gloomberb 0.13.2 → 0.14.0

package/src/api-client/research-activity.ts

@@ -1,61 +1,368 @@
 import { apiClient } from "./index";
 import { getCurrentPluginTarget } from "../plugins/current-target";
+import type { DesktopDeepLinkBridge } from "../types/desktop-deeplink";
 
-export type ResearchActivity = "workspace_opened" | "research_viewed" | "ticker_saved" | "pro_feature_used" | "upgrade_intent";
-export type ResearchFeature = "overview" | "chart" | "financials" | "news" | "transcripts" | "search" | "research";
+export type ResearchActivity =
+  | "workspace_opened"
+  | "research_viewed"
+  | "ticker_saved"
+  | "pro_feature_used"
+  | "upgrade_intent"
+  // First-run funnel, one per step reached. Keep in sync with the server's list.
+  | "onboarding_started"
+  | "onboarding_position_added"
+  | "onboarding_research_opened"
+  | "onboarding_account_viewed"
+  | "onboarding_signed_in"
+  | "onboarding_pro_viewed"
+  | "onboarding_completed"
+  | "onboarding_skipped";
+export type ResearchFeature =
+  | "overview"
+  | "chart"
+  | "financials"
+  | "news"
+  | "transcripts"
+  | "search"
+  | "research";
 const sent = new Set<string>();
 let anonymousId: string | undefined;
 let attribution: Record<string, string> = {};
 
+const ATTRIBUTION_STORAGE_KEY = "gloomberb.web.attribution";
+const ANONYMOUS_ID_STORAGE_KEY = "gloomberb.web.anonymous-id";
+const HANDOFF_ID_KEY = "_gloom";
+const ATTRIBUTION_WINDOW_MS = 30 * 24 * 60 * 60 * 1000;
+/** Another device's clock may run slightly ahead; a touch from a minute in the future is still fresh. */
+const CLOCK_SKEW_MS = 5 * 60 * 1000;
+const ANONYMOUS_ID = /^[a-f0-9-]{36}$/;
+const CAMPAIGN_KEYS = [
+  "utm_source",
+  "utm_medium",
+  "utm_campaign",
+  "utm_content",
+  "utm_term",
+  "twclid",
+] as const;
+const FIRST_TOUCH_KEYS = [
+  "first_touch_at",
+  "first_touch_landing_page",
+  "first_touch_referrer",
+  ...CAMPAIGN_KEYS.map((key) => `first_touch_${key}` as const),
+] as const;
+
+interface StorageLike {
+  getItem(key: string): string | null;
+  setItem(key: string, value: string): void;
+}
+
+function cleanValue(value: unknown, maxLength = 300): string | undefined {
+  if (typeof value !== "string") return undefined;
+  const trimmed = value.trim();
+  return trimmed ? trimmed.slice(0, maxLength) : undefined;
+}
+
+function maxLengthFor(key: string): number {
+  return key.includes("referrer") || key.includes("landing") ? 500 : key.endsWith("_at") ? 40 : 300;
+}
+
+function isFresh(at: string | undefined, now: number): boolean {
+  const age = now - Date.parse(at ?? "");
+  return Number.isFinite(age) && age >= -CLOCK_SKEW_MS && age < ATTRIBUTION_WINDOW_MS;
+}
+
+function cleanUrlValue(value: unknown): string | undefined {
+  const cleaned = cleanValue(value, 500);
+  if (!cleaned) return undefined;
+  try {
+    new URL(cleaned);
+    return cleaned;
+  } catch {
+    return undefined;
+  }
+}
+
+/** A referrer only counts when it is another site; our own pages are not a source. */
+function externalReferrer(referrer: string | undefined, href: string): string | undefined {
+  const value = cleanUrlValue(referrer);
+  if (!value) return undefined;
+  return new URL(value).origin === new URL(href).origin ? undefined : value;
+}
+
+/** `gloomberb://cloud/success` has no meaningful pathname on its own; keep the host. */
+function landingPageOf(url: URL): string {
+  return url.protocol === "http:" || url.protocol === "https:" ? url.pathname : `${url.host}${url.pathname}`;
+}
+
+/** The stored touches that are still inside their windows; nothing is invented here. */
