Stop a client-side session age check from signing users out and dropping GPS trips

src/components/GPSTripStateChecker/index.native.tsx

@@ -4,6 +4,7 @@ import useLocalize from '@hooks/useLocalize';
 import useNetwork from '@hooks/useNetwork';
 import useOnyx from '@hooks/useOnyx';
 
+import {resetGPSDraftDetails} from '@libs/actions/GPSDraftDetails';
 import {getGpsPoints, stopGpsTrip} from '@libs/GPSDraftDetailsUtils';
 import Navigation from '@libs/Navigation/Navigation';
 import {generateReportID} from '@libs/ReportUtils';
@@ -16,6 +17,7 @@ import ONYXKEYS from '@src/ONYXKEYS';
 import ROUTES from '@src/ROUTES';
 import {useSplashScreenState} from '@src/SplashScreenStateContext';
 
+import {accountIDSelector} from '@selectors/Session';
 import {hasStartedLocationUpdatesAsync, startLocationUpdatesAsync, stopLocationUpdatesAsync} from 'expo-location';
 import React, {useEffect, useState} from 'react';
 import OnyxUtils from 'react-native-onyx/dist/OnyxUtils';
@@ -27,6 +29,8 @@ function GPSTripStateChecker() {
     const {translate} = useLocalize();
     const [showContinueTripModal, setShowContinueTripModal] = useState(false);
     const [gpsDraftDetails] = useOnyx(ONYXKEYS.GPS_DRAFT_DETAILS);
+    const [currentAccountID, currentAccountIDResult] = useOnyx(ONYXKEYS.SESSION, {selector: accountIDSelector});
+    const isSessionLoaded = currentAccountIDResult.status === 'loaded';
     const {isOffline} = useNetwork();
 
     const {splashScreenState} = useSplashScreenState();
@@ -36,6 +40,27 @@ function GPSTripStateChecker() {
     useUpdateGpsTripOnReconnect({gpsPoints: getGpsPoints(gpsDraftDetails)});
     useUpdateGpsNotification();
 
+    // A trip kept across a forced re-auth belongs to whoever started it. Wait for the session to load before
+    // judging that, otherwise a trip would be discarded just because the accountID had not arrived yet.
+    const isTripFromDifferentUser = isSessionLoaded && !!gpsDraftDetails && gpsDraftDetails.accountID !== currentAccountID;
+
+    useEffect(() => {
+        if (!isTripFromDifferentUser) {
+            return;
+        }
+
+        resetGPSDraftDetails();
+        hasStartedLocationUpdatesAsync(BACKGROUND_LOCATION_TRACKING_TASK_NAME).then((isRunning) => {
+            if (!isRunning) {
+                return;
+            }
+
+            stopLocationUpdatesAsync(BACKGROUND_LOCATION_TRACKING_TASK_NAME).catch((error) =>
+                console.error('[GPS distance request] Failed to stop tracking for a trip from another user', error),
+            );
+        });
+    }, [isTripFromDifferentUser]);
+
     useEffect(() => {
         async function handleGpsTripInProgressOnAppRestart() {
             await checkAndCleanGpsNotification();
@@ -111,7 +136,7 @@ function GPSTripStateChecker() {
 
     return (
         <ConfirmModal
-            isVisible={showContinueTripModal && splashScreenState === CONST.BOOT_SPLASH_STATE.HIDDEN}
+            isVisible={showContinueTripModal && !!gpsDraftDetails?.isTracking && !isTripFromDifferentUser && splashScreenState === CONST.BOOT_SPLASH_STATE.HIDDEN}
             title={translate('gps.continueGpsTripModal.title')}
             prompt={translate('gps.continueGpsTripModal.prompt')}
             shouldReverseStackedButtons

src/components/Image/getImageSource.ts

@@ -10,22 +10,27 @@ type GetImageSourceParams = {
     session: Session | undefined;
     isAuthTokenRequired: boolean;
     isOffline: boolean;
+
+    /** Whether the auth token can still be refreshed in the background */
+    canReauthenticateSilently: boolean;
 };
 
 type GetImageSourceReturn = {
     source: ImageProps['source'];
     shouldReauthenticate: boolean;
 };
 
