@peabody-soft/mbs-model-ts 1.11.0 → 1.13.0

package/dist/Model.js

@@ -1,14 +1,15 @@
 import { Constants as proto_Constants } from "./generated/Constants";
-import { CreateUserRequest as proto_CreateUserRequest } from "./generated/CreateUserRequest";
 import { FulfillmentMode as proto_FulfillmentMode } from "./generated/FulfillmentMode";
 import AuthTokens from "./AuthTokens";
+import { MAX_PROFILE_STALENESS_MS } from "./Constants";
 import * as ContainerNames from "./ContainerNames";
 import { IllegalOperationException, InvalidArgumentException } from "./Exceptions";
 import Ids from "./Ids";
+import InMemoryLock from "./InMemoryLock";
 import LiveData from "./LiveData";
 import { canonicalizeBusinessId } from "./Profile";
 import * as ProtoMap from "./ProtoMap";
-import { InternalServerException, NotFoundException } from "./ServiceExceptions";
+import { ConflictException, InternalServerException, NotFoundException } from "./ServiceExceptions";
 import ShoppingList from "./ShoppingList";
 import SyncCache from "./SyncCache";
 import * as SyncKeys from "./SyncKeys";
@@ -16,15 +17,26 @@ import SyncState from "./SyncState";
 // The root of the object model, and the only object a UI needs. Call initialize once, then get the
 // current instance with getInstance.
 //
-// THERE IS NO LOCKING. A caller makes one call at a time and awaits it. Otherwise:
+// CALLS ARE NOT QUEUED. A caller makes one call at a time and awaits it. Otherwise:
 // - A setBusinessId still reading when signIn reads the business too can publish the anonymous
 //   container's business over the customer's. The published business then has no cart or orders,
 //   and nothing publishes them again.
-// - Two reads at once interleave their pages and writes, as do two tabs on one store (each holds a
-//   Model), so a store supports one tab at a time.
-// A queue inside Model would not fix the tabs, and each public method would need an unqueued twin
-// (signIn calls signOut, businessSyncIn calls updateCart). A caller that calls from several places,
-// like a UI, queues the calls itself.
+// - Two reads at once interleave their pages and writes.
+// A queue inside Model would need an unqueued twin of each public method (signIn calls signOut,
+// businessSyncIn calls updateCart). A caller that calls from several places, like a UI, queues the
+// calls itself. Only changeUser takes a Lock, so that two tabs do not start from the same user.
+//
+// SEVERAL TABS can use one store, each with its own Model. The store applies a batch atomically and
+// keeps the greater eTag, so what the tabs store converges on what the server holds. A profile
+// container is shared by every tab the customer has open, on any shop, so concurrent use matters
+// more there than in a business container, which only tabs on the same shop share. A sequence of
+// calls is not atomic across tabs:
+// - Deleting a container (deleteBusiness, or an eviction by the store) while another tab writes
+//   pages to it can leave its cursors ahead of its entities.
+// - The Business and Profile a Model publishes change only when that Model reads or writes. A
+//   cart or a user built from them can be older than what the store holds, and sending it replaces
+//   the newer one on the server. changeUser starts from the stored user, and a caller can read the
+//   profile again with refreshProfileIfStale.
 class Model {
     constructor() {
         // True when the published business, if any, has been read to the end and found to be the one
@@ -33,6 +45,13 @@ class Model {
         // failure, a rejection) leaves the business published and unvetted. See readJoinBusinessId, which
         // does not join such a business.
         this._isPublishedBusinessVetted = false;
+        // When the last read of the profile ended, as Date.now() gave it. Null before the first.
+        this._profileReadAt = null;
+        // The profile cursors the published profile was read at, from getProfileCursorsKey. Null until a
+        // profile is published from the store.
+        this._publishedProfileCursors = null;
+        // The read that refreshProfileIfStale is running, so an overlapping call can share it
+        this._profileRefresh = null;
         this._business = new LiveData(null);
         this._profile = new LiveData(null);
         this._authenticationMethod = null;
@@ -41,10 +60,13 @@ class Model {
         this._businessId = null;
     }
     // Sets the service and store to use. Discards the current instance, so nobody is signed in and no
-    // business is browsed.
-    static initialize(service, database) {
+    // business is browsed. lock makes changeUser exclusive: pass one that spans every tab that shares
+    // the store (see Lock), or leave the default, which excludes calls in this tab only. A call still
+    // running on the discarded instance is not excluded against the new one.
+    static initialize(service, database, lock = new InMemoryLock()) {
         Model._service = service;
         Model._cache = new SyncCache(database);
+        Model._lock = lock;
         Model._instance = null;
     }
     // The current model. Fetch it each time and do not keep it: signOut discards it.
@@ -63,7 +85,7 @@ class Model {
     // Signs in and syncs this subject's profile in, for a subject the server has a profile for (use
     // createUser otherwise). Also reads in the business being browsed, if any, as this customer.
