativeIconSet';
+
+describe('the SDK icon families are decorative', () => {
+  it.each([
+    ['MaterialCommunityIcons', MaterialCommunityIcons, 'chevron-down'],
+    ['Ionicons', Ionicons, 'add'],
+  ] as const)('%s hides its glyph from assistive technology', (_family, Icon, name) => {
+    const { container } = render(<Icon name={name as never} size={20} />);
+
+    expect(container.querySelector(`[data-icon="${name}"]`)?.getAttribute('aria-hidden')).toBe('true');
+  });
+
+  it('keeps the glyph hidden even when a caller asks otherwise', () => {
+    const { container } = render(
+      <MaterialCommunityIcons name="chevron-down" aria-hidden={false} />,
+    );
+
+    expect(container.querySelector('[data-icon]')?.getAttribute('aria-hidden')).toBe('true');
+  });
+
+  it('carries the family statics, so it stays a drop-in for the family', () => {
+    expect(MaterialCommunityIcons.glyphMap['chevron-down']).toEqual(expect.any(Number));
+    expect(Ionicons.glyphMap.add).toEqual(expect.any(Number));
+
+    const Family = Object.assign(() => null, { glyphMap: { a: 1 }, getFontFamily: () => 'F' });
+    const Wrapped = decorativeIconSet(Family, 'Wrapped');
+    expect(Wrapped.glyphMap).toBe(Family.glyphMap);
+    expect(Wrapped.getFontFamily()).toBe('F');
+  });
+});

package/src/ui/icons/decorativeIconSet.ts

@@ -0,0 +1,41 @@
+import { createElement, type ComponentProps, type ComponentType } from 'react';
+
+/** Function built-ins and statics a function component must not inherit. */
+const NOT_COPIED = new Set(['length', 'name', 'prototype', 'caller', 'arguments', 'defaultProps', 'displayName']);
+
+/**
+ * Wrap an icon-font family so every glyph it renders is hidden from assistive
+ * technology.
+ *
+ * A vector-icons glyph is a `Text` node whose content is a private-use code
+ * point. A screen reader reads it like any other text: Android QA of the account
+ * menu found `"\u{F0140}"` announced next to "Switch account" (OxyHQ/oxy#1375),
+ * and on Android the code point is folded into the label of the pressable around
+ * it, because RN builds an unlabelled accessible view's description from its
+ * children's text.
+ *
+ * Every glyph in this SDK is decorative — the control or row around it carries
+ * the words — so it is hidden here, once, rather than at each call site where
+ * the next icon would forget it. `aria-hidden` is
+ * `importantForAccessibility="no-hide-descendants"` on Android,
+ * `accessibilityElementsHidden` on iOS and `aria-hidden` on web. It is applied
+ * AFTER the caller's props so it cannot be switched back on; a glyph that needs
+ * a name belongs inside a control that has one. (Mention's own wrapper,
+ * `components/common/Ionicons.tsx`, is the same rule.)
+ *
+ * The family's statics (`glyphMap`, `getImageSource`, `loadFont`, …) are carried
+ * over, so the wrapper is a drop-in for the family itself.
+ */
+// biome-ignore lint/suspicious/noExplicitAny: an icon family's own props are whatever `createIconSet` typed them as; the wrapper returns the SAME type.
+export function decorativeIconSet<T extends ComponentType<any>>(IconSet: T, displayName: string): T {
+  function DecorativeIcon(props: ComponentProps<T>) {
+    return createElement(IconSet, { ...props, 'aria-hidden': true });
+  }
+  for (const key of Object.getOwnPropertyNames(IconSet)) {
+    if (NOT_COPIED.has(key)) continue;
+    const descriptor = Object.getOwnPropertyDescriptor(IconSet, key);
+    if (descriptor) Object.defineProperty(DecorativeIcon, key, descriptor);
+  }
+  DecorativeIcon.displayName = displayName;
+  return DecorativeIcon as unknown as T;
+}

