feat(amicus): harden auth access with RC init wiring (1/3) - #1658
Merged
Conversation
Part 1 of splitting codex/amicus-auth-access-hardening into reviewable PRs. This PR ships the auth/access work the codex branch name promised. ## What this does - Wires RevenueCat init into app startup. initializePurchases already existed in services/purchases.ts but was only called from tests — RC was effectively uninitialized in production, meaning syncPremiumStatus was a no-op and premium status was driven entirely by local state. - Introduces getAmicusAuthToken() — single source of truth for the token Amicus sends to the Cloudflare Worker proxy. Prefers the RevenueCat appUserID; falls back to EXPO_PUBLIC_AMICUS_DEV_TOKEN in dev, with an allowDevFallback:false opt-out for production call sites that want to forbid it entirely. - Adds a 16-char min-length sanity guard so empty/placeholder values don't impersonate a real user. - Adds getPurchasesAppUserID() to services/purchases.ts plus a purchasesConfigured flag so syncPremiumStatus and the new getter short-circuit until RC finishes configuring. - Adds a usage-event bus (services/amicus/usageEvents.ts) so useAmicusAccess refreshes monthly-usage in real time as users query Amicus, instead of only on entitlement change. ## Tier 2 fixes included 1. RC init is fire-and-forget. initializePurchases awaits sdk.configure() and syncPremiumStatus (a network call that can take 10+ seconds on spotty connections). Awaiting it in App.tsx would stall the splash screen for that long. Changed to 'void initializePurchases(...)' with a comment explaining the rationale. initializePurchases swallows its own errors; syncPremiumStatus short-circuits on the purchasesConfigured flag; downstream access is safe. 2. Dev-fallback info log gated with __DEV__. Since EXPO_PUBLIC_* vars get inlined into the shipped bundle, if EXPO_PUBLIC_AMICUS_DEV_TOKEN leaks into a prod build the token still works but we don't announce it in production logs. ## Out of scope (split into PR 2 and PR 3) - DB migrations 22/23, thread context/summary tables, related queries and mutations, PRAGMA foreign_keys = ON - New context/trust/threadIntelligence/studyActions/studyLaunch services and their types - All UI components, hooks, and screens - MyStudyScreen and StudySessionScreen changes (defer per #1652 re-plan; StudySessionScreen conflict with #1654 resolved in PR 3) ## Rollback Revert the single merge. App.tsx goes back to the pre-init state (RevenueCat stays uninitialized — pre-existing no-op), getAmicusAuthToken disappears (no callers in this PR), and the emitAmicusUsageChanged calls stop firing (the hook's subscription becomes inert, still functional as it was pre-PR).
Test Results✅ All tests passed
Coverage
⏱️ Duration: 89.3s |
PR #1658 wired initializePurchases into App.tsx's init sequence. The App.providerTree smoke test mocks '@/services/purchases' but only exported syncPremiumStatus, so initializePurchases resolved to undefined and the 'void initializePurchases(...)' call threw synchronously during init(). The throw was caught, setting dbStatus='needs_download' instead of 'ready', and the test's waitFor(root-navigator-stub) timed out at 5s. Mock update adds initializePurchases: jest.fn().mockResolvedValue(undefined). No production code change.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part 1 of 3 — salvaging codex/amicus-auth-access-hardening
This is the first of three PRs that split up the
codex/amicus-auth-access-hardeningbranch. That branch bundled 10+ distinct Amicus features under a name that describes only one of them, with no PR opened for review. After a senior-dev review we're splitting it into focused PRs to preserve rollback granularity.This PR ships only the auth/access work the codex branch name promised. PR 2 covers DB + services foundation; PR 3 covers UI wiring.
Why it matters
On current master,
initializePurchases()exists inservices/purchases.tsbut is never called from production code — only from tests. RevenueCat is effectively uninitialized in the shipped app, which means:syncPremiumStatus()is a no-op (the SDK was never configured)premiumStoreThis PR is the first time production actually hits RevenueCat.
