@replit/river 0.23.14 → 0.23.16

package/dist/transport/index.cjs

@@ -252,7 +252,7 @@ var import_nanoid2 = require("nanoid");
 var import_api = require("@opentelemetry/api");
 
 // package.json
-var version = "0.23.14";
+var version = "0.23.16";
 
 // tracing/index.ts
 function getPropagationContext(ctx) {
@@ -572,6 +572,18 @@ var Session = class {
   get nextExpectedSeq() {
     return this.ack;
   }
+  /**
+   * Check that the peer's next expected seq number matches something that is in our send buffer
+   * _or_ matches our actual next seq.
+   */
+  nextExpectedSeqInRange(nextExpectedSeq) {
+    for (const msg of this.sendBuffer) {
+      if (nextExpectedSeq === msg.seq) {
+        return true;
+      }
+    }
+    return nextExpectedSeq === this.seq;
+  }
   // This is only used in tests to make the session misbehave.
   /* @internal */
   advanceAckForTesting(by) {
@@ -756,6 +768,20 @@ var Transport = class {
     if (this.log) {
       session.bindLogger(this.log);
     }
+    const currentSession = this.sessions.get(session.to);
+    if (currentSession) {
+      this.log?.warn(
+        `session ${session.id} from ${session.to} surreptitiously replacing ${currentSession.id}`,
+        {
+          ...currentSession.loggingMetadata,
+          tags: ["invariant-violation"]
+        }
+      );
+      this.deleteSession({
+        session: currentSession,
+        closeHandshakingConnection: false
+      });
+    }
     this.sessions.set(session.to, session);
     this.eventDispatcher.dispatchEvent("sessionStatus", {
       status: "connect",
@@ -795,7 +821,7 @@ var Transport = class {
     if (
       // reject this request if there was no previous session to replace
       session === void 0 || // or if both parties do not agree about the next expected sequence number
-      session.nextExpectedAck < nextExpectedSeq || // or if both parties do not agree on the advertised session id
+      !session.nextExpectedSeqInRange(nextExpectedSeq) || // or if both parties do not agree on the advertised session id
       session.advertisedSessionId !== sessionId
     ) {
       return false;
@@ -854,6 +880,17 @@ var Transport = class {
     }
     session.close();
     session.telemetry.span.end();
+    const currentSession = this.sessions.get(session.to);
+    if (currentSession && currentSession.id !== session.id) {
+      this.log?.warn(
+        `session ${session.id} disconnect from ${session.to}, mismatch with ${currentSession.id}`,
+        {
+          ...session.loggingMetadata,
+          tags: ["invariant-violation"]
+        }
+      );
+      return;
+    }
     this.sessions.delete(session.to);
     this.log?.info(
       `session ${session.id} disconnect from ${session.to}`,