-export default function getImageSource({propsSource, session, isAuthTokenRequired, isOffline}: GetImageSourceParams): GetImageSourceReturn {
+export default function getImageSource({propsSource, session, isAuthTokenRequired, isOffline, canReauthenticateSilently}: GetImageSourceParams): GetImageSourceReturn {
     if (typeof propsSource === 'object' && propsSource !== null && 'uri' in propsSource) {
         if (typeof propsSource.uri === 'number') {
             return {source: propsSource.uri, shouldReauthenticate: false};
         }
 
         const authToken = session?.encryptedAuthToken ?? null;
         if (isAuthTokenRequired && authToken) {
-            if (isOffline || (!!session?.creationDate && !isExpiredSession(session.creationDate))) {
+            // The age check is a client-side guess, not proof the token is dead. Without a way to refresh it,
+            // blanking the image only loses a working attachment, so keep serving the token we already have.
+            if (isOffline || !canReauthenticateSilently || (!!session?.creationDate && !isExpiredSession(session.creationDate))) {
                 return {
                     source: {
                         ...propsSource,

src/components/Image/index.tsx

@@ -5,6 +5,7 @@ import useNetwork from '@hooks/useNetwork';
 
 import {isExpiredSession} from '@libs/actions/Session';
 import activateReauthenticator from '@libs/actions/Session/AttachmentImageReauthenticator';
+import {canReauthenticateSilently} from '@libs/Reauthentication';
 
 import CONST from '@src/CONST';
 
@@ -128,6 +129,7 @@ function Image({
             session,
             isAuthTokenRequired,
             isOffline,
+            canReauthenticateSilently: canReauthenticateSilently(),
         });
 
         if (resolvedImageSource.shouldReauthenticate && session) {

src/libs/Reauthentication.ts

@@ -165,6 +165,27 @@ function getAuthenticationErrorResponse(error: HttpsError): Response<OnyxKey> {
     };
 }
 
+/**
+ * Whether `reauthenticate()` could refresh the token in the background. When it cannot it can only end in
+ * `redirectToSignIn`, so a caller that is only guessing the session went stale must not trigger it.
+ * Mirrors the two branches below that redirect to sign in, and lives here so they cannot drift apart.
+ */
+function canReauthenticateSilently(): boolean {
+    if (account?.isSAMLRequired && !isSupportSession && !isSupportAuthTokenUsed) {
+        return false;
+    }
+
+    const credentials = isConnectedAsDelegate({delegatedAccess: account?.delegatedAccess}) ? stashedCredentials : getCredentials();
+
+    // `undefined` means Onyx has not loaded credentials yet, unlike `null` which means there are none.
+    // Assume a refresh is possible until we know, so a render during startup is not treated as a dead session.
+    if (credentials === undefined) {
+        return true;
+    }
+
+    return !!credentials?.autoGeneratedLogin && !!credentials?.autoGeneratedPassword;
+}
+
 /**
  * Reauthenticate using the stored credentials and redirect to the sign in page if unable to do so.
  * @param [command] command name for logging purposes
@@ -368,3 +389,4 @@ function reauthenticate(command = ''): Promise<boolean> {
 }
 
 export default reauthenticate;
+export {canReauthenticateSilently};

src/libs/actions/GPSDraftDetails.ts

@@ -80,13 +80,14 @@ function removeLastSegment(gpsPoints: GPSPoint[][]) {
     });
 }
 
-function initGpsDraft(reportID: string, unit: Unit) {
+function initGpsDraft(reportID: string, unit: Unit, accountID?: number) {
     Onyx.merge(ONYXKEYS.GPS_DRAFT_DETAILS, {
         gpsPoints: [[]],
         isTracking: true,
         distanceInMeters: 0,
         reportID,
         unit,
+        accountID,
     });
 }
 

src/libs/actions/Session/AttachmentImageReauthenticator.ts

@@ -1,6 +1,6 @@
 import Log from '@libs/Log';
 import {getIsOffline} from '@libs/NetworkState';
-import reauthenticate from '@libs/Reauthentication';
+import reauthenticate, {canReauthenticateSilently} from '@libs/Reauthentication';
 