+export function readStoredAttribution(stored: string | null, now = Date.now()): Record<string, string> {
+  let saved: Record<string, unknown> = {};
+  try {
+    const parsed: unknown = JSON.parse(stored ?? "{}");
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) saved = parsed as Record<string, unknown>;
+  } catch {
+    /* Corrupt storage is the same as no storage. */
+  }
+
+  const next: Record<string, string> = {};
+  if (isFresh(cleanValue(saved.first_touch_at, 40), now)) {
+    for (const key of FIRST_TOUCH_KEYS) {
+      const value = cleanValue(saved[key], maxLengthFor(key));
+      if (value) next[key] = value;
+    }
+  }
+  if (isFresh(cleanValue(saved.last_touch_at, 40), now)) {
+    next.last_touch_at = cleanValue(saved.last_touch_at, 40)!;
+    for (const key of CAMPAIGN_KEYS) {
+      const value = cleanValue(saved[key]);
+      if (value) next[key] = value;
+    }
+  }
+  return next;
+}
+
+/**
+ * The website forwards the first touch it recorded when it sends a visitor to
+ * term.gloom.sh or into the desktop app, so the earliest touch survives the
+ * hop. It is only trusted when it is well formed and still inside the window.
+ */
+function incomingFirstTouch(url: URL, now: number): Record<string, string> | null {
+  const at = cleanValue(url.searchParams.get("first_touch_at"), 40);
+  if (!at || !isFresh(at, now)) return null;
+  const touch: Record<string, string> = { first_touch_at: at };
+  for (const key of FIRST_TOUCH_KEYS) {
+    if (key === "first_touch_at") continue;
+    const raw = url.searchParams.get(key);
+    const value = key === "first_touch_referrer" ? cleanUrlValue(raw) : cleanValue(raw, maxLengthFor(key));
+    if (value) touch[key] = value;
+  }
+  return touch;
+}
+
+/** Whether a URL carries anything the website hands over: an id, a campaign, or a first touch. */
+export function carriesHandoff(href: string): boolean {
+  try {
+    const params = new URL(href).searchParams;
+    return (
+      params.has(HANDOFF_ID_KEY) ||
+      CAMPAIGN_KEYS.some((key) => params.has(key)) ||
+      FIRST_TOUCH_KEYS.some((key) => params.has(key))
+    );
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Merges what this page load reveals into the stored attribution. The first
+ * touch (landing page, external referrer, and any campaign on it) is written
+ * once and kept for 30 days so a signup on a later visit still knows how the
+ * visitor originally arrived; a first touch forwarded by the website wins over
+ * inventing one here. Campaign fields track the most recent click: a new
+ * campaign replaces the old click id instead of inheriting it. Both parts
+ * expire independently.
+ */
+export function resolveBrowserAttribution({
+  href,
+  now = Date.now(),
+  referrer,
+  stored,
+}: {
+  href: string;
+  now?: number;
+  referrer?: string;
+  stored: string | null;
+}): Record<string, string> {
+  const url = new URL(href);
+  const next = readStoredAttribution(stored, now);
+
+  const campaign: Partial<Record<(typeof CAMPAIGN_KEYS)[number], string>> = {};
+  for (const key of CAMPAIGN_KEYS) {
+    const value = cleanValue(url.searchParams.get(key));
+    if (value) campaign[key] = value;
+  }
+  const capturedAt = new Date(now).toISOString();
+  if (Object.keys(campaign).length > 0) {
+    for (const key of CAMPAIGN_KEYS) delete next[key];
+    next.last_touch_at = capturedAt;
+    Object.assign(next, campaign);
+  }
+
+  if (!next.first_touch_at) {
+    const forwarded = incomingFirstTouch(url, now);
+    if (forwarded) Object.assign(next, forwarded);
+  }
+  if (!next.first_touch_at) {
