Skip to content

fix(server,host): emit the opening auth state and forward session activation - #393

Open
filvecchiato wants to merge 7 commits into
mainfrom
fix/initial-auth-state-and-session-restore
Open

fix(server,host): emit the opening auth state and forward session activation#393
filvecchiato wants to merge 7 commits into
mainfrom
fix/initial-auth-state-and-session-restore

Conversation

@filvecchiato

Copy link
Copy Markdown
Collaborator

Closes #389.

  • AuthStateMachine::transition also emits on the first attempt, so a signed-out boot reports Disconnected instead of silence. Two tests that asserted the silence now assert the emission.
  • WorkerPairingHostRuntime exposes activateStoredSession, activateExternalSession and resetSessionState, sharing one sessionActivationResponse reply and pending map; in-flight calls reject on worker teardown.
  • Host-level runtime only — session lifecycle is not product-scoped.

Verified: cargo test --workspace --all-features, cargo +nightly fmt --check, npm run build/npm test --prefix js/packages/truapi-host (44 pass, 3 new).

…ivation

The core reports the outcome of the host's first session reconciliation even
when it is the default Disconnected, and the worker runtime exposes
activateStoredSession, activateExternalSession and resetSessionState.
@filvecchiato
filvecchiato requested a review from a team August 14, 2026 08:58
Comment thread rust/crates/truapi-server/src/runtime/auth_state.rs Outdated
Comment thread js/packages/truapi-host/src/web/create-worker-host-runtime.ts
Comment thread rust/crates/truapi-server/src/runtime/auth_state.rs Outdated
Comment thread rust/crates/truapi-platform/src/lib.rs Outdated
Comment thread rust/crates/truapi-platform/src/lib.rs Outdated
…om:paritytech/truapi into fix/initial-auth-state-and-session-restore
…e-and-session-restore

# Conflicts:
#	js/packages/truapi-host/src/worker-runtime.ts
@filvecchiato
filvecchiato enabled auto-merge August 14, 2026 14:39
/// future resolves.
/// future resolves. Reports the resulting auth state to the host, including
/// when there was no session to restore.
pub(crate) async fn activate_stored_session(&self) -> Result<(), String> {

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Both activation entry points announce now, which is right. reset_session_state, further down at
line 780, does not, and it is the third call the worker exposes through the same
sessionActivationResponse reply. Tested: with a session active, reset emits Disconnected because
the state really changed; with nothing active it emits nothing at all. That silent case is the
"already signed out" one, where a host that waits for an auth state before routing cannot tell the
answer from no answer, which is the problem this PR closes everywhere else. Adding the same one-line
self.auth_state.announce_current(); at the end of reset_session_state would make all three calls
report.

* once product frames may use it, so a host can await this at boot before
* routing. Rejects when the runtime has been disposed or the worker faulted,
* so a host never routes on an activation that did not run.
*/

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It would be nice to document these three methods in js/packages/truapi-host/README.md as well.
activateStoredSession, activateExternalSession and resetSessionState are the answer to "how
does a browser host restore a session across a reload", and the README's worker example currently
stops at createProvider, so a host author has to read these types to find them. A few lines
showing the boot order, create the runtime, await activateStoredSession(), then open providers,
would make the fix discoverable. CLAUDE.md asks for README updates after any code change. The same subsection could also cover disconnectSession and notifySessionStoreChanged, which are
undocumented there too.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

A JS host cannot read the initial AuthState and cannot restore a stored session, so pairing does not survive a reload

3 participants