fix(auth): acknowledge QR login before authentication completes

.github/workflows/linejs-auto-update.yml

@@ -1,13 +1,9 @@
 name: LINEJS auto update
 
 on:
+  # Run on every PR. Path filters can leave required checks permanently pending
+  # when a PR changes files outside the filter, blocking merge without a job.
   pull_request:
-    paths:
-      - 'package.json'
-      - 'bun.lock'
-      - 'engine/linejs/**'
-      - 'scripts/*linejs*'
-      - '.github/workflows/linejs-auto-update.yml'
   workflow_dispatch:
   schedule:
     - cron: '17 */6 * * *'

engine/auth/auth-finalization.test.ts

@@ -0,0 +1,132 @@
+import { describe, expect, test } from "bun:test";
+import { createAuthFinalizationBarrier } from "./auth-finalization";
+
+describe("auth finalization barrier", () => {
+  test("waits for an active finalization to settle", async () => {
+    const barrier = createAuthFinalizationBarrier();
+    let settle!: () => void;
+    const operation = barrier.track(() => new Promise<void>((resolve) => {
+      settle = resolve;
+    }));
+    let waited = false;
+    const waiting = barrier.wait().then(() => { waited = true; });
+
+    await Promise.resolve();
+    expect(waited).toBe(false);
+    settle();
+    await Promise.all([operation, waiting]);
+    expect(waited).toBe(true);
+  });
+
+  test("does not let a rejected finalization block logout cleanup", async () => {
+    const barrier = createAuthFinalizationBarrier();
+    const operation = barrier.track(async () => {
+      throw new Error("finalization failed");
+    });
+    await expect(operation).rejects.toThrow("finalization failed");
+    await expect(barrier.wait()).resolves.toBeUndefined();
+  });
+
+  test("does not wait after the finalization has settled", async () => {
+    const barrier = createAuthFinalizationBarrier();
+    await barrier.track(async () => undefined);
+    await expect(barrier.wait()).resolves.toBeUndefined();
+  });
+
+  test("waits for every concurrently tracked finalization", async () => {
+    const barrier = createAuthFinalizationBarrier();
+    let settleFirst!: () => void;
+    let settleSecond!: () => void;
+    const first = barrier.track(() => new Promise<void>((resolve) => {
+      settleFirst = resolve;
+    }));
+    const second = barrier.track(() => new Promise<void>((resolve) => {
+      settleSecond = resolve;
+    }));
+    let waited = false;
+    const waiting = barrier.wait().then(() => { waited = true; });
+
+    await Promise.resolve();
+    settleFirst();
+    await first;
+    await Promise.resolve();
+    expect(waited).toBe(false);
+
+    settleSecond();
+    await Promise.all([second, waiting]);
+    expect(waited).toBe(true);
+  });
+
+  test("waits for a finalization registered while waiting", async () => {
+    const barrier = createAuthFinalizationBarrier();
+    let settleFirst!: () => void;
+    let settleSecond!: () => void;
+    const first = barrier.track(() => new Promise<void>((resolve) => {
+      settleFirst = resolve;
+    }));
+    let waited = false;
+    const waiting = barrier.wait().then(() => { waited = true; });
+
+    await Promise.resolve();
+    const second = barrier.track(() => new Promise<void>((resolve) => {
+      settleSecond = resolve;
+    }));
+    await Promise.resolve();
+    settleFirst();
+    await first;
+    await Promise.resolve();
+    expect(waited).toBe(false);
+
+    settleSecond();
+    await Promise.all([second, waiting]);
+    expect(waited).toBe(true);
+  });
+
+  test("logout clears auth-storage writes that finish after logout starts", async () => {
+    const barrier = createAuthFinalizationBarrier();
+    const durable = new Map<string, string>();
+    let generation = 0;
+    let finishWrite!: () => void;
+
+    const finalization = barrier.track(async () => {
+      if (generation !== 0) return;
+      await new Promise<void>((resolve) => { finishWrite = resolve; });
+      // The write was already inside the barrier when Logout invalidated it.
+      durable.set("refreshToken", "late-token");
+    });
+
+    // Ensure the finalizer has entered its protected write before Logout.
+    while (!finishWrite) await Promise.resolve();
+    generation += 1;
+    let logoutFinished = false;
+    const logout = barrier.wait().then(() => {
+      durable.clear();
+      logoutFinished = true;
+    });
+
+    expect(logoutFinished).toBe(false);
+    finishWrite();
+    await Promise.all([finalization, logout]);
+
+    expect(logoutFinished).toBe(true);
+    expect(durable.size).toBe(0);
+  });
+
+  test("does not commit auth storage when logout invalidates before finalization", async () => {
+    const barrier = createAuthFinalizationBarrier();
+    const durable = new Map<string, string>();
+    let generation = 1;
+
+    const result = await barrier.track(async () => {
+      if (generation !== 1) return false;
+      durable.set("refreshToken", "stale-token");
+      return true;
+    });
+
+    expect(result).toBe(true);
+    generation += 1;
+    await barrier.wait();
+    durable.clear();
+    expect(durable.size).toBe(0);
+  });
+});