+    next.first_touch_at = capturedAt;
+    next.first_touch_landing_page = landingPageOf(url);
+    const source = externalReferrer(referrer, href);
+    if (source) next.first_touch_referrer = source;
+    for (const key of CAMPAIGN_KEYS) {
+      const value = campaign[key];
+      if (value) next[`first_touch_${key}`] = value;
+    }
+  }
+
+  return next;
+}
+
+function readHandoffId(url: URL): string | undefined {
+  const value = url.searchParams.get(HANDOFF_ID_KEY);
+  return value && ANONYMOUS_ID.test(value) ? value : undefined;
+}
+
+function stripHandoffParams(url: URL): void {
+  url.searchParams.delete(HANDOFF_ID_KEY);
+  for (const key of FIRST_TOUCH_KEYS) url.searchParams.delete(key);
+}
+
 /** Hosted web analytics only. Native local use never creates an identifier. */
 export function initializeBrowserResearchActivity(): void {
   try {
-    if (navigator.doNotTrack === "1" || (navigator as Navigator & { globalPrivacyControl?: boolean }).globalPrivacyControl) return;
+    if (
+      navigator.doNotTrack === "1" ||
+      (navigator as Navigator & { globalPrivacyControl?: boolean })
+        .globalPrivacyControl
+    )
+      return;
     const url = new URL(location.href);
-    const incoming = url.searchParams.get("_gloom");
-    const stored = localStorage.getItem("gloomberb.web.anonymous-id");
-    anonymousId = [incoming, stored].find((value) => value && /^[a-f0-9-]{36}$/.test(value)) ?? crypto.randomUUID();
-    localStorage.setItem("gloomberb.web.anonymous-id", anonymousId);
-    const keys = ["utm_source", "utm_medium", "utm_campaign", "utm_content", "utm_term", "twclid"];
-    const saved = JSON.parse(localStorage.getItem("gloomberb.web.attribution") ?? "{}");
-    const age = Date.now() - Date.parse(saved?.last_touch_at ?? "");
-    attribution = Number.isFinite(age) && age >= 0 && age < 30 * 24 * 60 * 60 * 1000 ? saved : {};
-    if (keys.some((key) => url.searchParams.has(key))) {
-      // A new campaign replaces the old click id instead of inheriting it.
-      attribution = { last_touch_at: new Date().toISOString() };
-      for (const key of keys) {
-        const value = url.searchParams.get(key);
-        if (value) attribution[key] = value.slice(0, 300);
-      }
-    }
-    localStorage.setItem("gloomberb.web.attribution", JSON.stringify(attribution));
-    url.searchParams.delete("_gloom");
+    const incoming = readHandoffId(url);
+    const stored = localStorage.getItem(ANONYMOUS_ID_STORAGE_KEY);
+    anonymousId =
+      [incoming, stored].find(
+        (value) => value && ANONYMOUS_ID.test(value),
+      ) ?? crypto.randomUUID();
+    localStorage.setItem(ANONYMOUS_ID_STORAGE_KEY, anonymousId);
+    attribution = resolveBrowserAttribution({
+      href: url.href,
+      referrer: document.referrer,
+      stored: localStorage.getItem(ATTRIBUTION_STORAGE_KEY),
+    });
+    localStorage.setItem(ATTRIBUTION_STORAGE_KEY, JSON.stringify(attribution));
+    stripHandoffParams(url);
     history.replaceState(history.state, "", url.href);
-  } catch { /* Private browsing must still work. */ }
+  } catch {
+    /* Private browsing must still work. */
+  }
 }
 
-/** Counts milestones once per feature/session/account, never their content. */
-export function recordResearchActivity(event: ResearchActivity, feature?: ResearchFeature): void {
+/**
+ * The desktop app never mints an identifier or invents a touch of its own. It
+ * only continues what the website handed over in a gloomberb:// link, so a
+ * visitor who read gloom.sh, installed the app, and signed up inside it is one
+ * person in analytics instead of two.
