From a31b26df45860af16061fb43ccc3443381ed3df2 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Wed, 26 Aug 2026 13:54:56 +0200 Subject: fix(transport): reconnect used a fresh handshake token but a stale signaling one MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Found live: every reconnect attempt failed "Signaling failed: 401 Invalid or expired token", looping for 4+ minutes with no chance of ever succeeding. connect() takes one token but uses it in two places — the handshake sent to the node, and the Authorization header on the signaling POST to the hub — and only the constructor's original `this._accessToken` was ever used for the latter. onNeedToken correctly fetches a fresh token for each reconnect attempt, but it only ever reached the handshake; the signaling call kept sending whatever token the transport was constructed with, no matter how many minutes had passed or how many attempts fetched a new one. connect() now updates this._accessToken on every call, reconnects included, so both places use the same current token. --- packages/meshbay-hub/src/meshbay_hub/static/transport.js | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'packages/meshbay-hub/src') diff --git a/packages/meshbay-hub/src/meshbay_hub/static/transport.js b/packages/meshbay-hub/src/meshbay_hub/static/transport.js index 35f729e..9f85ee1 100644 --- a/packages/meshbay-hub/src/meshbay_hub/static/transport.js +++ b/packages/meshbay-hub/src/meshbay_hub/static/transport.js @@ -305,6 +305,15 @@ class MeshBayTransport { // "failed" — see the pc.onconnectionstatechange handler further down. this._connectArgs = { nodeId, groupId, gekRaw, bundleKey, username, userId, joinCode }; this._lastToken = jwtToken; + // The constructor sets this once from whatever token the caller had at + // the time — and the signaling POST below reads *this*, not `jwtToken`. + // A reconnect passes a freshly-fetched `jwtToken` (see onNeedToken) but + // that never reached here before, so the signaling call kept using the + // original token no matter how many minutes had passed or how many + // reconnect attempts fetched a new one — confirmed live: every attempt + // failed "Signaling failed: 401 Invalid or expired token" in a loop, + // never actually trying the fresh token connect() had just been handed. + this._accessToken = jwtToken; this._gekRaw = gekRaw || null; this._sessionKeys = sessionKeys || null; this._bundleKey = bundleKey || null; -- cgit v1.2.3