A chat no longer dies when the network moves under it. A NAT rebind, a lift, a Wi-Fi radio parking itself, a phone that dozed: the session repairs its own network path in place, and the messages typed meanwhile go out when it returns. Recovery is an ICE restart, which renegotiates only the transport path — the DTLS handshake, the session keys and the SCTP association carrying the data channel all sit above ICE and survive it. The renegotiation SDP therefore travels over the existing end-to-end encrypted, SAS-verified channel: no signalling service enters the design, and an attacker who cannot already decrypt the session cannot inject a reconnection. A restart is refused outright unless the DTLS fingerprint in the incoming SDP matches the live session's, so recovery can never re-point a conversation at a different peer. When the path is gone for good the session is ended and its data wiped rather than left half-alive: with no server there is nothing to re-signal through, and a conversation whose transport is gone should not leave its plaintext in an open tab. The two cases where that is already certain are recognised in seconds instead of being retried for two minutes — a channel that has delivered nothing at all since the drop cannot carry a renegotiation, and an ICE agent left bound to a network that no longer exists reports zero candidate pairs on every restart. Judging liveness was the hard part. Silence is not evidence of death: browsers freeze backgrounded tabs outright, and a frozen peer answers nothing while being perfectly healthy. What survives that freeze is ICE consent, which the browser runs in its network stack rather than on the page's thread — so a connected ICE state means a silent peer is asleep, and only a degraded one turns an unanswered probe into a teardown. The grace window before a restart is sized to the browser's own timings: 'disconnected' arrives after ~5s of missed consent responses and is held ~25s before 'failed', and that window exists for self-healing, so restarting at the start of it broke connections that were about to recover. Several long-standing bugs surfaced along the way and are fixed here: - handleHeartbeat() was dispatched to but never defined, so every inbound heartbeat threw a TypeError and peer liveness was never observed at all. - Heartbeats were folded into the 5-minute maintenance cycle instead of running on their own timer, far too coarse to notice a dead path. - ondatachannel can hand over a channel that is already open, so the answering side's 'open' event had been dispatched before the handler was assigned and never fired, leaving that side with no heartbeat, no watchdog and no file-transfer init. The peer whose network was fine kept showing "connected" indefinitely because nothing was running to notice. - Answering a heartbeat required the peer to have finished verifying, but the two sides confirm a SAS code at different moments; for that whole window one of them could not reply and was declared dead on a healthy connection. - Sending on a channel that was not ready returned in silence: the text stayed in the box, nothing was transmitted, and nothing said why. - The send path gated on navigator.onLine and the offline/online events, which report whether an interface exists rather than whether anything is reachable. A tab the OS froze misses the 'online' edge, and this side then queued every message forever: one tick on everything it sent, while incoming messages kept arriving. Sending is now decided by the data channel, and queues drain by polling rather than on an edge, so a missed event cannot strand them. - A false offline modal appeared on a working session, because the offline event was taken at face value. tests/session-recovery.test.mjs covers the state machine, the backoff and its serialisation, the offline hold, the sleeping-peer discriminator and the identity check.
180 lines
8.4 KiB
JavaScript
180 lines
8.4 KiB
JavaScript
// Verifies the multi-session reducer keeps sessions fully isolated: a change to one
|
|
// session never mutates another, unread only grows for non-active received traffic, and
|
|
// removing a session re-points the active pointer without disturbing siblings.
|
|
import assert from 'node:assert/strict';
|
|
|
|
const {
|
|
sessionsReducer,
|
|
createInitialState,
|
|
createSessionEntry,
|
|
SESSION_ACTIONS: A,
|
|
decorateSession,
|
|
monoInitials,
|
|
statusDot
|
|
} = await import('../src/state/sessionsStore.js');
|
|
|
|
function withTwoSessions() {
|
|
let state = createInitialState();
|
|
state = sessionsReducer(state, { type: A.CREATE_SESSION, entry: createSessionEntry({ id: 'a', peerLabel: 'work laptop' }) });
|
|
state = sessionsReducer(state, { type: A.CREATE_SESSION, entry: createSessionEntry({ id: 'b', peerLabel: 'atlas repo' }) });
|
|
return state;
|
|
}
|
|
|
|
// CREATE_SESSION activates the new session and preserves order.
|
|
{
|
|
const state = withTwoSessions();
|
|
assert.deepEqual(state.order, ['a', 'b']);
|
|
assert.equal(state.activeSessionId, 'b', 'newest session becomes active');
|
|
assert.equal(Object.keys(state.sessions).length, 2);
|
|
}
|
|
|
|
// Isolation: mutating session B leaves session A's object referentially untouched.