     //
-    // Anything thrown after beginSignIn's guard (a bad credential, a rejected push while reading the
+    // Anything thrown after beginSignIn's guard (a bad credential, a rejected request while reading the
     // business) calls signOut. profileSyncIn publishes a cached profile before it reaches the
     // network, so a retry could otherwise find _profile set and fail the "already signed in" guard.
     // Throws NotFoundException if the business being browsed cannot be opened. See businessSyncIn.
@@ -84,22 +106,114 @@ class Model {
     // profile for (use signIn otherwise). Also reads in the business being browsed, if any, as this
     // customer. Throws NotFoundException if that business cannot be opened (see businessSyncIn), after
     // the User exists. The sign-up is not undone: the customer stays signed up and signed in.
+    // - The user is created under an id this model makes for the subject, not userToCreate.id. One id
+    //   is made per subject and saved in the profile container before the call, and every attempt of
+    //   that subject sends it until the sign up is stored or refused with a ConflictException. It is
+    //   kept after a network error, a 5xx and any other error (a 400, a 401), and a successful signIn
+    //   does not delete it. It is deleted once the answer is stored, and by a ConflictException.
+    // - A ConflictException means the server could not create the user: the subject has one already,
+    //   or the id could not be used. It is rethrown, and this method does not sign in: the caller signs
+    //   in, which reads the profile. If signIn answers UnauthorizedException the subject has no
+    //   profile, and the caller creates again. The saved id is already deleted, so that sign up makes
+    //   a new one.
+    // - When the business being browsed is published and was read to the end, the call joins it too,
+    //   so the answer holds the link and the business and no second call is needed. If the server then
+    //   answers a NotFoundException, the user was created but the join was rejected, and no answer came
+    //   back: the profile is read without a join, and the business read that follows makes the join
+    //   again, which throws. A NotFoundException when no join was sent is rethrown at once.
     async createUser(authenticationMethod, subjectId, authenticationToken, userToCreate) {
         this.beginSignIn(authenticationMethod, subjectId, authenticationToken);
         const authTokens = await this.requireProfileAuthTokens();
-        await this.createProfileOnServer(proto_CreateUserRequest.create({ user: ProtoMap.buildUser(userToCreate) }), authTokens);
+        const containerName = this.requireProfileContainerName();
+        const cache = Model.getCache();
+        let userId = await cache.readUserId(containerName);
+        if (userId === null) {
+            userId = Ids.getNewId(proto_Constants.USER_ENTITY_TYPE_ID);
+            await cache.writeUserId(containerName, userId);
+        }
+        // A subject with no profile has nothing synced, so every cursor is zero
+        const noCursors = new SyncState(SyncKeys.PROFILE_SYNC_IN);
+        const joinBusinessId = this.getVettedBusiness()?.id ?? BigInt(proto_Constants.ENTITY_ID_NULL);
+        try {
+            await this.createProfileOnServer(ProtoMap.buildUserRequest(ProtoMap.buildUser(userToCreate, userId), noCursors, joinBusinessId), authTokens);
+        }
+        catch (error) {
+            if (error instanceof ConflictException) {
+                await cache.deleteUserId(containerName);
+                throw error;
+            }
+            const isJoinRefused = error instanceof NotFoundException &&
+                joinBusinessId !== BigInt(proto_Constants.ENTITY_ID_NULL);
+            if (!isJoinRefused)
+                throw error;
+            await this.profileSyncIn(ProtoMap.buildProfileSyncOutRequest(noCursors), await this.requireProfileAuthTokens());
+            await cache.deleteUserId(containerName);
+        }
         if (this._businessId !== null)
             await this.businessSyncIn();
     }
     // Updates this customer's own profile with what userProfile holds. Service.updateUser matches the
     // caller against the User by entity id (see ProtoMap.buildUpdateUser), so userProfile must be this
-    // customer's own, read in earlier, not built fresh. Throws if no profile has been read. Not
-    // paged. Publishes nothing today: the response carries no entities, only reissued tokens (see
-    // writeProfileResponse).
+    // customer's own, read in earlier, not built fresh. Throws if no profile has been read. The answer
+    // is cached and published as a profile read is, so the User as the server stored it replaces the
+    // held one (see readProfilePages).
     async updateUser(userProfile) {
         if (this._profile.value === null)
             throw new IllegalOperationException("Nobody is signed in, so this call cannot be made");
-        await this.writeProfileResponse(await Model.getService().updateUser(ProtoMap.buildUpdateUser(userProfile), await this.requireProfileAuthTokens()));
+        await this.sendUserUpdate(this.requireProfileContainerName(), userProfile);
+    }
+    // Changes this customer's own user. Reads the profile, calls change with the user the profile
+    // container stores, and sends the user change returns, as updateUser does. Use it instead of
+    // updateUser when the new user is the current one with something altered, for example an address
+    // added. The current user includes what other tabs and devices have written, which a user built
+    // from the published profile may lack, and sending that user would erase it.
