fix: retry superseded public invoice preparation

Author: ben-kaufman

Bitkit/ViewModels/WalletViewModel.swift

@@ -1401,13 +1401,9 @@ class WalletViewModel: ObservableObject {
             return ("", "")
         }
 
-        let invoiceRevision = publicPaykitInvoiceRevision
+        let initialInvoiceRevision = publicPaykitInvoiceRevision
         let session = pubkyProfile?.currentSession
         let wasSharing = sharesPublicPaykitEndpoints
-        let canCommitInvoice = {
-            !Task.isCancelled && self.isPaykitUIActive && self.publicPaykitInvoiceRevision == invoiceRevision &&
-                self.pubkyProfile?.currentSession == session && self.sharesPublicPaykitEndpoints == wasSharing
-        }
         let receiveID = receiveRefreshID
         let commitID = receiveCommitID
         let previousAddress = onchainAddress
@@ -1416,26 +1412,46 @@ class WalletViewModel: ObservableObject {
             onchainAddress = publicOnchainAddress
         }
 
-        if includeLightning, hasUsableChannels {
-            let hasReusableInvoice = await hasReusablePublicPaykitInvoice()
-            guard canCommitInvoice() else { throw PubkyServiceError.sessionNotActive }
-            let shouldRefreshBolt11 = forceRefreshBolt11 || !hasReusableInvoice
-            if shouldRefreshBolt11 {
-                do {
-                    try await refreshPublicPaykitBolt11(canCommitInvoice: canCommitInvoice)
-                } catch let error as PublicPaykitError {
-                    guard case .routeHintsUnavailable = error else {
-                        throw error
+        for attempt in 0 ..< 2 {
+            let invoiceRevision = attempt == 0 ? initialInvoiceRevision : publicPaykitInvoiceRevision
+            let canCommitInvoice = { () async throws -> Bool in
+                if attempt > 0 {
+                    guard await !PrivatePaykitService.shared.isDeletingProfile else { throw PubkyServiceError.sessionNotActive }
+                }
+                guard !Task.isCancelled, self.isPaykitUIActive,
+                      attempt == 0 || self.pubkyProfile?.isDeletingProfile != true,
+                      self.pubkyProfile?.currentSession == session && self.sharesPublicPaykitEndpoints == wasSharing
+                else { throw PubkyServiceError.sessionNotActive }
+                return self.publicPaykitInvoiceRevision == invoiceRevision
+            }
+            if attempt > 0 {
+                guard try await canCommitInvoice() else { continue }
+            }
+            if includeLightning, hasUsableChannels {
+                let hasReusableInvoice = await hasReusablePublicPaykitInvoice()
+                guard try await canCommitInvoice() else { continue }
+                let shouldRefreshBolt11 = forceRefreshBolt11 || !hasReusableInvoice
+                if shouldRefreshBolt11 {
+                    do {
+                        guard try await refreshPublicPaykitBolt11(canCommitInvoice: canCommitInvoice) else { continue }
+                    } catch let error as PublicPaykitError {
+                        guard case .routeHintsUnavailable = error else {
+                            throw error
+                        }
+                        Logger.warn(
+                            "Public Paykit Lightning invoice has no route hints; publishing on-chain endpoint only",
+                            context: "WalletViewModel"
+                        )
                     }
-                    Logger.warn("Public Paykit Lightning invoice has no route hints; publishing on-chain endpoint only", context: "WalletViewModel")
                 }
+            } else if includeLightning {
+                guard try await canCommitInvoice() else { continue }
+                clearPublicPaykitBolt11()
             }
-        } else if includeLightning {
-            guard canCommitInvoice() else { throw PubkyServiceError.sessionNotActive }
-            clearPublicPaykitBolt11()
-        }
 
-        return (publicOnchainAddress, includeLightning ? publicPaykitBolt11 : "")
+            return (publicOnchainAddress, includeLightning ? publicPaykitBolt11 : "")
+        }
+        throw PublicPaykitError.publicationFailed
     }
 
     func refreshPublicPaykitEndpointsOnForeground(isSessionCurrent: @escaping @MainActor () -> Bool) async {
@@ -1515,10 +1531,10 @@ class WalletViewModel: ObservableObject {
             PublicPaykitService.hasLightningRouteHints(bolt11: publicPaykitBolt11)
     }
 
