Files
PaperClipAI/ui/src/api/client.test.ts
T
DottaandPaperclip 27622c156a fix(ui): recover expired Cloud tenant sessions (#12826)
## Thinking Path

> - Paperclip is the open source app people use to manage AI agents for
work.
> - Paperclip Cloud serves each tenant through a browser session and an
HttpOnly cookie.
> - A parked tenant tab can outlive that tenant session.
> - The active SPA then receives a tenant-session 401 from its API calls
and shows the internal error code.
> - A page reload already enters the secure Cloud document and OIDC
handoff and keeps the requested tenant route.
> - This pull request detects only the two Cloud tenant-session 401
codes and starts that existing handoff once.
> - The benefit is that an expired tenant session recovers without
exposing tokens or showing temporary API errors.

## Linked Issues or Issue Description

**What happened?**

A Paperclip Cloud tenant tab can stay open after its HttpOnly tenant
session expires. The next API request returns `401
tenant_session_required` or `401 tenant_session_invalid`. The SPA shows
the internal error code in the full page or in sidebar data consumers. A
manual page refresh clears the error.

**Expected behavior**

The tenant tab must enter the existing Cloud session handoff when an API
request reports an expired tenant session. The handoff must keep the
current route and query. The UI must not show the internal
tenant-session error code.

**Steps to reproduce**

1. Open a Paperclip Cloud tenant route.
2. Keep the SPA open until the tenant session expires.
3. Let the page make an API request.
4. Observe the tenant-session 401 in the page or sidebar.
5. Refresh the page and observe that the existing Cloud handoff restores
the session.

**Paperclip version or commit**

The problem reproduces on `master` at commit `b5f862376`.

**Deployment mode**

Paperclip Cloud tenant deployment.

## What Changed

- Added one tenant-session recovery coordinator for exact top-level
Cloud error codes.
- Reloaded the top-level document once and shared one pending promise
across concurrent failures.
- Applied recovery before normal error handling in the shared API
client, auth API, and health API.
- Applied the same recovery to direct audit CSV exports and provider
trace downloads.
- Preserved ordinary self-hosted 401 behavior and avoided automatic
mutation replay.
- Added tests for exact detection, concurrent failures, auth-session
behavior, health bootstrap, and direct-fetch behavior.

## Verification

- `pnpm exec vitest run --config vitest.config.ts
src/lib/tenant-session-recovery.test.ts src/api/client.test.ts
src/api/auth.test.ts src/api/health.test.ts src/api/heartbeats.test.ts
src/api/audit.test.ts` from `ui/` — 30 tests passed.
- `pnpm --filter @paperclipai/ui typecheck` — passed.
- `pnpm check:token-gates` — passed.
- `pnpm -r typecheck` — passed.
- `pnpm build` — passed.
- `pnpm test:run` — the changed UI tests passed, but the full local
macOS run also hit existing failures in untouched server worktree and
temporary-path tests.
- GitHub verification — 30 checks passed, no checks failed, and the
Storybook job was intentionally skipped because this PR has no visual
changes.
- Greptile — 5/5 on `fbba29a2f`, with no open findings.

## Risks

- Low risk. Detection requires HTTP 401 and one exact top-level Cloud
error code.
- The recovery promise intentionally stays pending because document
navigation replaces the active SPA.
- If the Paperclip ID session has also expired, the existing Cloud
sign-in flow remains authoritative.
- This change does not modify APIs, cookies, token lifetimes, database
state, or Cloud server code.

> For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and
discuss it in `#dev` before opening the PR. Feature PRs that overlap
with planned core work may need to be redirected — check the roadmap
first. See `CONTRIBUTING.md`.

## Model Used

- OpenAI GPT-5 Codex. The agent runtime identifies the model as GPT-5.
The context-window size is not exposed. Reasoning, repository editing,
shell execution, test execution, and GitHub CLI tool use were enabled.

## Checklist

- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [x] All Paperclip CI gates are green
- [x] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge

---------

Co-authored-by: Paperclip <noreply@paperclip.ing>
2026-09-04 07:29:14 -05:00

202 lines
6.9 KiB
TypeScript

import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
import {
createTenantSessionRecoveryCoordinator,
tenantSessionRecovery,
} from "@/lib/tenant-session-recovery";
import { __inflightGetCount, api, detachInflightGet } from "./client";
interface Deferred<T> {
promise: Promise<T>;
resolve: (value: T) => void;
reject: (reason?: unknown) => void;
}
function deferred<T>(): Deferred<T> {
let resolve!: (value: T) => void;
let reject!: (reason?: unknown) => void;
const promise = new Promise<T>((res, rej) => {
resolve = res;
reject = rej;
});
return { promise, resolve, reject };
}
function jsonResponse(body: unknown) {
return { ok: true, status: 200, json: async () => body } as unknown as Response;
}
function errorResponse(body: unknown, status = 401) {
return { ok: false, status, json: async () => body } as unknown as Response;
}
const fetchMock = vi.fn();
beforeEach(() => {
fetchMock.mockReset();
vi.stubGlobal("fetch", fetchMock);
});
afterEach(() => {
vi.restoreAllMocks();
vi.unstubAllGlobals();
});
describe("tenant-session recovery", () => {
it("keeps concurrent failures pending and schedules one top-level reload", async () => {
const reload = vi.fn();
const recovery = createTenantSessionRecoveryCoordinator(reload);
vi.spyOn(tenantSessionRecovery, "recoverIfNeeded").mockImplementation(recovery.recoverIfNeeded);
fetchMock.mockResolvedValue(errorResponse({ error: "tenant_session_required" }));
const first = api.post("/tenant-session-a", { value: 1 });
const second = api.post("/tenant-session-b", { value: 2 });
await vi.waitFor(() => {
expect(tenantSessionRecovery.recoverIfNeeded).toHaveBeenCalledTimes(2);
expect(reload).toHaveBeenCalledTimes(1);
});
expect(fetchMock).toHaveBeenCalledTimes(2);
let settled = false;
void Promise.all([first, second]).then(
() => { settled = true; },
() => { settled = true; },
);
await Promise.resolve();
expect(settled).toBe(false);
});
it("preserves ApiError handling for an unrelated 401", async () => {
fetchMock.mockResolvedValue(errorResponse({ error: "unauthorized" }));
await expect(api.get("/ordinary-401")).rejects.toMatchObject({
name: "ApiError",
status: 401,
message: "unauthorized",
});
});
});
describe("in-tab GET coalescing", () => {
it("shares one underlying fetch for identical in-flight GETs", async () => {
const d = deferred<Response>();
fetchMock.mockReturnValue(d.promise);
const p1 = api.get("/coalesce-a");
const p2 = api.get("/coalesce-a");
expect(fetchMock).toHaveBeenCalledTimes(1);
expect(__inflightGetCount()).toBe(1);
d.resolve(jsonResponse({ value: 1 }));
expect(await p1).toEqual({ value: 1 });
expect(await p2).toEqual({ value: 1 });
// Entry cleared once settled.
expect(__inflightGetCount()).toBe(0);
});
it("issues a fresh fetch after the previous one settles", async () => {
fetchMock.mockResolvedValue(jsonResponse({ value: "x" }));
await api.get("/coalesce-b");
await api.get("/coalesce-b");
expect(fetchMock).toHaveBeenCalledTimes(2);
});
it("does not coalesce different paths", async () => {
fetchMock.mockReturnValue(deferred<Response>().promise);
const c1 = new AbortController();
const c2 = new AbortController();
const p1 = api.get("/path-1", { signal: c1.signal });
const p2 = api.get("/path-2", { signal: c2.signal });
expect(fetchMock).toHaveBeenCalledTimes(2);
// Clean up the never-settling shared entries so the module map does not leak.
c1.abort();
c2.abort();
await expect(p1).rejects.toMatchObject({ name: "AbortError" });
await expect(p2).rejects.toMatchObject({ name: "AbortError" });
});
it("stops later callers joining a detached in-flight GET", async () => {
// A GET issued under one account's session must not answer a caller that
// runs after the account changed.
const first = deferred<Response>();
fetchMock.mockReturnValueOnce(first.promise);
const previousAccount = api.get("/detach-me");
expect(__inflightGetCount()).toBe(1);
detachInflightGet("/detach-me");
expect(__inflightGetCount()).toBe(0);
const second = deferred<Response>();
fetchMock.mockReturnValueOnce(second.promise);
const currentAccount = api.get("/detach-me");
expect(fetchMock).toHaveBeenCalledTimes(2);
// Each caller gets its own response, not the other's.
first.resolve(jsonResponse({ companies: ["previous"] }));
second.resolve(jsonResponse({ companies: ["current"] }));
expect(await previousAccount).toEqual({ companies: ["previous"] });
expect(await currentAccount).toEqual({ companies: ["current"] });
expect(__inflightGetCount()).toBe(0);
});
it("never coalesces mutations", async () => {
fetchMock.mockResolvedValue(jsonResponse({ ok: true }));
await Promise.all([api.post("/mutate", { a: 1 }), api.post("/mutate", { a: 1 })]);
expect(fetchMock).toHaveBeenCalledTimes(2);
});
});
describe("per-caller abort semantics", () => {
it("aborting one caller rejects only that caller, not the shared fetch", async () => {
const d = deferred<Response>();
let sharedSignal: AbortSignal | undefined;
fetchMock.mockImplementation((_url: string, init: RequestInit) => {
sharedSignal = init.signal ?? undefined;
return d.promise;
});
const c1 = new AbortController();
const c2 = new AbortController();
const p1 = api.get("/abort-a", { signal: c1.signal });
const p2 = api.get("/abort-a", { signal: c2.signal });
c1.abort();
await expect(p1).rejects.toMatchObject({ name: "AbortError" });
// The shared fetch is still alive because caller 2 has not aborted.
expect(sharedSignal?.aborted).toBe(false);
d.resolve(jsonResponse({ value: 2 }));
expect(await p2).toEqual({ value: 2 });
});
it("aborts the shared fetch once every caller has aborted", async () => {
const d = deferred<Response>();
let sharedSignal: AbortSignal | undefined;
fetchMock.mockImplementation((_url: string, init: RequestInit) => {
sharedSignal = init.signal ?? undefined;
return d.promise;
});
const c1 = new AbortController();
const c2 = new AbortController();
const p1 = api.get("/abort-b", { signal: c1.signal });
const p2 = api.get("/abort-b", { signal: c2.signal });
c1.abort();
c2.abort();
await expect(p1).rejects.toMatchObject({ name: "AbortError" });
await expect(p2).rejects.toMatchObject({ name: "AbortError" });
expect(sharedSignal?.aborted).toBe(true);
expect(__inflightGetCount()).toBe(0);
});
it("rejects immediately if the caller signal is already aborted", async () => {
const controller = new AbortController();
controller.abort();
await expect(api.get("/already-aborted", { signal: controller.signal })).rejects.toMatchObject({
name: "AbortError",
});
expect(fetchMock).not.toHaveBeenCalled();
});
});