+ */
+export function initializeDesktopResearchActivity(storage: StorageLike = localStorage): void {
+  try {
+    const stored = storage.getItem(ANONYMOUS_ID_STORAGE_KEY);
+    anonymousId = stored && ANONYMOUS_ID.test(stored) ? stored : undefined;
+    attribution = readStoredAttribution(storage.getItem(ATTRIBUTION_STORAGE_KEY));
+  } catch {
+    /* A read-only profile still runs the app. */
+  }
+}
+
+export function adoptDesktopHandoff(href: string, storage: StorageLike = localStorage, now = Date.now()): boolean {
+  if (!carriesHandoff(href)) return false;
+  try {
+    const url = new URL(href);
+    const incoming = readHandoffId(url);
+    if (incoming) {
+      anonymousId = incoming;
+      storage.setItem(ANONYMOUS_ID_STORAGE_KEY, incoming);
+    }
+    attribution = resolveBrowserAttribution({
+      href,
+      now,
+      stored: storage.getItem(ATTRIBUTION_STORAGE_KEY),
+    });
+    storage.setItem(ATTRIBUTION_STORAGE_KEY, JSON.stringify(attribution));
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Wraps the deep-link bridge so every link the app receives is inspected for a
+ * website handoff before the app acts on it. Wrapping, rather than subscribing
+ * separately, matters: the bridge flushes links queued during startup to the
+ * first subscriber only, and that subscriber must stay the app.
+ */
+export function observeDesktopDeepLinks(
+  bridge: DesktopDeepLinkBridge,
+  storage: StorageLike = localStorage,
+): DesktopDeepLinkBridge {
+  return {
+    subscribe(listener) {
+      return bridge.subscribe((deeplink) => {
+        adoptDesktopHandoff(deeplink.url, storage);
+        listener(deeplink);
+      });
+    },
+  };
+}
+
+/** What the server stores against the account: stored touches plus the product marker. */
+function attributionPayload(): Record<string, string> | undefined {
+  const target = getCurrentPluginTarget();
+  if (target === "web") return { product: "gloomberb", ...attribution };
+  if (target === "desktop" && Object.keys(attribution).length > 0) return { product: "gloomberb", ...attribution };
+  return undefined;
+}
+
+/**
+ * Counts milestones once per feature/session/account, never their content.
+ * Native surfaces report anonymously only with an identifier the website
+ * handed over; they still never mint one of their own.
+ */
+export function recordResearchActivity(
+  event: ResearchActivity,
+  feature?: ResearchFeature,
+): void {
   const target = getCurrentPluginTarget();
   const user = apiClient.getCurrentUser();
-  if (target === "web" ? !anonymousId : !user) return;
+  if (!user && !anonymousId) return;
+  if (!user && target !== "web" && target !== "desktop") return;
   const key = `${user?.id ?? "guest"}:${event}:${feature ?? ""}`;
   if (sent.has(key)) return;
   sent.add(key);
   if (event !== "workspace_opened") recordResearchActivity("workspace_opened");
-  void apiClient.recordResearchActivity({ event, eventId: crypto.randomUUID(),
-    surface: target === "desktop" ? "desktop" : target,
-    anonymousId: target === "web" ? anonymousId : undefined,
-    attribution: target === "web" ? attribution : undefined, feature,
-  }).catch(() => { sent.delete(key); });
+  void apiClient
+    .recordResearchActivity({
+      event,
+      eventId: crypto.randomUUID(),
+      surface: target === "desktop" ? "desktop" : target,
+      anonymousId: target === "web" || target === "desktop" ? anonymousId : undefined,
+      attribution: attributionPayload(),
+      feature,
+    })
+    .catch(() => {
+      sent.delete(key);
+    });
+}
+
+/**
+ * Ties the visitor to the account right after sign-up or sign-in. Milestones
+ * are keyed by account, so the first one under the new user id carries the
+ * stored attribution and the anonymous id to the server; without this call a
+ * visitor who signs up and leaves is never attributed.