-    private func refreshPublicPaykitBolt11(canCommitInvoice: () -> Bool) async throws {
+    private func refreshPublicPaykitBolt11(canCommitInvoice: () async throws -> Bool) async throws -> Bool {
         let invoice = try await createInvoice(amountSats: nil, note: "")
         let decodedInvoice = try await decode(invoice: invoice)
-        guard canCommitInvoice() else { throw PubkyServiceError.sessionNotActive }
+        guard try await canCommitInvoice() else { return false }
         guard case let .lightning(lightningInvoice) = decodedInvoice else {
             clearPublicPaykitBolt11()
             throw PublicPaykitError.invalidPayload
@@ -1531,6 +1547,7 @@ class WalletViewModel: ObservableObject {
         publicPaykitBolt11 = invoice
         publicPaykitBolt11PaymentHash = lightningInvoice.paymentHash.hex
         publicPaykitBolt11ExpiresAt = Double(lightningInvoice.timestampSeconds + lightningInvoice.expirySeconds)
+        return true
     }
 
     private func clearPublicPaykitBolt11() {

BitkitTests/ReceiveInvoiceRefreshTests.swift

@@ -246,6 +246,152 @@ final class ReceiveInvoiceRefreshTests: XCTestCase {
         } catch PublicPaykitError.publicationFailed {}
     }
 
