fix(cloud): #96 review, round two — another window's sign-in; a cancelled request starts no renewal

1. A sign-in in ANOTHER window could still be replayed into. Round one bound a
   request to the host's sessionGeneration, which counts the sessions THIS
   window has been through. The stored tokens belong to every window: one that
   signs in as someone else changes them without moving this window's count. A
   401 arriving after that found "a different token for the same gateway", and
   the old account's prompt went out again on the new account's token — an
   inline edit in flight, or the nodes still to come of a Sketch run.

   What every window can see, and a renewal does not change, is who the token
   says it is for. providers/session.js gains jwtSubject: `sub`, read the way
   `exp` already is, not verified. A different stored token is a renewal only if
   it names the subject the refused one named — checked where the count is,
   before refreshing and again before re-sending. Tokens that name no subject
   cannot be told apart this way and are left to the count; one that stops, or
   starts, naming a subject is not taken for the same account. The same-account
   case still works across windows: a token another window renewed is used, with
   no second refresh of it.

2. A request cancelled while the stored session was being read still started a
   renewal. Cancel, Stop or the next keystroke could land during that read;
   recovery went on to start the refresh before it looked at the signal, and for
   ghost text used up the minute's one renewal. The signal is now checked as soon
   as the read returns: a request nobody is waiting for starts nothing.

Verified: 48 suites, 924 cases, 0 failing — on develop, which this branch now
contains (d056588: #92 and #95 have merged). session.test.js goes from 15 to 19
cases, authRetry.test.js from 39 to 45, authRetryCallers.test.js from 72 to 76:
another window signing in as someone else while an inline edit is out, and
half-way through a Sketch run, against the shipped host code; another window
renewing the same session; a keystroke landing during the read. On the module as
last pushed, the new cases fail and the rest pass. 55 breakages — each rule
removed, each caller reverted, each option dropped — fail a case each.
node --check is clean, and tsc --checkJs reports nothing new. Not run in the
editor. The subject check rests on the access token being a JWT that carries
`sub`, as the session tests model it; the backend is not in this repository.

Author: ndemianc

extensions/levelcode-ai/extension.js

@@ -671,7 +671,8 @@ async function refreshGatewayToken() {
  * ONE instance for the window, so that requests which fail together wait on a single renewal. And it
  * is told which session this window is on (sessionGeneration), for the reason the refresh keeps that
  * count: a request belongs to the session it was sent in. A token stored by a LATER sign-in is not a
- * renewal of the old one, and is never put on a request the earlier session sent.
+ * renewal of the old one, and is never put on a request the earlier session sent. (A sign-in made in
+ * ANOTHER window this count cannot see; for that, authRetry goes by who the tokens say they are for.)
  */
 const authRetry = createAuthRetry({ prepProviderRequest, refreshGatewayToken, isAuthError, sessionGeneration: () => sessionGeneration, dbg });
 

extensions/levelcode-ai/providers/authRetry.js

@@ -20,7 +20,8 @@
  *    - Only a GATEWAY request is renewed. A 401 from the user's own provider is a wrong key, and no
  *      amount of refreshing a cloud session fixes that: it is rethrown untouched.
  *    - Only an auth failure, only before any of the answer has arrived (a second send would repeat
- *      it), and not once the caller has aborted. One retry: the second failure is the answer.
+ *      it), and not once the caller has aborted — a request nobody is waiting for starts no renewal
+ *      either, wherever in the recovery the abort lands. One retry: the second failure is the answer.
  *    - It never ends a session. One thing does — the refresh endpoint answering 401, inside the
  *      host's own refresh. This only FINDS OUT, by asking the host for a provider again: `signedOut`
  *      means the session is over, and the caller gets the sentence the chat shows — coded
@@ -41,7 +42,10 @@
  *      sign-in as someone else, or a change of cloud host, the stored token is not this request's.
  *      Putting it on the request would send one host's credential to another, or replay one
  *      account's prompt as another's — so recovery stops there, before refreshing and again before
- *      re-sending, and the request's own error stands.
+ *      re-sending, and the request's own error stands. Two things say whose a token is. The host
+ *      counts the sessions THIS window has been through. What another window does to the store
+ *      they share no window can count — but the tokens name their subject, and a token that names
+ *      a different one is another account's, whoever stored it.
  *    - A request nobody asked for (ghost text) may START a renewal once a minute at most. It is
  *      sent on every pause in typing; a gateway that keeps answering 401 must not turn typing into
  *      a stream of refreshes, each one rotating the session's credentials. Waiting on a renewal
@@ -50,7 +54,7 @@
 // @ts-check
 'use strict';
 
