@zeniai/client-epic-state 5.0.33 → 5.0.34-betaRD1

package/lib/esm/init.js

@@ -23,14 +23,19 @@ export default function initialize(restEndPoints, userId, sessionId, tenantId, i
     return store;
 }
 let isPusherInitialized = false;
+// Caches an in-flight initializePusher() promise so that concurrent callers
+// share a single Pusher instance instead of each constructing their own and
+// leaking WebSocket connections (see Bugbot review on PR #2983). Cleared in
+// the IIFE's `finally` once construction settles.
+let pusherInitPromise;
 /**
  * Call initializePusher before using pusher in web-app
  */
-export function initializePusher(pusherClientSecret, options, headers, reInitialize = false) {
+export async function initializePusher(pusherClientSecret, options, headers, reInitialize = false) {
     // Pusher subscribes/decrypts only make sense in the browser. `pusher-js/
     // with-encryption` resolves to a browser-only bundle that references
-    // `window` at module init, so even *requiring* it on the server crashes.
-    // Bail out early on SSR/Node so loading this module never triggers that.
+    // `window` at module init, so even *importing* it on the server crashes.
+    // Bail out early on SSR/Node so the dynamic import below never executes.
     if (typeof window === 'undefined') {
         console.warn(`initializePusher called on server-side; pusher-js/with-encryption is browser-only — skipping.`);
         return undefined;
@@ -45,27 +50,59 @@ export function initializePusher(pusherClientSecret, options, headers, reInitial
         console.warn(`Already initialized pusher`);
         return pusher;
     }
-    // Lazy-require so the browser-only bundle is loaded only when this function
-    // actually runs (browser path). The pusher-js UMD wrapper does
-    // `module.exports = factory()` for CJS, so the require result is the
-    // Pusher class directly. Some bundlers wrap CJS in `{ default: ... }` for
-    // ESM interop — fall back to the module itself when `.default` is absent.
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const pusherModule = require('pusher-js/with-encryption');
-    const PusherConstructor = 'default' in pusherModule ? pusherModule.default : pusherModule;
-    const endpoint = `${zeniAPI.apiEndPoints.tenantMicroServiceBaseUrl}/1.0/notifications/push_notification/auth`;
-    pusher = new PusherConstructor(pusherClientSecret, {
-        ...options,
-        channelAuthorization: {
-            endpoint,
-            transport: 'ajax',
-            customHandler: (params, callback) => customHandler(params, headers, callback),
-        },
-    }).bind('error', function (err) {
-        console.warn('Pusher error', err);
-    });
-    console.info(`initializing with ${JSON.stringify(options)}`);
-    return pusher;
+    // De-dupe concurrent in-flight calls so we don't construct multiple Pusher
+    // instances (each one a live WebSocket) and leak the older ones. We don't
+    // de-dupe when reInitialize=true — that's the caller asking for a fresh
+    // instance, which is the existing contract.
+    if (pusherInitPromise && !reInitialize) {
+        return pusherInitPromise;
+    }
+    // The IIFE captures `currentInit` so that, when its `finally` runs, it can
+    // identity-check before clearing the module-level `pusherInitPromise`. This
+    // matters when a reInitialize=true call overwrites `pusherInitPromise`
+    // while we're still in flight: without the identity check, our finally
+    // would clobber the newer call's slot and the next concurrent caller
+    // would bypass the dedup guard. Capture is safe because the first action
+    // inside the try is `await import(...)`, which always yields control —
+    // so the finally runs in a future microtask, after `currentInit` has
+    // already been assigned below. We declare it as `let … | undefined` so
+    // TS's definite-assignment analysis (which doesn't model the await) accepts
+    // the closure read; at runtime it's always the IIFE promise by then.
+    let currentInit = undefined;
+    currentInit = (async () => {
+        try {
+            // Dynamic import so the browser-only bundle is loaded only when this
+            // function actually runs (browser path). Works in both build outputs:
+            //   • ESM (lib/esm): preserved as native `import()` → Vite/Rollup code-split
+            //   • CJS (lib): TypeScript lowers to `Promise.resolve().then(() => require(...))`
+            // The pusher-js UMD wrapper does `module.exports = factory()` for CJS,
+            // so the module result is the Pusher class directly. Some bundlers wrap
+            // CJS in `{ default: ... }` for ESM interop — fall back to the module
+            // itself when `.default` is absent.
+            const pusherModule = (await import('pusher-js/with-encryption'));
+            const PusherConstructor = 'default' in pusherModule ? pusherModule.default : pusherModule;
+            const endpoint = `${zeniAPI.apiEndPoints.tenantMicroServiceBaseUrl}/1.0/notifications/push_notification/auth`;
+            pusher = new PusherConstructor(pusherClientSecret, {
+                ...options,
+                channelAuthorization: {
+                    endpoint,
+                    transport: 'ajax',
+                    customHandler: (params, callback) => customHandler(params, headers, callback),
+                },
+            }).bind('error', function (err) {
+                console.warn('Pusher error', err);
+            });
+            console.info(`initializing with ${JSON.stringify(options)}`);
+            return pusher;
+        }
+        finally {
+            if (pusherInitPromise === currentInit) {
+                pusherInitPromise = undefined;
+            }
+        }
+    })();
+    pusherInitPromise = currentInit;
+    return currentInit;
 }
 const customHandler = async (params, headers, callback) => {
     const { socketId, channelName } = params;