+ */
+export function identifyResearchUser(): void {
+  try {
+    recordResearchActivity("workspace_opened");
+  } catch {
+    /* Analytics never blocks sign-in. */
+  }
 }
 
 export function researchUpgradeUrl(returnTo?: string): string {
   const url = new URL("https://gloom.sh/cloud?upgrade=pro");
   if (returnTo) url.searchParams.set("returnTo", returnTo);
-  if (anonymousId) url.searchParams.set("_gloom", anonymousId);
+  if (anonymousId) url.searchParams.set(HANDOFF_ID_KEY, anonymousId);
   for (const [key, value] of Object.entries(attribution)) {
-    if (/^(utm_(source|medium|campaign|content|term)|twclid)$/.test(key)) url.searchParams.set(key, value);
+    if (/^(utm_(source|medium|campaign|content|term)|twclid)$/.test(key))
+      url.searchParams.set(key, value);
   }
   return url.href;
 }

package/src/api-client/session-request-lifetime.test.ts

@@ -0,0 +1,184 @@
+import { afterEach, beforeEach, expect, test } from "bun:test";
+import { apiClient, setCloudApiFetchTransport, type AuthUser } from "./index";
+import { ChatController } from "../plugins/builtin/chat/controller";
+import { MemoryPluginPersistence } from "../test-support/plugin-persistence";
+
+const pro: AuthUser = { id: "controlled", username: "Controlled", name: "Controlled", email: "test@example.invalid", emailVerified: true, plan: "pro", image: null, createdAt: "", updatedAt: "" };
+const free: AuthUser = { ...pro, emailVerified: false, plan: "free" };
+let controller: ChatController;
+function restore(user = pro, token = "current-token") {
+  apiClient.setSessionToken(token);
+  apiClient.restoreCachedUser(user);
+}
+function attach() {
+  const persistence = new MemoryPluginPersistence();
+  persistence.setState("session", { sessionToken: "current-token", user: free }, { schemaVersion: 1 });
+  controller.attachPersistence(persistence);
+}
+beforeEach(() => {
+  apiClient.dispose(); apiClient.setSessionToken(null); apiClient.setCookieSessionMode(false);
+  controller = new ChatController();
+});
+afterEach(() => {
+  controller.dispose(); apiClient.dispose(); apiClient.setSessionToken(null);
+  setCloudApiFetchTransport(null);
+});
+
+test.each(["dispose", "adopt"])("real HTTP session response cannot overwrite a newer account after controller %s", async (change) => {
+  attach();
+  const response = Promise.withResolvers<Response>();
+  let requests = 0;
+  setCloudApiFetchTransport(async () => ++requests === 1 ? response.promise : Response.json({ user: pro }));
+  const pending = controller.refreshSession();
+  if (change === "dispose") { controller.dispose(); restore(); }
+  else controller.adoptSession("current-token", pro);
+  apiClient.setWebSocketToken("current-ws");
+  response.resolve(Response.json({ user: null, token: "retired-ws" }, { headers: { "set-cookie": "gloomberb.session_token=retired-token; Path=/" } }));
+  await pending;
+  expect(apiClient.getCurrentUser()).toMatchObject(pro);
+  expect(apiClient.getSessionToken()).toBe("current-token");
+  expect(apiClient.getWebSocketToken()).toBe("current-ws");
+  expect(requests).toBe(1);
+  expect((controller as any).realtime.sessionRetryTimer).toBeNull();
+});
+
+test("a current independent caller keeps a shared session request valid after another caller retires", async () => {
+  restore();
+  let active = true;
+  let requests = 0;
+  const response = Promise.withResolvers<Response>();
+  setCloudApiFetchTransport(async () => { requests++; return response.promise; });
+  const retired = apiClient.getSession(() => active);
+  const independent = apiClient.getSession();
+  active = false;
+  response.resolve(Response.json({ user: free, token: "accepted-ws" }));
+  await Promise.all([retired, independent]);
+  expect(requests).toBe(1);
+  expect(apiClient.getCurrentUser()).toMatchObject(free);
+  expect(apiClient.getWebSocketToken()).toBe("accepted-ws");
+});
+
+test.each(["retired-callers", "api-dispose"])("old body completion cannot clear a newer single-flight request: %s", async (retire) => {
