convex 1.42.0 → 1.42.1

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "convex",
   "description": "Client for the Convex Cloud",
-  "version": "1.42.0",
+  "version": "1.42.1",
   "author": "Convex, Inc. <no-reply@convex.dev>",
   "homepage": "https://convex.dev",
   "repository": {

package/src/browser/sync/authentication_manager.ts

@@ -36,16 +36,19 @@ type AuthConfig = {
 };
 
 /**
- * In general we take 3 steps:
- *   1. Fetch a possibly cached token
+ * By default we take 3 steps:
+ *   1. Fetch a possibly cached token and send it to the server
  *   2. Immediately fetch a fresh token without using a cache
  *   3. Repeat step 2 before the end of the fresh token's lifetime
  *
- * When we fetch without using a cache we know when the token
- * will expire, and can schedule refetching it.
+ * When `initialAuthTokenReuse` is enabled, step 2 is skipped: the
+ * cached token is reused and a refetch is scheduled based on its
+ * remaining lifetime (estimated via the server's clock skew). This
+ * avoids a second Authenticate message that would cause the server
+ * to re-execute all authenticated queries.
  *
- * If we get an error before a scheduled refetch, we go back
- * to step 2.
+ * If the server rejects a token before a scheduled refetch, we
+ * immediately fetch a fresh token and retry.
  */
 type AuthState =
   | { state: "noAuth" }
@@ -97,6 +100,7 @@ export class AuthenticationManager {
   private readonly clearAuth: () => void;
   private readonly logger: Logger;
   private readonly refreshTokenLeewaySeconds: number;
+  private readonly initialAuthTokenReuse: boolean;
   // Track last value to avoid redundant calls
   private lastRefreshChange: boolean;
   // Number of times we have attempted to confirm the latest token. We retry up
@@ -115,6 +119,7 @@ export class AuthenticationManager {
     config: {
       refreshTokenLeewaySeconds: number;
       logger: Logger;
+      initialAuthTokenReuse: boolean;
     },
   ) {
     this.syncState = syncState;
@@ -126,6 +131,7 @@ export class AuthenticationManager {
     this.clearAuth = callbacks.clearAuth;
     this.logger = config.logger;
     this.refreshTokenLeewaySeconds = config.refreshTokenLeewaySeconds;
+    this.initialAuthTokenReuse = config.initialAuthTokenReuse;
     this.lastRefreshChange = false;
   }
 
@@ -206,7 +212,12 @@ export class AuthenticationManager {
 
     if (this.authState.state === "waitingForServerConfirmationOfCachedToken") {
       this._logVerbose("server confirmed auth token is valid");
-      void this.refetchToken();
+      const cachedToken = this.syncState.getAuth()?.value;
+      if (this.initialAuthTokenReuse && cachedToken) {
+        this.scheduleTokenRefetch(cachedToken, serverMessage.clientClockSkew);
+      } else {
+        void this.refetchToken();
+      }
       this.authState.config.onAuthChange(true);
       return;
     }
@@ -361,7 +372,7 @@ export class AuthenticationManager {
     this.tryRestartSocket();
   }
 