-const { SESSION_EXPIRED_MESSAGE } = require('./session');
+const { SESSION_EXPIRED_MESSAGE, jwtSubject } = require('./session');
 
 /** How often requests the user did not ask for may START a renewal. */
 const BACKGROUND_RENEWAL_INTERVAL_MS = 60 * 1000;
@@ -138,9 +142,11 @@ function createAuthRetry(host) {
 	 *
 	 *   'ended'      — the session is over: the host answers `signedOut`
 	 *   'superseded' — the request is no longer this session's to recover. The session it was sent
-	 *                  in has been replaced (a sign-in, a sign-out), or the host would now send it
-	 *                  somewhere else: another gateway URL, the user's own provider, nowhere.
-	 *                  Whatever token is stored for THAT is not put on this request.
+	 *                  in has been replaced — a sign-in or a sign-out here (the host's count), a
+	 *                  sign-in as someone else in another window (the stored token names another
+	 *                  subject) — or the host would now send it somewhere else: another gateway
+	 *                  URL, the user's own provider, nowhere. Whatever token is stored for THAT is
+	 *                  not put on this request.
 	 *   'renewed'    — same session, same gateway, a different token in place: `apiKey`
 	 *   'same'       — the token that was refused is still the one stored
 	 *
@@ -153,7 +159,12 @@ function createAuthRetry(host) {
 		if (cur && !cur.ok && cur.reason === 'signedOut') { return { state: 'ended' }; }
 		const sameGateway = !!cur && cur.ok && cur.gateway && cur.providerId === req.providerId && cur.baseURL === req.baseURL;
 		if (!sameGateway || generation() !== sessionOf.get(req)) { return { state: 'superseded' }; }
-		return cur.apiKey && cur.apiKey !== sent ? { state: 'renewed', apiKey: cur.apiKey } : { state: 'same' };
+		if (!cur.apiKey || cur.apiKey === sent) { return { state: 'same' }; }
+		// A different token. The store is shared with the other windows, and their sign-ins are not in
+		// this window's count: it is a renewal only if it is for whoever the refused one was for. (Tokens
+		// that name no subject cannot be told apart this way, and are left to the checks above.)
+		if (jwtSubject(cur.apiKey) !== jwtSubject(sent)) { return { state: 'superseded' }; }
+		return { state: 'renewed', apiKey: cur.apiKey };
 	}
 
 	/**
@@ -165,6 +176,9 @@ function createAuthRetry(host) {
 	 */
 	async function recover(req, sent, o) {
 		let cur = await look(req, sent);
+		// Cancel, Stop or the next keystroke can land while that read is out. A request nobody is waiting
+		// for any more starts no renewal — and, for ghost text, does not use up the minute.
+		if (aborted(o.signal)) { return { outcome: 'aborted' }; }
 		if (cur.state === 'renewed') { return { outcome: 'already-renewed', apiKey: cur.apiKey }; }
 		if (cur.state !== 'same') { return { outcome: cur.state }; }   // ended, or no longer this request's: nothing to refresh
 		// The limit is on STARTING a renewal. One that is already out costs nothing to wait on — and the

extensions/levelcode-ai/providers/session.js

@@ -26,23 +26,51 @@ const REFRESH_TIMEOUT_MS = 10 * 1000;
 const SESSION_EXPIRED_MESSAGE = 'Your LevelCode Cloud session has expired. Sign in again to continue.';
 
 /**
- * The `exp` claim of a JWT as epoch milliseconds, or null when the token is not a JWT, carries no
- * `exp`, or is unreadable. Never throws: a malformed token is a reason to re-check with the server,
- * not a reason to crash the editor.
+ * The payload of a JWT, or null when the token is not a JWT or is unreadable. Never throws.
  * @param {string|null|undefined} token
- * @returns {number|null}
+ * @returns {any}
  */
-function jwtExpiresAt(token) {
+function jwtPayload(token) {
 	try {
 		const parts = String(token || '').split('.');
 		if (parts.length !== 3) { return null; }
 		const b64 = parts[1].replace(/-/g, '+').replace(/_/g, '/');
 		const payload = JSON.parse(Buffer.from(b64 + '='.repeat((4 - b64.length % 4) % 4), 'base64').toString('utf8'));
-		const exp = Number(payload && payload.exp);
-		return Number.isFinite(exp) && exp > 0 ? exp * 1000 : null;
+		return payload && typeof payload === 'object' ? payload : null;
 	} catch { return null; }
 }
 