 import ONYXKEYS from '@src/ONYXKEYS';
 import type Session from '@src/types/onyx/Session';
@@ -54,7 +54,7 @@ function activate(session: Session) {
 }
 
 function tryReauthenticate() {
-    if (getIsOffline() || !active) {
+    if (getIsOffline() || !active || !canReauthenticateSilently()) {
         return;
     }
     reauthenticate().catch((error) => {

src/libs/actions/SignInRedirect.ts

@@ -91,6 +91,10 @@ function clearStorageAndRedirect(errorMessage?: string, isSAMLReauthentication?:
         keysToPreserve.push(ONYXKEYS.ACCOUNT);
         Onyx.merge(ONYXKEYS.CREDENTIALS, {login: currentSessionEmail, autoGeneratedLogin: null, autoGeneratedPassword: null});
         Onyx.merge(ONYXKEYS.ACCOUNT, {isLoading: true});
+
+        // A forced re-auth is involuntary, so an in-progress trip is kept and offered back on return.
+        // The trip records who started it, and GPSTripStateChecker drops it unless that user signs back in.
+        keysToPreserve.push(ONYXKEYS.GPS_DRAFT_DETAILS);
     }
 
     return Onyx.clear(keysToPreserve).then(async () => {

src/pages/iou/request/step/IOURequestStepDistanceGPS/GPSButtons/index.tsx

@@ -1,6 +1,7 @@
 import Button from '@components/ButtonComposed';
 import ConfirmModal from '@components/ConfirmModal';
 import {loadIllustration} from '@components/Icon/IllustrationLoader';
+import {useSession} from '@components/OnyxListItemProvider';
 
 import {useMemoizedLazyAsset} from '@hooks/useLazyAsset';
 import useLocalize from '@hooks/useLocalize';
@@ -53,6 +54,7 @@ function GPSButtons({navigateToNextStep, setShouldShowStartError, setShouldShowP
     const [showZeroDistanceModal, setShowZeroDistanceModal] = useState(false);
     const [showDisabledServicesModal, setShowDisabledServicesModal] = useState(false);
     const {isOffline} = useNetwork();
+    const session = useSession();
 
     const {asset: ReceiptLocationMarker} = useMemoizedLazyAsset(() => loadIllustration('ReceiptLocationMarker'));
     const [gpsDraftDetails] = useOnyx(ONYXKEYS.GPS_DRAFT_DETAILS);
@@ -93,7 +95,7 @@ function GPSButtons({navigateToNextStep, setShouldShowStartError, setShouldShowP
             return;
         }
 
-        initGpsDraft(reportID, unit);
+        initGpsDraft(reportID, unit, session?.accountID);
         startGpsTripNotification(translate, reportID, unit);
     };
 

src/types/onyx/GpsDraftDetails.ts

@@ -45,6 +45,9 @@ type GpsDraftDetails = {
     /** Distance unit of the ongoing GPS trip */
     unit: Unit;
 
+    /** accountID that started the trip, so a draft kept across a re-auth is never resumed by a different user */
+    accountID?: number;
+
     /**
      * Distance the user trimmed to in the Edit Stop screen.
      * When set, this is the distance shown to the user and used when creating the expense.

tests/actions/SessionTest.ts

@@ -35,6 +35,7 @@ import {openAuthSessionAsync} from 'expo-web-browser';
 import {clearTokenRefresh, removeAllFromAutoprefetch} from 'react-native-nitro-fetch';
 import Onyx from 'react-native-onyx';
 
+import getOnyxValue from '../utils/getOnyxValue';
 import * as TestHelper from '../utils/TestHelper';
 import waitForBatchedUpdates from '../utils/waitForBatchedUpdates';
 
@@ -1050,6 +1051,45 @@ describe('Session', () => {
         });
     });
 