-  private scheduleTokenRefetch(token: string) {
+  private scheduleTokenRefetch(token: string, clientClockSkewMs?: number) {
     if (this.authState.state === "noAuth") {
       return;
     }
@@ -384,17 +395,34 @@ export class AuthenticationManager {
       );
       return;
     }
-    // Because the client and server clocks may be out of sync,
-    // we only know that the token will expire after `exp - iat`,
-    // and since we just fetched a fresh one we know when that
-    // will happen.
-    const tokenValiditySeconds = exp - iat;
-    if (tokenValiditySeconds <= 2) {
+    const fullLifetimeSeconds = exp - iat;
+    if (fullLifetimeSeconds <= 2) {
       this.logger.error(
         "Auth token does not live long enough, cannot refetch the token",
       );
       return;
     }
+    let tokenValiditySeconds: number;
+    if (clientClockSkewMs !== undefined) {
+      // For cached tokens we use the server's clock skew estimate to
+      // compute remaining lifetime. The server computes
+      // clientClockSkew = clientTs - serverReceiveTs, so it's positive
+      // when the client is ahead and negative when behind. To recover
+      // server time: serverNow = Date.now() - clientClockSkew.
+      // Both Date.now() and setTimeout use the same client clock, so
+      // the scheduled delay is accurate regardless of absolute offset.
+      // Connect latency inflates the skew toward "client behind," which
+      // is conservative — we schedule the refetch slightly early.
+      const estimatedServerNowSeconds = (Date.now() - clientClockSkewMs) / 1000;
+      tokenValiditySeconds = exp - estimatedServerNowSeconds;
+      if (tokenValiditySeconds <= 0) {
+        tokenValiditySeconds = 0;
+      }
+    } else {
+      // For freshly-fetched tokens, `exp - iat` is the full lifetime
+      // starting from now.
+      tokenValiditySeconds = fullLifetimeSeconds;
+    }
     // Attempt to refresh the token `refreshTokenLeewaySeconds` before it expires,
     // or immediately if the token is already expiring soon.
     let delay = Math.min(

package/src/browser/sync/client.ts

@@ -137,6 +137,22 @@ export interface BaseConvexClientOptions {
    * Defaults to false, not waiting for an auth token.
    */
   expectAuth?: boolean;
+  /**
+   * This API is experimental: it may change or disappear.
+   *
+   * When true, the client reuses the initial cached auth token instead
+   * of immediately fetching a fresh one. This avoids a second
+   * Authenticate message that causes the server to re-execute all
+   * authenticated queries.
+   *
+   * The cached token's remaining lifetime is estimated using the
+   * server's clock skew measurement, and a refresh is scheduled
+   * before it expires.
+   *
+   * Defaults to false, preserving the original behavior of immediately
+   * fetching a fresh token after the cached token is confirmed.
+   */
+  initialAuthTokenReuse?: boolean;
 }
 
 /**
@@ -358,6 +374,7 @@ export class BaseConvexClient {
       {
         logger: this.logger,
         refreshTokenLeewaySeconds: authRefreshTokenLeewaySeconds,
+        initialAuthTokenReuse: options.initialAuthTokenReuse ?? false,
       },
     );
     this.optimisticQueryResults = new OptimisticQueryResults();

package/src/cli/lib/typecheck.ts

@@ -139,18 +139,34 @@ async function runTsc(
   tscArgs: string[],
   handleResult: TypecheckResultHandler,
 ): Promise<void> {
-  // Check if tsc is even installed
-  const tscPath =
-    typescriptCompiler === "tsgo"
-      ? path.join(
+  // Check if the TypeScript compiler is even installed
+  let compilerPath: string | undefined;
+  switch (typescriptCompiler) {
+    case "tsgo": {
+      // @typescript/native-preview@7.0.0-dev.20260626.1 switched to using `bin/tsgo` instead of `bin/tsgo.js`.
+      const tsgoPaths = ["tsgo", "tsgo.js"].map((filename) =>
+        path.join(
           "node_modules",
           "@typescript",
           "native-preview",
           "bin",
-          "tsgo.js",
-        )
-      : path.join("node_modules", "typescript", "bin", "tsc");
-  if (!ctx.fs.exists(tscPath)) {
+          filename,
+        ),
+      );
+      compilerPath = tsgoPaths.find((path) => ctx.fs.exists(path));
+      break;
+    }
+    case "tsc": {
+      const tscPath = path.join("node_modules", "typescript", "bin", "tsc");
+      if (ctx.fs.exists(tscPath)) {
+        compilerPath = tscPath;
+      }
+      break;
+    }
+    default:
+      typescriptCompiler satisfies never;
+  }
+  if (!compilerPath) {
     return handleResult("cantTypeCheck", () => {
       logError(
         chalkStderr.gray(
@@ -162,14 +178,14 @@ async function runTsc(
 
