fix(user_status): stop the heartbeat firing on every mouse movement

The away countdown was cancelled by passing the callback function to
clearTimeout() instead of the id returned by setTimeout(), so the clear
did nothing and the id was thrown away. Every burst of mouse movement
scheduled another two minute timer that nothing could cancel, and each
one that expired marked an active user as away. The next movement
flipped them back and sent a heartbeat, so an ordinary browsing session
sent around 600 heartbeats an hour instead of the 13 the code intends.

The scheduling now lives in its own module, which makes it testable
without mounting the component and gives the timers a single owner. That
also fixes the teardown: the listener was registered as "mousemove" with
capture and removed as "mouseMove" without it, so it was never actually
removed and every unmounted component leaked one.

Signed-off-by: Git'Fellow <12234510+solracsf@users.noreply.github.com>

Author: solracsf

apps/user_status/src/UserStatus.vue

@@ -40,13 +40,13 @@
 <script>
 import { getCurrentUser } from '@nextcloud/auth'
 import { subscribe, unsubscribe } from '@nextcloud/event-bus'
-import debounce from 'debounce'
 import { defineAsyncComponent } from 'vue'
 import NcButton from '@nextcloud/vue/components/NcButton'
 import NcListItem from '@nextcloud/vue/components/NcListItem'
 import NcUserStatusIcon from '@nextcloud/vue/components/NcUserStatusIcon'
 import { logger } from './logger.ts'
 import OnlineStatusMixin from './mixins/OnlineStatusMixin.js'
+import { startHeartbeat } from './services/heartbeatScheduler.ts'
 import { sendHeartbeat } from './services/heartbeatService.js'
 
 export default {
@@ -75,11 +75,8 @@ export default {
 
 	data() {
 		return {
-			heartbeatInterval: null,
-			isAway: false,
 			isModalOpen: false,
-			mouseMoveListener: null,
-			setAwayTimeout: null,
+			stopHeartbeat: null,
 		}
 	},
 
@@ -91,31 +88,7 @@ export default {
 		this.$store.dispatch('loadStatusFromInitialState')
 
 		if (OC.config.session_keepalive) {
-			// Send the latest status to the server every 5 minutes
-			this.heartbeatInterval = setInterval(this._backgroundHeartbeat.bind(this), 1000 * 60 * 5)
-			this.setAwayTimeout = () => {
-				this.isAway = true
-			}
-			// Catch mouse movements, but debounce to once every 30 seconds
-			this.mouseMoveListener = debounce(() => {
-				const wasAway = this.isAway
-				this.isAway = false
-				// Reset the two minute counter
-				clearTimeout(this.setAwayTimeout)
-				// If the user did not move the mouse within two minutes,
-				// mark them as away
-				setTimeout(this.setAwayTimeout, 1000 * 60 * 2)
-
-				if (wasAway) {
-					this._backgroundHeartbeat()
-				}
-			}, 1000 * 2, { immediate: true })
-			window.addEventListener('mousemove', this.mouseMoveListener, {
-				capture: true,
-				passive: true,
-			})
-
-			this._backgroundHeartbeat()
+			this.stopHeartbeat = startHeartbeat((isAway) => this._backgroundHeartbeat(isAway))
 		}
 		subscribe('user_status:status.updated', this.handleUserStatusUpdated)
 	},
@@ -124,8 +97,7 @@ export default {
 	 * Some housekeeping before destroying the component
 	 */
 	beforeUnmount() {
-		window.removeEventListener('mouseMove', this.mouseMoveListener)
-		clearInterval(this.heartbeatInterval)
+		this.stopHeartbeat?.()
 		unsubscribe('user_status:status.updated', this.handleUserStatusUpdated)
 	},
 
@@ -147,12 +119,13 @@ export default {
 		/**
 		 * Sends the status heartbeat to the server
 		 *
+		 * @param {boolean} isAway Whether the user is currently away
 		 * @return {Promise<void>}
 		 * @private
 		 */
-		async _backgroundHeartbeat() {
+		async _backgroundHeartbeat(isAway) {
 			try {
-				const status = await sendHeartbeat(this.isAway)
+				const status = await sendHeartbeat(isAway)
 				if (status?.userId) {
 					this.$store.dispatch('setStatusFromHeartbeat', status)
 				} else {