package/src/ui/screens/ManageAccountScreen.tsx

@@ -20,6 +20,7 @@ import {
     getNormalizedUserHandle,
     logger as loggerUtil,
     packageInfo,
+    type DeviceLinkedSession,
 } from '@oxy.so/core';
 import type { BaseScreenProps } from '../types/navigation';
 import ProfileSummaryCard from '../components/ProfileSummaryCard';
@@ -33,16 +34,9 @@ import { isWebBrowser } from '../utils/isWebBrowser';
 import { useCurrentUser } from '../hooks/queries/useAccountQueries';
 import { useUserSubscription } from '../hooks/queries/usePaymentQueries';
 import { useDeviceSessions } from '../hooks/queries/useServicesQueries';
+import { deviceSessionTitle } from '../utils/deviceSessionTitle';
 
-interface DeviceSessionRow {
-    sessionId: string;
-    deviceId: string;
-    deviceName: string;
-    isActive: boolean;
-    lastActive: string;
-    expiresAt: string;
-    isCurrent: boolean;
-}
+type DeviceSessionRow = DeviceLinkedSession;
 
 const AVATAR_SIZE = 88;
 
@@ -172,8 +166,7 @@ const ManageAccountScreen: React.FC<BaseScreenProps> = ({
         const confirmed = await surfaces.confirm({
             title: t('manageAccount.confirms.removeDeviceTitle') || 'Remove device',
             description:
-                t('manageAccount.confirms.removeDevice', { name: device.deviceName })
-                || `Sign out from "${device.deviceName}"?`,
+                t('manageAccount.confirms.removeDevice', { name: deviceSessionTitle(device, t) }),
             confirmLabel: t('common.remove') || 'Remove',
             cancelLabel: t('common.cancel') || 'Cancel',
             destructive: true,
@@ -186,8 +179,7 @@ const ManageAccountScreen: React.FC<BaseScreenProps> = ({
             await oxyServices.logoutSession(activeSessionId, device.sessionId);
             await refetchDeviceSessions();
             toast.success(
-                t('manageAccount.toasts.deviceRemoved', { name: device.deviceName })
-                || `Signed out from ${device.deviceName}`,
+                t('manageAccount.toasts.deviceRemoved', { name: deviceSessionTitle(device, t) }),
             );
         } catch (error) {
             loggerUtil.warn('Remove device failed', { component: 'ManageAccountScreen' }, error as unknown);
@@ -503,7 +495,7 @@ const ManageAccountScreen: React.FC<BaseScreenProps> = ({
                                         }
                                     />
                                 }
-                                title={`${device.deviceName}${device.isCurrent ? ` (${t('manageAccount.sessions.thisDevice') || 'This device'})` : ''}`}
+                                title={deviceSessionTitle(device, t)}
                                 description={
                                     t('manageAccount.sessions.lastActive', {
                                         relative: formatRelative(device.lastActive),
@@ -711,10 +703,13 @@ const ManageAccountScreen: React.FC<BaseScreenProps> = ({
                             description={
                                 accounts.length > 0
                                     ? (
-                                        t('accounts.manage.switch.count', {
-                                            count: accounts.length,
-                                        })
-                                        || `${accounts.length} ${accounts.length === 1 ? 'account' : 'accounts'}`
+                                        // One account is "1 account", not "1 accounts".
+                                        t(
+                                            accounts.length === 1
+                                                ? 'accounts.manage.switch.countOne'
+                                                : 'accounts.manage.switch.count',
+                                            { count: accounts.length },
+                                        )
                                     )
                                     : (
                                         t('accounts.manage.switch.empty')