+    // Calls for one profile run one at a time. When the Lock given to initialize spans tabs, a second
+    // tab that changes the user waits for this change and starts from its result. The server still
+    // takes the last write of two devices that change the user at once.
+    // change must return a user with the id it is given, and must not call changeUser, which would
+    // wait for its own lock. Throws IllegalOperationException if no profile has been read,
+    // InvalidArgumentException if change returns another id, and what change throws.
+    async changeUser(change) {
+        if (this._profile.value === null)
+            throw new IllegalOperationException("Nobody is signed in, so this call cannot be made");
+        const containerName = this.requireProfileContainerName();
+        await Model._lock.runExclusive(containerName, async () => {
+            await this.syncProfile(containerName);
+            const current = await this.readStoredUser(containerName);
+            if (current === null)
+                throw new IllegalOperationException("No user has been read, so there is none to change");
+            const changed = change(current);
+            if (changed.id !== current.id)
+                throw new InvalidArgumentException("A change of the user must keep the id of the user");
+            await this.sendUserUpdate(containerName, changed);
+        });
+    }
+    // Reads the profile if the last read of it is older than MAX_PROFILE_STALENESS_MS, and returns
+    // whether it did. Every read of the profile counts, a sign in and an update included. Does
+    // nothing when nobody is signed in or the first read is still under way. The read fetches only
+    // what changed, and calls that overlap share one read, so a UI can call it from every event that
+    // shows a tab again. The profile is published if it differs from what was published, including
+    // when another tab stored the answer first. Throws what a read throws, and a failed read leaves
+    // the profile stale, so the next call reads again. A clock set back counts as stale.
+    async refreshProfileIfStale() {
+        if (this._profile.value === null)
+            return false;
+        if (this._profileRefresh !== null)
+            return this._profileRefresh;
+        const readAt = this._profileReadAt;
+        if (readAt === null)
+            return false;
+        const age = Date.now() - readAt;
+        if (age >= 0 && age < MAX_PROFILE_STALENESS_MS)
+            return false;
+        const refresh = this.refreshProfile();
+        this._profileRefresh = refresh;
+        try {
+            return await refresh;
+        }
+        finally {
+            this._profileRefresh = null;
+        }
     }
     // Discards this model. The next getInstance() builds a fresh one, signed out and browsing nothing.
     async signOut() {
@@ -131,7 +245,7 @@ class Model {
     // order placed from it. Both need a customer who is a member of the business (see
     // requireCustomerOfBusiness), except that a signed-out visitor can keep a cart locally (see
     // updateCartLocalOnly).
-    // An order reaches the store only after the server accepts it, so a customer never holds an order
+    // An order reaches the store only after the server accepts it, so a customer never has an order
     // the server has not accepted, and a failed call leaves nothing to reconcile. A cart can be
     // stored before the server has it (see updateCartLocalOnly).
     // Creates or replaces this customer's cart, on the server and in the store. An empty list
@@ -139,9 +253,11 @@ class Model {
     // Signed out, this calls updateCartLocalOnly, as the server has no cart for a visitor. Signed in,
     // it costs a request, so an editor should write each change with updateCartLocalOnly and call this
     // on a schedule (debounced, on blur, on a timer).
-    // A call that matches the stored copy returns without a request (hasShoppingListChanged). It does
-    // not replace a read of the business: the response to a push holds only the pushed messages, so
-    // it brings no changes made by others.
+    // A call that matches the stored copy returns without a request (hasShoppingListChanged), and so
+    // reads nothing. A call that sends gets back the customer's messages that are newer than the last
+    // read, the cart among them: a change that the business made to an order comes with it. It brings
+    // nothing of the rest of the business, so it does not replace a read of it.
+    // The cart is sent as a whole and replaces the stored cart if it is dated later.
     async updateCart(shoppingList) {
         if (this._profile.value === null)
             return this.updateCartLocalOnly(shoppingList);
@@ -150,7 +266,7 @@ class Model {
         if (!ProtoMap.hasShoppingListChanged(stored, shoppingList))
             return;
         const partyPreferencesMessage = ProtoMap.buildPartyPreferencesMessage(Ids.getPartyPreferencesMessageId(target.businessLink.id), stored, target.senderId, shoppingList, null, BigInt(Date.now()));
-        await this.pushBusinessMessages(target, [partyPreferencesMessage]);
+        await this.sendBusinessMessages(target, [partyPreferencesMessage]);
     }
     // The same, but stored locally and not sent. Call it on every edit (a request per tap of a
     // quantity stepper is too many), and call updateCart on a schedule to send.