apps/user_status/src/services/heartbeatScheduler.spec.ts

@@ -0,0 +1,121 @@
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+import { afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+	AWAY_TIMEOUT,
+	HEARTBEAT_INTERVAL,
+	MOUSE_MOVE_DEBOUNCE,
+	startHeartbeat,
+} from './heartbeatScheduler.ts'
+
+const HOUR = 60 * 60 * 1000
+
+let stop: (() => void) | undefined
+
+/**
+ * Move the mouse for a second, then hold still.
+ *
+ * @param gap - Milliseconds of stillness after the burst
+ */
+async function moveThenRest(gap: number): Promise<void> {
+	for (let i = 0; i < 10; i++) {
+		window.dispatchEvent(new MouseEvent('mousemove'))
+		await vi.advanceTimersByTimeAsync(100)
+	}
+	await vi.advanceTimersByTimeAsync(gap)
+}
+
+describe('heartbeat scheduler', () => {
+	beforeAll(() => {
+		// `debounce` compares Date.now() against its own timestamp, so Date has to stay faked alongside the timers
+		vi.useFakeTimers()
+	})
+
+	beforeEach(() => {
+		vi.clearAllTimers()
+		vi.resetAllMocks()
+	})
+
+	afterEach(() => {
+		stop?.()
+		stop = undefined
+	})
+
+	it('sends a heartbeat on start', () => {
+		const beat = vi.fn()
+		stop = startHeartbeat(beat)
+
+		expect(beat).toHaveBeenCalledTimes(1)
+		expect(beat).toHaveBeenCalledWith(false)
+	})
+
+	it('sends a heartbeat every five minutes', async () => {
+		const beat = vi.fn()
+		stop = startHeartbeat(beat)
+
+		await vi.advanceTimersByTimeAsync(HEARTBEAT_INTERVAL - 1000)
+		expect(beat).toHaveBeenCalledTimes(1)
+
+		await vi.advanceTimersByTimeAsync(1000)
+		expect(beat).toHaveBeenCalledTimes(2)
+
+		await vi.advanceTimersByTimeAsync(HEARTBEAT_INTERVAL)
+		expect(beat).toHaveBeenCalledTimes(3)
+	})
+
+	it('does not send extra heartbeats while the user keeps moving the mouse', async () => {
+		const beat = vi.fn()
+		stop = startHeartbeat(beat)
+
+		const cycle = 1000 + 5000
+		for (let elapsed = 0; elapsed < HOUR; elapsed += cycle) {
+			await moveThenRest(5000)
+		}
+
+		expect(beat).toHaveBeenCalledTimes(1 + HOUR / HEARTBEAT_INTERVAL)
+		// the away countdown is restarted, never accumulated
+		expect(vi.getTimerCount()).toBeLessThanOrEqual(3)
+	})
+
+	it('reports the user as away after two minutes without mouse movement', async () => {
+		const beat = vi.fn()
+		stop = startHeartbeat(beat)
+
+		window.dispatchEvent(new MouseEvent('mousemove'))
+		await vi.advanceTimersByTimeAsync(AWAY_TIMEOUT + 1000)
+
+		await vi.advanceTimersByTimeAsync(HEARTBEAT_INTERVAL - AWAY_TIMEOUT - 1000)
+		expect(beat).toHaveBeenLastCalledWith(true)
+	})
+
+	it('sends one heartbeat when the user comes back from being away', async () => {
+		const beat = vi.fn()
+		stop = startHeartbeat(beat)
+
+		window.dispatchEvent(new MouseEvent('mousemove'))
+		await vi.advanceTimersByTimeAsync(AWAY_TIMEOUT + MOUSE_MOVE_DEBOUNCE)
+		const beforeReturn = beat.mock.calls.length
+
+		window.dispatchEvent(new MouseEvent('mousemove'))
+		expect(beat).toHaveBeenCalledTimes(beforeReturn + 1)
+		expect(beat).toHaveBeenLastCalledWith(false)
+	})
+
+	it('stops the interval, the away countdown and the mouse listener', async () => {
+		const beat = vi.fn()
+		const stopHeartbeat = startHeartbeat(beat)
+		window.dispatchEvent(new MouseEvent('mousemove'))
+
+		stopHeartbeat()
+
+		await vi.advanceTimersByTimeAsync(3 * HEARTBEAT_INTERVAL)
+		window.dispatchEvent(new MouseEvent('mousemove'))
+		await vi.advanceTimersByTimeAsync(3 * HEARTBEAT_INTERVAL)
+
+		expect(beat).toHaveBeenCalledTimes(1)
+		expect(vi.getTimerCount()).toBe(0)
+	})
+})

apps/user_status/src/services/heartbeatScheduler.ts

@@ -0,0 +1,53 @@
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+import debounce from 'debounce'
+
+/** Has to stay below the server margin between `StatusService::REFRESH_STATUS_THRESHOLD` and `StatusService::INVALIDATE_STATUS_THRESHOLD`. */
+export const HEARTBEAT_INTERVAL = 5 * 60 * 1000
+
+export const AWAY_TIMEOUT = 2 * 60 * 1000
+
+export const MOUSE_MOVE_DEBOUNCE = 2 * 1000
+
+/**
+ * Send heartbeats on a fixed interval, and once more whenever the user comes back from being away.
+ *
+ * @param beat - Called with the current away state when a heartbeat is due
+ * @return Function that stops the heartbeat and removes every timer and listener
+ */
+export function startHeartbeat(beat: (isAway: boolean) => void): () => void {
+	let isAway = false
+	let awayTimeout: ReturnType<typeof setTimeout> | undefined
+
+	const onMouseMove = debounce(() => {
+		const wasAway = isAway
+		isAway = false
+
+		clearTimeout(awayTimeout)
+		awayTimeout = setTimeout(() => {
+			isAway = true
+		}, AWAY_TIMEOUT)
+
+		if (wasAway) {
+			beat(isAway)
+		}
+	}, MOUSE_MOVE_DEBOUNCE, { immediate: true })
+
+	const interval = setInterval(() => beat(isAway), HEARTBEAT_INTERVAL)
+	window.addEventListener('mousemove', onMouseMove, {
+		capture: true,
+		passive: true,
+	})
+
+	beat(isAway)
+
+	return () => {
+		clearInterval(interval)
+		clearTimeout(awayTimeout)
+		onMouseMove.clear()
+		window.removeEventListener('mousemove', onMouseMove, { capture: true })
+	}
+}