   // Check the TypeScript version matches the recommendation from Convex
   const versionResult = await spawnAsync(ctx, process.execPath, [
-    tscPath,
+    compilerPath,
     "--version",
   ]);
 
   const version = versionResult.stdout.match(/Version (.*)/)?.[1] ?? null;
   const hasOlderTypeScriptVersion = version && semver.lt(version, "4.8.4");
 
-  await runTscInner(ctx, tscPath, tscArgs, handleResult);
+  await runTscInner(ctx, compilerPath, tscArgs, handleResult);
 
   // Print this warning after any logs from running `tsc`
   if (hasOlderTypeScriptVersion) {

package/src/index.ts

@@ -1 +1 @@
-export const version = "1.42.0";
+export const version = "1.42.1";

package/src/react/ConvexAuthState.test.tsx

@@ -198,6 +198,7 @@ test("Tokens are used to schedule refetch", async () => {
 function mockServerConfirmsAuth(
   client: ConvexReactClient,
   oldIdentityVersion: number,
+  clientClockSkew?: number,
 ) {
   act(() => {
     const querySetVersion = client.sync["remoteQuerySet"]["version"];
@@ -212,6 +213,7 @@ function mockServerConfirmsAuth(
         identity: oldIdentityVersion + 1,
       },
       modifications: [],
+      ...(clientClockSkew !== undefined ? { clientClockSkew } : {}),
     });
   });
 }
@@ -539,3 +541,146 @@ test("stop() during reauth notifies isRefreshing false", async () => {
 