package/src/ui/session/__tests__/tokenLossRecovery.test.ts

@@ -0,0 +1,195 @@
+/**
+ * A lost access token is a question, not a sign-out (OxyHQ/Mention#1140).
+ *
+ * The provider used to sign the user out on ANY cleared bearer. HttpService
+ * clears it whenever a 401's refresh comes back empty — including when the mint
+ * is merely cooling down after a 429 or the network blipped — and with no token
+ * the refresh scheduler stops, so the session never came back until a relaunch
+ * re-minted from the device credential that had been intact the whole time.
+ */
+import {
+  createTokenLossRecovery,
+  MAX_KEYED_RECOVERY_ATTEMPTS,
+  TOKEN_RECOVERY_BACKOFF_MS,
+  type TokenLossRecoveryDeps,
+} from '../tokenLossRecovery';
+
+interface Harness {
+  deps: TokenLossRecoveryDeps;
+  state: { signedIn: boolean; token: string | null; credential: boolean; keyed: boolean };
+  remint: jest.Mock<Promise<string | null>, []>;
+  signOutLocally: jest.Mock<Promise<void>, []>;
+  sleeps: number[];
+}
+
+function harness(remintAnswers: Array<string | null | 'drop-credential'>): Harness {
+  const state = { signedIn: true, token: null as string | null, credential: true, keyed: false };
+  const sleeps: number[] = [];
+  const remint = jest.fn(async (): Promise<string | null> => {
+    const answer = remintAnswers.length > 0 ? remintAnswers.shift() : null;
+    if (answer === 'drop-credential') {
+      // What the refresh handler does on `invalid_device_secret` /
+      // `no_active_session`: the credential goes, and the mint returns nothing.
+      state.credential = false;
+      return null;
+    }
+    if (answer) {
+      state.token = answer;
+    }
+    return answer ?? null;
+  });
+  const signOutLocally = jest.fn(async () => {
+    state.signedIn = false;
+  });
+  const deps: TokenLossRecoveryDeps = {
+    remint,
+    hasDeviceCredential: async () => state.credential,
+    hasKeyedRecovery: async () => state.keyed,
+    isSignedIn: () => state.signedIn,
+    hasToken: () => state.token !== null,
+    signOutLocally,
+    sleep: async (ms) => {
+      sleeps.push(ms);
+    },
+  };
+  return { deps, state, remint, signOutLocally, sleeps };
+}
+
+async function runToCompletion(recovery: ReturnType<typeof createTokenLossRecovery>): Promise<void> {
+  for (let i = 0; i < 200 && recovery.isRecovering(); i += 1) {
+    await new Promise((resolve) => setTimeout(resolve, 0));
+  }
+  expect(recovery.isRecovering()).toBe(false);
+}
+
+describe('token loss recovery', () => {
+  it('keeps a user with an intact device credential signed in through transient failures, then restores the token', async () => {
+    // The incident: the mint is rate limited / cooling down for a while, then
+    // succeeds — exactly what a relaunch a few minutes later did.
+    const h = harness([null, null, null, 'fresh']);
+    const recovery = createTokenLossRecovery(h.deps);
+
+    recovery.start();
+    await runToCompletion(recovery);
+
+    expect(h.signOutLocally).not.toHaveBeenCalled();
+    expect(h.state.token).toBe('fresh');
+    expect(h.remint).toHaveBeenCalledTimes(4);
+    expect(h.sleeps).toEqual(TOKEN_RECOVERY_BACKOFF_MS.slice(0, 3));
+  });
+
+  it('signs out once a re-mint gets a definitive verdict and no key can re-establish the session', async () => {
+    const h = harness([null, 'drop-credential']);
+    const recovery = createTokenLossRecovery(h.deps);
+
+    recovery.start();