+  restore();
+  let active = true;
+  let requests = 0;
+  const readingBody = Promise.withResolvers<void>();
+  const oldBody = Promise.withResolvers<string>();
+  const newResponse = Promise.withResolvers<Response>();
+  setCloudApiFetchTransport(async () => {
+    if (++requests !== 1) return newResponse.promise;
+    return { ok: true, status: 200, headers: new Headers(), text: () => { readingBody.resolve(); return oldBody.promise; } };
+  });
+  const oldRequest = apiClient.getSession(() => active);
+  await readingBody.promise;
+  if (retire === "api-dispose") apiClient.dispose();
+  else active = false;
+  const newRequest = apiClient.getSession();
+  expect(requests).toBe(2);
+  apiClient.setWebSocketToken("current-ws");
+  oldBody.resolve(JSON.stringify({ user: null, token: "retired-ws" }));
+  await oldRequest;
+  expect(apiClient.getCurrentUser()).toMatchObject(pro);
+  expect(apiClient.getWebSocketToken()).toBe("current-ws");
+  const joined = apiClient.getSession();
+  expect(requests).toBe(2);
+  newResponse.resolve(Response.json({ user: free }));
+  await Promise.all([newRequest, joined]);
+  expect(apiClient.getCurrentUser()).toMatchObject(free);
+});
+
+test("a newer same-token cached account prevents an older independent response from committing", async () => {
+  restore(free);
+  const response = Promise.withResolvers<Response>();
+  setCloudApiFetchTransport(async () => response.promise);
+  const pending = apiClient.getSession();
+  restore();
+  response.resolve(Response.json({ user: null, token: "retired-ws" }));
+  await pending;
+  expect(apiClient.getCurrentUser()).toMatchObject(pro);
+  expect(apiClient.getWebSocketToken()).toBeNull();
+  expect(apiClient.describeAuthState().sessionChecked).toBe(false);
+});
+
+for (const status of [200, 401, 403, 503]) test(`real profile ${status} completion remains inert after controller disposal`, async () => {
+  attach();
+  const started = Promise.withResolvers<void>();
+  const profile = Promise.withResolvers<Response>();
+  setCloudApiFetchTransport(async (url) => {
+    if (new URL(url).pathname === "/auth/get-session") return Response.json({ user: null });
+    started.resolve(); return profile.promise;
+  });
+  const pending = controller.refreshSession();
+  await started.promise;
+  controller.dispose(); restore(); apiClient.setWebSocketToken("current-ws");
+  profile.resolve(Response.json(status === 200 ? { profile: free, token: "retired-ws" } : { message: "Controlled failure" }, { status, headers: { "set-cookie": "gloomberb.session_token=retired-token; Path=/" } }));
+  await pending;
+  expect(apiClient.getCurrentUser()).toMatchObject(pro);
+  expect(apiClient.getSessionToken()).toBe("current-token");
+  expect(apiClient.getWebSocketToken()).toBe("current-ws");
+  expect((controller as any).realtime.sessionRetryTimer).toBeNull();
+});
+
+test("current null, unauthorized and deleted-account responses keep their distinct session semantics", async () => {
+  restore();
+  setCloudApiFetchTransport(async () => Response.json({ user: null }));
+  await expect(apiClient.getSession()).resolves.toBeNull();
+  expect(apiClient.getCurrentUser()).toBeNull();
+  expect(apiClient.getSessionToken()).toBe("current-token");
+  restore();
+  setCloudApiFetchTransport(async () => Response.json({ message: "Unauthorized" }, { status: 401 }));
+  await expect(apiClient.getSession()).rejects.toThrow("Unauthorized");
+  expect(apiClient.getCurrentUser()).toMatchObject(pro);
+  setCloudApiFetchTransport(async () => Response.json({ code: "USER_NOT_FOUND" }, { status: 403 }));
+  await expect(apiClient.getSession()).resolves.toBeNull();
+  expect(apiClient.getSessionToken()).toBeNull();
+});
+
+for (const status of [401, 403]) test(`retired real HTTP ${status} cannot clear a current credential`, async () => {
+  restore();
+  let active = true;
+  const response = Promise.withResolvers<Response>();
+  setCloudApiFetchTransport(async () => response.promise);