|
|
{
|
|
const before = withTwoSessions();
|
|
const aRef = before.sessions.a;
|
|
const after = sessionsReducer(before, { type: A.ADD_MESSAGE, id: 'b', message: { id: 1, message: 'hi', type: 'sent' } });
|
|
assert.equal(after.sessions.a, aRef, 'session A object must be the same reference after editing B');
|
|
assert.equal(after.sessions.b.messages.length, 1);
|
|
assert.equal(after.sessions.a.messages.length, 0, 'A transcript untouched');
|
|
// And the original state object was not mutated in place.
|
|
assert.equal(before.sessions.b.messages.length, 0, 'reducer is immutable');
|
|
}
|
|
|
|
// SET_STATUS / SET_FINGERPRINT / SET_SAS are scoped to one session.
|
|
{
|
|
let state = withTwoSessions();
|
|
state = sessionsReducer(state, { type: A.SET_STATUS, id: 'a', status: 'verified' });
|
|
state = sessionsReducer(state, { type: A.SET_SAS, id: 'a', sas: { isVerified: true, bothConfirmed: true } });
|
|
state = sessionsReducer(state, { type: A.SET_FINGERPRINT, id: 'a', fingerprint: 'AB:CD' });
|
|
assert.equal(state.sessions.a.status, 'verified');
|
|
assert.equal(state.sessions.a.sas.isVerified, true);
|
|
assert.equal(state.sessions.a.keyFingerprint, 'AB:CD');
|
|
assert.equal(state.sessions.b.status, 'new', 'sibling status untouched');
|
|
assert.equal(state.sessions.b.sas.isVerified, false, 'sibling SAS untouched');
|
|
assert.equal(state.sessions.b.keyFingerprint, '', 'sibling fingerprint untouched');
|
|
}
|
|
|
|
// Peer presence is cleared when the session leaves the connected state, so a reconnect
|
|
// never re-shows the peer's stale status before they re-broadcast it.
|
|
{
|
|
let state = withTwoSessions();
|
|
state = sessionsReducer(state, { type: A.SET_STATUS, id: 'a', status: 'connected' });
|
|
state = sessionsReducer(state, { type: A.SET_PEER_PRESENCE, id: 'a', presence: 'busy' });
|
|
assert.equal(state.sessions.a.peerPresence, 'busy');
|
|
|
|
// connected -> verified keeps presence (still connected).
|
|
state = sessionsReducer(state, { type: A.SET_STATUS, id: 'a', status: 'verified' });
|
|
assert.equal(state.sessions.a.peerPresence, 'busy', 'presence kept while still connected');
|
|
|
|
// verified -> peer_disconnected clears it.
|
|
state = sessionsReducer(state, { type: A.SET_STATUS, id: 'a', status: 'peer_disconnected' });
|
|
assert.equal(state.sessions.a.peerPresence, null, 'presence cleared on disconnect');
|
|
|
|
// Reconnecting does not resurrect the old presence; it stays null until re-broadcast.
|
|
state = sessionsReducer(state, { type: A.SET_STATUS, id: 'a', status: 'connected' });
|
|
assert.equal(state.sessions.a.peerPresence, null, 'no stale presence after reconnect');
|
|
state = sessionsReducer(state, { type: A.SET_PEER_PRESENCE, id: 'a', presence: 'available' });
|
|
assert.equal(state.sessions.a.peerPresence, 'available', 'fresh presence applies after reconnect');
|
|
|
|
// A session repairing its network path is still a live session: blanking the
|
|
// peer's presence would make a two-second glitch look like a disconnect.
|
|
state = sessionsReducer(state, { type: A.SET_STATUS, id: 'a', status: 'reconnecting' });
|
|
assert.equal(state.sessions.a.peerPresence, 'available', 'presence survives a path repair');
|
|
}
|
|
|
|
// A reconnecting session reads as in-progress (amber), not as dropped (red).
|
|
{
|
|
const entry = createSessionEntry({ id: 'a', peerLabel: 'phone' });
|
|
entry.status = 'reconnecting';
|
|
const d = decorateSession(entry, 'a');
|
|
assert.equal(d.headerSub, 'Reconnecting…');
|
|
|
|
const dropped = createSessionEntry({ id: 'b', peerLabel: 'phone' });
|
|
dropped.status = 'disconnected';
|
|
assert.notEqual(d.dot, decorateSession(dropped, 'b').dot, 'reconnecting must not look dropped');
|
|
}
|
|
|
|
// UPDATE_MESSAGE_STATUS and DELETE_MESSAGE only touch the named session/message.