+    await runToCompletion(recovery);
+
+    expect(h.signOutLocally).toHaveBeenCalledTimes(1);
+    expect(h.remint).toHaveBeenCalledTimes(2);
+  });
+
+  it('signs out at once when the credential was already gone and there is no key-based lane (the old behaviour for a real revocation)', async () => {
+    const h = harness([]);
+    h.state.credential = false;
+    const recovery = createTokenLossRecovery(h.deps);
+
+    recovery.start();
+    await runToCompletion(recovery);
+
+    expect(h.remint).not.toHaveBeenCalled();
+    expect(h.signOutLocally).toHaveBeenCalledTimes(1);
+  });
+
+  it('re-establishes through the shared identity when the credential is gone, like the cold boot does', async () => {
+    const h = harness([null, 'from-shared-key']);
+    h.state.credential = false;
+    h.state.keyed = true;
+    const recovery = createTokenLossRecovery(h.deps);
+
+    recovery.start();
+    await runToCompletion(recovery);
+
+    expect(h.signOutLocally).not.toHaveBeenCalled();
+    expect(h.state.token).toBe('from-shared-key');
+  });
+
+  it('gives the key-based lane a bounded number of tries, then signs out', async () => {
+    const h = harness([]);
+    h.state.credential = false;
+    h.state.keyed = true;
+    const recovery = createTokenLossRecovery(h.deps);
+
+    recovery.start();
+    await runToCompletion(recovery);
+
+    expect(h.remint).toHaveBeenCalledTimes(MAX_KEYED_RECOVERY_ATTEMPTS);
+    expect(h.signOutLocally).toHaveBeenCalledTimes(1);
+  });
+
+  it('stops without touching the session when the user signs out meanwhile', async () => {
+    const h = harness([]);
+    h.remint.mockImplementation(async () => {
+      h.state.signedIn = false;
+      return null;
+    });
+    const recovery = createTokenLossRecovery(h.deps);
+
+    recovery.start();
+    await runToCompletion(recovery);
+
+    expect(h.remint).toHaveBeenCalledTimes(1);
+    expect(h.signOutLocally).not.toHaveBeenCalled();
+  });
+
+  it('stops when another lane planted a token first', async () => {
+    const h = harness([]);
+    h.remint.mockImplementation(async () => {
+      h.state.token = 'planted-by-a-sign-in';
+      return null;
+    });
+    const recovery = createTokenLossRecovery(h.deps);
+
+    recovery.start();
+    await runToCompletion(recovery);
+
+    expect(h.remint).toHaveBeenCalledTimes(1);
+    expect(h.signOutLocally).not.toHaveBeenCalled();
+  });
+
+  it('runs one recovery at a time', async () => {
+    const h = harness([null, 'fresh']);
+    const recovery = createTokenLossRecovery(h.deps);
+
+    recovery.start();
+    recovery.start();
+    await runToCompletion(recovery);
+
+    expect(h.remint).toHaveBeenCalledTimes(2);
+  });
+
+  it('signs out rather than strand a signed-in UI with no bearer when recovery itself throws', async () => {
+    const h = harness([]);
+    h.deps.hasDeviceCredential = async () => {
+      throw new Error('store exploded');
+    };
+    const recovery = createTokenLossRecovery(h.deps);
+
+    recovery.start();
+    await runToCompletion(recovery);
+
+    expect(h.signOutLocally).toHaveBeenCalledTimes(1);
+  });
+
+  it('does nothing after dispose', async () => {
+    const h = harness([]);
+    const recovery = createTokenLossRecovery(h.deps);
+
+    recovery.dispose();
+    recovery.start();
+    await runToCompletion(recovery);
+
+    expect(h.remint).not.toHaveBeenCalled();
+    expect(h.signOutLocally).not.toHaveBeenCalled();
+  });
+});