+    func testEnablingContactPaymentsRetriesInvoiceSupersessionOnce() async throws {
+        snapshotAppDefaultsDomain()
+        UserDefaults.standard.set(UsdtPreference.disabled.rawValue, forKey: UsdtPreference.key)
+        for duringCreation in [false, true] {
+            for invalidations in duringCreation ? [1, 2] : [1] {
+                let (profile, wallet) = publicationWallet(route: .channelUsable)
+                wallet.stubPublicEndpoints = false
+                UserDefaults.standard.set(false, forKey: PublicPaykitService.publishingEnabledKey)
+                UserDefaults.standard.set(false, forKey: ContactPaymentsService.confirmedPreferenceKey)
+                let session = try XCTUnwrap(profile.currentSession)
+                var preparations = 0
+                let invalidate = {
+                    preparations += 1
+                    if preparations <= invalidations {
+                        wallet.publicPaykitBolt11PaymentHash = "paid"
+                        wallet.rotatePublicPaykitInvoiceIfNeeded(paymentHash: "paid")
+                    }
+                }
+                wallet.beforeReceiveAddress = { if !duringCreation { invalidate() } }
+                wallet.invoiceCreation = {
+                    if duringCreation { invalidate() }
+                    return Self.invoiceWithRouteHints
+                }
+                var published: [String] = []
+                var removals = 0
+                let operations = ContactPaymentsService.Operations(
+                    syncPublicEndpoints: { publish, isCurrent in
+                        try await PublicPaykitService.syncPublishedEndpoints(
+                            wallet: wallet, publish: publish, isSessionCurrent: isCurrent, syncApp: {},
+                            applyEndpoints: {
+                                if !publish { removals += 1 }
+                                published = $0.map(\.value)
+                            }
+                        )
+                    },
+                    preparePrivateEndpoints: { _, _, _ in nil }, removePrivateEndpoints: { _ in },
+                    setPublicCleanupPending: PublicPaykitService.setCleanupPending,
+                    setPrivateCleanupPending: PrivatePaykitService.setContactSharingCleanupPending
+                )
+                do {
+                    let applied = try await ContactPaymentsService.setEnabled(
+                        true, pubkyProfile: profile, contactsManager: ContactsManager(),
+                        operations: operations, privatePaymentAccess: { _ in false }
+                    )
+                    XCTAssertEqual(invalidations, 1)
+                    XCTAssertTrue(applied)
+                    XCTAssertTrue(published.contains(Self.invoiceWithRouteHints))
+                } catch {
+                    XCTAssertEqual(invalidations, 2, "\(error), creation: \(duringCreation)")
+                    guard case PublicPaykitError.publicationFailed = error else {
+                        XCTFail("Expected publication failure, got \(error)")
+                        continue
+                    }
+                    XCTAssertEqual(preparations, 2)
+                    XCTAssertTrue(published.isEmpty)
+                }
+                XCTAssertEqual(profile.currentSession, session)
+                XCTAssertEqual(ContactPaymentsService.isEnabled(), invalidations == 1)
+                XCTAssertEqual(removals, invalidations == 1 ? 0 : 1)
+            }
+        }
+    }
+
+    func testInvoiceSupersessionDoesNotRetryCreationOrDecodeFailures() async throws {
+        for failsCreation in [false, true] {
+            let (_, wallet) = publicationWallet(route: .channelUsable)
+            wallet.stubPublicEndpoints = false
+            var creations = 0
+            wallet.invoiceCreation = {
+                creations += 1
+                wallet.publicPaykitBolt11PaymentHash = "paid"
+                wallet.rotatePublicPaykitInvoiceIfNeeded(paymentHash: "paid")
+                if failsCreation { throw PublicPaykitError.walletNotReady }
+                return "invalid-invoice"
+            }
+            do {
+                _ = try await wallet.refreshPublicPaykitEndpoints(includeOnchain: false)
+                XCTFail("Expected invoice failure")
+            } catch {
+                if failsCreation {
+                    guard case PublicPaykitError.walletNotReady = error else { return XCTFail("Unexpected error: \(error)") }
+                } else {
+                    XCTAssertFalse(error is PubkyServiceError)
+                    XCTAssertFalse(error is PublicPaykitError)
+                }
+            }
+            XCTAssertEqual(creations, 1)
+            XCTAssertTrue(wallet.publicPaykitBolt11.isEmpty)
+        }
+    }
+
+    func testEnablingContactPaymentsRejectsDeletionBeforeOrDuringInvoiceRetry() async throws {
+        snapshotAppDefaultsDomain()
+        UserDefaults.standard.set(UsdtPreference.disabled.rawValue, forKey: UsdtPreference.key)
+        for heldCreation in [1, 2] {
+            let (profile, wallet) = publicationWallet(route: .channelUsable)
+            wallet.stubPublicEndpoints = false
+            UserDefaults.standard.set(false, forKey: PublicPaykitService.publishingEnabledKey)
+            UserDefaults.standard.set(false, forKey: ContactPaymentsService.confirmedPreferenceKey)
+            let session = try XCTUnwrap(profile.currentSession)
+            let creation = PublicationGate("Public invoice creation before deletion")
+            var creations = 0
+            wallet.invoiceCreation = {
+                creations += 1
+                if creations == 1 {
+                    wallet.publicPaykitBolt11PaymentHash = "paid"
+                    wallet.rotatePublicPaykitInvoiceIfNeeded(paymentHash: "paid")
+                }
+                if creations == heldCreation { await creation.wait() }
+                return Self.invoiceWithRouteHints
+            }
+            let operations = ContactPaymentsService.Operations(
+                syncPublicEndpoints: { publish, isCurrent in
+                    try await PublicPaykitService.syncPublishedEndpoints(
+                        wallet: wallet, publish: publish, isSessionCurrent: isCurrent, syncApp: {},
+                        applyEndpoints: { XCTAssertTrue($0.isEmpty, "Deletion must not publish replacement endpoints") }
+                    )
+                },
+                preparePrivateEndpoints: { _, _, _ in nil }, removePrivateEndpoints: { _ in },
+                setPublicCleanupPending: PublicPaykitService.setCleanupPending,
+                setPrivateCleanupPending: PrivatePaykitService.setContactSharingCleanupPending
+            )
+            let change = Task {
+                try await ContactPaymentsService.setEnabled(
+                    true, pubkyProfile: profile, contactsManager: ContactsManager(),
+                    operations: operations, privatePaymentAccess: { _ in false }
+                )
+            }
+            await fulfillment(of: [creation.started], timeout: 5)
+            await profile.performProfileDeletion {
+                XCTAssertEqual(profile.currentSession, session)
+                creation.release()
+                do {
+                    _ = try await change.value
+                    XCTFail("Expected deletion to reject invoice retry")
+                } catch PubkyServiceError.sessionNotActive {
+                } catch {
+                    XCTFail("Unexpected error: \(error)")
+                }
+                XCTAssertTrue(wallet.publicPaykitBolt11.isEmpty)
+                XCTAssertFalse(ContactPaymentsService.isEnabled())
+                XCTAssertEqual(creations, heldCreation)
+            }
+        }
+    }
+
     func testAdmittedPublicWriteCannotAcknowledgeNewerChannelRefresh() async throws {
         for invoice in ["ln-public", ""] {
             let (profile, wallet) = publicationWallet(route: .channelUsable)
@@ -299,7 +445,7 @@ final class ReceiveInvoiceRefreshTests: XCTestCase {
     }
 