@@ -161,12 +277,17 @@ class Model {
     // the update number of the copy it amends, buildPartyPreferencesMessage dates it past that copy,
     // and the later copy wins.
     async updateCartLocalOnly(shoppingList) {
-        // A signed-out visitor has no membership to derive a message id from, so a fresh id is drawn.
-        // It is the cart's id only for the first edit: buildPartyPreferencesMessage reuses the stored
-        // cart's id, so later edits amend one entity. With no party, the sender is ENTITY_ID_NULL. The
-        // first push after signing in carries the real one.
-        if (this._profile.value === null)
-            return this.storeCartInCache(ContainerNames.forBusiness(this.requireBusinessBeingBrowsed()), Ids.getNewId(proto_Constants.MESSAGE_ENTITY_TYPE_ID), BigInt(proto_Constants.ENTITY_ID_NULL), shoppingList);
+        // A signed-out visitor has no membership to derive a message id from, so a fresh id is drawn for
+        // the first edit and the stored cart keeps it, so later edits amend one entity. With no party, the
+        // sender is ENTITY_ID_NULL. A visitor's cart is never sent as it is: signing in sends a new cart
+        // under the id of the membership (see businessSyncIn).
+        if (this._profile.value === null) {
+            const containerName = ContainerNames.forBusiness(this.requireBusinessBeingBrowsed());
+            const stored = await Model.getCache().readPartyPreferences(containerName);
+            return this.storeCartInCache(containerName, stored === null
+                ? Ids.getNewId(proto_Constants.MESSAGE_ENTITY_TYPE_ID)
+                : ProtoMap.getMessageId(stored), BigInt(proto_Constants.ENTITY_ID_NULL), shoppingList);
+        }
         const target = this.requireCustomerOfBusiness();
         return this.storeCartInCache(target.containerName, Ids.getPartyPreferencesMessageId(target.businessLink.id), target.senderId, shoppingList);
     }
@@ -176,10 +297,14 @@ class Model {
     // The emptied cart records this fulfillmentMode, which Business.defaultFulfillmentMode returns.
     // The caller creates orderId with Ids.getNewId(Constants.MESSAGE_ENTITY_TYPE_ID), so it can find
     // the placed order, and can retry a call that a NetworkConnectionException left unresolved using
-    // the same id, without placing a second order. getPartyPreferencesMessageId gives a cart the same
-    // guarantee.
+    // the same id, without placing a second order: the server stores an order only if no message has
+    // its id, so a retry changes nothing, even after the business has started the order. The cart has
+    // one id for the same reason (see getPartyPreferencesMessageId).
     // A delivery must name an address: an id from this customer's list, or a full address sent
-    // directly (see requireDeliveryAddress).
+    // directly (see requireDeliveryAddress). Either way the address goes to the business with the
+    // order, in the party of the customer, so a full address has an id that is not zero.
+    // The party of the customer goes with every order: their name and phone number, and the delivery
+    // address of an order that is delivered. It is not sent with a cart.
     async createOrder(orderId, fulfillmentMode, deliveryAddressId, deliveryAddress, note) {
         const target = this.requireCustomerOfBusiness();
         // Read from the store rather than the published Business, so the order matches the stored cart
@@ -190,16 +315,25 @@ class Model {
             : ProtoMap.buildShoppingList(partyPreferencesMessage, target.countryCode);
         if (shoppingList.existingItems.length === 0)
             throw new IllegalOperationException("The cart holds nothing, so there is no order to place");
-        Model.requireDeliveryAddress(target.addresses, fulfillmentMode, deliveryAddressId, deliveryAddress);
+        Model.requireDeliveryAddress(target.user.addresses, fulfillmentMode, deliveryAddressId, deliveryAddress);
+        // A delivery is where the party of the customer gets an address, as in the merchant app, which adds
+        // the delivery address of an order to the party and none for a pick-up. It is the address of the
+        // order: the one sent whole, else the one the id names in the customer's list.
+        const partyAddress = fulfillmentMode === proto_FulfillmentMode.DELIVERY
+            ? (deliveryAddress ?? target.user.addresses.getAddress(deliveryAddressId))
+            : null;
+        if (partyAddress !== null && partyAddress.id === BigInt(proto_Constants.ENTITY_ID_NULL))
+            throw new InvalidArgumentException("An address to deliver to has an id of its own, which is how the party of the customer keeps it");
         // One timestamp for both messages: the time the order was placed
         const now = BigInt(Date.now());
-        // One request for the order and the emptied cart: two calls could leave an order placed and the
-        // cart still full if the second failed
-        await this.pushBusinessMessages(target, [
+        // One request for the order, the emptied cart and the party: two calls could leave an order placed
+        // and the cart still full if the second failed. The party goes with every order, one sent again
+        // included, and with nothing else: the server refuses a party that has no order with it.
