feat: Add resumeSession() to recover Web Auth logins after Android process death#1566
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds ChangesresumeSession() — Android process-death login recovery
Sequence Diagram(s)sequenceDiagram
participant App as React Native App (cold start)
participant Provider as Auth0Provider
participant Adapter as NativeWebAuthProvider
participant Bridge as NativeBridgeManager
participant Native as A0Auth0Module (Android)
participant SDK as WebAuthProvider (Auth0 Android SDK)
rect rgba(255, 165, 0, 0.5)
note over App,SDK: Android process-death recovery path
App->>Provider: resumeSession()
Provider->>Adapter: bridge.resumeSession()
Adapter->>Bridge: resumeWebAuthSession()
Bridge->>Native: resumeWebAuthSession (native call)
Native->>SDK: WebAuthProvider.registerCallbacks(lifecycle, ...)
SDK-->>Native: onSuccess(credentials) or timeout → null
Native-->>Bridge: Credentials | null
Bridge-->>Adapter: CredentialsModel | null
Adapter-->>Provider: Credentials | null
alt credentials returned
Provider->>Provider: derive user, saveCredentials, dispatch LOGIN_COMPLETE
Provider-->>App: Credentials
else null returned
Provider-->>App: null (no pending session)
end
end
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
| object : com.auth0.android.callback.Callback<Credentials, AuthenticationException> { | ||
| // start() registers a LifecycleObserver internally (Auth0.Android 3.19.0+ for | ||
| // process-death recovery), which must happen on the main thread. | ||
| UiThreadUtil.runOnUiThread { |
There was a problem hiding this comment.
where is UiThreadUtil located? is it auth0.android api or inbuilt api from android SDK
There was a problem hiding this comment.
its from com.facebook.react.bridge.UiThreadUtil a react native built-in library
| object : com.auth0.android.callback.Callback<Credentials, AuthenticationException> { | ||
| // start() registers a LifecycleObserver internally (Auth0.Android 3.19.0+ for | ||
| // process-death recovery), which must happen on the main thread. | ||
| UiThreadUtil.runOnUiThread { |
There was a problem hiding this comment.
Whats the need to explicitly put it to uiThread here ? Isn't this callback executed in UI thread ? Would there be any issues if this is not added ?
There was a problem hiding this comment.
as auth0.android usage LifecycleObserver, that can't be run on without main thread, otherwise it throws IllegalStateException.
| // Safety net for the rare case where the restored token exchange is still in | ||
| // flight: give it a short grace window, then resolve null if nothing arrived. | ||
| if (!resolved.get()) { | ||
| Handler(Looper.getMainLooper()).postDelayed({ |
There was a problem hiding this comment.
This can cause memory leak , if the activity is cleared / destroyed before the RESUME_SESSION_GRACE_MS elapses . Ideally we should clear any pending handler callbacks in such scenarios
There was a problem hiding this comment.
Updated code to cleared the handler
3 participants
Description
On Android, the OS can kill the app's process while the user is completing login in the browser — common on devices with aggressive memory management (Samsung One UI, Xiaomi MIUI), especially during MFA when the user switches apps to fetch a code. When the browser redirects back, the app cold-starts and the in-flight login is silently lost, dropping the user back on the login screen.
This PR adds
resumeSession(), which recovers that login. The underlying native SDK finishes the token exchange after the process restarts and buffers the result; callingresumeSession()once on cold start drains it and returns the recoveredCredentials(ornullif there was nothing to recover).nullon iOS and web, so it is safe to call unconditionally.MainActivitychanges required, so it works the same in bare React Native and Expo.References
Checklist
Summary by CodeRabbit
resumeSession(), with lifecycle-aware, main-thread-safe behavior.nullwhen nothing is recoverable.