+/**
+ * The `exp` claim of a JWT as epoch milliseconds, or null when the token is not a JWT, carries no
+ * `exp`, or is unreadable. Never throws: a malformed token is a reason to re-check with the server,
+ * not a reason to crash the editor.
+ * @param {string|null|undefined} token
+ * @returns {number|null}
+ */
+function jwtExpiresAt(token) {
+	const payload = jwtPayload(token);
+	const exp = Number(payload && payload.exp);
+	return Number.isFinite(exp) && exp > 0 ? exp * 1000 : null;
+}
+
+/**
+ * Who a JWT says it is for: its `sub` claim, as a string — or null when the token is not a JWT, is
+ * unreadable, or names no subject. Read, not verified, like `exp`: it is only asking the token.
+ *
+ * It is the one thing about a session that every window can see and that a renewal does not change.
+ * The stored tokens belong to all the windows, and a window only counts the sign-ins it makes
+ * itself; but two tokens that name different subjects are two accounts, whichever window stored the
+ * second one.
+ * @param {string|null|undefined} token
+ * @returns {string|null}
+ */
+function jwtSubject(token) {
+	const payload = jwtPayload(token);
+	const sub = payload ? payload.sub : undefined;
+	if (typeof sub === 'string') { return sub || null; }
+	return typeof sub === 'number' && Number.isFinite(sub) ? String(sub) : null;
+}
+
 /**
  * Whether an access token should be refreshed before use: it expires within the margin, has
  * already expired, or cannot be read at all (an unreadable token is treated as expired — the
@@ -97,4 +125,4 @@ function isSessionExpiredError(e) {
 	return status === 401 || /\bAPI 401\b|token_expired|refresh_expired|signature has expired/i.test(msg);
 }
 
-module.exports = { EXPIRY_MARGIN_MS, REFRESH_TIMEOUT_MS, SESSION_EXPIRED_MESSAGE, jwtExpiresAt, accessNeedsRefresh, classifyRefresh, isSessionExpiredError };
+module.exports = { EXPIRY_MARGIN_MS, REFRESH_TIMEOUT_MS, SESSION_EXPIRED_MESSAGE, jwtExpiresAt, jwtSubject, accessNeedsRefresh, classifyRefresh, isSessionExpiredError };

extensions/levelcode-ai/test/authRetry.test.js

@@ -13,7 +13,7 @@
  *    - requests that fail together wait on one renewal, and one refused on a token that has been
  *      renewed since is simply sent again
  *    - a request stays with the session and the gateway it was sent on: a token stored by a later
- *      sign-in, or for another cloud host, is never put on it
+ *      sign-in — in this window or in another — or for another cloud host, is never put on it
  *    - a request nobody asked for (ghost text) cannot turn typing into a stream of refreshes — but
  *      is never kept from waiting on a renewal that is already out
  *
@@ -42,6 +42,15 @@ function within(promise, ms, what) {
 	return Promise.race([promise, late]).finally(() => clearTimeout(timer));
 }
 
+/** An unsigned JWT with the given payload: a real access token says who it is for. */
+function jwt(payload) {
+	const b64 = (o) => Buffer.from(JSON.stringify(o)).toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+	return b64({ alg: 'HS256', typ: 'JWT' }) + '.' + b64(payload) + '.sig';
+}
+/** Ada's n-th access token, and one of Bo's. */
+const ada = (n) => jwt({ sub: 'ada', exp: 1_800_000_000 + n });
+const BO = jwt({ sub: 'bo', exp: 1_800_000_000 });
+
 /** The gateway's answer to a lapsed access token, as the openai adapter throws it. */
 const gateway401 = () => Object.assign(new Error('LevelCode Cloud API 401: Signature has expired'), { status: 401 });
 
@@ -365,6 +374,53 @@ async function test(name, fn) { await fn(); n++; console.log('  ok - ' + name);
 		assert.deepStrictEqual(w.dbg, ['auth.retry superseded']);
 	});
 
