🐛 await re-grant if consent is revoked during session manager init (#4605)

Author: thomas-lebeau

packages/core/src/domain/session/sessionManager.spec.ts

@@ -31,6 +31,15 @@ import type { SessionStoreStrategyType } from './storeStrategies/sessionStoreStr
 import type { SessionState } from './sessionState'
 import { EXPIRED } from './sessionState'
 
+// Flush several microtask cycles so chained awaits inside startSessionManager
+// (resolveInitialState's await, the .catch chain, and the post-await continuation)
+// have a chance to run before assertions.
+async function flushMicrotasks(): Promise<void> {
+  for (let i = 0; i < 10; i += 1) {
+    await Promise.resolve()
+  }
+}
+
 describe('startSessionManager', () => {
   const STORE_TYPE: SessionStoreStrategyType = { type: SessionPersistence.COOKIE, cookieOptions: {} }
   let fakeStrategy: ReturnType<typeof createFakeSessionStoreStrategy>
@@ -518,18 +527,50 @@ describe('startSessionManager', () => {
       expect(fakeStrategy.getInternalState().anonymousId).toBeUndefined()
     })
 
-    it('should expire the session when consent is revoked before initialization completes', async () => {
+    it('should not install the session manager while consent stays revoked after being revoked during init', async () => {
+      const trackingConsentState = createTrackingConsentState(TrackingConsent.GRANTED)
+
+      const initResolvers: Array<() => void> = []
+      const delayedStrategy = createFakeSessionStoreStrategy()
+      delayedStrategy.setSessionState = jasmine
+        .createSpy('setSessionState')
+        .and.callFake((fn: (state: SessionState) => SessionState): Promise<void> => {
+          fn({})
+          return new Promise<void>((resolve) => {
+            initResolvers.push(resolve)
+          })
+        })
+
+      fakeStrategy = delayedStrategy
+
+      const sessionManagerResolution = jasmine.createSpy('sessionManagerResolution')
+      void startSessionManager(
+        {
+          sessionStoreStrategyType: STORE_TYPE,
+          sessionSampleRate: 100,
+          trackAnonymousUser: false,
+        } as Configuration,
+        trackingConsentState
+      ).then(sessionManagerResolution)
+
+      trackingConsentState.update(TrackingConsent.NOT_GRANTED)
+      initResolvers[0]()
+      await flushMicrotasks()
+
+      expect(sessionManagerResolution).not.toHaveBeenCalled()
+    })
+
+    it('should install the session manager when consent is granted again after being revoked during init', async () => {
       const trackingConsentState = createTrackingConsentState(TrackingConsent.GRANTED)
 
-      // Create a strategy where setSessionState returns a pending promise (to simulate async init)
-      let resolveInit!: () => void
+      const initResolvers: Array<() => void> = []
       const delayedStrategy = createFakeSessionStoreStrategy()
       delayedStrategy.setSessionState = jasmine
         .createSpy('setSessionState')
         .and.callFake((fn: (state: SessionState) => SessionState): Promise<void> => {
           fn({})
           return new Promise<void>((resolve) => {
-            resolveInit = resolve
+            initResolvers.push(resolve)
           })
         })
 
@@ -544,15 +585,56 @@ describe('startSessionManager', () => {
         trackingConsentState
       )
 
-      // Consent revoked while initialization promise is pending
       trackingConsentState.update(TrackingConsent.NOT_GRANTED)
+      initResolvers[0]()
+      await flushMicrotasks()
+
+      trackingConsentState.update(TrackingConsent.GRANTED)
+      await flushMicrotasks()
 
-      // Resolve the initialization promise
-      resolveInit()
+      // After re-grant, the loop re-resolves the initial state
+      expect(initResolvers.length).toBeGreaterThanOrEqual(2)
+      initResolvers[initResolvers.length - 1]()
 
