[roncodes]

What

Authenticates the driver's realtime socket in both client trees:

• v2 contexts (SocketClusterContext.native.tsx / .web.tsx, AuthContext.tsx, OrderScreen.tsx) and src/services/socket-auth.ts: already on release/v3.0.0 through feat(socket-auth): authenticate realtime socket with driver socket tokens #112. This PR does not change them.
• v3 SocketProvider (src/v3/realtime/SocketProvider.tsx): new in this PR. It uses the same in-memory auth session, src/services/socket-auth.ts.

How

• The handshake carries a short-lived socket token minted for the signed-in driver from POST {host}/{namespace}/socket/token, sent with the driver bearer. It goes through a custom in-memory authEngine: loadToken fetches when there is no token or it is within 60 s of expiry.
• The token is refreshed at expires_in - 60s with socket.authenticate.
• On deauthenticate, kickOut or subscribeFail, the app fetches a fresh token, re-authenticates, and resubscribes every channel listen still holds. Channels are reference-counted, so a channel two listeners share is not closed while the second one still needs it. Handler and loop errors still never end the connection.
• In v3, V3App passes the API host, the driver bearer (userToken) and a session key to SocketProvider. The session key combines AuthContext's sessionEpoch, the driver and the organisation. The socket is rebuilt on login, logout, organisation switch and instance reconfiguration (API host or socket config).
• The handshake query identifies the client as navigator/<version>.
• The token is kept in memory only. It is never written to AsyncStorage, MMKV or localStorage, and never put in the socket URL.

Old servers

If the server has no socket token route (it answers 404), the socket connects anonymously for that session, the same as before this change. It also connects anonymously while no driver is signed in.

Why a new PR

This PR was meant to replace #112, whose branch was cut from main and carried the v2.0.11 release commits into v3. #112 has since been merged into feature/v3-redesign and from there into release/v3.0.0 (#109), so its v2 socket-auth commit and those v2.0.11 commits are already in this base. This branch is release/v3.0.0 plus one commit, the v3 SocketProvider work.

Tests

• src/v3/realtime/__tests__/SocketProvider.test.tsx covers:
  • the token in the handshake, and that it is not in the URL or query
  • the client tag
  • anonymous fallback on 404 and when signed out
  • refresh one minute before expiry
  • re-authentication and resubscribe after each of deauthenticate, kickOut and subscribeFail
  • no resubscribe of a released channel
  • rebuild on session change and sign-out
• __tests__/SocketAuth-test.js is unchanged.

The repo's CI workflow only runs on PRs to main and does not run yarn test, so these suites need a manual yarn jest src/v3/realtime __tests__/SocketAuth-test.js run before merge.

Related PRs

• feat(socket-auth): authenticated realtime channels (tokens, authorizer, signed publish) core-api#290
• feat(socket-auth): fleetops channel resolvers, driver socket tokens, per-customer tracking channel fleetops#358
• feat(socket-auth): Fleetbase socket server with JWT auth and signed internal publish fleetbase#704
• Feature/socket auth fleetbase#710