package/src/ui/session/tokenLossRecovery.ts

@@ -0,0 +1,146 @@
+/**
+ * What a signed-in app does when its access token disappears at runtime.
+ *
+ * `HttpService` clears the bearer when a request draws a 401 and the refresh it
+ * then tries returns nothing. That refresh can return nothing for reasons that
+ * say NOTHING about the session: the mint is cooling down after a failure or a
+ * 429, the network dropped, the server was restarting. The provider used to read
+ * every such clear as a sign-out and tore the session down on the spot — and
+ * because the proactive refresh scheduler only runs while a token exists, nothing
+ * was left to bring the session back. Only a relaunch did, because the cold boot
+ * mints from the durable device credential that had been there all along
+ * (OxyHQ/Mention#1140).
+ *
+ * So a lost token is a question, and this answers it the way a relaunch would:
+ *
+ *  - The durable store still holds the device credential → the session is NOT
+ *    known to be over. Keep the user signed in (private queries pause, because
+ *    there is no bearer) and re-mint with backoff until one succeeds. A
+ *    definitive server verdict (`invalid_device_secret`, `no_active_session`)
+ *    makes the refresh handler drop or clear that credential, which is what ends
+ *    this loop in a sign-out — so a real revocation still signs out.
+ *  - No credential, but a key-based lane can still re-establish (the native
+ *    shared identity, or an identity-bound client's own key) → try that a few
+ *    times, as the cold boot's shared-key step would, then sign out.
+ *  - Neither → the session is over. Sign out now, as before.
+ *
+ * Framework-free and clock-injectable so the policy is unit tested without a
+ * provider.
+ */
+import { logger } from '@oxy.so/core';
+
+export interface TokenLossRecoveryDeps {
+  /** Re-mint once through the installed refresh handler; the token, or null. */
+  remint: () => Promise<string | null>;
+  /** Whether the durable auth store still holds `deviceId` + `deviceSecret`. */
+  hasDeviceCredential: () => Promise<boolean>;
+  /**
+   * Whether a key-based lane could still re-establish the session without a
+   * device secret. Consulted only once the credential is gone.
+   */
+  hasKeyedRecovery: () => Promise<boolean>;
+  /** Whether the UI still shows a signed-in user. */
+  isSignedIn: () => boolean;
+  /** Whether a bearer is planted right now. */
+  hasToken: () => boolean;
+  /** Tear down the local session (the provider's `clearSessionState`). */
+  signOutLocally: () => Promise<void>;
+  /** Timer seam for tests. */
+  sleep?: (ms: number) => Promise<void>;
+}
+
+export interface TokenLossRecovery {
+  /** Start recovering, unless a recovery is already running. */
+  start(): void;
+  /** Abandon any running recovery (provider unmount). */
+  dispose(): void;
+  /** Whether a recovery is running. */
+  isRecovering(): boolean;
+}
+
+/**
+ * Delays between re-mint attempts while the device credential is intact. Starts
+ * near the post-failure refresh cooldowns and settles at one attempt a minute,
+ * which also respects the mint's own 60s rate-limit cooldown.
+ */
+export const TOKEN_RECOVERY_BACKOFF_MS: readonly number[] = [2_000, 5_000, 10_000, 20_000, 30_000, 60_000];
+
+/** Attempts through a key-based lane once the device credential is gone. */
+export const MAX_KEYED_RECOVERY_ATTEMPTS = 3;
+
+const defaultSleep = (ms: number): Promise<void> =>
+  new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+
+const LOG_CONTEXT = { component: 'OxyContext', method: 'tokenLossRecovery' } as const;
+
+export function createTokenLossRecovery(deps: TokenLossRecoveryDeps): TokenLossRecovery {
+  const sleep = deps.sleep ?? defaultSleep;
+  let running = false;
+  let disposed = false;
+
+  const settled = (): boolean => disposed || deps.hasToken() || !deps.isSignedIn();
+
+  const run = async (): Promise<void> => {
+    let attempt = 0;
+    let keyedAttempts = 0;
+    logger.warn('Access token lost while signed in — recovering the session instead of signing out', LOG_CONTEXT);
+    while (!settled()) {
+      if (!(await deps.hasDeviceCredential())) {
+        const keyed = keyedAttempts < MAX_KEYED_RECOVERY_ATTEMPTS && (await deps.hasKeyedRecovery());
+        if (!keyed) {
+          if (settled()) {
+            return;
+          }
+          logger.warn('Session recovery ended: no device credential and no key-based lane left — signing out', {
+            ...LOG_CONTEXT,
+            attempts: attempt,
+            keyedAttempts,
+          });
+          await deps.signOutLocally();
+          return;
+        }
+        keyedAttempts += 1;
+      }
+      if (settled()) {
+        return;
+      }
+      const token = await deps.remint().catch(() => null);
+      attempt += 1;
+      if (token || settled()) {
+        if (token) {
+          logger.warn('Session recovered after a lost access token', { ...LOG_CONTEXT, attempts: attempt });
+        }
+        return;
+      }
+      await sleep(TOKEN_RECOVERY_BACKOFF_MS[Math.min(attempt - 1, TOKEN_RECOVERY_BACKOFF_MS.length - 1)]);
+    }
+  };
+
+  return {
+    start(): void {
+      if (running || disposed) {
+        return;
+      }
+      running = true;
+      void run()
+        .catch(async (error: unknown) => {
+          // Never leave a signed-in UI with no bearer and nothing recovering it.
+          logger.warn('Session recovery failed unexpectedly — signing out', LOG_CONTEXT, error);
+          if (!settled()) {
+            await deps.signOutLocally().catch(() => undefined);
+          }
+        })
+        .finally(() => {
+          running = false;
+        });
+    },
+    dispose(): void {
+      disposed = true;
+    },
+    isRecovering(): boolean {
+      return running;
+    },
+  };
+}