|
|
{
|
|
let state = withTwoSessions();
|
|
state = sessionsReducer(state, { type: A.ADD_MESSAGE, id: 'a', message: { id: 1, mid: 'm1', message: 'x', type: 'sent', status: 'sending' } });
|
|
state = sessionsReducer(state, { type: A.UPDATE_MESSAGE_STATUS, id: 'a', mid: 'm1', status: 'delivered' });
|
|
assert.equal(state.sessions.a.messages[0].status, 'delivered');
|
|
state = sessionsReducer(state, { type: A.DELETE_MESSAGE, id: 'a', mid: 'm1' });
|
|
assert.equal(state.sessions.a.messages.length, 0);
|
|
assert.equal(state.sessions.b.messages.length, 0);
|
|
}
|
|
|
|
// Unread bookkeeping.
|
|
{
|
|
let state = withTwoSessions(); // active = b
|
|
state = sessionsReducer(state, { type: A.INCREMENT_UNREAD, id: 'a' });
|
|
state = sessionsReducer(state, { type: A.INCREMENT_UNREAD, id: 'a' });
|
|
assert.equal(state.sessions.a.unreadCount, 2);
|
|
assert.equal(state.sessions.b.unreadCount, 0);
|
|
state = sessionsReducer(state, { type: A.SET_ACTIVE, id: 'a' });
|
|
state = sessionsReducer(state, { type: A.CLEAR_UNREAD, id: 'a' });
|
|
assert.equal(state.sessions.a.unreadCount, 0);
|
|
assert.equal(state.activeSessionId, 'a');
|
|
}
|
|
|
|
// PATCH_SETUP merges, scoped per session.
|
|
{
|
|
let state = withTwoSessions();
|
|
state = sessionsReducer(state, { type: A.PATCH_SETUP, id: 'a', patch: { offerData: 'OFFER', showOfferStep: true } });
|
|
assert.equal(state.sessions.a.setup.offerData, 'OFFER');
|
|
assert.equal(state.sessions.a.setup.showOfferStep, true);
|
|
assert.equal(state.sessions.a.setup.answerData, '', 'untouched setup field keeps default');
|
|
assert.equal(state.sessions.b.setup.offerData, '', 'sibling setup untouched');
|
|
}
|
|
|
|
// RENAME marks the label custom.
|
|
{
|
|
let state = withTwoSessions();
|
|
state = sessionsReducer(state, { type: A.RENAME, id: 'a', label: 'Alice' });
|
|
assert.equal(state.sessions.a.peerLabel, 'Alice');
|
|
assert.equal(state.sessions.a.labelIsCustom, true);
|
|
assert.equal(state.sessions.b.labelIsCustom, false);
|
|
}
|
|
|
|
// REMOVE_SESSION re-points active to the previous sibling and leaves the rest intact.
|
|
{
|
|
let state = withTwoSessions(); // order [a,b], active b
|
|
const bRef = state.sessions.b;
|
|
state = sessionsReducer(state, { type: A.SET_ACTIVE, id: 'a' });
|
|
state = sessionsReducer(state, { type: A.REMOVE_SESSION, id: 'a' });
|
|
assert.equal(state.sessions.a, undefined, 'a removed');
|
|
assert.equal(state.sessions.b, bRef, 'sibling b object untouched');
|
|
assert.deepEqual(state.order, ['b']);
|
|
assert.equal(state.activeSessionId, 'b', 'active re-pointed to remaining session');
|
|
}
|
|
|
|
// REMOVE_SESSION on the last session leaves no active.
|
|
{
|
|
let state = createInitialState();
|
|
state = sessionsReducer(state, { type: A.CREATE_SESSION, entry: createSessionEntry({ id: 'solo' }) });
|
|
state = sessionsReducer(state, { type: A.REMOVE_SESSION, id: 'solo' });
|
|
assert.equal(state.activeSessionId, null);
|
|
assert.deepEqual(state.order, []);
|
|
}
|
|
|
|
// Decorators mirror the design helpers.
|
|
{
|
|
assert.equal(monoInitials('work laptop'), 'WL');
|
|
assert.equal(monoInitials('atlas'), 'AT');
|
|
assert.equal(statusDot('verified'), '#3ecf8e');
|
|
assert.equal(statusDot('connecting'), '#e3b341');
|
|
assert.equal(statusDot('disconnected'), '#e5727a');
|
|
|
|
const entry = createSessionEntry({ id: 'a', peerLabel: 'work laptop' });
|
|
entry.unreadCount = 3;
|
|
entry.status = 'connecting';
|
|
const d = decorateSession(entry, 'b');
|
|
assert.equal(d.mono, 'WL');
|
|
assert.equal(d.unread, '3');
|
|
assert.equal(d.active, false);
|
|
assert.equal(d.inactive, true);
|
|
}
|
|
|
|
console.log('sessions-reducer.test.mjs: all assertions passed');
|