mashlib: await xlogin ready before booting shell#7
Merged
Conversation
Hard-reload race: panes mounted before xlogin restored the session, so authenticated requests (e.g. sharing-pane) 401'd on first paint. Wait for the script to load and, when present, for window.xlogin.ready before importing the shell. Keeps losos/shell.js generic (no auth-library awareness in the framework).
There was a problem hiding this comment.
Pull request overview
This PR addresses a hard-reload race where panes (e.g. sharing-pane) may issue unauthenticated requests (401s) because the LOSOS shell boots before xlogin finishes restoring session state.
Changes:
- Add a
xloginLoadedpromise that resolves on the xlogin<script>load/errorevent. - Await
xloginLoaded, then awaitwindow.xlogin.readywhen available, before importinglosos/shell.js.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+88
to
+91
| // Wait for xlogin script to load + finish session restore so panes | ||
| // don't capture an unrestored auth state and 401 on hard reload. | ||
| await xloginLoaded | ||
| if (window.xlogin && window.xlogin.ready) await window.xlogin.ready |
Contributor
Author
There was a problem hiding this comment.
Both branches are already covered, declining to add code:
xloginLoadedresolves on bothloadanderror— blocked / 404 / CSP-rejected all fireerror, so the await unblocks.window.xlogin.readyis a Promise published by xlogin@0.0.9 with atry/finallyresolver — it cannot reject. The version guard (if (window.xlogin && window.xlogin.ready)) covers older versions that lack it.
Keeping the patch at 9 lines.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #6.
Problem
On hard reload of an authenticated page, panes that need a WebID (e.g. sharing-pane) sometimes 401. xlogin is injected from
mashlib.jsand starts session restore async; if the shell boots before restore settles, panes capture an unrestored auth state.Fix
Wait in
mashlib.js(the consumer that already injects xlogin) for:<script>to finish loading (load/error).window.xlogin.ready(Promise published in xlogin@0.0.9), if present.Then import the shell.
This keeps
losos/shell.jsgeneric — the framework stays free of auth-library awareness. Older xlogin versions without.readydegrade gracefully (the secondawaitis skipped).Diff
mashlib.jsonly — 9 lines added across two hunks. Nolosos/changes.Test plan