+        await this.sendBusinessMessages(target, [
             ProtoMap.buildOrderMessage(orderId, target.senderId, shoppingList, fulfillmentMode, deliveryAddressId, deliveryAddress, note, now),
             // The customer's latest choice of fulfillmentMode, for defaultFulfillmentMode to offer next time
             ProtoMap.buildPartyPreferencesMessage(Ids.getPartyPreferencesMessageId(target.businessLink.id), partyPreferencesMessage, target.senderId, null, fulfillmentMode, now),
-        ]);
+        ], ProtoMap.buildParty(target.user, partyAddress));
     }
     // #endregion
     // Throws if a profile is already held, otherwise stores the credentials every later call signs
@@ -211,32 +345,40 @@ class Model {
         this._subjectId = subjectId;
         this._authenticationToken = authenticationToken;
     }
-    // #region Pushing
-    // Pushes the messages in one request, together with the update number this business container's
-    // reads have reached, then stores the response. The server answers with these messages under their
-    // assigned update numbers and nothing else: a push is not a read. They are stored without moving
-    // any cursor, so the next read receives them again, along with anything others changed in the
-    // meantime. A rejected push throws from the Service call itself, as for any bad status, so
-    // reaching the write below means the server accepted it.
-    async pushBusinessMessages(target, messages) {
+    // #region Sending
+    // Sends the messages, and the party of the customer if there is one, in one request, together with
+    // the update number this business container's reads have reached, then stores the response.
+    // The server answers with a sync out of the customer's messages, made after it writes: the stored
+    // messages that are newer than that update number, in the order of their update numbers, with the
+    // ones that were sent among them, and not in the order they were sent in. It is stored as a page of
+    // a read is, and moves the message cursor the same way. A message that was not stored (an order
+    // whose id exists, a cart dated no later than the stored one) is in it only if the stored message
+    // is newer than the cursor, and then it is the stored message. The cache has every message at or
+    // below the cursor, so what a caller needs afterwards is read from the cache by id.
+    // A full page may have more behind it, which is read as a read reads. A rejected request throws
+    // from the Service call itself, as for any bad status, so reaching the write below means the
+    // server accepted it.
+    async sendBusinessMessages(target, messages, party = null) {
         const cache = Model.getCache();
         const messageUpdateNumber = await cache.readMessageUpdateNumber(target.containerName);
         const authTokens = await this.requireBusinessAuthTokens(target.containerName, target.businessLink);
-        const response = await Model.getService().businessSyncIn(ProtoMap.buildBusinessSyncInRequest(messageUpdateNumber, messages), ProtoMap.buildAuthTokens(authTokens));
+        const request = ProtoMap.buildBusinessSyncInRequest(messageUpdateNumber, messages, party);
+        const response = await Model.getService().businessSyncIn(request, ProtoMap.buildAuthTokens(authTokens));
         await this.storeIssuedTokens(ProtoMap.getResponseAuthTokens(response), target.containerName);
-        // Stored as the response carried them: the server answers with the messages themselves, so
-        // nothing is stamped
-        const changeCount = await cache.writeMessages(target.containerName, ProtoMap.getSyncInResponseMessages(response));
+        let changeCount = await cache.writeMessages(target.containerName, ProtoMap.getSyncInResponseMessages(response));
+        // Read on from the cursor the page moved, with the tokens the response may have renewed
+        if (ProtoMap.isSyncInResponseFull(request, response))
+            changeCount += await this.readBusinessPages(target.containerName, target.businessLink.businessId, await cache.readBusinessCursors(target.containerName), ProtoMap.getBusinessResponseAttachmentBaseUrlExpiry(await cache.readBusiness(target.containerName)), ProtoMap.buildAuthTokens(await this.requireBusinessAuthTokens(target.containerName, target.businessLink)));
         // What the store took decides whether anything is published - see the Publishing region
         if (changeCount !== 0)
             this.publishBusiness(await cache.readBusiness(target.containerName));
     }
-    // Amends the cart containerName holds and writes the result to the cache. Nothing is pushed.
+    // Amends the cart containerName stores and writes the result to the cache. Nothing is sent.
     // The two callers differ in container, id and sender: see updateCartLocalOnly.
     async storeCartInCache(containerName, messageId, senderId, shoppingList) {
         const cache = Model.getCache();
         const changeCount = await cache.writePartyPreferences(containerName, ProtoMap.buildPartyPreferencesMessage(messageId, await cache.readPartyPreferences(containerName), senderId, shoppingList, null, BigInt(Date.now())));
-        // Published on what the store took, as for every read and push
+        // Published on what the store took, as for every read and sync in
         if (changeCount !== 0)
             this.publishBusiness(await cache.readBusiness(containerName));
     }
@@ -268,7 +410,7 @@ class Model {
             businessLink: businessLink,
             containerName: Model.getBusinessContainerName(businessLink),
             senderId: businessLink.partyId,
-            addresses: user.addresses,
+            user: user,
             countryCode: business.countryCode,
         };
     }
@@ -292,7 +434,8 @@ class Model {
     // #region The four calls of Service, each as this model makes it
     //
     // Each caches the response (a read caches every page as it arrives), files the tokens the server
-    // issued, and publishes what the cache then holds. A read is paged. A sign up and an update are not.