     func testSuspendedPublicInvoiceCreationCannotMutateChangedOwnerOrSharing() async throws {
-        enum State: CaseIterable { case replaced, sharingDisabled, cancelled }
+        enum State: CaseIterable { case replaced, sameKeyNewSession, sharingDisabled, uiDisabled, cancelled }
         for state in State.allCases {
             let (profile, wallet) = publicationWallet(route: .channelUsable)
             wallet.stubPublicEndpoints = false
@@ -310,9 +456,16 @@ final class ReceiveInvoiceRefreshTests: XCTestCase {
             }
             let preparation = Task { try await wallet.refreshPublicPaykitEndpoints(includeOnchain: false) }
             await fulfillment(of: [creation.started], timeout: 5)
+            wallet.publicPaykitBolt11PaymentHash = "paid"
+            wallet.rotatePublicPaykitInvoiceIfNeeded(paymentHash: "paid")
             switch state {
             case .replaced: profile.publicKey = "pubky" + String(repeating: "z", count: 52)
+            case .sameKeyNewSession:
+                do {
+                    try await profile.signOut(performSessionCleanup: { throw PublicPaykitError.publicationFailed })
+                } catch PublicPaykitError.publicationFailed {}
             case .sharingDisabled: UserDefaults.standard.set(false, forKey: PublicPaykitService.publishingEnabledKey)
+            case .uiDisabled: UserDefaults.standard.set(false, forKey: PaykitFeatureFlags.uiEnabledKey)
             case .cancelled: preparation.cancel()
             }
             wallet.publicPaykitBolt11 = "ln-retained"

journeys/profile/README.md

@@ -20,6 +20,8 @@ While deletion is held, make a Lightning channel usable or ready, then fail dele
 
 Repeat the held snapshot check while enabling contact payments and while a failed enable restores the previous sharing preference. A late stale publication must remain pending for repair; a successful current publication must acknowledge earlier pending work. Explicit disabling must still remove endpoints and retain failed cleanup for retry.
 
+While enabling contact payments, invalidate the public invoice during address preparation or invoice creation without changing the session. Enabling must re-prepare once and keep sharing enabled after publication. Repeated invalidation must stop with a publication failure, while creation or decoding errors must propagate without retry. Cancellation, identity changes, disabled sharing or UI, and active deletion must not admit replacement preparation. These checks require controlled preparation and invalidation gates beyond the journey runner capabilities.
+
 On iOS, these channel-refresh checks cover public endpoints. Private endpoint preparation retains its existing cleanup and reconciliation behavior.
 
 Hold initial session restoration before sign-in completes, make a Lightning channel usable or ready, then release restoration while public publication remains blocked. Restore readiness or connectivity without another channel event. Normal public maintenance must retain the forced invoice refresh for the restored identity, including after a deferred or failed restoration and a skipped or failed publication. Work retained for the stored identity or an existing signed-in session must not transfer to a replacement identity or a new session for the same key. These checks require restoration, channel and publication gates beyond the journey runner capabilities.