package/lib/esm/view/zeniOAuthView/epics/approveOAuthConsentEpic.js

@@ -1,5 +1,5 @@
 import { from, of } from 'rxjs';
-import { catchError, concatMap, filter, mergeMap, switchMap, } from 'rxjs/operators';
+import { catchError, concatMap, exhaustMap, filter, mergeMap, } from 'rxjs/operators';
 import { openSnackbar } from '../../../entity/snackbar/snackbarReducer';
 import { createZeniAPIStatus } from '../../../responsePayload';
 import { approveOAuthConsent, approveOAuthConsentFailure, approveOAuthConsentSuccess, } from '../zeniOAuthReducer';
@@ -9,10 +9,11 @@ const failureSnackbar = (reason) => openSnackbar({
     type: 'error',
     variables: [{ variableName: '__reason__', variableValue: reason }],
 });
-export const approveOAuthConsentEpic = (actions$, state$, zeniAPI) => actions$.pipe(filter(approveOAuthConsent.match), switchMap((action) => {
-    if (state$.value.zeniOAuthViewState.fetchState === 'In-Progress') {
-        return from([]);
-    }
+export const approveOAuthConsentEpic = (actions$, _state$, zeniAPI) => actions$.pipe(filter(approveOAuthConsent.match), 
+// `approveOAuthConsent` reducer sets fetchState to In-Progress before epics
+// run, so a guard on In-Progress would block every legitimate request.
+// exhaustMap drops duplicate approve clicks while the HTTP call is in flight.
+exhaustMap((action) => {
     const { userId, zeniSessionId, tenantId, clientId, redirectUri, codeChallenge, codeChallengeMethod, state, responseType, } = action.payload;
     const authHeaders = {
         'zeni-user-id': userId,

package/lib/init.d.ts

@@ -26,7 +26,7 @@ export declare function initializePusher(pusherClientSecret: ID, options: Option
     sessionId: ID;
     tenantId: ID;
     userId: ID;
-}, reInitialize?: boolean): Pusher | undefined;
+}, reInitialize?: boolean): Promise<Pusher | undefined>;
 export declare function disconnectPusher(): void;
 export { pusher };
 export { injectFeatureModules, injectFeatureEpics } from './configureStore';