What's in
Auth layer
services/amicus/authToken.ts(new) —getAmicusAuthToken()returns the token Amicus sends to the Worker. PrefersgetPurchasesAppUserID()(the RevenueCat appUserID); falls back toEXPO_PUBLIC_AMICUS_DEV_TOKENin dev. Accepts{ allowDevFallback: false }so production call sites can explicitly forbid the dev path. 16-char min-length sanity guard on both token sources.services/amicus/__tests__/authToken.test.ts— covers the RC-preferred / dev-fallback / no-token / explicit-disable paths.RevenueCat init
services/purchases.ts—purchasesConfiguredflag guardssyncPremiumStatusand the newgetPurchasesAppUserID()so they short-circuit untilconfigure()completes. Empty/whitespace API keys are rejected with a warn-and-skip instead of reaching the SDK.getPurchasesAppUserID()is the new exportauthToken.tsconsumes.App.tsx—getRevenueCatApiKey()helper readsEXPO_PUBLIC_REVENUECAT_IOS_API_KEY/_ANDROID_API_KEYwith a generic_API_KEYfallback. Wired into both the primary init path and the post-download init path.__tests__/services/purchases.test.ts— coverage for thepurchasesConfiguredgate +getPurchasesAppUserIDhappy/error paths.Usage event bus
services/amicus/usageEvents.ts(new) — 16-line pub/sub.emitAmicusUsageChanged()fires on usage writes;subscribeAmicusUsageChanges()returns an unsubscribe.hooks/useAmicusAccess.ts— subscribes on mount, refreshesusageThisMonthon every emit. Previously only refreshed on entitlement change, so the monthly counter could lag behind the user's actual usage within a session.db/userMutations.ts— two-line isolated change: fireemitAmicusUsageChanged()fromincrementAmicusUsageandclearAllAmicusData. Kept surgical so PR 2's largeruserMutations.tschanges don't conflict.Tier 2 fixes included
await initializePurchases(...)beforesetDbStatus('ready'), which stalls the splash screen onsdk.configure()+syncPremiumStatus()(a customer-info network call — 10+ seconds worst case on flaky networks). Changed tovoid initializePurchases(...)with a comment explaining the rationale. The SDK swallows its own errors andpurchasesConfiguredguards downstream access, so delayed RC readiness is safe.__DEV__.EXPO_PUBLIC_*env vars get inlined into the shipped JS bundle. IfEXPO_PUBLIC_AMICUS_DEV_TOKENaccidentally leaks into a production build the token still works, but we don't announce the fallback in production logs.Out of scope (moving to PR 2 / PR 3)
PRAGMA foreign_keys = ON, and all the new thread-context queries/mutations → PR 2context.ts,trust.ts,threadIntelligence.ts,studyActions.ts,studyLaunch.tsservices and their types → PR 2TrustFooter,StudyActionRow, thread/screen/hook wiring → PR 3StudySessionScreen.tsxchanges (the codex branch reverts fix(guided-study): stepper taps no longer bounce back to initialStep #1654'suseRefbounce-back guard — conflict resolution deferred to PR 3 which will preserve the guard)MyStudyScreen.tsxchanges (deferred until Guided Study: current UX is a framework, not a guided flow — capture current state and re-plan #1652's re-plan per standing direction)Test plan
npx tsc --noEmit+npx jestvia CIusageThisMonthin the access hook update in real time without a remountEXPO_PUBLIC_AMICUS_DEV_TOKENon a dev build, confirm log line appears; verify a prod build with the same env does NOT log (would require a release build — spot check is fine)Rollback
Single-commit revert. App.tsx goes back to the pre-init state (RC stays uninitialized — pre-existing no-op).
getAmicusAuthTokendisappears but has no callers in this PR. TheemitAmicusUsageChangedcalls stop firing — the subscription inuseAmicusAccessbecomes inert but the hook falls back to its original mount-only refresh, still functional.Stacks with PR 2 and PR 3 (to follow).