pryv 3.12.0 → 3.12.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pryv",
-  "version": "3.12.0",
+  "version": "3.12.1",
   "description": "Pryv JavaScript library",
   "keywords": [
     "Pryv",

package/src/Auth/AuthController.js

@@ -253,11 +253,12 @@ class AuthController {
     this._state = newState;
 
     // Dispatch the state that was just set (`newState`), NOT the live `this.state`
-    // getter: a listener that synchronously changes the state mid-dispatch (e.g.
-    // the LoginButton's logout confirm re-initializing to INITIALIZED) would
-    // otherwise overwrite `this._state`, so later listeners in this loop would
-    // receive the wrong state (a logout would deliver INITIALIZED instead of
-    // SIGNOUT to the app's onStateChange).
+    // getter: a listener that synchronously changes the state mid-dispatch (e.g. a
+    // custom listener re-initializing to INITIALIZED on SIGNOUT; the LoginButton's
+    // own re-init now starts a microtask later) would otherwise overwrite
+    // `this._state`, so later listeners in this loop would receive the wrong state
+    // (a logout would deliver INITIALIZED instead of SIGNOUT to the app's
+    // onStateChange).
     this.stateChangeListeners.forEach((listener) => {
       try {
         listener(newState);

package/src/Browser/LoginButton.js

@@ -74,8 +74,11 @@ class LoginButton {
       case AuthStates.SIGNOUT: {
         const message = this.messages.SIGNOUT_CONFIRM ? this.messages.SIGNOUT_CONFIRM : 'Logout ?';
         if (confirm(message)) {
-          this.deleteAuthorizationData();
-          this.auth.init();
+          // Awaited: a re-init left running in the background resumes later
+          // (after loading assets) and consumes whatever poll URL the page shows
+          // by then, racing any other sign-in in progress.
+          await this.deleteAuthorizationData();
+          await this.auth.init();
         }
         break;
       }

package/src/Service.js

@@ -573,8 +573,12 @@ class Service {
    * apiEndpoint), and uses this method to build a working `Connection`.
    *
    * The implementation polls `<access>/<key>` once; the call MUST be
-   * made while the access is still in the ACCEPTED state (which
-   * persists until expiry — see `expireAfter` on the access request).
+   * made while the access request is still readable in the ACCEPTED
+   * state. Servers keep a decided request only for a short retention
+   * window after it is first polled (default 2 minutes, operator setting
+   * `access.terminalRetentionMs`), so call this promptly after the flow
+   * completes; afterwards the key is unknown. (`expireAfter` on the
+   * access request is the lifetime of the access created, not of the key.)
    *
    * @param {string} key - polling key from `startAccessRequest`
    * @returns {Promise<Connection>}

package/test/Browser.AuthController.test.js

@@ -112,9 +112,10 @@ describe('[AUTX] Browser.LoginButton', function () {
       const seen = [];
       const a = makeAuth((s) => seen.push(s.status));
       await a.init();
-      // Mimic LoginButton (registered after the external app listener): on
-      // SIGNOUT it confirms + re-initializes, synchronously driving the state
-      // to INITIALIZED during the same dispatch.
+      // Worst case of a LoginButton-like listener (registered after the external
+      // app listener): on SIGNOUT it re-initializes synchronously, driving the
+      // state to INITIALIZED during the same dispatch. (The real LoginButton
+      // awaits its re-init, which starts a microtask later.)
       a.stateChangeListeners.push((s) => {
         if (s.status === AuthStates.SIGNOUT) a.state = { status: AuthStates.INITIALIZED, serviceInfo: {} };
       });

package/test/LoginButton.test.js

@@ -39,6 +39,7 @@ describe('[LBTX] LoginButton', function () {
     delete global.document;
     delete global.window;
     delete global.location;
+    delete global.navigator;
     delete global.confirm;
   });
 
@@ -174,6 +175,23 @@ describe('[LBTX] LoginButton', function () {
       // Confirm is mocked to return true
     });
 
+    it('[LBSG] SIGNOUT waits for the re-init to finish (none left running in the background)', async function () {
+      // A re-init that outlives onStateChange resumes later and consumes
+      // whatever poll URL the page shows by then (it raced [LBRU] on CI).
+      const originalInit = loginBtn.auth.init;
+      let reinitDone = false;
+      loginBtn.auth.init = async function () {
+        await new Promise((resolve) => setTimeout(resolve, 50));
+        reinitDone = true;
+      };
+      try {
+        await loginBtn.onStateChange({ status: AuthStates.SIGNOUT });
+        expect(reinitDone).to.equal(true);
+      } finally {
+        loginBtn.auth.init = originalInit;
+      }
+    });
+
     it('[LBSF] handles unknown state gracefully', async function () {
       // Should log warning but not throw
       await loginBtn.onStateChange({ status: 'UNKNOWN_STATE' });

package/test/LoginButton.urlCleanup.test.js

@@ -9,14 +9,19 @@ const utils = require('../src/utils');
 
 describe('[LBRU] LoginButton URL cleanup after redirect', function () {
   const PAGE_URL = 'http://localhost/app?x=1&prYvpoll=http%3A%2F%2Flocalhost%2Fpoll%2Fkey123&prYvstatus=ACCEPTED';
-  let dom;
-  let cleanupDom = false;
+  const GLOBALS = ['document', 'window', 'location', 'navigator'];
+  let saved;
   let originalFetchGet;
 
   before(() => {
-    if (typeof document === 'undefined') {
-      cleanupDom = true;
-      dom = new JSDOM('<!DOCTYPE html><body></body>', { url: PAGE_URL });
+    // Always our own page: reusing a DOM left by another file would test that
+    // page's URL, not PAGE_URL. Node only (a real browser run has no JSDOM).
+    if (typeof JSDOM !== 'undefined') {
+      saved = {};
+      for (const name of GLOBALS) {
+        saved[name] = Object.getOwnPropertyDescriptor(global, name);
+      }
+      const dom = new JSDOM('<!DOCTYPE html><body></body>', { url: PAGE_URL });
       global.document = dom.window.document;
       global.window = dom.window;
       global.location = dom.window.location;
@@ -28,11 +33,11 @@ describe('[LBRU] LoginButton URL cleanup after redirect', function () {
 
   after(() => {
     utils.fetchGet = originalFetchGet;
-    if (!cleanupDom) return;
-    delete global.document;
-    delete global.window;
-    delete global.location;
-    delete global.navigator;
+    if (saved == null) return;
+    for (const name of GLOBALS) {
+      if (saved[name]) Object.defineProperty(global, name, saved[name]);
+      else delete global[name];
+    }
   });
 
   it('[LBR1] strips consumed prYv* params from the visible URL', async () => {