+    // issued, and publishes what the cache then holds. A read is paged, and the answer to a sign up or
+    // an update is the first page of a profile read.
     // Reads in the business being browsed: an anonymous visitor under its businessId, a signed-in
     // customer under their own container (see getBusinessContainerName), joining as a customer first
     // if not linked (see requireBusinessLink).
@@ -515,9 +658,26 @@ class Model {
         if (link !== null)
             return link;
         const joinBusinessId = await this.readJoinBusinessId(businessId);
-        await this.profileSyncIn(ProtoMap.buildProfileSyncOutRequest(await Model.getCache().readProfileCursors(this.requireProfileContainerName()), joinBusinessId), await this.requireProfileAuthTokens());
-        // Tried once: a join that leaves no link is the server contradicting itself, and retrying
-        // would not fix it.
+        const containerName = this.requireProfileContainerName();
+        const cache = Model.getCache();
+        try {
+            await this.profileSyncIn(ProtoMap.buildProfileSyncOutRequest(await cache.readProfileCursors(containerName), joinBusinessId), await this.requireProfileAuthTokens());
+        }
+        catch (error) {
+            if (!(error instanceof JoinNotAnsweredException))
+                throw error;
+            // The answer lacks the link and the business because the cursors are past them. Either
+            // another tab stored them first, and profileSyncIn has published them from the store, or the
+            // container lost them (it was cleared while a read was under way). In the second case the
+            // cursors are deleted and the profile is read again from the start, once.
+            const published = this._profile.value;
+            if (published === null || Model.findBusinessLink(published, businessId) === null) {
+                await cache.resetProfileCursors(containerName);
+                await this.profileSyncIn(ProtoMap.buildProfileSyncOutRequest(await cache.readProfileCursors(containerName), joinBusinessId), await this.requireProfileAuthTokens());
+            }
+        }
+        // A join that still leaves no link after the profile was read again from the start is the
+        // server contradicting itself, and retrying would not fix it.
         const joined = this._profile.value;
         const joinedLink = joined === null ? null : Model.findBusinessLink(joined, businessId);
         if (joinedLink === null)
@@ -529,8 +689,8 @@ class Model {
     // A business published from the cache by a read that has not ended is not known to be open or to
     // be the one the businessId names, so a customer is not joined to it.
     async readJoinBusinessId(businessId) {
-        const alreadyHeld = this._business.value;
-        if (alreadyHeld !== null && this._isPublishedBusinessVetted)
+        const alreadyHeld = this.getVettedBusiness();
+        if (alreadyHeld !== null)
             return alreadyHeld.id;
         await this.syncAnonymousBusiness(businessId);
         // A missing business is a NotFoundException from the read above. Reaching here with none
@@ -540,6 +700,12 @@ class Model {
             throw new InternalServerException(`The read of business ${businessId} answered with no Business`);
         return business.id;
     }
+    // The business being browsed, if it is published and has been read to the end and found open. A
+    // business published from the cache by a read that has not ended is not known to be either, so
+    // this is null for it.
+    getVettedBusiness() {
+        return this._isPublishedBusinessVetted ? this._business.value : null;
+    }
     static findBusinessEntity(profile, businessId) {
         const wanted = canonicalizeBusinessId(businessId);
         for (const business of profile.businesses)
@@ -600,9 +766,47 @@ class Model {
     async profileSyncIn(firstRequest, firstAuthTokens) {
         const containerName = this.getProfileContainerName();
         if (containerName === null)
+            return;
+        await this.publishProfileFromStore(containerName);
+        await this.readProfilePages(containerName, firstRequest, firstAuthTokens, () => Model.getService().profileSyncOut(firstRequest, firstAuthTokens));
+    }
+    // Reads what changed in the profile since the cursors the container holds, as a sign in does, but
+    // without publishing the stored profile first.
+    async syncProfile(containerName) {
+        const request = ProtoMap.buildProfileSyncOutRequest(await Model.getCache().readProfileCursors(containerName));
+        const authTokens = await this.requireProfileAuthTokens();
+        await this.readProfilePages(containerName, request, authTokens, () => Model.getService().profileSyncOut(request, authTokens));
+    }
+    // The user the profile container stores, or null when it holds none
+    async readStoredUser(containerName) {
+        const stored = await Model.getCache().readProfile(containerName);
+        if (stored === null || this._subjectId === null)
             return null;
-        const cached = await Model.getCache().readProfile(containerName);
-        this.publishProfile(cached);
+        return ProtoMap.buildProfile(this._subjectId, stored)?.user ?? null;
+    }
+    // Sends user over the one the server has, and stores and publishes the answer, which is the first
+    // page of a profile read.