package/lib/init.js

@@ -67,14 +67,19 @@ function initialize(restEndPoints, userId, sessionId, tenantId, isSandboxEnv, on
     return exports.store;
 }
 let isPusherInitialized = false;
+// Caches an in-flight initializePusher() promise so that concurrent callers
+// share a single Pusher instance instead of each constructing their own and
+// leaking WebSocket connections (see Bugbot review on PR #2983). Cleared in
+// the IIFE's `finally` once construction settles.
+let pusherInitPromise;
 /**
  * Call initializePusher before using pusher in web-app
  */
-function initializePusher(pusherClientSecret, options, headers, reInitialize = false) {
+async function initializePusher(pusherClientSecret, options, headers, reInitialize = false) {
     // Pusher subscribes/decrypts only make sense in the browser. `pusher-js/
     // with-encryption` resolves to a browser-only bundle that references
-    // `window` at module init, so even *requiring* it on the server crashes.
-    // Bail out early on SSR/Node so loading this module never triggers that.
+    // `window` at module init, so even *importing* it on the server crashes.
+    // Bail out early on SSR/Node so the dynamic import below never executes.
     if (typeof window === 'undefined') {
         console.warn(`initializePusher called on server-side; pusher-js/with-encryption is browser-only — skipping.`);
         return undefined;
@@ -89,27 +94,59 @@ function initializePusher(pusherClientSecret, options, headers, reInitialize = f
         console.warn(`Already initialized pusher`);
         return pusher;
     }
-    // Lazy-require so the browser-only bundle is loaded only when this function
-    // actually runs (browser path). The pusher-js UMD wrapper does
-    // `module.exports = factory()` for CJS, so the require result is the
-    // Pusher class directly. Some bundlers wrap CJS in `{ default: ... }` for
-    // ESM interop — fall back to the module itself when `.default` is absent.
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const pusherModule = require('pusher-js/with-encryption');
-    const PusherConstructor = 'default' in pusherModule ? pusherModule.default : pusherModule;
-    const endpoint = `${exports.zeniAPI.apiEndPoints.tenantMicroServiceBaseUrl}/1.0/notifications/push_notification/auth`;
-    exports.pusher = pusher = new PusherConstructor(pusherClientSecret, {
-        ...options,
-        channelAuthorization: {
-            endpoint,
-            transport: 'ajax',
-            customHandler: (params, callback) => customHandler(params, headers, callback),
-        },
-    }).bind('error', function (err) {
-        console.warn('Pusher error', err);
-    });
-    console.info(`initializing with ${JSON.stringify(options)}`);
-    return pusher;
+    // De-dupe concurrent in-flight calls so we don't construct multiple Pusher
+    // instances (each one a live WebSocket) and leak the older ones. We don't
+    // de-dupe when reInitialize=true — that's the caller asking for a fresh
+    // instance, which is the existing contract.
+    if (pusherInitPromise && !reInitialize) {
+        return pusherInitPromise;
+    }
+    // The IIFE captures `currentInit` so that, when its `finally` runs, it can
+    // identity-check before clearing the module-level `pusherInitPromise`. This
+    // matters when a reInitialize=true call overwrites `pusherInitPromise`
+    // while we're still in flight: without the identity check, our finally
+    // would clobber the newer call's slot and the next concurrent caller
+    // would bypass the dedup guard. Capture is safe because the first action
+    // inside the try is `await import(...)`, which always yields control —
+    // so the finally runs in a future microtask, after `currentInit` has
+    // already been assigned below. We declare it as `let … | undefined` so
+    // TS's definite-assignment analysis (which doesn't model the await) accepts
+    // the closure read; at runtime it's always the IIFE promise by then.
+    let currentInit = undefined;
+    currentInit = (async () => {
+        try {
+            // Dynamic import so the browser-only bundle is loaded only when this
+            // function actually runs (browser path). Works in both build outputs:
+            //   • ESM (lib/esm): preserved as native `import()` → Vite/Rollup code-split
+            //   • CJS (lib): TypeScript lowers to `Promise.resolve().then(() => require(...))`
+            // The pusher-js UMD wrapper does `module.exports = factory()` for CJS,
+            // so the module result is the Pusher class directly. Some bundlers wrap
+            // CJS in `{ default: ... }` for ESM interop — fall back to the module
+            // itself when `.default` is absent.
+            const pusherModule = (await Promise.resolve().then(() => __importStar(require('pusher-js/with-encryption'))));
+            const PusherConstructor = 'default' in pusherModule ? pusherModule.default : pusherModule;
+            const endpoint = `${exports.zeniAPI.apiEndPoints.tenantMicroServiceBaseUrl}/1.0/notifications/push_notification/auth`;
+            exports.pusher = pusher = new PusherConstructor(pusherClientSecret, {
+                ...options,
+                channelAuthorization: {
+                    endpoint,
+                    transport: 'ajax',
+                    customHandler: (params, callback) => customHandler(params, headers, callback),
+                },
+            }).bind('error', function (err) {
+                console.warn('Pusher error', err);
+            });
+            console.info(`initializing with ${JSON.stringify(options)}`);
+            return pusher;
+        }
+        finally {
+            if (pusherInitPromise === currentInit) {
+                pusherInitPromise = undefined;
+            }
+        }
+    })();
+    pusherInitPromise = currentInit;
+    return currentInit;
 }
 const customHandler = async (params, headers, callback) => {
     const { socketId, channelName } = params;