+	// What another WINDOW does to the store they share is in nobody's count. The tokens say whose they are.
+	await test('another WINDOW signed in as someone else: this window counted nothing, the token names another subject — not replayed', async () => {
+		const w = window_({ token: ada(1) });
+		const req = w.request();
+		w.token = BO;   // the shared store, changed elsewhere: no sign-in here, same host, same provider
+		const e = await failure(w.authRetry(req, w.send));
+		assert.ok(/API 401/.test(e.message), 'the request\'s own error');
+		assert.deepStrictEqual(w.sent, [ada(1)], 'Ada\'s prompt is not sent again on Bo\'s token');
+		assert.strictEqual(w.renewals, 0, 'and Bo\'s session is not refreshed for it');
+		assert.deepStrictEqual(w.dbg, ['auth.retry superseded']);
+	});
+
+	await test('another window RENEWED the same account: the same subject, so it is sent again on that token', async () => {
+		const w = window_({ token: ada(1) });
+		const req = w.request();
+		w.token = ada(2);
+		assert.strictEqual(await w.authRetry(req, w.send), 'answered on ' + ada(2));
+		assert.deepStrictEqual({ renewals: w.renewals, dbg: w.dbg }, { renewals: 0, dbg: ['auth.retry already-renewed'] });
+	});
+
+	await test('the renewal itself comes back as someone else\'s (the other window signed in just before it): not this request\'s', async () => {
+		const w = window_({ token: ada(1), renewal: async () => { w.token = BO; return 'claim'; } });
+		const e = await failure(w.authRetry(w.request(), w.send));
+		assert.ok(/API 401/.test(e.message));
+		assert.deepStrictEqual({ sent: w.sent, dbg: w.dbg }, { sent: [ada(1)], dbg: ['auth.retry superseded'] });
+	});
+
+	await test('a renewal within the account is taken as one, by tokens that say who they are for', async () => {
+		const w = window_({ token: ada(1), renewal: async () => { w.token = ada(2); return 'claim'; } });
+		assert.strictEqual(await w.authRetry(w.request(), w.send), 'answered on ' + ada(2));
+	});
+
+	await test('a token that cannot be read as the same subject is not taken for the same account', async () => {
+		for (const [sentOn, stored] of [[ada(1), 'opaque-token'], ['opaque-token', ada(2)], [jwt({ sub: 7 }), jwt({ sub: '8' })]]) {
+			const w = window_({ token: sentOn });
+			const req = w.request();
+			w.token = stored;
+			await failure(w.authRetry(req, w.send));
+			assert.deepStrictEqual(w.sent, [sentOn], JSON.stringify([sentOn, stored]));
+		}
+		// …while 7 and '7' are one subject: a server may write the id either way.
+		const w = window_({ token: jwt({ sub: 7, exp: 1 }) });
+		const req = w.request();
+		w.token = jwt({ sub: '7', exp: 2 });
+		assert.strictEqual(await w.authRetry(req, w.send), 'answered on ' + w.token);
+	});
+
 	await test('the same URL under another provider is not the same gateway', async () => {
 		const stored = { ok: true, gateway: true, providerId: 'openai', apiKey: 'access-1', baseURL: 'https://cloud.test/ai' };
 		const authRetry = createAuthRetry({
@@ -416,6 +472,18 @@ async function test(name, fn) { await fn(); n++; console.log('  ok - ' + name);
 		assert.strictEqual(w.renewals, 1);
 	});
 
+	await test('aborted while the stored session is being READ: no renewal is started — and ghost text\'s minute is not used up', async () => {
+		const w = window_({ renewal: 'fail' });
+		const ac = new AbortController();
+		w.onPrep = (nth) => { if (nth === 1) { ac.abort(); } };   // the keystroke lands while authRetry is looking at what is stored
+		const e = await failure(w.authRetry(w.request(), w.send, { background: true, signal: ac.signal }));
+		assert.ok(/API 401/.test(e.message));
+		assert.deepStrictEqual({ renewals: w.renewals, dbg: w.dbg }, { renewals: 0, dbg: ['auth.retry aborted'] });
+		w.onPrep = null;
+		await failure(w.authRetry(w.request(), w.send, { background: true }));   // the next pause, well inside the minute
+		assert.deepStrictEqual({ renewals: w.renewals, dbg: w.dbg }, { renewals: 1, dbg: ['auth.retry aborted', 'auth.retry failed'] }, 'it may still start the minute\'s one renewal');
+	});
+
 	await test('aborted AFTER the renewal landed, before the re-send: the new token is kept, the request is not sent', async () => {
 		const w = window_();
 		const ac = new AbortController();