+    async sendUserUpdate(containerName, user) {
+        const request = ProtoMap.buildUserRequest(ProtoMap.buildUpdateUser(user), await Model.getCache().readProfileCursors(containerName));
+        const authTokens = await this.requireProfileAuthTokens();
+        await this.readProfilePages(containerName, ProtoMap.getUserRequestSyncOutRequest(request), authTokens, () => Model.getService().updateUser(request, authTokens));
+    }
+    // The sign-up call. Its answer is the first page of a profile read, which readProfilePages
+    // continues if the page is full. The id saved for the sign up is deleted once that page is stored.
+    async createProfileOnServer(request, authTokens) {
+        const containerName = this.requireProfileContainerName();
+        await this.readProfilePages(containerName, ProtoMap.getUserRequestSyncOutRequest(request), authTokens, () => Model.getService().createUser(request, authTokens), () => Model.getCache().deleteUserId(containerName));
+    }
+    // Caches and publishes a profile read of the pages that firstRequest starts. sendFirstPage makes
+    // the first call: profileSyncOut for a read, createUser or updateUser for a write, which answers
+    // with the first page of the read that its profileSyncOutRequest describes. Later pages are read
+    // with profileSyncOut, because a write cannot be sent again.
+    // Each page is cached, moving the cursors, and the tokens it reissues are stored. afterFirstPage
+    // runs once the first page and its tokens are stored. The profile is published once, and only if
+    // the store took something. The join is checked last, so everything that arrived is cached and
+    // published before it can throw: the pages are valid even when the join is not.
+    async readProfilePages(containerName, firstRequest, firstAuthTokens, sendFirstPage, afterFirstPage = null) {
+        const cache = Model.getCache();
         let request = firstRequest;
         let authTokens = firstAuthTokens;
         let changeCount = 0;
@@ -611,9 +815,14 @@ class Model {
         const joinBusinessId = firstRequest.joinBusinessId;
         let hasJoinedLink = false;
         let hasJoinedBusiness = false;
+        let page = await sendFirstPage();
         for (;;) {
-            const page = await Model.getService().profileSyncOut(request, authTokens);
-            changeCount += await this.cacheProfileResponse(containerName, page, true);
+            changeCount += await cache.writeProfile(containerName, page);
+            await this.storeIssuedTokens(ProtoMap.getResponseAuthTokens(page), containerName);
+            if (afterFirstPage !== null) {
+                await afterFirstPage();
+                afterFirstPage = null;
+            }
             if (ProtoMap.hasJoinedBusinessLink(joinBusinessId, page))
                 hasJoinedLink = true;
             if (ProtoMap.hasJoinedBusiness(joinBusinessId, page))
@@ -625,36 +834,20 @@ class Model {
             // Each call after the first is signed with what the previous page reissued, since a token can
             // expire part way through a long read
             authTokens = ProtoMap.refreshAuthTokens(authTokens, ProtoMap.getResponseAuthTokens(page));
+            page = await Model.getService().profileSyncOut(request, authTokens);
         }
-        // As above: nothing the store took, nothing published
-        let response = cached;
-        if (changeCount !== 0) {
-            response = await Model.getCache().readProfile(containerName);
-            this.publishProfile(response);
-        }
-        // Checked last, so everything that arrived is cached and published before this can throw. The
-        // pages are valid even when the join is not.
+        this._profileReadAt = Date.now();
+        if (changeCount !== 0)
+            await this.publishProfileFromStore(containerName);
+        // After a sign up the User exists whatever became of the join, so what came back is kept and
+        // published before this throws
         Model.requireJoinedBusiness(joinBusinessId, hasJoinedLink, hasJoinedBusiness);
-        return response;
-    }
-    // The sign-up call. Not paged: resending it would create a second user, and a new caller has at
-    // most their User, one BusinessLink and the Business it names. It can join a business in the same
-    // call, with the same join requirements as a profile read, in one response.
-    async createProfileOnServer(request, authTokens) {
-        const response = await this.writeProfileResponse(await Model.getService().createUser(request, authTokens));
-        const joinBusinessId = request.joinBusinessId;
-        // Raised after the response is cached and published, as on a profile read. It matters more
-        // here: the User exists regardless of the join, so discarding the response and signing up
-        // again would create a second one
-        Model.requireJoinedBusiness(joinBusinessId, ProtoMap.hasJoinedBusinessLink(joinBusinessId, response), ProtoMap.hasJoinedBusiness(joinBusinessId, response));
-        return response;
     }
     // #endregion
     // #region Driving one call
     // Throws when a requested join is not answered with both the BusinessLink (the membership, whose
     // token signs calls) and the Business it names (whose businessId everything else is built from).