   expect(onRefreshChange).toHaveBeenCalledWith(false);
 });
+
+// --- initialAuthTokenReuse tests ---
+// When enabled, the cached token is reused after server confirmation
+// (no immediate fresh-token fetch), and the refetch is scheduled using
+// the server's clientClockSkew to estimate remaining lifetime.
+// The server computes clientClockSkew = clientTs - serverReceiveTs:
+// negative means client behind, positive means ahead. Connect latency
+// makes the skew more negative (conservative).
+
+test("initialAuthTokenReuse: sends only one Authenticate", async () => {
+  const client = new ConvexReactClient("https://127.0.0.1:3001", {
+    initialAuthTokenReuse: true,
+  });
+  const tokenLifetimeSeconds = 60;
+  let tokenId = 0;
+  const tokenFetcher = vi.fn(async () =>
+    jwtEncode(
+      { iat: 1234500, exp: 1234500 + tokenLifetimeSeconds },
+      "secret" + tokenId++,
+    ),
+  );
+
+  const sendMessageSpy = vi.spyOn(
+    client.sync["webSocketManager"],
+    "sendMessage",
+  );
+
+  const onAuthChange = vi.fn();
+  void client.setAuth(tokenFetcher, onAuthChange);
+
+  await flushPromises();
+  mockServerConfirmsAuth(client, 0);
+  await flushPromises();
+
+  expect(onAuthChange).toHaveBeenCalledWith(true);
+
+  const authenticateMessages = sendMessageSpy.mock.calls.filter(
+    ([msg]) => msg.type === "Authenticate",
+  );
+  expect(authenticateMessages).toHaveLength(1);
+
+  await client.close();
+});
+
+test("initialAuthTokenReuse: clock skew adjusts schedule for partially-expired token", async () => {
+  const client = new ConvexReactClient("https://127.0.0.1:3001", {
+    initialAuthTokenReuse: true,
+  });
+  const defaultLeewaySeconds = 10;
+  const tokenLifetimeSeconds = 60;
+  const tokenAgeOnServer = 30;
+  const clientClockSkewMs = 0;
+  const clientNow = Date.now() / 1000;
+  const serverNow = clientNow;
+  const tokenFetcher = vi.fn(async () =>
+    jwtEncode(
+      {
+        iat: serverNow - tokenAgeOnServer,
+        exp: serverNow - tokenAgeOnServer + tokenLifetimeSeconds,
+      },
+      "secret",
+    ),
+  );
+  void client.setAuth(tokenFetcher, () => {});
+
+  await flushPromises();
+  mockServerConfirmsAuth(client, 0, clientClockSkewMs);
+
+  expect(tokenFetcher).toHaveBeenCalledTimes(1);
+
+  const expectedDelay =
+    (tokenLifetimeSeconds - tokenAgeOnServer - defaultLeewaySeconds) * 1000;
+
+  vi.advanceTimersByTime(expectedDelay - 1);
+  expect(tokenFetcher).toHaveBeenCalledTimes(1);
+
+  vi.advanceTimersByTime(1);
+  expect(tokenFetcher).toHaveBeenCalledTimes(2);
+});
+
+test("initialAuthTokenReuse: clock skew triggers immediate refetch for nearly-expired token", async () => {
+  const client = new ConvexReactClient("https://127.0.0.1:3001", {
+    initialAuthTokenReuse: true,
+  });
+  const tokenLifetimeSeconds = 60;
+  const clientClockSkewMs = -50_000;
+  const clientNow = Date.now() / 1000;
+  const serverNow = clientNow - clientClockSkewMs / 1000;
+  const tokenFetcher = vi.fn(async () =>
+    jwtEncode(
+      {
+        iat: serverNow - 55,
+        exp: serverNow - 55 + tokenLifetimeSeconds,
+      },
+      "secret",
+    ),
+  );
+  void client.setAuth(tokenFetcher, () => {});
+
+  await flushPromises();
+  mockServerConfirmsAuth(client, 0, clientClockSkewMs);
+
+  expect(tokenFetcher).toHaveBeenCalledTimes(1);
+
+  vi.advanceTimersByTime(1);
+  expect(tokenFetcher).toHaveBeenCalledTimes(2);
+});
+
+test("initialAuthTokenReuse: clock skew corrects for client clock behind server", async () => {
+  const client = new ConvexReactClient("https://127.0.0.1:3001", {
+    initialAuthTokenReuse: true,
+  });
+  const defaultLeewaySeconds = 10;
+  const tokenLifetimeSeconds = 60;
+  const tokenAgeOnServer = 30;
+  const clientClockSkewMs = -20_000;
+  const clientNow = Date.now() / 1000;
+  const serverNow = clientNow - clientClockSkewMs / 1000;
+  const tokenFetcher = vi.fn(async () =>
+    jwtEncode(
+      {
+        iat: serverNow - tokenAgeOnServer,
+        exp: serverNow - tokenAgeOnServer + tokenLifetimeSeconds,
+      },
+      "secret",
+    ),
+  );
+  void client.setAuth(tokenFetcher, () => {});
+
+  await flushPromises();
+  mockServerConfirmsAuth(client, 0, clientClockSkewMs);
+
+  expect(tokenFetcher).toHaveBeenCalledTimes(1);
+
+  const expectedDelay =
+    (tokenLifetimeSeconds - tokenAgeOnServer - defaultLeewaySeconds) * 1000;
+
+  vi.advanceTimersByTime(expectedDelay - 1);
+  expect(tokenFetcher).toHaveBeenCalledTimes(1);
+
+  vi.advanceTimersByTime(1);
+  expect(tokenFetcher).toHaveBeenCalledTimes(2);
+});

package/src/server/impl/registration_impl.ts

@@ -500,7 +500,6 @@ export const internalQueryGeneric: QueryBuilder<any, "internal"> = ((
 async function invokeAction<
   F extends (ctx: GenericActionCtx<GenericDataModel>, ...args: any) => any,
 >(func: F, requestId: string, argsStr: string, visibility: FunctionVisibility) {
-  (globalThis as any).Convex?.setupPerformance?.();
   const args = jsonToConvex(JSON.parse(argsStr));
   const calls = setupActionCalls(requestId);
   const ctx = {
@@ -682,7 +681,6 @@ export const internalActionGeneric: ActionBuilder<any, "internal"> = ((
 async function invokeHttpAction<
   F extends (ctx: GenericActionCtx<GenericDataModel>, request: Request) => any,
 >(func: F, request: Request) {
-  (globalThis as any).Convex?.setupPerformance?.();
   // TODO(presley): Change the function signature and propagate the requestId from Rust.
   // Ok, to mock it out for now, since http endpoints are only running in V8.
   const requestId = "";