+    describe('GPS trip on the sign in redirect', () => {
+        const gpsTrip = {
+            gpsPoints: [[{lat: 1, long: 2}]],
+            distanceInMeters: 100,
+            isTracking: true,
+            reportID: '1',
+            unit: CONST.CUSTOM_UNITS.DISTANCE_UNIT_MILES,
+        };
+
+        beforeEach(() => {
+            jest.restoreAllMocks();
+        });
+
+        test('keeps the in-progress trip when a SAML re-auth forces the redirect', async () => {
+            await TestHelper.signInWithTestUser();
+            const accountID = (await getOnyxValue(ONYXKEYS.SESSION))?.accountID;
+            await Onyx.merge(ONYXKEYS.GPS_DRAFT_DETAILS, {...gpsTrip, accountID});
+            await waitForBatchedUpdates();
+
+            await SignInRedirect.default(undefined, true);
+            await waitForBatchedUpdates();
+
+            const draft = await getOnyxValue(ONYXKEYS.GPS_DRAFT_DETAILS);
+            expect(draft?.isTracking).toBe(true);
+            expect(draft?.accountID).toBe(accountID);
+        });
+
+        test('discards the in-progress trip on a sign out redirect', async () => {
+            await TestHelper.signInWithTestUser();
+            await Onyx.merge(ONYXKEYS.GPS_DRAFT_DETAILS, gpsTrip);
+            await waitForBatchedUpdates();
+
+            await SignInRedirect.default();
+            await waitForBatchedUpdates();
+
+            expect(await getOnyxValue(ONYXKEYS.GPS_DRAFT_DETAILS)).toBeUndefined();
+        });
+    });
+
     describe('signIn', () => {
         test('sends the login and validate code arguments to the API, independent of the CREDENTIALS Onyx cache', async () => {
             const writeSpy = jest.spyOn(API, 'write').mockResolvedValue(undefined);

tests/unit/components/Image/getImageSource.test.ts

@@ -26,6 +26,7 @@ describe('getImageSource', () => {
                 session: undefined,
                 isAuthTokenRequired: false,
                 isOffline: false,
+                canReauthenticateSilently: true,
             }),
         ).toEqual({source, shouldReauthenticate: false});
     });
@@ -43,6 +44,7 @@ describe('getImageSource', () => {
                 session,
                 isAuthTokenRequired: true,
                 isOffline: false,
+                canReauthenticateSilently: true,
             }),
         ).toEqual({
             source: {
@@ -69,6 +71,7 @@ describe('getImageSource', () => {
                 session,
                 isAuthTokenRequired: true,
                 isOffline: true,
+                canReauthenticateSilently: true,
             }),
         ).toEqual({
             source: {
@@ -94,10 +97,38 @@ describe('getImageSource', () => {
                 session,
                 isAuthTokenRequired: true,
                 isOffline: false,
+                canReauthenticateSilently: true,
             }),
         ).toEqual({source: undefined, shouldReauthenticate: true});
     });
 
+    it('keeps serving the token on an expired-looking session when a background refresh is not possible', () => {
+        const propsSource = {uri: MOCK_URI};
+        const session: Session = {
+            encryptedAuthToken: MOCK_TOKEN,
+            creationDate: NOW.getTime() - CONST.SESSION_EXPIRATION_TIME_MS - 1,
+        };
+
+        expect(
+            getImageSource({
+                propsSource,
+                session,
+                isAuthTokenRequired: true,
+                isOffline: false,
+                canReauthenticateSilently: false,
+            }),
+        ).toEqual({
+            source: {
+                ...propsSource,
+                cacheKey: MOCK_URI,
+                headers: {
+                    [CONST.CHAT_ATTACHMENT_TOKEN_KEY]: MOCK_TOKEN,
+                },
+            },
+            shouldReauthenticate: false,
+        });
+    });
+
     it('preserves numeric image sources', () => {
         // @ts-expect-error -- Numeric object URIs intentionally exercise the runtime compatibility branch not represented by the public image source model.
         const propsSource: Parameters<typeof getImageSource>[0]['propsSource'] = {uri: 42};
@@ -108,6 +139,7 @@ describe('getImageSource', () => {
                 session: undefined,
                 isAuthTokenRequired: true,
                 isOffline: false,
+                canReauthenticateSilently: true,
             }),
         ).toEqual({source: 42, shouldReauthenticate: false});
     });