-    // Without both, the caller is a customer of something it cannot reach. Shared by the two calls
-    // that can carry a joinBusinessId.
+    // Without both, the caller is a customer of something it cannot reach.
     //
     // Throws a ServiceException, since the fault is the server's and not the caller's: the server
     // answered 200 and left out what was asked for. The 500 status means a retry is worthwhile.
@@ -671,35 +864,7 @@ class Model {
             : hasBusinessLink
                 ? "Business"
                 : "BusinessLink";
-        throw new InternalServerException(`A join of business ${joinBusinessId} was answered with no ${missing}`);
-    }
-    // Caches the entities of a profile response and files the tokens it reissued under the same
-    // container. Returns how much the store accepted, which decides whether anything is published.
-    // The three calls that receive a profile response (a page of a read, a sign up, an update) share
-    // this, so they cache and file tokens the same way. It does not publish: a read publishes once
-    // after all its pages, the other two once each.
-    // Only a page of a read moves the container's cursors. A sign up and an update are changes this
-    // client made and the next read brings them back, so they are stored without moving any.
-    async cacheProfileResponse(containerName, response, isPageOfRead) {
-        const cache = Model.getCache();
-        const changeCount = isPageOfRead
-            ? await cache.writeProfile(containerName, response)
-            : await cache.storeProfile(containerName, response);
-        await this.storeIssuedTokens(ProtoMap.getResponseAuthTokens(response), containerName);
-        return changeCount;
-    }
-    // Handles the response of a profile call other than a read: caches and publishes it, as for a
-    // paged read without the paging. Like a read, a sign up and an update publish only when the store
-    // accepted something. An update publishes nothing today because the server puts no entities in
-    // its response, only reissued tokens. If it ever answers with the stored User, whose update
-    // number and updated time a caller cannot know, this publishes it as the server sent it.
-    async writeProfileResponse(response) {
-        const containerName = this.getProfileContainerName();
-        if (containerName === null)
-            return response;
-        if ((await this.cacheProfileResponse(containerName, response, false)) !== 0)
-            this.publishProfile(await Model.getCache().readProfile(containerName));
-        return response;
+        throw new JoinNotAnsweredException(`A join of business ${joinBusinessId} was answered with no ${missing}`);
     }
     // Stores the tokens a call received in the container the call was about: a profile call's tokens
     // in the subject's profile container, a business call's in that business's container. The caller
@@ -765,12 +930,16 @@ class Model {
     // over every page), whatever the response carried. The store keeps a blob only when its eTag is
     // later, so it can reject a response in full (a cursor that moved without its eTag resends an
     // entity already cached). Publishing then would notify every observer of an identical value.
-    // All four calls follow this, so an update publishes nothing (see writeProfileResponse).
+    // A sign up and an update follow this too, because their answer is the first page of a profile read
+    // (see readProfilePages).
     //
     // A business with online shopping off is not published, even from the cache, or a customer could
     // be joined to it. A read that finds the published business is no longer open, or that the server
     // rejects, publishes null in its place. A business published from the cache counts as open only
     // once the read has ended (see _isPublishedBusinessVetted, which readJoinBusinessId checks).
+    static getProfileCursorsKey(cursors) {
+        return SyncKeys.PROFILE_SYNC_IN.map((key) => cursors.getUpdateNumber(key)).join(",");
+    }
     publishBusiness(response) {
         this.publish(Model.buildPublishable(response));
     }
@@ -789,6 +958,23 @@ class Model {
                 ? null
                 : ProtoMap.buildProfile(this._subjectId, response);
     }
+    // Publishes what the profile container stores, and notes the cursors it was read at, so that
+    // refreshProfileIfStale can tell whether the store has moved since.
+    async publishProfileFromStore(containerName) {
+        const cache = Model.getCache();
+        const cursorsKey = Model.getProfileCursorsKey(await cache.readProfileCursors(containerName));
+        this.publishProfile(await cache.readProfile(containerName));
+        this._publishedProfileCursors = cursorsKey;
+    }
+    // The read behind refreshProfileIfStale
+    async refreshProfile() {
+        const containerName = this.requireProfileContainerName();
+        await this.syncProfile(containerName);
+        const cursors = await Model.getCache().readProfileCursors(containerName);
+        if (Model.getProfileCursorsKey(cursors) !== this._publishedProfileCursors)
+            await this.publishProfileFromStore(containerName);
+        return true;
+    }
     // #endregion
     static getService() {
         const service = Model._service;
@@ -805,5 +991,10 @@ class Model {
 }
 Model._service = null;
 Model._cache = null;
+Model._lock = new InMemoryLock();
 Model._instance = null;
 export default Model;
+// A join the server answered with no link or business. It is a 500 like any other fault of the
+// server. requireBusinessLink catches it to read the profile again from the start.
+class JoinNotAnsweredException extends InternalServerException {
+}