pro/im_webapp
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix(web): code review round 2 -- critical session/connection races

Browse Source 
- RequireAuth: a page reload lost the session even with a valid token
  sitting in sessionStorage -- myUserId is never persisted (by design)
  but nothing ever re-derived it from the reusable login token. Added
  connection.ts's restoreSession(), which also fixes the race the first
  attempt at this ran into live: React 19 StrictMode double-invokes the
  restore effect in dev, and Tinode.loginToken() isn't idempotent (second
  call on an already-authenticated connection gets 409'd), so both the
  connect() and the login itself needed module-level in-flight dedup,
  not just a per-effect cancelled flag
- topics.ts: same dedup pattern for openConversation/closeConversation --
  StrictMode's mount->cleanup->remount always overlapped an open with
  itself, and a leave() landing before its own subscribe() resolved was
  silently no-op'ing instead of detaching
- LOGGING_ENABLED was unconditionally on, including prod builds --
  Tinode's verbose logging prints the raw login secret and full message
  content to the console
- imPost/imPatch/imPut/imDelete could silently drop the Idempotency-Key
  header for a caller that passes its own headers (object-spread order
  bug, dormant today since no call site does this yet)
- DetailColumn's getFriends()/getBlocks() only ever read page 1 despite
  fetchAllPages existing specifically to prevent this bug class
- availableActions() now defers to the server's message_policy.
  supported_actions when present instead of only a client-side time
  window, and exposes recallRemainingSeconds for the context menu's
  countdown label

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Your Name
2026-09-08 04:48:28 +08:00
co-authored by Claude Sonnet 5
parent 1bd8d7f804
commit d3a0eb0dbc
12 changed files with 181 additions and 65 deletions
Download Patch File Download Diff File Expand all files Collapse all files
web/src/lib/api/client.ts
+6 -4
View File
@@ -179,15 +179,17 @@ export async function imRequest<T = unknown>(
const idem = () => ({ 'Idempotency-Key': requestId() });
// `opts.headers` is merged ON TOP of idem() (not replaced by the outer `...opts` spread) so a
// caller that needs its own extra header can't accidentally drop the Idempotency-Key.
export const imGet = <T = unknown>(path: string, opts?: RequestOptions) => imRequest<T>(path, opts);
export const imPost = <T = unknown>(path: string, body?: unknown, opts: RequestOptions = {}) =>
imRequest<T>(path, { method: 'POST', body, headers: idem(), ...opts });
imRequest<T>(path, { method: 'POST', body, ...opts, headers: { ...idem(), ...opts.headers } });
export const imPatch = <T = unknown>(path: string, body?: unknown, opts: RequestOptions = {}) =>
imRequest<T>(path, { method: 'PATCH', body, headers: idem(), ...opts });
imRequest<T>(path, { method: 'PATCH', body, ...opts, headers: { ...idem(), ...opts.headers } });
export const imPut = <T = unknown>(path: string, body?: unknown, opts: RequestOptions = {}) =>
imRequest<T>(path, { method: 'PUT', body, headers: idem(), ...opts });
imRequest<T>(path, { method: 'PUT', body, ...opts, headers: { ...idem(), ...opts.headers } });
export const imDelete = <T = unknown>(path: string, opts: RequestOptions = {}) =>
imRequest<T>(path, { method: 'DELETE', headers: idem(), ...opts });
imRequest<T>(path, { method: 'DELETE', ...opts, headers: { ...idem(), ...opts.headers } });
/**
* List endpoints here cap out at 20-50 items per page and it's a real, previously-hit bug class to