From f911d7d88e250ea847dce65572aaf386963dab77 Mon Sep 17 00:00:00 2001 From: Charles Hetterich Date: Mon, 25 May 2026 15:52:13 -0400 Subject: [PATCH 1/3] fix(host-papp): raise SSO request size limit --- packages/host-papp/__tests__/userSession.spec.ts | 11 +++++++++++ .../host-papp/src/sso/sessionManager/userSession.ts | 3 +++ 2 files changed, 14 insertions(+) diff --git a/packages/host-papp/__tests__/userSession.spec.ts b/packages/host-papp/__tests__/userSession.spec.ts index b66f89fd..cce5c5d1 100644 --- a/packages/host-papp/__tests__/userSession.spec.ts +++ b/packages/host-papp/__tests__/userSession.spec.ts @@ -1,4 +1,5 @@ import type { Encryption, StatementProver, StatementStoreAdapter } from '@novasamatech/statement-store'; +import { createSession } from '@novasamatech/statement-store'; import type { StorageAdapter } from '@novasamatech/storage-adapter'; import { ResultAsync, errAsync, okAsync } from 'neverthrow'; import { beforeEach, describe, expect, it, vi } from 'vitest'; @@ -48,6 +49,7 @@ import type { StoredUserSession } from '../src/sso/userSessionRepository.js'; const SESSION_ID = 'user-session-1'; const MSG_ID = 'msg-fixed'; +const MAX_SSO_REQUEST_SIZE = 254 * 1024; function captureEvents() { const events: HostPappDebugEvent[] = []; @@ -75,6 +77,7 @@ function buildSession() { } beforeEach(() => { + vi.mocked(createSession).mockClear(); mocks.nanoid.mockReset().mockReturnValue(MSG_ID); mocks.request.mockReset(); mocks.waitForRequestMessage.mockReset(); @@ -89,6 +92,14 @@ beforeEach(() => { // when the corresponding code path runs. If a future refactor drops an emit, // the matching assertion below fails. describe('createUserSession debug emits', () => { + it('configures the statement-store session for mobile-sized SSO requests', () => { + buildSession(); + + expect(vi.mocked(createSession)).toHaveBeenCalledWith( + expect.objectContaining({ maxRequestSize: MAX_SSO_REQUEST_SIZE }), + ); + }); + describe('host actions', () => { it('signPayload emits host_action_sent then host_action_response_received on success', async () => { mocks.request.mockReturnValue(okAsync(undefined)); diff --git a/packages/host-papp/src/sso/sessionManager/userSession.ts b/packages/host-papp/src/sso/sessionManager/userSession.ts index 19879d94..5dbf616a 100644 --- a/packages/host-papp/src/sso/sessionManager/userSession.ts +++ b/packages/host-papp/src/sso/sessionManager/userSession.ts @@ -26,6 +26,8 @@ import type { SigningPayloadRequest, SigningPayloadResponseData, SigningRawReque // payload is for an SDK version the mobile app doesn't support yet. After // this timeout the queue task fails, freeing the pool for the next request. const QUEUE_TASK_TIMEOUT_MS = 180_000; +// Mobile SSO statements allow 256 KiB total; keep headroom for statement/session overhead. +const MAX_SSO_REQUEST_SIZE = 254 * 1024; function withQueueTimeout(resultAsync: ResultAsync, label: string): ResultAsync { const timeoutPromise = new Promise>(resolve => @@ -128,6 +130,7 @@ export function createUserSession({ statementStore, encryption, prover, + maxRequestSize: MAX_SSO_REQUEST_SIZE, }); const processedMessages = fieldListView({ From ac17cb3ef5f6696a2597196312267b95de1431af Mon Sep 17 00:00:00 2001 From: Charles Hetterich Date: Tue, 26 May 2026 10:19:40 -0400 Subject: [PATCH 2/3] test(host-papp): remove SSO request size test --- packages/host-papp/__tests__/userSession.spec.ts | 9 --------- 1 file changed, 9 deletions(-) diff --git a/packages/host-papp/__tests__/userSession.spec.ts b/packages/host-papp/__tests__/userSession.spec.ts index cce5c5d1..63e3e521 100644 --- a/packages/host-papp/__tests__/userSession.spec.ts +++ b/packages/host-papp/__tests__/userSession.spec.ts @@ -49,7 +49,6 @@ import type { StoredUserSession } from '../src/sso/userSessionRepository.js'; const SESSION_ID = 'user-session-1'; const MSG_ID = 'msg-fixed'; -const MAX_SSO_REQUEST_SIZE = 254 * 1024; function captureEvents() { const events: HostPappDebugEvent[] = []; @@ -92,14 +91,6 @@ beforeEach(() => { // when the corresponding code path runs. If a future refactor drops an emit, // the matching assertion below fails. describe('createUserSession debug emits', () => { - it('configures the statement-store session for mobile-sized SSO requests', () => { - buildSession(); - - expect(vi.mocked(createSession)).toHaveBeenCalledWith( - expect.objectContaining({ maxRequestSize: MAX_SSO_REQUEST_SIZE }), - ); - }); - describe('host actions', () => { it('signPayload emits host_action_sent then host_action_response_received on success', async () => { mocks.request.mockReturnValue(okAsync(undefined)); From 1120480936aa5833d26787a94d3428c30b6ec44e Mon Sep 17 00:00:00 2001 From: Charles Hetterich Date: Tue, 26 May 2026 10:21:30 -0400 Subject: [PATCH 3/3] test(host-papp): remove unused createSession reset --- packages/host-papp/__tests__/userSession.spec.ts | 2 -- 1 file changed, 2 deletions(-) diff --git a/packages/host-papp/__tests__/userSession.spec.ts b/packages/host-papp/__tests__/userSession.spec.ts index 63e3e521..b66f89fd 100644 --- a/packages/host-papp/__tests__/userSession.spec.ts +++ b/packages/host-papp/__tests__/userSession.spec.ts @@ -1,5 +1,4 @@ import type { Encryption, StatementProver, StatementStoreAdapter } from '@novasamatech/statement-store'; -import { createSession } from '@novasamatech/statement-store'; import type { StorageAdapter } from '@novasamatech/storage-adapter'; import { ResultAsync, errAsync, okAsync } from 'neverthrow'; import { beforeEach, describe, expect, it, vi } from 'vitest'; @@ -76,7 +75,6 @@ function buildSession() { } beforeEach(() => { - vi.mocked(createSession).mockClear(); mocks.nanoid.mockReset().mockReturnValue(MSG_ID); mocks.request.mockReset(); mocks.waitForRequestMessage.mockReset();