package/src/ui/utils/__tests__/deviceSessionTitle.test.ts

@@ -0,0 +1,31 @@
+import type { User } from '@oxy.so/core';
+import { deviceSessionTitle } from '../deviceSessionTitle';
+
+const t = (key: string) =>
+  ({
+    'manageAccount.sessions.thisDevice': 'This device',
+    'manageAccount.sessions.otherSession': 'Another session',
+  })[key] ?? key;
+
+describe('deviceSessionTitle', () => {
+  it('never reads "undefined" when the server sends no device name (OxyHQ/oxy#1375 item 11)', () => {
+    // The live response shape: no `deviceName` key at all.
+    const title = deviceSessionTitle({ isCurrent: true } as never, t);
+    expect(title).toBe('This device');
+    expect(title).not.toContain('undefined');
+  });
+
+  it("names another session by its account, which the response does carry", () => {
+    const user = { id: 'u2', username: 'bob', name: { displayName: 'Bob' } } as unknown as User;
+    expect(deviceSessionTitle({ isCurrent: false, user } as never, t)).toBe('Bob');
+  });
+
+  it('falls back to a generic label when nothing names the session', () => {
+    expect(deviceSessionTitle({ isCurrent: false } as never, t)).toBe('Another session');
+  });
+
+  it('keeps a real device name, marking the current one', () => {
+    expect(deviceSessionTitle({ deviceName: 'Pixel 8a', isCurrent: true }, t)).toBe('Pixel 8a (This device)');
+    expect(deviceSessionTitle({ deviceName: 'Pixel 8a', isCurrent: false }, t)).toBe('Pixel 8a');
+  });
+});

package/src/ui/utils/deviceSessionTitle.ts

@@ -0,0 +1,29 @@
+import { getNormalizedUserHandle, type DeviceLinkedSession } from '@oxy.so/core';
+
+type Translate = (key: string, vars?: Record<string, string | number>) => string;
+
+/**
+ * The title of one row in "Sessions & devices".
+ *
+ * `GET /session/device/sessions/:sessionId` lists the sessions that share THIS
+ * physical device — one per account signed in here — and sends no
+ * `deviceName` at all, although the model declared one. The row interpolated
+ * it unconditionally and Android QA read "undefined (This device)"
+ * (OxyHQ/oxy#1375 item 11).
+ *
+ * A name the server does send is used; otherwise the current session is "This
+ * device" and any other is named by the account it belongs to, which the
+ * response does carry. Never the string "undefined".
+ */
+export function deviceSessionTitle(
+  session: Pick<DeviceLinkedSession, 'deviceName' | 'isCurrent' | 'user'>,
+  t: Translate,
+): string {
+  const thisDevice = t('manageAccount.sessions.thisDevice');
+  const deviceName = typeof session.deviceName === 'string' ? session.deviceName.trim() : '';
+  if (deviceName) return session.isCurrent ? `${deviceName} (${thisDevice})` : deviceName;
+  if (session.isCurrent) return thisDevice;
+  const user = session.user;
+  const name = user?.name?.displayName?.trim() || (user ? getNormalizedUserHandle(user) : null);
+  return name || t('manageAccount.sessions.otherSession');
+}