fix(cloud): a sign-in replaces the whole session — it no longer keeps the last one's refresh token

From review on #95. storeSession wrote the access token, and the refresh token only if the
sign-in brought one. With none, the previous session's stayed in SecretStorage — and it is
what the new session's first renewal was then made with. The generation counter does not
help: by then the stale token IS the current session's, as far as this window can tell.

Reproduced on the reviewed code, both ways it can go:

  - the old token is refused: the refresh is sent with it, its 401 ends the session — the
    access token minted by the sign-in is deleted and the "session expired" card shown to
    someone who signed in hours ago. This is the reviewer's case.
  - the old token is still good: the server renews the PREVIOUS account, and the editor ends
    up holding that account's access token under the new account's name and plan. Requests
    then run, and bill, as someone else. The review did not mention this one; it is worse.

So a sign-in now settles the refresh token either way — stored, or forgotten when there is
none. And it settles it FIRST, before the access token. The same bad pairing was reachable
without an absent token at all: with the access token written first, a sign-in cut short
before its second write (the editor closing, a keychain that locks) left the new access token
over the old refresh token. Written the other way round, what a cut-short sign-in leaves is
the old access token over the new refresh token, which the next renewal resolves to the
account the user was signing in to.

How reachable: today's backend sends a refresh token on both callback forms, so this needs a
callback that arrives without one — the legacy `?token=` form accepts that. Latent, then, but
the client documents the refresh token as optional and already had a test for a sign-in
without one.

Three cases in sessionExpiredHost.test.js (57 -> 60), run against the real functions. With
the delete removed, exactly those three fail; with the old write order, exactly the ordering
case. tsc --checkJs reports no new undefined names.

Author: ndemianc

extensions/levelcode-ai/extension.js

@@ -3193,13 +3193,25 @@ async function webHandoffUrl() {
 		return (data && data.url) || null;
 	} catch (e) { dbg('account.handoff', { error: String((e && e.message) || e) }); return null; }
 }
-/** Persist an editor session: access token (required), optional refresh token, and display profile. */
+/**
+ * Persist an editor session: access token (required), the refresh token if the sign-in brought one,
+ * and the display profile.
+ *
+ * A sign-in REPLACES the session; it does not top one up. A refresh token left over from whatever
+ * was here before is what the new session's first renewal would be made with: refused, it ends the
+ * session that replaced it; still good, it hands this editor the previous account's access token
+ * under the new account's name. So the refresh token is settled first — stored, or forgotten when
+ * there is none — and only then the access token. A sign-in cut short between the two (the editor
+ * closing, a keychain that will not write) must not leave the new access token over the old
+ * refresh token either.
+ */
 async function storeSession(access, refresh, profile) {
 	if (!ctx || !access) { return; }
 	await withSessionLock(async () => {
 		sessionGeneration++;   // a refresh still out for the session this replaces must not touch the new one
-		await ctx.secrets.store(ACCOUNT_TOKEN_KEY, access);
 		if (refresh) { await ctx.secrets.store(ACCOUNT_REFRESH_KEY, refresh); }
+		else { await ctx.secrets.delete(ACCOUNT_REFRESH_KEY); }
+		await ctx.secrets.store(ACCOUNT_TOKEN_KEY, access);
 		cloudSignedIn = true;
 		await ctx.globalState.update(ACCOUNT_PROFILE_KEY, {
 			name: (profile && profile.name) || '', email: (profile && profile.email) || '', plan: (profile && profile.plan) || ''

extensions/levelcode-ai/test/sessionExpiredHost.test.js

@@ -561,6 +561,50 @@ async function test(name, fn) { await fn(); n++; console.log('  ok - ' + name);
 		assert.ok(!t.types().includes('sessionExpired'));
 	});
 
+	// The case above is a refresh already OUT when such a sign-in lands. These are the NEXT one: with no
+	// refresh token of its own, the sign-in left the previous session's in storage, and the new
+	// session's first renewal — hours later — was made with it.
+	await test('a sign-in with no refresh token of its own forgets the previous session\'s', async () => {
+		const t = boot({ access: liveAccess(), refresh: 'r-old', profile: { name: 'Ada' } });
+		const mine = deadAccess();                                  // the new session's token, at the end of its eight hours
+		await t.host.storeSession(mine, null, { name: 'Bo' });
+		assert.strictEqual(t.secrets.get(t.K.refresh), undefined, 'the old refresh token is gone');
+		t.refreshReply = refused;                                   // what the server would have said to r-old
+		await t.host.checkCloudSession('focus');
+		assert.strictEqual(t.calls.refresh.length, 0, 'it is never sent');
+		assert.strictEqual(t.secrets.get(t.K.token), mine, 'so its 401 cannot end the session that replaced it');
+		assert.strictEqual(t.state.get(t.K.expired), undefined);
+		assert.ok(!t.types().includes('sessionExpired'), 'no sign-in card');
+	});
+
+	await test('…nor can a still-valid one put the previous ACCOUNT back under the new name', async () => {
+		const t = boot({ access: liveAccess(), refresh: 'r-ada', profile: { name: 'Ada' } });
+		const bo = deadAccess();
+		await t.host.storeSession(bo, null, { name: 'Bo' });       // Bo signs in over Ada's session
+		t.refreshReply = { status: 200, body: { access: liveAccess() + '.ada', refresh: 'r-ada-2' } };   // r-ada still works — for Ada
+		await t.host.checkCloudSession('focus');
+		assert.strictEqual(t.calls.refresh.length, 0);
+		assert.strictEqual(t.secrets.get(t.K.token), bo, 'Bo\'s editor is not handed Ada\'s access token');
+		assert.strictEqual(t.state.get(t.K.profile).name, 'Bo');
+	});
+
+	await test('a sign-in settles the refresh token BEFORE the access token: one cut short never pairs new with old', async () => {
+		const t = boot({ access: liveAccess(), refresh: 'r-ada' });
+		await t.host.storeSession(liveAccess(), 'r-bo', { name: 'Bo' });
+		assert.deepStrictEqual(t.ops.slice(0, 2), ['store ' + t.K.refresh, 'store ' + t.K.token]);
+		const u = boot({ access: liveAccess(), refresh: 'r-ada' });
+		await u.host.storeSession(liveAccess(), null, { name: 'Bo' });
+		assert.deepStrictEqual(u.ops.slice(0, 2), ['forget ' + u.K.refresh, 'store ' + u.K.token]);
+
+		// The SECOND write is the one that fails — a keychain that locks half-way through a sign-in.
+		const v = boot({ access: liveAccess(), refresh: 'r-ada' });
+		const bos = liveAccess() + '.bo';
+		let writes = 0;
+		v.onOp = (op) => { if (/^(store|forget) /.test(op) && ++writes === 2) { v.storeError = new Error('keychain locked'); } };
+		await assert.rejects(v.host.storeSession(bos, 'r-bo', { name: 'Bo' }), /keychain locked/);
+		assert.ok(!(v.secrets.get(v.K.token) === bos && v.secrets.get(v.K.refresh) === 'r-ada'), 'never Bo\'s access token over Ada\'s refresh token');
+	});
+
 	await test('late 401: a sign-out while the refresh is out is not turned into an expiry', async () => {
 		const t = boot({ access: deadAccess(), refresh: 'r1', profile: { name: 'Ada' } });
 		const reply = deferred();