feat(auth): prompt relogin when restored session has no CSRF token

A session restored from a persisted access token on cold start never
passes through login or refresh, so no CSRF token is ever set and every
mutating request fails with a 403. On launch for a signed-in session,
try to re-establish CSRF via a refresh; if that is not possible, tell
the user the session is broken and to log in again.

Author: UserGreen

app/src/main/kotlin/org/astermail/android/auth/AuthRepository.kt

@@ -487,6 +487,15 @@ class AuthRepository @Inject constructor(
         return true
     }
 
+    suspend fun ensure_csrf_ready(): Boolean {
+        if (!_is_signed_in.value) return true
+        if (api_client.get_csrf() != null) return true
+        return when (try_refresh_session()) {
+            RefreshOutcome.Success -> api_client.get_csrf() != null
+            RefreshOutcome.AuthFailed, RefreshOutcome.Transient -> false
+        }
+    }
+
     fun has_stored_session(account_id: String): Boolean = session_snapshot_store.has(account_id)
 
     suspend fun change_password(current_password: String, new_password: String): Result<Unit> = runCatching {

app/src/main/kotlin/org/astermail/android/auth/auth_gate_view_model.kt

@@ -24,15 +24,20 @@ package org.astermail.android.auth
 import androidx.lifecycle.ViewModel
 import androidx.lifecycle.viewModelScope
 import android.content.Context
+import android.widget.Toast
 import dagger.hilt.android.lifecycle.HiltViewModel
 import dagger.hilt.android.qualifiers.ApplicationContext
 import javax.inject.Inject
 import kotlinx.coroutines.CancellationException
+import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.flow.asStateFlow
 import kotlinx.coroutines.launch
+import kotlinx.coroutines.withContext
 import kotlinx.coroutines.withTimeoutOrNull
+import org.astermail.android.BuildConfig
+import org.astermail.android.R
 import org.astermail.android.api.auth.AuthApi
 import org.astermail.android.security.LockdownStore
 
@@ -54,6 +59,21 @@ class AuthGateViewModel @Inject constructor(
         }
         _is_ready.value = true
         if (auth_repository.is_signed_in.value) {
+            viewModelScope.launch {
+                val csrf_ok = auth_repository.ensure_csrf_ready()
+                if (!csrf_ok) {
+                    if (BuildConfig.DEBUG) {
+                        android.util.Log.w("AuthGate", "CSRF token fetch failed on launch")
+                    }
+                    withContext(Dispatchers.Main) {
+                        Toast.makeText(
+                            context,
+                            context.getString(R.string.csrf_unavailable),
+                            Toast.LENGTH_LONG,
+                        ).show()
+                    }
+                }
+            }
             viewModelScope.launch {
                 try {
                     val info = withTimeoutOrNull(8_000L) { auth_api.me() }

app/src/main/res/values-ar/strings.xml

@@ -1281,4 +1281,5 @@
     <string name="pending_deletion_error">تعذّرت استعادة حسابك. يرجى المحاولة مرة أخرى.</string>
     <string name="pending_deletion_restored">مرحبًا بعودتك. تمت استعادة حسابك.</string>
     <string name="image_blocked_placeholder">[تم حظر الصورة]</string>
+    <string name="csrf_unavailable">هذه الجلسة معطوبة! يرجى تسجيل الدخول مرة أخرى.</string>
 </resources>

app/src/main/res/values-de/strings.xml

@@ -1274,4 +1274,5 @@
     <string name="pending_deletion_error">Ihr Konto konnte nicht wiederhergestellt werden. Bitte versuchen Sie es erneut.</string>
     <string name="pending_deletion_restored">Willkommen zurück. Ihr Konto wurde wiederhergestellt.</string>
     <string name="image_blocked_placeholder">[Bild blockiert]</string>
+    <string name="csrf_unavailable">Diese Sitzung ist fehlerhaft! Bitte melden Sie sich erneut an.</string>
 </resources>

app/src/main/res/values-es/strings.xml

@@ -1274,4 +1274,5 @@
     <string name="pending_deletion_error">No se pudo restaurar tu cuenta. Inténtalo de nuevo.</string>
     <string name="pending_deletion_restored">Bienvenido de nuevo. Tu cuenta ha sido restaurada.</string>
     <string name="image_blocked_placeholder">[Imagen bloqueada]</string>
+    <string name="csrf_unavailable">¡Esta sesión está dañada! Vuelve a iniciar sesión.</string>
 </resources>

app/src/main/res/values-fr/strings.xml

@@ -1889,4 +1889,5 @@
     <string name="pending_deletion_error">Impossible de restaurer votre compte. Veuillez réessayer.</string>
     <string name="pending_deletion_restored">Bon retour. Votre compte a été restauré.</string>
     <string name="image_blocked_placeholder">[Image bloquée]</string>
+    <string name="csrf_unavailable">Cette session est corrompue ! Veuillez vous reconnecter.</string>
 </resources>

app/src/main/res/values-it/strings.xml

@@ -1273,4 +1273,5 @@
     <string name="pending_deletion_error">Impossibile ripristinare il tuo account. Riprova.</string>
     <string name="pending_deletion_restored">Bentornato. Il tuo account è stato ripristinato.</string>
     <string name="image_blocked_placeholder">[Immagine bloccata]</string>
+    <string name="csrf_unavailable">Questa sessione è danneggiata! Effettua nuovamente l\'accesso.</string>
 </resources>

app/src/main/res/values-ja/strings.xml

@@ -1271,4 +1271,5 @@
     <string name="pending_deletion_error">アカウントを復元できませんでした。もう一度お試しください。</string>
     <string name="pending_deletion_restored">おかえりなさい。アカウントが復元されました。</string>
     <string name="image_blocked_placeholder">[画像はブロックされました]</string>
+    <string name="csrf_unavailable">このセッションは壊れています！もう一度ログインしてください。</string>
 </resources>

app/src/main/res/values-ko/strings.xml

@@ -1271,4 +1271,5 @@
     <string name="pending_deletion_error">계정을 복원할 수 없습니다. 다시 시도해 주세요.</string>
     <string name="pending_deletion_restored">다시 오신 것을 환영합니다. 계정이 복원되었습니다.</string>
     <string name="image_blocked_placeholder">[이미지 차단됨]</string>
+    <string name="csrf_unavailable">이 세션이 손상되었습니다! 다시 로그인해 주세요.</string>
 </resources>

app/src/main/res/values-nl/strings.xml

@@ -1273,4 +1273,5 @@
     <string name="pending_deletion_error">Kan je account niet herstellen. Probeer het opnieuw.</string>
     <string name="pending_deletion_restored">Welkom terug. Je account is hersteld.</string>
     <string name="image_blocked_placeholder">[Afbeelding geblokkeerd]</string>
+    <string name="csrf_unavailable">Deze sessie is beschadigd! Log opnieuw in.</string>
 </resources>