+  const pending = apiClient.getSession(() => active);
+  active = false;
+  response.resolve(Response.json({ code: "USER_NOT_FOUND" }, { status }));
+  await pending;
+  expect(apiClient.getSessionToken()).toBe("current-token");
+  expect(apiClient.getCurrentUser()).toMatchObject(pro);
+});
+
+test("current cookie and socket-token rotation remains accepted and revalidates the new credential", async () => {
+  restore();
+  const cookies: Array<string | null> = [];
+  setCloudApiFetchTransport(async (_url, options) => {
+    cookies.push(new Headers(options?.headers).get("Cookie"));
+    return cookies.length === 1
+      ? Response.json({ user: pro, token: "rotated-ws" }, { headers: { "set-cookie": "gloomberb.session_token=rotated-token; Path=/" } })
+      : Response.json({ user: pro });
+  });
+  await apiClient.getSession();
+  expect(cookies).toHaveLength(2);
+  expect(cookies[1]).toContain("rotated-token");
+  expect(apiClient.getSessionToken()).toBe("rotated-token");
+  expect(apiClient.getWebSocketToken()).toBe("rotated-ws");
+  expect(apiClient.getCurrentUser()).toMatchObject(pro);
+});
+
+
+test("new-credential validation supersedes an older live request without rechecking the retired response", async () => {
+  restore(free, "old-token");
+  const response = Promise.withResolvers<Response>();
+  let requests = 0;
+  setCloudApiFetchTransport(async () => ++requests === 1 ? response.promise : Response.json({ user: pro, token: "new-ws" }));
+  const old = apiClient.getSession();
+  restore(pro, "new-token");
+  const current = apiClient.getSession();
+  expect(requests).toBe(2);
+  await current;
+  response.resolve(Response.json({ user: null, token: "old-ws" }, { headers: { "set-cookie": "gloomberb.session_token=old-token; Path=/" } }));
+  await old;
+  expect(requests).toBe(2);
+  expect(apiClient.getSessionToken()).toBe("new-token");
+  expect(apiClient.getWebSocketToken()).toBe("new-ws");
+  expect(apiClient.getCurrentUser()).toMatchObject(pro);
+});

package/src/api-client/socket-health.test.ts

@@ -10,7 +10,8 @@ function waitForStatus(
   health: ConnectionHealthRegistry,
   status: ConnectionHealthStatus,
 ): Promise<void> {
-  if (health.getSnapshot().sources[0]?.status === status) return Promise.resolve();
+  if (health.getSnapshot().sources[0]?.status === status)
+    return Promise.resolve();
   return new Promise((resolve, reject) => {
     const timer = setTimeout(() => {
       unsubscribe();
@@ -32,7 +33,9 @@ describe("CloudApiSocket connection health", () => {
       hostname: "127.0.0.1",
       port: 0,
       fetch(request, server) {
-        return server.upgrade(request) ? undefined : new Response("Upgrade required", { status: 426 });
+        return server.upgrade(request)
+          ? undefined
+          : new Response("Upgrade required", { status: 426 });
       },
       websocket: {
         open(socket) {
@@ -47,16 +50,19 @@ describe("CloudApiSocket connection health", () => {
       name: "Gloom Cloud Stream",
       kind: "websocket",
     });
-    const socket = new CloudApiSocket({
-      getBaseUrl: () => `http://127.0.0.1:${server.port}`,
-      getSocketAuthToken: () => null,
-      hasSessionCredential: () => false,
-      hasVerifiedUser: () => false,
-      isUsingWebSocketToken: () => false,
-      clearWebSocketTokenForFallback: () => false,
-      markCurrentUserUnverified: () => {},
-      updateCurrentUserFromSocket: () => {},
-    }, health);
+    const socket = new CloudApiSocket(
+      {
+        getBaseUrl: () => `http://127.0.0.1:${server.port}`,
+        getSocketAuthToken: () => null,
+        hasSessionCredential: () => false,
+        hasVerifiedUser: () => false,
+        isUsingWebSocketToken: () => false,
+        clearWebSocketTokenForFallback: () => false,
+        markCurrentUserUnverified: () => {},
+        updateCurrentUserFromSocket: () => {},
+      },
+      health,
+    );
 
     try {
       socket.subscribeQuotes([{ symbol: "AAPL" }], () => {});