engine/auth/auth-finalization.ts

@@ -0,0 +1,28 @@
+/**
+ * Tracks asynchronous session-finalization phases so logout can invalidate
+ * attempts immediately, then wait for every in-flight finalizer before
+ * clearing shared account and credential state.
+ */
+export function createAuthFinalizationBarrier() {
+  const pending = new Set<Promise<void>>();
+
+  return {
+    track<T>(operation: () => Promise<T>): Promise<T> {
+      const task = Promise.resolve().then(operation);
+      // Track a non-rejecting promise so a failed finalizer cannot leave the
+      // barrier permanently blocked or create an unhandled rejection.
+      const settled = task.then(() => undefined, () => undefined);
+      pending.add(settled);
+      void settled.then(() => pending.delete(settled));
+      return task;
+    },
+
+    async wait(): Promise<void> {
+      // Loop because another finalizer may be registered while we are waiting
+      // for the current batch to settle.
+      while (pending.size > 0) {
+        await Promise.all([...pending]);
+      }
+    },
+  };
+}

engine/auth/login-guard.test.ts

@@ -0,0 +1,46 @@
+import { describe, expect, test } from "bun:test";
+import { createLoginAttemptGuard } from "./login-guard";
+
+describe("login attempt guard", () => {
+  test("rejects overlapping authentication attempts", () => {
+    const guard = createLoginAttemptGuard();
+    const release = guard.tryAcquire();
+
+    expect(release).toBeTypeOf("function");
+    expect(guard.isLocked()).toBe(true);
+    expect(guard.tryAcquire()).toBeNull();
+
+    release?.();
+    expect(guard.isLocked()).toBe(false);
+    expect(guard.tryAcquire()).toBeTypeOf("function");
+  });
+
+  test("keeps a stale attempt locked until its owner settles", () => {
+    const guard = createLoginAttemptGuard();
+    let settle!: () => void;
+    const pending = new Promise<void>((resolve) => {
+      settle = resolve;
+    });
+    const release = guard.tryAcquire();
+
+    expect(guard.tryAcquire()).toBeNull();
+    settle();
+    expect(guard.isLocked()).toBe(true);
+
+    return pending.then(() => {
+      release?.();
+      expect(guard.isLocked()).toBe(false);
+    });
+  });
+
+  test("release is idempotent", () => {
+    const guard = createLoginAttemptGuard();
+    const release = guard.tryAcquire();
+
+    release?.();
+    release?.();
+
+    expect(guard.isLocked()).toBe(false);
+    expect(guard.tryAcquire()).toBeTypeOf("function");
+  });
+});

engine/auth/login-guard.ts

@@ -0,0 +1,27 @@
+export type ReleaseLoginAttempt = () => void;
+
+/**
+ * Serializes authentication flows that share LINEJS credential storage.
+ * The owner releases the lock only after its underlying LINEJS operation settles.
+ */
+export function createLoginAttemptGuard() {
+  let locked = false;
+
+  return {
+    isLocked(): boolean {
+      return locked;
+    },
+
+    tryAcquire(): ReleaseLoginAttempt | null {
+      if (locked) return null;
+      locked = true;
+      let released = false;
+
+      return () => {
+        if (released) return;
+        released = true;
+        locked = false;
+      };
+    },
+  };
+}