-      // Should resolve with undefined because consent was revoked
       const sessionManager = await sessionManagerPromise
-      expect(sessionManager).toBeUndefined()
+      expect(sessionManager).toBeDefined()
+    })
+
+    it('should expire the session in storage while consent stays revoked during init', async () => {
+      const trackingConsentState = createTrackingConsentState(TrackingConsent.GRANTED)
+
+      const initResolvers: Array<() => void> = []
+      const setStateCalls: Array<(state: SessionState) => SessionState> = []
+      const delayedStrategy = createFakeSessionStoreStrategy()
+      delayedStrategy.setSessionState = jasmine
+        .createSpy('setSessionState')
+        .and.callFake((fn: (state: SessionState) => SessionState): Promise<void> => {
+          setStateCalls.push(fn)
+          fn({})
+          return new Promise<void>((resolve) => {
+            initResolvers.push(resolve)
+          })
+        })
+
+      fakeStrategy = delayedStrategy
+
+      void startSessionManager(
+        {
+          sessionStoreStrategyType: STORE_TYPE,
+          sessionSampleRate: 100,
+          trackAnonymousUser: false,
+        } as Configuration,
+        trackingConsentState
+      )
+
+      const initialCallCount = setStateCalls.length
+
+      trackingConsentState.update(TrackingConsent.NOT_GRANTED)
+      initResolvers[0]()
+      await flushMicrotasks()
+
+      // expire() should have triggered an additional setSessionState call to mark the cookie expired
+      expect(setStateCalls.length).toBeGreaterThan(initialCallCount)
     })
   })
 

packages/core/src/domain/session/sessionManager.ts

@@ -126,7 +126,7 @@ export async function startSessionManager(
     stopped = true
   })
 
-  const initialState = await resolveInitialState().catch((error) =>
+  let initialState = await resolveInitialState().catch((error) =>
     monitorError(new Error(`Error while resolving initial session state: ${error}`))
   )
   if (!initialState || stopped) {
@@ -135,9 +135,18 @@ export async function startSessionManager(
 
   // Consent is always granted when the session manager is started, but it may
   // be revoked during the async initialization (e.g., while waiting for cookie lock).
-  if (!trackingConsentState.isGranted()) {
+  // Mirror setupSessionTracking's revoke/grant handler until the manager is installed:
+  // expire the session in storage, wait for the next grant, then re-resolve.
+  while (!trackingConsentState.isGranted()) {
     expire()
-    return
+    await new Promise<void>((resolve) => trackingConsentState.onGrantedOnce(resolve))
+    if (stopped) {
+      return
+    }
+    initialState = await resolveInitialState().catch(monitorError)
+    if (!initialState || stopped) {
+      return
+    }
   }
 
   sessionContextHistory.add(buildSessionContext(initialState), clocksOrigin().relative)

test/e2e/scenario/trackingConsent.scenario.ts

@@ -61,6 +61,34 @@ test.describe('tracking consent', () => {
         expect(await findSessionCookie(browserContext)).not.toEqual(initialSessionId)
       })
 
+    createTest('recovers when consent is revoked during session manager init and re-granted')
+      .withRum({ trackingConsent: 'not-granted' })
+      .run(async ({ intakeRegistry, flushEvents, browserContext, page }) => {
+        // Grant then revoke synchronously: the grant triggers startSessionManager
+        // (it begins awaiting setSessionState / cookie lock), and the revoke lands
+        // before that async work completes.
+        await page.evaluate(() => {
+          window.DD_RUM!.setTrackingConsent('granted')
+          window.DD_RUM!.setTrackingConsent('not-granted')
+        })
+
+        // While consent stays revoked the cookie must be marked expired so
+        // other tabs don't pick up an orphan session ID.
+        await page.waitForTimeout(200)
+        expect((await findSessionCookie(browserContext))?.isExpired).toEqual('1')
+
+        // Re-grant: the session manager should now finish installing and
+        // start collecting events with a fresh session.
+        await page.evaluate(() => {
+          window.DD_RUM!.setTrackingConsent('granted')
+        })
+
+        await flushEvents()
+
+        expect(intakeRegistry.rumViewEvents.length).toBeGreaterThan(0)
+        expect((await findSessionCookie(browserContext))?.isExpired).not.toEqual('1')
+      })
+
     createTest('using setTrackingConsent before init overrides the init parameter')
       .withRum({ trackingConsent: 'not-granted' })
       .withRumInit((configuration) => {