Fix crash due to race condition when initiating AuthenticatedDotcomRequest (#16259)

Author: itsmeichigo

WooCommerce/Classes/System/SessionManager.swift

@@ -54,6 +54,10 @@ final class SessionManager: SessionManagerProtocol {
     ///
     private let imageCache: ImageCache
 
+    /// Serial queue for thread-safe credentials access
+    ///
+    private let credentialsQueue = DispatchQueue(label: "com.woocommerce.session.credentials", qos: .userInitiated)
+
     /// Makes sure the credentials are in sync with the watch session.
     ///
     private lazy var watchDependenciesSynchronizer = {
@@ -76,20 +80,31 @@ final class SessionManager: SessionManagerProtocol {
     ///
     var defaultCredentials: Credentials? {
         get {
-            return loadCredentials()
+            credentialsQueue.sync {
+                loadCredentials()
+            }
         }
         set {
-            guard newValue != defaultCredentials else {
-                return
-            }
+            let shouldUpdateWatchSync = credentialsQueue.sync { () -> Bool in
+                let currentCredentials = loadCredentials()
+                guard newValue != currentCredentials else {
+                    return false
+                }
 
-            removeCredentials()
+                removeCredentials()
 
-            if let credentials = newValue {
-                saveCredentials(credentials)
+                if let credentials = newValue {
+                    saveCredentials(credentials)
+                }
+
+                return true
             }
 
-            watchDependenciesSynchronizer.credentials = newValue
+            // Update watch synchronizer outside the sync block to avoid potential deadlocks
+            // from @Published property triggering Combine subscribers that might read credentials
+            if shouldUpdateWatchSync {
+                watchDependenciesSynchronizer.credentials = newValue
+            }
         }
     }
 
@@ -235,7 +250,7 @@ final class SessionManager: SessionManagerProtocol {
     /// Deletes application password
     ///
     func deleteApplicationPassword(using creds: Credentials?, locally: Bool) {
-        let useCase: ApplicationPasswordUseCase? = {
+        let useCase: ApplicationPasswordUseCase? = credentialsQueue.sync {
             let credentials = creds ?? loadCredentials()
             switch credentials {
             case let .wporg(username, password, siteAddress):
@@ -253,7 +268,7 @@ final class SessionManager: SessionManagerProtocol {
             case .none:
                 return nil
             }
-        }()
+        }
         guard let useCase else {
             return
         }